We are not able to logon to OWA using forms-based authentication. When we OWA to use Window Integrated authentication, it works fine.
But when forms based authentication on both the OWA and ECP is setup, users are not able to logon.
When a user enters valid credentials, they are taken to a blank page https://ExchCASServerName.domain.com/owa/auth.owa. But if they enter bad cred's, it just redirects to the logon page and asked them to logon again.
Looking at the IIS logs, they are entering an IIS status code of 500.0 - http://support.microsoft.com/kb/943891/en-us
10-05-19 16:32:00 192.168.1.8 POST /owa/auth.owa - 443 domain\username 123.231.10.11 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+CWADS32;+HDR.05.01.00.06;+.NET+CLR+2.0.50727;+InfoPath.2;+.NET+CLR+3.0.4506.2152;+MS-RTC+LM+8;+MS-RTC+EA+2) 500 0 0 31
I also get a failure when I run the test-owaconnectity cmd-let and forms based auth is enabled:
[PS] C:\Windows\system32>Test-OwaConnectivity -MailboxCredential (get-credential domain\username) -URLhttps://ExchCASServerName.domain.com/owa -TrustAnySSLCertificate -verbose | FL
VERBOSE: [17:29:48.069 GMT] Test-OwaConnectivity : Active Directory session settings for 'Test-OwaConnectivity' are: View Entire Forest: 'False', Default Scope: 'domain.local', Configuration Domain Controller: 'DC1.domain.local', Preferred Global Catalog: 'DC1.domain.local',
Preferred Domain Controllers: '{ DC1.domain.local }'
VERBOSE: [17:29:48.085 GMT] Test-OwaConnectivity : Runspace context: Executing user: domain.local/Users & Groups/username, Executing user organization: , Current organization: ,RBAC-enabled: Enabled.
VERBOSE: [17:29:48.085 GMT] Test-OwaConnectivity : Beginning processing.
VERBOSE: [17:29:48.085 GMT] Test-OwaConnectivity : Instantiating handler with index 0 for cmdlet extension agent "Admin Audit Log Agent".
VERBOSE: [17:29:48.085 GMT] Test-OwaConnectivity : Current ScopeSet is: {Domain Read Scope: {, }, Domain WriteScope(s): {, }, Configuration Scope: {, }, Server Configuration Scope(s): {, }, , Exclusive Scope: {, }}
VERBOSE: The TrustAnySSLCertificate flag has been set. The task won't verify that the server certificate is valid before sending the user requests and credentials to this server. User credentials will be used for the following user: domain\username Do you want
to test Outlook Web App connectivity on Client Access server ExchCASServer.domain.local?
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : Resolved current organization: .
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : Adding a test instance for URL 'https://ExchCASServerName.domain.com/owa' specified with the -URL argument.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : The TrustAnySSLCertificate flag was specified, so any certificate will be trusted.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : Sending the HTTP GET logon request without credentials for authentication type verification.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : The HTTP request succeeded with result code 200 (OK).
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : The sign-in page is from Outlook Web App, not ISA Server.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : The server reported that it supports authentication method FBA.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : This virtual directory URL type is External or Unknown, so the authentication type won't be checked.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : Sending HTTP request for logon page 'https://ExchCASServerName.domain.com/owa/auth/owaauth.dll'.
VERBOSE: [17:29:48.132 GMT] Test-OwaConnectivity : Trying to sign in with method 'Fba'.
WARNING: An unknown failure occurred during logon.
WARNING: The test encountered an error while signing in to Outlook Web App.
WARNING: Test failed for URL 'https://ExchCASServerName.domain.com/owa/'.
RunspaceId : 77678ba5-bbda-46e5-bc1e-c65099239ddc
AuthenticationMethod : FBA
MailboxServer :
LocalSite : LabSite
SecureAccess : True
VirtualDirectoryName :
Url :https://ExchCASServerName.domain.com/owa/
UrlType : Unknown
Port : 0
ConnectionType : Plaintext
ClientAccessServerShortName :
LocalSiteShortName : LabSite
ClientAccessServer :
Scenario : Logon
ScenarioDescription : Sign in to Outlook Web App and verify the response page.
PerformanceCounterName : Logon Latency
Result : Failure
Error : The test encountered an error while signing in to Outlook Web App.
UserName : username
StartTime : 5/19/2010 10:29:48 AM
Latency : -00:00:00.0010000
EventType : Error
LatencyInMillisecondsString :
Identity :
IsValid : True
VERBOSE: [17:29:48.148 GMT] Test-OwaConnectivity : Ending processing.
The server is a all-in-one setup (Mailbox, CAS, Hub-transport) running Windows 2008 R2. I've installed Update Rollup 3 for Exchange Server 2010.
Any ideas on what would cause the forms based auth to fail?