AzureAd get groups info when not in token

Question

I few days ago I configured my AzureAd to get Id_Tokens for my app also with groupIds claims within the token.

Everything works fine, but if I add more than 5 groups to an user it fails because azure add the "hasgroups": "true" claims because token is to big to add it in the URL so I have to perform another request.

The point is that I am not be able to perform the request to then obtaining the groups. The token ID_TOKEN I have received is the following:

for the backend and front end azureAD filter this token is perfect and works fine

Then as it it said in the official Microsoft azure docs I have to perform another request to https://graph.microsoft.com/v1.0/users/{userID}/getMemberObjects

As you can see the aud claim is the same as my app client ID:

I am trying to perform the request with postman because I need it and this is the result

{
  "error": {
    "code": "InvalidAuthenticationToken",
    "message": "Access token validation failure. Invalid audience.",
    "innerError": {
      "date": "2020-07-08T13:56:50",
      "request-id": "6b2f3374-33e4-4a1a-9709-b8111cd2bc66"
    }
  }
}

As you can see the aud is not invalid because is the same as client_id

What am I doing wrong>? I have spent a lot of time dealing with that and I can't find the solution.

I have also tried with POST request and BODY

UPDATE

I found the problem, the problem was that I was using an id_token instead of a access_token. But for me ot would be ususer to be able to extract such information only by using id_token.

I still have a horrible inconvenience, because if you can only use access token I will have to change half the application because is only the front end which have access token and in backend I have aspects that were using id_token with the group information contained and did not need the access token at all .Now front end should have to add access token in every request header to be captured in backend to run son filters and aspects that are executed and require such information

Is it possible to get the same info but with id_token instead?

Can you please try with the Graph Explorer I see your calling get request as per the document it is a [post request](https://learn.microsoft.com/en-us/graph/api/user-getmembergroups?view=graph-rest-1.0&tabs=http) — Sruthi J, Jul 08 '20 at 14:35
I think the problem is because I am using the Id_token instead of access_token, but its because in back end I only have such token to perform the request, because its the token that front end uses to call my app api — Gabriel García Garrido, Jul 09 '20 at 09:02

Sruthi J · Answer 1 · 2020-07-08T16:32:15.833

1

Instead of Get request use Post request for below query

Post https://graph.microsoft.com/v1.0/users/{userID}/getMemberObjects

{
  "securityEnabledOnly": true
}

Please refer to this document

If you want to try with Graph explorer here is the link

edited Jul 08 '20 at 16:32

answered Jul 08 '20 at 16:09

Sruthi J

1,524
1
5
8

same error. I have add a screenshot above. I think it should be something of the token, but I have check everything and it looks fine. The "aud" claim is the same as my client_id (App id). The token I am using is the token that I obtain after redirection login in the browser URL – Gabriel García Garrido Jul 09 '20 at 06:57
can you please check with Graph Explorer once – Sruthi J Jul 09 '20 at 13:18
I found a solution. it is because I am using ID_TOKEN and to call graph api only access token is permited, but this is awefull because front end is the id_token and access code token generator and now in my microservice app with stateless login, I can note add a static class to fast get profiles from id_token, and front end is not sending me the access token on each request! – Gabriel García Garrido Jul 09 '20 at 15:14
I add an update but I still have a horrible inconvenience, because if you can only use access token I will have to change half the application because is only the front end wich have access token and in backend I have aspects that were using id_token with the group information contained and did not need the access token at all and now front end is going to add in every request also the access token to header to be captured in backend to run son filters and aspects that are executed in each request and require such information – Gabriel García Garrido Jul 09 '20 at 18:42
Can you please raise new Stackoverflow question – Sruthi J Jul 10 '20 at 14:51
Are you still looking for any help – Sruthi J Aug 07 '20 at 15:15

AzureAd get groups info when not in token

1 Answers1