Claims based authorization token in Azure B2C and .Net Core 2.0

Question

I am building a ASP .Net Core 2.0 app and would like to know how to add the groups claim to my Azure B2C access token on my backend. I use the user's id to query MS Graph to get the user's group claim using ADAL and need the groups on the authorization token every time the user hits a controller. I would rather not query MS Graph every time a controller is hit.

Is it possible to add the groups claim to the B2C token after it is retrieved?

If not, should I store the groups as a Session variable?

If those aren't right, should I craft a second authorization token with the groups and then use that in my header when I send reqeusts?

score 0 · Answer 1 · answered Aug 09 '19 at 05:46

You can in one of the OpenID Notifications (i.e. OnTokenValidated) and add user's groups(or roles ,but they are different ) to the ClaimsPrincipal. Something like :

options.Events = new OpenIdConnectEvents
{

    OnTokenValidated =  ctx =>
    {
        //query the user's groups using api 

        // add claims
        var claims = new List<Claim>
        {
            new Claim("groups", xxxx-xx-xx)
        };
        var appIdentity = new ClaimsIdentity(claims);

        ctx.Principal.AddIdentity(appIdentity);

        return Task.CompletedTask;
    },   
};

Below links are code sample with .net framework , you can modify to fit the .net core version :

Authorize By Group in Azure Active Directory B2C

Azure AD B2C - Role management

You can support adding group claims to b2c issued tokens by voting for it in the Azure AD B2C feedback forum: Get user membership groups in the claims with Azure AD B2C

Does this execute every time a request hits a controller / action that needs authentication? This seems to take too long. I meant to ask how to add the groups claim to the token and then send it to the client so MS Graph doesn't need to be queried multiple times. — afriedman111, Aug 09 '19 at 13:54
@afriedman111 , that is not possible currently , you can vote for feature request as shown above . — Nan Yu, Aug 12 '19 at 01:08

Claims based authorization token in Azure B2C and .Net Core 2.0

1 Answers1