Authorize users with Azure Active Directory in ASP.NET Core

In the previous article
we discussed how to integrate Azure AD authentication in an ASP.NET Core web
application. Continuing from where we left, this article shows how to authorize
users based on their AD groups.
First of all you need to create required groups in Azure AD and then assign
one or more groups to a user account. So, open the Azure AD that you used last
time and locate the Groups options as shown below:

Then click on New Group to open this page:

Specify a group name (say, TestGroup) and also select which user accounts
should be part of the group being created. To do so click on the Members option
and search / select user accounts. Click Create to create the group.
You can add users to a group later also. You can even do this from a user
account page rather than from group page.
Once a group is created, go to its page and note down its Object Id:

You will need this Object Id in your ASP.NET Core web application.
Next, go to your registered application and select the Manifest option.

This will open Manifest editor where you can modify the manifest. In the
editor, set the groupMembershipClaims property to SecurityGroup. You need to do
this since your web application wants to read group information to perform
authorization.

OK. So, now we have TestGroup ready and user1 account (or whatever user
account you created earlier) has been assigned this group.
Open the same web application that you created with the
previous article. Then
open appsettings.json file and add the following section to it:
"AzureADGroup": {
"TestGroupId": "YOUR_GROUP_OBJECT_ID_HERE"
}
The AzureADGroup section stores the group's Object Id in a key named
TestGroupId.
Next, open Startup class and add the following code to its ConfigureServices()
method.
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthentication(
AzureADDefaults.AuthenticationScheme)
.AddAzureAD(options =>
Configuration.Bind("AzureAD", options));
services.AddAuthorization(options => {
options.AddPolicy("TestGroupPolicy", policyBuilder =>
policyBuilder.RequireClaim("groups",
Configuration.GetValue<string>("AzureADGroup:TestGroupId")));
});
services.AddControllersWithViews();
services.AddRazorPages();
}
As you can see, AddAuthorization() method enables policy based authorization
by defining an authorization policy named TestGroupPolicy. The TestGroupPolicy
specifies a condition that a user is required to have groups claim whose value
matches the TestGroup's Object Id (picked from appsettings.json).
You can define more than one policies here but for our purpose
TestGroupPolicy is sufficient.
Then go to Index() action in HomeController and change the [Authorize]
attribute like this:
[Authorize(Policy ="TestGroupPolicy")]
public IActionResult Index()
{
ViewBag.UserName = User.Identity.Name;
return View();
}
The [Authorize] attribute now sets the Policy property to TestGroupPolicy.
If you try to sign-in with a user account that has been assigned TestGroup
group, you will see sign-in success message as before. However, if you sign-in
with a user account that is not a part of TestGroup you will get Access denied
error.

That's it for now! Keep coding!!