通过分配给用户组的App角色来验证Azure AD用户
我为Azure AD Backend API创建了一个应用程序角色，并将此角色分配给了一个组。现在，如果用户具有具有此角色的组，我想在我的.NET Core后端应用程序中对用户进行身份验证。我在访问令牌中获得了组ID，但是如何将应用程序角色分配给这些组。
I have created an App role for my AZURE AD Backend Api and assigned this role to a group. Now I want to authenticate user in my .net core backend application on the basis if user has a group which has this role. I am getting the group ids in the access token but how can I get app roles assigned to these groups.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
请检查您如何在Azure门户中启用组索赔。
如果您将EMIT组作为角色索赔选项检查，则无法看到应用程序角色，但是您可以看到组ID。
如果启用了上述选项，请确保取消选中框。
note
，我建议您在下面参考此Microsoft官方文档， ，然后将应用程序角色分配给该组，Azure AD不会向令牌IT问题添加角色。下图： -
将应用程序角色添加到您的应用程序中，并在令牌中接收它们
有关更多信息，请详细介绍请参阅>下面的链接：
使用Azure Active Directory 配置应用程序索赔
Please check how you enabled group claims in Azure Portal.
If you check the Emit groups as role claims option like below you cannot see application roles, but you can see group ids.
If the above option is enabled, make sure to uncheck the box.
Note
Also, I would suggest you refer to this Microsoft official documentation below which states that if you add a service principal to a group, and then assign an app role to that group, Azure AD does not add the roles claim to tokens it issues.You can modify the “groupMembershipClaims” field in application manifest if you want to include groups claim in your token like below: -
Add app roles to your application and receive them in the token
For more in detail, please refer below link:
Configure group claims for applications by using Azure Active Directory