---
id: d17903e2-44c9-491d-8cc9-f52cf9aee870
---

# Azure Web App Authentication and Authorization Problems

This incident type refers to issues related to user authentication and authorization in an Azure web application. This can happen due to incorrect configuration of authentication and authorization settings, such as identity provider settings, application roles, and access control. Resolving this incident requires verifying and correcting these settings to ensure proper user authentication and authorization in the application.

### Parameters

```shell
export WEBAPP_NAME="PLACEHOLDER"
export RESOURCE_GROUP_NAME="PLACEHOLDER"
export APPLICATION_ID="PLACEHOLDER"
export SUBSCRIPTION_ID="PLACEHOLDER"
export TOKEN_AUDIENCE_URL="PLACEHOLDER"
export CLIENT_ID="PLACEHOLDER"
export CLIENT_SECRET="PLACEHOLDER"
export TOKEN_ISSUER_URL="PLACEHOLDER"
```

## Debug

### Check if the web app is running

```shell
az webapp show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query "state"
```

### Check if authentication and authorization is enabled for the web app

```shell
az webapp auth show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query "enabled"
```

### Check if the identity provider is correctly configured

```shell
az webapp identity show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```

### Check if the application roles are correctly configured

```shell
az ad app show --id ${APPLICATION_ID}
```

### Check if access control is correctly configured

```shell
az role assignment list --assignee ${APPLICATION_ID} --scope /subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}
```

## Repair

### Check and update the authentication and authorization settings in the Azure web application and verify that they are correctly configured.

```shell
#!/bin/bash

# Set variables
resource_group=${RESOURCE_GROUP_NAME}
webapp_name=${WEBAPP_NAME}
token_audience_url=${TOKEN_AUDIENCE_URL}
client_id=${CLIENT_ID}
client_secret=${CLIENT_SECRET}
token_issuer_url=${TOKEN_ISSUER_URL}

# Verify that the resource group exists
if az group show --name $resource_group &>/dev/null; then
  echo "Resource group exists: $resource_group"
else
  echo "Resource group not found: $resource_group"
  exit 1
fi

# Verify that the web app exists
if az webapp show --name $webapp_name --resource-group $resource_group &>/dev/null; then
  echo "Web app exists: $webapp_name"
else
  echo "Web app not found: $webapp_name"
  exit 1
fi

# Check the authentication and authorization settings
if az webapp auth show --name $webapp_name --resource-group $resource_group --query enabled &>/dev/null; then
  echo "Authentication and authorization enabled"
else
  echo "Authentication and authorization not enabled"
  echo "Enabling authentication and authorization..."
  az webapp auth update --name $webapp_name \ 
  --resource-group $resource_group \
  --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences $token_audience_url \
  --aad-client-id $client_id \
  --aad-client-secret $client_secret \
  --aad-token-issuer-url $token_issuer_url
  echo "Authentication and authorization enabled"
fi
```

This incident type refers to issues related to user authentication and authorization in an Azure web application. This can happen due to incorrect configuration of authentication and authorization settings, such as identity provider settings, application roles, and access control. Resolving this incident requires verifying and correcting these settings to ensure proper user authentication and authorization in the application.


```shell
export WEBAPP_NAME="PLACEHOLDER"
export RESOURCE_GROUP_NAME="PLACEHOLDER"
export APPLICATION_ID="PLACEHOLDER"
export SUBSCRIPTION_ID="PLACEHOLDER"
export TOKEN_AUDIENCE_URL="PLACEHOLDER"
export CLIENT_ID="PLACEHOLDER"
export CLIENT_SECRET="PLACEHOLDER"
export TOKEN_ISSUER_URL="PLACEHOLDER"
```


### Check if the web app is running

```shell
az webapp show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query "state"
```

### Check if authentication and authorization is enabled for the web app

```shell
az webapp auth show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query "enabled"
```

### Check if the identity provider is correctly configured

```shell
az webapp identity show --name ${WEBAPP_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```

### Check if the application roles are correctly configured

```shell
az ad app show --id ${APPLICATION_ID}
```

### Check if access control is correctly configured

```shell
az role assignment list --assignee ${APPLICATION_ID} --scope /subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}
```


### Check and update the authentication and authorization settings in the Azure web application and verify that they are correctly configured.

```shell
#!/bin/bash

# Set variables
resource_group=${RESOURCE_GROUP_NAME}
webapp_name=${WEBAPP_NAME}
token_audience_url=${TOKEN_AUDIENCE_URL}
client_id=${CLIENT_ID}
client_secret=${CLIENT_SECRET}
token_issuer_url=${TOKEN_ISSUER_URL}

# Verify that the resource group exists
if az group show --name $resource_group &>/dev/null; then
  echo "Resource group exists: $resource_group"
else
  echo "Resource group not found: $resource_group"
  exit 1
fi

# Verify that the web app exists
if az webapp show --name $webapp_name --resource-group $resource_group &>/dev/null; then
  echo "Web app exists: $webapp_name"
else
  echo "Web app not found: $webapp_name"
  exit 1
fi

# Check the authentication and authorization settings
if az webapp auth show --name $webapp_name --resource-group $resource_group --query enabled &>/dev/null; then
  echo "Authentication and authorization enabled"
else
  echo "Authentication and authorization not enabled"
  echo "Enabling authentication and authorization..."
  az webapp auth update --name $webapp_name \ 
  --resource-group $resource_group \
  --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences $token_audience_url \
  --aad-client-id $client_id \
  --aad-client-secret $client_secret \
  --aad-token-issuer-url $token_issuer_url
  echo "Authentication and authorization enabled"
fi
```


Azure Web App Authentication and Authorization Problems

Overview

Parameters

Debug

Check if the web app is running

Check if authentication and authorization is enabled for the web app

Check if the identity provider is correctly configured

Check if the application roles are correctly configured

Check if access control is correctly configured

Repair

Check and update the authentication and authorization settings in the Azure web application and verify that they are correctly configured.

Learn more

Related Runbooks

Support