Calling the Graph api after SAML2.0 auth. How do I

Question

Our web aap is authenticating with the Azure AD via SAML2.0 similar to this.

In return we get SAML assertion(SAML token).

But when the user who logs in have more then 150+ groups the response doesn't contain the group information(so that token size doesn’t exceed HTTP header size limits. More info on this)

But what it return is a Graph Api to be hit to get the group information something like https://graph.windows.net/{tenant id}/users/{user id}/getMemberObject.

By going through this

I understand that I need to attach a Auth bearer token with the http request to hit the graph api successfully. My problem is how do I get the Auth bearer token? How can I use the SAML token to get the Auth bearer token?

Other useful link - link1 link2

Answer 1

I've only used the non SAML graph API using the ADAL libraries but from the docs it appears the NameID seems to be the basis for requesting an access token for the Graph API:

<Subject>
  <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">m_H3naDei2LNxUmEcWd0BZlNi_jVET1pMLR6iQSuYmo</NameID>
  <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />
</Subject>

From this post,

"Here the Client gets a SAML bearer assertion from the SAML Identity Provider then requests an access token from the Authorisation Server using the SAML bearer assertion as proof of identity"

and this article states the entire Assertion is used to get the access token, where you:

encode the whole assertion by using base64url encoding before adding it as part of the POST request