Azure Function Authentication with AAD Results in 'The page cannot be displayed because an internal server error has occurred.'

Michael Gressman 86

I have an Azure Function that I created and connected to AAD using the Express method and letting it create the App Registration for me. This Azure Function works as expected where I am required to provide an access token for it to work.

I've tried to duplicate this by manually creating the App Registration via the portal for another Azure Function. In the Authentication / Authorization settings for the new Function, I chose the Express method but used the existing App Registration I created manually. Unfortunately, this function always returns the error 'The page cannot be displayed because an internal server error has occurred.' whenever I navigate to it. If I turn off the App Service Authentication then the Function works, albeit not protected by AAD. As soon as I turn the App Service Authentication back on, it fails with the internal server error message.

I've verified the settings between the automatically created App Registration from the first Function and my manually created App Registration from the second Function and everything looks correct. It just seems that something is still not setup correctly on the App Registration I created manually, but nothing in the portal seems to show me what that is and the error I am getting is completely useless.

How can I troubleshoot this to find out why my manually created App Registration is not working?

Michael Gressman 86 Reputation points

2020-11-12T03:20:40.83+00:00
Tried using the Azure CLI to create an App Registration using the following code:

az ad app create --display-name "FuncAPI" --credential-description "funcapi" --password "p@ssword1" --reply-urls "http://localhost:7071" --identifier-uris "https://funcapi.<tenantname>.onmicrosoft.com"

After connecting that App Registration to my Azure Function, the same result happens:

As soon as I navigate to the Function URL, I get the error 'The page cannot be displayed because an internal server error has occurred.'

Unless I am missing something, it appears there is no way to pre-create an App Registration and connect it to an Azure Function. The only way I can make this work is to create the App Registration at the same time I enable the App Service Authentication on the Function. I need to be able to create these things via IaC,

Accepted answer

Matt Lavery 76 Reputation points Microsoft Employee

2020-11-15T09:06:14.363+00:00

Been facing this exact problem myself with a new Azure Function for a small project where calling the function API (either via browser or with Postman) would result in "The page cannot be displayed because an internal server error has occurred."

Through some trial and error after reading the the steps you had also ruled out I switched from "Express" mode to "Advanced" mode in Active Directory Authentication. Here I noticed that the Issuer Url was set to something which didn't seem right from previously configuring this type of auth (i think it was https://sts.microsoft.com). What ever web site it was it was not a valid URL and didn't resolve.

As my security is restricted to my specific tenant I set the Issuer Url to https://login.microsoftonline.com/{{tenant_id}}. This fixed the issue as now when I called the API from PostMan I would get the "You do not have permission to view this directory or page." with an invalid token supplied.

Note: I also added a Client Secret just to improve the security, but I am doubtful that influenced the issue as I tried that before changing the Issuer URL.

Let us know if that helps you.
Please sign in to rate this answer.
Michael Gressman 86 Reputation points

2020-11-16T02:55:44.303+00:00

Thank you for the tip on switching to Advanced mode.

I switched to Advanced mode and the issuer Url that is pre-filled is https://sts.windows.net/<tenant id>. The Client ID for my manually created App Registration is in the Client ID field. Now I can actually navigate to the URL of my function and it doesn't throw the 'The page cannot be displayed because an internal server error has occurred.' error any more. So it looks like progress.

Now the problem that I have is that every request I make to the function via Postman says 'You do not have permission to view this directory or page'. In the Authorization tab for Postman, I am using the OAuth 2.0 type and using the Get New Access Token button to get an access token. This works fine as I get an access token back, but for some reason I cannot get past the permission issue. Even the Azure account owner credentials do not work. Are you able to actually call your function with Postman?

Michael Gressman 86 Reputation points

2020-11-16T03:27:17.433+00:00

I think I may have finally gotten it working.

The first step was clearly to use Advanced mode instead of Express. That solves the server error issue. My issue with Postman was the Allowed Token Audiences in the Advanced mode. I was leaving it blank as I wasn't entirely sure what to put in here, but it looks like the Application ID URI from the App Registration needs to be populated here. As soon as I did that, I am now able to call the Function from Postman and get the expected response.

Thank you so much for the tip, @Matt Lavery . You got me off to the right direction.

I will accept your answer shortly. I just want to do a few more tests. For those in the Microsoft world that may be paying attention to this, I still think there is something obviously broken, or at least not well understood, about Express mode configuration. I would expect Express mode to work as I laid it out in my previous comments, but it clearly does not.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,491 Reputation points

2020-11-12T21:17:49.847+00:00

Hello @Michael Gressman . Your reply URL should be https://funcapi.azurewebsites.net/.auth/login/aad/callback. Also the identifier uri should be https://funcapi.azurewebsites.net.

Let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.
Please sign in to rate this answer.
Michael Gressman 86 Reputation points

2020-11-13T18:15:57.003+00:00

Thank you so much for your response, but I don't think this is related to the reply URL or the identifier uri. I did go ahead and make the changes you suggest and it still does not work.

I've put together a document and attached (way too many characters to type here) to describe a simple testing process. The testing process has two steps:

Create an Azure Function, enable authentication, and let Azure create the App Registration automatically

Create an App Registration manually, create an Azure Function, enable authentication and use the manually created App Registration

Step 1 works every time. Step 2 fails every time.

If you run through the steps, you should be able to see exactly what I am seeing.

39745-aad-af.pdf

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,491 Reputation points

2020-11-13T19:42:09.623+00:00

Hi @Michael Gressman , I reproduced your error using the az cli command and found those were the main differences between the applications. Are you allowed to authenticate to later see the error? Also, ensure the Active Directory Graph User.Read scope is added to the application permissions. If that does not work you might compare both application manifest and spot some relevant difference. If that does not work maybe you can modify the original application created by the express configuration.

Michael Gressman 86 Reputation points

2020-11-13T20:18:24.37+00:00

I am unable to authenticate to the Azure Function. I can successfully get an auth token via private browser window and then use Postman to exchange auth token for access token, but when I submit a GET request to the Function with the token, I get the server error response.

I will compare the manifest between the two and see if there is a difference and report back.

As far as I know, there is no way to add the Active Directory Graph User.Read scope manually via the portal because Azure AD Graph API is deprecated. I see the auto-generated App Registration does have that scope, but I can't add it to the manual registration. The scope I have on the manually registered App Registration is Microsoft Graph User.Read.

Michael Gressman 86 Reputation points

2020-11-13T21:25:41.683+00:00

After comparing the manifest between the automatic registration and the manual registration, the only difference I find is around the naming for redirects and sign-ins (e.g. one is automatic and one is manual), and the required resource access which is the Active Directory Graph vs Microsoft Graph.

At this point, I am still led to believe that this is an issue internally somewhere that I can't fix.

Can you run through my sample document to get to the same place I am and let me know if you have an idea on how to fix it? I am pretty much dead in the water at this point.

Michael Gressman 86 Reputation points

2020-11-13T23:17:36.09+00:00

The final test. I re-created the Azure Function from scratch, letting it automatically create the App Registration, and tested it as working as expected. Navigating to the Function URL produces the Microsoft login window.

I left the App Registration in place, but deleted the resource group containing the Azure Function. I then re-created the Azure Function again EXACTLY as it was created before. I setup the auth to use the App Registration from before, which I assume should work since it worked perfectly in the previous version of the Function, and it does not. Same problem. The page cannot be displayed because an internal server error has occurred.

At this point, I think it is pretty convincing that my App Registration is not the issue here. There has to be something that Azure is doing internally to make this work when the App Registration is created automatically, but cannot be reproduced manually.

I really need help on this one. I don't have any other options to try.

Björn Bergstrand 1 Reputation point

2021-01-22T15:45:24.777+00:00

I had a similar issue, it was due to a mismatch of client secret in the Authentication / Authorization -> Azure Active Directory and the app registration client secret in the AD.
I could get a token fine with the secret from the app registration, but it would fail to login with 'The page cannot be displayed because an internal server error has occurred.'
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Thanh Duong 1 Reputation point

2021-10-11T21:51:40.783+00:00

I'm running into the same problem her as i get a 500 when i turn on AAD for my function app. There isn't an advanced or express option anymore, but i tried changing the issue URL as well and no luck. The secrets does match between the app registration and the function app configuration.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Function Authentication with AAD Results in 'The page cannot be displayed because an internal server error has occurred.'

2 additional answers

Your answer