How to Configure Single Sign On for OWA 2010 with Two Factor Authentication

book

Article ID: CTX134724

calendar_today

Updated On:

Description

This article describes how to configure Single Sign On (SSO) for Outlook Web Access (OWA) 2010 with two factor authentication.

Background

SSO does not work for OWA 2010 for two factor authentication after configuring SSO by using CTX128197 - How to Configure Single Sign-On for Exchange 2010.

The Action URL for SSO form is different in OWA 2010. Therefore, you must modify the Traffic Management policy. You require a rewrite policy to set the PBack cookie in the logon.aspx request.
In normal scenarios, the PBack cookie is set at the client when you select Submit. If SSO is configured, then the response to logon.aspx is intercepted and the form request is generated by the NetScaler appliance. The PBack cookie is not attached in the form submission request. The OWA server expects the PBack cookie in the form submission request. Rewrite policy must be attached to the PBack cookie in the form submission request.

Note: Clientless Virtual Private Network (CVPN) access for OWA 2010 is now supported with NetScaler software release 10.

Instructions

To configure SSO for Outlook Web Access 2010, complete the following procedures:

Authentication, Authorization, and Auditing (AAA) for Traffic Management Configuration

Rewrite Configuration

Authentication, Authorization, and Auditing (AAA) for Traffic Management Configuration

Configure a SSO profile.
Create a Traffic profile with the preceding Form SSO action.
Configure a Traffic policy with the Traffic Profile.
Bind the Traffic policy either at global level or to a virtual server.
Configure a Session profile.

Note: Select Credential Index to either primary or secondary depending on the credentials that must be sent to the Web Applications.
Configure a Session policy with the Session profile.
Bind the Session policy to the AAA virtual server.

Rewrite Configuration

Configure a Rewrite action.
Configure a Rewrite policy with the Rewrite action.
Bind the Rewrite policy to the Load Balance virtual server.

Note: Sometimes even after you implement the rewrite configuration, Outlook might not issue OWA Session cookies and the Pback cookies might not be inserted. In this scenario, you must use the following configuration as a workaround instead of the preceding rewrite configuration.