Azure AD extract role claim from acesses token and pass it on to the controller - asp.net-core

Question

I would like to know how do i extract the role claim from Azure ID accesses token ?
Ideally i would like to get the role claim in a string Variable in ASP.net Core 3.1 controller and then pass this on to my service layer which will do some kind of call to the backend db.
Any sample code would be of great help to me.

Answer 1

If you want to implement Azure AD auth based on app role, please refer to the following steps:
Define your Application Roles
a. In the blade for your application in Azure Portal, click Manifest.
b. Edit the manifest by locating the appRoles setting and adding your Application Roles. The role definitions are like the following json.
"appRoles": [
{
"allowedMemberTypes": [
"User"
],
"description": "User readers can read basic profiles of all users in the directory",
"displayName": "UserReaders",
"id": "a816142a-2e8e-46c4-9997-f984faccb625",
"isEnabled": true,
"lang": null,
"origin": "Application",
"value": "UserReaders"
},
{
"allowedMemberTypes": [
"User"
],
"description": "Directory viewers can view objects in the whole directory.",
"displayName": "DirectoryViewers",
"id": "72ff9f52-8011-49e0-a4f4-cc1bb26206fa",
"isEnabled": true,
"lang": null,
"origin": "Application",
"value": "DirectoryViewers"
}
],
c. Save the manifest.
assign app role to user or groups
Besides, please note that if you want to assign app role to group, you need to have Azure AD Premium license.
Code
a. Configure application to get role claim
please add following code in startup.cs
public void ConfigureServices(IServiceCollection services)
{
// This flag ensures that the ClaimsIdentity claims collection will be built from the claims in the token
JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
// The following lines code instruct the asp.net core middleware to use the data in the "roles" claim in the Authorize attribute and User.IsInrole()
services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
{
// The claim in the Jwt token where App roles are available.
options.TokenValidationParameters.RoleClaimType = "roles";
});
}
b. get role claim
[Authorize(Roles = <your role>")] // In controllers
// or
User.IsInRole("<your role>"); // In methods
For more details, please refer to the document and the sample