In the Azure Portal, in certain scenarios when it prompts me to open a URL in a new tab, I get a 403 error.
"Error 403 - This web app is stopped"
I have followed the help link on that page (https://blogs.msdn.microsoft.com/waws/2016/01/05/azure-web-apps-error-403-this-web-app-is-stopped/), but none of these issues (see footnote for issues) apply to me.
Specific examples of when I get this message:
In an app service > App Service Diagnostics > Collect Memory Dump: the report is available to view in a pop-out URL. When I click on the link, it opens a new browser tab and I can see from the url that it's attempting an oauth sign-in, which eventually displays the 403 page.
In an app service > App Service Editor (Preview), when I click on the "Go" link, as before, it opens a new browser tab and I can see from the url that it's attempting an oauth sign-in, which eventually displays the 403 page.
In both cases, it redirects to a https://****.sso.azurewebsites.net url which displays the 403 message.
Any suggestions?
Footnote: According to that url, there are 3 conditions that can cause this error to be presented.
The site has reached a billing limit and your site has been disabled.
The Website has been stopped in the portal.
The Azure Website has reached a resource quota limit that applies to either Free or Shared scale modes.
Based on Ivan's comment, I checked my role settings. I was a Contributor for this Azure subscription. Since I changed it to an Owner (via Access control IAM > Role Assignments), it now works as expected.
It's frustrating that this is not made obvious in the Azure Portal.
In my case, There were network IP restrictions applied to the site. So I was getting the same error above from my home network. You can check the rules by going to the properties tab. To modify, go to Networking->Configure access restrictions.
If you are only getting the error when you open a new tab, it could be a problem with the maximum number of connections.
Are you running in debug mode? For Basic and below the maximum number of debug connections is 1.
Related
Ok so for multiple reasons, I changed the network settings of an app service so that it cannot be accessed using its .azurewebsites.net url
It works but it displays the default "Forbidden" page. What I would like to do is have it display something like this:
If I can extend it to returning a failed status instead of a 403, that would also be awesome.
Creating custom error pages in cases of 4XX and 5XX errors is not supported out of the box with Azure App Services as of today, but it is a heavily upvoted and requested feature on their UserVoice forum. Please upvote it so the Product Group can prioritize it accordingly.
To work around it, you could use an Application Gateway to create custom error pages instead of displaying default error pages. You can use your own branding and layout using a custom error page.
Custom error pages are supported for maintenance and unauthorized access scenarios, and can be defined both at global and listener levels.
The configuration through Azure Portal and Azure PowerShell is explained in detail in this article: Create Application Gateway custom error pages
The Azure AD B2C - App Registrations (both current and preview) will not save my non localhost address. i.e. if I add a redirect Uri as https://localhost:44734, and save it works fine. If I add a uri as https://mysite.azurewebsites.net it will not save. The details here is slightly different depending on the part of the portal you are in.
If you are using the "App Registrations (Preview)" version, you see a notification in the top right saying "Update application Authentication". This just stays there and never finishes.
if you are using the current Applications blade you get an error stating "Application Update Error" "Cannot update Application: One of the properties provided for the application 'XXXXX' has invalid value. Please read this article (https://go.microsoft.com/fwlink/?linkid=847767) for more details.". This seems to be the case for any URL except localhost.
Also manually editing the manifest is also giving the error.
You should be able to add both localhost, and any valid url in that screen. Which seems to work on a new Application, but not an existing one.
I can not reproduce your issue on my side. I think you can create a new application to resolve this issue.
Also, you can try to delete all the reply urls and then add it again.
I have a web app in Azure. The access to that web app is controlled by Azure Active Directory. The app is up and running since September of last year. I didn't make any changes to the app for a while and have 33 users in that app.
So, a week ago I tried to add a user, using the same methods and paths I used before.
The new user can log in to microsoft (portal.office.com). After the initial log in and changing of the password the user goes to the web app in Azure and get the following error: You do not have permission to view this directory or page.
Error tracing gives me this:
HTTP Error 401.73 - Unauthorized You do not have permission to view
this directory or page.
Most likely causes: The authenticated user does not have access to a
resource needed to process the request.
Things you can try: Create a tracing rule to track failed requests for
this HTTP status code. For more information about creating a tracing
rule for failed requests, click here.
Detailed Error Information: Module EasyAuthModule_32bit
Notification BeginRequest Handler
ExtensionlessUrlHandler-Integrated-4.0 Error Code 0x80004005
Requested URL https://*******:80/.auth/login/aad/callback Physical
Path D:\home\site\wwwroot.auth\login\aad\callback Logon Method
Not yet determined Logon User Not yet determined
More Information: This is the generic Access Denied error returned by
IIS. Typically, there is a substatus code associated with this error
that describes why the server denied the request. Check the IIS Log
file to determine whether a substatus code is associated with this
failure. View more information ยป
Microsoft Knowledge Base Articles:
Another observed behavior: usually when new users are logging in the web app asks for permissions for the AD to access their account information. Ever since this problem came up this is not the case any more.
Other users do not have any problems logging in. This problem only happens with new users who never logged in before.
EDIT: When I go to Active Directory and look at sign ins, I see failures to log into the web app with sign-in error code 90092. Failure Reason: Other.
Microsoft help desk could not give me details on that error code.
Checkout the related question and answer here. All new users have to first consent the application (agree and give your application permissions to access their profile / or you indicated as required permissions).
In short, you have to design "sign-up" button for your application, which uses the "login_url" and appends "&prompt=consent" to the query string.
Read all related resources here to better understand the consent framework.
And please read the documentation about Azure App Service Authentication/Authorization here, as well as the Azure AD specific documentation here.
OMG, I just found an answer. I created a test app and set it up to mirror the settings of my live app.
In Required Permissions the new app had nothing for Microsoft Graph, the live app had 5 permissions. I deleted Microsoft Graph and it works now!
I wish Microsoft communicated better about discontinued API's. I did get an alert, but it was mostly talking about MS Office 365.
We customised our Azure AD B2C tenant's Combined Sign-Up/Sign-In Policy to serve up our own login page. This worked across all the major browsers when we tested last week, but it stopped working today for some of our users on Chrome and Firefox.
We are getting this 404 error when some of our users browse to our home page and they get redirected to the login page (our B2C tenant and custom login URL is redacted but all other query parameters are unchanged):
https://login.microsoftonline.com/redacted.onmicrosoft.com/B2C_1_sign_up_in/api/CombinedSigninAndSignup/error?code=UX004&diags=%7B%22version%22%3A%222.0.0%22%2C%22user-agent%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A54.0)%20Gecko%2F20100101%20Firefox%2F54.0%22%2C%22online%22%3Atrue%2C%22trace%22%3A%5B%22%231%20T005%20(3ms)%22%2C%22%232%20T027%22%2C%22%233%20T021%20(37ms)%22%5D%2C%22code%22%3A%22UX004%22%7D&csrf_token=YzQ0N3F3NXlTVzBVWTFraG96cmlVU3FVbjVNRmZRbHZ6RURIaHdPRExNRTlDRVRNL3hPN00xRXhoOUV0bnE0V3pYc3ZYcEg0YzRhVnp5WE5QYTJZN0E9PTsyMDE3LTA4LTA4VDAwOjU3OjM2Ljc3MjM1MDlaO283Mm9nSFVXb3lIbWtVZy9CeHZVbFE9PTt7Ik9yY2hlc3RyYXRpb25TdGVwIjoxfQ==&tx=eyJUSUQiOiI4MDgwNWE3Ny02OTU2LTRiNGMtYmUyYi05OGZkZGEwYzM4MDkifQ&desc=https%3A%2F%2Fourdomain.redacted.html
We have tested the following with no success:
Clearing all our cache and cooking
Disabled all extensions
Private browsing/Incognito mode
Chrome on Android
But Internet Explorer loads the custom sign-in page just fine on their computer!
I have tried searching online for error code UX004 but didn't find anything. Can someone from Microsoft advise what this error code means? Thank you.
I didn't get any response from Microsoft, but we tried various fixes. The one that worked for us is to apply a SSL certificate issued by a commonly-trusted issuer on our test domain. I can't confirm that this error message means AAD B2C is complaining of an insecure connection, but it's worth exploring in case it works for anyone else too.
It appears as though this may be a CORS issue on your hosted login page. Use (F12) to open up your developer tools, look into the Console tab and ensure you have Preserve log switched on. Navigate to the website and hopefully the error should be visible.
For me it was a CORS issue with the storage account. Adding a CORS rule that allowed everything solved the problem.
Go to azure portal (https://portal.azure.com) and open the storage account that contains your custom login page templates. In the right hand navigation find Settings > Resource sharing (CORS)
Add a new rule with the following values
Allowed origins = *
Allowed methods = Select all items
Allowed headers = *
Exposed headers = *
Max age = 200
Hopefully that helps!
I am trying out the Azure AD-B2C. The user signup/sign in is fine when the MFA is turned off. But when I turn it on, and the user tries to sign in and provides the phone number, and requests a text message by clicking "send code", I get the Http 400 error: size of request headers is too long. Anybody else have this issue?
The error HTTP 400: Size of header request is too long generally happens because there's too many cookies.
Azure AD B2C's login goes through login.microsoftonline.com, as does almost every Microsoft service (O365, Azure, etc). So if you've got several accounts that you've signed in to across these services, you're accumulating cookies that will cause this problem.
Clearing the cookies should resolve this problem. If this is happening on a recurring basis, you should edit your question to include details about the request and cookies in order to best figure out what's bloating the request and how to reduce it.
Short answer: The file with the custom UI was not found by Microsoft login service. After getting shipped around it resulted in the error.
I had the same error with AAD B2C but "cookies" was not the problem. In my case I got the error while testing in the Azure B2C portal checking the policies and the custom UI pages. We use Azure Blob storage to hold custom login setup, its fast and it scales without our attention. The problem was found by using my test website using the B2C service. I put a stop/break on the Account controller's "public Task OnRemoteFailure(RemoteFailureContext context)" method. The debugger message gave me the full context of the error, an http 404 error and it gave the file name it was trying to find. Blob storage is case sensitive. The setup configuration used to configure B2C has camelCase names. The group who created the actual UI customization uses all lower case names. It took someone with access to all the assets to find the simple case name issue. Errors in distributed systems can be difficult.