Forms-based authentication errors with OMA and ActiveSync

Please let others know how useful this tip is via the rating scale at the end of it. Do you have a useful Exchange or Outlook tip, timesaver or workaround to share? Submit it to SearchExchange.com. If we publish it, we'll send you a nifty thank-you gift.

You may experience several Event ID errors when using forms-based authentication with Exchange Server 2003 ActiveSync and Outlook Mobile Access (OMA). The errors on the client side usually consist of one of the following:

The last error occurs if a user tries to run Exchange Server ActiveSync. The others are also accompanied by Event IDs 1805 and 1507, respectively, in the Exchange server's event logs. The Exchange server may also log Event IDs 3029, 3030 and 3031 as well.

This particular annoyance buzzes out whenever you have the following conditions:

1. Exchange OMA is hosted on the back-end server of a front-end/back-end Exchange Server configuration.

2. The back-end /Exchange virtual directory in Internet Information Server (IIS) is configured to use Secure Sockets Layer (SSL).

3. Forms-based authentication is enabled -- this is when you enter your username and password via a Web form with several logon options, instead of through the pop-up dialog that is typically used for integrated user validation across a Web connection.

The /Exchange virtual directory can't be accessed by OMA and ActiveSync if it's hosted in this fashion. Forms-based authentication can only work through the Basic authentication method (the security for the process is supplied by the SSL connection itself); but ActiveSync's virtual directory can only connect to the Exchange Server virtual directory via Kerberos ...

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Exchange Server Administration Tips Remove Exchange 2003 objects from AD to install Exchange 2010 Don'ts for optimal Exchange 2007 mailbox server efficiency Is your Exchange 2007 hub transport server healthy? Avoid Outlook 2007 performance issues during repairs Developing an Exchange 2007 server role DR plan How DSAccess service improves Exchange Server 2007 reliability An introduction to the Exchange Remote Connectivity Analyzer tool Monitor Exchange 2007 with disk- and RPC-related counters DPM 2007 replica inconsistencies in Exchange databases Track Exchange 2007 mailbox server health using database counters Outlook and Outlook Web Access Tips Block Web beacons and protect OWA users from spam Outlook 2007 shut-down problems and fixes OWA 2007 configuration tricks to boost performance Pros and cons of Outlook 2007's storage engine redesign Lock down direct file access and protect OWA users Simplify an OWA URL on Windows Server 2008 Windows Mobile 6.5 touts Internet Explorer, OWA improvements Custom error message redirects OWA users When OWA's default configurations aren't good enough Save time typing Outlook 2007 messages with Quick Parts Mobile Devices Top 5 Exchange ActiveSync tips Windows Mobile 6.5 touts Internet Explorer, OWA improvements Windows Mobile 6.5 touts ActiveSync and Outlook Mobile improvements What are your options for sending text messages from Outlook 2007? Using Mobile Device Manager 2008 server roles in Exchange 2007 Understanding Exchange Server 2007 SP1 mobile security settings Synchronized Exchange mobile device showing deleted appointment Which ActiveSync authentication method is best for your mobile device? Disable ActiveSync in bulk with Exchange Management Shell commands Configuring ActiveSync authentication in Exchange Server 2007

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

(NTLM) authentication.

NTLM authentications cannot work over more than one system "hop." If you have a front-end to back-end connection with NTLM authentication somewhere in the chain, it'll only work if the front end does the actual authentication.

This is due to limitations in the way Kerberos tokens can be honored from machine to machine. So for front-end/back-end setups, the easiest and most "portable" authentication methods involve Basic authentication via SSL, which have no such restrictions. This particular problem is one of a number of different manifestations of this whole issue.

The most basic workaround is to place the /Exchange virtual directory on the front-end server, or disable forms-based authentication. If this isn't practical, there is another solution -- a detailed registry-change process documented in Microsoft Knowledge Base article 817379. In the long run, though, it's best to use a properly planned front-end/back-end topology whenever possible.

About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter.

I have had trouble with OMA and ActiveSync when running forms-based authentication (FBA) on ISA Server 2004. After changing FBA from ISA Server back to Exchange 2003 SP2, I haven't had any issues.

Do you know of a procedure or fix available to allow OMA and ActiveSync to work with Exchange when FBA is done on ISA Server?
—Todd R.

******************************************

I did a little digging and found a tutorial on ISAserver.org, "ISA Server 2004: Supporting Both Basic and Forms-based Authentication with a Single External IP Address and Web Listener," that talks about using forms-based authentication with ISA Server.

The single biggest problem appears to be that you cannot bind both a basic and FBA listener to the single IP address that ISA Server presents to the world at large. However, this article describes a clever workaround (essentially, creating a listener on the localhost address). It's implemented for OWA, but it might also work for OMA -- in fact, it should work with only minimal changes to the configutation, based on a read of the instructions.

Good luck, and if it works for you please let us know. It would be worth passing this on to others if it turns out to be what you need.
—Serdar Yegulalp, tip author

Related information from SearchExchange.com:

Reference Center: Exchange mobile and wireless tips

Rate this Tip To rate tips, you must be a member of SearchExchange.com. Register now to start rating these tips. Log in if you are already a member. Submit a Tip DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.