如何获取Azure Active Directory角色或用户组

Question

I have a win 8 app in which I want to authenticate ADFS user based on role. I found a article http://msdn.microsoft.com/library/azure/dn169448.aspx This is a very good article to integrate win 8 app with Adfs and uses mvc as webclient for ad.

  AuthenticationContext authenticationContext = new AuthenticationContext("https://login.windows.net/" + domainName);

        AuthenticationResult result = await authenticationContext.AcquireTokenAsync(resourceAppIDUri, clientID);
        if (AuthenticationStatus.Succeeded != result.Status)
        {}

By using this code user get successfully authenticated, in case succeeded than I want to authorize user against user group. Is there any way?

There is a method in ClaimsPrinicipal IsInRole() but it always returns false. And in Claims collection there is nothing for role or user group. I searched over net and found this link http://www.cloudidentity.com/blog/2013/01/22/group-amp-role-claims-use-the-graph-api-to-get-back-isinrole-and-authorize-in-windows-azure-ad-apps/

But this uses graph api. I want it in a simpler way. Anyways I tried to use graph Api but on requesting https://graph.windows.net/ {0}/Users('{1}')/MemberOf I get a priviledge exception. Graph api can only be used by a admin privilege account. So How I gonna fetch current user login group?

Answer 1

That post is for Azure Active Directory. The only way in AAD to get the roles is via the Graph API.

You want to use ADFS. ADFS does not support the Graph API. ADFS supplies roles in the form of claims. This uses a SAML token.

But the title states " Azure AD IsInRole"?

Please edit the question to make it clear exactly what topology (ADFS / AAD) you are targeting.

Win 8 applications are what is referred to as native applications. These typically use OAuth. OAuth is only supported in ADFS 3.0 ie Server 2012 R2.

Answer 2

I found a solution by using Graph api. Below is the method with claimsprinicipal parameter which you get after user logged in. I used the link specified above in question to login user.

private async void GetToken(ClaimsPrincipal claimsPrincipal)
        {
            string upn = claimsPrincipal.FindFirst(
                 "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn").Value;
            string tenantID = claimsPrincipal.FindFirst(
      "http://schemas.microsoft.com/identity/claims/tenantid").Value;
             string requestUrl = string.Format("https://graph.windows.net/{0}/users/{1}/memberOf?api-version=2013-04-05",
            tenantID, upn);

            string appPrincipalID = "152313bf-2566-4bbb-8160-06013dc45679";//This is the cliend id you get after creating web api on azure 
            string appKey = "XP7rvrbzOXl6n94STPgI6LTqU1fOTje4cu+Cererererer8nE=";//generate it on web app on azure 

            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(String.Format(
                      "https://login.windows.net/{0}/oauth2/token?api-version=1.0",
                      domainName));
            System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
            string postData = "grant_type=client_credentials";
            postData += "&resource=" + HttpUtility.UrlEncode("https://graph.windows.net");
            postData += "&client_id=" + HttpUtility.UrlEncode(appPrincipalID);
            postData += "&client_secret=" + HttpUtility.UrlEncode(appKey);
            byte[] data = encoding.GetBytes(postData);
            request.Method = "POST";
            request.ContentType = "application/x-www-form-urlencoded";
            request.ContentLength = data.Length;
            //string authorizationHeader = string.Empty;
            Models.AADJWTToken token = null;

            using (Stream stream = request.GetRequestStream())
            {
                stream.Write(data, 0, data.Length);
                stream.Flush();
                using (var response = request.GetResponse())
                {
                    using (var stream1 = response.GetResponseStream())
                    {
                        using (var reader = new StreamReader(stream1))
                        {
                            string str = await reader.ReadToEndAsync();
                            token = Newtonsoft.Json.JsonConvert.DeserializeObject<Models.AADJWTToken>(str);                              
                        }
                    }
                }
            }

           HttpClient httpClient = new HttpClient();
            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(token.TokenType, token.AccessToken);
           var re = await httpClient.GetAsync(requestUrl);
            var se = await re.Content.ReadAsStringAsync();

         //this variable hold your result with user group in json format.


        }