Add Azure Active Directory Groups to Claims

0
votes

We are migrating an application which consists of an Angular Frontend and a ASP.NET Core 2.1 Web Api Backend running on .NET Framework 4.6.2 from on premises to Azure.

The application uses Active Directory Groups for authorization purposes.

To facilitate the migration process we would like to use the same groups which are synchronized to Azure Active Directory.

Authentication works fine but when i inspect the claims in the User Object within a Web Api Controller i can't find any group claims in it.

The only group-related claim i see in the User Object is one named "hasGroups" with the value true, but i need to know which groups the user is part of.

I know i can query AD via Graph API but i would prefer a seamless way if the service can provide this info directly.

Update: I use MSAL 1.0 and implicit flow in my Angular Frontend to authenticate the user and gain an access token to authenticate the calls to the Web Api.

Update 2: This is the configuration of the backend api:

  • I applied the following configuration in the "Token configuration" page

token configuration

  • I created a client secret in the "Certificates & secrets" page client secret

  • i created a scope in the "Expose an API" tab and added the client application to it expose an api page

  • i added API permissions api permissions

In the frontend app i activated the options for "access tokens" and "ID tokens" in the Authentication page: Authentication options in frontend app and i configured the redirect url on the same page redirect url

Update 3: I upgraded the backend to .net 5 and can still reproduce the problem (no roles in claims collection).

2
azureasp.net-coreazure-active-directorymsal

2 Answers

1
votes

Per my understanding, you want to get all groups that the current login user in as token claims. Seems you are in the right direction, but make sure that you are configuring the ASP.NET Core 2.1 Web Api Azure AD application instead of your Angular Frontend Azure AD application.

I also did some test on my side and this is my token config of ASP.NET Core 2.1 Web Api Azure AD application: enter image description here

I call Azure AD /token endpoint to mock user login:

enter image description here Client ID is Angular Frontend Azure AD APP ID and ASP.NET Core 2.1 Web Api Azure AD application here is 01abd597-4b2f-478e-bbb1-6d8759099346

parse the token: enter image description here

As you can see groups claim has been added to the token.

Let me know if you have any questions.

UPDATE Request Result:

enter image description here

1
votes

It seems to me, that the main problem was, that the user i tried to log in is part of more than 5 groups. In this case, the groups are not added to the claims but instead i only get the mentioned "hasGroups" entry.

This StackOverflow issue pointed me into this direction.

So for cases where your users could have more than 5 AD groups, you will have to query the groups manually using MS Graph or find another place to store your groups.