Azure AD B2C API Connector doesn't send X-ARR-ClientCert header

Question

Azure AD B2C API Connector doesn't send X-ARR-ClientCert header

Jakub Pernica 220

Hello,

In my Azure AD B2C, I've configured such API connector:

User's image

Then, I've included this API connector in my Sign In user flow.

User's image

I've tried to create a simple Node.JS application running in Azure Container Apps, for which I chose Client certificate mode to Required in the Ingress settings:

User's image

However, it seems like when I run my user flow, my ACA doesn't even get any request. I tried switching the client certificate mode to Accept and then I receive a request, but the X-ARR-ClientCert is missing, instead I receive x-forwarded-client-cert header which contains some certificates. Sample code of my ACA:

https://gist.github.com/kubop/33964fab65c532eb50f1a008de23f647

I've also tried to use Azure App Service (containerized), without any luck as well.

Accepted answer

0 additional answers

Your answer

Answer 1

Akshay-MSFT 17,956 Microsoft Employee Moderator

@Jakub Pernica

Thank you for posting your query on Microsoft Q&A, seems like there is an issue while calling the endpoint.

In your code you have allowed access over HTTP:

const http = require('http');

As per Configure TLS mutual authentication for Azure App Service If you access your site over HTTP and not HTTPS, you will not receive any client certificate. So if your application requires client certificates, you should not allow requests to your application over HTTP.

User's image

Or try to follow the Node.js sample

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Jakub Pernica 220 Reputation points

2023-10-26T10:31:44.8166667+00:00
Oh, I thought that since Azure Container App URLs uses https:// it would be enough. I've tried to rewrite my code to use self-signed certificate and use https:

const https = require('https'); const options = { key: fs.readFileSync("server.key"), cert: fs.readFileSync("server.cert"), };

However, then my container app doesn't start successfully. I guess it might be a bit tricky to use self-signed certificates running in Azure Container Apps?
Akshay-MSFT 17,956 Reputation points Microsoft Employee Moderator

2023-11-08T04:59:45.34+00:00

@Jakub Pernica \

For guidance on usage of self-signed certificates running in Azure Container Apps, I would request you to raise thread with Azure App services Tag.

Thanks,

Akshay Kaushik

Share via

Azure AD B2C API Connector doesn't send X-ARR-ClientCert header

0 additional answers

Your answer