Changes to use Session data for Authorization

Author: Shama-K

5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/Configure.ps1

@@ -253,6 +253,8 @@ Function ConfigureApplications
    Write-Host "- For 'webApp'"
    Write-Host "  - Navigate to '$webAppPortalUrl'"
    Write-Host "  - Navigate to the API Permissions page and select 'Grant admin consent for (your tenant)'" -ForegroundColor Red 
+   Write-Host "  - On Azure Portal, create a security group named GroupAdmin, assign some users to it, and configure your ID and Access token to emit GroupID in your app registration. Configure the value for 'GroupAdmin' key in appsettings.json." -ForegroundColor Red 
+   Write-Host "  - On Azure Portal, create a security group named GroupMember, assign some users to it, and configure your ID and Access token to emit GroupID in your app registration. Configure the value for 'GroupMember' key in appsettings.json." -ForegroundColor Red 
 
    Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" 
 

5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/sample.json

@@ -31,6 +31,12 @@
       "ManualSteps": [
         {
           "Comment": "Navigate to the API Permissions page and select 'Grant admin consent for (your tenant)'"
+        },
+        {
+          "Comment": "On Azure Portal, create a security group named GroupAdmin, assign some users to it, and configure your ID and Access token to emit GroupID in your app registration. Configure the value for 'GroupAdmin' key in appsettings.json."
+        },
+        {
+          "Comment": "On Azure Portal, create a security group named GroupMember, assign some users to it, and configure your ID and Access token to emit GroupID in your app registration. Configure the value for 'GroupMember' key in appsettings.json."
         }
       ]
     }

5-WebApp-AuthZ/5-2-Groups/Controllers/UserProfileController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Graph;
 using Microsoft.Identity.Web;
 using System.Threading.Tasks;
@@ -16,7 +17,7 @@ public UserProfileController(GraphServiceClient graphServiceClient)
         {
             this.graphServiceClient= graphServiceClient;
         }
-
+        [Authorize(Policy = "GroupAdmin")]
         [AuthorizeForScopes(Scopes = new[] { Constants.ScopeUserRead })]        
         public async Task<IActionResult> Index()
         {

5-WebApp-AuthZ/5-2-Groups/Infrastructure/CustomAuthorization.cs

@@ -0,0 +1,56 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc.Filters;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+namespace WebApp_OpenIDConnect_DotNet.Infrastructure
+{
+    public class GroupPolicyHandler : AuthorizationHandler<GroupPolicyRequirement>
+    {
+        private IHttpContextAccessor _httpContextAccessor;
+
+        public GroupPolicyHandler(IHttpContextAccessor httpContextAccessor)
+        {
+            _httpContextAccessor = httpContextAccessor;
+        }
+        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
+                                                   GroupPolicyRequirement requirement)
+        {
+            // Checks if groups claim exists in claims collection of signed-in User.
+            if (context.User.Claims.Any(x => x.Type == "groups"))
+            {
+                if (context.User.Claims.Any(x => x.Type == "groups" && x.Value == requirement.GroupName))
+                {
+                    context.Succeed(requirement);
+                }
+                return Task.CompletedTask;
+            }
+
+            // Checks if Session contains data for groupClaims.
+            // The data will exist for 'Group Overage' claim.
+            else if (_httpContextAccessor.HttpContext.Session.Keys.Contains("groupClaims"))
+            {
+                // Retrieves all the groups saved in Session.
+                var groups = _httpContextAccessor.HttpContext.Session.GetAsByteArray("groupClaims") as List<string>;
+                groups = null;
+
+                // Checks if required group exists in Session.
+                if (groups?.Count > 0 && groups.Contains(requirement.GroupName))
+                {
+                    context.Succeed(requirement);
+                }
+            }
+            return Task.CompletedTask;
+        }
+    }
+    public class GroupPolicyRequirement : IAuthorizationRequirement
+    {
+        public string GroupName { get; }
+        public GroupPolicyRequirement(string GroupName)
+        {
+            this.GroupName = GroupName;
+        }
+    }
+}

5-WebApp-AuthZ/5-2-Groups/Services/MicrosoftGraph-Rest/GraphHelper.cs

@@ -85,6 +85,9 @@ public static async Task<List<string>> GetSignedInUsersGroups(TokenValidatedCont
                                         // groupClaims.Add(group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));
                                         groupClaims.Add(group.Id);
                                     }
+
+                                    // Here we add the groups in a session variable that is used in authorization policy handler.
+                                    context.HttpContext.Session.SetAsByteArray("groupClaims", groupClaims);
                                 }
                             }
                         }
@@ -107,9 +110,6 @@ public static async Task<List<string>> GetSignedInUsersGroups(TokenValidatedCont
                 }
             }
 
-            // Here we add the groups in a session variable to print on the home page for informational purposes
-            context.HttpContext.Session.SetAsByteArray("groupClaims", groupClaims);
-
             return groupClaims;
         }
 

5-WebApp-AuthZ/5-2-Groups/Startup.cs

@@ -47,20 +47,26 @@ public void ConfigureServices(IServiceCollection services)
                     options.Events.OnTokenValidated = async context =>
                     {
                         //Calls method to process groups overage claim.
-                        await GraphHelper.GetSignedInUsersGroups(context);
+                        var groupClaims = await GraphHelper.GetSignedInUsersGroups(context);
+                    };
+                    options.Events.OnSignedOutCallbackRedirect = async context =>
+                    {
+                        context.HttpContext.Session.Clear();
                     };
                 }, options => { Configuration.Bind("AzureAd", options); })
                     .EnableTokenAcquisitionToCallDownstreamApi(options => Configuration.Bind("AzureAd", options), initialScopes)
                     .AddMicrosoftGraph(Configuration.GetSection("GraphAPI"))
                     .AddInMemoryTokenCaches();
 
-            services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
+            // Adding authorization policies that enforce authorization using group values.
+            services.AddAuthorization(options =>
             {
-                // The following code instructs the ASP.NET Core middleware to use the data in the "groups" claim in the [Authorize] attribute and for User.IsInRole()
-                // Uncomment the following if you wish to use groups for roles
-                // See https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles for more info.
-                // options.TokenValidationParameters.RoleClaimType = "groups";
+            options.AddPolicy("GroupAdmin",
+            policy => policy.Requirements.Add(new GroupPolicyRequirement(Configuration["Groups:GroupAdmin"])));
+                options.AddPolicy("GroupMember",
+              policy => policy.Requirements.Add(new GroupPolicyRequirement(Configuration["Groups:GroupMember"])));
             });
+            services.AddSingleton<IAuthorizationHandler, GroupPolicyHandler>();
 
             services.AddDistributedMemoryCache();
             services.AddSession(options =>

5-WebApp-AuthZ/5-2-Groups/appsettings.json

@@ -14,6 +14,10 @@
     "BaseUrl": "https://graph.microsoft.com/v1.0",
     "Scopes": "User.Read GroupMember.Read.All"
   },
+  "Groups": {
+    "GroupAdmin": "Enter the objectID for GroupAdmin group copied from Azure Portal",
+    "GroupMember": "Enter the objectID for GroupMember group copied from Azure Portal"
+  },
   "Logging": {
     "LogLevel": {
         "Default": "Information",