13

Background

We are developing a multi-tenant SaaS product in Azure which has an AngularJS front-end and Web API back-end. We use Azure AD for authentication and have hooked it up with ADAL JS (using the OAuth2 implicit grant). Being a multi-tenant application, we allow customers to authenticate against their own Azure AD (which may or may not be connected to an on-premise AD).

So far this all works nicely. ADAL JS takes the user to the Azure login page and once the user has authenticated, an OAuth2 token is issued. This JWT token is then sent with all API calls as a bearer token where we have our own claims transformation process for mapping the incoming claims from Azure to our application claims.

Rather than specify individual users in the claims transformation process, we try to do it by AD groups. This allows our customers to have security groups in their AD and then our application will use that to map to the correct application claims.

The problem

The JWT token we receive does not contain a groups property, despite having set groupMembershipClaims to SecurityGroup in the AAD application manifest. I have since read in this tweet from Vittorio that

The implicit grant will NOT send those claims, as it returns the token in the querystring - it's easy to blow past max length

Upon further investigation, I also found this StackOverflow answer from Vittorio that says

I verified and in the implicit grant case you will receive groups always via the overage claim. Please refer to https://github.com/AzureADSamples/WebApp-GroupClaims-DotNet/tree/master/WebApp-GroupClaims-DotNet - it will show you how to process the overage claim to retrieve groups.

I had a look at the JWT token and it does not include any overage claim (identified by _claim_names and _claim_sources). I'm definitely a member of two groups in my Azure AD.

I also now appear to have two conflicting statements about whether it is possible to get group information (whether directly or indirectly) in the implicit grant token.

Question 1: Should I get an overage claim that I can use to get group information? If so, do I need to do anything to ensure that claim gets sent to me?

Graph API

Whether I can get an overage claim with a link to the user in the graph API or whether I have to manually craft the link to get the user's groups, I'm still a little unsure how I authenticate with the graph API.

I need to contact the graph API from the back-end after receiving a request with a bearer token (from ADAL JS).

Question 2: Can I send the same bearer token to the graph API to read that user's directory information? Or do I need to authenticate directly from my application to the graph API tenant in the context of the application rather than the user?

1
  • I never managed to get this working client side. Instead I make a Graph API call server side using the user's token and the On Behalf Of grant. I can then get group memberships from the Graph API. Nov 20, 2015 at 10:19

1 Answer 1

4

apologies for the confusion here. I will double check the statement about the overage, but in any case - for the sake of unblocking you quickly, let's assume that you need to get the groups manually without the aid of the overage claim. You cannot reuse the token you send to your Web API. That token is scoped to your app, and any other recipient will (or should) reject it. The good news is that the flow through which your backend can request a new token scoped for the Graph is easy to implement. See https://github.com/AzureADSamples/WebAPI-OnBehalfOf-DotNet - the details in your case are a be a bit different (your web API has the audience == clientid of your app) but the topology and the code/calls involved are exactly the same. HTH! V.

10
  • Thanks for that. I've implemented the manual graph API lookup using the on behalf of token. It works nicely when my user and application are in the same AAD/tenant. However, when I have the user and application in separate tenants, I get AADSTS50034: To sign into this application the account must be added to the xxxxx.onmicrosoft.com directory. when trying to acquire the token. Apr 22, 2015 at 9:19
  • Is the user a guest in the target tenant? If not, that's by design... And the app needs app level permission to the graph rather than delegated
    – vibronet
    Apr 22, 2015 at 15:28
  • Not quite sure what you mean. The user (belonging to the customer's tenant) logs in to our application (in our tenant). Are you saying I need to add the customer's users to our tenant as well? I thought the point of multi-tenant apps is that we don't have to deal with users like this? All we're trying to do is allow our customer's IT departments to add their users to groups in their AD as usual and then get these group memberships in our application so we can base permissions of the groups rather than deal with users directly. Is my thinking correct or is there a better way to achieve this? Apr 22, 2015 at 22:17
  • 1
    I am using also the AngularJS ADAL library, not getting the security groups. Any info whether this is available somehow now, or I must implement it in backend using Graph API?
    – Jaanus
    Nov 20, 2015 at 10:12
  • 1
    @Jaanus the implicit flow does not yield tokens containing security groups, and ADAL JS depends on it - hence you need to get groups from the graph
    – vibronet
    Nov 20, 2015 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.