I have a app hosted in Azure. Currently when a user is authenticated in Azure AD but does not have access to the application, a generic message appears suggesting the user should request access from an administrator.
Now how would I redirect the user to a specific URL when they get this page from Azure AD ? I see no way to configure this in Azure.
EDIT
A little more technical details :
My App is hosted in a serverless Azure App Service. It is an Angular application using msal.js to authenticate.
The App is manually configured in Azure AD using Application Registration tab.
Related
I have a blazor server-side application that uses Azure B2C authentication. Everything works well when I run it on my local machine. Now I deployed it as Azure App Service. The application url is redirected for authentication to https://mycompanyb2c.b2clogin.com/mycompanyb2c.onmicrosoft.com/b2c_1_myapp_signin/oauth2/v2.0/authorize... etc.
But immediately after that it is redirected to redirect uri (https://localhost:44333/signin-oidc). I don't know why this happens. What I did notice was a warning "You can use this application to authenticate against Azure Active Directory, but not Azure AD B2C". This surprises me, as I thought the app is under Azure AD B2C, and I can see it under Home/Azure AD B2C on Azure portal.
How can my issue be resolved?
Did you update the redirect URL in your json file?
Did you update the redirect URL in the app registration?
It looks like this is pointing to your local PC rather than the Azure App Service.
In terms of the message, is your app. one of these?
I have a click once windows application which already has authentication n Authorization built in. Earlier i used to deploy it on physical server n share the location with users so that they can install it n use it. But now we have decided to deploy it on azure PAAS service (App service ). But currently url is geting access by anyone which i want to restrict. Currently my organization AD is not synced with Azure AD. So not able to use Azure AD for authentication.
Kindly provide some better solutions other than restricting users based on IP.
If it's a file download you can put it on Azure Blob storage for download and generate short-time SAS tokens.
While IP address restrictions and Azure AD authentication would be one-efficient approach for your scenario. Since you do not want to go that route (due to environment limitations), If you wish you could authenticate users with the specified provider (Microsoft Account, Facebook, Google, Twitter or Any OpenID Connect provider). App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code.
App Service uses federated identity, in which a third-party identity provider manages the user identities and authentication flow for you. You can also use multiple sign-in providers.
So the simple process could be:
The option is Log in with . App Service redirects all anonymous requests to /.auth/login/<provider> for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized.
Kindly checkout step-step instructions on the process/workflow:
Configure your App Service or Azure Functions app to use Microsoft Account login
If your WebApp is on VNet, you can have service endpoints enabled for Microsoft.Web, through access restrictions.
See- Advanced usage of authentication and authorization in Azure App Service
We are planning to setup a multi-tenant azure web api which will be invoke by a client app which is registered as converged app with MSA but now in Azure AD. The client app owner dont have Azure AD on thier side. And the client belongs to different tenant.
Can someone please explain how the client will invoke our azure ad web api as client isn't registered as azure webapp.
We have setup .net core azure webapp
You need to consent to the web API from your client app tenant first. To consent to the web API, you could follow this:
https://login.microsoftonline.com/client-app-tenant/oauth2/authorize?client_id=api-client-id&redirect_uri=api-reply-url&response_type=code&prompt=admin_consent
By this, a service principal will be created in your app tenant for the API, allowing you to assign app permissions to the web API in your app tenant.
I am trying to make Windows Authentication (with Kerberos/NTLM) work in a Web App hosted in IIS using Azure AD Federated users but seems it does not work. Below are the whole infrastructure details:
I have an Azure AD (e.g. skj.onmicrosoft.com) with Azure AD Domain Services Configured
I have an on premises Windows AD (e.g. skjtest.com) which is federated with the Azure AD. The on-prem users are available in AAD, SSO works but the password hash is not synced with AAD.
A VM is created in Azure and joined to the AAD Domain skj.onmicrosoft.com
I created a Web App which uses Windows Authentication and hosted in IIS present in the above Azure VM
When I try to login using an AAD user (e.g. aaduser1#skj.onmicrosoft.com) to the web app, it works all fine using both Kerberos and NTLM
However when I try to login using a federated identity (e.g. feduser1#skjtest.com), it fails showing a 401 Unauthorized Status code.
Here my question is, is this at all possible to make the Windows Auth (with Kerberos or NTLM) work with the Federated identities? If yes, please let me know the ways I can achieve this.
What could be the ways to integrate a web application ( on-prem) to another web application (Azure) using azure AD authentication( happening in the background), with out the user being prompted for credentials.
It depends on how your on-premise application authenticated. Based on the description, you want to implement the single sign-on for the on-premise application with the application which protected by Azure AD.
In this scenario, you can deploy ADFS on-premise and make the on-premise web application authenticate by the ADFS. Then we need to enable the trust from the ADFS to Azure AD. After build the federated trust, when the users try to access the web application which protect by Azure AD will redirect to the ADFS, and if the users already authenticate the on-premise application they will not required to enter their credential again. Here is a figure to demonstrate this progress and you can refer more detail about it from this link.
And now, we can use Azure AD connect to integrate your on-premises directories with Azure Active Directory easily. You can refer the video on this link about different settings for this tool.