Azure AD Redirect URL Using Application Gateway

Question

We have an ASP Core 2.0 App working nicely with Azure AD on the private network. However, we've been playing around with the Azure Application Gateway, investigating the possibility of allowing access to the app from outside for remote workers etc.

We have registered the app on the Gateway, and, once logged in with Azure AD, the anonymous front page is accessible via ourapp.msappproxy.net. However, when signing in (again?) in the app, the client is redirected back to intervalServer/signin-oidc which fails as it is not accessible externally.

While I doubt this is any part of the solution, I have tried overriding the redirect "CallbackPath": "/signin-oidc", to absolute path ourapp.msappproxy.net/signin-oidc but I can't seem to work out how. Changing the reply URL in Azure Portal doesn't help either (although I doubted it would, this is just for verification right?).

I can't seem to find any guidance on this on this particular scenario, so that would be welcome. Otherwise, I'm left pondering the following:

1, If I could change the redirect to ourapp.msappproxy.net/signin-oidc, would that solve the sign in issue?

2, Do I even need an additional sign in step, or should I be changing the app to accept AzureAppProxyUserSessionCookie or AzureAppProxyAccessCookie? (If that's even an option?)

Answer 1

Thanks to rfcdejong in the comments for putting me on track. In our case I was able use Azure AD with the Azure Application Gateway by overriding OnRedirectToIdentityProvider event and supplying the proxy url in ConfigureServices

services.AddAuthentication(...)
          .AddOpenIdConnect(options =>
         {
           options.ClientId = Configuration["Authentication:AzureAD:ClientId"];
           options.Authority = Configuration["Authentication:AzureAd:Authority"];
           options.CallbackPath = Configuration["Authentication:AzureAd:CallbackPath"];

           if (IsProduction) // So that I can use the original redirect to localhost in development
           {
             Task RedirectToIdentityProvider(RedirectContext ctx)
             {
               ctx.ProtocolMessage.RedirectUri = "https://ourapp.msappproxy.net/signin-oidc";
               return Task.FromResult(0);
             }

             options.Events = new OpenIdConnectEvents
             {
               OnRedirectToIdentityProvider = RedirectToIdentityProvider
             };
           }
          })

The return URI needs to be configured to match for the app in Azure Portal. Users also need to be assigned, but the internal app is now available anywhere without requiring direct access to the server.