question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Roles set via AAD not detected

See original GitHub issue

I’ve configured DAB to use AAD. I can correctly authenticate but I cannot use the role I have defined in AAD - and that are present in my token - to access a protected entity.

This is part of my token:

"aud": "3b294ef8-c570-4c75-b77e-95fa92527a67",
  "iss": "https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0",
  "name": "Davide Mauri",
  "preferred_username": "damauri@microsoft.com",
  "roles": [
    "contributor"
  ],
  "scp": "EndpointAccess",
  "ver": "2.0"

this is how I have configured my dab-config.json file:

"authentication": {
          "provider": "AzureAD",
          "jwt": {
            "audience": "3b294ef8-c570-4c75-b77e-95fa92527a67",
            "issuer": "https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0"
          }
        }

I was able to debug the code and I noticed that line 63 in .\src\Service\Authorization\ClientRoleHeaderAuthorizationMiddleware.cs

return httpContext.User.IsInRole(clientRoleHeaderValue);

always returns false. clientRoleHeaderValue correctly contains the role I specify in the X-MS-API-ROLE , but even if the value matches the one in the Claim (‘contributor’), false is returned anyway.

Issue Analytics

  • State:closed
  • Created a year ago
  • Comments:6 (6 by maintainers)

github_iconTop GitHub Comments

1reaction
seantleonardcommented, Nov 3, 2022

oct2022

1reaction
Aniruddh25commented, Oct 28, 2022

@seantleonard, Is there documentation that explains to use short name like roles and not the URL value?

Read more comments on GitHub >

github_iconTop Results From Across the Web

Azure AD role assigned to user not reflected on ...
Hello All, i have an Azure AD joined laptop on which i use to login with a normal user with no administrative rights....
Read more >
Azure AD v2 roles not included in Access Token
Unfortunately there is a bug on AAD that only add the roles to the access_token when an API scope is requested when requesting...
Read more >
Configure Azure AD OAuth2 authentication
By default, Azure AD authentication will map users to organization roles based on the most privileged application role assigned to the user in...
Read more >
Azure AD authentication troubleshooting: Known problems ...
Clear all Azure AD tokens to ensure this is not a corrupt Azure AD ... You have opted into 2FA and are using...
Read more >
Azure AD user not showing assigned roles/profile in ...
I heard from Sitecore support on the roles at least, so I wanted to share this answer: The concept of the Federated Authentication...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found