Function App breaks whenever one identity provider is unreachable

Luis Arteiro 1 Reputation point
2022-07-05T14:26:51.863+00:00

To keep it simple, I am using a Function App with two identity providers: one is Microsoft's (referring to an app registration) and an OpenID Connect one.
Everything works smoothly and the authentication is occuring correctly for tokens from both instances. Users can either use our application if they authenticate through Azure Active Directory or through the custom OpenID Connect on-prem.

However, there's a problem. If, for some reason, the configured OpenID Connect custom identity provider is down, the whole API stops responding (errors with 503) everytime an endpoint is called. The following error occurs:

   System.TypeInitializationException: The type initializer for 'Microsoft.Azure.AppService.Middleware.ModuleUtils' threw an exception.  
     
   2022-07-05T14:12:06.357092584Z  ---> Newtonsoft.Json.JsonSerializationException: Error getting value from 'AuthorizationEndpointString' on 'Microsoft.Azure.AppService.Middleware.Modules.OpenIdConnectEndpointConfig'.  
     
   2022-07-05T14:12:06.357261383Z  ---> Microsoft.Azure.AppService.Middleware.HttpException: Exception of type 'Microsoft.Azure.AppService.Middleware.HttpException' was thrown.  
     
   2022-07-05T14:12:06.357386383Z    at Microsoft.Azure.AppService.Middleware.OpenIdConnectConfiguration.Download(String siteName, String url) in /EasyAuth/Microsoft.Azure.AppService.Middleware.Modules/OpenIdConnectConfiguration.cs:line 77  

This is expected since obviously EasyAuth can't reach the downed custom provider. However, is there a way to bypass this error? I don't want the API to go down just because one identity provider is down. It should still receive requests and respond accordingly (if a request has a Microsoft token, it works. If not, it refuses and refuses the connection as unauthenticated).

Is there a way to set my API up so it doesn't crash just because one of the identity providers is down? It should be open to new requests and just not check with the downed identity provider.

Thank you very much!

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
5,578 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,747 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.