Does Azure Application Gateway support conditional mTLS

Question

Currently we're running a Azure App Service hosted application providing different API endpoints like /public/xyz & /secured/xyz where all APIs under /secured/... are protected on application level requiring a x.509 based AuthN. Therefore the App Service is configured with "Client certificate mode == Allow" which leads to fact that app (App Service) will ask the client for a certificate. In case the client provides a certificate this will fetched by App Services and forwarded to the application via X-ARR-ClientCert HTTP custom header. But even the client sends no certificate the request is forwarded to application. This concept works very well and we can depending on path support different AuthN methods.

Due to security guidelines, we have now to place the Azure Application Gateway in between client and Azure App Service and need to find a way that above described behavior stays the same.

I searched the Microsoft documentation and Internet but was not able to figure out if there is a way to configure the App GW in same way the App Service works when it comes to client cert handling. Up to now I'm only able to activate mTLS by using aSSL profile, but this applies for the listener (complete domain) and requires the client to always send a certificate even when only requesting /public/... API endpoints.

So my question is if there is a trick to configure the App GW to behave the same as described above for App Service (Client certificate mode == Allow). Something like conditional (path based) mTLS?

Answer 1

Note that: As per MsDoc mutual authentication is currently possible only between the frontend client and the Application Gateway. Backend mutual authentication is currently not supported.

The “Client certificate mode == Allow” configuration in Azure App Service does not have an equivalent built-in feature in Azure Application Gateway. The App Gateway only supports mTLS (mutual TLS) authentication at the listener level, which means that it requires the client to always send a certificate for all requests to the listener and cannot be conditionally enabled based on specific paths.

App service built in front end it sends X-ARR-clientcert request header to the code running in app service the code does the validation and check the client cert info to determine you will get authenticated and authorized

Allow is less strict and Require will give you certificate, Allow as give your certificate with another way of authentication.

Configured listener and enabled SSl profile with intermediate certificate and test client certificate comes from trusted CA then rule will rewrite rule send the server value with client certificate via header to the App gateway.

To know more in detail, check the below references:

Overview of mutual authentication on Azure Application Gateway | Microsoft Learn

Configure listener-specific SSL policies on Azure Application Gateway through portal | Microsoft Learn