Link to home
Start Free TrialLog in
Avatar of aaronzw
aaronzwFlag for United States of America

asked on

What are the Azure Authentication and Authorization Best Practices for a complicated situation?

We are trying to develop an Insurance Agent Web Portal using Azure and have some fairly complicated requirements for our Users/Agents:  We want each Agent to only have one login ID/password but they may be associated with multiple agencies and their security levels may vary based on the agency.

For example, the Agent Bob may be authorized to access the Portal for Agency XX and also Agency YY but for Agency XX he should have admin level privileges but for Agency YY he should only have Basic privileges. Once Bob logins in, we would like to present a screen to him so he can choose which Agency he is currently working with and then later he can switch to the other agency.

I realize this is probably not built into either Azure AD or asp.net Identity but any suggestions about which one might be a good starting point would be appreciated.
SOLUTION
Avatar of Adam Brown
Adam Brown
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of aaronzw

ASKER

Thank you very much for your prompt response!

A couple of follow-up questions:

1. Could AD help with determining what is the Current Agency that the logged in User has selected or would that be outside the scope of AD?  In other words, if Billy Bob logs in and has various permissions for 5 different Agencies can we somehow store in AD which Agency he has currently chose?

2. For each Agency, there will be an identical list of permissions - Can_Create_Policies, Can_Access_Accounting, Can_Generate_Quotes, Can_Review_Documents and Can_Add_messages.  And each user can have any combination of these.  Is there a way to use AD groups such that I don't have to make a new Group for every possible permutation of these 5 permissions?
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of aaronzw

ASKER

Thanks for your help