Unable to get Azure AD Groups to appear in user claims

NibblyPig 0
Viewed 39

I've read every article and post on this subject, to no avail.

I have an MVC app in azure. I wanted to connect to Azure AD, and get the Groups for a user.

To do this, firstly I altered the Program.cs

// Azure AD
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

Also this:

builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();

    options.Filters.Add(new AuthorizeFilter(policy));
});

Once I did this, it asked me to authenticate when I ran it. I logged in, and it worked. On my MVC page I added @User.Claims.SingleOrDefault(_ => _.Type == "name")?.Value; and it works great.

Next, I wanted to see what groups the user is in.

I followed every guide I could find, but nothing seemed to work. In the user's claims, there is no 'groups' entry or anything suggesting overage (I assume it would appear in claims?).

Now I don't know if I am missing some configuration from my appsettings file? I say this because my appsettings ONLY has this:

 "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "ClientId": "a guid",
    "TenantId": "another guid"
  },

It's unclear. After adding the above, I went into Azure and I did various tasks:

My web app : Token configuration > Add groups claim
My web app : API permissions > GroupMember.Read.All (Granted)
My web app : Manifest > change to "groupMembershipClaims": "All"

I also did the same thing in Enterprise applications > MyApp | Single sign-on, I don't know what that is but it was in one of the many posts I read.

What could I possibly be missing that is preventing the groups from appearing?

azure-active-directory asp.net-mvc azure
1 Answers

Here's the answer, I hope this saves future people some insane levels of pain.

For whatever reason, your claims are cached. I've been working on trying to fix this for like, 2 days. So it caches for a long time.

Since the application is single-sign on, and resists most attempts to force it to sign out, this is the issue. Once I signed it out, it updated my claims.

So if you're having issues, REMEMBER TO SIGN OUT AND BACK IN!

Here's how:

Azure > Go to Azure Active Directory > App Registrations

Click your application, click Authentication

In the Front-channel logout URL, enter the value: https://localhost:[YOURPORTHERE]/signout-oidc assuming it's dev and you're using a port number.

Hit SAVE.

Now launch your website, and then browse to that URL. It will sign you out. Next time you hit it it will prompt you to log in again, and then all of your information will be updated.

NibblyPig0
Related