Azure Function LDAP call, Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Question

Azure Function LDAP call, Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Gary Zhou 1

I am working on a Azure Function v1 app, using .NET framework 4.8, this app has to create account in on prem Active Directory using LDAP over SSL, but it always got Access is denied error.
This app use service account for LDAP request, I believe the service account permission has set properly because it works fine in developer's machine.

Any idea?
Thanks!

1 answer

Your answer

Answer 1

MughundhanRaveendran-MSFT 12,506

@Gary Zhou ,

Thanks for reaching out to Q&A.

Using ldap in functions is actually complicated and there might be some restrictions. From a networking perspective, you need to create a hybrid connection using expressroute or atleast a point to site connection to access an on-prem resource. When you have successfully configured the hybrid network connectivity, then comes the restriction on LDAP.

Things you cannot do with Hybrid Connections includes Support LDAP, because it can require UDP. Please refer : https://devblogs.microsoft.com/premier-developer/using-azure-app-services-with-hybrid-connections/#things-you-cannot-do-with-hybrid-connections

I would suggest you to host your .net application in a VM and access the on-prem Active directory using LDAP over SSL.

Please see a similar discusssion here: https://stackoverflow.com/questions/49196898/azure-app-service-active-directory-authentication-access-denied/52633900#52633900

MughundhanRaveendran-MSFT 12,506 Reputation points

2022-02-14T05:13:14.273+00:00

@Gary Zhou , Just wanted to know if the above answer was helpful or not. Please let me know
Gary Zhou 1 Reputation point

2022-02-14T11:04:08.743+00:00

Thanks for your help. I have resolved this issues.
LDAP actually work in App Service and Function App, you have to use LDAP over SSL, which force LDAP request using TCP on port 636. also domain controller should have public SSL certificate installed, App service/Function doesn't trust internal SSL certificate.
My current Function App, original code use DirectoryEntry.Invoke("SetPassword".....), I chanage it to UserPrincipal.SetPawword method, the function app works after I make this change, it can create new account with password.
However, I have to say I don't fully understand the difference between these two classes in terms of how LDAP request being processed.

Share via

Azure Function LDAP call, Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

1 answer

Your answer