I have configured Onpremise app with Azure App proxy and SAML SSO.
I'm able to access the application using application user access url. I have assigned my organization Azure AD group to onpremise application, so all users in that group able to access application.
Now, I want to allow external users (gmail,hotmail,yahoo etc.) access to the application.
I have large list of external users, who needs access to the application.
How can I provide access to all external users for my application.
You could use Azure Active Directory - B2C. This allows external users to use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs. Refer to the official documentation https://learn.microsoft.com/en-us/azure/active-directory-b2c/overview
Related
I have a click once windows application which already has authentication n Authorization built in. Earlier i used to deploy it on physical server n share the location with users so that they can install it n use it. But now we have decided to deploy it on azure PAAS service (App service ). But currently url is geting access by anyone which i want to restrict. Currently my organization AD is not synced with Azure AD. So not able to use Azure AD for authentication.
Kindly provide some better solutions other than restricting users based on IP.
If it's a file download you can put it on Azure Blob storage for download and generate short-time SAS tokens.
While IP address restrictions and Azure AD authentication would be one-efficient approach for your scenario. Since you do not want to go that route (due to environment limitations), If you wish you could authenticate users with the specified provider (Microsoft Account, Facebook, Google, Twitter or Any OpenID Connect provider). App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code.
App Service uses federated identity, in which a third-party identity provider manages the user identities and authentication flow for you. You can also use multiple sign-in providers.
So the simple process could be:
The option is Log in with . App Service redirects all anonymous requests to /.auth/login/<provider> for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized.
Kindly checkout step-step instructions on the process/workflow:
Configure your App Service or Azure Functions app to use Microsoft Account login
If your WebApp is on VNet, you can have service endpoints enabled for Microsoft.Web, through access restrictions.
See- Advanced usage of authentication and authorization in Azure App Service
I have setup some B2C Custom policies that depend on an external web API (TOTP MFA and OIDC endpoints). This API is running as an app service in Azure and everything is working correctly.
Is there a way to configure the network access restrictions so that I can use the firewall to restrict calls that are not coming from Azure AD B2C based on IP address?
I would even except the ability to restrict IP addresses to only that of Azure resources. I don't want to expose this web API to the entire internet, but currently adding any IP restrictions to the app service prevents Azure B2C from being able to access the API.
I have a sitecore application (version 9.0) hosted in azure. I have an azure ad synchronized with the on-premise ad consisting of internal users from my company. I have given full access to the internal users of my company on the sitecore applications.
I want to allow my b2c users from different domain to access the site core applications. the external users are from a separate azure ad. however, the external users will only have read-only permissions on the sitecore applications.
How to allow both the external and internal users to access the sitecore application hosted in azure?
I am trying to make Windows Authentication (with Kerberos/NTLM) work in a Web App hosted in IIS using Azure AD Federated users but seems it does not work. Below are the whole infrastructure details:
I have an Azure AD (e.g. skj.onmicrosoft.com) with Azure AD Domain Services Configured
I have an on premises Windows AD (e.g. skjtest.com) which is federated with the Azure AD. The on-prem users are available in AAD, SSO works but the password hash is not synced with AAD.
A VM is created in Azure and joined to the AAD Domain skj.onmicrosoft.com
I created a Web App which uses Windows Authentication and hosted in IIS present in the above Azure VM
When I try to login using an AAD user (e.g. aaduser1#skj.onmicrosoft.com) to the web app, it works all fine using both Kerberos and NTLM
However when I try to login using a federated identity (e.g. feduser1#skjtest.com), it fails showing a 401 Unauthorized Status code.
Here my question is, is this at all possible to make the Windows Auth (with Kerberos or NTLM) work with the Federated identities? If yes, please let me know the ways I can achieve this.
What could be the ways to integrate a web application ( on-prem) to another web application (Azure) using azure AD authentication( happening in the background), with out the user being prompted for credentials.
It depends on how your on-premise application authenticated. Based on the description, you want to implement the single sign-on for the on-premise application with the application which protected by Azure AD.
In this scenario, you can deploy ADFS on-premise and make the on-premise web application authenticate by the ADFS. Then we need to enable the trust from the ADFS to Azure AD. After build the federated trust, when the users try to access the web application which protect by Azure AD will redirect to the ADFS, and if the users already authenticate the on-premise application they will not required to enter their credential again. Here is a figure to demonstrate this progress and you can refer more detail about it from this link.
And now, we can use Azure AD connect to integrate your on-premises directories with Azure Active Directory easily. You can refer the video on this link about different settings for this tool.