microsoft / microsoft/PowerPlatformConnectors
Custom connector traffic blocked by backend's WAF while Test tab and built-in HTTP action succeed (data.gov.ma)
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1.3k
- Forks
- 1.5k
- Avg merge
- 5d 15h
- Merged PRs (30d)
- 11
Description
Summary
A custom connector's backend calls fail specifically when executed through the custom connector's production Flow execution path, while the identical call succeeds via direct browser/curl access, the connector's own Test operations tab, and a built-in HTTP action inside the same flow. A diagnostic response-schema change confirms the failure body is the backend's own WAF block page, not a data or schema issue.
Environment
- Connector: Independent Publisher,
Morocco Open Data(data.gov.maCKAN Action API, mounted at/data/api/3/action, No Auth) - Environment ID, Tenant ID, and Subscription ID: redacted from this public issue — happy to provide directly to a Microsoft engineer working the case.
- Connector internal route:
new-5fmorocco-20open-20data-5f33a5b486ed68fe1a
Evidence
Direct call (curl, tested with several User-Agent strings including a Python-style one) to https://data.gov.ma/data/api/3/action/package_list → HTTP 200, valid JSON, every time, 5/5 consecutive tries.
Called via the connector's Test operations tab → succeeds, real data.
Called via a built-in HTTP action inside a flow, same URL → succeeds, real data, clean application/json response.
Called via the custom connector's action inside the same flow (List_dataset_names, then separately List_licences) → Flow reports:
The API operation 'ListDatasetNames' requires the property 'body' to be of type 'Object' but is of type 'String'.
Loosening the response schema to type: string as a diagnostic, to see the raw text Flow actually received instead of having it rejected by schema validation, revealed the actual body:
<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<br><br>Your support ID is: 2482531038446027970<br><br><a href='javascript:history.back();'>[Go Back]</a></body></html>
This is the backend's own WAF block page (F5-style signature) — confirmed to be the identical page returned separately for an unrelated malformed request earlier in the same build session, so this backend does run an aggressive WAF against certain traffic.
What this rules out
- Not a swagger/schema bug. The response schema and definitions are correct — confirmed by the built-in HTTP action returning a perfectly clean, correctly-typed JSON object for the same URL, same flow, same run.
- Not a User-Agent-based block. Tested
python-requests/2.31.0,Go-http-client/1.1,Microsoft-Flow/1.0,azure-logic-apps/1.0, an empty UA, and more, all succeed via direct curl. - Not backend flakiness. Direct calls succeed consistently; the connector-routed call fails consistently across retries, not intermittently.
Working theory
Custom connectors execute through Azure API Management's shared multi-tenant gateway, a distinct piece of infrastructure with its own outbound IP range, separate from the built-in HTTP action (which appears to route more directly through Flow's own compute) and separate again from whatever serves the Test tab. If the backend's WAF has blocked that specific shared IP range, every custom connector calling this backend from any tenant would see this failure, while manual testing and the built-in HTTP connector would not.
Ask
Can you confirm whether custom connectors route through a distinct, publishable outbound IP range separate from the built-in HTTP connector and the Test tab, and if so, what that range is? A stable, documented range would let connector authors ask a backend's administrators to allowlist it specifically, instead of guessing at the cause the way this report had to.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the data.gov.ma package_list call through the custom connector's production Flow action, the Test operations tab, and the built-in HTTP action, using the connector route new-5fmorocco-20open-20data-5f33a5b486ed68fe1a. Compare the responses and investigate the Azure API Management routing theory; done means confirming the distinct outbound range and documenting an allowlist recommendation, if applicable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- api, cloud, networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100