we have configured azure active directory pass-through authentication . Need to access on premise resources from the azure deployed application. can we do this by configuring application proxy?. so that on premise application authenticated with azure AD. so the communication between azure application and on premise application be seamless. Is it possible?
I'm not entirely sure if I understand you correctly but what you want is probably possible by using Azure Hybrid Connections: https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections
You install the Hybrid Connector on-prem, e.g. on a VM, and then for instance an Azure App Service can access certain resources on-prem.
Or for anything more advanced you might want to look at Azure VPN (or ExpressRoute in the long run).
Related
We have some dedicated LOB application on-premise applications. Access to these apps is through the public Internet. Active Directory Domain Services is used to authenticate users.
In Azure, there are multiple ways to create high-availability; is there something similar for on-premise apps using Azure? By this I mean if one on-premise system is down, traffic is routed to another app.
I know there are some options such as Application Gateway, Traffic manager and Front-door including Azure LB, my question is - are these the right services we should use in an on-premise setting?
For your on premise environment, you can use Network Load balancing(NLB) feature of Windows Server. See details here, it has an Azure inspired feature too.
What is Azure AD connect and Azure ADFS? This is what I have understood: Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that. Am I right?
We need to build an application which needs to authenticate users from different clients' AD. They may or may not have exposed their AD to Azure. Can someone please guide how can this problem be solved?
Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that.
AS of now, the way Azure ADFS works, it essentially provides a way for a company to use AD and ADFS services, without having to deploy themselves. Just like how a Azure has Azure Web App will allow you to have a web server without having your own.
Unfortunately, It does not actually connect or integrate or expose your on premise AD. If you want your clients authenticate against multiple IDs, you do it the old fashioned way, by connecting to the on-premises AD directly. You cannot actually route it through Azure.
One thing which you can do (this will be a huge endeavour) is to move the on premises AD to Azure cloud, which can be done using Azure VMs. Now, that would allow your client to get rid of their on premises AD and use the Azure cloud for everything.
We are using on-prem and Azure cloud separately and planning to make connection between on-prem AD and Azure AD by using Azure AD connect or Pass-though authentication (preview).
My question is, If we use Azure AD connect or pass-though ,will there be any need to use Azure application proxy in any case?
Under what scenario/application integration, both application proxy and Azure AD connect/pass-through will be required?
If we use Azure AD connect or pass-though ,will there be any need to
use Azure application proxy in any case?
By default, there is no need to deploy a proxy for Azure AD connect. It depends on your local network, if your On-prem server(AAD connect installed) can connect to the internet direct, we should not deploy the proxy.
Under what scenario/application integration, both application proxy
and Azure AD connect/pass-through will be required?
This table describes the ports and protocols that are required for communication between the Azure AD Connect server and on-premises AD:
More information about hybrid identity required ports and protocols, please refer to this official article.
If your on-prem network can't open those ports, we need to deploy a proxy for it.
I'm looking at ways to host our web site in Azure. The Web application consumes on-premise web services and send/receive messages from ActiveMQ hosted on-premise. Is this possible? Any pointers will be helpful.
Short Answer: Yes, it's possible. Mixing Azure and On-Prem resources is what's called the Hybrid Cloud.
Long Answer:
You can use Azure App Service Environment to setup a Virtual Network with an Azure Web App that will allow for a VPN connection to be setup between your on-premises network and the Azure VNet. If VPN setup isn't an option of you, then you could use the Azure Service Bus Relay service to connect an on-premises WCF Web Service to the Azure Web App. Additionally, a Biztalk Hybrid Connection could be used to tunnel through the firewall between your on-premises resources and the Azure Web App. Hybrid Cloud is fully supported in Microsoft Azure and there are a few options to choose depending on which fits your needs / scenario best.
You can create a VPN on Azure, add the web site to it and then create a site to point VPN connection to add the VM that has the on-premise web service to it.
Another solution, if your web service is developed in WCF, you can use Service Bus Relay with your web service, this will make it accessible from your Azure web site.
Can anybody tell me how to connect a web app running on azure to existing web services (.ASMX) on premises?
We do not have the source for the services they are exposed by third party applications and we do not want to open them up to public access.
Sounds like Azure's Service Bus Relay Service might be what you're looking for...
There might be three options based on your scenario. But I personally prefer the third one.
If you used azure cloud service (web role, worker role), you can use Windows Azure Connect. It builds an IP-sec communication between the azure machine and your local machine. Then you can connect to your local service through the its IPv6 address.
If you used azure virtual machine to host your azure project you can use Virtual Network. It's more powerful than the Windows Azure Connect.
You can use Windows Azure Service Bus Relay. It can open your local service to the cloud regardless how your azure project is hosted. But since it's only support WCF of Service Relay, and since you cannot change codes and config of your service, you might need some more works. Maybe you can create a small WCF on your local machine as a proxy, register it to Service Bus Relay, and pass all request/response to your local service.