Force consent page before OWA 4

[yesti]

Hi, we have a webpage setup that users hit before OWA that has a consent banner, then forwards them to the

http://owaserver/exchange

page. However, if a user manually types in the URL to the OWA site then they bypass the consent page. Is there a way to configure the server so that if they try the direct link they are forwarded to the consent page? Both pages are hosted on the OWA server. Thanks!

 

[58sniper]

I think you'd have to edit the code for the logon page. But this would be troublesome, since just about every hotfix, update, and service pack overwrites that page. So you'd have to re-edit the page.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[smah]

My webserver experience (other than OWA) is with linux & apache, so I can't provide any specific details however, in concept OWA is just a service being served by a IIS web server from a particular directory.

With apache it is quite easy to protect a directory's content by checking the referrer (the page a user is coming from). I assume that IIS must have similar capability but I don't know what it is. I suspect someone in forum41 could provide more insight about that part.

If this 'protection by referrer' is possible, make sure that you consider the ramifications. For example, if remote users are syncing their PDA's/Smartphones via OWA, this sort of protection would cause problems.

 

[SteveRoadWarrior]

The standard web based authentication screen will stop any user before they access the exchange system. I wouldn't edit the Exchange permissions much from the norm.

A low tech way would be to edit the images which adorn the login screen (keeping size and resolution the same) if your agreement message is short. At least you can say that by logging in they agree to terms. That may be enough to keep your legal team happy.

 

[baddos]

It's possible you could look into an ISAPI filter that would reject requests that do not have a referal from your consent page. That would probably fubar any windows smart phones you have though.

 

[yesti]

Thanks all for the quick replies. I'll forward the information on and see what the plan is. Much appreciated.