WebDAV connection using Forms Based Authentication Fails (Response asking for Basic Authntication?)

17 Apr 2009 9:44 AM

macca

Hi,

Please can somebody help? I'm trying to a authenticate on exchange
2003 using WebDAV (through cURL/PHP). I have enabled Forms-based
Authentication on the Exchange server and can log in successfully
using OWA, so I don't think it's an certificate issue. However, when
trying to authenticate using FBA through webdav I get the following
response:

HTTP/1.1 401 Unauthorized
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: Basic realm="<IP removed>"
X-Powered-By: ASP.NET
Date: Fri, 17 Apr 2009 09:11:05 GMT

<html><head><title>Error</title></head><body>Error: Access is Denied.</
body></html>

I seems as though the server is not accepting the posted form
credentials posted to /exchweb/bin/auth/owaauth.dll and is still
asking me for Basic Authentication.

I can get it working through Basic authentication but this is not
adequate for my needs. Any ideas would be appreciated.

Thanks,

Paul

17 Apr 2009 12:31 PM

Lee Derbyshire [MVP]

Show quote Hide quote

"macca" <ptmcna***@googlemail.com> wrote in message
news:64678fd3-592e-4b43-b059-6f4cde5b8c60@z14g2000yqa.googlegroups.com...
> Hi,
>
> Please can somebody help? I'm trying to a authenticate on exchange
> 2003 using WebDAV (through cURL/PHP). I have enabled Forms-based
> Authentication on the Exchange server and can log in successfully
> using OWA, so I don't think it's an certificate issue. However, when
> trying to authenticate using FBA through webdav I get the following
> response:
>
> HTTP/1.1 401 Unauthorized
> Content-Length: 83
> Content-Type: text/html
> Server: Microsoft-IIS/6.0
> WWW-Authenticate: Basic realm="<IP removed>"
> X-Powered-By: ASP.NET
> Date: Fri, 17 Apr 2009 09:11:05 GMT
>
> <html><head><title>Error</title></head><body>Error: Access is Denied.</
> body></html>
>
> I seems as though the server is not accepting the posted form
> credentials posted to /exchweb/bin/auth/owaauth.dll and is still
> asking me for Basic Authentication.
>
> I can get it working through Basic authentication but this is not
> adequate for my needs. Any ideas would be appreciated.
>
> Thanks,
>
> Paul

It would be good to see the generated IIS log file entries. Maybe your
owaauth.dll file is not available to anonymous connections?

Lee.

--
______________________________________

Outlook Web Access For PDA , OWA For WAP
www.leederbyshire.com
lee a.t leederbyshire d.o.t c.o.m
______________________________________

22 Apr 2009 8:29 AM

macca

I don't have easy access to the server log files, as the exchange
server is configured by one of my colleagues and not me.

I have managed to post the form data to the server and the response is
now a 302 Moved header where I can grab the two Forms-based
Authentication cookies, but when I redirect to the Exchange inbox and
pass the cookies in the HTTP headers one of the following happens:

If I use the http://<ip removed>/exchange/

I get a HTTP/1.1 403 Forbidden
"The page must be viewed over a secure channel"

but if I use https:<ip removed>/exchange/
cURL just returns a boolean false (no response)

Any ideas?

23 Apr 2009 12:47 PM

Lee Derbyshire [MVP]

I don't know which component you used to send the request, but did you tell
it to ignore certificate warnings (which it will almost certainly get if you
use the IP address in the URL)?

Show quoteHide quote

"macca" <ptmcna***@googlemail.com> wrote in message
news:30dc8862-027a-41a7-b24f-c5357af75a80@q16g2000yqg.googlegroups.com...
>I don't have easy access to the server log files, as the exchange
> server is configured by one of my colleagues and not me.
>
> I have managed to post the form data to the server and the response is
> now a 302 Moved header where I can grab the two Forms-based
> Authentication cookies, but when I redirect to the Exchange inbox and
> pass the cookies in the HTTP headers one of the following happens:
>
> If I use the http://<ip removed>/exchange/
>
> I get a HTTP/1.1 403 Forbidden
> "The page must be viewed over a secure channel"
>
> but if I use https:<ip removed>/exchange/
> cURL just returns a boolean false (no response)
>
> Any ideas?

23 Apr 2009 1:12 PM

macca

Thanks Lee, that has solved the problem.

I appreciate the help.

Regards,

Paul