401 Error when you using mobile device to access OWA or OMA published by ISA Server 2006

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Consider the following scenario:

��������� When you are using ISA Server 2006 to publish OWA (Outlook Web Access), with FBA (Form-based authentication) enabled on the web listener;

��������� You are using Windows Mobile or other mobile phone devices to access the published OWA site or OMA (Outlook Mobile Access) site.

�

You will receive the �401 Unauthorized� error instead of the Exchange Logon Forms

The error appears when the required HTML form directories for Windows Mobile access are missing from the Exchange HTML form set directory.

In ISA Server 2006, there is a new feature called �User-Agent Mappings�, which could map the user agent with specified HTML authentication form or basic authentication.

�

In ISA Server 2006, there are 3 types of HTML form to Form-Based Authentication, the �HTML�, �CHTML� and �XHTML-MP�, and different forms are stored in different folders.

�

Be default, the User-Agent mappings are listed below.

�

No. ������� User-Agent headers ����� Authentication type

1������������� *Blazer*����������������������������� XHTML-MP forms

2������������� *DoCoMo*������������������������ cHTML forms

3������������� *Windows CE*����������������� XHTML-MP forms

4������������� *Symbain OS*������������������ XHTML-MP forms

5������������� *SonyEricsson*������������������������������� XHTML-MP forms

6������������� *Frontpage*��������������������� Basic authentication

7������������� *Mozilla*��������������������������� HTML 4.01 forms

8������������� *Opera*����������������������������� HTML 4.01 forms

9������������� *MSRPC*��������������������������� Basic authentication

10���������� *�������������������������������������������� Basic authentication

�

When ISA Server 2006 is installing on the computer, the folder �%programfiles%\Microsoft ISA Server\CookieAuthTemplate\Exchange� only contains �HTML\� folder, which will only make �HTML 4.01 forms� mapping available. Other 2 forms, �XHTML-MP form� and �cHTML form� are missing. So ISA could not find the right form folders for authentication, and �401 Unauthorized� error will appear.

�

To resolve this issue, follow these steps:

1.������ Manually create the two directories, �cHTML� and �xHTML�, in the �%programfiles%\Microsoft ISA Server\CookieAuthTemplate\Exchange� folder.

2.������ Copy the contents of the �%programfiles%\Microsoft ISA Server\CookieAuthTemplate\ISA\cHTML� folder to the �cHTML� folder which is created in step 1.

3.������ Copy the contents of the �%programfiles%\Microsoft ISA Server\CookieAuthTemplate\ISA\xHTML� folder to the �xHTML� folder which is created in step 1.

4.������ Restart the �ISA firewall service�.

For the User-Agent Mappings, please refer to TechNet article.

http://technet.microsoft.com/en-us/library/bb794715.aspx

�

For the User-Agent Mappings, please refer to TechNet article.

http://technet.microsoft.com/en-us/library/bb794715.aspx

�

You can find sample script to:

l�������������� List User-Agent Mappings

l�������������� Create a new User-Agent Mapping

l�������������� Edit or delete a User-Agent Mapping

�

�