Azure AD Application Proxy SSO stop working since this weekend?

Jack Chen 131 Reputation points
2021-11-15T17:47:29.52+00:00

I am wondering if any one has setup Azure AD application proxy with Integrated Windows Authentication ?

I worked with a client to set it up with Exchange OWA, and it was working until this weekend. This morning the client told me it stop working, now it shows

Azure AD Application Proxy
Status code: BadGateway

Weird part is I setup a POC for the client and it was working before, now it got same BadGateway error. Since the two application proxy are in different Azure AD tenant/different domain, that seems indicate there might be something wrong with Azure AD?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,690 questions

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michael Maher 42 Reputation points
    2021-11-18T17:06:52.35+00:00

    Seeing the same issue, thanks for sharing this

    1 person found this answer helpful.
    0 comments
  2. Florian Obradovic 6 Reputation points
    2021-11-22T14:30:33.543+00:00

    Thanks for sharing.
    I already banged my head for hours.

    The DCs in the affected environment are on Server 2012 R2, is there anout-of-band update for 2012 R2?

    On the target DCs you see this in the logs: 

    A Kerberos service ticket was requested. 
Account Information: 
 Account Name: AzAppProxyHost$@DOMAIN.LOCAL 
 Account Domain: DOMAIN.LOCAL 
 Logon GUID: {00000000-0000-0000-0000-000000000000} 
Service Information: 
 Service Name: HTTP/host.domain.local 
 Service ID: S-1-0-0 
Network Information: 
 Client Address: ::ffff:10.10.xx.xx 
 Client Port: 49837 
Additional Information: 
 Ticket Options: 0x40830000 
 Ticket Encryption Type: 0xFFFFFFFF 
 Failure Code: 0x29 
 Transited Services: - 
This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested. 
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket. 
Ticket options, encryption types, and failure codes are defined in RFC 4120.

    Failure Code: 0x29:
    0x29 KRB_AP_ERR_MODIFIED Message stream modified and checksum didn't match

    Regards, Flo.

    1 person found this answer helpful.
    0 comments
  3. JackieB 1 Reputation point
    2021-11-20T21:29:01.01+00:00

    Thank you!!!! This post saved me hours of banging my head.

    0 comments
  4. Jack Chen 131 Reputation points
    2021-11-22T16:05:48.04+00:00

    @Florian Obradovic

    https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#2750

    Take action: Out-of-band update to address authentication issues on DCs relating to Kerberos delegation scenarios
    Microsoft is releasing Out-of-band (OOB) updates today, November 14, 2021, to resolve issues in which authentication might fail on DCs with certain Kerberos delegation scenarios on all supported versions of Windows Server when used as a Domain Controller. To get the standalone update package, search for it in the Microsoft Update Catalog. You can import this update into Windows Server Update Services (WSUS) manually. See the Microsoft Update Catalog for instructions. Note These updates are not available from Windows Update and will not install automatically.

    For instructions on how to install this update for your operating system, see the KB for your OS listed below:
    Windows Server 2019: KB5008602
    Windows Server 2016: KB5008601
    Windows Server 2012 R2: KB5008603
    Windows Server 2012: KB5008604
    Windows Server 2008 R2 SP1: KB5008605
    Windows Server 2008 SP2: KB5008606

    0 comments