title: “Authorization has been denied for this request” for few Users using Azure Active Directory
body: <p>I have a native iOS App with a Single Sign On Authentication with Azure ADFS. On launching the App, the user must login to Azure Active Directory and on successful authentication gets back a Token to validate with a Web API for all the Service Endpoint calls.<br>The Authorization works very well for few users (e.g. Developer Logins) but for a few AD logins within the organization the Web API returns back <code>Authorization has been denied for this request</code>.
  I have eliminated the App From this equation to keep it simple and tried with the Postman to hit the Web API passing in the Authorization Token in the Header.<br>For few accounts, the Web API returns back the data successfully and for few accounts the <code>Authorization has been denied for this request</code> is thrown. (<em>401 Unauthorized</em>)<br>Given the fact that the Authentication engine works successfully for few accounts, I am wondering whether this is an issue with the Active Directory User Roles / Group Policies.<br>Has anyone had this issue or know the reason for this issue? Any help on this would be highly appreciated.</p>
  
  <p><strong>More Details:</strong></p>
  
  <ul>
  <li>WebAPI 2.0 hosted in Azure.</li>
  <li><p>In the Web API StartUp class</p>
  
  <pre><code>    var azureActiveDirectoryBearerAuthenticationOptions = new WindowsAzureActiveDirectoryBearerAuthenticationOptions
      {
          AuthenticationType = "OAuth2Bearer",
  
          Tenant = "companyName.onmicrosoft.com",
          TokenValidationParameters = new TokenValidationParameters
          {
              ValidAudience = ConfigurationManager.AppSettings["ida:AppIdUri"],
          },
          Provider = new OAuthBearerAuthenticationProvider()
          {
              OnRequestToken = (context) =&gt;
              {
                  OAuthRequestTokenContext token = context;
                  System.Diagnostics.Debug.WriteLine(token.Token);
                  return Task.FromResult(0);   
              },  
              OnApplyChallenge = (context) =&gt;
              {
                  OAuthChallengeContext challenge = context;
                  var types = challenge.OwinContext.Authentication.GetAuthenticationTypes();
                  foreach (var type in types)
                  {
                      System.Diagnostics.Debug.WriteLine(type.Caption + " "+ type.AuthenticationType);
                  }
                  return Task.FromResult(0);
              },
              OnValidateIdentity = (context) =&gt;
              {
                  var authenticationTicket = context.Ticket;
                  var claims = ClaimsHelper.GetClaimsFor(authenticationTicket.Identity.Name);
                  context.Ticket.Identity.AddClaims(claims);
  
                  return Task.FromResult(0);
              }
          }
  
      };
  </code></pre>
  
  <p>`</p></li>
  </ul>
  
  <p>The OWIN Auth Types in the <code>OAuthBearerAuthenticationProvider</code> are <em>OAuth2Bearer and Federation</em>.<br> 
      No role based Claims are involved at this point.</p>
  
  <p>The client generates the token like this and passes this on each request as a Bearer token in the header </p>
  
  <pre><code>AuthenticationContext authenticationContext = new AuthenticationContext(azureSettings.AdAuthority);
  AuthenticationResult authenticationResult = 
  await authenticationContext.AcquireTokenAsync(azureSettings.AdResource,
                            azureSettings.AdClientId,
                            new Uri(azureSettings.AdRedirect),
                            new AuthorizationParameters(view),
                            UserIdentifier.AnyUser,
                            string.Format("domain_hint={0}", azureSettings.AdDomainHint));
  </code></pre>
  
  <p>`</p>
  
  <p>Azure Active Directory is in sync with the local Active Directory.</p>
  
  <p>Tried the Following but in Vain:</p>
  
  <p>Create a new AD User with same exact roles and dept as a user who can successfully retrieve data and made the sync to AAD and even the new user gets Unauthorized. Ensured the Web API on Azure is not restricted to individual Assigned Users. </p>