Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Azure AD does not emit group claims

I am trying to set up role based access via groups for my application on azure. I've followed following articles (Sorry for posting links as code, wasn't allowed to post more than 1 link). However my app doesn't receive any group claims.

https://www.simple-talk.com/cloud/security-and-compliance/azure-active-directory-part-4-group-claims/

http://www.dushyantgill.com/blog/2014/12/10/roles-based-access-control-in-cloud-applications-using-azure-ad/

What I've done so far

Manifest file

    "appId": "d754a979-689d-45f8-8c63-983de55840da"
"appRoles": [
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "Manager",
      "id": "1e06dae5-467a-40cf-a9a6-14baf3969472",
      "isEnabled": true,
      "description": "Manages",
      "value": "Manager"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "Issuer",
      "id": "da85f458-720d-4c09-861f-92f5c465ee3e",
      "isEnabled": true,
      "description": "Issues",
      "value": "Issuer"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "displayName": "Supervisor",
      "id": "d64807d4-6e12-4637-a049-2a61b250507b",
      "isEnabled": true,
      "description": "Can perform any function",
      "value": "Supervisor"
    }
  ],
  "availableToOtherTenants": false,
  "displayName": "traffic",
  "errorUrl": null,
  "groupMembershipClaims": "SecurityGroup",
  "homepage": "https://myapp.ca",
  "identifierUris": [
    "https://myapp.azurewebsites.net/"
  ],

Also added relevant groups to app on azure (assume that the group contains at least one user) Groups Assignment on Azure

But I don't get any group claims in my app. The following code results in a count of zero, always. Any ideas? Thanks in advance.

var claims = ClaimsPrincipal.Current.Claims.Where(c => c.Type == "groups");

            Debug.Print("Total Group Claims in HomeController #### "+claims.Count());

            foreach (Claim c in claims)
            {
                Debug.Print("%%%%%%%% " + c.Value + " %%% VALUETYPE %%% " + c.Type);
            }
like image 409
Madcap Avatar asked Sep 13 '25 01:09

Madcap


1 Answers

Problem solved. I was barking up the wrong app profile. There are numerous apps registered with my AD (sandbox, testing etc.). Turns out that I was editing the wrong profile. The steps I mentioned in my problem do work. Thanks @Fei Xue - MSFT for your time and help.

like image 191
Madcap Avatar answered Sep 15 '25 14:09

Madcap