Use incremental consent for User.ReadBasic.All

DFE-Digital · Aug 16, 2023 · 2ab4f2b · 2ab4f2b
1 parent 1a9ca51
commit 2ab4f2b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml.cs
@@ -2,12 +2,14 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Identity.Web;
 using TeachingRecordSystem.Core;
 using TeachingRecordSystem.SupportUi.Services.AzureActiveDirectory;
 
 namespace TeachingRecordSystem.SupportUi.Pages.Users.AddUser;
 
 [Authorize(Roles = UserRoles.Administrator)]
+[AuthorizeForScopes(Scopes = new[] { "User.ReadBasic.All" })]
 public class IndexModel : PageModel
 {
     private readonly IUserService _userService;

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs
@@ -68,7 +68,7 @@
 
 if (!builder.Environment.IsUnitTests() && !builder.Environment.IsEndToEndTests())
 {
-    var graphApiScopes = new[] { "User.Read", "User.ReadBasic.All" };
+    var graphApiScopes = new[] { "User.Read" };
 
     builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
         .AddMicrosoftIdentityWebApp(builder.Configuration, "AzureAd")