CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-api
Shelby115
Shelby115

Reputation: 2867

How to check if a user is in an AD group via Azure AD?

Setup Specifications

Startup.cs Configuration

// COOKIES: Tells it to use cookies for authentication.
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    CookieManager = new SystemWebCookieManager()
});

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions()
{
    ClientId = ClientID,
    Authority = Authority,
    PostLogoutRedirectUri = PostLogoutRedirectUri,
    Notifications = new OpenIdConnectAuthenticationNotifications()
    {
        AuthenticationFailed = PrincipalService.OnAzureAuthenticationFailure,
        AuthorizationCodeReceived = (AuthorizationCodeReceivedNotification notification) =>
        {
            var username = notification.AuthenticationTicket.Identity.Name.Split('#').LastOrDefault();
            var emailAddress = notification.AuthenticationTicket.Identity.Claims.FirstOrDefault(x => x.Type.Contains("emailaddress"))?.Value;
            Logger.Log(Level.Auth, $"Azure login success! Username: '{username}' Email: '{emailAddress}'.");
            return Task.FromResult(0);
        }
    }
});

Question

How can I, given this setup, check if the currently logged in user is in a particular AD Group?

What I've tried

All the guides on doing Microsoft Graph API always come up with a problem that I don't know how to get past (e.g. GetAccountsAsync returning empty, etc).

I added the following to our app registration manifest:

"optionalClaims": {
    "idToken": [
        {
            "name": "email",
            "source": null,
            "essential": true,
            "additionalProperties": []
        },
        {
            "name": "groups",
            "source": null,
            "essential": true,
            "additionalProperties": []
        }
    ],
    "accessToken": [],
    "saml2Token": []
}

email works fine, but obviously groups doesn't as it was a shot in the dark.

Upvotes: 3

Views: 10131

Answers (1)

Rohit Saigal
Rohit Saigal

Reputation: 9664

1. Getting Group Membership Claims as part of Token

You can enable group claims to come in as part of the access token for your application by editing your application's manifest (this can be done directly in Azure Portal) and setting "groupMembershipClaims" property to "All" or "SecurityGroup" as needed.

2. Group Ids are returned as part of Claims

Once application manifest is updated as mentioned above, you can get Group Id's as part of claims. Here's a quick sample for a decoded JWT token

enter image description here

3. Limit on the number of groups that can be returned as part of token

To ensure that the token size doesn't exceed HTTP header size limits, Azure AD limits the number of objectIds that it includes in the groups claim. If a user is member of more groups than the overage limit (150 for SAML tokens, 200 for JWT tokens), then Azure AD does not emit the groups claim in the token. Instead, it includes an overage claim in the token that indicates to the application to query the Graph API to retrieve the user's group membership.

4. Relevant Microsoft Graph APIs

NOTE: Working with Microsoft Graph APIs can be pretty powerful, since you can get around overage scenarios as well as get all other kinds of information about groups if needed (like name). In this particular case, since intent is to validate group membership, group Id is the best field as it will not change while others like name can.

Check member groups

This one will be helpful if you already know the groups that you want to check/validate membership in.

 POST https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}/checkMemberGroups

In request body, you can provide groupdIds, i.e. a collection that contains the object IDs of the groups in which to check membership. Up to 20 groups may be specified.

     {
      "groupIds": [
           "fee2c45b-915a-4a64b130f4eb9e75525e",
           "4fe90ae065a-478b9400e0a0e1cbd540"
       ]
     }

user: getMemberGroups

This one will be helpful if you don't already know the group and want to get all the groups that this user belongs to.

POST https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}/getMemberGroups

Here is another related SO Post

Upvotes: 10

Related Questions