Blazor Authentication with Azure AD - Retrieving User Roles

4
votes

I've successfully setup a Blazor application to authenticate with the Azure tenant where I work. The authentication works beautifully. I have the App Registration setup in Azure with appRoles defined in the manifest. I've add a few users to the application with those roles assigned however I'm not getting any Role claims back on the user context after it authenticates.

Startup.cs

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
                .AddAzureAD(options => Configuration.Bind("AzureAd", options));


        services.AddControllersWithViews(options =>
        {
            var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();
            options.Filters.Add(new AuthorizeFilter(policy));

        });

Manifest:

"appRoles": [
    {
        "allowedMemberTypes": [
            "User"
        ],
        "description": "Coming soon.",
        "displayName": "Viewer",
        "id": "{guid goes here}",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "Viewer"
    },
    {
        "allowedMemberTypes": [
            "User"
        ],
        "description": "Coming soon.",
        "displayName": "Manager",
        "id": "{guid goes here}",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "Manager"
    }
],

I'm trying to retrieve those roles with the claims after authentication, but no roles are coming through. This is obviously making IsInRole not work and for the life of me I can't find any samples of code to achieve this.

I would greatly appreciate it if someone could point me in the right direction!

1
azure-active-directoryblazor
Which blazor do u use, server-side ou wasm ? – agua from mars
I use server side – Tim Southard
I added my startup code to the original post. – Tim Southard
Can you post the code and the context where you try to read user's roles. Is it in component, in a webapi method ? – agua from mars
You can make a separate call to the Microsoft Graph to get this information (as a separate call) – Michael Washington

1 Answers

0
votes

If the user has been assigned application roles, it should be returned in the id token. You can decode the id token by using https://jwt.io/.

enter image description here

I didn't find a blazor sample, but you can refer to this aspnetcore sample.