通过 Laravel azure ad oauth 从 Azure AD 获取用户角色

Question

I am trying to get the role form Azure AD by using metrogistics/laravel-azure-ad-oauth socialiate plugin.

I got the name and email and azure_id from the Azure. But I can't get the user role.

user: array:12 [
    "@odata.context" => "https://graph.microsoft.com/v1.0/$metadata#users/$entity"
    "businessPhones" => []
    "displayName" => "Test4"
    "givenName" => "Test4"
    "jobTitle" => null
    "mail" => null
    "mobilePhone" => null
    "officeLocation" => null
    "preferredLanguage" => null
    "surname" => null
    "userPrincipalName" => "test4@xyz.com"
    "id" => "xyz"
  ]

It is possible to get the role from Azure. My setup :

image1 image2 image3

Answer 1

According to my research, the defined AppRole will be returned in id_token. For more details, please refer to the official documentation and the document

Regarding how to get the user's id token, you can use Azure AD OAuth 2.0 authorization code flow to implement it. Here I use postman to acquire access_token and id_token:

And then I can get the id_token

By analyzing the id token, you can get the role of the user:

---

Update

Regarding how to assign app role to user, please refer to the following steps

1. Declare app roles

2. Assign role to user

   a. In the Azure Active Directory pane, select Enterprise applications from the Azure Active Directory left-hand navigation menu.

   b.Select All applications to view a list of all your applications. If you do not see the application you want show up here, use the various filters at the top of the All applications list to restrict the list or scroll down the list to locate your application.

   c. assign role

Answer 2

What you have is an app role , and as the name suggests, they belong to an application. Merely seeking a user's object from Microsoft Graph wouldn't provide those.

And yes, as indicated in another answer, they will be provided to the application in an id_token after the user sign's in.

To fetch those independently of an app, use the Get appRoleAssignment Api.