Azure AppService 与用户 AD 身份验证

Question

Imagine such a scenario: I have Web API app deployed tu azure as an app service. What I want to do is to implement role-based actions in this Web API. The problem is that this API will be called from other MS products such as Dynamics CRM, Sharepoint Online, etc. and actions should be called as authenticated user from this other product. So to simplify:

1. User logs into Dynamics CRM
2. Some action will be called from Web API
3. I need to get information about who called action in Web API code to verify if the user is authorized to actually call this action

Do you have some materials, tutorials about how to achieve this? We've spent a lot of time for research about this and didn't found any information about such simple case.

Answer 1

I believe that you are looking for group claim or app roles .

For group claim, you could add the users into different security Groups and include Groups claim in your token. You just need to modify the "groupMembershipClaims" field in application manifest:

"groupMembershipClaims": "SecurityGroup"

Then the ID token will contain the Ids of the groups that the use belongs to like below:

{
  "groups": ["{group id}"]
}

Then you could implement the code logic in your code by the group id.

For app roles, I think it may be more applicable to you. You can add app roles in your application and receive them in the token . After you configure it, you will get the app role claim in the id token of the authorized user. Then you could execute judgment statements based on it.

More information here: Using groups vs using application roles for authorization in Azure AD apps .