azure-active-directory blazor roles blazor-server-side

How to use Azure AppRoles in Blazor Server with Azure Active Directory

I have an up and running .NET 5 Web-API with a Blazor Server Client in Production. I'd like to switch from Individual User Accounts to Azure AD using App Roles to authenticate specific Users in my Controllers. I found lots of Information regarding Webassembly but none for Blazor Server.

Has somebody a working Solution for a .NET 5/6 Web-Api with a Blazor Server Client and integrating Azure App Roles?

Apps are already registered in the Azure Portal and so forth, I just need to know how to pass the App Roles specific stuff to my API, so my Controller can work with the [Authorize("Admin")] stuff. I suspect it will use Bearer Tokens aswell.

Edit: Thanks a lot for reading. So I figured out that if I use something like this in my Controller only using the [Authorize] Attribute without any roles:

 var identities = HttpContext.User.Identities.ToList();
            foreach (var item in identities)
            {
                if (item.RoleClaimType == "admin")
                {
                    // return or do something
                }
            }

It would just work fine but there has to be some smoother solution for this or am I doing this completly wrong? When I look at the WASM Samples, they pick up the AppRoles with their token and the Controller simply can use the [Authorize(Roles = "xyz")] Attribute. What am I missing here? :/

Btw, this is how my Program.cs looks right now:

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApi(options =>
            {
                builder.Configuration.Bind("AzureAd", options);
                options.TokenValidationParameters.RoleClaimType =
                    "admin";
                options.TokenValidationParameters.RoleClaimType = "doku";
            },
            options => { builder.Configuration.Bind("AzureAd", options); });

Thank you guys/gals <3

Solution

Please check if the given references are of use in your case.

A SERVER API app can authorize users to access secure API endpoints with authorization policies for security groups, AAD Administrator Roles, and App Roles

In Program.cs of a SERVER app, specify the claim as roleclaim

example:

     builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApi(options =>
            {
                Configuration.Bind("AzureAd", options);
                options.TokenValidationParameters.RoleClaimType = 
                    "http://schemas.microsoft.com/ws/2008/06/identity/claims/role";
            },
            options => { Configuration.Bind("AzureAd", options); });

Then you can use admin role on authorization controller to access

[Authorize(Roles = "admin")]
Here in App roles section you can see the configuration for both server and client.
Edit the app role in the manifest editor in portal and then give proper api permissions , expose scopes and grant permission for admin consent >see Add app roles and get them from a token .And the procedural logic must contain those scopes required by api.

Note : The appRoles manifest property of both the client and the server Azure portal app registrations must include the same configured roles.

Please check this for more detailed information which guides for both server and client apps.

Other references: