provtest AllAboutHMC.xml : Hosted Office Communications Server 2007

Hosted Messaging and Collaboration Knowledge Base Articles

kip.ng — Sat, 26 Sep 2009 01:58:00 GMT

This page used to provide just the HMC related updates but now it has been updated to provide the specific product service packs, rollup updates, hotfixes that have been tested by the HMC product group. With this, I will no longer provide any quarterly...(read more)

Troubleshooting HMC OCS’s Address Book Segregation

kip.ng — Mon, 20 Jul 2009 20:43:00 GMT

HMC 4.5 has been out for a while now. We are beginning to see more and more people deploying OCS into the HMC environment as the concept of using IM as one of the corporate communication tools getting better acceptance.

One of the most common issues when setting up the OCS in HMC is configuring the address book segregation. To be honest, that’s really the only major customization you need to do to have OCS in HMC environment. If you want to know more about what are the customizations we have in HMC, you can refer to my previous blog, HMC 4.5 and Office Communications Server 2007.

In my previous blog, I talked about the address book segregation customization introduced by HMC into the OCS 2007 on a very high level. Here, we will take a closer look at the mechanism, how it should work and what are the things to look at if it doesn’t work.

1. Address Book Generation or Synchronization.

So, firstly, in order for you to have address book segregation, obviously you need to have different address book for different organizations, just like Global Address List in Hosted Exchange. Once you have completed the installation of the OCS servers, by default, it generates one address book. Think of it like the Default Global Address Book in Exchange. Now, we really don’t want that. If you have that, you should delete those to avoid confusion.

Go to the server where you have your OCS address book, such as \\OCSPOOLWEB01\ABS

If there are files there, you should remove them all.

Then by following one of the deployment steps in HMC deployment guide, Procedure W08-DWHO.66: To enable Address Book Isolation, to be specific, you will use a tool called ABSConfig.exe from the OCS 2007 ResKit and through WMI to enable the feature called Partition ABS data by Organizational Unit and create individual ABS files per OU.

Essentially, with this option enabled, when the OCS tries to perform the address book synchronization, it will generate address book based on OU instead of everyone in one big address book. So, if you want to find out if the address book generation is working accordingly right now (assuming you currently have sip enabled users in your environment), look at the ABS output location. It should have a structure following your domain OU like the following,

\\ OCSPOOLWEB01

\ABS

\fabrikam.com

\Hosting

\ConsolidatedMessanger

\AlpineSkiHouse

*.dabs

*.lsabs

\Tailspin

*.dabs

*.lsabs

If it does not have any of the OU structure and just have the plain .lsabs and .dabs files in the root of ABS folder, then it probably means the feature has not been activated.

You can force a call to generate or synchronize address book by calling the following,

C:\Program Files\Microsoft Office Communication Server 2007\Server\Core>ABServer.exe -syncNow

Of course, if you have absolutely zero sip enabled users in the environment then nothing will be generated.

2. Address Book Redirection

Once the address book has been generated, of course the next thing is to make sure that it should redirect to the user to the appropriate address book according to the location of the user. This is documented in the following steps, Procedure W08-DWHO.68: To enable redirection on the external Address Book Website.

Now, here I want to highlight a couple of things which I think has kind of being left out in the deployment guide.

a. Configuring Redirection. The deployment guide only request you to configure web.config file in the C:\Program Files\Microsoft Office Communications Server 2007\Web Components\Address Book Files\Ext\Handler

This is the External handler. This handler will be used only if the connection is through external (based on the configuration of the Office Communicator client). This is where sometimes things get slightly confusing because when you are setting up stuff, you tend to try connecting through the internal server name and that will trigger the internal handler instead.

So, if you may actually want to configure the internal handler as well, which is the web.config file in C:\Program Files\Microsoft Office Communications Server 2007\Web Components\Address Book Files\Int\Handler

So, once all these have been setup, when you try to download the address book from Office Communicator, it will send you to the IIS location containing the address book. Authentication will take place and based on the authentication, it will redirect you to the appropriate path containing the address book. If you look at the IIS log, you find something like the following,

2009-06-05 10:14:04 W3SVC1 192.168.45.20 GET /Abs/Int/Handler/D-0c03-0c04.lsabs - 443 - 192.168.45.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+MS-RTC+LM+8) 401 2 2148074254

2009-06-05 10:14:04 W3SVC1 192.168.45.20 GET /Abs/Int/Handler/D-0c03-0c04.lsabs - 443 HMC45\johnc_AlpineSkiHouse 192.168.45.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+MS-RTC+LM+8) 302 0 0

2009-06-05 10:14:04 W3SVC1 192.168.45.20 GET /Abs/Int/Files/hmc45.com/Hosting/ConsolidatedMessenger/AlpineSkiHouse/D-0c03-0c04.lsabs - 443 HMC45\johnc_AlpineSkiHouse 192.168.45.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+MS-RTC+LM+8) 200 0 0

Note: See how Communicator will first request for /Abs/Int/Handler/D-0c03-0c04.lsabs and then authentication happened and when it finally got authenticated, it got redirected (302) and it goes to /Abs/Int/Files/hmc45.com/Hosting/ConsolidatedMessenger/AlpineSkiHouse/D-0c03-0c04.lsabs.

b. Configuring Application Pool account. Now, everything is in IIS and the redirection happens in IIS through an application pool created by OCS installation.

If you note the IIS log above, you will find that the Office Communicator client isn’t the one that will send you to the exact path but it was the application pool that is serving the directory that figures out which path to redirect you to.

If you right click at the application pool (LSGroupExpAppPool) in the IIS, you will find the identity running this pool is RTCComponentService.

This is important, in order for the redirection to work; the RTCComponentService must have the appropriate permissions to know where those accounts are from (when they authenticate). By default, this account has no permission to the Hosting container in HMC because of how we harden the Hosting container. Hence, in order for it to work, RTCComponentService should be part of the Windows-based hosting Service Accounts. If it is not there, you need to add it to the group and then restart the IIS.

c. ABS location and connection.

The last thing to check is how the IIS able to connect to the address book file share. If you look at the Abs\Ext\Files properties in IIS Manager, you will find that it is pointing to a network directory for the ABS. Click on Connect As button to find out what user it is using to connect to the file share. It is important to make sure that the password for that user is correctly set AND also that the account has not been disabled or locked out.

3. Quick Tests using Internet Explorer

To find out if the redirection is working.

a. Find out a .lsabs file in the ABS folder, say in

\\OCSPOOLWEB01\ABS\fabrikam.com\Hosting\ConsolidatedMessanger\AlpineSkiHouse\F-0b72.lsabs

b. Then go to the web site where your address book is being published, say, https://web.consolidatedmessenger.com/Abs/Ext/Handler/F-0b72.lsabs

c. It should prompt you for user name and password. Enter a sip enabled user in the AlpineSkiHouse.

d. It will then redirect you to https://web.consolidatedmessenger.com/Abs/fabrikam.com/Hosting/ ConsolidatedMessenger/Alpineskihouse/F-0b72.lsabs and allow you to download the file.

e. If it doesn’t work, then check the IIS log to find out why.

What's going on to group expansion in HMC 4.5 Office Communications Server (OCS)?

kip.ng — Wed, 15 Jul 2009 18:18:00 GMT

When you are using Office Communicator, one of the nicest features (in my opinion) is the capability to add a group and expand it in the contact list. This feature really makes organization and group of contacts more consistent throughout the company. Unfortunately, this feature didn’t make it into HMC 4.5. As a result, while you still can add group, when you try to expand it, you will see the following message,

Use of this group is restricted. Contact your system administrator to request the required permissions.

I did a bit of investigation and found that the primary reason is because the logon user does not have the appropriate AD permission on the Group object, hence it failed to expand the group and resulting in the error shown above.

In my investigation, I also found a quick work around; however, you will have to manually do it. Of course, knowing how smart some of you are, you can probably and easily whip out some clever scripts or to enable the group to be allowed for group expansion in OCS.

This is what you can do,

a. Go to the Group object that you want to expand
b. Open up the security
c. Go to the Advance
d. Add AllUsers@<company domain>
e. Just add "Read Permission"

Once added, voila, any logon user in that organization will be able to expand the group object.

HMC 4.5 and Office Communications Server 2007

kip.ng — Tue, 20 Jan 2009 10:12:00 GMT

Introduction

I have blogged about Hosted Exchange as well as Hosted Windows SharePoint Services so far and I think it is only fair that I should write a little bit about Hosted Office Communications Server 2007 (OCS) as well. My primary focus will be more on what HMC has introduced to a default OCS deployment for multi-tenant enablement.

What is multi-tenancy and what does it mean to OCS?

I had this in my previous post but I thought it will be nice to restate this. From Wikipedia, "Multitenancy refers to a principle in software architecture where a single instance of the software runs on a software-as-a-service (SaaS) vendor's servers, serving multiple client organizations (tenants)."

When we introduce HMC into OCS, it is about enabling OCS to service multiple tenants in that same infrastructure. Now, the good news is this, although like Hosted Exchange, there are various client applications for Hosted Office Communications Server 2007 (such as Microsoft Office Communicator 2007, Microsoft Office Communicator Web Access, Microsoft Office Communicator Mobile and Microsoft Office Live Meeting client), there are not heavy amount of changes required to be made on the infrastructure to enable it for multi-tenants.

Before we look into what it means by enabling OCS for multi-tenant, let’s quickly look at what are the primary services offered by Hosted OCS 2007, as written in the help file,

· Instant Messaging (IM)

· Group IM

· PC-Based Audio and Video Conferencing

· PC-Based Web Conferencing

As with the rest of the products in the HMC solutions, OCS’s default deployment is designed primarily for a corporate environment. In order to enable it for multi-tenant, we need to introduce a few changes to it so that there are appropriate isolation and segregation. From a very high level, here are what HMC intends to achieve,

· Contact Tenant Isolation – In a default OCS installation, domain users are allowed to search each other without restriction. That is obviously a problem in a hosted environment. Hence one of HMC’s goals is to make sure that proper contact tenant isolation is achieved.

· Address Book Isolation - Each company should only be allowed to access the address book that is meant for their company only. However, they should not be restricted from adding users from all other companies or even users using public instant messaging like AOL, MSN or Yahoo.

· Web Meeting and Conferencing Settings – Different organizations will obviously have different meeting and conferencing settings. Hence it is important to ensure that the enforcement is executed either on a per organization basis or per user basis.

· Presence Information Isolation – OCS provides the infrastructure to enable client applications to publish and subscribe to extended, or “enhanced,” presence information. The presence information may include things like status, location, or calendar state which most organization may want to limit it to just the users in their own organization.

So as you can see, there isn’t a lot to do and the good news is that most of the above can be easily achieved. Nonetheless, I also like to highlight that there may be some limitations too. Let's take a closer look.

What is HMC doing to OCS for Hosting?

At a high level, really not a great deal. Unlike Hosted Exchange, there is no specific customized HMC component introduced by HMC solutions into the OCS infrastructure for Hosting purposes (perhaps there should be some, I will explain later). On top of that, most of the isolation requirements mentioned above can be achieved easily with a few tweaking.

My intention is to briefly explain some of those tweaking in the deployment walkthrough so that we all understand a little bit better why we are doing some of those tasks.

As you walk through the deployment process, you probably have realized that the OCS infrastructure deployment isn’t very different as compared to deploying OCS on a corporate environment. In fact, you will find many references in the help file pointing you back to the OCS deployment guide.

You will find that you only need to make a few simple changes to the OCS infrastructure for hosting purposes. To be specific, after you have completed the deployment of the OCS infrastructure, you need to execute the following procedures,

Deploy Provisioning for Hosted Office Communications Server 2007

Procedure W08-DWHO.56 to W08-DWHO.58

The above procedures deploy the OCS Administrative tools and then the MPS OCS namespaces required to make OCS calls. The HMC deployment tools do not make any change to the OCS environment. Next you will execute the following procedures,

Configure Security for Office Communications Server 2007 Edge Services

Procedure W08-DWHO.59 to Procedure W08-DWHO.71

I think the name of this section needs to be changed because it does more than just configuring the security of OCS 2007 Edge services. In fact, it covers all major the configurations required for Hosted OCS.

I will skip some of the items or steps that are self explanatory in the above procedures and for the purpose of this blog, I will organize my points based on isolations and segregations,

(1) Contact Tenant Isolation

As we know, the default OCS deployment is catered for corporate environment. It means by default, all domain users (or all authenticated users) are allowed to search each other without restriction. This is obviously not acceptable in a hosted environment.

Fortunately, OCS uses a property set to determine whether a user is authorized to search other users in the organization using the Find functionality in OCS. The property set is RTCUserSearchPropertySet.

RTCUserSearchPropertySet is composed of a single attribute,

· msRTCSIP-PrimaryUserAddress

So, in order to ensure that only the authorized users can perform the search, the procedures will have you to remove the Authenticated users from the top so that it will not inherit downwards. And in order to allow authorized users to search that, you will notice that AllUsers@<domain> will be granted permission to that property set on their respective Organization OU.

(2) Address Book Isolation

If you have used Microsoft Office Communicator 2007 before, you will notice that you have access to a contact list, rich with information about people in your organization such as office locations, job titles, multiple phone numbers and etc. This information (contact list or most often we call it address book) is generated from the Active Directory and it is being distributed to the Communicator by Address Book Server through IIS.

If you think about it, this is actually similar to Hosted Exchange where out of the box; we have a Default Global Address List that consists of everyone. Of course, there is absolutely no relationship between Hosted Exchange address list and OCS address book, other than the fact that they are generated from the same source, Active Directory.

The Microsoft Office Communications Server 2007 Address Book server contains the following set of address book files that Communicator 2007 can download:

· A full file that contains all contacts.

· Delta files that contain the changes from the current full file and from each previous full file.

Now, by default, it consists of just a single address book. This is obviously not acceptable in a Hosted environment.

Fortunately, OCS comes with a feature called Partition ABS data by Organizational Unit and create individual ABS files per OU. One of the deployment steps is to enable this using a tool called ABSConfig.exe.

Note: If you encounter error “System.ArgumentOutofRangeException” when running this tool, please refer to this article, http://support.microsoft.com/kb/954749.

What this option (ABS data by Organizational Unit and create individual ABS files per OU) does is that, instead of creating a single address book, it will create multiple address books based on OU and it will create the appropriate OU structure in the address book output location during synchronization. For example in my test lab, my ABS output location looks like the following,

\\ OCSPOOLWEB01

\ABS

\fabrikam.com

\Hosting

\ConsolidatedMessanger

\AlpineSkiHouse

*.dabs

*.lsabs

\Tailspin

*.dabs

*.lsabs

So, that’s on the Address Book Server side. What about on the Communicator side? How does Communicator know which path to go to? We know that the distribution is through IIS, so, if I am user from AlpineSkiHouse, for example, will Communicator know how to get to the link say for example,

https://web.consolidatedmessenger.com/Abs/fabrikam.com/Hosting/ConsolidatedMessenger/Alpineskihouse/

How does Communicator know how to get there? The truth is, Communicator does not know. Communicator will only know how to get to one link that you specified during deployment, which is https://web.consolidatedmessenger.com/Abs/Ext/Handler and it will attempt to get F-0b72.lsabs file. By default it will just point you to the default address book just as your default installation. In order to make sure Communicator know how to get to the right path, you have to configure in the web.config in the ABS server to perform a redirect (this is specified in Procedure W08-DWHO.68).

Here is an example of how it works. Once the redirect is set, if I am a user in AlpineSkiHouse, when I logon using Communicator and try to perform a contact search, Communicator will try to go to https://web.consolidatedmessenger.com/Abs/Ext/Handler/F-0b72.lsabs to locate the address book, the IIS will perform a search based on my logon ID and redirect the Communicator to https://web.consolidatedmessenger.com/Abs/fabrikam.com/Hosting/ ConsolidatedMessenger/Alpineskihouse/F-0b72.lsabs.

The Communicator will then download and cache the address book on the workstation in this location, %APPDATA%\Microsoft\Communicator\Galcontact.db

So, there you go, this is the biggest part of the segregation process for Hosted OCS 2007.

Note: I should also highlight that the address book server will synchronized with the Active Directory on a daily basis. Hence, a contact may take up to 24 hours before it appears in an address book. If you can’t wait, you can always call ABServer.exe -syncNow (located in %programfiles%\Microsoft Office Communications Server 2007\Server\Core)

In addition to the Address Book (from Active Directory), Communicator provides access to information in your Outlook Contacts folder, and in the Windows Address Book.

(3) Web Meeting and Conferencing Settings

Now, here is a direct cut and paste from the HMC help file, “Office Communications Server 2007 allows for either per user policies or per forest policies to be configured for both Voice and Meetings.

The default setting for both of these is to support per forest settings and anonymous participants in a meeting is disabled.

In a HMC environment it is likely that different services will be offered to different business and thus it is necessary to configure each user with the correct settings. To change the default behavior you will need to make the following changes.”

I thought the above has said it all. I don’t need to add much to this.

(4) Presence Information Isolation

I like to spend a tiny bit of time on this. When you run through your deployment, one of the procedures (to be specific W08-DWHO.65) is to Disable Non-Contacts Presence Information Display. As provided in the description in the help file, this procedure ensures users who are not in the users contact list cannot view presence information.

Unfortunately, it is actually more complicated than that. It seems that this option doesn’t work well in the context of Enhanced Presence feature. As a result, I would say this is currently a limitation in the Hosted OCS 2007.

While the directory search and address book have been properly segregated, the presence information may not if the user enter the full sip address of the user correctly in to the search box. It means, if I am a user in AlpineSkihouse and I put in a full sip address of another user in another organization in the same Hosted environment, say mark@tailspin.com, I can actually see his presence information right away even though I am not part of his company. HMC 4.5 out of the box right now does not have lock that down. Individual user can lock that down by using Access Levels Management. However, it should be noted that the display name may still show.

Note: You should also know that, once you enable enhanced presence for a user and the user signs in to Office Communications Server using the Office Communicator 2007 client, the user account is converted to use enhanced presence. The user will then no longer be able to sign in to Live Communications Server 2005 with SP1 and cannot use any previous version of Communicator to sign in. This means that the user will not be able to sign in by using the 2005 version of Communicator Web Access or Communicator Mobile version 1.

Other Limitations

One of the features of OCS is that it has the capability of archiving and call details recordings (CDRs). This is provided through CDR server and by default it has the following capabilities:

· Archiving of all instant messaging (IM)

· Archiving of call detail records (CDR)

However, it should be noted that Hosted Office Communications Server 2007 supports archiving of CDR. Deployment of the IM archiving are out of scope for Hosted Office Communications Server 2007.

Conclusion

Obviously, the above is a simplified version of the whole Hosted Office Communications Server solution. There are more to it in HMC such as offering Hosted OCS through Organization and User Plan, configurations and policies of Live Meeting components, additional server roles such as Director in a slightly larger environment, inclusion of IP telephony devices and etc. that may add to the complexity of the solutions.