Authorize ASP.NET Core App By Azure AD Groups Using Graph API

Miroslav Adamec

5y69.3k14100Article

ASP.NET Azure Azure AD Graph APIGroupRolesGraphAPISecurity GroupAzureADAuthorizeAdGroup

14 Comments

Join the conversation! Your thoughts help the community grow.

Benzhi Pan5y ago
Hi Miroslav Adamec, your code example works fine locally, but I got problem when I put it on Azure webSite. Do you have same problem? https://stackoverflow.com/questions/66118758/azure-ad-login-with-groups-get-error-aadsts50011/66118892?noredirect=1#comment116921177_66118892
- Miroslav Adamec5y ago
  Hi, this is not related to AD groups, but its AAD auth in general. I run my site as Azure app service web app. Looks like you do the same. I have 2 reply URLs. One for each slot: https://site.azurewebsites.net/signin-oidc and https://site.azurewebsites-slot.net/signin-oidc. This could be different in another network scenarios. If you open your AAD app in Azure portal - Enterprise applications, you will see failed logins with more detailed logs. i would try turning on HTTPS Only on your App service (TLS/SSL settings section)
Stas Mashkovich5y ago
Miroslav Adamec Hi, how can I implement the same if my code in .net core 2.0? thanks
- Miroslav Adamec5y ago
  Yes. Libraries I mentioned should be available also for .NET Standard 2.0. The code should be mostly the same.
Josh Feimster5y ago
@Miroslav, can you tell me why I would get a build error on the Batch in the foreach statement in GraphServices? foreach (var groupsBatch in groupIds.Batch(batchSize)) -- in this example, groupIds.Batch will not build. Any help you can think of would be greatly appreciated.
- Miroslav Adamec5y ago
  Batch is my custom extension method implemented here: https://github.com/mirecad/AspAzureAdGroupsAuthorization/blob/master/AspNetAzureAdGroupsAuthorization/Helpers/Extensions.cs
Herda Akshija6y ago
Hello, how would it be able to check more than 20 groups?
- Miroslav Adamec6y ago
  Described method CheckMemberGroupsAsync handles more than 20 groups without any problems. It checks membership by batches - 20 groups at the time.
Frank Rodriguez6y ago
Miroslav Adamec Hi, can you explain or direct me to the rigth documentation for make this example : https://docs.microsoft.com/en-us/aspnet/core/security/authentication/social/additional-claims?view=aspnetcore-3.1 but with Azure AD?
- Miroslav Adamec6y ago
  I don't understand your question. What specific Azure AD claims you want to retrieve in your application?
Ano Mepani6y ago
@Miroslav can you explain how can we use this claims binding on action or on controller as for simple use case I understand that you have demonstrated with simple endpoints.
- Miroslav Adamec6y ago
  You can decorate your controllers/actions with Authorize attribute. For example [Authorize(Roles = "examplerole1")]. Check out this documentation: https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-3.1
Ano Mepani6y ago
Thanks for sharing this article. Very useful for AD group based authorization.
Sourav Kumar Das6y ago
Nice and useful article. Thanks for sharing.

Introduction

Business websites use AD groups as authentication mechanisms quite often. Before the cloud era, ASP.NET translated AD groups into roles out of the box. This is no longer possible with Azure AD. At least it's not so simple. Now there are 2 ways you can check group membership,

Set Azure AD to include security groups membership information into JWT token.
Query Graph API for user groups.

There are many tutorials describing the first approach. It is easy and effective, however it has its limitations. If the user is a member of a lot of groups, the size of the token will grow. There is a limit of 200 group ids in one JWT token. Error message appears, that points you to Graph API, if you try to request token for user with more than 200 groups. This sample demonstrates how to obtain users AD groups from Graph API and assign ASP.NET roles based on these groups. Roles are then stored in cookies, so only first request queries Graph API.

The whole sample can be cloned from my GitHub repo.

How to run this sample

You need access to Azure AD to register your application and check ids of groups.

Register Azure AD application

Create new Azure AD application and set its reply URL. I won't cover this in detail.
Set up a secret in Certificates & secrets tab.
In API permissions tab, add permission Microsoft Graph -> GroupMember.Read.All. User.Read is present by default. Don't forget to grant admin consent.

Fill in information about your app into AzureAD section of appsettings.json file.

"AzureAD": {
"Instance": "https://login.microsoftonline.com/",
"Domain": "<your domain>",
"TenantId": "<your tenant id>",
"ClientId": "<your client id>",
"ClientSecret": "<your client secret>"
},

You would want to place your secret somewhere safer in production application.

Assign ASP.NET roles to your Azure AD groups

Find guid of your Azure AD groups. In the AuthorizationGroups section of appsettings.json file replace key-value pairs with group id as key and target role as value. You can add as many as you want.

"AuthorizationGroups": {
"5b99527f-947b-4e8d-aad5-404f8d39008c": "examplerole1",
"2bd89580-1d95-4a9a-98c2-a7a150168cba": "examplerole2"
},

Set up endpoints authorization and run the application

There are 3 endpoints,

/ Default endpoint. Requires only to be logged in.
/roletest Requires role to grant access.
/accessdenied Redirect destination in case of failed authorization.

In Startup.cs modify { Roles = "examplerole1" } to match one of roles specified in previous step.

app.UseEndpoints(endpoints =>
{
endpoints.MapGet("/", async context =>
{
await context.Response.WriteAsync("Im authorized (no required role).");
}).RequireAuthorization();
endpoints.MapGet("/roletest", async context =>
{
await context.Response.WriteAsync("You passed the role test!");
}).RequireAuthorization(new AuthorizeAttribute() { Roles = "examplerole1" });
endpoints.MapGet("/accessdenied", async context =>
{
await context.Response.WriteAsync("Access denied!");
});
});

Run the application.

How does it work

Here are described key concepts of this project.

Azure AD authentication

I used Microsoft.AspNetCore.Authentication.AzureAD.UI NuGet package. Startup.cs file changes:

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
.AddAzureAD(options => Configuration.Bind("AzureAD", options));

app.UseAuthentication();
app.UseAuthorization();

This package takes care of setting up Open Id Connect and Cookies.

Graph API

Class GraphService.cs takes care of all operations against Graph API. Method CheckMemberGroupsAsync gets collection of group ids and returns only ids, that user is member of. This is done by CheckMemberGroups Graph API method.

public async Task<IEnumerable<string>> CheckMemberGroupsAsync(IEnumerable<string> groupIds)
{
//You can check up to a maximum of 20 groups per request (see graph api doc).
var batchSize = 20;
var tasks = new List<Task<IDirectoryObjectCheckMemberGroupsCollectionPage>>();
foreach (var groupsBatch in groupIds.Batch(batchSize))
{
tasks.Add(_client.Me.CheckMemberGroups(groupsBatch).Request().PostAsync());
}
await Task.WhenAll(tasks);
return tasks.SelectMany(x => x.Result.ToList());
}

Information about which user groups to check is taken from user context. That's why GraphServiceClient must be created on behalf of user with it's token. I've created factory method CreateOnBehalfOfUserAsync for this purpose.

public static async Task<GraphService> CreateOnBehalfOfUserAsync(string userToken, IConfiguration configuration)
{
var clientApp = ConfidentialClientApplicationBuilder
.Create(configuration["AzureAD:ClientId"])
.WithTenantId(configuration["AzureAD:TenantId"])
.WithClientSecret(configuration["AzureAD:ClientSecret"])
.Build();
var authResult = await clientApp
.AcquireTokenOnBehalfOf(new[] { "User.Read", "GroupMember.Read.All" }, new UserAssertion(userToken))
.ExecuteAsync();
GraphServiceClient graphClient = new GraphServiceClient(
"https://graph.microsoft.com/v1.0",
new DelegateAuthenticationProvider(async (requestMessage) =>
{
requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", authResult.AccessToken);
}));
return new GraphService(graphClient);
}

Intercepting authentication flow and adding custom claims

OpenId exposes OnTokenValidated event. We can use returned token before authentication is finished. It is needed to create Graph API client, that will act on behalf of actual user.

Load key-value pairs of group ids and target roles from section AuthorizationGroups of configuration.
Create Grap API service on behalf of actual user.
Check which groups from configuration is user member of.
Create role claims from returned entries.
Add these claims to current user.

Added claims are stored in cookie, so other requests do not trigger this event.

services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
{
options.Events = new OpenIdConnectEvents
{
OnTokenValidated = async ctx =>
{
var roleGroups = new Dictionary<string, string>();
Configuration.Bind("AuthorizationGroups", roleGroups);
var graphService = await GraphService.CreateOnBehalfOfUserAsync(ctx.SecurityToken.RawData, Configuration);
var memberGroups = await graphService.CheckMemberGroupsAsync(roleGroups.Keys);
var claims = memberGroups.Select(groupGuid => new Claim(ClaimTypes.Role, roleGroups[groupGuid]));
var appIdentity = new ClaimsIdentity(claims);
ctx.Principal.AddIdentity(appIdentity);
}
};
});

Conclusion

In this article, we learned how to authorize ASP.NET Core applications with Azure Active Directory groups.