Qlik Sense SaaS: How to verify group information returned by Azure AD Graph API

Damien_V — Mon, 15 Aug 2022 07:29:15 GMT

This article explains how to call the Graph API manually to verify group information.

This is based on how Qlik Sense SaaS code is fetching groups from Azure AD.

Qlik Sense for Windows straightly reads the groups from the ID token and if the number is too big, Azure AD will just include a link to the graph API in the ID token, which Qlik Sense for Windows will just ignore.

Environments:

Resolution

FIrst of all, generate a token based on the steps in the below article.

Qlik Sense: How to request an OIDC token manually and check if correct attributes are included (PowerShell)

Once the tokens generated, take the access_token (NOT the id_token) and use it to retrieve information from the Azure AD Graph API:

$access_token='eyJ0eXAiOi...CjAeMzpab_5QE2c5QZm0bA' $hdrs = @{} $hdrs.Add("Authorization","Bearer "+$access_token) $url = 'https://graph.microsoft.com/v1.0/me/memberof' $response = Invoke-WebRequest -Uri $url -Method Get -Headers $hdrs echo $response.Content

Example of response:

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects","value":[{"@odata.type":"#microsoft.graph.directoryRole","id":"605fd212-5945-4270-a4d5-e1e6ca65fbc7","deletedDateTime":null,"description":nu ll,"displayName":null,"roleTemplateId":null},{"@odata.type":"#microsoft.graph.group","id":"43d6963e-a75f-46d7-87e4-99b95bb74877","deletedDateTime":null,"classification":null,"createdDateTime":"2018-08-31T14:24:21Z","crea tionOptions":[],"description":"Qlik","displayName":"TestGroup","expirationDateTime":null,"groupTypes":[],"isAssignableToRole":null,"mail":null,"mailEnabled":false,"mailNickname":"cf40a8f3-47f6-4a3b-811b-e6028a9e21b9 ","membershipRule":null,"membershipRuleProcessingState":null,"onPremisesDomainName":null,"onPremisesLastSyncDateTime":null,"onPremisesNetBiosName":null,"onPremisesSamAccountName":null,"onPremisesSecurityIdentifier":null, "onPremisesSyncEnabled":null,"preferredDataLocation":null,"preferredLanguage":null,"proxyAddresses":[],"renewedDateTime":"2018-08-31T14:24:21Z","resourceBehaviorOptions":[],"resourceProvisioningOptions":[],"securityEnabl ed":true,"securityIdentifier":"S-1-12-1-1138136638-1188538207-3113870471-2001254235","theme":null,"visibility":null,"onPremisesProvisioningErrors":[]}]}

Qlik Sense will fetch the odata type #microsoft.graph.group and fetch the displayName, then create the groups.

If there is more than 100 groups, the results will be paginated by page of 100 in the Graph API, Qlik Sense can fetch up to 10 pages (1000 groups).

article Qlik Sense SaaS: How to verify group information returned by Azure AD Graph API in Official Support Articles

Qlik Sense SaaS: How to verify group information returned by Azure AD Graph API

Resolution