Tonnes of enhancements

kalyankrishna1 · kalyankrishna1 · commit 22481c1305ce · 2020-09-04T01:13:42.000-07:00
diff --git a/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/BulkCreateGroups.ps1 b/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/BulkCreateGroups.ps1
@@ -6,10 +6,11 @@
 
 $ErrorActionPreference = "Stop"
 
+ # ObjectId of the user to be assigned to these security groups. The ObjectId can be obtained via Graph Explorer or in the "Users" blade on the portal.
+$usersobjectId = "695a3e1d-2e9f-4d24-aa3c-ac795c16f25c"
+
 Get-AzureADUser -ObjectId $usersobjectId
 
- # ObjectId of the user to be assigned to these security groups. The ObjectId can be obtained via Graph Explorer or in the "Users" blade on the portal.
-$usersobjectId = "5b6e08a5-7789-4ae0-a4cb-3d73b4097752"
 $groupNamePrefix = "TestGroup"
 $numberOfGroupsToCreate = 222;
 
diff --git a/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/BulkRemoveGroups.ps1 b/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/BulkRemoveGroups.ps1
@@ -10,7 +10,12 @@ $numberOfGroupsToDelete = 222;
 for($i = 1; $i -le $numberOfGroupsToDelete; $i++)
 {
   $groupName = $groupNamePrefix + $i
-  $group = Get-AzureADGroup -SearchString $groupName
-  Remove-AzureADGroup -ObjectId $group.ObjectId
-  Write-Host "Successfully deleted $($group.DisplayName)"
+  $groups = Get-AzureADGroup -SearchString $groupName
+
+  Foreach ($group in $groups)
+  {
+    Write-Host "Trying to delete group $($group.DisplayName)"
+    Remove-AzureADGroup -ObjectId $group.ObjectId
+    Write-Host "Successfully deleted $($group.DisplayName)"
+  } 
 }
diff --git a/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/Configure.ps1 b/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/Configure.ps1
@@ -102,6 +102,42 @@ Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requ
 }
 
 
+Function UpdateLine([string] $line, [string] $value)
+{
+    $index = $line.IndexOf('=')
+    $delimiter = ';'
+    if ($index -eq -1)
+    {
+        $index = $line.IndexOf(':')
+        $delimiter = ','
+    }
+    if ($index -ige 0)
+    {
+        $line = $line.Substring(0, $index+1) + " "+'"'+$value+'"'+$delimiter
+    }
+    return $line
+}
+
+Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary)
+{
+    $lines = Get-Content $configFilePath
+    $index = 0
+    while($index -lt $lines.Length)
+    {
+        $line = $lines[$index]
+        foreach($key in $dictionary.Keys)
+        {
+            if ($line.Contains($key))
+            {
+                $lines[$index] = UpdateLine $line $dictionary[$key]
+            }
+        }
+        $index++
+    }
+
+    Set-Content -Path $configFilePath -Value $lines -Force
+}
+
 Set-Content -Value "<html><body><table>" -Path createdApps.html
 Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
 
@@ -207,8 +243,10 @@ Function ConfigureApplications
 
    # Update config file for 'webApp'
    $configFile = $pwd.Path + "\..\appsettings.json"
+
    Write-Host "Updating the sample code ($configFile)"
-  
+   $dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = $tenantId;"Domain" = $tenantName;"ClientSecret" = $webAppAppKey };
+   UpdateTextFile -configFilePath $configFile -dictionary $dictionary
    Write-Host ""
    Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" 
    Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal":
diff --git a/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/sample.json b/5-WebApp-AuthZ/5-2-Groups/AppCreationScripts/sample.json
@@ -45,7 +45,7 @@
   "CodeConfiguration": [
     {
       "App": "webApp",
-      "SettingKind": "JSon",
+      "SettingKind": "JSON",
       "SettingFile": "\\..\\appsettings.json",
       "Mappings": [
         {
diff --git a/5-WebApp-AuthZ/5-2-Groups/Controllers/HomeController.cs b/5-WebApp-AuthZ/5-2-Groups/Controllers/HomeController.cs
@@ -1,8 +1,12 @@
 ﻿using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using System.Collections.Generic;
 using System.Diagnostics;
 using System.Security.Claims;
 using WebApp_OpenIDConnect_DotNet.Models;
+using WebApp_OpenIDConnect_DotNet.Infrastructure;
+using System.Linq;
+using Microsoft.AspNetCore.Http;
 
 namespace WebApp_OpenIDConnect_DotNet.Controllers
 {
@@ -16,14 +20,20 @@ public HomeController()
         public IActionResult Index()
         {
             ViewData["User"] = HttpContext.User;
+
+            // If groups overage occurred..
+            if (HttpContext.Session.Keys.Contains("groupClaims"))
+            {
+                ViewData.Add("groupClaims", HttpContext.Session.GetAsByteArray("groupClaims") as List<string>);
+            }
             return View();
         }
 
         [AllowAnonymous]
         [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
         public IActionResult Error()
         {
-            return View(new ErrorViewModel {RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier});
+            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
         }
     }
 }
diff --git a/5-WebApp-AuthZ/5-2-Groups/Infrastructure/SessionExtensions.cs b/5-WebApp-AuthZ/5-2-Groups/Infrastructure/SessionExtensions.cs
@@ -0,0 +1,37 @@
+﻿using Microsoft.AspNetCore.Http;
+using Newtonsoft.Json;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.Serialization.Formatters.Binary;
+using System.Text.Json;
+using System.Threading.Tasks;
+
+namespace WebApp_OpenIDConnect_DotNet.Infrastructure
+{
+    public static class SessionExtensions
+    {
+        public static void SetAsByteArray(this ISession session, string key, object toSerialize)
+        {
+            var binaryFormatter = new BinaryFormatter();
+            var memoryStream = new MemoryStream();
+            binaryFormatter.Serialize(memoryStream, toSerialize);
+
+            session.Set(key, memoryStream.ToArray());
+        }
+
+        public static object GetAsByteArray(this ISession session, string key)
+        {
+            var memoryStream = new MemoryStream();
+            var binaryFormatter = new BinaryFormatter();
+
+            var objectBytes = session.Get(key) as byte[];
+            memoryStream.Write(objectBytes, 0, objectBytes.Length);
+            memoryStream.Position = 0;
+
+            return binaryFormatter.Deserialize(memoryStream);
+
+        }
+    }
+}
diff --git a/5-WebApp-AuthZ/5-2-Groups/README.md b/5-WebApp-AuthZ/5-2-Groups/README.md
@@ -135,6 +135,10 @@ As a first step you'll need to:
    - In the *Commonly used Microsoft APIs* section, click on **Microsoft Graph**
    - In the **Delegated permissions** section, select the **GroupMember.Read.All** in the list. Use the search box if necessary.
    - Click on the **Add permissions** button at the bottom.
+1. At this stage permissions are assigned correctly and the **GroupMember.Read.All** requires admin to consent.
+   Click the **Grant/revoke admin consent for {tenant}** button, and then select **Yes** when you are asked if you want to grant consent for the
+   requested permissions for all account in the tenant.
+   You need to be an Azure AD tenant admin to do this.
 
 #### Configure your application to receive the **groups** claim
 
diff --git a/5-WebApp-AuthZ/5-2-Groups/Services/MicrosoftGraph-Rest/GraphHelper.cs b/5-WebApp-AuthZ/5-2-Groups/Services/MicrosoftGraph-Rest/GraphHelper.cs
@@ -7,18 +7,21 @@
 using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
+using WebApp_OpenIDConnect_DotNet.Infrastructure;
 
-namespace WebApp_OpenIDConnect_DotNet.Services.GroupProcessing
+namespace WebApp_OpenIDConnect_DotNet.Services
 {
     public class GraphHelper
     {
         /// <summary>
-        /// This method inspects the claims collection created from the ID or Access token and detects groups overage. If Groups overage is detected, the method then makes calls to
-        /// Microsoft Graph to fetch the group membership of the authenticated user.
+        /// This method inspects the claims collection created from the ID or Access token issued to a user and returns the groups that are present in the token . If it detects groups overage,
+        /// the method then makes calls to Microsoft Graph to fetch the group membership of the authenticated user.
         /// </summary>
         /// <param name="context">TokenValidatedContext</param>
-        public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext context)
+        public static async Task<List<string>> GetSignedInUsersGroups(TokenValidatedContext context)
         {
+            List<string> groupClaims = new List<string>();
+
             try
             {
                 // Checks if the incoming token contained a 'Group Overage' claim.
@@ -36,7 +39,7 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con
                     // For the Web App, SecurityToken contains value of the ID Token.
                     else if (context.SecurityToken != null)
                     {
-                        // Checks if 'JwtSecurityTokenUsedToCallWebAPI' key already exists. 
+                        // Checks if 'JwtSecurityTokenUsedToCallWebAPI' key already exists.
                         // This key is required to acquire Access Token for Graph Service Client.
                         if (!context.HttpContext.Items.ContainsKey("JwtSecurityTokenUsedToCallWebAPI"))
                         {
@@ -48,18 +51,19 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con
 
                         // The properties that we want to retrieve from MemberOf endpoint.
                         string select = "id,displayName,onPremisesNetBiosName,onPremisesDomainName,onPremisesSamAccountNameonPremisesSecurityIdentifier";
-                       
+
                         IUserMemberOfCollectionWithReferencesPage memberPage = new UserMemberOfCollectionWithReferencesPage();
                         try
                         {
                             //Request to get groups and directory roles that the user is a direct member of.
                             memberPage = await graphClient.Me.MemberOf.Request().Select(select).GetAsync().ConfigureAwait(false);
                         }
-                        catch(Exception graphEx)
+                        catch (Exception graphEx)
                         {
                             var exMsg = graphEx.InnerException != null ? graphEx.InnerException.Message : graphEx.Message;
-                            Console.WriteLine("Call to Microsoft Graph failed: "+ exMsg);
+                            Console.WriteLine("Call to Microsoft Graph failed: " + exMsg);
                         }
+
                         if (memberPage?.Count > 0)
                         {
                             // There is a limit to number of groups returned, below method make calls to Microsoft graph to get all the groups.
@@ -72,9 +76,7 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con
                                 if (identity != null)
                                 {
                                     // Remove any existing groups claim
-                                    RemoveExistingClaim(identity);
-
-                                    List<Claim> groupClaims = new List<Claim>();
+                                    RemoveExistingClaims(identity);
 
                                     // Re-populate the `groups` claim with the complete list of groups fetched from MS Graph
                                     foreach (Group group in allgroups)
@@ -83,8 +85,8 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con
                                         // the app registration, you might want to add other attributes than id to the `groups` claim, examples being;
 
                                         // For instance if the required format is 'NetBIOSDomain\sAMAccountName' then the code is as commented below:
-                                        // groupClaims.AddClaim(new Claim("groups", group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));
-                                        groupClaims.Add(new Claim("groups", group.Id));
+                                        // groupClaims.Add(group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));
+                                        groupClaims.Add(group.Id);
                                     }
                                 }
                             }
@@ -103,10 +105,15 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con
                 {
                     // Removes 'JwtSecurityTokenUsedToCallWebAPI' from Items collection.
                     // If not removed then it can cause failure to the application.
-                    // Because this key is also added by StoreTokenUsedToCallWebAPI method of Microsoft.Identity.Web. 
+                    // Because this key is also added by StoreTokenUsedToCallWebAPI method of Microsoft.Identity.Web.
                     context.HttpContext.Items.Remove("JwtSecurityTokenUsedToCallWebAPI");
                 }
             }
+
+            // Here we add the groups in a session variable to print on the home page for informational purposes
+            context.HttpContext.Session.SetAsByteArray("groupClaims", groupClaims);
+
+            return groupClaims;
         }
 
         /// <summary>
diff --git a/5-WebApp-AuthZ/5-2-Groups/Startup.cs b/5-WebApp-AuthZ/5-2-Groups/Startup.cs
@@ -8,10 +8,10 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Identity.Web;
-using Microsoft.Identity.Web.TokenCacheProviders.InMemory;
 using Microsoft.Identity.Web.UI;
+using System;
 using WebApp_OpenIDConnect_DotNet.Infrastructure;
-using WebApp_OpenIDConnect_DotNet.Services.GroupProcessing;
+using WebApp_OpenIDConnect_DotNet.Services;
 
 namespace WebApp_OpenIDConnect_DotNet
 {
@@ -33,7 +33,7 @@ public void ConfigureServices(IServiceCollection services)
                 // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                 options.CheckConsentNeeded = context => true;
                 options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
-                // Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1
+                // Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite
                 options.HandleSameSiteCookieCompatibility();
             });
 
@@ -47,7 +47,7 @@ public void ConfigureServices(IServiceCollection services)
                     options.Events.OnTokenValidated = async context =>
                     {
                         //Calls method to process groups overage claim.
-                        await GraphHelper.ProcessClaimsForGroupsOverage(context);
+                        await GraphHelper.GetSignedInUsersGroups(context);
                     };
                 }, options => { Configuration.Bind("AzureAd", options); })
                     .EnableTokenAcquisitionToCallDownstreamApi(options => Configuration.Bind("AzureAd", options), initialScopes)
@@ -62,6 +62,14 @@ public void ConfigureServices(IServiceCollection services)
                 // options.TokenValidationParameters.RoleClaimType = "groups";
             });
 
+            services.AddDistributedMemoryCache();
+            services.AddSession(options =>
+            {
+                options.IdleTimeout = TimeSpan.FromMinutes(1);
+                options.Cookie.HttpOnly = true;
+                options.Cookie.IsEssential = true;
+            });
+
             services.AddControllersWithViews(options =>
             {
                 var policy = new AuthorizationPolicyBuilder()
@@ -88,12 +96,13 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 
             app.UseHttpsRedirection();
             app.UseStaticFiles();
-            app.UseCookiePolicy();
 
             app.UseRouting();
+            app.UseSession();
             app.UseAuthentication();
             app.UseAuthorization();
 
+
             app.UseEndpoints(endpoints =>
             {
                 endpoints.MapControllerRoute(
diff --git a/5-WebApp-AuthZ/5-2-Groups/Views/Home/Index.cshtml b/5-WebApp-AuthZ/5-2-Groups/Views/Home/Index.cshtml
@@ -26,20 +26,44 @@
 
     @foreach (var claim in user.Claims)
     {
-<tr>
-    @{
-        if (claim.Type == "groups")
-        {
-            <td><b>@claim.Type</b></td>
-        }
-        else
-        {
-            <td>@claim.Type</td>
-        }
+        <tr>
+            @{
+                if (claim.Type == "groups")
+                {
+                    <td><b>@claim.Type</b></td>
+                }
+                else
+                {
+                    <td>@claim.Type</td>
+                }
+            }
+
+            <td>@claim.Value</td>
+        </tr>
+    }
+
+</table>
+
+@{
+    List<string> groupClaims = new List<string>();
+
+    if (ViewData.ContainsKey("groupClaims"))
+    {
+        groupClaims = ViewData["groupClaims"] as List<string>;
     }
 
-    <td>@claim.Value</td>
-</tr>
+}
+
+<table class="table table-striped table-bordered table-condensed table-hover">
+    <tr>
+        <td colspan="2">If groups overage occured, the groups fetched from Graph will be listed below</td>
+        </tr>
+
+    @foreach (var group in groupClaims)
+    {
+        <tr>
+            <td colspan="2">@group</td>
+        </tr>
     }
 
 </table>
diff --git a/5-WebApp-AuthZ/5-2-Groups/WebApp-OpenIDConnect-DotNet.csproj b/5-WebApp-AuthZ/5-2-Groups/WebApp-OpenIDConnect-DotNet.csproj

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@`
`45`	`45`	`"CodeConfiguration": [`
`46`	`46`	`{`
`47`	`47`	`"App": "webApp",`
`48`		`- "SettingKind": "JSon",`
	`48`	`+ "SettingKind": "JSON",`
`49`	`49`	`"SettingFile": "\\..\\appsettings.json",`
`50`	`50`	`"Mappings": [`
`51`	`51`	`{`
Original file line number	Diff line number	Diff line change
`@@ -1,8 +1,12 @@`
`1`	`1`	`using Microsoft.AspNetCore.Authorization;`
`2`	`2`	`using Microsoft.AspNetCore.Mvc;`
	`3`	`+using System.Collections.Generic;`
`3`	`4`	`using System.Diagnostics;`
`4`	`5`	`using System.Security.Claims;`
`5`	`6`	`using WebApp_OpenIDConnect_DotNet.Models;`
	`7`	`+using WebApp_OpenIDConnect_DotNet.Infrastructure;`
	`8`	`+using System.Linq;`
	`9`	`+using Microsoft.AspNetCore.Http;`
`6`	`10`
`7`	`11`	`namespace WebApp_OpenIDConnect_DotNet.Controllers`
`8`	`12`	`{`
`@@ -16,14 +20,20 @@ public HomeController()`
`16`	`20`	`public IActionResult Index()`
`17`	`21`	`{`
`18`	`22`	`ViewData["User"] = HttpContext.User;`
	`23`	`+`
	`24`	`+ // If groups overage occurred..`
	`25`	`+ if (HttpContext.Session.Keys.Contains("groupClaims"))`
	`26`	`+ {`
	`27`	`+ ViewData.Add("groupClaims", HttpContext.Session.GetAsByteArray("groupClaims") as List<string>);`
	`28`	`+ }`
`19`	`29`	`return View();`
`20`	`30`	`}`
`21`	`31`
`22`	`32`	`[AllowAnonymous]`
`23`	`33`	`[ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]`
`24`	`34`	`public IActionResult Error()`
`25`	`35`	`{`
`26`		`- return View(new ErrorViewModel {RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier});`
	`36`	`+ return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });`
`27`	`37`	`}`
`28`	`38`	`}`
`29`	`39`	`}`
Original file line number	Diff line number	Diff line change
`@@ -7,18 +7,21 @@`
`7`	`7`	`using System.Linq;`
`8`	`8`	`using System.Security.Claims;`
`9`	`9`	`using System.Threading.Tasks;`
	`10`	`+using WebApp_OpenIDConnect_DotNet.Infrastructure;`
`10`	`11`
`11`		`-namespace WebApp_OpenIDConnect_DotNet.Services.GroupProcessing`
	`12`	`+namespace WebApp_OpenIDConnect_DotNet.Services`
`12`	`13`	`{`
`13`	`14`	`public class GraphHelper`
`14`	`15`	`{`
`15`	`16`	`/// <summary>`
`16`		`- /// This method inspects the claims collection created from the ID or Access token and detects groups overage. If Groups overage is detected, the method then makes calls to`
`17`		`- /// Microsoft Graph to fetch the group membership of the authenticated user.`
	`17`	`+ /// This method inspects the claims collection created from the ID or Access token issued to a user and returns the groups that are present in the token . If it detects groups overage,`
	`18`	`+ /// the method then makes calls to Microsoft Graph to fetch the group membership of the authenticated user.`
`18`	`19`	`/// </summary>`
`19`	`20`	`/// <param name="context">TokenValidatedContext</param>`
`20`		`- public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext context)`
	`21`	`+ public static async Task<List<string>> GetSignedInUsersGroups(TokenValidatedContext context)`
`21`	`22`	`{`
	`23`	`+ List<string> groupClaims = new List<string>();`
	`24`	`+`
`22`	`25`	`try`
`23`	`26`	`{`
`24`	`27`	`// Checks if the incoming token contained a 'Group Overage' claim.`
`@@ -36,7 +39,7 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con`
`36`	`39`	`// For the Web App, SecurityToken contains value of the ID Token.`
`37`	`40`	`else if (context.SecurityToken != null)`
`38`	`41`	`{`
`39`		`- // Checks if 'JwtSecurityTokenUsedToCallWebAPI' key already exists.`
	`42`	`+ // Checks if 'JwtSecurityTokenUsedToCallWebAPI' key already exists.`
`40`	`43`	`// This key is required to acquire Access Token for Graph Service Client.`
`41`	`44`	`if (!context.HttpContext.Items.ContainsKey("JwtSecurityTokenUsedToCallWebAPI"))`
`42`	`45`	`{`
`@@ -48,18 +51,19 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con`
`48`	`51`
`49`	`52`	`// The properties that we want to retrieve from MemberOf endpoint.`
`50`	`53`	`string select = "id,displayName,onPremisesNetBiosName,onPremisesDomainName,onPremisesSamAccountNameonPremisesSecurityIdentifier";`
`51`		`-`
	`54`	`+`
`52`	`55`	`IUserMemberOfCollectionWithReferencesPage memberPage = new UserMemberOfCollectionWithReferencesPage();`
`53`	`56`	`try`
`54`	`57`	`{`
`55`	`58`	`//Request to get groups and directory roles that the user is a direct member of.`
`56`	`59`	`memberPage = await graphClient.Me.MemberOf.Request().Select(select).GetAsync().ConfigureAwait(false);`
`57`	`60`	`}`
`58`		`- catch(Exception graphEx)`
	`61`	`+ catch (Exception graphEx)`
`59`	`62`	`{`
`60`	`63`	`var exMsg = graphEx.InnerException != null ? graphEx.InnerException.Message : graphEx.Message;`
`61`		`- Console.WriteLine("Call to Microsoft Graph failed: "+ exMsg);`
	`64`	`+ Console.WriteLine("Call to Microsoft Graph failed: " + exMsg);`
`62`	`65`	`}`
	`66`	`+`
`63`	`67`	`if (memberPage?.Count > 0)`
`64`	`68`	`{`
`65`	`69`	`// There is a limit to number of groups returned, below method make calls to Microsoft graph to get all the groups.`
`@@ -72,9 +76,7 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con`
`72`	`76`	`if (identity != null)`
`73`	`77`	`{`
`74`	`78`	`// Remove any existing groups claim`
`75`		`- RemoveExistingClaim(identity);`
`76`		`-`
`77`		`- List<Claim> groupClaims = new List<Claim>();`
	`79`	`+ RemoveExistingClaims(identity);`
`78`	`80`
`79`	`81`	// Re-populate the `groups` claim with the complete list of groups fetched from MS Graph
`80`	`82`	`foreach (Group group in allgroups)`
`@@ -83,8 +85,8 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con`
`83`	`85`	// the app registration, you might want to add other attributes than id to the `groups` claim, examples being;
`84`	`86`
`85`	`87`	`// For instance if the required format is 'NetBIOSDomain\sAMAccountName' then the code is as commented below:`
`86`		`- // groupClaims.AddClaim(new Claim("groups", group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));`
`87`		`- groupClaims.Add(new Claim("groups", group.Id));`
	`88`	`+ // groupClaims.Add(group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));`
	`89`	`+ groupClaims.Add(group.Id);`
`88`	`90`	`}`
`89`	`91`	`}`
`90`	`92`	`}`
`@@ -103,10 +105,15 @@ public static async Task ProcessClaimsForGroupsOverage(TokenValidatedContext con`
`103`	`105`	`{`
`104`	`106`	`// Removes 'JwtSecurityTokenUsedToCallWebAPI' from Items collection.`
`105`	`107`	`// If not removed then it can cause failure to the application.`
`106`		`- // Because this key is also added by StoreTokenUsedToCallWebAPI method of Microsoft.Identity.Web.`
	`108`	`+ // Because this key is also added by StoreTokenUsedToCallWebAPI method of Microsoft.Identity.Web.`
`107`	`109`	`context.HttpContext.Items.Remove("JwtSecurityTokenUsedToCallWebAPI");`
`108`	`110`	`}`
`109`	`111`	`}`
	`112`	`+`
	`113`	`+ // Here we add the groups in a session variable to print on the home page for informational purposes`
	`114`	`+ context.HttpContext.Session.SetAsByteArray("groupClaims", groupClaims);`
	`115`	`+`
	`116`	`+ return groupClaims;`
`110`	`117`	`}`
`111`	`118`
`112`	`119`	`/// <summary>`