HAP+ Azure Application Proxy and Security Issue

[Ben_Stanton]

Hi all,

 

I have been trying to get Azure App Proxy working with v10.6. I'm banging my head against the wall to be honest, I can land on the HAP login page but it will not SSO - even though i'm sure everything is set correctly. I just get the standard HAP username/password page. I can log in from there - just not automatically.

 

Also, something else (slightly more alarming) I noticed is that after editing the HAP config to replace Forms with Windows (AuthMode="Windows") - I can log in with any password as along as the username is correct. This is via AAP and internally browsing direct to HAP server. A small point i'm sure isn't relevant, but we actually only use the booking system so everything points to that directly https://server.ourdomain.abc/booking (it was in the hapconfig of the booking folder I made the authmode change).

 

Any ideas? No doubt it's a config error our end… but like I say, going round in circles and now found this odd behaviour that anybody can log in regardless of password - which is a tad worrying. We can even replicate the login with random password on a fresh, clean install on a local machine!

 

Any thoughts on either problem?

 

Cheers in advance…

 

Ben

Edited March 9, 2018 by Ben_Stanton

[nickbro]

Set iis into Windows authentication mode. Disable forms and anonymous authentication.

 

In the hapconfig.xml set the authmode to Windows. There's a YouTube video explaining iy

[Ben_Stanton]

Hi Nik,

 

Thank you for that. Editing the I misunderstood what you were saying in the video. Switching 'Extended Protection' off in 'Advanced Settings' of the windows Authentication now gets it logged in automatically. From the video, it sounds as though that change is only necessary if using cards and/or tracker. Apologies.

 

However, I now get an internal server error. This happens whether I log in via AAP or internally. Error 401 (IIS log) when first hitting the page

 

2018-03-09 15:05:32 fe80::d178:aa68:16db:b35e%12 GET /booking/bookingsystem/ - 443 - fe80::d178:aa68:16db:b35e%12 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+rv:31.0)+Gecko/20100101+Firefox/31.0 - 401 2 5 1725

 

 

Any quick ideas? Appreciate your busy so thanks for getting back to me.

 

Edited March 9, 2018 by Ben_Stanton

[nickbro]

For the tracker you will need another install which is in forms mode and using a sql database. Or some folder magic.

 

Can you do some Json debugging to get the raw error on that api call

[Ben_Stanton]

Does this help?

 

Server Error in '/booking' Application.

The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'WebHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

 

Exception Details: System.NotSupportedException: The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'WebHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.

 

Source Error:

 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

 

Stack Trace:

 

 

[NotSupportedException: The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'WebHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.]

System.ServiceModel.Channels.HttpTransportBindingElement.UpdateAuthenticationSchemes(BindingContext context) +7770229

System.ServiceModel.Channels.HttpsTransportBindingElement.BuildChannelListener(BindingContext context) +106

System.ServiceModel.Channels.Binding.BuildChannelListener(Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, BindingParameterCollection parameters) +173

System.ServiceModel.Description.DispatcherBuilder.MaybeCreateListener(Boolean actuallyCreate, Type[] supportedChannels, Binding binding, BindingParameterCollection parameters, Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, ServiceThrottle throttle, IChannelListener& result, Boolean supportContextSession) +16380721

System.ServiceModel.Description.DispatcherBuilder.BuildChannelListener(StuffPerListenUriInfo stuff, ServiceHostBase serviceHost, Uri listenUri, ListenUriMode listenUriMode, Boolean supportContextSession, IChannelListener& result) +946

System.ServiceModel.Description.DispatcherBuilder.InitializeServiceHost(ServiceDescription description, ServiceHostBase serviceHost) +1406

System.ServiceModel.ServiceHostBase.InitializeRuntime() +85

System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) +48

System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +301

System.ServiceModel.HostingManager.ActivateService(ServiceActivationInfo serviceActivationInfo, EventTraceActivity eventTraceActivity) +129

System.ServiceModel.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath, EventTraceActivity eventTraceActivity) +741

 

[serviceActivationException: The service '/booking/api/livetiles' cannot be activated due to an exception during compilation. The exception message is: The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'WebHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement..]

System.Runtime.AsyncResult.End(IAsyncResult result) +610714

System.ServiceModel.Activation.HostedHttpRequestAsyncResult.End(IAsyncResult result) +231

System.Web.CallHandlerExecutionStep.OnAsyncHandlerCompletion(IAsyncResult ar) +177

 

 

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.7.2106.0

[nickbro]

Replace the service model section of the web.config file with this:

 

[Ben_Stanton]

Thanks, replaced but no change.

 

Will keep digging.

[Ben_Stanton]

In fact, only just realised that using the code above actually breaks the booking system even with Forms and anonymous switched back on.

 

Grrrr.

[nickbro]

The code will break forms authentication as its only for Windows authentication. It should work as its the code I use on my site which uses azure application proxy

[Ben_Stanton]

Hi Nik,

 

Thanks for the reply. Sorry, probably me not making myself clear.

 

If I replace the existing code in the web.config file with the above and usable anonymous and forms, enable windows authentication (advanced settings, extended protection is off and enable kernel is ticked) then it still comes up with an Internal Server Error

 

 

As this breaks the system for staff, I have been re-enabling anonymous and forms and disabling windows. But like you say, that then breaks it further with the replaced code. SO i'm having to revert the code back and do it that way so the system can be used.

 

Any further pointers?

 

Cheers and sorry for the hassle

Edited March 12, 2018 by Ben_Stanton

[nickbro]

Make sure only windows is on. It will play up otherwise. Then go to /api/bookingsystem/

[Ben_Stanton]

Yes, only Windows Auth is on.

 

I get a login box, I have tried a test account and mine (which usually works) and get taken to an unauthorised.aspx page

 

[Ben_Stanton]

UPDATE: Just digging around and noticed that HTTP was taken out of the default website bindings, added that back and it seems to be ok… will keep testing.

 

I'm blaming my techie

 

Thank you for your time so far Nik

[nickbro]

No problem, that would explain things.

 

It seems to work quite well. DirectEdit and the Word/Excel/Powerpoint addins won't work with Azure. But you can do 2FA