3

After setting up a Azure Web App with Azure AD Authentication, the site is returning a 401 after authenticating.

This is the auth flow as I see it.

  1. Go to https://mysite-$environment.azurewebsites.net/
  2. Redirects to https://login.microsoftonline.com/
  3. Authenticate using my credentials
  4. Redirects to https://mysite-$environment.azurewebsites.net/.auth/login/aad/callback
  5. Error You do not have permission to view this directory or page. HttpStatus 401.

Long version

I have 3 x Web Apps in Azure under the same Service Plan - 1 x website and 2 x APIs.

I would like these to use Azure AD for authentication.

So, I created an Azure AD App using Powershell.

$app = @{
    DisplayName = "azad-$environment-mysite"
    IdentifierUris = @(
        "https://mysite-$environment.azurewebsites.net",
        "https://mysite-api-$environment.azurewebsites.net",
        "https://mysite-api-2-$environment.azurewebsites.net"
    )
    HomePage = "https://mysite-$environment.azurewebsites.net"
    ReplyUrls = @(
        "https://mysite-$environment.azurewebsites.net",
        "https://mysite-api-$environment.azurewebsites.net",
        "https://mysite-api-2-$environment.azurewebsites.net"
    )
    AvailableToOtherTenants = $false
}

New-AzureRmADApplication @app

Then using the ApplicationId returned, I have setup the Azure AD through the portal Web App > Authentication / Authorization blade.

This is similar scenario to question asked over at Azure AD server authentication, No permission to view directory question.

Community
  • 1
  • 1
Dennis
  • 20,275
  • 4
  • 64
  • 80

1 Answers1

1

You have to register each app in the AAD and you can do it, more easily, via azure-portal.

When you have the web-app registered through the "Express" process everything should work as expected (OAuth2 flow). The problem may come with your API-app especially if you need to access with server-to-server.

Because the process is a little bit long to write here I wrote two posts:

Web API access through Azure Active Directory

API-APP server-to-server through Azure Active Directory

In the first post you can see the REST flow using POSTMAN.

Fabio Maulo
  • 427
  • 4
  • 3