Azure App Proxy and SharePoint Online

[Nitin Rastogi]

I am working on validating whether we can access an internal on-prem service, exposed externally via Azure App Proxy, in a client side code.

Structure of things

1. An internal service

2. Azure App Proxy exposing the internal service externally

3. A SharePoint Online Page - On this page I am trying to validate whether I can access the service via app proxy

Flow

1. User signs-in to the SharePoint Online site

2. Navigates to a page that pulls data from azure app proxy service

3. User should see data from internal service passed over through Azure App Proxy without any authentication challenge

Is the above flow possible? I tried the same and it fails where the call to Azure App Proxy is stopped with status code 307. I suspect the call is deemed as unauthenticated and hence failing.

Had a look at the various cookies passed when I access SharePoint Online - FedAuth and rtfa

Had a look at the various cookies passed when I access Azure App Proxy directly and once authenticated by login - AzureAppProxyUserSessionCookie, ASP.NET_SessionId, AzureAppProxyAccessCookie

Considering there are different set of cookies for each authenticated session, I am doubtful, the desired flow is plausible.

[#2]

307 was coming from usage of "http" instead of "https". Have changed it to "https" and now I get 302, which is to the login page. Is this expected?

Both the applications - SharePoint Online and Azure App Proxy are being authenticated by same STS service i.e. Azure AD STS and I thought, the cookie transformation would be done internally by the product. However, this doesn't seem to be the case.

Suggestion, clue - any pointer would help here.

[#3]

@Nitin Rastogi was wondering if you were ever able to find a solution to this. We are exploring the same capability at my company and have found that we can retrieve data from our on-prem services via client-side call in SharePoint Online. However, where we have run into issues is when we try to post to those services the redirect to the login is throwing CORS errors and we haven't figured out how to get this to work.  So when I saw your post I was wondering if you were able to get it working.