Use Azure Application Proxy with an App Service

1
votes

We want to use the AAP to communicate from an Azure App to an on premise application. We want to the App to authenticate and call the Proxy Api and not delegate the user. Right now, we are able to get an token for the Resource of the Proxy Api and call the api from the application, but we get an error page (imho from the proxy api) saying "This corporate app can't be accessed right now.", with StatusCode: InternalServerError.

Calling the proxy url from an browser and Azure Authentication enabled on the proxy, and with an Azure Account logged in that browser, it works.

Calling the proxy url from an browser with Passthrough on the proxy, anonymously, it works.

Calling the proxy url from an browser with Azure Authentication on the proxy, anonymously, it return access denied.

Calling the proxy url from an Web Api hosted on Azure with a token requested on the Proxy resources and with Azure Authentication on the proxy, it fails with InternalServerError.

Is the AAP only working for use with Users and not Applications? I suspect this because in the documentation has this quote:

The client sends the token to the Application Proxy service, which retrieves the user principal name (UPN) and security principal name (SPN) from the token, then directs the request to the Application Proxy connector.

1
azureoauth-2.0azure-active-directory
Not sure if you'd be able to help me here. I am trying to access an application service ( a web service) behind the AAP. My requirement is to authenticate as a user. You have mentioned we are able to get an token for the Resource of the Proxy Api and call the api from the application which proxy Api do you mean ? do you mean an API behind the AAP ? If that is the case can you point me in the right direction here ? – Chathum
Not sure what your question is and we ended up not using this because of reasons, so not much help from here I think. But the scenario you describe seems to be what AAP is meant for. The documentation is pretty straight forward here. 2 modes I believe, mode 1 the Azure Part authenticates, mode 2 the on premise part authenticates. – Mulder

1 Answers

0
votes

It is intended to give users access to your on-premises applications, not applications. enter image description here

The user is authenticated through Azure AD and given access to the on-premises application. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy