OWA and Forms Based Auth.

[user125]

Quick question. I just enabled forms based auth. When we type in our username and pw and click log on.. another pop up comes up asking us to enter our username and password. Any ideas of what i may doing wrong?

 

[Bhavin78]

try to put domain\username and it should work.
to avoid user to put domain name you need to configure IIS.

 

[user125]

yes I used the domain\username.. What I'm confused about is.. it ignores the username/password thats enter and asked for the username and password in popup auth box. I have to enter the info twice in order to get in. I was told that its because I don't have ssl so I used the suggestion to add an entry into the registry to allow owa over non-ssl
and now even though i enter the username/pw w/ or w/o domain it just reloads the page.. Im lost.

 

[monsterjta]

Why are you using forms based auth without SSL? Doesn't this go hand in hand?

 

[58sniper]

Yes. You have to use SSL with FBA.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[Bhavin78]

try this if it helps
1) Create and installed Certificate using selfSSL

http://www.msexchange.org/tutorials/SSL_Enabling_OWA_2003.html

2)SSL Enabling OWA 2003 using your own Certificate Authority

http://www.msexchange.org/tutorials/Creating-Certificate-OWA2003-SelfSSL.html

3)Password change

http://www.petri.co.il/enable_password_changing_through_owa_in_exchange_2003.htm

 

[user125]

Bhavin78. Thanks a billion. That worked and now I'm finally able to test this thing out.
Got a question though. Considering its for OWA and only our internal users will be using it, what are the pros and cons of using your own CA vs using verisign. Is there anything that an auditing company would catch you for if you're authorizing your own certs for your own site?

 

[monsterjta]

Using a private CA is the way most orgs go. No need to use Verisign, or some other outside CA, unless your doing e-commerce and EVERY NEEDS to trust you.

Hope This Helps,

Good Luck!

 

[58sniper]

I would have to disagree with that. If you want your users to be able to get into OWA remotely, from ANY Internet connected PC, using a self signed cert isn't the way to go. A majority of my clients all use third party certs. From one man shops to 3000+ user shops.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[monsterjta]

And, why would one be able to use OWA from ANY Internet connected PC using a self signed cert?

Hope This Helps,

Good Luck!

 

[user125]

Well, I do want my users to get into OWA remotely from anywhere in the country. But whats the problem with using a self signed cert? We have roughly about 200 users. We've been using basic auth. owa and recently wanted to change to forms based. So anything is a big jump. We want the info encrypted but if I can avoid the associated costs with going with verisign, I'd prefer to go the self signed route. Unless you can convince me that, that is the wrong way to go.

 

[monsterjta]

My previous post meant to read:

And, why would one not be able to use OWA from ANY Internet connected PC using a self signed cert?

 

[58sniper]

You can. But the issue is that with a third party cert, there are no alert dialog boxes coming up (which just causes user confusion).

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[user125]

So what you're saying is, if I go with a self signed cert then I cant get rid of that annoying, "you are accessing a page with secure and non secure items, do you want to continue" crap?

 

[Bhavin78]

I agree with user125 there is nothing wrong using using self signed cert no matter how many users are accessing OWA, its still going to do job like verisign.

As 58snipper said, all the user will have pop up to agree on selfSSL but there is a work around on that. I think you can get rid of it with some script. Try and do some research and you might come up with something.

 

[user125]

ah... that blasted pop-up saying the site isn't secure is gonna be a pain in the ***. I looked around and seems like everyone is aware of the pop up but have no way of removing it.

 

[monsterjta]

user125,

you are accessing a page with secure and non secure items, do you want to continue

I don't think this is the message we're talking about here. I think what 58sniper is talking about is the certificate pop-up dialogue, asking if you want to continue.

If you're getting a pop-up stating that the site isn't secure, that's another story. This is possibly due to having the wrong CN on your cert.

What, exactly, is the pop-up window stating? If you don't mind, spell it out so I know what message you are receiving.

I use a self-signed cert for my OWA, and I never receive any security warnings or anything when I access the site.

Hope This Helps,

Good Luck!

 

[reynolwi]

What 58sniper is saying i think is that the problem with a selfSSL cert is that you will get an error message before the logon page with this message:

"There is a problem with this website's security certificate.
The security certificate presented by this website was not issued by a trusted certificate authority.
Security certificate problems may indicate an attempt to fool you or intercept any data you send to
the server.

We recommend that you close this webpage and do not continue to this website."

Now you can still continue to use it and there is an option to continue to the website (even though it says its not recommended). Granted yes that will confuse the users and they will probably be asking you questions. You dont specifically have to use Verisign. There are several other companies that are certification authorities such as GeoTrust, Thawte, GeoCerts, and several others but those are the major ones. GeoCerts gets theirs from GeoTrust at a good discounts which is given to the customer so they have affordable certificates, and since they are from GeoTrust you get support from them just as if you bought it from them.

If you dont need the SSL for anything else but OWA then you can get a basic SSL Certificate withup 256 bit encryption. GeoCerts has 1 for $99 for 1 year that will work for OWA.

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[user125]

was thinking of actually using one from godaddy.com They have a basic ssl cert for $20 i believe.

 

[58sniper]

I have a couple hundred certs from FreeSSL/RapidSSL and it's been great. It's under $100 for two years.

And yes, it will get rid of the popup warning (IE < 7) or the nasty warning (IE 7) that your users see.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt