ASP.NET Core 6.0 which uses Microsoft Identity Platform for authentication and Active Directory groups for authorization

Question

We are building an ASP.NET Core MVC web application for an organization. This organization has their users in Azure Office 365. We are planning to create a new ASP.NET Core MVC web application and define the authentication to use the Microsoft Identity Platform. Finally for the authorization, we are going to build Azure security groups and reference them inside our application.

We have this AD security group:

and we reference it inside the program.cs as follows:

builder.Services.AddAuthorization(options =>
    {
        options.AddPolicy("admin-only", p =>
             { p.RequireClaim("groups", "4876872c-918e-4405-80b3-6fef38bbaa69"); });
        options.FallbackPolicy = options.DefaultPolicy;
    });

Inside the controller, we use this as follows:

[Authorize("admin-only")]
public IActionResult Privacy()
{
    return View();
}

Is my approach valid?

Answer 1

You also need to add below code

builder.Services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
        .AddAzureAD(options => Configuration.Bind("AzureAd", options));

You code should like below:

builder.Services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
        .AddAzureAD(options => Configuration.Bind("AzureAd", options));

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("admin-only", p =>
         { p.RequireClaim("groups", "4***a69"); });
    options.FallbackPolicy = options.DefaultPolicy;
});
...
app.UseAuthentication(); 
app.UseAuthorization();
...