在已部署到Azure的Web应用程序中确定登录的用户是否是AD组的成员

Question

I am using Windows Identity Framework for authentication in my web app deployed to Azure. When I run the app locally, I can use PrincipalContext to see if the user is in a group:

        PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "DOMAIN");

        // find a user
        UserPrincipal user = UserPrincipal.FindByIdentity(ctx, username);

        // find the group in question
        GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, "GROUP-NAME");

        if (user != null)
        {
            // check if user is member of that group
            return user.IsMemberOf(group);                
        }

This works locally, but does not work in the app deployed to Azure. I'm not sure how to check this information now. I've seen that the LDAP protocol is not supported in Azure, so that's why it's not working, but I'm not sure the correct way to try and accomplish this now. I've read a bit about Group Claims, Application Roles, and the Azure Graph API, but they either seem like overkill, or not the direction I should take. Any help?

Answer 1

As you already discovered, that approach does not work in Azure AD - your app is not running in your intranet hence those calls cannot take place. The standard solution to this is to ensure that Azure AD includes groups in the token sent at sign in time, see this sample .

There are various attention points you need to keep in mind - the main one is that using WIF forces you to rely on WSFederation, and that isn't handy in case you have too many groups: Azure AD avoids issuing large tokens by expecting you to call back to the Azure AD Graph API and retrieve the groups after the fact, but that operation requires more modern protocols like OpenID Connect (as shown in the sample I linked to).

The other challenge is that the groups in the token are represented by their SIDs and not by their names, for security reasons - hence you need to know the SIDS you want to validate against (or call the Graph to retrieve their names).

HTH