When access OWA I receive a strange response. OWA prompts for user name and Password, but then rejects them as invalid. If I then click refresh OWA appears and works properly. Why would the server reject the username and password but then allow the user in if the page is refreshed? Strange. Any ideas? Thanks.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations TouchToneTommy on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
OWA
- Thread starter parker309
- Start date
- Thread starter
- #3
Are you using a HTTPS connection (SSL certificate)?
If so your OWA web site should be configured for Basic Authentication only. Chances are you have both Basic and Windows Authentication enabled. The Windows Authentication is failing over http(s).
(To check use IIS snapin to access properties of OWA page, Directory Security tab, Edit Anonymous Access and Authentication Control). Uncheck Windows Authentication.
Keep in mind, if you aren't using HTTPS you shouldn't be using Basic Authentication as this means your users are transmitting passwords in clear text over the internet. In other words if you don't have an SSL certificate on the OWA server you shouldn't be accessing it over the internet.
If so your OWA web site should be configured for Basic Authentication only. Chances are you have both Basic and Windows Authentication enabled. The Windows Authentication is failing over http(s).
(To check use IIS snapin to access properties of OWA page, Directory Security tab, Edit Anonymous Access and Authentication Control). Uncheck Windows Authentication.
Keep in mind, if you aren't using HTTPS you shouldn't be using Basic Authentication as this means your users are transmitting passwords in clear text over the internet. In other words if you don't have an SSL certificate on the OWA server you shouldn't be accessing it over the internet.
- Thread starter
- #5
Sorry to be so long getting back to you. This MS TID gives a lot of basic information about using SSL with the virtual server component of the OWA system.
Just realized the previous document doesn't actually tell you how to generate a http certificate request. Go to the properties of the virtual server you're using for OWA - probably the default for if you aren't hosting any other sites on your server.
In IIS Manager right click on the virtual server, select properties and go to the Directory Security tab. Generate the cert request using the Server Certificate button. You want the certificate issued in the fully qualified name that external users type into their browser to get to OWA.
You send the req along with the necessary $$ to a third party issuer like Verisign. When you get your certificate you install it by going back to the Server Certificate button in IIS Manager as above. Just push the button and point the wizard to your new certificate when asked.
When that's done you'll want to force all access to SSL using the following method.
In IIS Manager right click on the virtual server, select properties and go to the Directory Security tab. Generate the cert request using the Server Certificate button. You want the certificate issued in the fully qualified name that external users type into their browser to get to OWA.
You send the req along with the necessary $$ to a third party issuer like Verisign. When you get your certificate you install it by going back to the Server Certificate button in IIS Manager as above. Just push the button and point the wizard to your new certificate when asked.
When that's done you'll want to force all access to SSL using the following method.
- Status
Similar threads
- Locked
- Question
- Locked
- Question