Azure B2C approles and permissions

Question

Hi,

Is there a way where I can define application roles AND also what each role can actually perform?

I see we can define approles in the manifest, but what about roles permissions. So that in my application I can like enable/disable UI element based on those granular permissions.

Thanks,

Answer 1

@bdiddy you can use directory extension as optional claims for each of the permissions required. You can create extension "process order" and "cancel order" both of type "boolean" and assign both to user or group C and the latter to user or group D so you can get them in the token issued to each user.

Follows how to create an application, an extension and assign it to the first directory user:

Answer 2

Define your application app roles and assign them to the desired users in the Azure Portal, trough powershell or MS Graph. Then add the MSAL Angular library to your Angular project and create a Guard that validates if the required role(s) is/are present in the user id token:

   @Injectable()  
   class CanActivateOnRoles implements CanActivate {  
     constructor(private msalService: MsalService) {}  
     
     canActivate(  
       route: ActivatedRouteSnapshot,  
       state: RouterStateSnapshot  
     ): boolean {  
       return msalService.getAccount().idToken['roles'].find( r => r === 'some role') !== undefined;  
     }  
   }  

---
Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.