1

I've been trying to solve this issue for over a week now with no progress whatsoever. I’m having trouble authenticating using Cordova Azure Mobile App plugin and .NET/C# back-end.

I'm following this tutorial on creating a Cordova app for Android/iOS. I added Azure Active Directory as my provider for authentication based on this tutorial. I downloaded the quickstart projects from the Azure Portal for Cordova and .NET/C# back-end.

I deployed the Azure mobile app back-end and updated the Resource Explorer to allow https://localhost:4000 and https://{myazurewebsite}.azurewebsites.net by adding the URL’s in allowedExternalRedirectUrls. I also updated CORS to allow those same URL’s. I added my Single Sign-On Reply URL to be https://{myazurewebsite}.azurewebsites.net/.auth/login/aad/callback. I ensured that my Cordova app has the InAppBrowser and Azure Mobile Apps plugin installed. I updated the Content-Security-Policy to point to https://login.windows.net and https://{myazurewebsite}.azurewebsites.net. I updated my onDeviceReady() function to be:

function onDeviceReady() {

    // Create a connection reference to our Azure Mobile Apps backend
    client = new WindowsAzure.MobileServiceClient('https://{myazurewebsite}.azurewebsites.net');

    // Login to the service
    client.login('aad')
        .then(function () {

            // BEGINNING OF ORIGINAL CODE

            // Create a table reference
            todoItemTable = client.getTable('todoitem');

            // Refresh the todoItems
            refreshDisplay();

            // Wire up the UI Event Handler for the Add Item
            $('#add-item').submit(addItemHandler);
            $('#refresh').on('click', refreshDisplay);

            // END OF ORIGINAL CODE

        }, handleError);
}

When I execute the Cordova app in Ripple while connected to my work LAN, the app loads into Ripple and then a second window opens asking me for my AAD credentials. I enter my username, tab off, and the redirect starts to happen and I am successfully authenticated and able to interact with the ToDoItems from the tutorial.

When I execute the Cordova app in Ripple while connected to a public network, the app loads into Ripple and then a second window opens asking me for my AAD credentials. I enter my username, tab off, and the redirect starts to happen and the I am presented with an additional prompt shown in the image below:

enter image description here

When I execute the Cordova app and send it to an Android or iOS device while connected to a public network, I receive the Cordova WebView (InAppBrowser) which asks for my credentials. I enter my username, press the password text box, and the redirect starts. It then just goes to a blank white page and hangs there.

Am I missing something? Why do I get a second prompt in Ripple when connected to a public network and why does the Cordova WebView show a blank screen after trying to authenticate the user name only?

Azure Mobile App CORS settings: enter image description here

Azure Mobile App AAD Authentication settings enter image description here

Azure Resource Explorer settings: enter image description here

Azure Active Directory WebApp created by Express setting Active Directory Management Mode enter image description here The delegate permission set is the default one: Sign in and read user profile

Arthur Yegiazaryan
  • 520
  • 5
  • 14

2 Answers2

1

It looks like the public network is set up on a proxy. You are then proxying a proxy and the backend is not seeing the URL it expects - instead, it is seeing the URL of the proxy.

I suspect this is one of those things that will work fine in a "normal" mobile situation. Run the app on a real device instead when you are on the public network.

Adrian Hall
  • 7,990
  • 1
  • 18
  • 26
  • Adrian, thanks for replying. I was hoping you would! Unfortunately your suggestion does not seem to work. I deployed the app to my personal Samsung Galaxy S5 device, disconnected it from WiFi (so I am on 4G LTE) and I get the same behavior. How can I further debug it? Any other suggestions? – Arthur Yegiazaryan Jul 26 '16 at 12:05
  • Given it works internally and not externally, it has to be networking. You have ruled out the application and settings. I'd ask the IT guys if there are any permissions set up that would affect this – Adrian Hall Jul 26 '16 at 16:12
  • Thanks Adrian! I tested it on my personal instance of Azure and everything worked as expected so it's definitely something to do with my companies Azure/Fed setup. Once our IT guys look into it, I'll post the answer here and in MSDN when I posted the question as well. – Arthur Yegiazaryan Jul 27 '16 at 13:29
0

The problem was that my company was sending Azure AD authentication requests through Azure to our on-premise ADFS servers. The infrastructure group at our company needed to add a WAP (Web Application Proxy) Server in the middle to intercept communication and allow this flow to work.

Once they added the WAP server, it was no longer an issue.

Arthur Yegiazaryan
  • 520
  • 5
  • 14