User.IsInRole("Admin");

[Pr1vEsc]

Is there a way for the code to be able to use this in Controllers or Views.

I need to change views based on the user group access.
I have created users in AD B2C and assigned them in Group but this is not comming in the Token so I assume Graph API needs to be used.

Let me know your thoughts.
Steve

[elvogel]

It's not going to come through the as a token, which is why I created this sample project to use Group Authorization to query Graph API for the user's membership info. I am using a modified version of this (with caching!) in a production app and it works pretty well.

There is a blog post on how to get group claims in there, but as the author implies, it's pretty ugly. http://mrochon.azurewebsites.net/2019/05/06/using-groups-in-azure-ad-b2c/

[Pr1vEsc]

Ya I took a look at that article also and it is ugly like the author mentioned and did not want to go there. I assume in the Controller and View I would need to write methods to use the Graph API to check the group membership like your service? Did you find issues with performance and you cached the users Group membership?

[elvogel]

The single best way of doing it is by doing it the way I prescribed in this sample code. Doing this:

 [Authorize("Admin")]
 public IActionResult Index()
 {
    return View();
 }

Is going to be a lot easier than trying to use Graph API in your Views.

If you need Graph API information for a user, my suggestion would be to have a UserRepository object that does those lookups for you (and caches them as well). Another option would be to have a separate data store for additional app-specific user information.