Azure AD: How to make tokens have the "hasgroups" claim?

user_414058 0
Viewed 880

Our application allows assigning permission to groups, which means for every user, we have to reliably determine group membership. The user presents a token regularly obtained with ADAL (some use .NET, others use NodeJS, others use CLI).

Some users seem to be sending a token with the following claim:

"hasgroups": true,

That claim is documented in the Azure AD token reference page.

We would like to add a test case for that, but after following steps here and here, we always end up with a token with the following claims:

"_claim_names": {
  "groups": "src1"
},
"_claim_sources": {
  "src1": {
    "endpoint": "https://graph.windows.net/{redacted}/users/{redacted}/getMemberObjects"
  }
},

What is wrong with our setup? Why can't we get the hasgroups claim?

Here are some additional information:

  • Application type is Native (not WebApi).
  • Manifest says "oauth2AllowImplicitFlow": true.
  • The application is given access to Azure Key Vault.

We use the following code to get the token (in C#):

var userCredential = new UserCredential( _userName, _password );
result = context.AcquireToken( _resource, _clientId, userCredential );

Where:

  • _userName and _password are from a user with lots of groups.
  • _clientId is the application id of the native application - the one with "oauth2AllowImplicitFlow": true.
  • _resource is https://vault.azure.net.

The token is emitted correctly. The only issue is that it shows _claim_names and _claims_sources instead of hasgroups.

azure-security adal claims-based-identity azure-active-directory azure
2 Answers

Where: • _userName and _password are from a user with lots of groups.

As the user is part of lots of groups (assuming 6 or more here).. Azure AD token will come back with a groups overage indicator instead of actual group ids in “groups” claim. I guess you know that and hence doing it intentionally.

var userCredential = new UserCredential( _userName, _password );
result = context.AcquireToken( _resource, _clientId, userCredential );

Since you're acquiring the token in a .NET based application using C# code, the token response is not really limited in length (like in cases for a web SPA, where it is being returned as a URI fragment and URL length has limits)

Looking at the documentation both "hasgroups" and "groups:src1" claims have the same intention of telling that there are too many groups to return as part of the token. Although there is a subtle difference:

  • in cases where URL limit applies, "hasgroups" will be sent as true (like implicit grant flow for SPA)

  • in cases where length is not limited (like in your case), Azure AD will still not return all the groups to make sure the token doesn't get too big, but it will send a little more information on how to get to all groups by sending the information on how you can query for all your groups. In this case it's sending the "groups:src1" and "_claim_sources" with source information instead of just the "hasgroups"

Claims in id_tokens enter image description here

user_101303850
user_12659970
Related