Calculate the Azure AD B2C hash claims transformation locally using PowerShell

The Azure AD B2C hash claims transformation takes the following form:

<ClaimsTransformation Id="MyHashClaimsTransformation" TransformationMethod="Hash">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="myPlaintext" TransformationClaimType="plaintext" />
    <InputClaim ClaimTypeReferenceId="mySalt" TransformationClaimType="salt" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="randomizerSecret" DataType="string" Value="B2C_1A_MyRandomizerSecret" />
  </InputParameters>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="myHash" TransformationClaimType="hash" />
  </OutputClaims>
</ClaimsTransformation>

Technically the hash claims transformation is the Base64 encoded SHA256 hash of the UTF8 encoded bytes of a string composed of these input claim and parameter components in the form {randomizerSecret}{plaintext}{salt}. You can calculate it locally with PowerShell as follows which results in the hash Sfsxeci8gzm1nbLn4Vl3F/zOoOqRJ1GbQicKTg5v3i0=:

$randomizerSecret = 'randomizerSecret'
$plaintext = 'plaintext'
$salt = 'salt'

[Convert]::ToBase64String([Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes("${randomizerSecret}${plaintext}${salt}")))

maskati/#aad-b2c-hash.md