Anyone getting access denied to approve-requests and/or view-imports? #3
-
|
Amazing app/service. Just ran through the blog post, set up everything and it's all working pretty much. Have devices I can get to generate QR codes/import IDs, so that's all working. For testing, I've got my account as the only approver/viewer/general user in the 3 groups, and when I try to access the URL for approving requests or viewing the imports I just get access denied. Not sure what to check other than making sure the ObjectId's are correct in the app config (they are) and that I'm a group member in each group (I am). |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 11 replies
-
|
First of all thanks! I think it might be that the groups claim is missing in the token configuration on the app registration. This would explain the behavior you are seeing. Can you please double check if you added the token configuration groups claim for Security Groups with Group ID? |
Beta Was this translation helpful? Give feedback.
-
|
OK thanks for looking at this with me. Just enabled logs, so I'll dig into that a bit and report back if I find anything. Otherwise, the service works awesome with that second account I have, so I know it works :) |
Beta Was this translation helpful? Give feedback.
-
|
So, from the stream when I connect to the approver page from my primary account, it looks like it saying I'm not a member of the group, yet I am and I know all the IDs are correct and the token config is correct. Stream is below here for that connection. (Also, I get the same information with the corresponding ID info for the viewer page connecting as my primary or secondary account) 2020-12-10T21:30:41 Welcome, you are now connected to log-streaming service. The default timeout is 2 hours. Change the timeout with the App Setting SCM_LOGSTREAM_TIMEOUT (in seconds). |
Beta Was this translation helpful? Give feedback.
-
|
So your primary account is probably reaching the 200 groups and not sending any group ID therefore. The secondary AAD cloud-only account should get access as soon as you have all memberships. In this line I think the correct "claim" is requested I guess... asking for the configured group, beginning with 268d1099... Does your user have the group with... 268d1099 if yes I think, as already mentioned, the user reaches the token max amount... There is a way to maybe re-configure to let the user send only relevant groups. I think it can be done when re-configuring the app registration with a different groups claim: instead: "groupMembershipClaims": "SecurityGroup" using this -> "groupMembershipClaims": "ApplicationGroup" "ApplicationGroup" | Emits only the groups that are explicitly assigned to the application and the user is a member of I think if you re-configure this via the manifest and then add the groups to the Enterprise App under users and groups it might help... never done this. You could try this and report the results... |
Beta Was this translation helpful? Give feedback.
-
|
Editing the manifest and adding the 3 sec groups to the Enterprise App definitely is a good work around... worked for me. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
that's great to hear that this solves the issue, I've verified it also in my environment and there it is working as well, even though I don't have so much group memberships on my users 👍 |
Beta Was this translation helpful? Give feedback.
First of all thanks! I think it might be that the groups claim is missing in the token configuration on the app registration. This would explain the behavior you are seeing. Can you please double check if you added the token configuration groups claim for Security Groups with Group ID?