4

I have two registered applications in Azure AD B2C: azure functions application and frontend spa application. I call azure functions from frontend app and use implicit authorization flow. I use MSAL npm package to request access token.

I followed this article to setup roles for users: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps

But access_token I receive in Frontend app is missing "roles" claim, as well as id_token. Here is access token I receive:

{
  "typ": "JWT",
  "alg": "RS256",
  "kid": "X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk"
}.{
  "iss": "https://<tenant_name>.b2clogin.com/<id>/v2.0/",
  "exp": 1595333452,
  "nbf": 1595329852,
  "aud": "3d6123b2-b436-46c0-bcde-e0b61b0ad827",
  "oid": "e98c46c4-f13d-428e-9b7d-28ba3abeb060",
  "sub": "e98c46c4-f13d-428e-9b7d-28ba3abeb060",
  "name": "Basic User",
  "emails": [
    "[email protected]"
  ],
  "tfp": "B2C_1_signin_v2",
  "nonce": "a70eece3-31d2-4cc3-8abb-0a56a95d4ba1",
  "scp": "demo.read",
  "azp": "d7787de1-6642-409f-b0b9-2f5608476367",
  "ver": "1.0",
  "iat": 1595329852
}.[Signature]

Why there are no roles in it?

2
  • I marked your answer with checkmark but I got a message "Votes cast by those with less than 15 reputation are recorded, but do not change the publicly displayed post score".
    – TanyaMy
    Aug 7, 2020 at 5:35
  • Thank You TanyaMy for the vote. You can also accept the answer if it was helpful,( click on the check mark beside the answer to toggle it from greyed out to filled in.). See meta.stackexchange.com/questions/5234/…
    – Nishant
    Aug 7, 2020 at 8:32

2 Answers 2

3

Application roles are not currently supported in Azure AD B2C.

You can raise user voice for your request Azure feedback portal or vote for an existing one.

For now, you can call MS Graph from AAD B2C custom policy, there is an ability to call APIs in Custom Policy using OAuth client credentials.

You can query the users group membership and then return the data back to B2C policy directly, and issue it into the token

https://learn.microsoft.com/en-us/azure/active-directory-b2c/secure-rest-api#oauth2-bearer-authentication

Then use this to get the data from MS Graph

https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-rest-api-claims-exchange

or

You need to use either groups to manage this, or create an AAD App inside the B2C tenant and do the App Role assignments there. Then during the B2C policy execution, call a REST API to query the roles for the user and insert them into the B2C token. You need to use custom policy for this one. Please refer github sample similar to this

7
  • 1
    Thank you for the answer. What do you mean by create an AAD App inside the B2C tenant ? Is it a custom API or just insert a code somewhere?
    – TanyaMy
    Jul 22, 2020 at 7:50
  • App need to be registered under b2c tenant. Create a Custom API which queries the roles of the user and you need to call this custom API from the custom policy. Jul 22, 2020 at 21:06
  • There is an existing feature request for this that you can vote on. feedback.azure.com/forums/169401-azure-active-directory/…
    – bpossolo
    Mar 29, 2021 at 0:19
  • I have an Azure AD app registration within my Azure AD B2C tenant, and in the Manage menu on the app registration page there is NO App roles menu item (like there is in a 'normal' Azure AD tenant app registration page). Jan 25 at 11:49
  • 1
    However, I went to Azure AD within my Azure AD B2C tenant, clicked on Enterprise Applications > Application Type: All Applications > clicked on my application > Users and Groups. There is text at top of page that says 'Assign users and groups to app-roles for your application here. To create new app-roles for this application, use the application registration'. When I click on the link, it loads a page where u CAN create an app role - URL is like this: https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/AppRoles/appId/***/defaultBlade/AppRoles Jan 25 at 11:49
1

As far as I can remember, B2C doesn't support Role claims. I've had to make use of a custom claim in the past and Sven Glöckner has written an article that describes something similar to what I've done.

In my case, I've added the role claim value to default to 'appMember', which was like the main role for a user on the site and if he had a UPN extension of our company, he would get a role like 'internalUser'. This is how we distinguished the permissions that would apply to the security trimming and downstream calls.

3
  • I successfully implemented a custom role claim as described here: learn.microsoft.com/en-us/azure/active-directory-b2c/… B2C doesn't support string[] as a datatype for custom attributes so I'm simply using a string type and then the claim value is comma-separated roles
    – bpossolo
    Mar 29, 2021 at 2:57
  • Where and how can an admin change the claim value in the Azure Portal later? E.g. from 'appMember' to 'internalUser'? This is not described in the linked article by Sven Glöckner.
    – Joerg
    Oct 26, 2021 at 13:21
  • Also, I am not sure about the difference between user attributes and claims in this answer. As far as I know I can only create user attrributes which then can be selected as claims that are returned in the token. How would I "create" a claim and set the default value to e.g. 'appMember'?
    – Joerg
    Oct 26, 2021 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.