mystyleit

How to configure Forms-Based Authentication in Exchange Server 2003 OWA

By default, Outlook Web Access (OWA) is setup to use Basic Authentication. Best practice is to configure MS Exchange 2003 to use Forms-Based Authentication (FBA) over Secure Socket Layer (SSL). This document outlines the procedure for setting up FBA over SSL start to finish.

Installing a Stand-alone Root CA

A Microsoft Certificate Server can take on one of four roles:

• Enterprise Root CA
• Enterprise Subordinate CA
• Stand-alone Root CA
• Stand-alone Subordinate CA

For our purpose, we will install a self signed Stand-alone Root CA

A self signed Stand-alone Root CA requires that Internet Information Services (IIS) be installed.

1. Click Start, point to Control Panel and click Add/Remove Programs.
2. In the Add or Remove Programs window, click the Add/Remove Windows Components button.
3. In the Windows Components dialog box, click on the Certificate Services entry and click the Details.
4. Check off Certificate Services CA checkbox, note the warning about changing the machine name and click the Yes button.
5. Ensure that both Certificate Services CA and Certificate Services Web Enrollment Support checkboxes are checked. Click OK in the Certificate Services dialog box.
6. Select Stand-alone Root CA
7. Enter the machine name as the Common Name and click next.
8. Accept the default certificate database locations.
9. Click Yes on the Microsoft Certificate Services dialog box informing you that Internet Information Services must be stopped temporarily.
10. Click Finish on the Completing the Windows Components Wizard page.

The standalone Certificate Server is now ready to accept certificate requests.

Creating a SSL Certificate for OWA

The CA must issue us a certificate to use for the OWA portal. In order to get the certificate we must:

• Create a certificate request.
• Submit the certificate request.
• Approve the certificate.
• Download and install the certificate.

Creating a Certificate Request

1. Open IIS Management Console and expand Web Sites.
2. Right click on Default Web Site and select Properties.
3. Select the Directory Security tab.
4. Click the Server Certificate button.
5. Click Next.
6. Click Next again to accept Create a new certificate.
7. Select Prepare the request now, but send it later and click Next.
8. Click Next to accept the default name and bit length for the certificate.
9. Fill in appropriate values for Organization and Organization unit.
10. For the Common Name, type in the DNS name that will be used to connect to the OWA server, usually mail.domainname.com.
11. Fill in appropriate values for Country, State/province, and City/locality.
12. Click Next to accept the default request file location, C:\certreq.txt.
13. Click Next to confirm options.
14. Click Finish to close the Wizard.

Submitting the request to the CA

1. Browse to the web console of your Stand-alone CA using http://servername/certsrv
2. Click Request a certificate
3. Click advanced certificate request.
4. Click Create and submit a request to this CA.
5. Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file..
6. Open C:\certreq.txt in notepad and copy all the text into the Saved Request field.
7. Click Submit.

Approving the Certificate

1. Click Start, click Programs, click Administrative Tools, and click Certification Authority.
2. Expand the server and click Pending Requests.
3. Right click the pending request and click Issue.

Downloading and installing the certificate

1. Browse to the web console of your Stand-alone CA using http://servername/certsrv
2. Click View the status of a pending certificate request.
3. Click the link to download the certificate.
4. Download the certificate as a *.cer file
5. Open IIS Management Console and expand Web Sites.
6. Right click on Default Web Site and select Properties.
7. Select the Directory Security tab.
8. Click the Server Certificate button.
9. Click Next.
10. Click Next to accept Process the pending request and install the certificate.
11. Click Browse and navigate to your downloaded certificate file and click Next.
12. Click Next to accept the default SSL port as 443.
13. Click Next to accept.
14. Click Finish.

Your IIS certificate has now been created and installed for the Default Web Site.

Installing the certificate to OWA

1. In Internet Services Manager, in the console tree, expand servername (your local computer), and then expand Web Sites, then expand Default Web Site.
2. In the console tree, right-click the Exchange virtual directory, and then click Properties.
3. In the Default Web Site Properties dialog box, on the Directory Security tab, in the Secure communications area, click Edit.
4. In the Secure Communications dialog box, click the Require secure channel (SSL) check box, click the Require 128-bit encryption check box, and then click OK.



5. Keep clicking OK until you are completely out of the Properties dialog boxes, then close IIS.

Enabling Forms-Based Authentication

After configuring SSL on the OWA site, you now need to enable the Forms-Based Authentication on the HTTP Virtual Server in Exchange System Manager.

1. Open Exchange System Manager.
2. Navigate to your server object.
3. Expand your server object, and expand Protocols.
4. Expand HTTP.
5. Right-click on the Exchange Virtual Server and select Properties.
6. On the Settings tab, click to select the Enable Forms Based Authentication check-box.
7. Click OK, and click OK to dismiss the warning message.
8. Restart the IIS services either from the Services snap-in or from the IIS Admin snap-in.

By default, Forms-Based Authentication requires users enter their usernames as DOMAIN\USERNAME. To change this default behavior set the following:

FBA over SSL for OWA setup complete.

References

1. http://www.petri.co.il/configuring_forms_based_authentication_in_exchange_2003.htm
2. http://www.petri.co.il/configure_ssl_on_owa.htm
3. http://www.isaserver.org/img/upl/vpnkitbeta2/installstandaloneca.htm
4. http://www.msexchange.org/tutorials/OWA2003Forms-based-Authentication-default-domain.html