EasyAuth for azure functions not recognising app role correctly in ClaimsPrincipal

Question

I'm trying to hook up azure functions with EasyAuth as it is part of the app service platform. I have configured well and its working fine out-of-the-box when authenticating with azure active directory.

But since I want to add authorization as well, I decided to do this with app_roles using this guide.

Still I cannot use this in my code. Here's my only function in the function app:

using System;
using System.IO;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
using System.Security.Claims;

namespace delme_azf
{
    public static class meh
    {
        [FunctionName("meh")]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
            ILogger log, ClaimsPrincipal claims)
        {

            string name = req.Query["name"];
            req.Headers.TryGetValue("X-MS-TOKEN-AAD-ID-TOKEN", out var jwt);

            if (claims.IsInRole("shizzl"))
            {
                return new OkObjectResult($"shiiiiiiiiiiiiiiiiiiiit {name} {jwt}");
            }
            else
            {
                return new OkObjectResult($"moepppppppp === {jwt} ===");                
            }

        }
    }
}

As you can see, I injected the ClaimsPrincipal, as is advertised here. And according to this I should be able to check for the existence of a role with claims.IsInRole("shizzl") but this ALWAYS return false (shizzl is the name of my role). But as you can also see, I am returning the jwt in the response as well, if I put this in https://jwt.ms the role is there!

Any guess as to why it's not working via the ClaimsPrincipal approach? Any help is really appreciated.

alphaz18 alphaz18 · Accepted Answer · 2020-05-16T04:47:44

you are correct that "roles" it is in the claims, however. according to the documentation, isinrole does not work as you expect. it looks for role types as per the claimidentity

Each ClaimsIdentity has its own definition of the claim type that represents a role. This claim type can be accessed and set through the ClaimsIdentity.RoleClaimType property.

by default the roleclaimtype is something like "ClaimsType.Role" where as the claims type in the jwt is "roles" it doesn't match so it doesn't consider it a role claim when you call isinrole

you can try to set the claimsidentity roleclaimtype or you can search for the claim using a different method like claims.hasclaim("roles","shizzl") . that will work too?

Hopefully this helps you.

EasyAuth for azure functions not recognising app role correctly in ClaimsPrincipal

1 Answers