Authorize By Group in Azure Active Directory B2C
asp.net-mvc, azure, azure-ad-b2c, c#
Solution
This will work, however you have to write a couple of lines of code in your authentication logic in order to achieve what you're looking for.
First of all, you have to distinguish between `Roles` and `Groups` in Azure AD (B2C).
`User Role` is very specific and only valid within Azure AD (B2C) itself. The Role defines what permissions a user does have inside Azure AD .
`Group` (or `Security Group`) defines user group membership, which can be exposed to the external applications. The external applications can model Role based access control on top of Security Groups. Yes, I know it may sound a bit confusing, but that's what it is.
So, your first step is to model your `Groups` in Azure AD B2C - you have to create the groups and manually assign users to those groups. You can do that in the Azure Portal (https://portal.azure.com/):
Then, back to your application, you will have to code a bit and ask the Azure AD B2C Graph API for users memberships once the user is successfully authenticated. You can use this sample to get inspired on how to get users group memberships. It is best to execute this code in one of the OpenID Notifications (i.e. SecurityTokenValidated) and add users role to the ClaimsPrincipal.
Once you change the ClaimsPrincipal to have Azure AD Security Groups and "Role Claim" values, you will be able to use the Authrize attribute with Roles feature. This is really 5-6 lines of code.
Finally, you can give your vote for the feature here in order to get group membership claim without having to query Graph API for that.
Problem
I am trying to figure out how to authorize using groups in Azure Active Directory B2C. I can Authorize via User, for example: ``` [Authorize(Users="Bill")] ``` However, this is not very effective and I see very few use-cases for this. An alternate solution would be Authorizing via Role. However for some reason that does not seem to work. It does not work if I give a user the Role "Global Admin" for example, and try: ``` [Authorize(Roles="Global Admin")] ``` Is there a way to authorize via Groups or Roles?