如何配置用户对受Azure AD oAuth2保护的API的访问权限

Question

we have an existing "private/internal" API (non MS/Azure) that we would like to protect with oAuth2 provided by Azure AD, so, that the user's access to the API could be maintained by the Azure AD administrators.

It seems like the way to do this is to configure the API as a web application in the Azure AD. Then, users can get the authorization token from the Azure oAuth2 server and send it to the api (eg from a single page web app).

The API is expected to validate the scope, as per my understanding, received in the token and make a decision regarding the access.

But I can't figure out how to configure the API access scope in the Azure AD against a user. Ie how to link a particular user and the API scope in Azure AD?

Can someone pls advise?

Thank you.

Answer 1

When you configure the app, you can enable "User assignment required" (in the Enterprise application Properties in the Azure Portal), and then configure which users or groups should have access.

Alternatively, if you need more granularity, you can use the Role based access, where you define roles in the application manifest ( https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles ), and then assign users to the different roles.

The [Authorize] attributes on the API controllers or on actions in them can then be configured with the required roles to access them, like so: [Authorize(Roles = "Admin, Writer, Approver")] (any of the three named roles have access).

There is a sample which demonstrates this.