azure oauth2.0 Application Roles with dot net core Authorization

Question

Hi All,

I have added application roles in Azure AD account and it is visible in Token under Claims.

I am using this roles for authorization in dot net core 5.0 using Identity framework.

But when I disable Role in Azure AD account, it is still visible in claims and doing authorization of it, can you please help me to know how to hide role in token if it is disable or can you help me to know if role is disable then authorization should not happen.

Regards,
Pritesh

Answer 1

Hi @pritesh dabhi ,

Here State is little confusing in terms of it doesn’t remove application role from the claims nor from the application. After disable the app role, app role is still present in manifest due to which it is visible in token claims.

It actually specifies whether the app roles are disabled so it can be further deleted.

To save the accidently deletion of the app role from application registration so it will not impact the daemon applications. There is a double check before deleting the app roles.
If you will directly try to delete the app role from the application, it will prompt the message as below.

To delete an app role, deselect this checkbox and apply the change before attempting the delete operation.

To remove the claim-based authorization you need to delete the app roles from the application after disable the app role which we remove the app role from manifest as well

And while running the application you will get the below error.

Thanks,
Shweta