ASP.NET MVC using Azure AD authentication — how to allow users to administer group/role assignments?

0
votes

I'm developing an ASP.NET MVC application and using Azure AD for single sign on. I'm at a point where I'm looking at how to handle user roles for authorization. I understand that I can create roles or groups from inside the Azure portal, but everything I've read seems to suggest that the only way to add or remove people to those groups or roles is from within the portal. But we don't want to be in a situation where our developer group is handling role/permission assignments for this application's users.

What I really want is some sort of interface within the application where an Admin can select an AD user, select one (or more) of the application's roles, and add the user into those roles.

Is there a way to pull a list of available application roles from Azure AD, then send back which of those roles should get attached to a user? Most of the documentation I've seen seems to assume that you have a pre-defined list of users that you manage through the portal.

Should I be using separate tables in ASP.NET Identity? I had hoped Azure AD integration would allow me to skip having a database user store.

1
c#asp.net-mvcazureazure-active-directory
You can make calls to Microsoft Graph API (or Azure AD Graph API). At a high level your app would need to do the following to assign a role: Get the roles defined by the Application object, get the application's corresponding service principal, then create an appRoleAssignment for each user + role combination you want to add, referencing the user's object id, the role's id, and the service principal's object id. – juunas

1 Answers

0
votes

Take a look at https://github.com/Azure-Samples/active-directory-dotnet-webapp-groupclaims . The code and ADAL reference can certainly be updated as it's quite old, but this should serve as a good starting point.