CODEWITHSUNDEEP
asp.net-mvcazureactive-directory
jrizzo
jrizzo

Reputation: 1692

How can I get roles from AD with MVC Azure AD Authentication?

I setup and MVC 4 application and added authentication against our Azure AD server as outlined here: http://msdn.microsoft.com/en-us/library/windowsazure/dn151790.aspx

Authentication works as expected. However, I'm not getting any roles back by default. There should be several AD groups created and I would like to use them to role restrict the application via the [Authorize] attribute in MVC.

I can't really find a good place to even start figuring this out. Can anyone give me an outline or point me to a good tutorial?

I should mention that I'm not the administrator for our Azure account, so I need to be able to tell our admin what to do if any setup is required on that side.

Upvotes: 8

Views: 7731

Answers (2)

Mariusz Pawelski
Mariusz Pawelski

Reputation: 28852

Sean answer is a bit outdated. You can now configure Azure AD so it will include groups or roles inside JWT token so it will be included into ClaimsPrincipal.Current.Claims so standard [Authorize(Roles = "yourRoleName")] attribute will work.

Here is introduction post. Which basically says you have two options:

  1. Use groups claim - you need to change groupMembershipClaims value in app manifest and later in application you can check for ClaimsPrincipal.Current.FindFirst("groups").Value to see in what group user is (you only get group id). You can write you own Authorize attribute that use this. more info

  2. Define roles for you application and then use normal code for testing if user is in role:

    [PrincipalPermission(SecurityAction.Demand, Role = “yourRoleName”)]

    [Authorize(Roles = “yourRoleName”)]

    if (ClaimsPrincipal.Current.IsInRole(“yourRoleName”)) { //do something }

    You need to edit roles in you app's manifest. More info here and here. Values needed to be set in manifest are described here

What is really strange is that you can't assign more than one role to group from Azure web page. You need to use azure graph api for this.

If you can't see Users and Groups tab in Azure portal you probably need Azure AD Basic or Premium edition. If you are working on free azure subscription you can use free Azure AD Premium trial to test stuff.

Upvotes: 9

Sean Osterberg
Sean Osterberg

Reputation: 844

First, tokens returned by Azure AD do not currently contain claims for roles or groups, so you need to get them from the Graph API. Second, roles in Azure AD that are returned by the Graph API are not necessarily intended for use in an ISV/LoB app, and in general you should use security groups for authorization instead. To perform authorization, you should use the checkMemberGroups or getMemberGroups operations in the Graph API, which are transitive and valid for this purpose.

If you check out the following resources in order, I think your questions will be answered. You'll learn how to authenticate to the Graph, call it, and configure your application to use the result of the group operations to perform authorization:

Upvotes: 9

Related Questions