OWA Cross-Site Silent Redirection in Exchange 2010 SP2

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

NA — Sun, 05 Feb 2012 18:18:03 GMT

HI i have two internet facing CAS site and want to use a single owa url globally. What should i have InternalURL and ExternalURL value on both a CAS site so that if user access his mailbox his request redirect to correct and nearest CAS server.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Ross Smith IV [MSFT] — Sat, 17 Dec 2011 01:01:41 GMT

@Sly - Sorry for the confusion. With the Temporary Redirection scenarios I outlined above, only silent redirection will work. You still need to perform a second authentication. This has to do with the process used to detect that the mailbox database is no longer located in the same AD site as the RPCClientAccessServer value (this happens after the authentication is performed and thus we can't do the hidden post back to the browser).

Ross

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Greg Taylor [msft] — Sat, 17 Dec 2011 00:20:01 GMT

Sly, does the redirection take place? Does the user get sent to the CAS in the other AD site, but just not logged in? The redirection is no different, unless it's the temporary manual redirection that Ross refers to that you are seeing?

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

sly — Fri, 16 Dec 2011 16:35:16 GMT

I got the slient cross-site redirection to work without users having to re-enter their credentials when OWA is first launched. That's great!

Now, I was expecting this slient cross-site redirection with single sign-on to work during cross-site failovers as well...Howerver, my tests show that the redirection does take place but the user is presented with the logon screen. Is there a way to get the single sign-on to work for cross-site failovers?

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Greg Taylor [msft] — Thu, 15 Dec 2011 19:21:35 GMT

Mike, the 451 isn't impacted by any of the changes this feature added, just to make that clear.

Do you have externalURL set on both AD sites correctly? The CAS sending the 451 should provide the correct externalURL within its stream. Have a look in the IIS logs for the CAS you are trying to be redirection from, not to, away from. That's the guy generating the 451. Also look at the app event logs too.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Mike C — Thu, 15 Dec 2011 19:13:35 GMT

I'ge got this working great with OWA.

Problem I'm having is that active sync chokes on the 451 redirect. I put a thread in the Exchange > Mobility forums but haven't gotten any feedback.

Have you been able to get Silent Redirect working on Active Sync? Doc says it works ( technet.microsoft.com/.../bb310763.aspx ) but I can't get it to function. Even Remote Connectivity Analyzer chikes on it:

A Web exception occurred because an HTTP 451 - 451 response was received from Unknown.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Greg Taylor [msft] — Thu, 15 Dec 2011 15:33:44 GMT

Ok, so if you don't have any custom transport agents and there's nothing else unusual, I'd open a case and get to the bottom of it rather than revert to SP1, else you'll never really solve it, and if you can't repro it you'll be stuck. Give support a call and they can help you trace messages through transport (you can do it yourself if you know how) and see what is causing the delay.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Chris — Thu, 15 Dec 2011 13:26:17 GMT

@Greg: No, I haven't put antivirus on the new server yet. We use Forefront on the other two.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Greg Taylor [msft] — Thu, 15 Dec 2011 02:14:20 GMT

@ Chris, do you have any AV software running on those servers? Are they validated for SP2 if so? We haven't heard of issues like this, and it sounds to me like some transport based agent is having trouble. Transport AV scanning might be a good candidate to look at if you have it.

@ David - yes, it's hard, but we have no plans to redirect to internal or external based on source IP, so your options are, use split DNS, so hte external names resolve internally, and then use the FBA feature the same inside and out - send everyone to one site/url and then redirect/SSO to wherever they need to be. Or, use DNS to try and get people to their closest CAS right from the start, tricky, but possible. You know, Windows has location aware DNS built in, it's called subnet mask ordering I think. If the clients and the CAS you want them to use are in the same subnet, windows DNS will return the IP close to the user if it has several. Take a look at that.

re: OWA Cross-Site Silent Redirection in Exchange 2010 SP2

Bob — Wed, 14 Dec 2011 18:00:02 GMT

Great article and feature Ross!!! Thanks!!!