Support: Azure Entra ID Authentication for existing Azure Web App

[bbaabemhp]

Hey Guys,

I have an existing Azure Web App where I host Langfuse by pulling the Langfuse image.

Now, I wanted to set up authentication with Microsoft Entra ID, but with no luck.

I created authentication via Azure Portal in the Azure Web App but my app seems to completely crash.

I have set up the folllowing environment variables:

AUTH_AZURE_AD_CLIENT_ID
AUTH_AZURE_AD_CLIENT_SECRET
AUTH_AZURE_AD_TENANT_ID
AUTH_DISABLE_USERNAME_PASSWORD=true
AUTH_AZURE_ALLOW_ACCOUNT_LINKING=false

I tried to insert the callback url but with no luck:

And this is my configuration:

Thanks in advance guys!

[dosubot[bot]]

To set up Microsoft Entra ID authentication for your Azure Web App hosting Langfuse, ensure the following:

1. Environment Variables: You've set the necessary environment variables, but make sure they are correctly configured:

   • AUTH_AZURE_AD_CLIENT_ID
   • AUTH_AZURE_AD_CLIENT_SECRET
   • AUTH_AZURE_AD_TENANT_ID

2. Callback URL: Ensure that the OAuth Redirect URL is set to /api/auth/callback/azure-ad. This should be configured in both your Azure AD application and your Azure Web App settings.

3. Azure AD Application Configuration:

   • Verify that the redirect URI in your Azure AD app matches the one used in your web app settings.
   • Ensure that the app registration in Azure AD is set to allow the necessary permissions and scopes for authentication.

4. App Service Authentication Settings:

   • Make sure that the "App Service authentication" is enabled.
   • Set "Unauthenticated requests" to "HTTP 403 Forbidden" to ensure only authenticated users can access the app.
   • Ensure the "Allowed external redirect URLs" includes the correct callback URL.

5. Troubleshooting:

   • Double-check that the client secret is valid and has not expired.
   • Review the logs in Azure to identify any specific errors that might indicate what is causing the crash.

By ensuring these configurations are correct, your app should be able to authenticate using Microsoft Entra ID without crashing ^[1][2].

To continue talking to Dosu, mention @dosu.

[marcklingen]

Happy to help, are you sure that this is the correct callback url? What kind of errors do you get with this configuration?

[bbaabemhp]

My web app just get an timeout error when booting up, so there are no meaningful logs unfortunately.

Regarding callback url, I just copy/pasted it from the official Langfuse documentation where SSO is described. Should it be different?

[Steffen911]

@bbaabemhp Do you see the Langfuse login screen when accessing the deployment? Could you perhaps share a recording of the signin flow and where you run into any issues?
And could you share the exact environment variables you use for configuration (with sensitive parts being redacted)?