Add support for group membership claims

[MrMossevig]

Hi,

We're using the new Database Connection with SWA. We also want to use the built-in Authentication with Entra ID of the SWA to keep things simple and avoid building glue ourselves.

We're using security groups to control who has access to what data. I.e. a security group has access to a project and it's corresponding data in the database. If I understand the API builder correctly, it only supports roles today and not group claims?

Are there any plans for implementing it or other ways to acheive the same thing?

Ref: This is the conversation that started this Feature Request: https://learn.microsoft.com/en-us/answers/questions/1410852/does-the-new-database-connection-in-static-web-app

[MrMossevig]

To add an example to the problem, let's say you have the entity Books, and the roles User and Author. The User can read all books, and the Author can also edit her own, but only her own, Books. How do you acheive that in the API Builder?

[MrMossevig]

Thank you! This might be drifting into off-topic territory, but it might help us solve the case. Is it possible to use related fields in the policies? E.g. If I have a many-to-one relationship between books and organizations and each organization have a an id, can I then use @item.organization.id in the policy?

[seantleonard]

Unfortunately, no. This is being tracked by #569

[MrMossevig]

Okay, got it. And I guess the answer to my last question is also no, using part of the userDetails (e.g. the domain (split at '@')) for filtering?

[seantleonard]

DAB can't parse out a substring of userDetails, however I wouldn't recommend using that field alone for authorization purposes since the username is mutable. Using the userId would probably be better in that case.

[MrMossevig]

Yeah, it was a bit too late when I thought about that. Agree - not a good idea :)