Discussion on: Securing a Blazor WebAssembly Hosted Apps with Azure Active Directory - Part 2

View post

I followed your tutorial, and after a month of trying to get this to work on my own, I was finally able to make progress. However I still haven't fully gotten it to work. I am fully authorized in the front end with all the roles and what not available, and I can hit api routes that just have the [Authorize] attribute, however when I want to specify the role, nothing I do works. I've spent two days trying to figure out why.

I turned on logging for the JWT on the backend and it validates everything properly. Even when I decode the token it has "roles: {list of roles}". However, when I use [Authorize(Roles = "{role in list}")] I get nothing but 403 errors. Any advice?

Evan Howlett • Aug 29 '22

Instead of doing

AddMicrosoftIdentityWebApi(options =>
        {
            builder.Configuration.Bind("AzureAd", options);
            options.TokenValidationParameters.RoleClaimType =
                "http://schemas.microsoft.com/ws/2008/06/identity/claims/role";
        },
        options => { builder.Configuration.Bind("AzureAd", options); });

AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));