Exception: Correlation failed. AAD + Azure Front Door

Question

I have a web application(ASP.NET Core MVC) which communicates with my REST API. Both of them are configured to use Azure Active Directory. Now I'm trying to configure Azure Front Door for the app, but I get the following error:

or this one:

I designed the front door for http-s redirection, configured the backend pool for website to use its own host name.

I've also configured the forwarded headers:

services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders =
                ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;

            options.KnownNetworks.Clear();
            options.KnownProxies.Clear();

            // Put your front door FQDN here and any other hosts that will send headers you want respected
            options.AllowedHosts = new List<string>() { "<my front door here>" };
        });

...

        app.UseForwardedHeaders();

However still getting the error. Any ideas?

Thanks.

kavyasaraboju-MT kavyasaraboju-MT · Accepted Answer · 2021-11-22T14:37:11

Please check the possible workarounds for few causes:

Firstly please check the reply urls are configured correctly which must be same in azure portal and code (with https protocol )
Check if the callback path is set to identity provider something like /signin-oidc for redirect url .(And make sure you have unique callback if multiple urls are used as in second reference)
use Microsoft.AspNetCore.HttpOverrides; reference in startup.cs class.

Also check and Add > app.UseHttpsRedirection(); above app.authentication(); in startup configure method.

If ConfigureServices method, from Startup.cs has

.services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));

The cause maybe cookies not being set as secure. Try to store cookies as secure before the services.AddAuthentication .

services.Configure<CookiePolicyOptions>(options =>
    {
        options.CheckConsentNeeded = context => true;//add if consent needed
        options.MinimumSameSitePolicy = SameSiteMode.None; // else try  SameSiteMode.Lax;

         options.Secure = CookieSecurePolicy.Always;

    });

And call cookie policy from app.UseCookiePolicy() right before the call to app.UseRouting() in the Configure() method in Startup.cs.

Also try to set the enable cookie settings in browser.

Also see if you can use XForward.Host when Using Azure Front Door with .NET Core | phillipsj.net.
While adding backend config in azure front door set up try to leave Backend host header field blank as it is automatically generated same as the host name and may cause issue for multiple domains.

References:

Exception: Correlation failed. AAD + Azure Front Door

1 Answers