Not able to get user group claims when using Azure AD as external login alongside Identity Core(ASP.NET Core 2.1)

user_12047033 0
Viewed 930

I am trying the following:

  • Get Azure AD user and role management to work with Identity Core.
  • The aim is -> if a user logs in through Azure AD(External Login), I get the corresponding user details from AD, using the same, write logic to sync Identity with AD.

Problem:

When using AD as the only authentication schema to the web app without Identity, able to get more data from the AD request through claims. (About 14 claims to work with)

However, when using AD as an external login schema with Identity, I am only able to extract at-most 4 claims from AD.

What I have tried :

appsettings.json

  **{
      "AzureAd": {
        "Instance": "https://login.microsoftonline.com/",
        "Domain": "domain name",
        "TenantId": "aaaaaa-assss-assas--assa-ssss",
        "ClientId": "aaaaaa-ssssss-ddddd-dddddd",
        "CallbackPath": "/signin-oidc",
        "SignedOutCallbackPath": "/signout-callback-oidc",
        "ClientSecret": "clientsecret of the application",
        "CookieSchemeName": "Identity.External"


      },
      "Logging": {
        "LogLevel": {
          "Default": "Warning"
        }
      },
      "AllowedHosts": "*",
"GraphApiUrl": "https://graph.microsoft.com/beta"
    }**

startup.cs

public void ConfigureServices(IServiceCollection services)
        {

            services.AddMicrosoftIdentityPlatformAuthentication(Configuration)
              .AddMsal(Configuration, new string[] { "User.Read", "Directory.Read.All" })
              .AddInMemoryTokenCaches();
            services.AddMSGraphService(Configuration);

            services.Configure<CookiePolicyOptions>(options =>
            {
                // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });

            services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(
                    Configuration.GetConnectionString("DefaultConnection")));

            services.AddDefaultIdentity<IdentityUser>()
                .AddRoles<IdentityRole>()
                .AddEntityFrameworkStores<ApplicationDbContext>();            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        }

My Result

Claims from Azure AD (as the only auth schema for the app)

enter image description here

Users associated role in AD through Claims.(as the only auth schema for the app)

enter image description here

With Azure Ad as an external login, I am able to get only 4 claims(not very useful data)

enter image description here

enter image description here

Reference: Github Project

azure-ad-graph-api azure-active-directory asp.net-mvc asp.net c#
1 Answers

I got the probable solution Hope it helps

Scaffold the identity of external login Once Scaffolded there will be 2 files

  • ExternalLogin.cshtml
  • ExternalLogin.cshtml.cs

In ExternalLogin.cshtml.cs file there is an method named "OnGetCallbackAsync" Under this method You can either add your own claims or get the claims present over there 

 "var info = await _signInManager.GetExternalLoginInfoAsync();"

under info if you navigate to principal->claims you can find the claims over there where you can get groups-id for the current user logged in

To get the claims make sure to add below service in startup class under configureServices method For the detail code of working MSAL refer the github project 

    services.AddMicrosoftIdentityPlatformAuthentication(Configuration).AddMsal(Configuration, new string[] { "User.Read", "Directory.Read.All" })
services.AddMSGraphService(Configuration);

instead of 

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
    .AddAzureAD(options => Configuration.Bind("AzureAd", options));
user_120470330
Related