WebAPI Can't read user scope claims about active-directory-dotnet-daemon

[skwan]

Today Azure AD does not send scope claims when using the client credentials OAuth flow. The daemon samples use client credentials (as opposed to a delegated OAuth flow, like the authorization code flow or the on behalf of flow). The configuration UX is unfortunately misleading because you can set what looks like a scope to be sent, but nothing get sent. We are working on adding support for this scenario. Net, for now you will need to make authorization decisions based on just the claims you receive in the access token.

[npnelson]

I usually don't leave a simple "thank you" comment because it adds noise, but I just wanted to say I am very thankful for your quick and thorough response (and especially for saying you are working on adding support for this scenario). We just started using Azure and so far, I am pretty impressed (except for the Portal UIs).

Thanks again, keep up the good work!

[cwe1ss]

@skwan Has there been any progress on this? Can I get the scope/permissions somehow in a client_credentials call?

[jmprieur]

Scopes are about the AAD V2 endpoint (which you get access to using MSAL.Net). this sample is about the AAD V1 endpoint (which you get access token to using ADAL.NET).