Scoping questionsAssumptions
Microsoft makes the following assumptions as part of this Configuring Certificate Based Authentication for Outlook Web Access Professional Advisory Support Scenario:
- The current Exchange environment is healthy and configured per Microsoft�s Best Practice Recommendations as determined by a full Exchange Best Practice Analyzer (ExBPA) health check.
- Any pre-existing configuration, or other issues that might prevent a successful OWA Certificate Based Authentication deployment, must be resolved prior to beginning work on the Professional Advisory offering as scoped.� It is highly recommended the customer perform the ExBPA health check and resolve any issues prior to beginning work on the Case Scope stage itself.
- Should the customer request assistance with bringing the current environment to a healthy state separate, break-fix support incidents will need to be opened to address each subordinate issue.� Further, should any issues arise while performing scoped tasks, a maximum of thirty (30) minutes will be spent troubleshooting those issues. This troubleshooting will be billed within the current advisory case.� If the issue is not resolved in these thirty (30) minutes a new, charged break-fix, support incident must be opened to address the problem.� The Advisory Support Engineer may work the support incident at their discretion.
- At the conclusion of this service the Support Engineer and the customer will verify the functionality of the configuration before the delivery can be considered fully complete.
- ISA Server 2006 basic configuration is already complete & publishing rules already exist for at least Outlook Web Access.
This scenario is based on MSExchangeTeam blogs and Microsoft TechNet/KB articles.
Questions that choose the deployment option
The following questions will determine the CBA deployment option and ultimately cost.�
If the customer is unable to answer these questions, or is unfamiliar with them; please recommend they read the following blogs and documents:
- Is this a first time you are configuring CBA for OWA in your environment?
Yes = This qualifies as an advisory scenario - proceed to question 2.
No = STOP - This is not an Advisory scenario.� Case will be worked as a normal break-fix.
- Do you have more than one domain or forest?
Yes = STOP - Not supported due to limitations of Kerberos Constrained Delegation.
No = Proceed to question 3.
- Is the Active Directory (AD) domain set to the Windows Server 2003 Domain Functional Level?
Yes = Proceed to question 4.
No = STOP - Not supported due to the requirement that the AD domain must be set to Windows Server 2003 Domain Functional Level.
- Do you have, or are you planning to have, ISA Server 2006 installed in your environment?
Yes = Proceed to question 5.
No = STOP�- Not supported since ISA Server 2006 is required for this advisory scenario.
- What type of environment is this?
- Is this a pure Exchange Server 2003 SP2 environment with ISA Server 2006 configured?
Yes�= Follow�Option 1: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2003. �This option is based on the following articles:
No = Proceed to question B. - Is this a mixed Exchange Server 2003 SP2 back-end (BE) and Exchange Server 2007 Client Access Server (CAS) environment with ISA Server 2006?�
Yes�= Follow�Option 2: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2007 Client Access Server with Exchange Server 2003 Back End Servers. �This option is based on the following articles:
No�= Proceed to question C. - Is this a pure Exchange Server 2007 environment with ISA Server 2006?
Yes�= Follow�Option 3: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2007. �This option is based on the following articles:
No�= Restart at A. or this is an unsupported scenario.
�������
Option 1: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2003
Reasons to use this method:� This option is for environments running only Exchange Server 2003 SP2 and ISA Server 2006.� The AD domain is set to Windows Server 2003 Domain Functional Level.� This is typically a single domain with ISA Server 2006 joined to the domain.
Scope (includes any combination of the following)- Configure Certificate Based Authentication for OWA using a deployment strategy that uses a supported 3rd party or internally issued (self-signed) certificate.
- Configure Windows client machines by adding the user certificate to the local certificate store. The certificate can also be added to an External accessible storage device e.g. flash drive, USB reader.
- Configuring the correct authentication methods on the /Exchange virtual directory.
- Configuring the correct bit strength for the IIS Default Web Site.
- Configuring the ISA Server 2006 Web Listener.
Footnotes:
- If we review the steps with the customer, instead of doing the steps with the customer, then the time can be reduced to 40% of total.
- SSL Certificates: Customer is responsible for procurement of certificate(s) from a third-party company.� Customer may also use an internal Certificate Authority (CA) to generate the required certificates.� If using an internal CA, all systems must trust the entire CA chain.� This includes the ISA Server, CAS, and client workstations.� The CA Root certificate must be in the Trusted Root Certification Authorities store on all systems.
- Firewalls: Assistance in configuring firewalls only includes giving the required ports to the customer.� We do not support configuring firewalls.� If ISA Server is used, and the customer needs assistance with this, then a separate case must be opened with the ISA Server support team.
- Networking issues: If issues arise that are caused by networking issues which cannot be resolved within 30 minutes, then a separate case must be opened with the Networking support team for more extensive troubleshooting.
- Smartcard issues: If issues arise that are caused by the smartcard readers/writers, this will be referred to the respective vendor(s). Microsoft will assist the customer to install the required client certificate but if this cannot be done within 30 minutes, then a separate case must be opened with the Directory Services support team for more extensive troubleshooting.
Option 2: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2007 Client Access Server with Exchange Server 2003 Back End Servers
Reasons to use this method:� This option is only for environments running a mixture Exchange Server 2007 CAS and Exchange Server 2003 SP2 BE servers with ISA Server 2006.� The AD domain is set to Windows Server 2003 Domain Functional Level.� This is typically a single domain with ISA Server 2006 joined to the domain.
Scope (includes any combination of the following)- Configure Certificate Based Authentication for OWA using a deployment strategy that uses a supported 3rd party or internally issued (self-signed) certificate.
- Configure Windows client machines by adding the user certificate to the local certificate store. The certificate can also be added to an External accessible storage device e.g flash drive, USB reader.
- Configuring the correct authentication methods on the /Exchange virtual directory.
- Configuring the correct bit strength for the IIS Default Web Site.
- Configuring the ISA Server 2006 Web Listener.
Footnotes:- If we review the steps with the customer, instead of doing the steps with the customer, then the time can be reduced to 40% of total.
- CAS: Work may take less time if Exchange Management Shell is used to configure multiple servers.
- SSL Certificates: Customer is responsible for procurement of certificate(s) from a third-party company.� Customer may also use an internal Certificate Authority (CA) to generate the required certificates.� If using an internal CA, all systems must trust the entire CA chain.� This includes the ISA Server, CAS, and client workstations.� The CA Root certificate must be in the Trusted Root Certification Authorities store on all systems.
- Firewalls: Assistance in configuring firewalls only includes giving the required ports to the customer.� We do not support configuring firewalls.� If ISA Server is used, and the customer needs assistance with this, then a separate case must be opened with the ISA Server support team.
- Networking issues: If issues arise that are caused by networking issues which cannot be resolved within 30 minutes, then a separate case must be opened with the Networking support team for more extensive troubleshooting.
- Smartcard issues: If issues arise that are caused by the smartcard readers/writers, this will be referred to the respective vendor(s). Microsoft will assist the customer to install the required client certificate but if this cannot be done within 30 minutes, then a separate case must be opened with the Directory Services support team for more extensive troubleshooting.
Option 3: Configuring Certificate Based Authentication for Outlook Web Access in Exchange Server 2007
Reasons to use this method:� This option is only for environments running only Exchange Server 2007 with ISA Server 2006.� The AD domain is set to Windows Server 2003 Domain Functional Level.� This is typically a single domain with ISA Server 2006 joined to the domain.
Scope (includes any combination of the following)- Configure Certificate Based Authentication for OWA using a deployment strategy that uses a supported 3rd party or internally issued (self-signed) certificate.
- Configure Windows client machines by adding the user certificate to the local certificate store. The certificate can also be added to an External accessible storage device e.g. flash drive, USB reader.
- Configuring the correct authentication methods on the /Exchange virtual directory.
- Configuring the correct bit strength for the IIS Default Web Site.
- Configuring the ISA Server 2006 Web Listener.
Footnotes:- If we review the steps with the customer, instead of doing the steps with the customer, then the time can be reduced to 40% of total.
- CAS: Work may take less time if Exchange Management Shell is used to configure multiple servers.
- SSL Certificates: Customer is responsible for procurement of certificate(s) from a third-party company.� Customer may also use an internal Certificate Authority (CA) to generate the required certificates.� If using an internal CA, all systems must trust the entire CA chain.� This includes the ISA Server, CAS, and client workstations.� The CA Root certificate must be in the Trusted Root Certification Authorities store on all systems.
- Firewalls: Assistance in configuring firewalls only includes giving the required ports to the customer.� We do not support configuring firewalls.� If ISA Server is used, and the customer needs assistance with this, then a separate case must be opened with the ISA Server support team.
- Networking issues: If issues arise that are caused by networking issues which cannot be resolved within 30 minutes, then a separate case must be opened with the Networking support team for more extensive troubleshooting.
Smartcard issues: If issues arise that are caused by the smartcard readers/writers, this will be referred to the respective vendor(s). Microsoft will assist the customer to install the required client certificate but if this cannot be done within 30 minutes, then a separate case must be opened with the Directory Services support team for more extensive troubleshooting.