Issue
Azure AD provides us with a nice mechanism of assigning users to a app role defined in the Azure AD portal. However there is no mechanism which defines the permissions each app role has. For example what if we want to control the CRUD operations on a role called TaskUser (as defined in the docs). What if we only want to allow POST and GET for that role.
How can we do this without hardcoding the correlation between an app role and it's permissions. Currently this is hardcoded in the following example created by Microsoft: https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/5-AccessControl
Please provide us with the following information:
This issue is for the sample
https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/5-AccessControl
- [ ] 1-1) Sign-in with Azure AD
- [ ] 1-2) Sign-in with Azure AD B2C
- [ ] 2-1) Acquire a Token and call Microsoft Graph
- [x] 3-1) Protect and call a web API on Azure AD
- [ ] 3-2) Protect and call a web API on Azure AD B2C
- [ ] 4-1) Deploy to Azure Storage and App Service
- [ ] 4-2) Deploy to Azure Static App Service
- [x ] 5-1) Call a web API using App Roles
- [ ] 5-2) Call a web API using Security Groups
- [ ] 6-1) Call Microsoft Graph using on-behalf-of flow
- [ ] 6-3) Call a web API using Conditional Access Auth Context
- [ ] 6-4) Sign-in with Hybrid SPA flow
This issue is for a
- [ ] bug report -> please search issues before submitting
- [x ] question
- [ ] feature request
- [ ] documentation issue or request
Minimal steps to reproduce
- Follow the steps as stated in the example tutorial
Any log messages given by the failure
Expected/desired behavior
No hardcoding permissions like (PUT, POST, UPDATE, DELETE) but manageable in the Azure Portal.
Otherwise we have to maintain this on application level, which is not desired.
Also the possibility for Deviating settings per role per api pathname.
App Role: TaskUser
API Path: /api/todolist
Allowed Operations: POST, GET
App Role: TaskAdmin
API path: /api/todolist
Allowed Operations: POST, GET, UPDATE, DELETE
Library version
"@azure/msal-browser": "^2.31.0",
"@azure/msal-react": "^1.4.10",
Browser and version
Chrome Versie 108.0.5359.94 (Officiële build) (arm64)
Chrome, Edge, Firefox, Safari?
Mention any other details that might be useful
In my opinion the app roles are not a true RBAC system for our applications. We are missing control from the Azure portal for granularly control over permissions for each app role. We simply can't apply permissions to roles from the Azure portal. What is the point of having app roles if a role without a specific set of permissions assigned to them?
Take this example screenshot from the opensource headless CMS called Strapi.
This is something I have no clue of if this even possible with Azure Add app roles. Hopefully someone has the answer to it!
![roles-and-permissions](https://user-images.githubusercontent.com/17518874/206719892-1c90146d-3ae9-471b-850a-ca4bbf6e857d.png)
Lastly, in term of security, we can just change the app roles in sessions storage or local storage in the front-end, so what's the point anyway of having a RouteGuard which is useless in terms of security?
In terms of security we have to add this on API level of course. (as described per docs)
However, right now I don't feel comfortable hard coding this like shown in the example below. What if we want to give TaskAdmin GET and POST permission and TaskUser only PUT permission?
Sample code from: https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/blob/main/5-AccessControl/1-call-api-roles/API/authConfig.js
accessMatrix: {
todolist: {
path: '/todolist',
methods: ['GET', 'POST', 'PUT', 'DELETE'],
roles: ['TaskUser', 'TaskAdmin'],
},
dashboard: {
path: '/dashboard',
methods: ['GET'],
roles: ['TaskAdmin'],
},
},
Thanks! We'll be in touch soon.