Supporting single sign-on behind an application gateway

Trevor Richards 0 Reputation points
2024-05-30T08:29:25.7633333+00:00

Hi there,

We're trying to deploy an application that supports single-sign on using Microsoft Accounts. Our application is running locally as expected.

We're now trying to deploy on our Azure architecture. The application runs as an App Service. The App Service sits behind an application gateway on an internal VNet. This is accessible from certain internal networks via a private DNS link (e.g. application-name.azurewebsites.net).

We then are using the Azure Application Gateway / Application firewall for all inbound traffic to this site. We've configured listeners / pools etc. to route the traffic from e.g. application-name.companydomainname.com to application-name.azurewebsites.net. The application / firewall are working as expected.

When we are attempting to do single sign-on, we are receiving the following error message:

SSO Login Error. Error from external provider: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS500112: The reply address 'https://application-name.azurewebsites.net/SsoProvider/office365/signin-oidc' does not match the reply address 'https://application-name.companydomainname.com/SsoProvider/office365/signin-oidc' provided when requesting Authorization code. Trace ID: <omitted> Correlation ID: <omitted> Timestamp: <omitted>.

We understand that this is being caused by the fact that SSO is using the host name of the application running within app services (application-name.azurewebsites.net) but the inbound request is coming in via (application-name.companydomainname.com).

We have tried numerous configurations within our application, but we can't get passed the above message.

Any support would be appreciated,

Thanks,

Trev

Azure DNS
Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
620 questions
Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
989 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,148 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
37 questions
{count} votes