Want to understand OAuth Code flow where Application passes the Access_Token on user's behalf to the API to get the resources

Question

I like to know my understanding is correct and also like to clarify my doubts further.

1) Confirm my Understanding:

In the below image, I have explained my understanding of protecting the application and api using Azure AD. I have exposed the API with the SCOPE and the Application has consumed the same through the permission module.

Can someone please confirm my understanding is correct?

2) Should we pass Role in ACCESS_TOKEN?

This is where I require someone to help me. This is a code flow where the User login into the Application and while he tries to get the Todo list, an application sends a request to the API. In this communication, an application gets the ACCESS_TOKEN for the login-in user and passes it to the request going to the API.

At the API side, we have the policy where it checks the Scope coming through IHttpContextAccessor.HttpContext.User.Identity and make sure the Claim has scp/scope and it has the right value.

Now, all are going well. The questions here are:

1. Should we not have Role (User's role) in the ACCESS_TOKEN? (When I said Role - I mean User's role not Application's role)

following the link at Microsoft documentation I am getting the role in claim when user login to the Application but to call the API I have to use ACCESS_TOKEN which I am getting through TokenAcquisition.GetAccessTokenForUserAsync and it doesn't include Role. It includes SUB, userPreferedName, email and Scope kind of detail (have checked in jwt.io)

2. If the answer of Question #1 is "NO, we should not" what is the way for API to check the user's role and give the result? Is that something we need to stuff in SCOPE only?

REF: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps

To give better context, I have added my Azure Configuration as well here.

Answer 1

1. Confirm my Understanding:

Based on your screenshot, your understanding is basically accurate.

Microsoft identity platform issues you an access token after you sign in, and then you use this access token to call your web API. The API will validate the access token and the permissions / roles, which determines whether you can access its data.

This Protocol diagram is clearer for your understanding.

2. Should we pass Role in ACCESS_TOKEN?

Firstly, the link you shared is related to Application Roles. But you are not talking about that. What you are talking about is the AAD role (eg. Global admin, Group admin). Correct me if there is any understanding.

Honestly, AAD role should not be included in the access token because it's meaningless. To access your web API, you should define your own roles to control the permissions of users. AAD roles only work when you try to perform AAD or Microsoft Graph operations.

If the answer of Question #1 is "NO, we should not" what is the way for API to check the user's role and give the result?

You have found the correct guide: Add app roles to your application and receive them in the token.

You should use Application Roles. Define the User app role in the Azure AD app which represents your API and assign your users to the role. Then your API can check the user's role by verifying scopes and app roles.

There is another method to control the user's role: using Group Claims which is also mentioned in the link you shared. The detailed steps are listed here.