I’m looking at ways to put internal web apps behind enterprise sign-in without changing each app. How well does AWS ALB authentication with Entra ID work, and what alternatives or gotchas should I consider?
Can ALB and Entra ID add SSO to apps that lack it?
Asked by
V5+Gasket
Answers
ALB authentication can be a practical fit when the app is already behind an AWS Application Load Balancer and you mainly need to restrict access to signed-in users. It can move the OIDC sign-in step out of the app, so the app itself may not need SSO support.
Check how the app behaves behind a proxy, especially its handling of forwarded headers, redirects, cookies, and any direct access path that could bypass the ALB. Also test sign-out and access removal rather than assuming they work exactly as desired.
Reply to this answer
If this is an AWS-hosted service, keeping authentication at the ALB can be a straightforward choice. If it sits elsewhere, or you want one access layer across several environments, compare it with a dedicated access proxy or identity-aware gateway before committing.
Cloudflare Access, Azure Application Proxy, OAuth2 Proxy, Keycloak, and Ory components came up as alternatives. They differ in where they run and how much identity-provider flexibility or operational setup they offer, so the best fit depends on your infrastructure.
Reply to this answer
The part I’d plan carefully is user management. A proxy can protect the front door, but it does not automatically replace accounts the application already keeps internally. You may still need to manage those accounts, roles, and permissions separately.
Before rolling it out widely, verify that users cannot reach the app around the proxy, and decide how authorization maps to the app’s own access controls. SSO answers who signed in, but it may not answer what they’re allowed to do inside the tool.
Reply to this answer
Keycloak can make sense if you want to centralize identity integrations and support multiple upstream providers, though it adds another service to operate. A lighter proxy may be enough if the need is simply to validate sign-in and pass a trusted identity to an app.
Whatever you choose, test the exact app and deployment path. An authentication layer that works for one simple web interface may not cover every app’s API calls, websockets, or unusual login flow.
Reply to this answer
Add your answer
Answers are reviewed before publication.
V5+Gasket:
That distinction helps. I’ll check whether the apps have their own roles and whether any routes can be reached without passing through the ALB.