Azure ADAL with Web API and Native app

Question

I currently have a Xamarin Forms app correctly logging in and using Microsoft Azure AD for authentication before accessing a web api that is also configured in Azure.

Now I want to add role based authorization like I used to do using IdentityServer 4.0. So within my webapi I put this on my controller:

[Authorize(Roles = "SOMEDOMAIN\\ADGroup")]

So now I'm trying to follow documentation on the web but people aren't being descriptive enough. I have 1 question but let me first explain my setup.

For my Native Xamarin App

Under "Required Permissions

• I've already added Windows Azure Active Directory
• I've already added my web api

I edited the Manifest

• "groupMembershipClaims": "SecurityGroup",

For my Web Api

Under "Required Permissions

• I've already added Windows Azure Active Directory

I edited the Manifest

• "groupMembershipClaims": "SecurityGroup",

Question

1) Within each app above, do I need to enable Read Directory Data for the Windows Azure Active Directory permission? If not, which one needs it?

Answer 1

In the Application Manifest, the "groupMembershipClaims": "SecurityGroup" should add the groups claim to the JWT. Then you just need the ObjectId in Azure AD for the Security Group(s) you are trying to target, discussed in detail here. The group information is part of the id_token, Per the documentation here,

Provides object IDs that represent the subject's group memberships. These values are unique (see Object ID) and can be safely used for managing access, such as enforcing authorization to access a resource. The groups included in the groups claim are configured on a per-application basis, through the "groupMembershipClaims" property of the application manifest. A value of null will exclude all groups, a value of "SecurityGroup" will include only Active Directory Security Group memberships, and a value of "All" will include both Security Groups and Office 365 Distribution Lists.

Also, read there is a very thorough Wiki on the Github repo for the ADAL library here.

Also, here some good resources on that groups claim and the last one is sample solution:

http://www.cloudidentity.com/blog/2013/01/22/group-amp-role-claims-use-the-graph-api-to-get-back-isinrole-and-authorize-in-windows-azure-ad-apps/

https://www.red-gate.com/simple-talk/cloud/security-and-compliance/azure-active-directory-part-4-group-claims/

https://azure.microsoft.com/en-gb/resources/samples/active-directory-dotnet-webapp-groupclaims/