title: Error AADSTS50105 if the user is member of a group that is a member of another group
body: <p>We have successfully set up AAD authentication for an existing Service Fabric cluster using <a href="https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-cluster-creation-setup-aad" rel="nofollow noreferrer">this documentation</a>. However, we have some issues when it comes to assigning groups to the application:</p>
  <ul>
  <li>Connect with a user that has the admin role directly assigned ✔</li>
  <li>Connect with a user that is member of a group which is directly assigned to the admin role ✔</li>
  <li>Connect with a user that is member of a <strong>group which is member of the group</strong> which is directly assigned to the admin role ❌</li>
  </ul>
  <blockquote>
  <p>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS50105: The signed in user
  '{EmailHidden}' is not assigned to a role for the application</p>
  </blockquote>
  <pre><code>Connect-ServiceFabricCluster -ConnectionEndpoint xxx.westeurope.cloudapp.azure.com:19000 -
  
  AzureActiveDirectory -ServerCertThumbprint yyy
  WARNING: Failed to contact Naming Service. Attempting to contact Failover Manager Service...
  WARNING: Failed to contact Failover Manager Service, Attempting to contact FMM...
  False
  Connect-ServiceFabricCluster : GetAccessToken failed:
  authority=https://login.microsoftonline.com/zzz
  cluster=xxx client=yyy
  error=Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS50105: The signed in user
  '{EmailHidden}' is not assigned to a role for the application
  'xxx'(myclustername).
  Trace ID: &lt;traceid&gt;
  Correlation ID: &lt;correlationId&gt;
  Timestamp: 2020-09-01 16:03:00Z
     at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.RunAsyncTask[T](Task`1 task)
     at System.Fabric.AzureActiveDirectory.Client.ClientUtility.GetAccessToken(String authority, String audience, String
  client, String redirectUri, Boolean refreshSession)
     at GetAccessToken(Char* authority, Char* audience, Char* client, Char* redirectUri, Boolean refreshSession, Char*
  outBuffer, Int32 outBufferSize)
          ErrorCode: access_denied
          StatusCode: 0
  At line:1 char:1
  + Connect-ServiceFabricCluster -ConnectionEndpoint xxx.westeurop ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : InvalidOperation: (:) [Connect-ServiceFabricCluster], FabricException
      + FullyQualifiedErrorId : TestClusterConnectionErrorId,Microsoft.ServiceFabric.Powershell.ConnectCluster
  </code></pre>
  <p>I tried both via Service Fabric Explorer and Powershell (<code>Connect-ServiceFabricCluster</code>). Service Fabric Explorer just freezes after logging in, while Powershell gives the error mentioned above.</p>
  <p>Am I hitting a limit for what is possible, or is it possible to allow this?</p>
  <p><a href="https://i.stack.imgur.com/mb3VW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mb3VW.png" alt="Screenshot of assigned users and groups" /></a></p>