I have an application registered on Azure AD. The application has been configured to include groups claim on Token Configuration section on Azure Portal. When I access to the application, follow the process to authenticate against AzureAD, and access to an Controller endpoint, I see that the Claims for the user property does not have the groups. Instead, I'm getting a property, hasgroups, defined with true.
I'm assigned to 89 groups, I don't know if there's any limitation about the number of groups and for that reason Azure change the claims (instead one for each group, it's emitting one with the boolean value I have told you).
This situation happens with an organization tenant. I have test the same with my own tenant on Azure and I'm getting the groups. But in my own tenant I'm assigned only to 2 groups. This is the reason I've highlighted the number of groups i belongs to in my organization.
There is a limitation to how many groups can be returned due to size limitations of tokens.
You must always be ready to query for user groups from MS Graph API, e.g. with:
Get group members: https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http
Get user groups: https://learn.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0&tabs=http
Check group access for user: https://learn.microsoft.com/en-us/graph/api/user-checkmembergroups?view=graph-rest-1.0&tabs=http
If you get the hasgroups claim, you need to query for groups.
Related
I have created an App role for my AZURE AD Backend Api and assigned this role to a group. Now I want to authenticate user in my .net core backend application on the basis if user has a group which has this role. I am getting the group ids in the access token but how can I get app roles assigned to these groups.
Please check how you enabled group claims in Azure Portal.
If you check the Emit groups as role claims option like below you cannot see application roles, but you can see group ids.
If the above option is enabled, make sure to uncheck the box.
Note
If you use the option to emit group data as roles, only groups will
appear in the role claim. Any application roles that the user is assigned to won't appear in the role claim.
Also, I would suggest you refer to this Microsoft official documentation below which states that if you add a service principal to a group, and then assign an app role to that group, Azure AD does not add the roles claim to tokens it issues.You can modify the “groupMembershipClaims” field in application manifest if you want to include groups claim in your token like below: -
Add app roles to your application and receive them in the token
For more in detail, please refer below link:
Configure group claims for applications by using Azure Active Directory
There are 2 call end points given by the Linkedin API
v2/adAccountsV2?q=search
v2/adAccountUsersV2?q=authenticatedUser
that are used to fetch ad Accounts of a user. What is the difference between the two although the purpose of those two seems the same?Are there any benefits of one over the other?
Ad Account Users API allows to manage user access to Ad Accounts, read more here.
Ad Accounts API is mainly for Enterprise or Business Ads Account holders, not personals.
When it stands to fetching Ad Accounts by some criteria then those methods performs different jobs and returns different JSON data structure.
If you want to retrieve the business Ad Accounts by ID, name, reference, type, and status fields then you can use /v2/adAccountsV2?q=search call and append to it all the required parameters. See more details here.
If you require to find Ad Accounts by an authenticated user then you will need to call /v2/adAccountUsersV2?q=authenticatedUser and it will return the Ad Accounts associated with a member whose access token is being passed for the API call.
Here is the scenario, I have a service containing many records. My service also has many users, each with the ability to create, read, update and delete records. The ability to perform these operations on each record must be controlled at the record level.
For example, user A can only read and update record 1 but user B can read, update and delete records 1, 2 and 3 and user C can perform all operations on all records.
How if at all, can this be done using Azure AD?
Obviously, using application roles is not sufficient because that gives the user uniform access rights to all records.
The tenant is also not useful because its the same for all users (in this example).
I definitely do not want to define access rights for every record individually, I would like to do something like assigning roles to a user group and then somehow assign records to the group.
Is there a standard way to deal with this type of resource based authorization?
As you correctly mention, role based access or authorization is very generic and using that, a user with specific role gets access (or gets denied access) to all resources. (If your sceanrio permits, you could make it a little better by dividing your resources into a few types and give access for 1 or more types of resources to 1 or more roles).
When trying to control access for each record individually, you will need to implement custom logic for resource based authorization. Typically applications utilize a mix of role-based and resource-based authorization driven by their requirements.
In the end it will boil down to a mapping that you need to maintain between 3 things
Resource (or a collection of resources)
Azure AD object (like role, group, individual user that is being given permission)
Permission that you're giving (understood and enforced by your application e.g. Blogs.Create permission for a Blogs application)
Relevant Documentation available on Microsoft Docs
Role-based and resource-based authorization
This documentation talks about similar concepts and shows a good example which makes use of both role based and resource based. CRUD operations on resources based on roles and then special privileges on specific resource for the owner of that resource (i.e. resource based)
Code Samples
Multi-tenant Survey Application Code
Code base for the documentation link above
Authorization in a web app using Azure AD groups & group claims
This one provides a sample task tracker application where users can share tasks with other users or Azure AD groups. Again you will see a mapping between resources (i.e. tasks in this case) and Azure AD objects (i.e. Users or Groups) is being maintained in sample database.
Assigning Application Roles for groups
Since you mentioned this as part of your question, just letting you know that this is possible from Azure Portal but only if you have Azure AD Premium license (I'm not sure which specific ones support it, but search on Group based assignments feature and you'll find it.)
I am using Azure AD B2C and I want a group based user distribution for my application. Lets say I have two subdomains subA.myapp.com and subB.myapp.com. On the other hand, I have two groups subA and subBin Azure B2C. Now a user wants to signin to subA.myapp.com, but is not a member of group subA, I would like to deny the user to sign in.
I know that Azure B2C does not include group info in the access token. So I will actually use Graph API to get the group membership of the user. But I am not quite sure if there is an appropriate event where I could intercept the validation process and manually deny a user to sign-in. Also, I thought I could use one of the *Validator methods of TokenValidationParameters but not sure which one.
I have read Authorize By Group in Azure Active Directory B2C. My problem is different because that problem is trying to protect only some actions based on group memberships, I want to prevent the whole login process to fail based on group membership.
You can use a ValidationTechnicalProfile on a page created by the SelfAssertedAttributeProvider technical profile. Using the validation technical profile, you can first authenticate the user, and then call a Rest API that can look up users group membership and return a successfull/fail response.
If the response is successful, the flow will continue. If it's a failure, an error will be shown to the user.
I have ADFS configured to deliver AD group information for a logged in user returned as claims.
Claim Language:
(sorry for the screen capture... the schemas were interpretted as URLs that I wasn't allowed to post)
Basic claims to return AD groups user belongs to
This returns groups that the user directly belongs to.
Would like ADFS to return effective permissions for the user.
Example:
User MyDomain\Bob belongs to the group Floor3Employees
The Group EntireBuilding contains the groups Floor1Employees, Floor2Employees, Floor3Employees
When getting claims for MyDomain\Bob... would like the groups returned to be:
Floor3Employees
EntireBuilding
The web application receiving the claims from ADFS could probably query AD to figure out the hierarchy of groups, but want to avoid the web application communicating directly with AD.