Get azure ad user group by @azure/msal-angular library in angular 8

Question

I am using @azure/msal-angular. Using loginRedirect() to redirect to microsoft login page and i am getting the response with access_token and group IDs. But i need group details to implement access control in my application. Is there any extra config setting required to get the group details.

my config:

MsalModule.forRoot({
  clientID: <clientId>,
  authority: `https://login.microsoftonline.com/<tenantId>`,
  redirectUri: "http://localhost:4200/",
  cacheLocation: "localStorage",
  popUp: !isIE,
  consentScopes: ["user.read", "api://<clientID>/GFS_EClaims_UI"],
  storeAuthStateInCookie: false,
  postLogoutRedirectUri: "http://localhost:4200/",
  protectedResourceMap: protectedResourceMap
})

or To get the group details, do i need to make a call to the Microsoft graph api after loginRedirect()?

Thanks in advance!

Tom Luo Tom Luo · Accepted Answer · 2019-10-23T10:08:25

You cannot get group details from the token. You can only get the group Ids like below in the claims:

{
  "groups": ["1ce9c55a-9826-4e32-871c-a8488144bb32"]
}

For supported claimes in access token, refer to https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens#claims-in-access-tokens

But to control access of your application, I don't think your need group details. You can just use group ids to decide if the user has permission to the resource.

A better way is to combine Groups and Roles. You can define some applciation roles and assign the roles to the groups. Then the users in the group will have the claim like below:

{
  "roles": ["admin"]
}

Then you can implement your authorization logic based on the roles of the user.

Refer to https://joonasw.net/view/using-groups-vs-using-app-roles-in-azure-ad-apps and https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps for more details

Get azure ad user group by @azure/msal-angular library in angular 8

1 Answers