Connecting Entra External ID as an SP to Azure AD B2C via SAML

ExternalIDSigninSAML.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="tenant.onmicrosoft.com" PolicyId="B2C_1A_ExternalIDSigninSAML" PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_ExternalIDSigninSAML" DeploymentMode="Development" UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">

	<BasePolicy>
		<TenantId>tenant.onmicrosoft.com</TenantId>
		<PolicyId>B2C_1A_TrustFrameworkExtensionsSAMLMeta</PolicyId>
	</BasePolicy>

	<BuildingBlocks>

		<ClaimsSchema>
			<ClaimType Id="emailaddress">
				<DisplayName>Email Address</DisplayName>
				<DataType>string</DataType>
				<DefaultPartnerClaimTypes>
					<Protocol Name="OpenIdConnect" PartnerClaimType="emailaddress" />
					<Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
				</DefaultPartnerClaimTypes>
				<UserHelpText>Email address that can be used to contact you.</UserHelpText>
				<UserInputType>TextBox</UserInputType>
				<Restriction>
					<Pattern RegularExpression="^[a-zA-Z0-9!#$%&amp;'+^_`{}~-]+(?:\.[a-zA-Z0-9!#$%&amp;'+^_`{}~-]+)*@(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$" HelpText="Please enter a valid email address." />
				</Restriction>
			</ClaimType>
		</ClaimsSchema>

		<ClaimsTransformations>
			<ClaimsTransformation Id="CopyEmailAddress" TransformationMethod="CopyClaim">
				<InputClaims>
					<InputClaim ClaimTypeReferenceId="signInName" TransformationClaimType="inputClaim"/>
				</InputClaims>
				<OutputClaims>
					<OutputClaim ClaimTypeReferenceId="emailaddress" TransformationClaimType="outputClaim"/>
				</OutputClaims>
			</ClaimsTransformation>
		</ClaimsTransformations>
	</BuildingBlocks>

	<ClaimsProviders>
		<ClaimsProvider>
			<DisplayName>Copy</DisplayName>
			<TechnicalProfiles>
				<TechnicalProfile Id="CopyEmail">
					<DisplayName>Copy email</DisplayName>
					<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="email" />
					</OutputClaims>
					<OutputClaimsTransformations>
						<OutputClaimsTransformation ReferenceId="CopyEmailAddress" />
					</OutputClaimsTransformations>
					<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
				</TechnicalProfile>

				<TechnicalProfile Id="AAD-UserReadUsingObjectId">
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
					</OutputClaims>
					<IncludeTechnicalProfile ReferenceId="AAD-Common" />
				</TechnicalProfile>

			</TechnicalProfiles>
		</ClaimsProvider>

		<ClaimsProvider>
			<DisplayName>Session Management</DisplayName>
			<TechnicalProfiles>
				<TechnicalProfile Id="Saml2AssertionIssuer">
					<DisplayName>Token Issuer</DisplayName>
					<Protocol Name="SAML2"/>
					<OutputTokenFormat>SAML2</OutputTokenFormat>
					<Metadata>
						<Item Key="IssuerUri">https://tenant.b2clogin.com/tenant.onmicrosoft.com/B2C_1A_ExternalIDSigninSAML</Item>
						<Item Key="TokenNotBeforeSkewInSeconds">600</Item>
						<Item Key="NameIDFormat">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</Item>
					</Metadata>
					<CryptographicKeys>
						<Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SAMLExtID"/>
						<Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SAMLExtID"/>
						<Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SAMLExtID"/>
					</CryptographicKeys>
					<InputClaims/>
					<OutputClaims/>
					<UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml"/>
				</TechnicalProfile>

				<!-- Session management technical profile for SAML based tokens -->
				<TechnicalProfile Id="SM-Saml">
					<DisplayName>Session Management Provider</DisplayName>
					<Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
				</TechnicalProfile>
			</TechnicalProfiles>
		</ClaimsProvider>
	</ClaimsProviders>

	<UserJourneys>

		<UserJourney Id="SignUpOrSignInSAML">
			<OrchestrationSteps>

				<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
					<ClaimsProviderSelections>
						<ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" />
						<ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
					</ClaimsProviderSelections>
					<ClaimsExchanges>
						<ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- Check if the user has selected to sign in using one of the social providers -->
				<OrchestrationStep Order="2" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH" />
						<ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- For social IDP authentication, attempt to find the user account in the directory. -->
				<OrchestrationStep Order="3" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>authenticationSource</Value>
							<Value>localAccountAuthentication</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
          This can only happen when authentication happened using a social IDP. If local account was created or authentication done
          using ESTS in step 2, then an user account must exist in the directory by this time. -->
				<OrchestrationStep Order="4" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
          in the token. -->
				<OrchestrationStep Order="5" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>authenticationSource</Value>
							<Value>socialIdpAuthentication</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
             from the user. So, in that case, create the user in the directory if one does not already exist 
             (verified using objectId which would be set from the last step if account was created in the directory. -->
				<OrchestrationStep Order="6" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<OrchestrationStep Order="7" Type="ClaimsExchange">
					<ClaimsExchanges>
						<ClaimsExchange Id="Copy" TechnicalProfileReferenceId="CopyEmail" />
					</ClaimsExchanges>
				</OrchestrationStep>

				<OrchestrationStep Order="8" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer"/>

			</OrchestrationSteps>
			<ClientDefinition ReferenceId="DefaultWeb" />
		</UserJourney>

	</UserJourneys>

	<RelyingParty>
		<DefaultUserJourney ReferenceId="SignUpOrSignInSAML"/>

		<!-- <Endpoints>
			points to refresh token journey when app makes refresh token request
			<Endpoint Id="Token" UserJourneyReferenceId="RedeemRefreshToken"/>
		</Endpoints>	 -->

		<UserJourneyBehaviors>
			<JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="410...5d0" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0"/>
		</UserJourneyBehaviors>

		<TechnicalProfile Id="PolicyProfile">
			<DisplayName>PolicyProfile</DisplayName>
			<Protocol Name="SAML2"/>
			<Metadata>
				<!-- Action required: Set the value PartnerEntity to URL of SP metadata or embed the metadata directly, using <![CDATA[]]> -->
				<Item Key="PartnerEntity">https://tenant.ciamlogin.com/federationmetadata/saml20/federationmetadata.xml</Item>
			</Metadata>

			<OutputClaims>
				<OutputClaim ClaimTypeReferenceId="displayName" />
				<OutputClaim ClaimTypeReferenceId="givenName" />
				<OutputClaim ClaimTypeReferenceId="surname" />
				<OutputClaim ClaimTypeReferenceId="emailaddress" />
				<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
				<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="" />
				<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="objectId"/>
			</OutputClaims>
			<SubjectNamingInfo ClaimType="objectId" ExcludeAsClaim="true"/>
		</TechnicalProfile>
	</RelyingParty>
</TrustFrameworkPolicy>

https://medium.com/the-new-control-plane/connecting-entra-external-id-as-an-sp-to-azure-ad-b2c-via-saml-eda6c648e4cd