在Azure API管理中检索用户的AAD应用程序角色

Question

我们已经注册了Azure AD App，并将清单文件更新为包括2个应用程序角色，然后将用户分配给了应用程序角色。

    {
        "allowedMemberTypes": [
            "User"
        ],
        "description": "Approvers can approve the information",
        "displayName": "Approver",
        "id": "8f29f99b-5c77-4fba-a310-4a5c0574e8ff",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "approver"
    }

清单文件也有

"oauth2AllowIdTokenImplicitFlow": true,
"oauth2AllowImplicitFlow": true,
"groupMembershipClaims": "All",

AAD应用程序已启用ID Token和Access Token

在Azure API Management中，我们启用了具有以下属性的OAuth2：

• 授权码
• 访问令牌发送机制：授权标头
从AAD应用程序检索到的
• 客户端ID /机密

登录开发人员门户并测试API时，我们能够检索AAD JWT令牌；但是，即使已为用户分配了应用程序角色，分配给用户的Roles也不会包含在令牌中。

{
  "aud": "https://management.core.windows.net/",
  "iss": "https://sts.windows.net/xxxxxxxxxxxxx/",
  "iat": 1559283639,
  "nbf": 1559283639,
  "exp": 1559287539,
  "acr": "1",
  "aio": "xxxxxxxxxx",
  "amr": [
    "rsa",
    "mfa"
  ],
  "appid": "dbccd1a6-1dab-4013-8601-ee6054b5a12",
  "appidacr": "1",
  "deviceid": "d1c0faa8-xxxx-xxxx-xxxx-7f2a791387a7",
  "family_name": "Gxxxx",
  "given_name": "Pxxxxxxx",
  "name": "Pxxxxxxx Gxxxx",
  "oid": "741232d8-xxxx-xxxx-xxxx-aed51374ec7a",
  "scp": "email offline_access openid profile",
  "sub": "",
  "tenant_region_scope": "WW",
  "tid": "72f988bf-xxxx-xxxx-xxxx-xxxxxxxxx",
  "unique_name": "email@host.com",
  "upn": "email@host.com",
  "uti": "rMaJcHJTLUKFBvkPXLpDAQ",
  "ver": "1.0"
}

此令牌是使用OAuth2从PowerApps自定义连接器生成的

backend API也希望获得角色信息。

配置是否有问题？我们还如何为用户检索Application Roles？