title: Azure AD - Check for security group membership - (Node.js, passport, Azure Web App)
body: <p>We are trying to set up an authentication/authorization-process with the following requirements:</p>
  
  <ul>
  <li>Authentication: Done by Azure AD.</li>
  <li>Authorization: Only members of a specific security groups should be allowed to access the app.</li>
  </ul>
  
  <p>While the authentication part seems to work without problems, we are stuck at the authorization part. We are using Express and Passport.</p>
  
  <p>Azure AD some tokens to <code>req.headers</code>, e.g.</p>
  
  <ul>
  <li>x-ms-token-aad-access-token</li>
  <li>x-ms-token-aad-refresh-token</li>
  <li>x-ms-token-aad-id-token</li>
  </ul>
  
  <p>We are currently using the id-token together with the passport-azure-ad BearerStrategy to check the security groups of the user against the allowed security groups.</p>
  
  <p>The problem is: As soon as the id-token expires, the application won't let us access the app. Assuming setting <code>{session: true}</code> in passport could solve this issue, we enabled the session, but no luck.</p>
  
  <p>Doing some more research I found this post: <a href="https://stackoverflow.com/questions/38419058/how-to-refresh-an-id-token-from-azure-ad-in-a-web-app">How to refresh an ID Token from Azure AD in a Web App?</a>, which states that only access-tokens can be refreshed, but ID tokens cannot and should not.</p>
  
  <p>Examining the <code>x-ms-token-aad-access-token</code> and the <code>x-ms-token-aad-refresh-token</code>, we found that they don't have the JWT-structure, e.g </p>
  
  <pre><code>    eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik5HVEZ2ZEstZnl0aEV1THdqcHdBSk9NOW4tQSJ9.eyJhdWQiOiJodHRwczovL3NlcnZpY2UuY29udG9zby5jb20vIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvN2ZlODE0NDctZGE1Ny00Mzg1LWJlY2ItNmRlNTdmMjE0NzdlLyIsImlhdCI6MTM4ODQ0MDg2MywibmJmIjoxMzg4NDQwODYzLCJleHAiOjEzODg0NDQ3NjMsInZlciI6IjEuMCIsInRpZCI6IjdmZTgxNDQ3LWRhNTctNDM4NS1iZWNiLTZkZTU3ZjIxNDc3ZSIsIm9pZCI6IjY4Mzg5YWUyLTYyZmEtNGIxOC05MWZlLTUzZGQxMDlkNzRmNSIsInVwbiI6ImZyYW5rbUBjb250b3NvLmNvbSIsInVuaXF1ZV9uYW1lIjoiZnJhbmttQGNvbnRvc28uY29tIiwic3ViIjoiZGVOcUlqOUlPRTlQV0pXYkhzZnRYdDJFYWJQVmwwQ2o4UUFtZWZSTFY5OCIsImZhbWlseV9uYW1lIjoiTWlsbGVyIiwiZ2l2ZW5fbmFtZSI6IkZyYW5rIiwiYXBwaWQiOiIyZDRkMTFhMi1mODE0LTQ2YTctODkwYS0yNzRhNzJhNzMwOWUiLCJhcHBpZGFjciI6IjAiLCJzY3AiOiJ1c2VyX2ltcGVyc29uYXRpb24iLCJhY3IiOiIxIn0.JZw8jC0gptZxVC-7l5sFkdnJgP3_tRjeQEPgUn28XctVe3QqmheLZw7QVZDPCyGycDWBaqy7FLpSekET_BftDkewRhyHk9FW_KeEz0ch2c3i08NGNDbr6XYGVayNuSesYk5Aw_p3ICRlUV1bqEwk-Jkzs9EEkQg4hbefqJS6yS1HoV_2EsEhpd_wCQpxK89WPs3hLYZETRJtG5kvCCEOvSHXmDE6eTHGTnEgsIk--UlPe275Dvou4gEAwLofhLDQbMSjnlV5VLsjimNBVcSRFShoxmQwBJR_b2011Y5IuD6St5zPnzruBbZYkGNurQK63TJPWmRd3mbJsGM0mf3CUQ
  </code></pre>
  
  <p>They don't contain any dots and thus don't pass the JWT-verification.</p>
  
  <p>Resulting in the following question:</p>
  
  <ul>
  <li>What is the correct way to check security groups of a user against specified allowed security groups?</li>
  </ul>