Hello, Cloud Gurus, and welcome back
for part 2 of Providing Access to Legacy Applications.
In the previous lesson,
we took a look at Web Application Proxy
and now we're going to explore a modern alternative.
Let's take a look at what we're going to cover.
First up, we'll answer the question,
what is Azure AD Application Proxy?
We'll also take a look at
how Azure AD Application Proxy works, and then we'll go
through the Azure AD Application Proxy requirements.
And then finally, we'll do a demo
where we'll take a look at Azure AD Application Proxy.
Let's get started.
Now, Azure AD Application Proxy is a modern alternative
to provide remote access to corporate applications
on your internal network.
And it provides remote access to on-premises applications
with a minimum of 1 server
and only requires 2 to provide high availability.
And these servers do not need to be deployed
in a perimeter network
like they do with Web Application Proxy.
And your security teams will be happy
because there's no inbound ports
to open on your external firewall
because all access from Azure AD Application Proxy
is outbound to Azure.
So you don't need to manage multiple firewall rules
and you don't need to manage heaps of certificates.
And proxy is also secure.
Connectivity to apps can be protected
by Azure Active Directory Multifactor Authentication
and Azure AD conditional access.
For example, you can check
if your users are accessing the applications
from a trusted device,
if they're using multifactor authentication,
or if they're using approved client software,
or a range of other conditional access policies.
So how does Azure AD Application Proxy work?
Well let's first start with our
remote application access infrastructure
that we deployed in part 1 of this lesson.
We can start to simplify this infrastructure
by removing the perimeter network,
the Web Application Proxy servers, and the ADFS servers.
And in a typical production deployment,
you would also have had load balancers
and multiple firewalls to support
the remote access to your applications.
And those also won't be required anymore.
And instead, we can use the
Azure AD Application Proxy Service in Azure.
And we can deploy the Application Proxy Connector service
on a server on our internal network.
Users authenticate against Azure AD and connect
to a public endpoint in the Microsoft Azure Cloud
and it generates a request in the Application Proxy Service.
And the endpoint your users connect to
in the Azure AD Application Proxy Service
can be a custom domain if you'd like.
The Application Proxy Connector,
listening using an outbound connection, collects the request
and performs authentication if required,
for example, getting a Kerberos ticket
from a domain controller.
And a variety of authentication methods can be used,
including Integrated Windows Authentication,
forms-based authentication, and more.
Then the Application Proxy Service
forwards the request to the application server
and you can forward the request to a domain
or a subfolder within your web application.
For maximum performance,
you can also group your connectors into connector groups
to make sure that a connector close
to your application collects the request
from the Application Proxy Service.
The response from the application is sent
to the proxy service by the proxy connector server
where it can be accessed by the user.
All right, now let's take a look at some of the requirements
for implementing Azure AD Application Proxy.
Let's first start with the Azure AD requirements.
Now you need to have at least one Azure AD Premium license
for the administrative user.
And the administrator also needs to be a member
of the Global Administrator role
or the Application Administrator Azure AD Role.
And you also need user identities synced to Azure AD
or Azure AD Cloud-Only users.
But be aware that some authentication types
will require synced users.
And for your server requirements,
you need to have a minimum
of Windows Server 2012 R2 or later
and your server also needs to be
in the same domain or a trusted domain
as the application server.
And Windows Server 2019 or later require the HTTP/2 protocol
to be disabled to support Kerberos constrained delegation.
And the server hosting your Application Proxy Connector
should also be close to your application server
to provide low latency between the proxy connector
and the application server.
And if you've deployed the
Azure AD Password Protection Proxy,
you should not install the Azure AD Application Proxy
and the Azure AD Password Protection Proxy
together on the same server.
And you'll also need outbound network connectivity
on port 80 and 443.
Port 80 is used for certificate validation
and 443 is used for traffic to the proxy service.
All right, let's take a look at a demo
of Azure AD Application Proxy.
In this demo, we'll use the Azure AD Application Proxy
to make the Barrier Reef Audio's time-tracking application
accessible from outside the network.
And we've deployed a new server that will be used
as our Azure AD Application Proxy Connector.
And because our internal application uses
Integrated Windows Authentication, we'll start
by configuring resource-based constrained delegation
for the new server so it can delegate credentials
for the users when they attempt to access the application.
Then we will prepare the Application Proxy server,
download, and set up the connector.
And then we will configure the application
in the Azure AD Application Proxy Service.
And finally, we will log in and test the application.
Let's take a look.
All right, now here I am logged on
to our administrative server
and we're going to go ahead
and configure resource-based Kerberos constrained delegation
to allow our Azure AD Application Proxy server
to delegate credentials for users
when they access the web application.
So to begin, we'll go ahead and get the identity
of the Azure AD Application Proxy Connector computer
and we'll save that to a variable.
And now we'll go ahead and set the properties
on the web application server
to allow the Application Proxy server
to delegate credentials to the web server.
And to do that, we'll use the
Set-ADComputer PowerShell cmdlet
and CORP-BNE-WEB01 is our web application server.
We'll go ahead and run that.
All right, now let's jump across
to our Azure AD Application Proxy Connector server
and configure the prerequisites.
All right, so here we are
on our Azure AD Application Proxy Connector server.
Now because this server is running Windows Server 2022,
we need to first disable HTTP/2.
To do that, we'll use PowerShell.
So I'll go ahead and launch PowerShell.
I'll just clear the screen.
And now to save you having to wait for me
to type in all of these PowerShell cmdlets,
I'm just going to paste the commands in here
and I'll include a link so that you can go
and get these commands from the Microsoft documentation.
So to disable HTTP/2,
we need to run the Set-ItemProperty PowerShell cmdlet.
So I'll go ahead and paste that command in now.
And we also need to enable TLS 1.2 on this server
and this is required
for all Azure AD Application Proxy servers.
And there are a number of commands that you need to run
and they're all using the Set-ItemProperty cmdlet as well,
and I'll just paste these commands in
and you can grab them from the documentation.
All right, the prerequisites are now complete
on our Application Proxy Connector.
The next step is to download and install the connector.
So I'll show you in the Azure Portal
where you can download and install it.
Let's head over to the Azure Portal now.
All right, so here I am in the Azure Portal
and I've gone ahead and navigated
into Azure Active Directory.
To download and install the
Azure AD Application Proxy Connector,
you navigate to Application Proxy under Manage
and then you can download the connector service
using the button shown here.
If this is the first time
you're using Azure AD Application Proxy,
you also might need to enable the Application Proxy Service
using the icon here.
All right, let's jump over
to our Azure AD Application Proxy Connector server
and install the service.
All right, so here I am back
on the Azure AD Application Proxy Connector server.
So I'll go ahead and run the installer.
We'll accept the license terms and click Install.
And then we just need to log on
with a user account that is a member
of the Application Administrator Azure AD Role
or a Global Admin.
So we'll go ahead and log in now.
And then we'll come back when that's done.
All right, and I've successfully authenticated
and now it's going ahead and installing the
Azure AD Application Proxy Connector service.
All right, now let's take a look at the portal
to confirm the installation has been successful.
All right, and here we are back in the Azure Portal
and we've got our default proxy connector group.
We'll go ahead and expand that.
And we can see we have our
Azure AD Application Proxy Connector server displayed here
and its status is active, so we're good to go.
Now let's go ahead and add an on-premises app.
So we'll go ahead and select Configure an App
and we'll provide a name for our app.
We're just going to use the name Time Tracker.
I'll go ahead and paste in the internal URL,
which is timetracker.corp.barrierreefaudio.com
and it's already providing an external URL for us
and we're going to use
Azure Active Directory Pre-Authentication
so that we can use an
Integrated Windows Authentication application.
We don't need to configure any additional settings
so we can go ahead and click Add.
This will just take a moment to complete
so we'll come back when this is done.
All right, our application has been successfully created.
Now let's navigate back into Azure Active Directory
and configure single sign-on.
So we'll navigate back to Azure AD
and then we'll navigate into Enterprise Applications
and we'll navigate into our Time Tracker app
and we'll navigate into Single Sign-On.
And we're going to use Windows Integrated Authentication
and I'll paste in the internal
application service principle name.
And what this means is that we're using the HTTP service
and that service is running on corp-bne-web01
in the corp.barrierreefaudio.com domain.
And this service principle name
has been configured in Active Directory.
And this application expects to receive
this same account name as the user log identity
so we're going to go ahead and change that.
And then we can go ahead and click Save.
Now let's go ahead and assign a user.
So we'll select Users and Groups.
And then we'll go ahead and add a user
and we'll go ahead and select Alice.
And then we can go ahead and click Assign.
All right, now let's test access as Alice.
So we'll jump over to our computer
where we're logged on as Alice.
All right, and I've gone ahead
and navigated to myapps.microsoft.com
and I've gone ahead and logged in as Alice.
Now, let's go ahead and access the Time Tracker application
and test our application proxy.
And we can see here where it presented
with the application from our internal network,
and it's successfully detected us
as Alice using Integrated Windows Authentication.
And if users want to access this application directly-
they can use the built-in default URL provided
or you can assign a custom domain to this application.
All right, that wraps up this demo.
Let's take a look at what we've covered in this lesson.
All right, so what have we covered?
Azure AD Application Proxy provides simple
and secure remote access to on-premises legacy applications.
And it's important to remember
that Azure AD Application Proxy requires
at least one Azure AD Premium license assigned
to your application administrator.
And it's also important to remember
that Kerberos delegation is used
to access web-based applications
that use Integrated Windows Authentication.
And Kerberos constrained delegation is recommended
and that constrained delegation must be resource-based
to work across domains.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found it useful,
and I look forward to seeing you on the next lesson.