Roles set via AAD not detected
See original GitHub issueI’ve configured DAB to use AAD. I can correctly authenticate but I cannot use the role I have defined in AAD - and that are present in my token - to access a protected entity.
This is part of my token:
"aud": "3b294ef8-c570-4c75-b77e-95fa92527a67",
"iss": "https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0",
"name": "Davide Mauri",
"preferred_username": "damauri@microsoft.com",
"roles": [
"contributor"
],
"scp": "EndpointAccess",
"ver": "2.0"
this is how I have configured my dab-config.json
file:
"authentication": {
"provider": "AzureAD",
"jwt": {
"audience": "3b294ef8-c570-4c75-b77e-95fa92527a67",
"issuer": "https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0"
}
}
I was able to debug the code and I noticed that line 63 in .\src\Service\Authorization\ClientRoleHeaderAuthorizationMiddleware.cs
return httpContext.User.IsInRole(clientRoleHeaderValue);
always returns false. clientRoleHeaderValue
correctly contains the role I specify in the X-MS-API-ROLE
, but even if the value matches the one in the Claim (‘contributor’), false
is returned anyway.
Issue Analytics
- State:
- Created a year ago
- Comments:6 (6 by maintainers)
Top Results From Across the Web
Azure AD role assigned to user not reflected on ...
Hello All, i have an Azure AD joined laptop on which i use to login with a normal user with no administrative rights....
Read more >Azure AD v2 roles not included in Access Token
Unfortunately there is a bug on AAD that only add the roles to the access_token when an API scope is requested when requesting...
Read more >Configure Azure AD OAuth2 authentication
By default, Azure AD authentication will map users to organization roles based on the most privileged application role assigned to the user in...
Read more >Azure AD authentication troubleshooting: Known problems ...
Clear all Azure AD tokens to ensure this is not a corrupt Azure AD ... You have opted into 2FA and are using...
Read more >Azure AD user not showing assigned roles/profile in ...
I heard from Sitecore support on the roles at least, so I wanted to share this answer: The concept of the Federated Authentication...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
oct2022
@seantleonard, Is there documentation that explains to use short name like
roles
and not the URL value?