title: Retrieving roles from token in an Azure function app using AAD as identity provider
body: <p>I have a working setup in Azure where a Function App is protected by OAuth using an app registration in AAD.</p>
  <p>In this app registration, I have defined two roles; <em>Administrator</em> and <em>Developer</em>. I have assigned both of these roles to myself, and now I want to retrieve the role to determine what kind of actions a user is allowed to take.</p>
  <p>To try to understand what is going in, I've added the following to a protected endpoint:</p>
  <pre class="lang-cs prettyprint-override"><code>[FunctionName(&quot;Test&quot;)]
  public async Task&lt;IActionResult&gt; Run(
      [HttpTrigger(AuthorizationLevel.Anonymous, &quot;post&quot;, Route = null)] HttpRequest req, CancellationToken ct)
  {
      bool isDeveloper = req.HttpContext.User.HasClaim(&quot;roles&quot;, &quot;Developer&quot;);
      bool isAdministrator = req.HttpContext.User.HasClaim(&quot;roles&quot;, &quot;Administrator&quot;);
      _logger.LogInformation($&quot;Has role developer? {isDeveloper}&quot;); // true
      _logger.LogInformation($&quot;Has role administrator? {isAdministrator}&quot;); // true
  
      bool isDeveloperBuiltin = req.HttpContext.User.IsInRole(&quot;Developer&quot;);
      bool isAdministratorBuiltin = req.HttpContext.User.IsInRole(&quot;Administrator&quot;);
      _logger.LogInformation($&quot;Has role developer using built in? {isDeveloperBuiltin}&quot;); // false
      _logger.LogInformation($&quot;Has role administrator using built in? {isAdministratorBuiltin}&quot;); // false
      foreach (Claim claim in req.HttpContext.User.Claims)
      {
          _logger.LogInformation(claim.Type + &quot; : &quot; + claim.Value + &quot;\n&quot;);
      }
  }
  </code></pre>
  <p>The name of the role claim in my token is <code>roles</code> but under the hood the <code>IsInRole</code> function checks the claim <a href="https://docs.microsoft.com/en-us/dotnet/api/system.security.claims.claimtypes.role?view=net-6.0" rel="nofollow noreferrer"><code>ClaimsType.Role</code></a> which I do not have in my token. Pasting my token at <a href="https://jwt.ms/" rel="nofollow noreferrer">jwt.ms</a> shows:</p>
  <pre class="lang-json prettyprint-override"><code>&quot;roles&quot;: [
      &quot;Developer&quot;,
      &quot;Administrator&quot;
  ]
  </code></pre>
  <p>How come the role claim is different for a token issued by Microsoft themselves? Am I misunderstanding something here?</p>
  <p>If possible I would like to use the utility method <code>IsInRole</code>, but I have worked around this for the moment and wrote a small utility which basically does the same:</p>
  <pre class="lang-cs prettyprint-override"><code>public bool IsUserInRole(ClaimsPrincipal principal, Role role)
  {
      return principal.HasClaim(&quot;roles&quot;, role.ToString());
  }
  </code></pre>
  <p>However, I would like to understand what is going on here and what steps I could take to use the <code>IsInRole</code> method instead. Am I doing something wrong by instead using my own utility method?</p>