Obtain Application roles from idToken

I’m submitting a…

[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  
[ ] Performance issue
[ ] Feature request
[x] Documentation issue or request
[ ] Other... Please describe:

Browser:

• Chrome version 75
• Firefox version XX
• IE version XX
• Edge version 76
• Safari version XX

Library version

Library version: 1.0.2

Current behavior

Once SSO is successful I know who the user is but not which roles he has assigned.

Expected behavior

Once the SSO is successful I would expect to be able to get user roles from the idToken in order to restrict parts of the applications or actions to admin users only.

Minimal reproduction of the problem with instructions

I created an example in codesandbox.io: https://codesandbox.io/s/vue-template-evqjg The code is also checked in at https://github.com/RecuencoJones/Vue-Azure-SSO-example

Previous steps to setup Azure AD

1. Create an Azure AD directory.
2. Create an App Registration on Azure AD.
3. On Advanced settings, check both Access tokens and ID tokens for Implicit grant.
4. Edit following manifest fields:
   
   

     "accessTokenAcceptedVersion": 2,
     "appRoles": [
       {
         "allowedMemberTypes": [
           "User",
           "Application"
         ],
         "description": "Admin user for the application",
         "displayName": "Administrator",
         "id": "ccf2cb33-c1d2-4101-a1e8-b88e1d3806b2",
         "isEnabled": true,
         "lang": null,
         "origin": "Application",
         "value": "AdminUser"
       },
       {
         "allowedMemberTypes": [
           "User",
           "Application"
         ],
         "description": "Common user for the application",
         "displayName": "User",
         "id": "2ca47286-7be9-47b8-9c76-1369b3021506",
         "isEnabled": true,
         "lang": null,
         "origin": "Application",
         "value": "RegularUser"
       }
     ],
     "groupMembershipClaims": "All",
     "oauth2AllowIdTokenImplicitFlow": true,
     "oauth2AllowImplicitFlow": true,
     "signInAudience": "AzureADandPersonalMicrosoftAccount",
   

5. Create an Enterprise Application bound to previous App Registration
6. Add your user to the Enterprise Application and assign Admin role.

Test:

1. Fork the sandbox https://codesandbox.io/s/vue-template-evqjg
2. Update App registration Redirect URIs to add https://<sandbox-id>.codesandbox.io as Web type.
3. Copy Application Client ID from App registration and replace the value of clientId in config/auth.js with it.
4. Open the live preview in a new tab (codesandbox does not allow redirect within their embedded preview).
5. Attempt to SSO.
6. Check developer console for Account object and browse idToken entry.
7. No claims related to roles can be found.

[RecuencoJones]

On another hand (maybe should create another issue for this one?) once the auth.loginRedirect() returns with success I’m able to access auth.getAccount().idToken – decoded already.

Would it be possible to also add the property rawIdToken to it without having to use auth.acquireTokenSilent() and/or auth.acquireTokenRedirect()?

[sameerag]

Closing this. Please open a new issue if there are further questions.