easyauth | centralized Authentication and Authorization token server | Authorization library

The header X-MS-CLIENT-PRINCIPAL contains the same claims as the id_token. So if we want to get the group claim, we can base64 decode the header.

For example

My code

Regarding the issue, please refer to the following steps

1. Register Azure AD application to protect azure function with easy auth

2. Register client-side application

   a. Register single-page application

   b. In the Implicit grant and hybrid flows section, select ID tokens and Access tokens.

   c. Configure API permissions

3. Enable CORS in Azure function

4. Code

   a. Integrate Azure AD auth in your spa application with Implicit grant flow. After doing that, when users access your application, they need to enter their AD account to get access token

   b. Client exchanges this accessToken for an 'App Service Token'. It does this by making a POST to https://{app}.azurewebsites.net/.auth/login/aad with the content { "access_token" : "{token from Azure AD}" }. This will return back an authenticationToken

   c. Use that authenticationToken in a header named x-zumo-auth. Make all requests to your function app using that header.

For more details, please refer to here and here. Regarding how to implement Azure AD in spa, please refer to here.

The client should not be aware of who is currently logged-in. On the client, you just save the access token, and then you send it to the server on every request. The server will figure out who made the request based on the access token and return the appropriate response.

The MS-Graph link in the doc was false. It referred to the assignment of a role to a user, though an application in the linking text body was implied. This is the correct reference.

POST /servicePrincipals/{objectId}/appRoleAssignments

Also make sure, that in case you have created the Azure subscription with a personal account (eg. outlook.com, hotmail.com) to not use the bearer token of that user in the graph call. Instead create a user in AzureAD, assign proper permissions, and use that account's token.

If you want to call the Azure API app which enables easy auth, please refer to the following steps

1. Get the Application ID URI of the AD application you use to enable easy auth

a. In the Azure portal menu, select Azure Active Directory or search for and select Azure Active Directory from any page.

b. Select App registrations > Owned applications > View all applications in this directory. Select your web app name, and then select Overview.

1. code

To validate the access_token, your app should validate the token's signature, the claims, the issuer, the audience, and the signing tokens, these need to be validated against the values in the OpenID discovery document.

The Azure AD middleware has built-in capabilities for validating access tokens, and you can browse through the samples to find one in the language of your choice.

For more details, see - https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validating-tokens

you are correct that "roles" it is in the claims, however. according to the documentation, isinrole does not work as you expect. it looks for role types as per the claimidentity

Each ClaimsIdentity has its own definition of the claim type that represents a role. This claim type can be accessed and set through the ClaimsIdentity.RoleClaimType property.

by default the roleclaimtype is something like "ClaimsType.Role" where as the claims type in the jwt is "roles" it doesn't match so it doesn't consider it a role claim when you call isinrole

you can try to set the claimsidentity roleclaimtype or you can search for the claim using a different method like claims.hasclaim("roles","shizzl") . that will work too?

Hopefully this helps you.

First of all - you observe a working behavior because you (a) either explicitly assigned the managed identity a role / access to the easy auth app registration; or (b) APIM has a cached token from the time before you enable explicit assignment required for the easy auth app registration.

Generally your approach is correct. With one caveat. Authorizations based on groups will not work (today) for any service principals. This means, if you put a service principal (A) into a group (G) and you assign this group a role to another service principal (B). The first service principal (A) will still not be able to get access token for service principal (B). Any service principal (A) today must be explicitly authorized to another service principal (B). Meaning - if you set to require explicit user assignment for your service principal, then you have to explicitly assign any other service principal you want to grant access to. Anything else will fail in obtaining the access token.

Here are steps to achieve what you want in a clean environment:

1. Create the Function App
2. Enable Easy Auth for the function app
3. Change the settings for require explicit user assignment on the service principal for that app registration (the function app)
4. Do not assign any role yet on the service principal for the function app
5. Enable managed Identity on APIM
6. Use the managed identity in Policy by referring to the application_id for the function app easy auth registration
7. Test the APIM

Result before assigning any role on the function app:

I reproduce your issue with the same error message.

In the Valid OAuth redirect URIs field, just enter the url with https://.azurewebsites.net/.auth/login/facebook/callback and it will work well. Remember to replace with the name of your Azure App Service app.

For more details, you could refer to this article to Configure your App Service app to use Facebook login.