The following forum(s) have migrated to Microsoft Q&A (Preview): Azure Active Directory!
Visit Microsoft Q&A (Preview) to post new questions.

Learn More

 locked
Azure Proxy Connectors - Issue with Applications using ViewState and "InProc" Session RRS feed

  • Question

  • Recently I registered my legacy on-Premise applications on Azure for SSO and 2FA. But Since Now we have 2 load balancer, one F5 and other Azure Proxy Connector Servers. Currently F5 is setup for sticky sessions to avoid issue with Applications using ViewState and "InProc" Session. But Now we also have Azure lproxy connector servers so these applications have started breaking and throwing "ViewState is invalid" error very frequently. Please let me know if there is a way to avoid this problem with having F5 and Azure proxy connector servers  in-place.

    We have 2 proxy connector Servers.

    Problem:<u5:p></u5:p>

    Suppose  Some user accesses application A. Initial request to this application goes to A proxy connector server. Now User hits some action in that application and that request goes to B proxy connector server For F5, Both these requests will be different even though they are coming from same user session.  F5 may forward these request to different load balanced web servers. Since few applications are using “ViewState” and “InProc” session state and for these applications to work properly all the request from same session should come on same web server.<u5:p></u5:p>

     

    Solution:<u5:p></u5:p>

    If somehow we can tune our proxy connector servers that all the request from same user session should go on same proxy connector server then we should be able to fix this problem.<u5:p></u5:p>

    <u5:p></u5:p>

    • Edited by GuptaVipin Wednesday, November 7, 2018 7:38 PM
    Wednesday, November 7, 2018 2:50 PM

Answers

  • Able to fix this issue. Proxy Connector receives client IP from Azure cloud in "X-Forwarded-For" request header field. We created a custom iRule on F5 for considering "X-Forwarded-For" as client IP and It worked.
    • Marked as answer by GuptaVipin Friday, November 16, 2018 8:49 PM
    Friday, November 16, 2018 8:49 PM

All replies

  • You cannot configure connector servers to handle user sessions as the proxy connectors are stateless and have no configuration data on the machine and they load balance automatically. You can try assigning the application to a connector group where all requests can route to the same connector to process the requests.
    Friday, November 9, 2018 1:31 PM
  • Thanks Saurabh!

    If I just keep one connector server in connector group. It will solve the problem but it will break the entire system in the event of connector server failure because connector group has just one connector server.

    Is it possible to configure that if one connector group is down then other connector group should automatically assign to applications?

    Does connector receive the client IP in request as part of header? Does Azure cloud send client IP in X-Forwarded-For header field of request to connector?

    • Marked as answer by GuptaVipin Friday, November 16, 2018 8:47 PM
    • Unmarked as answer by GuptaVipin Friday, November 16, 2018 8:47 PM
    Sunday, November 11, 2018 9:18 PM
  • Able to fix this issue. Proxy Connector receives client IP from Azure cloud in "X-Forwarded-For" request header field. We created a custom iRule on F5 for considering "X-Forwarded-For" as client IP and It worked.
    • Marked as answer by GuptaVipin Friday, November 16, 2018 8:49 PM
    Friday, November 16, 2018 8:49 PM