Search code examples
javaspringspring-bootazureazure-active-directory

why it is called 'APPROLE_Admin' instead of 'Admin' in Spring boot App secured by Azure AD

I followed the article, https://learn.microsoft.com/en-us/azure/developer/java/spring-framework/configure-spring-boot-starter-java-app-with-azure-active-directory and created an App role

enter image description here

and assigned the user

enter image description here

in the spring boot application, I have to use 'APPROLE_Admin' instead of 'Admin' ? why? it is supposed to be only 'Admin', correct?

@CrossOrigin(origins = "http://localhost:8080")
@RestController
@RequestMapping("/api")
public class TutorialController {

    @Autowired
    TutorialRepository tutorialRepository;

    @PreAuthorize("hasAuthority('APPROLE_Admin')")
    @GetMapping("/tutorials")
Solution

  • The APPROLE_ prefix is coming from a default property configuration from Spring Cloud Azure.

    spring.cloud.azure.active-directory.resource-server.claim-to-authority-prefix-map

    Configure which claim will be used to build GrantedAuthority, and prefix of the GrantedAuthority’s string value. Default value is: "scp" → "SCOPE_", "roles" → "APPROLE_".

    Documentation link

    You can update the property with a desired prefix:

    spring:
  cloud:
    azure:
      active-directory:
        resource-server:
          claim-to-authority-prefix-map:
            roles: "" # no prefix
            scp: "MY_SCP_PREFIX_"