Net6 Web Api Azure AD Authentication And Authorization With Azure Ad Groups

Net6 Web Api Azure AD Authentication And Authorization With Azure Ad Groups | Using Azure AD groups authorization in ASP.NET Core | How to do Authorization based on Azure AD groups and Authenticate using Azure AD in .net core application?

Generally the Azure Token will have the groups related information, however if the user have 5+ number of groups in the token, Azure token will be created with "hasgroups"=true. This is called Groups overage.

In this scenario, our Azure AD Groups Authorization Web API application has to call Azure Graph API to check if the user has the required group or not. Web API using Azure Graph API can validate the groups by passing the required group IDs. If the groups are assigned to the user, Graph API will return the groups information to Web API application and Web API can validate the presence of Azure Group Groups.

To test Web API Azure AD with Postman, we need to use Oauth2.0 and generate an implicit token. We need to pass the required scopes to Azure AD. Postman authorize Azure AD can be done after specifying the required groups.

#AzureADGroupsAuthorization#
#Net6AzureAD#
#WebAPIAzureGraphAI#

Chapters
00:00 Web API Azure AD Azure AD Groups Authorization Intro
03:19 Net6 Azure AD Groups Authorization app creation
05:15 Explanation to Azure AD code
26:00 Azure AD Groups overage in .Net6 Web API
28:00 Web API calling Azure Graph API
31:00 Web API Azure AD Testing With Postman

[TellaTrix]

Wow, really helpful your all contents on YouTube

[Alex-jwrs]

Please help me. Why if I add mail.read permission and try to get _graphService.Me.Messages, do I get "Message: Resource could not be detected"? I added mail.read and user.read to the scope and ApiPermissions

[arusuvaiunavu]

Thank you very much for the valuable content. Unable to understand the reason you add user.read in the url and delegate permission to it. Please explain the reason.

Hello, friend, how can get name of groups asigned to my account in token???, thanks for your help, have a nice day

[rudrapatisravani]

I am Getting users in Context as null.Anyone please help me on this?

[dupadhyay]

Awesome content...that's really helps me... thanks again

[mikemcwilliams]

This is a really good video as I'm attempting to get the groups. In your group claims, you are using the GroupID, what about using the sAMAccountName and "Emit groups as a role claims? I just think that there's too much working into getting something simple. (I now understand about the header restriction, thank you!) Also, the base controller suggestion (and common practice here at work), however, the application I'm creating has two auth aproviders -- and the base controller is deeply wired into one of our base controller.

Without using graph, Windows Server AD based groups are the only ones appearing in the roles collection; meaning that (for instance), my account has two of them -- but I'm in several groups. Are you saying that the only way I can use groups is through the groupID rather than a group name? (if so, that seems entirely too laborious) Please advise.

[mahmoudkchaou-fb]

I created an app on Power Apps and also created users on Azure. Now I need to integrate these users into my application by assigning them specific roles. can you help me please

[zia]

amazing ! thank you very much i was struggling all these times with this Azure AD authentication and authorization, you made it really easy for me now

[sharmavadali]

The Allow Admin Consent is disabled, because of which not able to run the application, any help is appreciated

[apoorvasd]

very simple and crisp explanation. thanks v much! really helpful

[viksdeeps]

Good explanation and helpful. Do you have a video how one can call the same using webapi instead of postman or swagger.

[shashankgonuguntla]

Hi, After adding I am getting access token and id token using angular 12 but I can see group claims only in id token where as I can't see group claims in access token. Can you help me from this.

[nagamallikaannapureddy]

please provide code to generate JWT token in client application instead of using postman

[ulteriormotive]

Superb tutorial and explanation. Thanks so much for the insight!

[MatheusAlmeidaC]

hi, i want to make a system that can only be accessed by certain AD groups

to access the API you created in the video you need to enter the username and password through the login screen

i want the microsoft login screen to only be needed on the frontend, so my backend only receives the jwt token and validates if it can access each route, is it possible to do that? do you have a video explaining this?

[KanokpitsunLertprommakul]

Nowadays, Seem like azure have updated about returning claims groups to the new format but thanks for this video.

[piyalibasak]

thank you very much for this video..The content is really solid..appreciating you a lot.thanks once again

[Stefano-wufs]

Great content, really helpful, thanks!

[bouzidiyakoub]

hello, thanks for this video, how to generate this token 14:08 in C# ?