Azure / Azure/static-web-apps

Data API custom roles not honored

Open
#1,328 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When using the Data API and custom authentication roles with Entra (AAD), the roles are not allowed, resulting in 403.

**To Reproduce**

1. Enable Data API in application, connect up to database.
2. Have a custom role of `admin` setup and in `userRoles`
3. Have an entity defined as:
```json
"MyTable": {
"source": "dbo.MyTable",
"permissions": [
{
"actions": ["read"],
"role": "authenticated"
},
{
"actions": ["create", "read", "update", "delete"],
"role": "admin"
}
],
```
4. Try and call the update API REST endpoint, which results in 403.

**Expected behavior**

Having the `admin` role in roles should allow this operation.

When updating the `role` back to `authenticated`, it allows the update operation.

**Additional context**

Not sure if this is a bug, but recently the custom authentication stopped putting roles in the `userRoles` section of the .auth/me, but now in a `roles` claim, which may be the issue.

Why did this change?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.