Handle AAD login with site forwarded from Azure API Management - azure-active-directory

Question

I have a Service Fabric cluster that is running a service (Stateless ASP.Net Core) that can't be exposed to the Internet. Requests to the service are routed through API Management.
Incoming request ==> https://blah.trafficmanager.net/routeName
forwarded ==> https://10.0.4.6:[port]/routeName
This works fine with no authentication. I am hooking up AAD auth as we need to lock this down to a client registration (due to timeboxed elevation request requirements). I have set up the service to use AAD auth, and when running in my local development Service Fabric cluster, this works fine (i.e. prompted to log in, routes are gated based on roles) using these parameters:
"AzureAd:ClientId": "[client id]",
"AzureAd:Domain": "[tenant].onmicrosoft.com",
"AzureAd:Instance": "https://login.microsoftonline.com/",
"AzureAd:SignedOutCallbackPath": "/signout-callback-oidc",
"AzureAd:CallbackPath": "/signin-oidc",
"AzureAd:TenantId": "[tenant id]",
When I deploy this and try to hit it via https://blah.trafficmanager.net/routeName, the redirect https://10.0.4.6:44321/signin-oidc, and I end up with:
Here is my startup.cs code:
/// <summary>
/// Configure services
/// </summary>
/// <param name="services">Service collection</param>
public void ConfigureServices(IServiceCollection services)
{
services.AddHttpContextAccessor();
services.Configure<CookiePolicyOptions>(options =>
{
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
// Handling SameSite cookie according to https://learn.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1
options.HandleSameSiteCookieCompatibility();
});
// Sign-in users with the Microsoft identity platform
services.AddMicrosoftWebAppAuthentication(this.Configuration);
services.Configure<ForwardedHeadersOptions>(options =>
{
options.ForwardedHeaders = ForwardedHeaders.All;
options.KnownProxies.Add(IPAddress.Parse("10.0.4.6"));
});
// services.AddControllers();
services.AddControllers(options =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
options.Filters.Add(new AuthorizeFilter(policy));
});
}
/// <summary>
/// Configure app
/// </summary>
/// <param name="app">App builder</param>
/// <param name="env">Environment</param>
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.UseDeveloperExceptionPage();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseCookiePolicy();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseForwardedHeaders();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
}
I am wondering if there is something I can do in order to be able to have this service on the cluster node be able to authenticate requests that are coming in through APIM.
Thanks!

Answer 1

I was able to override the reply url with this:
services.Configure<OpenIdConnectOptions>(
OpenIdConnectDefaults.AuthenticationScheme,
options =>
{
var redirectToIdpHandler = options.Events.OnRedirectToIdentityProvider;
options.Events.OnRedirectToIdentityProvider = async context =>
{
// Call what Microsoft.Identity.Web is doing
await redirectToIdpHandler(context);
// Override the redirect URI so that auth works behind APIM
context.ProtocolMessage.RedirectUri = this.Configuration["AzureAd:RedirectUri"];
};
});
I then had auth problems as it would loop back many times and finally give a sign in error. I found this was because my reply url was to the main site instead of signin-oidc. When I added signin-oidc with the APIM as reply url, APIM failed as there was no route with this name. I created a new API that forwarded signin-oidc to the same route on the back end.
Now the reply back from AAD hits my APIM at signin-oidc and is forwarded to the same on the back. This allows auth to complete.