Recently was troubleshooting the issue when the internal application portal page was not loaded (part of the portal was not loaded at all) when accessed via Azure AD Application Proxy (AAD AP). The application in question was Dell Storage Manager web console, but the troubleshooting steps described below are applicable to any application.
First thing checked the Azure AD application settings related to AAD AP – Azure AD pre authentication was used, no custom domain, headers and application body translation enabled, so setup looked pretty standard.
As next step captured the Fiddler trace when accessing the internal application directly and via AAD AP.
In the trace for the AAD AP access see one of the pages fail to load and this error message:
Azure AD Application Proxy
Root cause: The connector did not respond within the timeout period.
Status code: GatewayTimeout
Timestamp: 9/4/2018 6:50:00 PM
At the same time, the “messages” page is successfully loaded when the application is accessed directly from the corporate network.
Looking closer at the request and response in both Fiddler traces see next.
GET https://IntenalHostName/messages HTTP/1.1
HTTP/1.1 101 Switching Protocols
Cache-Control: no-cache, no-store, must-revalidate
Date: Tue, 04 Sep 2018 GMT
In the bad Fiddler see following:
GET https://ExternalHostName.msappproxy.net/messages HTTP/1.1
Cookie: dsmUsername=; JSESSIONID=ZEfQJAHRszfZGXql33h06aRw.vdellem01; AzureAppProxyUserSessionCookie
HTTP/1.1 504 Gateway Timeout
So the issue seems to be happening when there is a request to upgrade to Websocket.
The Websocket support by Azure AD App Proxy is currently in preview and it was recommended to collect additional logs to see if it can be fixed in the current case.
To enable the verbose Connector logs, it was recommended to make these changes:
- Locate the installation directory of the connector (should be C:\Program Files\Microsoft AAD App Proxy Connector)
- Open the file ApplicationProxyConnectorService.exe.config in notepad for edit
- Add the following section right after appSettings:
<trace autoflush=”true” indentsize=”4″>
<add name=”consoleListener” type=”System.Diagnostics.ConsoleTraceListener” />
<add name=”textWriterListener” type=”System.Diagnostics.TextWriterTraceListener” initializeData=”<PATH_WITH_WRITE_PERMISSIONS> \ConnectorTrace.log” />
<remove name=”Default” />
- Make sure to change to a path with write permissions
- Restart the connector service and reproduce the issue from your PC while capturing the Fiddler trace.
Looking at the logs, found this exception entry:
System.Net.WebSockets.WebSocketException (0x80004005): Unable to connect to the remote server —> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. —> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
As the next step, tried to access the application directly from the Connector server using the Internet Explorer browser and sure thing the browser complained about SSL error.
Looking closer, noticed that the internal application URL was protected by SSL certificate issued to the host running the application.
As soon as the application URL was changed to server host name on the AAD App Proxy side, the issue was resolved.