Authentication Process Get Azure AD group the user is a member of and do logic

问题

Is there a way to get the Group the User is member of so we can process the authentication, or even throw exception so the token will not be created.

The reason we need groups is that we can not create OU in Azure AD whereas we could before in LDAP. We retrieved the distinguished name and therefore had very rich information about said user.

Lastly, we do see that you could create an OU on-premises but read that Graph API would not recognize it or could not retrieve it.

We are attempting to do logic within the SecurityTokenValidated stage of Authentication process and we break the process whenever we try to use:

string UPN = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.Name).Value

Is this because we are using MSAL?

回答1:

The best approach for you to take here is to make use of the group claims capability of Azure AD. (And for get OUs. OUs are not represented in Azure AD at all.)

Dushyant Gill's blog post on this is relatively old, but still very much relevant: http://www.dushyantgill.com/blog/2014/12/10/authorization-cloud-applications-using-ad-groups/. In short, the process is:

1. Enable group claims for your application by setting the groupMembershipClaims property in your application. After setting this, when a user signs in to your application, the list of groups they are a member of will be included in the token (if the number of groups is smaller than the limit).
2. Update your application's authorization code to make use of the group membership claims (if present).
3. Update your application to query the Azure AD Graph API if the groups membership claim is not present (i.e. if the "overage" claim is present). This happens only when the user is a member of more than 150-250 groups. (Use the _claim_name and _claim_sources claims as indications that the Graph API needs to be called directly.)

As described in the documentation for Azure AD Graph API permissions, in order for your application to call the getMemberGroups method, the app must have the "Read all groups" permission (Groups.Read.All). This permission requires admin consent, but once consent has been granted, the request can be made using the signed-in user's access token.

来源：https://stackoverflow.com/questions/42797166/authentication-process-get-azure-ad-group-the-user-is-a-member-of-and-do-logic