{"id":4351,"date":"2018-12-28T13:45:19","date_gmt":"2018-12-28T09:45:19","guid":{"rendered":"https:\/\/rakhesh.com\/?p=4351"},"modified":"2018-12-29T18:17:14","modified_gmt":"2018-12-29T14:17:14","slug":"adfs-with-exchange-owa-ecp","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/exchange\/adfs-with-exchange-owa-ecp\/","title":{"rendered":"ADFS with Exchange OWA & ECP"},"content":{"rendered":"

Follow the instructions here<\/a> to setup OWA & ECP authentication via ADFS rather than the default forms based authentication. Here\u2019s another<\/a>, more concise article. Both articles talk about setting up WAP too which I didn\u2019t do in my home lab.\u00a0<\/p>\n

I wanted to add something extra to these articles.<\/p>\n

In my home lab I have my primary ADFS server, which has a relying party trust setup with OWA & ECP as in these articles. Just to keep things interesting :) I also have a second domain, in a trust relationship with the first domain, and with its own ADFS server and users. The users in this second domain don\u2019t have any Exchange mailboxes – these are hosted in the first domain. The second domain’s ADFS server has the first domain\u2019s ADFS server as its relying party trust; and the first domain\u2019s ADFS server has the second domain\u2019s ADFS server as a claims provider trust apart from the default Active Directory.\u00a0<\/p>\n

Upshot of the situation is that everyone authenticates with the ADFS server of the primary domain. They are given the choice:\u00a0<\/p>\n

\"homerealm\"<\/p>\n

Selecting \u201cBranch Office\u201d takes them to the second domain ADFS server where they can authenticate and claims are sent to the primary domain ADFS server from where it is passed on to the application. Selecting \u201cHead Office\u201d results in authentication against the Domain Controller of the primary domain itself. Easy peasy.<\/p>\n

Now onto the claims setup in the primary domain as part of setting up OWA & ECP. We setup two claims: one takes the WindowsAccountName<\/code> claim issued by AD and gets the user SID and sends that.\u00a0<\/p>\n

c:[Type == \"http:\/\/schemas.microsoft.com\/ws\/2008\/06\/identity\/claims\/windowsaccountname\", Issuer == \"AD AUTHORITY\"]\r\n=> issue(store = \"Active Directory\", types = (\"http:\/\/schemas.microsoft.com\/ws\/2008\/06\/identity\/claims\/primarysid\"), query = \";objectSID;{0}\", param = c.Value);<\/pre>\n
The other claims takes the WindowsAccountName<\/code> claim and gets the user UPN and sends that.<\/p>\n
c:[Type == \"http:\/\/schemas.microsoft.com\/ws\/2008\/06\/identity\/claims\/windowsaccountname\", Issuer == \"AD AUTHORITY\"]\r\n=> issue(store = \"Active Directory\", types = (\"http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/upn\"), query = \";userPrincipalName;{0}\", param = c.Value);<\/pre>\n
So both these claims essentially query AD and send the SID & UPN. They don\u2019t work well with claims passed from another claims provider (such as the ADFS server in my second domain). So what I did is:<\/p>\n
    \n
  1. On the second ADFS server I already had a rule that passed along all claims to the relying party trust of the primary ADFS server, so I did nothing additional. (If I didn\u2019t have this in place I would have made two rules like I did in the next step).\u00a0<\/li>\n
  2. On the trust between the primary ADFS server and OWA & ECP I removed the two rules above and made two rules that simply sent UPN & SID as UPN & SID. The idea being that the default rules only query from AD specifically, but I don\u2019t want to limit to that. I will anyways get the UPN & SID claims either from the AD claims or the second ADFS server, so all I need do is pass these on to Exchange.\u00a0<\/li>\n<\/ol>\n
    \"upn-upn\"<\/p>\n
    That\u2019s it. Now users in the second domain too should be able to use OWA & ECP via ADFS.\u00a0<\/p>\n
    Update<\/strong>: This breaks ECP. Continued in another post<\/a>. <\/p>\n","protected":false},"excerpt":{"rendered":"
    Follow the instructions here to setup OWA & ECP authentication via ADFS rather than the default forms based authentication. Here\u2019s another, more concise article. Both articles talk about setting up WAP too which I didn\u2019t do in my home lab.\u00a0 I wanted to add something extra to these articles. In my home lab I have … Continue reading ADFS with Exchange OWA & ECP<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[86,88],"tags":[746],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4351"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=4351"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4351\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=4351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=4351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=4351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}