Forum Discussion
AAD Application Proxy and B2B Users
Hi, I assume you are looking to use the app proxy for organizations with on-premises apps which are using Windows authentication. We are currently working on the documentation for this scenario which should be posted to docs.microsoft.com shortly. In principle, creating an account in a AD domain corresponding to a user in Azure AD, including a guest user, would enable the app proxy to match the user coming in from Azure AD and use KCD for impersonation and permit that user to then access Windows integrated authentication, however there are a number of account lifecycle subtleties here. So even if you see the app proxy is able to permit the communication flow, I'd suggest waiting for the documentation as there are a number of deloyment considerations and best practices to look at (e.g., what container to put the users in, when to deprovision the user from AD, how to avoid RID exhaustion and end user confusion about "All authenticated users" etc) Feel free to reach out to us if you have additional questions. Thanks, Mark
MicrosoftHi, I assume you are looking to use the app proxy for organizations with on-premises apps which are using Windows authentication. We are currently working on the documentation for this scenario which should be posted to docs.microsoft.com shortly. In principle, creating an account in a AD domain corresponding to a user in Azure AD, including a guest user, would enable the app proxy to match the user coming in from Azure AD and use KCD for impersonation and permit that user to then access Windows integrated authentication, however there are a number of account lifecycle subtleties here. So even if you see the app proxy is able to permit the communication flow, I'd suggest waiting for the documentation as there are a number of deloyment considerations and best practices to look at (e.g., what container to put the users in, when to deprovision the user from AD, how to avoid RID exhaustion and end user confusion about "All authenticated users" etc) Feel free to reach out to us if you have additional questions. Thanks, Mark
Mark_Wahl I started configuring the new B2B shadow accounts, but it seams that the Application Proxy ignores the "Delegated Login Identity" configuration.
This results in the fact that my on-prem application server receives the cloud UPN (the one with #EXT#) instead of the configured sAMAccountName in the on-prem AD and respondes with a 401 since the user is not found/matched.
I assumed that the on-prem connector fetched the sAMAccountName form the on-prem AD, but it looks like it's using the onPremisesSamAccountName in Azure AD for this assignment (which is not available for B2B users and read-only via the Graph API).
Any suggestion for the issue I'm facing?
Regards,
Nick
Hi Mark, any updates on the documentation?
Hi Mark, just wondering if and where I can find the update documentation about this topic.
Thanks in advance,
Ronny
Any updates from Mark Wahl on the document?
- And for the app proxy to use KCD for impersonation the account could be disabled or?
- Mark_Wahl
It is correct that the user does not need to authenticate themselves to the AD DS domains. However the documentation on the combination of AD user account attributes that will be supported with Azure AD App Proxy for Windows integrated auth applications will need to be updated for the B2B guest scenario. (Typically for employees accessing on-premises apps, the users have been enabled on-premises as well as in Azure AD, so this issue has not yet showed up -- until now when we have guests). We'll need the Azure AD app proxy for guest scenario validation to be completed so we can ensure the combination of attributes work together, since KCD scenarios are often difficult to get working on first try particularly for multi-domain/multi-forest scenarios. Feel free to reach out to Sarat or I offline via email if you wish to discuss further. Thanks, Mark
Mark_Wahl wrote:It is correct that the user does not need to authenticate themselves to the AD DS domains. However the documentation on the combination of AD user account attributes that will be supported with Azure AD App Proxy for Windows integrated auth applications will need to be updated for the B2B guest scenario. (Typically for employees accessing on-premises apps, the users have been enabled on-premises as well as in Azure AD, so this issue has not yet showed up -- until now when we have guests). We'll need the Azure AD app proxy for guest scenario validation to be completed so we can ensure the combination of attributes work together, since KCD scenarios are often difficult to get working on first try particularly for multi-domain/multi-forest scenarios. Feel free to reach out to Sarat or I offline via email if you wish to discuss further. Thanks, Mark
Mark, do you know if the guide has now been published? Our set up is SharePoint and Web Servers deployed on Windows IIS all deployed in an Azure IaaS environment. These servers are joined to the Azure AD DS Domain. The application is published using Application Proxy, with IWA and Azure AD. However, we cannot seem to get external users to authorize on the backend application. For consumer identity we get MFA and then get forbidden and autorization errors, for external organisation users, the collaboration invitation does not get delivered to the recipient. I created the external users in the Azure AD DS environment and modified the UPN to reflect the invited external users - However no joy. Internal users however works.
Can you confirm if this is a supported configuration?
Thanks.
- Hi Mark,
create to hear this :)
Thats exactly what we are looking for. We (Oxford Computer Group Germany) just started working on a SCIM client to get some automation into this for our customers.
Looking forward to see it on docs!
