Error AADSTS50105 if the user is member of a group that is a member of another group

Question

We have successfully set up AAD authentication for an existing Service Fabric cluster using this documentation. However, we have some issues when it comes to assigning groups to the application:

• Connect with a user that has the admin role directly assigned ✔
• Connect with a user that is member of a group which is directly assigned to the admin role ✔
• Connect with a user that is member of a group which is member of the group which is directly assigned to the admin role ❌

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS50105: The signed in user '{EmailHidden}' is not assigned to a role for the application

Connect-ServiceFabricCluster -ConnectionEndpoint xxx.westeurope.cloudapp.azure.com:19000 -

AzureActiveDirectory -ServerCertThumbprint yyy
WARNING: Failed to contact Naming Service. Attempting to contact Failover Manager Service...
WARNING: Failed to contact Failover Manager Service, Attempting to contact FMM...
False
Connect-ServiceFabricCluster : GetAccessToken failed:
authority=https://login.microsoftonline.com/zzz
cluster=xxx client=yyy
error=Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS50105: The signed in user
'{EmailHidden}' is not assigned to a role for the application
'xxx'(myclustername).
Trace ID: <traceid>
Correlation ID: <correlationId>
Timestamp: 2020-09-01 16:03:00Z
   at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.RunAsyncTask[T](Task`1 task)
   at System.Fabric.AzureActiveDirectory.Client.ClientUtility.GetAccessToken(String authority, String audience, String
client, String redirectUri, Boolean refreshSession)
   at GetAccessToken(Char* authority, Char* audience, Char* client, Char* redirectUri, Boolean refreshSession, Char*
outBuffer, Int32 outBufferSize)
        ErrorCode: access_denied
        StatusCode: 0
At line:1 char:1
+ Connect-ServiceFabricCluster -ConnectionEndpoint xxx.westeurop ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Connect-ServiceFabricCluster], FabricException
    + FullyQualifiedErrorId : TestClusterConnectionErrorId,Microsoft.ServiceFabric.Powershell.ConnectCluster

I tried both via Service Fabric Explorer and Powershell (Connect-ServiceFabricCluster). Service Fabric Explorer just freezes after logging in, while Powershell gives the error mentioned above.

Am I hitting a limit for what is possible, or is it possible to allow this?

Answer 1

Nested groups are not supported for group based assignments.

https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-saasapps

Group-based assignment is supported only for security groups. Nested group memberships are not supported for group-based assignment to applications at this time.