title: Verify email before authenticating using Azure B2C auth service
body: <p><strong>Situation</strong></p>
  
  <p>I want to use Azure B2C auth service for my web app. However, I want the admins of the app to restrict access to certain emails or domains e.g. a whitelist as follows:</p>
  
  <ul>
  <li>tom1@abc.com</li>
  <li>tom2@def.com</li>
  <li>*@alphabet.com</li>
  </ul>
  
  <p>So only the top two emails and anyone else with an email ending in "alphabet.com" can access the site.</p>
  
  <p><strong>Problem</strong> </p>
  
  <p>I have everything implemented and it's working correctly, however I'm struggling to get the email address of the authenticated user to do the whitelist check during the signon/signin process. The AuthenticationTicket has all the claims requested (FirstName, LastName, Name, Object Identifer etc.), but the email is not present (It has been setup in Azure B2C as a claim). </p>
  
  <p>How can I access the email and is this the right place to be checking?</p>
  
  <p>Code in <code>Startup.App.cs</code></p>
  
  <pre><code>private OpenIdConnectAuthenticationOptions CreateOptionsFromPolicy(string policy)
  {
      return new OpenIdConnectAuthenticationOptions
      {
          // For each policy, give OWIN the policy-specific metadata address, and
          // set the authentication type to the id of the policy
          MetadataAddress = String.Format(aadInstance, tenant, policy),
          AuthenticationType = policy,
  
          // These are standard OpenID Connect parameters, with values pulled from web.config
          ClientId = clientId,
          RedirectUri = redirectUri,
          PostLogoutRedirectUri = redirectUri,
          Notifications = new OpenIdConnectAuthenticationNotifications
          {
              AuthenticationFailed = AuthenticationFailed,
              AuthorizationCodeReceived = (context) =&gt;
              {
                  // no claims present here
                  return Task.FromResult(0);
              },
              SecurityTokenReceived = (context) =&gt;
              {
                  // no claims present here
                  return Task.FromResult(0);
              },
              SecurityTokenValidated = (context) =&gt;
              {
                  // print all claims - quite a few except email :( Is this where this check should be done?
                  foreach (var claim in context.AuthenticationTicket.Identity.Claims)
                  {
                      Console.WriteLine(claim.Value);
                  }
                  return Task.FromResult(0);
              },
          },
          Scope = "openid",
          ResponseType = "id_token",
  
          // This piece is optional - it is used for displaying the user's name in the navigation bar.
          TokenValidationParameters = new TokenValidationParameters
          {
              NameClaimType  = "name"
          },
      };
  }
  </code></pre>
  
  <p>Any help greatly appreciated. </p>