Are claims available to Django Views in request to do custom permission check?

[sachingaikwad123]

Client: React SPA
Web API: Django Backend REST API
Azure AD (only cloud)

I am able to test 'authentication' and 'web api call' with access token. I would like to implement RBAC in Django Backend Web APIs. For this, I am getting 'claims' in token as well. [I created app roles in Azure AD App Registration page for this].

1. Now, I would like to do some custom permission checks in some 'views' (APIs) based on roles. How to access 'claims' value in 'views'? Should 'request.auth' have claims'? There is no documentation regarding this.
2. What is recommended/best approach to implement RBAC in such setup? Should I map 'roles' to Django 'groups'? Can we add some documentation/help guide for this scenario using this django package/lib?

Upvote & Fund

• We're using Polar.sh so you can upvote and help fund this issue.
• We receive the funding once the issue is completed & confirmed by you.
• Thank you in advance for helping prioritize & fund our backlog.

[tim-schilling]

The way I managed this was to create a list of group AD uuids that mapped to certain django groups. Since I only have 5 groups, it was easy enough to manage via an environment variable encoded as JSON.

[JonasKs]

You can set up Azure to respond with groups and map those role claims to Django groups. Then do normal RBAC on those.