将 AAD 应用程序添加为安全组的成员

问题描述

我正在尝试使用 AAD 令牌启用服务以进行身份​​验证.我的计划是验证令牌中的组"声明，以确保调用者是我们创建的安全组的成员.

例如，我们将为读者创建 group1，为作者创建 group2.然后根据组"声明，我会找出正确的访问级别.

我使用 AAD 应用发布令牌(不是用户)，所以我需要该应用成为安全组的成员.Azure AD powershell 似乎不接受应用程序 ID 作为组成员.如何解决这个问题?当调用者是另一个 AAD 应用时，还有其他推荐的模式吗?

使用的命令:

I'm trying to enable service to service auth using AAD tokens. My plan is to validate "groups" claim in the token to make sure the caller is a member of a security group that we created.

For example, we will create group1 for readers and group2 for writers. Then based on "groups" claim, I will figure out the right access level.

I use AAD app to issue the tokens (not a user), so I need that app to be a member of the security group. Azure AD powershell doesn't seem to accept application ids as group members. How to solve this? are there any other recommended patterns when the caller is another AAD app?

Command used:https://docs.microsoft.com/en-us/powershell/module/azuread/Add-AzureADGroupMember?view=azureadps-2.0

Error:
Add-AzureADGroupMember : Error occurred while executing AddGroupMember
Code: Request_BadRequest
Message: An invalid operation was included in the following modified references: 'members'.
RequestId: 0441a156-3a34-484b-83d7-a7863d14654e
DateTimeStamp: Mon, 11 Dec 2017 21:50:41 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:1 char:1
+ Add-AzureADGroupMember -ObjectId "9c2cdf89-b8d6-4fb9-9116-7749adec85c ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Add-AzureADGroupMember], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.AddGroupMember

解决方案

1. Unfortunately, you cannot add an application as a member of Azure AD group.Though the official document for the Powershell cmdlet Add-AzureADGroupMember doesn't make clear you cannot use Application's ObjectId as the RefObjectId, absolutely you cannot use it.You cannot add an application as a member of Azure AD group neither.

2. For your scenario, I'm afraid that you couldn't achieve this for now. I understand why you need this. According to your request, my thought is assigning your application from Enterprise Application to Groups or users and manger users with different access rights. However, you cannot choose more roles for the selected group. The only one role is default access If want to define more roles for the app, you can refer to this documentation.I also tried to use Azure AD RBAC and create new conditional access for my test app,but all don't have read only this choice.You can also put your idea in Azure Feedback Forum, azure team will see it. Also, I will upvote your idea.

Update:

---

Currently, you can add a service principal to an AAD Group:

Example:

$spn = Get-AzureADServicePrincipal -SearchString "yourSpName"

$group = Get-AzureADGroup -SearchString "yourGroupName"

Add-AzureADGroupMember -ObjectId $($group.ObjectId) -RefObjectId $($spn.ObjectId)

---

Updated 2:

Recently, I also see lots of users want to assign roles to a service principal to let the service principal have some permissions to access to the app with a role.

I want to make clear here. Role-based authorized should be used for users, NOT applications. And it's not designed for applications. If you want to give some different permissions you may consider to assign application permissions to your service principal instead.

You can expose your Web App/API with application permissions by editing the Manifest in app registrations.

In appRoles, you can insert content like this:

  {
      "allowedMemberTypes": [
        "Application"
      ],
      "displayName": "Access to the settings data",
      "id": "c20e145e-5459-4a6c-a074-b942bbd4cfe1",
      "isEnabled": true,
      "description": "Administrators can access to the settings data in their tenant",
      "value": "Settingsdata.ReadWrite.All"
    },

Then, you can go another app registration you want to give permission > Settings > require permissions > Add > Search the application name you want to access > Choose the application permission you created before.

Therefore, your sp can obtain a token with that application permissions in token claims.

Also, for authorization from the resource, you need to add code logic to give control policy for that token with Settingsdata.ReadWrite.All claim.

---

Update 3

Currently, you can add the service principal to one AAD Group directly in Azure portal:

这篇关于将 AAD 应用程序添加为安全组的成员的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！