Azure Active Directory Group Claim

[chris468]

With Azure Active Directory groups will be returned as a distributed claim when it is too long. When that happens, authorization based on the groups claim doesn't work. I believe mod_auth_openidc is checking for distributed claims returned from the UserInfo endpoint, but not in the id_token. And it doesn't look like AAD can be configured to return the groups claim from UserInfo.

Is there a reason mod_auth_openidc doesn't check the id_token for distributed claims? Or is there something else I'm missing?

Thanks

[zandbelt]

right, there's no good reason for not doing that, just an omission...

[chris468]

Thanks for confirming. I started prototyping a fix here, but probably won't get back to it for a few weeks. It's not working yet - for AAD I think it needs to handle claim sources that don't specify access tokens.