How do I authorize based on nested Azure AD groups? - asp.net-core

Question

I'm working on an ASP.NET Core MVC website for internal use at my company. It contains a variety of web-based tools, each of which has its own set of permissions for who can access it. My authorization is based on Azure Active Directory groups. My setup has been working well for authorizing based on direct members of groups, but now I want to start using nested groups, and it's not working.
In the example below, I have the group "View Report" which determines who has access to view a particular report. This group contains a handful of individuals, plus a group that contains the entire IT team.
Unfortunately, this approach isn't working because my group claims don't include the View Report group, because I'm not a direct member.
Here is my authentication setup code in Program.cs:
// Sign in users with the Microsoft identity platform
var initialScopes = new string[] { "User.Read", "GroupMember.Read.All" };
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(
options =>
{
builder.Configuration.Bind("AzureAd", options);
options.Events = new OpenIdConnectEvents();
}, options => { builder.Configuration.Bind("AzureAd", options); })
.EnableTokenAcquisitionToCallDownstreamApi(options => builder.Configuration.Bind("AzureAd", options), initialScopes)
.AddMicrosoftGraph(builder.Configuration.GetSection("GraphAPI"))
.AddInMemoryTokenCaches();
// Add policies to authorize by Active Directory groups
builder.Services.AddAuthorization(options =>
{
AddPoliciesForEachGroup(options);
});
void AddPoliciesForEachGroup(AuthorizationOptions options)
{
var allGroups = builder.Configuration.GetSection("Groups").GetChildren().ToDictionary(x => x.Key, x => x.Value);
foreach (var group in allGroups)
{
options.AddPolicy(group.Key, policy =>
policy.RequireAssertion(context => context.User.HasClaim(c =>
c.Type == "groups" && c.Value == group.Value)));
}
}
Relevant part of appsettings:
"Groups": {
"ViewReport": "5daa2626-5352-441d-98cc-0b59589dbc6d"
// other groups for other tools...
}
I'm not sure what to do about this. Is there any way to include nested groups in my user claims? Or am I completely off base with this entire approach? I don't know a whole lot about Azure AD (I just followed a tutorial to achieve my current setup) and I acknowledge that I'm lacking a lot of foundational knowledge, so I'm hoping someone can at least point me in the right direction for how to solve this problem, even if it involves a totally different approach to authentication.
(Note: I know that I can achieve authentication for multiple groups by making the code check for multiple specific groups, but I would prefer a solution that allows me to freely add and remove groups in AAD without making code/configuration changes.)

Answer 1

Here's a sample.
In Program.cs:
JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration)
.EnableTokenAcquisitionToCallDownstreamApi(new string[] { "User.ReadWrite.All" })
.AddMicrosoftGraph(builder.Configuration.GetSection("DownstreamApi"))
.AddInMemoryTokenCaches()
.AddDownstreamWebApi("DownstreamApi", builder.Configuration.GetSection("DownstreamApi"))
.AddDistributedTokenCaches();
builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
options.TokenValidationParameters.RoleClaimType = "groups";
});
// Adding authorization policies that enforce authorization using Azure AD roles.
builder.Services.AddAuthorization(options =>
{
// this policy stipulates that users in both GroupMember and GroupAdmin can access resources
options.AddPolicy("MemberGroupRequired", policy => policy.RequireRole(builder.Configuration["Groups:GroupMember"], builder.Configuration["Groups:GroupAdmin"]));
// this policy stipulates that users in GroupAdmin can access resources
options.AddPolicy("AdminGroupRequired", policy => policy.RequireRole(builder.Configuration["Groups:GroupAdmin"]));
});
In appsetting.json:
"Groups": {
"GroupAdmin": "group_object_id",
"GroupMember": "group_object_id"
},
In Controller, add attribute [Authorize(Policy = "AdminGroupRequired")] before action method.
With this code, when my user account is a member of "GroupAdmin", then I can access this action. When my user account is a member of the nested group("GroupMember" in my demo) of GroupAdmin, I can access this action as well. But if my user account is a member of neither "GroupAdmin" or "GroupMember", then I can't access this action method.
This method is adding all allowed groups into one policy. In your scenario, you should set object id of "ViewReport" and "entire IT team" group.