Azure App Proxy pointing to F5 Load Balancer

Question

Azure App Proxy pointing to F5 Load Balancer

Joe 6

Hi, were trying to make internal web apps available thru Azure Application Proxy, but some of our web apps are sitting behind an F5 load balancer.

We'd like to make the experience as seamless as possible for our users, so single sign-on is a must. Has anybody made this scenario work?

A request has been raised on the Azure Feedback Portal for this scenario, but so far it only reads that documentation for getting this to work is in progress (and has been for a while).
https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/37802281-azure-active-directory-s-application-proxy-and-loa

Thanks for any input.

VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee

2020-09-25T07:16:28.523+00:00

@Joe I wanted to follow up and know if the below response helped in answering your query, please do not forget to accept the response as Answer; if the response helped in answering your query.
Joe 6 Reputation points

2020-09-26T06:05:21.61+00:00

Hi, unfortunately John's response didn't really answer my question. It's the guidance for getting the authentication and single sign-on to work that we're looking for. I believe Microsoft reported that they were working on the guidance, but that was over a year ago.

1 answer

Your answer

VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee

2020-09-25T07:16:28.523+00:00

@Joe I wanted to follow up and know if the below response helped in answering your query, please do not forget to accept the response as Answer; if the response helped in answering your query.
Joe 6 Reputation points

2020-09-26T06:05:21.61+00:00

Hi, unfortunately John's response didn't really answer my question. It's the guidance for getting the authentication and single sign-on to work that we're looking for. I believe Microsoft reported that they were working on the guidance, but that was over a year ago.

Answer 1

John Lunn 1 Microsoft Employee

Hi, yes my understanding is that the Azure App Proxy connector will access your private network (i.e. bypass your External Facing F5 LB s it sits on an internal server with access to your app) Have you considered setting up an internal load balancer scenario (i.e. create a Private VIP) and have DNS configured that the connector service resolves your internal APP via the URL to the F5 internal VIP?

I guess depending on which auth method you need to use would depend on whether you need to do anything clever with the LB, but if you are just load balancing 443 and or 80 then this should work fine for you!

Hope this helps
John

Joe 6 Reputation points

2020-09-20T20:58:40.37+00:00

Hey John, thanks for the reply. We were planning on pointing the App Proxy URL to our internal F5. The problem seems to be with authentication when pointing the URL to the internal VIP of the F5 (and therefore hitting the F5). I believe the issue relates to configuring Kerberos delegated authentication and what is needed to make it work with the F5 in the data stream.

Much appreciated, Joe.
Sam Hall 46 Reputation points

2020-10-01T04:24:00.407+00:00

Do you have APM module enabled on the F5? If so, then the way to do this is to configure a Kerberos AAA with Azure AD / KDC and assign it to an APM Access Policy. Get that working against a dummy HTTP service. Then create a Kerberos SSO configuration to authenticate with the real application servers. So essentially it's two separate Kerberos SSO configurations, i.e. Azure AD <-- Kerberos SSO --> F5 <-- Kerberos SSO --> Server Pool.

Alternatively, if your F5 virtual server can be exposed to the Internet, create a SAML or Oauth based Access Policy for SSO against Azure AD, then you'll still need to create the Kerberos SSO configuration for the application servers (unless they support one of the other SSO configuration options). Then you don't need to use the App Proxy and one less Kerberos configuration. You can still publish links to the app via Azure AD so end user's won't know the difference.
Joe 6 Reputation points

2020-10-01T12:48:38.187+00:00

Thanks for the reply and sharing this info. I've passed it along to the team I'm working with and hopefully we can take a look at it shortly. I'll update this post when I have more info.
Joe 6 Reputation points

2020-10-14T12:41:29.707+00:00

Unfortunately we don't have APM in our F5 load balancers and we don't want to expose our internal F5 directly to the Internet.

I've opened a case with Microsoft Support and will provide more details as they become available.

Thanks for the suggestions.

Share via

Azure App Proxy pointing to F5 Load Balancer

1 answer

Your answer