I'm looking at ways to modernise some of our existing web apps without a total rewrite. One idea that's being bandied around is having pluggable modules that can be written in more up to date languages that can be bolted onto the existing webapps.
I tried this out with both an iFrame approach and also using Azure Front Door routing, so that even though I had separate Azure App Services, I managed to get everything to appear as though it was part of the same web app/domain with routing rules.
Unfortunately both these methods failed once I secured the websites using Azure b2c. As an example, I tried to create two bog standard asp.net core mvc apps (deployed in Azure as AppService1 and AppService2). I secured them both using b2c with separate b2c apps. I checked I could log into both apps successfully. Also once I logged into one app, I could go to the other via a different browser tab and didn't need to log in so I knew that SSO was working.
I then tried to embed one app service in the other via an iFrame and got the following error
Refused to display 'https://xxx.b2clogin.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
Didn't pursue this so my next step was to try and use Azure Front Door routing to help me out. I managed to get this working for the top level app service (AppService1) by following this post
Exception: Correlation failed. AAD + Azure Front Door
However, I haven't managed to get the routing to AppService2 working. Here's what I tried
Attempt 1
Added a routing path in front door that used /service2 as 'patterns to match'. AppService2 had the following CallBackPath
"CallbackPath": "/signin-demo"
Used a b2c app which a redirect URL of
https://<frontdoor url>/signin-demo
When I try to go to https://[frontdoor url]/service2 I just get taken to the following URL
https://<frontdoor url>/signin-demo
which doesn't display anything.
Attempt 2
Changed the b2c app to one that used a redirect URL of
https://<frontdoor url>/signin-oidc
which is the callback path of AppService1. Doing so gives the error when going to https://[frontdoor url]/service2
Unable to unprotect the message.State.
So, I'm not sure what to try next. What I'm doing feels like it should be possible but I wonder if anyone could help or work out what I'm doing wrong.
Many thanks
Related
I am trying to add the google one tap login to our internal website but I am getting the following warning. Although I have already added the main domain and sub domain(just to test) in Authorized redirect URIs and Authorized JavaScript origins but still getting this error.
I read in the document where it says no verification is required when the app is used internally.
Thanks in advance for any guidance
In order to add the new "Sign in with Google" option on the websites which are hosted on the dynamically created subdomains, one can use the solution provided by google is its integration via iframe.
The annoying part is that the documentation didn't mentioned this solution as another possible solution in its subdomain section.
I've put together this sample to integrate a bot in Microsoft Teams:
https://github.com/microsoft/BotBuilder-Samples/tree/main/samples/csharp_dotnetcore/46.teams-auth
Good news is, it works just fine out of the box with an Azure AD Connection as OAuth2 sign-in.
We use Amazon Cognito User Pools, and in order to call queries and other things, I need to be signed in, for obvious reasons. Therefore, I've tried configuring another connection, this time with a Generic OAuth2 Provider since Cognito is not in the list.
These are my connection settings for the Generic Provider
I've hidden the actual IDs for obvious reasons, but the core URLs are present, as stated in the Cognito docs.
I've also added "token.botframework.com" and "*.amazoncognito.com" in the validDomains list of the manifest.
Now, when I click on the sign in card button, the popup opens, but I'm getting a redirect_mismatch error in the URL, like so
I have looked up the reason for this error and it is stated that the redirection URL must match the atleast one of the callback URLs in the Cognito App Client corresponding to the provided ID.
However, in the sample's code for the bot, I can't seem to see where you specify such callback URL when dealing when the OAuth Prompt directly.
Any wizards in here have ideas about this? I would greatly appreciate any and all help.
Thanks!
EDIT
As requested, here's the settings page for the app client
Given that it's a MS Teams app, I have ngrok tunnels setup for traffic, so I put both URLs in there just to be sure... localhost:3000 is actually where the ngrok.io tunnel points to.
And here is proof that our Hosted UI, when opened from the User Pool, actually shows up, and at a redirect_uri of localhost:3000/
(Posting my comment above as an answer, since it seems to have solved the issue.)
When using the built-in auth support in Azure Bot Service, it fully handles the auth redirects. So your registered redirect URL ("callback URL" in Amazon Cognito?) should be https://token.botframework.com/.auth/web/redirect. This should have been your redirect URL when you tried it with AAD too, as indicated in the Bot Framework documentation for adding authentication to a bot.
I have a Google Cloud App Engine app that functions correctly when either I allow unauthenticated AllUsers access or turn on IAM for controlling access in Identity Aware Proxy. However when I follow the instructions on this page https://cloud.google.com/iap/docs/cloud-run-sign-in to enable Cloud Run Hosted sign-in with external identities and attempt to access either the login page or the Google Cloud Run hosted sign-in page, I receive the following error in the browser.
"Could not fetch URI /computeMetadata/v1/instance/service-accounts/default/token?scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/identitytoolkit"
For context, the Google Cloud Run service hosting the user sign-in is set to allow all Unauthenticated. It should re-direct to the Google App Engine web app. I think this is related to permissions or redirects, but I am at a loss as to how to fix. Any thoughts? Thanks!
I attempted to fix by re-deploying the Cloud Run Service, switching IAP on and off, switching between IAM and external identities, but to no success.
Thanks #John Hanley, I discovered that one my compute engine service account was disabled for some reason within the project. Re-enabling solved the problem partially. I'll spend more time matrix out the permissions and re-directs to make sure they are aligned.
I originally thought I completely answered my own question and solved my problem. Unfortunately, I only solved one of the problems with my implementation of the external identities authentication method.
Description of the other problem:
I enabled email/password and Google as providers, but when I click on the the option to authenticate with Google, I receive the following text in the browser: "The requested action is invalid."
At the Console in Dev Tools I get the following error:
GET https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=*mykey*&cb=1599165379363 403
The following url is displayed in the URL bar:
https://.firebaseapp.com/__/auth/handler?apiKey=mykey&appName=%5BDEFAULT%5D-firebaseui-temp&authType=signInViaRedirect&providerId=google.com&customParameters=%7B%22hl%22%3A%22en%22%7D&scopes=profile&redirectUrl=https%3A%2F%2Fiap-gcip-hosted-ui-app-engine-app-myserver-uc.a.run.app%2F%3FapiKey%3Dmykey**&v=7.16.0&fw=FirebaseUI-web
mykey and myserver were removed for this post and is not the actual values.
Email/password sign-in works, but not the Google sign-in. What am I missing here?
I was trying to setup OAuth workflow using the sample application as given here
However for some reason, after I enter my okta user Id and password, I never gets the control back on my call-back URL and application just hangs indefinitely.
However the normal Javascript Singn-in widget (check this link) with the minimal authentication does work and I get the control back to the redirect URL. But this is not for an OAuth2 workflow... which is completely useless for me. Because all it does is provide authentication service using Okta tenant app and it will redirect you to your App URL. This does not provide any authorization grant workflow or other OAuth2 complex workflow. May be useful for some application but not for enterprise app where you want to retrieve user profiles, and create a login session based on user profile data retrieved from OKTA.
So my question is why is the OAuth workflow not working using the PHP application that uses JS sign-in-widget? And why there are no instructions or warning on this page for this costly service (this is not free and many org is probably paying for this)?
I spent almost a day trying to setup my Authorization server as per the instruction given on this link, but nothing works. Any idea what must be going wrong ?
Does this entire example works only after contacting OKTA support to enable the Authorization server feature? Because, I also saw a documentation here that says that this is Early Access (EA) feature (and it is probably recently added in OKTA? Extremely frustrating experience).
BTW I sent email to their customer support to enable this Authorization server feature just in case if I am missing something. If this does not work then I will have to create my own OAuth2 server using Laravel 5.4 PHP framework, which is probably the quickest solution and 100% free.
I also tried to test the Authorization server setup as per the instructions provided here.
I was successful in getting the following end point working:
/oauth2/:authorizationServerId/.well-known/openid-configuration
But I am unable to get any scope and claims using api end-point:
/api/v1/authorizationServers/:authorizationServerId/scopes
So in short, I am so far unable to test my Authorization server to get my authorization grant workflow working.
Where can I look for some troubleshooting advice?
Is there another way to check whether I have configured my OKTA Authorization server properly?
I found out that the JS script provided for the PHP sample is not right for the workflow I am working on. So after changing that JS Script, things started to work.
Edit: Also please note that Setting up Authorization server is a new feature (It is Early Access feature) in OKTA. It is not enabled by default. So you need to contact OKTA support team to enable the Authorization service endpoint and functionality provided by it.
I am developing a SharePoint app that communicates with social feeds such as Twitter, Facebook (the user has to sign in ofcourse through the App using OAUTH). My problem is that everytime I deploy the app (using VS) it generates a new url and I need to keep registering this url with the community sites (Twitter, Facebook). Is there another way to overcome this problem.
I guess you are talking about the App Web wich is created every time the application is deployed (url has a form like that https://prefix-id.tenantdomain.tld/pathOfWebItHasBeenDeployedTo)
This is by design and here is some documentation about it
Then I guess the problem is because you're using OAuth implicit flow which requires url not to change over time. Unfortunately this is a by design limitation, to work around that you'd have to transtion to a provider hosted application. (therefore hosting it on your own server with a fixed url)