python-flask container example not compatible with AAD express settings

[microsoft]

python-flask container example not compatible with AAD express settings

[kraigb]

Thanks for the report; it's good to know about the behavior, which we'll have to look into.

[qubitron]

I have gotten this working using Azure Web Apps (without containers), @HansKallekleiv initially it didn't appear to be working until I set the following setting:

I also needed to open the site in an InPrivate session to see the login screen, I think my main browser may have been logged into active directory already.

@anders-kiaer I will take a look at the web apps for containers flavor next.

[kraigb]

@JoshuaPartlow One for you to look into with the Flask tutorial.

[HansKallekleiv]

Is there any update on this issue? I'm getting the same results as @anders-kiaer, except for the last part.
In my case turning on authentication (using Azure AD) does not appear to do anything at all.

We want to host quite a few web apps on Azure, but the lack of AD authentication is preventing us from doing so.

[HansKallekleiv]

Thanks for looking into this @qubitron
I'm also using containers, and have tried adding that action without success.
Using anonymous session does not help.

These screenshots might be relevant:

There is a warning/information that

To enable Authentication / Authorization, please ensure all your custom domains have corresponding SSL bindings, your .NET version is configured to “4.5” or higher and manage pipeline mode is set to “Integrated” ,

but I'm not sure that is relevant? There are no custom domains atleast.

[qubitron]

I was able to reproduce the issue in containers, and our team has found a workaround,

There is known issue with easyauth (middleware) where in some cases, the request header length gets larger than 4096 and the request fails. The mitigation is to set this app setting WEBSITE_AUTH_DISABLE_IDENTITY_FLOW to true, can you try that and let us know if it works?

More information on this setting is here.

[anders-kiaer]

@qubitron Thanks! 🙇 The provided workaround WEBSITE_AUTH_DISABLE_IDENTITY_FLOW = true worked, tried it some weeks ago for the first time. Tried again now - and now it appears to work also without that application setting. Perhaps the underlying issue has been fixed? 🎉👷

A follow up question regarding Azure web app service + the 🐳 Docker flavor:

For Single Container (screenshot below) authentication now works out of the box. However, selecting the Docker Compose functionality and a minimal configuration setup (using the same image as when doing Single container), authentication suddenly is bypassed (i.e. you go directly to the app).

version: '3'
services:
  web:
    image: someregistry.azurecr.io/someimage:latest
    ports:
      - 80:5000

Tried both with and without the ports setting. Are you able to reproduce? Is there something that should be changed/added in the 🐳 Docker compose configuration snippet above?

cc: @HansKallekleiv

[VladyslavHnatchenko]

Hi all! Sorry @anders-kiaer, @qubitron please can you explain where you add WEBSITE_AUTH_DISABLE_IDENTITY_FLOW = true; in your code (in app.py or in Dockerfile or ...?)
Thank you for your answer.

[anders-kiaer]

I added it the same place as WEBSITES_PORT=5000, i.e. under Configuration in the Azure web app.

Having said that, I have recently created new web apps (using Docker containers), and today it is working without the workaround for my part, so to me it looks like the underlying bug is fixed.

[anders-kiaer]

For Single Container (screenshot below) authentication now works out of the box. However, selecting the Docker Compose functionality and a minimal configuration setup (using the same image as when doing Single container), authentication suddenly is bypassed (i.e. you go directly to the app).

After I posted this comment, this has now been "fixed" by greying out the Authentication / Authorization tab when you use Docker compose, with a tooltip saying that "This feature is not supported with multi-container apps".

I.e. at least indicating that it is not working with Docker compose, even though technically it does not need to be a multi-container app. E.g. this will still not work:

version: '3'
services:
  web:
    image: some_acr.azurecr.io/pythonflasktutorial:latest
    ports:
      - 80:5000

[VladyslavHnatchenko]

@anders-kiaer, thank you very much for your answer! I added here in the Configuration -> Application settings -> WEBSITE_AUTH_DISABLE_IDENTITY_FLOW = true; but it's fixed my problem. When I turn off Authentication/Authorization(Log in with Azure Active Directory), my flask app worked correct, but when I turn on this function, I have 500 error(without details), in the last step of my workflow in the app. Thank you!

[VladyslavHnatchenko]

Sorry @anders-kiaer, why you add WEBSITES_PORT= 5000, I don't add this?

[anders-kiaer]

Based on this line:

python-sample-vscode-flask-tutorial/Dockerfile

Lines 6 to 11 in 3b80224

	# IMPORTANT: When deploying to Azure App Service, go to the App Service on the Azure
	# portal, navigate to the Applications Settings blade, and create a setting named
	# WEBSITES_PORT with a value that matches the port here (the Azure default is 80).
	# You can also create a setting through the App Service Extension in VS Code.
	ENV LISTEN_PORT=5000
	EXPOSE 5000