OWA Logging out problem - asks for password

[nogarap]

Hi,

I'm not sure if this should be in here or IIS. I've got a ex2003 OWA server. People access it fine, but when the log off button when they finish, they get a password prompt box. If they re-enter their credentials, they get logged off ok. If they click cancel, they get an 'access is denied' message, and the mailbox doesn't get logged off. If you use the back button in the browser, you can reload the inbox or whatever, and send emails, so as well as an annoyance, there's a security issue here as well.

I had a similar problem in the past, where the cause seemed to be configuration going awry. The fix for that one was to go to IIS Manager, default web site, exchweb, bin, properties, Authentication and Access, and re-entering the domain name into the domain and realm boxes. I've done this a couple of times today, but the error continues. I've stopped and started the website to no avail. DOes anyone know is this enough, or do I need to stop and start the actual services, rather than just restarting ISM and the website?

If anyone can shed any light, I'll be grateful as always.

Many thanks

Gaz

 

[nogarap]

Sorry about the garbled nonsense I put here later. I found the relevant KB article, called "You are not logged off when you click "Log Off" in Outlook Web Access on a front-end server that is running Exchange 2003 or Exchange 2000"

http://support.microsoft.com/kb/927907

, which says it better than I could. Anyway, they suggest 2 solutions, workarounds: the one I mentioned earlier, and the other one to check perms on the logoff.asp page. My file permissions were in order, and I've got basic authentication set. So, I'm stuck now. My knowledge of IIS and reading IIS logs is next to nothing, so as always thanks in advance for any help or advice.
Gaz

 

[nogarap]

I'm still having this problem, rebooted the server, still asks for a username/password when you hit the logoff button.
If I enable anonymous access on the bin folder, everything works, but anonymous access scares the life out of me! Some things I've seen say to enable, and some don't. Basically, how safe/unsafe is anonymous access on an OWA server?

This article deals with a different issue (

http://support.microsoft.com/kb/327843

), but mentions enabling anonymous access. Confused!

Many thanks, starting to worry here!

 

[xmsre]

sounds like you have NTLM (integrated) authentication enabled. That's an invalid configuration. The FE just proxies the request to the BE, so make sure you check the setting on both the FE and BE.

 

[nogarap]

Hi xmsre, thanks for the suggestion. Unfortunately, that wasn't it. I've bitten the bullet, and enabled anonymous access to the bin folder. It's all working now.