Authenticate AZURE Ad user by App role assigned to the user group

Question

I have created an App role for my AZURE AD Backend Api and assigned this role to a group. Now I want to authenticate user in my .net core backend application on the basis if user has a group which has this role. I am getting the group ids in the access token but how can I get app roles assigned to these groups.

Answer 1

Please check how you enabled group claims in Azure Portal.

If you check the Emit groups as role claims option like below you cannot see application roles, but you can see group ids.

If the above option is enabled, make sure to uncheck the box.

Note

If you use the option to emit group data as roles, only groups will appear in the role claim. Any application roles that the user is assigned to won't appear in the role claim.

Also, I would suggest you refer to this Microsoft official documentation below which states that if you add a service principal to a group, and then assign an app role to that group, Azure AD does not add the roles claim to tokens it issues.You can modify the “groupMembershipClaims” field in application manifest if you want to include groups claim in your token like below: -

Add app roles to your application and receive them in the token

For more in detail, please refer below link:

Configure group claims for applications by using Azure Active Directory

Answer 2

Try adding 15 spaces to the rest of the lines, not the first line:

s = series1.to_string()
line1, *rest = s.splitlines()
s = '\n'.join([line1, *map((' ' * 15).__add__, rest)])
print(f"The series is: {s}")