How to perform authentication in container apps through Front Door's custom domain?

Hello Boyan Stefanov,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having challenges to perform authentication in container apps through Front Door's custom domain.

To configure authentication and authorization for your Azure Container App with Front Door and Microsoft Entra ID, you will need to create an App Registration Automatically. From Azure portal you will navigate to your app and select Authentication, to add Identity Provider by selecting Microsoft as the identity provider. By default, the option to create a new registration is selected. You can customize the registration name and supported account types and configure your client secret to generate and store as a secret in the container app. https://video2.skills-academy.com/en-us/azure/container-apps/authentication-entra

Also, if you like you can configure it manually.

You can check a similar answer here if you use a private link https://video2.skills-academy.com/en-us/answers/questions/1689342/front-door-with-azure-container-apps-and-private-l

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam

@Sina Salam We went with the manual way but this doesn't answer my question. I went through the thread that you linked prior to posting my question but it is unclear as it didn't involve a custom domain at first. Also more details are needed on how to implement the "Secondly, in Container App Configuration, you will need to enable authentication, configure Azure AD settings, and set the redirect URI to the Front Door URL." and "You should consider using a custom domain, both in AFD and Internal Container Apps

• Let's consider this as "app.contoso.com"
• This way, the host name between Client to AFD and AFD to the ILB will remain the same."

Edit: I tried following the steps here https://techcommunity.microsoft.com/t5/apps-on-azure-blog/configure-container-app-behind-front-door-with-custom-domain/ba-p/3815048 and one of the considerations is "If you have deployed your container app environment in a custom VNET, ensure that the DNS is configured accordingly so that the Front door will be able to access the container app (https://video2.skills-academy.com/en-us/azure/container-apps/networking#dns)" - I tried creating such a private dns zone but it still doesn't seem to work.

@Boyan Stefanov ,

I see Sina Salam has shared a similar thread : https://video2.skills-academy.com/en-us/answers/questions/1689342/front-door-with-azure-container-apps-and-private-l on how to achieve this.If you would like to have an Entra authentication, you should add the custom domain to the backend PaaS Service (Container Apps).

• See : Add a custom domain to Container Apps

Can you confirm if a custom domain is added to your Container Apps?

Cheers,

Kapil

The link you mentioned was already sent by @Sina Salam and the solution mentioned there is based on classic frontdoor, and the solution you provided there involves adding a custom domain.

And to answer your question, yes, we do have custom domain added to our Container Apps.

EDIT: I have also tried to implement the solution mentioned here (leaving the origin host header blank for azure frontdoor premium): https://video2.skills-academy.com/en-us/azure/architecture/best-practices/host-name-preservation#azure-front-door