Missing "roles" claim in access_token from authorization code flow.

Question

There are two applications: SPA client app and protected api. Security lib on api side expects "roles" claim in access token sent along with request.

Both applications are registered in Azure AD in app registration blade. There is app role defined in both app registrations. There are users assigned to the role (in context of both apps: client and api) in "enterprise applications" section of Azure AD. Client app uses MSAL library and authorization code flow to get token. In requests to /authorize and /token endpoints there is scope based on api ID URI plus "/.default" suffix (like: "api://name-of-ap/.default). Urls for /authorize and /token security endpoints contains tenant id.

Unfortunately, received token doesn't contain "roles" claim. How to fix this ?

Answer 1

@Łukasz Engel

As I understand you are trying to get application roles as claims in access token.

you're implementing app role business logic in an app-calling-API scenario, you have two app registrations. One app registration is for the app, and a second app registration is for the API. In this case, define the app roles and assign them to the user or group in the app registration of the API. When the user authenticates with the app and requests an ID token to call the API, a roles claim is included in the ID token.

You can follow below article to achieve this,

https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps

You can create a Azure AD policy and define role claim in the policy. Once created you have to assign this policy to specific service principal associated to the application.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.