Azure B2C approles and permissions

bdiddy 171 Reputation points
2020-08-06T18:59:51.427+00:00

Hi,

Is there a way where I can define application roles AND also what each role can actually perform?

I see we can define approles in the manifest, but what about roles permissions. So that in my application I can like enable/disable UI element based on those granular permissions.

Thanks,

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
711 questions
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,742 questions
Accepted answer
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,426 Reputation points
    2020-08-10T17:21:09.077+00:00

    @bdiddy you can use directory extension as optional claims for each of the permissions required. You can create extension "process order" and "cancel order" both of type "boolean" and assign both to user or group C and the latter to user or group D so you can get them in the token issued to each user.

    Follows how to create an application, an extension and assign it to the first directory user:

    16838-image.png

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,426 Reputation points
    2020-08-08T19:50:48.093+00:00

    Define your application app roles and assign them to the desired users in the Azure Portal, trough powershell or MS Graph. Then add the MSAL Angular library to your Angular project and create a Guard that validates if the required role(s) is/are present in the user id token: 

       @Injectable()  
   class CanActivateOnRoles implements CanActivate {  
     constructor(private msalService: MsalService) {}  
     
     canActivate(  
       route: ActivatedRouteSnapshot,  
       state: RouterStateSnapshot  
     ): boolean {  
       return msalService.getAccount().idToken['roles'].find( r => r === 'some role') !== undefined;  
     }  
   }

    ---
    Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.