Azure / Azure-Governance-Visualizer

Azure Governance Visualizer aka AzGovViz is a PowerShell script that captures Azure Governance related information such as Azure Policy, RBAC (a lot more) by polling Azure ARM, Storage and Microsoft Graph APIs.
MIT License
92 stars 24 forks source link

Unable to browse the web app #28

Open MichaelBrankinBOE opened 8 months ago

MichaelBrankinBOE commented 8 months ago

AzGovViz version 6.3.7

Describe the bug This seems to be working for me, I am able to generate the html file and view the required information, but when trying to browse the web app, I am prompted to sign in, and when I do I receive this error - 'The page cannot be displayed because an internal server error has occurred.' Interestingly, I am not prompted for MFA, even on a private browser which I'm unsure if anyone else experiences the same?

jtracey93 commented 8 months ago

@Julianhayward and @sebaseem any ideas here?

JulianHayward commented 8 months ago

@MichaelBrankinBOE some questions:
how did you deploy the webApp? Did you use the accelerator or did you follow the setup guide?

Before publishing the html file to the webApp the pipeline checks if authentication is configured.

Are you running from Azure DevOps or GitHub?

MichaelBrankinBOE commented 8 months ago

I deployed the webApp using the accelerator guide, and I'm deploying it via GitHub.

jtracey93 commented 8 months ago

tagging the correct @sebassem

sebassem commented 8 months ago

@MichaelBrankinBOE Do you get any errors/warnings if you browse to the authentication tab of the web app ?

MichaelBrankinBOE commented 8 months ago

@sebassem Nope, no errors in the authentication tab for the web app.

sebassem commented 8 months ago

@sebassem Nope, no errors in the authentication tab for the web app.

Can you share a screenshot from the tab? Also a screenshot from the "Expose an API" tab for the web app service principal. I just did a deployment and could see AzGovViz after being authenticated.

MichaelBrankinBOE commented 8 months ago

I have attached the requested info, please note that the error in red just relates to my account not currently having permissions to amend the service principal settings.

sebassem commented 8 months ago

I have attached the requested info, please note that the error in red just relates to my account not currently having permissions to amend the service principal settings.

sorry Michael, I don't see the attachments, can you paste the screenshots in the chat ? During the pre-requisites, we need to change the service principal settings for this to work, did you use a different account to configure them ?

MichaelBrankinBOE commented 8 months ago

Apologies, I think the attachments were blocked by restrictions on that laptop.

sebassem commented 8 months ago

Apologies, I think the attachments were blocked by restrictions on that laptop.

No worries, everything seems to be in place. I think you might have some Entra ID rules or CA policies applied blocking this. If you have time, try to create a new web app, configure Entra ID authentication and observe if you get the same behavior.

MichaelBrankinBOE commented 7 months ago

Hi, apologies for the delay in response, I had some other urgent priorities take precedence. I revisited the web app issue this week, and have found the cause of the problem - not relating to permissions at all, despite the error message.

The web app is trying to load up a web page named 'AzGovVizMG NAME.html'. Whereas when I look at the html file that is generated, it is 'AzGovVizTENANT ID.html'. Adding the correct html file name with the Tenant ID into the Default Documents of the Web App has fixed the issue. However, my repo is now failing when I run DeployAzGovViz.

Any ideas on how I can amend the repo to deploy the Web App with the correct html page in the Default Documents, or, how I can add the correct html page to the Default Documents of the Web App using the repo?

JulianHayward commented 7 months ago

@MichaelBrankinBOE in the ado pipeline / gh action the file gets uploaded to the web app, where the management group id is used for the filename e.g. 'AzGovViz_ManagementGroupId.html'. Can you please share more information like which azgvz version are you using and if you are on ado or gh? Please also share a screenshot form where you see that the MG Name is used. Thanks.

MichaelBrankinBOE commented 7 months ago

AzGovViz version 6.3.7 and using GitHub web app 2 web app 1

Attached are the screenshots, one showing it before I added the html containing the tenant name, and one after.

JulianHayward commented 7 months ago

is sandpit-cdp a mg id or a mg displayname? if you are executing azgvz for multiple mgs (I guess one for the tenant root mg and the other for sandpit-cdp) then make sure to define the default document for the one that is preferred. It may well be that I still don´t understand the actual issue :)

MichaelBrankinBOE commented 7 months ago

sandpit-cdp is the MG ID. I'm running azgvz to report on everything within the tenant. Apologies if I haven't been clear.

The issue is that when the Web App is created, it is trying to point to AzGovViz_sandpit-cdp.html which doesn't exist. When I check the App Service Editor for the Web App, I can see which HTML files exist for the Web App. The HTML file in there is the one including the tenant name, so in Azure I need to manually add the correct HTML name in the Default Documents for the Web App to load.

The problem is after manually adding the correct HTML name to the Default Documents section, the Web App works, but the repo now fails when I run it. So I feel that I either need to amend the repo to deploy the Web App with the correct HTML page name in the Default Documents (using Tenant ID, not MG ID), or, how I can add the correct HTML page to the Default Documents of the Web App using the repo?

JulianHayward commented 7 months ago

@MichaelBrankinBOE can you ping me on linkedIn, I think you need to show me as I don´t really get it :)

MichaelBrankinBOE commented 6 months ago

@JulianHayward no problem, I've just sent you a request to connect

MichaelBrankinBOE commented 6 months ago

@JulianHayward I haven't received a response yet, but I have re-created the web app and seem to have bypassed the error I was getting, however, when I run the repo it generates a rather large file (130mb) which causes it to error due to large file shares not being enabled. Is there a recommended way to reduce the file size? Enabling large files on GitHub is pretty pricy.

JulianHayward commented 6 months ago

@MichaelBrankinBOE sorry, should be connected now. Let´s take it offline.