How to configure Azure AD Oauth2 to return all user groups on login

Question

I have an AD registered application which has an integration with Azure AD for SSO. It uses the Oauth2 strategy, by using the omniauth-azure-activedirectory-v2 gem.

I want to map a users security groups to my applications authorization model and for this I need the names of the security groups.

I want to reliably get a users security groups and the group names on login and I'm not able to. I get them sometimes correctly, sometimes in a uuid format and sometimes not at all.

I have an optional group claim set up for my application in Token Configuration and configured to return sam_account_name for all attached groups.

This seems to work fine for some clients, the groups are returned as for example "Admin_APP", but for others I seem to have the following issues:

• A Users groups are returned but only as a ID( c5bb3738-59f1-4718-b34c-2dfac761e023 ), even tough I requested the name.
• A User has "readable groups" but not all assigned in AD, some are missing.

Is this a configuration on my application side or should the organization adding my application to their AD configure their groups or my application? Or should I not rely on the token cliam at all and fetch the groups using the GraphQL API Azure offers?

I noticed when adding the application myself I need to give permissions for my user.profile but it doesn't show allowable permissions for groups. Also in the Enterprise application tab for the organization under permissions I can't seem to find the group claim I added. Only openid , profile and email .

Answer 1

I tried to reproduce the same in my environment and got the results like below:

I configured the Optional claims in Azure AD Application:

I generated the access token via Postman by using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:user.read openid
grant_type:authorization_code
redirect_uri:redirectUri
code:code

When I decoded the token, I got the Group IDs instead of Group Name like below:

Note that: If you are configuring sAMAccountName as the claim value in the token, then it only returns the Group which is synced from on-premises AD. By default, Group ObjectID is returned in the group claim value.

By default , groups emitted in a token is limited to 150 for SAML assertions and 200 for JWT.

I agree with junnas , you can make use of Graph API to get the user groups like below:

https://graph.microsoft.com/v1.0/users/UserID/memberOf

To get the only list of security groups user belongs to, you can make use of below query:

https://graph.microsoft.com/v1.0/users/UserID/memberOf?Filter("mailEnabled eq false and securityEnabled eq true")

References:

List a user's direct memberships - Microsoft Graph v1.0 | Microsoft Learn

How to get groups to appear as claims in the access_token by AmanpreetSingh-MSFT