EWS, SOAP: Unable to access Forefront-protected /EWS/Exchange.asmx

Question

This is a repost. I'm really hoping to get an answer from a Microsoft Forefront support engineer. Last time my question was ignored then closed, am I in the wrong place for Forefront support?
I have this app that uses EWS to access mail, using the standard /EWS/Exchange.asmx SOAP endpoint.
One my user's mail servers is protected by Microsoft Forefront, and the initial HTTP request to
https://server_name/EWS/Exchange.asmx
is redirected (HTTP 302) to:
https://server_name/
CookieAuth.dll?GetLogon?curl=Z2FEWSZ2FExchange.asmx&reason=0&formdir=3
which is an regular HTML page, the point of which, I guess, is to make the user authenticate "manually".
I've not heard about Forefront until today, not sure how to handle it.
Is this normal behavior for Forefront (i.e. it always redirects the initial HTTP request), or is it triggered by something in my app? For example, user-agent? The formatting of my SOAP request? Some other heuristics?
If it's normal, how am I supposed to get past this page and access /EWS/Exchange.asmx?
If it's triggered by something my app is doing, how can I find out what it is?
My code runs on Android and forms its own XML requests without using any SOAP library. At the transport level, I use Apache HTTP client components. The code works fine with Office 365/Exchange Online, and, according to user reports, "self-hosted"
corporate Exchange servers with NTLM.
However, in this case, I'm not even getting an HTTP 401: the HTTP 302 is returned by the very first HTTP roundtrip.
Trying to preemptively authenticate the initial request using Basic authentication didn't make any difference.
The user who reported this issue also mentioned that another EWS based app works, so there must be a solution to it.

Answer 1

Quan,
Thank you for responding.
There is no error per se, but the initial HTTP request to <server>/EWS/Exchange.asmx gets redirected by Forefront (HTTP 302) to:
https://server_name/
CookieAuth.dll?GetLogon?curl=Z2FEWSZ2FExchange.asmx&reason=0&formdir=3
...which is an HTML page that asks the user to log in, "manually" by again entering his login and password. This is a problem, because my app is not a web browser.
Normally, without Forefront, the first request for Exchange.asmx returns an HTTP 401, at which point the HTTP library provides authentication data, and then the server returns actual data that the app asked for.
I do not know which Forefront it is, I'm not familiar with Forefront. Does the above URL (.../CookieAuth.dll?GetLogon) tell you that? Does it matter which Forefront it is?
I hope that you are exactly a person "who is familiar with the issue" -- specifically, Forefront for Exchange -- or can escalate my question to someone who is.