Cloud Decoded

Sometime ago, I wrote an article about how to achieve http to https redirection in Azure hosted VMs. That solution is still applicable if your Azure environment was built using Classic model and is using Cloud Services.

Things are a bit different in Azure Resource Manager model and that’s for good, as it has become even easier to achieve the same.

Problem Statement

Let’s take a relook at what we are trying to solve here.

1. You have web application (let’s say SharePoint, but this solution is valid for any other web application as well) hosted in Azure VMs, build using Azure Resource Manager (ARM).
2. Azure Load Balancers are used to route the incoming users’ requests to the VMs hosting your application.
3. You have users accessing your web application from within the company network as well as Internet.
4. Everyone should access the sites over HTTPS only, including from within office network to avoid any security issues, since content is now hosted outside organization’s firewall in an external data center.
5. You want the HTTP to HTTPS redirection working. Means, if any user tries to access your web site over http, it will automatically get redirected to https.

Initial Thoughts

So, how to achieve this? I guess the initial thoughts would be to just add 2 load balancers in Azure

• One External Load Balancer with Public IP – for users coming over internet
  • Rule 1: port:80, backend port: 443 – so that all http requests get redirected to https
  • Rule 2: port 443, backend port: 443 – so that all https requests remain on https
• One Internal Load Balancer with Internal IP – – for users coming over company network
  • Rule 1: port:80, backend port: 443
  • Rule 2: port 443, backend port: 443

Smart, right… seems like not so, as

• You can’t add same backend port in 2 rules
• You can’t add same backend port even in 2 different load balancers!

If you try to configure like this, Azure portal will throw an error and these configurations won’t get saved.

So, we need to look for some workaround, right.

Solution

Internal Load Balancer:

Step 3:

•  Now, you can go ahead and configure your External load balancer rules
  • Rule 1: port 443, backend port: 443 – so that all https requests remain on https
• Repeat this for Internal Load balancer
• This time Azure will accept the rules and your site will be accessible over https from over LAN and Internet both.

Step 4:

Now it’s time to look into how we can redirect users accessing the application over http to https.

We need to make use of Azure Load Balancer + URL Rewriting module of IIS to make this work.

• Create an Empty Web Site in IIS on some random unused port, say 7780, with the same host headers as of your web application and map it to any folder.

• Allow port 7780 in Inbound Windows Firewall rule, if that’s enabled
• Add a web.config file in the root folder of this new IIS web site with following content

And we are done, now all your users accessing over Internet or company LAN, will always get redirected to https regardless of whether they are typing http or https.

Enjoy,
Anupam