通过使用数据库中的数据更新 Claim 进行授权（Blazor WebAssembly ASP.NET Core 托管）

Question

I have a question regarding authentication in my web-app using Blazor WebAssembly ASP.NET Core hosted. The database used is Azure SQL.

I want to avoid storing passwords in the database and the users are therefore restricted to having a Microsoft-account (relevant to the project).

As of now, the user logs in with Azure AD as the third-party authentication provider. When redirected back to the web-app, a user is created with a claim which only consists of the Email from Azure. The user is directed to a registration page where the Email-input is set to the current user-claim email. When the user clicks the register button, the information provided is now stored in the database.

The problem is that I now have a user in the db, but the claim is still just the Email. I want to be able to use the AuthorizeView role tag on the different pages, and therefore wondered if its possible to update the claim with a role that the user specified in the registration-page? This data is at this point only stored in the database.

If this is a bad practice, is there any other similar way I could make this work?

Answer 1

To use the AuthorizeView role , roles claims should be return by your Identity provider (Azure AD in your case). Your application should ask those claims by asking the corresponding scope.
According to the doc: Permissions and consent in the Microsoft identity platform endpoint , the profile scope should return roles claims.

The doc Secure an ASP.NET Core Blazor WebAssembly standalone app with Azure Active Directory explains how to request scopes from Azure AD