Supporting single sign-on behind an application gateway

Question

Hi there,

We're trying to deploy an application that supports single-sign on using Microsoft Accounts. Our application is running locally as expected.

We're now trying to deploy on our Azure architecture. The application runs as an App Service. The App Service sits behind an application gateway on an internal VNet. This is accessible from certain internal networks via a private DNS link (e.g. application-name.azurewebsites.net).

We then are using the Azure Application Gateway / Application firewall for all inbound traffic to this site. We've configured listeners / pools etc. to route the traffic from e.g. application-name.companydomainname.com to application-name.azurewebsites.net. The application / firewall are working as expected.

When we are attempting to do single sign-on, we are receiving the following error message:

SSO Login Error. Error from external provider: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS500112: The reply address 'https://application-name.azurewebsites.net/SsoProvider/office365/signin-oidc' does not match the reply address 'https://application-name.companydomainname.com/SsoProvider/office365/signin-oidc' provided when requesting Authorization code. Trace ID: <omitted> Correlation ID: <omitted> Timestamp: <omitted>.

We understand that this is being caused by the fact that SSO is using the host name of the application running within app services (application-name.azurewebsites.net) but the inbound request is coming in via (application-name.companydomainname.com).

We have tried numerous configurations within our application, but we can't get passed the above message.

Any support would be appreciated,

Thanks,

Trev