SAML authentication not working behind Azure Application Gateway

SonarQube
1

Version: SonarQube CE 8.6.0.39681

I have setup SonarQube behind Azure Application Gateway (AGW). Basically AGW is like a reverse proxy. AGW has a public IP address and it forwards requests to SonarQube and my other applications. Based on my experience with other applications, AGW sets the X-Forwarded-* headers correctly. SonarQube has a private IP address and hostname.

Now, I am trying to setup SAML authentication using Azure AD. Otherwise it works fine but the callback to SonarQube fails. I can see an error like this in the logs:

The response was received at https://sonarqube.private.example.com/oauth2/callback/saml instead of https://sonarqube.public.example.com/oauth2/callback/saml

I have set the SonarQube base URL as https://sonarqube.public.example.com. Clearly this is used to generate the callback URL (AssertionConsumerServiceURL) but not to validate the response.

How can I configure SonarQube to use the base URL / public hostname to validate the response?

2

There is a related question at Microsoft site -> https://docs.microsoft.com/en-us/answers/questions/152511/sending-saml-response-to-a-different-url.html. It looks to me that Azure AD does allow to change reply URL inside the message.

3

Any luck on this? We are in similar situation, the IdP here is PingID and the Appgateway is set on Azure.

4

No, I suppose it would work if we used the same hostname in AGW and SonarQube.

5

We got it working, you will need to change the HTTP setting of the App gateway to pick it up from a domain name and also we had to change the provider ID (if PingID is the IdP) on SonarQube app

6

@Thushma_Nair : Can you please elaborate on the configuration you did to get this working. I have a similar situation. Thanks.