0

We have implemented Azure AD OAuth 2.0 authentication in spring boot application. It gives the Microsoft login. After entering credentials it takes to page. https://xxx.xxx.xxx/login?error#. This happens when this application is deployed on an AWS ECS Service which has an Application Load Balancer configured.

enter image description here

The authentication works fine for localhost redirect URIs in App registration with same credentials. Above issue is for prod URI other than localhost URIs. It also works fine when deployed on Azure App Service. Earlier, I was getting an issue of MS online not redirecting to https redirect URI due to the ALB configured on ECS Service, so I have added below to the application.properties:

server.forward-headers-strategy=FRAMEWORK
server.tomcat.remoteip.remote-ip-header=x-forwarded-for
server.tomcat.remoteip.protocol-header=x-forwarded-proto
server.tomcat.use-relative-redirects=true
server.tomcat.remoteip.internal-proxies=.*

Now, authorization request is redirecting to https but I am getting invalid credentials even with correct credentials or SSO. My redirect URIs, look like below

enter image description here

On the App Reg, I have ' Access Tokens' for implicit flow checked.

The code for authentication is as below:

enter image description here

Dependencies added in pom.xml are as below:

enter image description here

We are using sprint boot v.2.4.5.

I tried to collect CloudWatch logs and below is what is logged on CloudWatch

 [ ] 6793 [ServerService Thread Pool -- 87] WARN  
c.a.s.telemetry.TelemetrySender - Failed to exchange telemetry request, 400 
Invalid instrumentation key: [{
    "itemsReceived": 1,
    "itemsAccepted": 0,
    "errors": [
        {
            "index": 0,
            "statusCode": 400,
            "message": "Invalid instrumentation key"
        }
    ]
}]. 

1 Answer 1

0

The issue was solved by enabling sticky session on the Application Load Balancer configured on ECS service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.