Renaming policy to user flow

Author: Tiago Brenck

Microsoft.Identity.Web/AzureADB2COpenIDConnectEventHandlers.cs

@@ -12,7 +12,7 @@ namespace Microsoft.Identity.Web
 {
     internal class AzureADB2COpenIDConnectEventHandlers
     {
-        private IDictionary<string, string> _policyToIssuerAddress =
+        private IDictionary<string, string> _userFlowToIssuerAddress =
             new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
 
         public AzureADB2COpenIDConnectEventHandlers(string schemeName, MicrosoftIdentityOptions options)
@@ -28,13 +28,13 @@ public AzureADB2COpenIDConnectEventHandlers(string schemeName, MicrosoftIdentity
         public Task OnRedirectToIdentityProvider(RedirectContext context)
         {
             var defaultUserFlow = Options.DefaultUserFlow;
-            if (context.Properties.Items.TryGetValue(OidcConstants.PolicyKey, out var policy) &&
-                !string.IsNullOrEmpty(policy) &&
-                !string.Equals(policy, defaultUserFlow, StringComparison.OrdinalIgnoreCase))
+            if (context.Properties.Items.TryGetValue(OidcConstants.PolicyKey, out var userFlow) &&
+                !string.IsNullOrEmpty(userFlow) &&
+                !string.Equals(userFlow, defaultUserFlow, StringComparison.OrdinalIgnoreCase))
             {
                 context.ProtocolMessage.Scope = OpenIdConnectScope.OpenIdProfile;
                 context.ProtocolMessage.ResponseType = OpenIdConnectResponseType.IdToken;
-                context.ProtocolMessage.IssuerAddress = BuildIssuerAddress(context, defaultUserFlow, policy);
+                context.ProtocolMessage.IssuerAddress = BuildIssuerAddress(context, defaultUserFlow, userFlow);
                 context.Properties.Items.Remove(OidcConstants.PolicyKey);
             }
 
@@ -43,20 +43,20 @@ public Task OnRedirectToIdentityProvider(RedirectContext context)
 
         private string BuildIssuerAddress(RedirectContext context, string defaultUserFlow, string userFlow)
         {
-            if (!_policyToIssuerAddress.TryGetValue(userFlow, out var issuerAddress))
+            if (!_userFlowToIssuerAddress.TryGetValue(userFlow, out var issuerAddress))
             {
-                _policyToIssuerAddress[userFlow] = context.ProtocolMessage.IssuerAddress.ToLowerInvariant()
+                _userFlowToIssuerAddress[userFlow] = context.ProtocolMessage.IssuerAddress.ToLowerInvariant()
                     .Replace($"/{defaultUserFlow.ToLowerInvariant()}/", $"/{userFlow.ToLowerInvariant()}/");
             }
 
-            return _policyToIssuerAddress[userFlow];
+            return _userFlowToIssuerAddress[userFlow];
         }
 
         public Task OnRemoteFailure(RemoteFailureContext context)
         {
             context.HandleResponse();
             // Handle the error code that Azure Active Directory B2C throws when trying to reset a password from the login page 
-            // because password reset is not supported by a "sign-up or sign-in policy".
+            // because password reset is not supported by a "sign-up or sign-in user flow".
             // Below is a sample error message:
             // 'access_denied', error_description: 'AADB2C90118: The user has forgotten their password.
             // Correlation ID: f99deff4-f43b-43cc-b4e7-36141dbaf0a0

Microsoft.Identity.Web/ClaimsPrincipalExtensions.cs

@@ -11,8 +11,6 @@ namespace Microsoft.Identity.Web
     /// </summary>
     public static class ClaimsPrincipalExtensions
     {
-        // TODO: how to make this work with B2C, given that there is no tenant ID with B2C?
-
         /// <summary>
         /// Gets the Account identifier for an MSAL.NET account from a <see cref="ClaimsPrincipal"/>
         /// </summary>
@@ -23,12 +21,12 @@ public static string GetMsalAccountId(this ClaimsPrincipal claimsPrincipal)
             string userObjectId = claimsPrincipal.GetObjectId();
             string nameIdentifierId = claimsPrincipal.GetNameIdentifierId();
             string tenantId = claimsPrincipal.GetTenantId();
-            string policyId = claimsPrincipal.GetPolicyId();
+            string userFlowId = claimsPrincipal.GetUserFlowId();
 
-            if (!string.IsNullOrWhiteSpace(nameIdentifierId) && !string.IsNullOrWhiteSpace(tenantId) && !string.IsNullOrWhiteSpace(policyId))
+            if (!string.IsNullOrWhiteSpace(nameIdentifierId) && !string.IsNullOrWhiteSpace(tenantId) && !string.IsNullOrWhiteSpace(userFlowId))
             {
                 // B2C pattern: {oid}-{tfp}.{tid}
-                return $"{nameIdentifierId}-{policyId}.{tenantId}";
+                return $"{nameIdentifierId}-{userFlowId}.{tenantId}";
             }
             else if (!string.IsNullOrWhiteSpace(userObjectId) && !string.IsNullOrWhiteSpace(tenantId))
             {
@@ -129,14 +127,14 @@ public static string GetDisplayName(this ClaimsPrincipal claimsPrincipal)
         }
 
         /// <summary>
-        /// Gets the Policy Id associated with the <see cref="ClaimsPrincipal"/>
+        /// Gets the user flow id associated with the <see cref="ClaimsPrincipal"/>
         /// </summary>
-        /// <param name="claimsPrincipal">the <see cref="ClaimsPrincipal"/> from which to retrieve the policy id</param>
-        /// <returns>Policy Id of the identity, or <c>null</c> if it cannot be found</returns>
-        public static string GetPolicyId(this ClaimsPrincipal claimsPrincipal)
+        /// <param name="claimsPrincipal">the <see cref="ClaimsPrincipal"/> from which to retrieve the user flow id</param>
+        /// <returns>User Flow Id of the identity, or <c>null</c> if it cannot be found</returns>
+        public static string GetUserFlowId(this ClaimsPrincipal claimsPrincipal)
         {
-            string policyId = claimsPrincipal.FindFirstValue(ClaimConstants.Tfp);
-            return policyId;
+            string userFlowId = claimsPrincipal.FindFirstValue(ClaimConstants.Tfp);
+            return userFlowId;
         }
 
         /// <summary>

Microsoft.Identity.Web/TokenAcquisition.cs

@@ -247,7 +247,7 @@ public async Task RemoveAccountAsync(RedirectContext context)
             IConfidentialClientApplication app = GetOrBuildConfidentialClientApplication();
             IAccount account = null; 
 
-            // For B2C, we should remove all accounts of the user regardless the policy
+            // For B2C, we should remove all accounts of the user regardless the user flow
             if(_microsoftIdentityOptions.IsB2C)
             {
                 var b2cAccounts = await app.GetAccountsAsync().ConfigureAwait(false);
@@ -376,11 +376,11 @@ private async Task<string> GetAccessTokenOnBehalfOfUserFromCacheAsync(
                 }
             }
 
-            // If is B2C and could not get an account (most likely because there is no tid claims), try to get it by policy
+            // If is B2C and could not get an account (most likely because there is no tid claims), try to get it by user flow
             if (_microsoftIdentityOptions.IsB2C && account == null)
             {
-                string currentPolicy = claimsPrincipal.GetPolicyId();
-                account = GetAccountByPolicy(await application.GetAccountsAsync().ConfigureAwait(false), currentPolicy);
+                string currentUserFlow = claimsPrincipal.GetUserFlowId();
+                account = GetAccountByUserFlow(await application.GetAccountsAsync().ConfigureAwait(false), currentUserFlow);
             }
 
             return await GetAccessTokenOnBehalfOfUserFromCacheAsync(application, account, scopes, tenant).ConfigureAwait(false);
@@ -496,17 +496,17 @@ private static bool AcceptedTokenVersionMismatch(MsalUiRequiredException msalSev
         }
 
         /// <summary>
-        /// Gets an IAccount for the current B2C policy in the user claims
+        /// Gets an IAccount for the current B2C user flow in the user claims
         /// </summary>
         /// <param name="accounts"></param>
-        /// <param name="policy"></param>
+        /// <param name="userFlow"></param>
         /// <returns></returns>
-        private IAccount GetAccountByPolicy(IEnumerable<IAccount> accounts, string policy)
+        private IAccount GetAccountByUserFlow(IEnumerable<IAccount> accounts, string userFlow)
         {
             foreach (var account in accounts)
             {
                 string accountIdentifier = account.HomeAccountId.ObjectId.Split('.')[0];
-                if (accountIdentifier.EndsWith(policy.ToLower()))
+                if (accountIdentifier.EndsWith(userFlow.ToLower()))
                     return account;
             }
 

Microsoft.Identity.Web/WebAppServiceCollectionExtensions.cs

@@ -248,8 +248,8 @@ public static AuthenticationBuilder AddSignIn(
 
                     if (microsoftIdentityOptions.IsB2C)
                     {
-                        // When a new Challenge is returned using any B2C policy different than sisu, we must change
-                        // the ProtocolMessage.IssuerAddress to the desired policy otherwise the redirect would use the sisu policy
+                        // When a new Challenge is returned using any B2C user flow different than susi, we must change
+                        // the ProtocolMessage.IssuerAddress to the desired user flow otherwise the redirect would use the susi user flow
                         await b2COidcHandlers.OnRedirectToIdentityProvider(context);
                     }
 
@@ -263,7 +263,7 @@ public static AuthenticationBuilder AddSignIn(
                     {
                         // Handles the error when a user cancels an action on the Azure Active Directory B2C UI.
                         // Handle the error code that Azure Active Directory B2C throws when trying to reset a password from the login page 
-                        // because password reset is not supported by a "sign-up or sign-in policy".
+                        // because password reset is not supported by a "sign-up or sign-in user flow".
                         await b2COidcHandlers.OnRemoteFailure(context);
 
                         await remoteFailureHandler(context).ConfigureAwait(false);