[Feature Request] [2L] Expose tenant profiles in IAccount and ID token claims in the AuthenticationResult

Is your feature request related to a problem? Please describe. Several customers want to get the ID token claims in the authentication result. See for instance #2580.

Describe the solution you’d like

• The AuthenticationResult could expose a new method .GetIdTokenClaims() returning a ClaimsPrincipal as this is the data structure which is commonly used in .NET - see #2584
• More generally, we’d want that IAccount exposes TenantProfiles
• Update API review with .NET and Java design

interface IAccount
{
 // current members

 /// <summary>
 /// Get the information about the account in each tenant, keyed by tenant Id
 /// </summary>
 IDictionnary<string, ITenantProfile> TenantProfiles { get; }
}

interface ITenantProfile
{
  /// <summary>
  /// Get object if of the account in this tenant
  /// </summary>
  public string Oid {get;}

  /// <summary>
  /// Get the tenant ID
  /// </summary>
  public string TenantId {get;}

  /// <summary>
  /// Get the claims of the ID token for the account in this tenant
  /// </summary>
  public ClaimsPrincipal Claims {get;}

  /// <summary>
  /// Is the tenant the home tenant of the user?
  /// </summary>
  public bool IsHomeTenant {get;}
}

Additional context

• Tenant profile is a consistency item … See the API review spec / design for Android: Account & Tenant Profiles
• This is mostly for public client applications, or applications that don’t use ASP.NET / ASP.NET Core as these framework already populate the .User.

[jmprieur]

@neha-bhargava @bgavrilMS What would be the point for us of having a hidden APIs. Our customers want to get the claims.

I would think that, in Java, this is related to the fact that they support front line workers, and have explicitly multi-tenant accounts. In MSAL.NET I’d say, we expose the API directly, and if there is only one tenant, there is only one tenant?

Is there code that I can try out? I see only this branch (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/tree/nebharg/AddTokenIdClaims), but this is pretty old?

[bgavrilMS]

Not sure this can be done for Confidential Client due to not checking signatures, continuing discussions offline.