Azure Application Gateway prompting for Credentials Multiple times

Avaisuddin Mohammad 1

I am wondering if someone can help me guide in the right direction. Since I put my App (hosted on IIS on a VM in Azure) behind the Azure Application Gateway (v2) I am being asked multiple times to put my username and password. P.S. I am using Windows Authentication for my app. Everything works fine without the gateway. I have seen this a few posts about it but going back to Gateway V1 is not an option unfortunately.

Anyone here came across this and fixed it?
Any help appreciated.
Thanks

1 answer

msrini-MSFT 9,256 Reputation points Microsoft Employee

2021-05-07T04:14:37.277+00:00
Hi,

If you are using NTLM based authentication, then it is expected to get multiple prompts for authentication. It is an known issue and this behavior is documented.

There are two options which are available.

You can use Application Gateway V1 (which you are not willing to move to)

Use different authentication method for your Application.
Please sign in to rate this answer.

1 person found this answer helpful.
Avaisuddin Mohammad 1 Reputation point

2021-05-07T11:14:06.83+00:00

Hi msrini,
Thanks for your reply.
Is there a link to this documentation please?
Would like to know if it matches my setup.

Thanks.

Aaron Fletcher 1 Reputation point

2022-02-10T20:34:13.793+00:00

How am I supposed to use an Application Gateway V1 with a web app that needs a static IP?

Sujith Chand 1 Reputation point

2022-02-24T04:42:52.513+00:00

Hello @msrini-MSFT ,

I am also having the exact same problem as @Avaisuddin Mohammad . My application is using Windows Authentication. Could you please let me know if there is solution is available?

Environment :
AD - Windows Domain Controller
Web Server : IIS 10 ( IAAS VM)
AG : WAF V2

Authentication : Windows Authentication ( Tried With NTLM and Negotiate as Preferred Providers, also checked / unchecked Enable Kernel-mode authentication option)

Issue : Application is being prompted for user credentials multiple times. Everything works fine when we bypass the gateway.

Aaron Fletcher 1 Reputation point

2022-02-25T03:33:21.647+00:00

I found a solution for me. Apparently you can use the V1 Application Gateway (Standard V1) and then use a dynamic IP for your public IP object. The dynamic IP will only change if you manually restart the Application Gateway via Powershell. Under regular maintenance or updates, the IP won’t change as long as it’s attached to the Application Gateway.

As soon as I rebuilt the Application Gateway with V1 instead of V2, all my login prompt issues went away.

I also verified all of this with our platinum support Azure engineer so it’s definitely a known issue and this is the solution.

Bollwerk, Pete 41 Reputation points

2022-06-01T23:02:30.557+00:00

V2 gateways only support the following methods of authentication:

Anonymous, Azure AD SSO (Single Sign On), and Basic.

NTLM / Kerberos authentication is NOT supported on V2 gateways.

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#does-application-gateway-v2-support-proxying-requests-with-ntlm-authentication
Sign in to comment