This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Reverse Authentication / OWA Exchange 2013

Hi,

I´m been reading several posts from this forum trying to figure it out what i´m doing wrong - but unfortunatelly i didn´t had any success.

Basically, i´m configuring the OWA using the webserver protection, w/ reverse authentication.

What i´ve done:

a)Created the real webserver (https - port 443).

b)Created a firewall rule only making antivirus scan and selecting the "Pass  Outlook Anywhere" option.

c)Created two Virtual Webservers

  1. publish access to OWA and Autodiscover
  2. publish access to OA

d) Created two Reverse Authentication Profiles
   1. mode:"basic"
   2. Users/Groups: "Active directory Users"
   3. Real WebServer: "Mode": basic; "User name afix": "none"

Finally, on "Site Path routing" i´ve configured forms reverse authentication to OWA, ECP.
Basic reverse authentication to rpc.

On the exchange side (exchange 2013) on the IIS administration, i´ve configured the virtual directories of owa, ecp, rpc, autodiscover, EWS and OAB to accept basic authentication and also added the Default Domain.

What happens is that the access to owa, is made, get the forms authentication, and after a succesfull validation, instead of having access to the OWA, i´m redirected to the OWA authentication form from the exchange server.

i´ve gathered the logs both from the webserver protection and from the IIS logs to try to check:

IIS:

2015-02-18 12:37:19 ::1 POST /OWA/auth.owa - 443 HealthMailbox3055292aea5e43f1b9fc33f37a06ff6c@***x.pt ::1 AMProbe/Local/ClientAccess - 302 0 0 15
2015-02-18 12:37:19 ::1 GET /PowerShell/ - 443 - ::1 AMProbe/Local/ClientAccess - 401 111 0 31
2015-02-18 12:37:23 192.168.62.5 GET /owa - 443 - 192.168.xx.3 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 302 0 0 31
2015-02-18 12:37:25 ::1 GET /ecp/ReportingWebService/ - 443 - ::1 AMProbe/Local/ClientAccess - 302 0 0 15
2015-02-18 12:37:30 ::1 POST /autodiscover/autodiscover.svc - 443 - ::1 AMProbe/AutoDStack+(ExchangeServicesClient/15.00.0516.014) - 401 0 0 0
2015-02-18 12:37:30 ::1 POST /autodiscover/autodiscover.svc - 443 - ::1 AMProbe/AutoDStack+(ExchangeServicesClient/15.00.0516.014) - 401 1 2148074254 0
2015-02-18 12:37:30 ::1 POST /autodiscover/autodiscover.svc - 443 - ::1 AMProbe/AutoDStack+(ExchangeServicesClient/15.00.0516.014) - 401 1 2148074252 15

Webserver:

2015:02:18-12:37:15 utm reverseproxy: id="0299" srcip="62.169.76.217" localip="83.***.***.182" size="3070" user="-" host="62.169.76.217" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="19516" url="/owa/auth/logon.aspx" server="owa.***x.pt" referer="-" cookie="logondata=acc=0&lgn=internal.***x.pt\rui.fernandes; PrivateComputer=true" set-cookie="-"
2015:02:18-12:37:24 utm reverseproxy: id="0299" srcip="62.169.76.217" localip="83.***.***.182" size="140" user="-" host="62.169.76.217" method="POST" statuscode="302" reason="-" extra="-" exceptions="-" time="115686" url="/owa/auth.owa" server="owa.***.pt" referer="owa.***.pt/.../logon.aspx
sta

(Sorry for the long post)

This thread was automatically locked due to age.

0 PeterRL over 9 years ago

The "issue" was related to the fact that the basic authentication was not properly configured on the exchange side (it was only made on the virtual directories of the IIS).

Still having problems with ECP since, it is making necessary to re-authenticate again.
Cancel
Vote Up 0 Vote Down

Cancel
0 Holy over 9 years ago in reply to PeterRL

hi can you please give a step by step guide to configure proper basic authentication on exchange?

i configured it too for virtual directories...

The "issue" was related to the fact that the basic authentication was not properly configured on the exchange side (it was only made on the virtual directories of the IIS).

Still having problems with ECP since, it is making necessary to re-authenticate again.
Cancel
Vote Up 0 Vote Down

Cancel
0 lyrik over 9 years ago

Changing authentication method is easy. At least in Exchange 2013.

- Start Exchange Administration PowerShell on the Exchange machine.
- Enter the following commands. One at a time.
- run: iisreset /noforce

you can alter the different methods by changing the value from $true to $false - or the other way round.

for further Information please refer to: https://technet.microsoft.com/en-us/library/dd298108(v=exchg.150).aspx

Basic-Auth for external users through UTM and internel ones get single sign on with Windows Authentication:

Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $false -BasicAuthentication $true -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $true

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $false -BasicAuthentication $true -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $true

If you want to change the method with the Exchange Administration Center look here: Virtual Directories: Exchange 2013 - The Microsoft MVP Award Program Blog - Site Home - MSDN Blogs

hope that will help.

edit: don't Change any other virtual Directory than the mentioned above. use passthrough for others
Cancel
Vote Up 0 Vote Down

Cancel
0 lyrik over 9 years ago

i don't know whether this is still needed or can provide any further help, but i just made a little how to for utm and exchange2013 which worked for me. can't upload docx or pdf so i made a zip.

edit: this is way better than my description: http://sophserv.sophos.com/repo_kb/120454/file/Configuring%20UTM%20firewall%20for%20Exchange.pdf

How to publish Exchange 2013 with Sophos UTM.zip
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 9 years ago

Thanks for sharing

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 DavidMoffatt over 9 years ago in reply to Scott_Klassen

@PeterRL

Did you manage to get this to work at all? I'm having the same issue with ecp and owa. Once the user has logged into both owa and ecp, they can change between them no problem at all and don't get asked to re-authenticate.

Thanks

Dave
Cancel
Vote Up 0 Vote Down

Cancel