Search code examples
oauth-2.0azure-active-directory

How to configure Azure AD Oauth2 to return all user groups on login

I have an AD registered application which has an integration with Azure AD for SSO. It uses the Oauth2 strategy, by using the omniauth-azure-activedirectory-v2 gem.

I want to map a users security groups to my applications authorization model and for this I need the names of the security groups.

I want to reliably get a users security groups and the group names on login and I'm not able to. I get them sometimes correctly, sometimes in a uuid format and sometimes not at all.

I have an optional group claim set up for my application in Token Configuration and configured to return sam_account_name for all attached groups.

This seems to work fine for some clients, the groups are returned as for example "Admin_APP", but for others I seem to have the following issues:

  • A Users groups are returned but only as a ID(c5bb3738-59f1-4718-b34c-2dfac761e023), even tough I requested the name.
  • A User has "readable groups" but not all assigned in AD, some are missing.

Is this a configuration on my application side or should the organization adding my application to their AD configure their groups or my application? Or should I not rely on the token cliam at all and fetch the groups using the GraphQL API Azure offers?

I noticed when adding the application myself I need to give permissions for my user.profile but it doesn't show allowable permissions for groups. Also in the Enterprise application tab for the organization under permissions I can't seem to find the group claim I added. Only openid, profile and email.

Solution

  • I tried to reproduce the same in my environment and got the results like below:

    I configured the Optional claims in Azure AD Application:

    enter image description here

    I generated the access token via Postman by using below parameters:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:user.read openid
grant_type:authorization_code
redirect_uri:redirectUri
code:code

    enter image description here

    When I decoded the token, I got the Group IDs instead of Group Name like below:

    enter image description here

    Note that: If you are configuring sAMAccountName as the claim value in the token, then it only returns the Group which is synced from on-premises AD. By default, Group ObjectID is returned in the group claim value.

    By default, groups emitted in a token is limited to 150 for SAML assertions and 200 for JWT.

    I agree with junnas, you can make use of Graph API to get the user groups like below:

    https://graph.microsoft.com/v1.0/users/UserID/memberOf

    enter image description here

    To get the only list of security groups user belongs to, you can make use of below query:

    https://graph.microsoft.com/v1.0/users/UserID/memberOf?Filter("mailEnabled eq false and securityEnabled eq true")

    enter image description here

    References:

    List a user's direct memberships - Microsoft Graph v1.0 | Microsoft Learn

    How to get groups to appear as claims in the access_token by AmanpreetSingh-MSFT