How to make WCF service backed by ACS to work through WATM endpoint

Question

I have two deployments (webroles) of the same WCF service hosted as Azure Cloud services: http://myservice1.cloudapp.net, http://myservice2.cloudapp.net. Each of those is configured to use ACS authentication. I've configured WATM (Traffic Manager) to load-balance between those two webroles. When calling each of those services directly, everything works just fine. However, when the client calls through the WATM endpoint, it gets the following error message:

ID3242: The security token could not be authenticated or authorized.

The ACS namespace has all three URLs configured as realms.

Thanks in advance.

Answer 1

It turned out that the only bit missing was to add the WATM URL in the Allowed AudienceUris list. Note, the list should actually contain all the endpoints the service will be accessible through, including the one it's exposed under. Details on how to add AudienceUris can be found here: https://msdn.microsoft.com/en-us/magazine/ee335707.aspx