How to set/find user roles from Organization based Identity in .NET core

Question

I'm trying to find out what role(s) a user has within a Blazor Server app that has Authentication setup for an organization that uses MS accounts and Azure Active Directory. I would imagine that the roles are set by the IT Operations team managing the MS accounts, but I'm not finding where to verify that at.

So I would like to know: where are roles set when using Org authentication, how can I change them, and is there a simple way to see what roles an authenticated user has?

I tried looking for an authenticated user's role in the MS doc example code using the cascade parameter like below:

@page "/"



@code {
    [CascadingParameter]
    private Task authenticationStateTask { get; set; }

    protected override void OnInitialized()
    {
        base.OnInitialized();
        LogUsername();
    }

    private async Task LogUsername()
    {
        var authState = await authenticationStateTask;
        var user = authState.User;

        if (user.Identity.IsAuthenticated)
        {
            var test = user.Claims.Where(c => c.Type.Contains("Role")); // also tried "role"
            string role = test.FirstOrDefault().ToString();
            Console.WriteLine($"{role} is authenticated.");
        }
        else
        {
            Console.WriteLine("The user is NOT authenticated.");
        }
    }
}

Identity has a RoleClaimType but I can't find anything else that would tell what the Role for a given user is. Am I looking in the wrong spot for this maybe? I couldn't find any detailed docs on how Organiztion Authentication works with Identity in .NET core and Blazor, so any tips, advice, or nudges in the right direction is appreciated!

user_3258336 · Answer

Roles are set in the azure portal. Azure Active Directory -> App Registrations -> [your app] -> Roles and Administrators. For custom roles, your organization will need Azure AD Premium P1 or P2 licenses.

As for how to retrieve them, here is a quote from documentation:

Get role claims. When a user signs in, the application receives the user's assigned role(s) in a claim with type http://schemas.microsoft.com/ws/2008/06/identity/claims/role (the roles claim in a JWT token).

A user can be assigned multiple roles, or no role. In your authorization code, don't assume the user has exactly one role claim. Instead, write code that checks whether a particular claim value is present:

if (context.User.HasClaim(ClaimTypes.Role, "Admin")) { ... }

user_6844770 · Answer

for those who are looking like me, in .Net 6

official documentation how to enable roles in Blazor docs.microsoft.com

close the component for viewing

  
     .....

get the name of the user's first role


    
       @context.User.Claims.FirstOrDefault(c=>c.Type == "role").Value

close page from view

@attribute [Authorize(Roles = "Admin, Normal")]

user_3316040 · Answer

var Roles = User.Claims.Where(t => t.Type == System.Security.Claims.ClaimTypes.Role);

How to set/find user roles from Organization based Identity in .NET core

3 Answers