RE: Can't publish OWA web page - No signature found error

Michael Altynikov — Fri, 18 Aug 2017 09:26:36 GMT

Hi Bob,

Yes, Form hardening option is unchecked for this WAF profile ... and after adding "/owa*" exception the logging form began to appear. WAF probably does know how to handle form' url that looks like that "/owa_xxxxxxxxxx_form.."

RE: Can't publish OWA web page - No signature found error

BAlfson — Thu, 17 Aug 2017 12:03:32 GMT

Have you tried to skip form hardening for that Virtual Server?

Cheers - Bob

RE: Can't publish OWA web page - No signature found error

Michael Altynikov — Tue, 15 Aug 2017 13:45:03 GMT

Well, all OWA WAF rules have been set exactly according to that manual .. By the way, ActiveSync, that sat in the same WAF rule works fine .. autodiscovery rule - works too ..only OWA web page - does not ... :(

Update: After adding additional exclusion like that "/owa*" the sophos default login form is finally start to appear when hitting https://owa.domain.com/owa page .. but after entring login credentials popups a new window with login to owa web server ... Probably, there is a reverse auth problem... Still looking :)

Update2: After playing with URL hardening exceptions and Reverse Auth profiles here what I have found (Sophos Firmware version is 9.502-4):

1. All OWA Sophos manuals define some URL exceptions to set, but in my case I needed to add one more URL exception "/owa*" (all manual says you only need "/owa/*" exclusion to work )

2. After solving the problem of utm' frontend form authentication I have faced another problem - the backend auth to exchange server in case of OWA webpage account did not work (but ActiveSync and autodiscovery services work fine at that time). In my case there were 2 Reverse auth profiles (as it was written in OWA Sophos manual) one for form based and another for basic authentication method.

In my case in the basic method form I have an Active Direct auth on fronend and basic on Real server backend with Suffix like "domain.com". In that case the UTM form worked good, but the backend auth did not worked and the CAS server asked for login credential again... Long story in short - I have created another Reverse auth profile with different Domain Suffix like "@domain.com" .. for /owa and /ecp site path routes, and finally OWA webpage start to work properly.

So, maybe its a bug of reverse proxy mechanism?

Regards,

Michael

RE: Can't publish OWA web page - No signature found error

Shaun Raven — Tue, 15 Aug 2017 09:15:26 GMT

Hi.

I suggest checking your method against the one found here, which works fine.

https://networkguy.de/?p=998