Front Door + App Service with built-in authentication not working

user_3231778 0
Viewed 387

I'm trying to use App Service with standard App Registration built-in authentication behind a Front Door with no success.

My setup is:

  1. An App Service "myapp.azurewebsites.com" with built-in authentication.
  2. App Registration "app-auth" as auth provider.
  3. I have "app-auth" configured in my App Service for automatic authentication via Provider.
  4. Front Door "frontdoor.example.com" forwards requests to my App Service.

My App Registration "app-auth" has a redirect URL assigned the Front Door public name example "frontdoor.example.com".

Problems I'm having:

  • App Service keeps sending it's own name "myapp.azurewebsites.com" as request_uri query string login in to Azure Active Directory. It must send the Front Door URL.
    enter image description here
  • Setting up "frontdoor.example.com" host header in Front Door fails, as it requires it to match the App Service name. enter image description here

Am I missing some configuration? Or, do I need to use custom authentication when behind a Front Door?

azure-front-door azure-web-app-service azure
3 Answers

In order for this to work, you need to add the custom domain (frontdoor.example.com) also to your app service. This can be done using DNS verification.

  • Go to your App Service
  • Go to Custom Domains
  • Copy the Custom Domain Verification ID
  • Add a new DNS TXT record with the copied value: TXT asuid.frontdoor.example.com. <verification id>

App Service Custom Domain Verification ID (image)

To ensure Front Door forwards the request Host Header, the Origin host header field in your Origin configuration must be blank.

Then, when Front Door forwards the request Host Header (Host: frontdoor.example.com) the App Service will recognize it and the Azure AD authentication will use it as for redirection.

user_194930140

it seems you have misconfigured the redirect URI in your APP service registration in Azure AD, that is where you specify the redirect_URI, it has nothing to do with the app service or the front door itself.

user_161724350
user_35958050
Related