Azure AAD Role Based Authentication, User.IsInRole()

Question

I am using Azure AD role based authentication, I have added 2 roles ( Observer, Reader ) which are assigned to specific users which works fine. The manifest file has these 2 new entries in it. All the authentication is working normally, but I cannot get the User.IsInRole() to return true, always returns false

I have added the following code to the Startup.cs

app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = SettingsHelper.ClientId,
                    Authority = String.Format(CultureInfo.InvariantCulture,SettingsHelper.AADInstance, SettingsHelper.TenantId), 
                                                                                                                                                  PostLogoutRedirectUri = SettingsHelper.PostLogoutRedirectUri,

                    TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
                    {
                        // map the claimsPrincipal's roles to the roles claim
                        RoleClaimType = "roles",
                    },
}

When I query User.IsInRole("Observer") it returns false. I can see the claim in my debug session of User

{http://schemas.microsoft.com/ws/2008/06/identity/claims/role: Observer}

But not able to access it, is this a common problem am I doing something wrong?

Here is my USER session var

Thanks

Answer 1

{http://schemas.microsoft.com/ws/2008/06/identity/claims/role: Observer}

How did you add the custom role? Here are the steps which work for me to add the custom roles for your reference:

1. register the apps on Azure AD
2. modify its manifest to add the custom role like below:

"appRoles": [
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "Orders",
      "id": "51e10148-16a8-432a-b86d-ef620c3e48ed",
      "isEnabled": true,
      "description": "Oders can rise a order request",
      "value": "Orders"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "Admin",
      "id": "51e10148-16a8-432a-b86d-ef620c3e48ec",
      "isEnabled": true,
      "description": "Admins can manage roles and perform all task actions.",
      "value": "Admin"
    }
  ],

3. assign the role to users through the portal
4. using the code as in your orignal post to integrate the web app with Azure

  app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = clientId,
                    Authority = authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri,
                    RedirectUri = postLogoutRedirectUri,
                    TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
                    {
                        // map the claimsPrincipal's roles to the roles claim
                        RoleClaimType = "roles",
                    },
                });

Then we can get the roles as figure below:

Answer 2

I had exactly the same problem and the answer for me was to do what @juunas is saying in his comment on your original question here: Azure AAD Role Based Authentication, User.IsInRole()

So literally change that line in your Startup.Auth.cs, so it now becomes:

TokenValidationParameters = new 
System.IdentityModel.Tokens.TokenValidationParameters
{   
    // map the claimsPrincipal's roles to the roles claim
    RoleClaimType = 
        "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
},

@juunas - thank you very much for your help.

Answer 3

By default, the claims mapping will map claim names in the old format to accommodate older SAML applications. The default mapping is 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' instead of 'roles'. So you can use this:

public void ConfigureServices(IServiceCollection services)
{
    // This is required to be instantiated before the OpenIdConnectOptions starts getting configured.
    JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
    ...
}