Exchange 2010 OWA access on internal LAN login form not working as expected

Question

hi
We have exchange 2010 sp3 installed and working. we have two sites
Site a
1 x CAS
2 X MBX
Site b
1 x cas
2x mbx
site A is the primary site we currently publish owa our through our TMG server located in the DMZ this is working as expected and carries out the forms authentication. our internal domain is company.local but our external domain is company.com
we have created split DNS so that we could use a wildcard cert and to deal with CA new rules. All URL's in Exchange are configured to use the external reference of company.com/
on the IIS server we have a redirection on the root of the site to redirect the requests through to OWA folder and we have basic Authentication enabled. on the OWA folder we have basic and windows authentication.
The problem we have is that when users try to access OWA internally we get username and password box appears once you login with this it then takes you through to the the normal login screen and you have tyo login again I'm thinking that this is the windows
authentication that is causing this but not sure?
also would be good to get an understanding as to what the Authentication, SSL and redirection setting should be set to on your CAS servers as looking at the ECP and autodiscover folder within IIS this currently has a redirect set to go to OWA surely that
cannot be right,
thanks
J

Answer 1

Hi
you are correct, the immediate concern is the double login to owa i do however want to also know what the settings/configuration for Authentication redirection and SSL should be set to on all virtual directories.
we do not have any additional OWA virtual directories just the default
These are the current live servers
Identity                      : ACAS01\owa (Default Web Site)
Url                           : {}
Exchange2003Url               :
FailbackUrl                   :
InternalUrl                   : https://email.Company.com.com/owa
ExternalUrl                   : https://email.Company.com/owa
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Fba}
Identity                      : BCAS01\owa (Default Web Site)
Url                           : {}
Exchange2003Url               : https://www.Companyt.co.uk/
FailbackUrl                   :
InternalUrl                   : https://webmail.Company.com/owa
ExternalUrl                   : https://webmail.Company.com/owa
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Fba}
These are the new servers which i have just installed
Identity                     : CAS05\owa (Default Web Site)
Url                           : {}
Exchange2003Url               :
FailbackUrl                   :
InternalUrl                   : https://webmail.Company.com/owa
ExternalUrl                   : https://webmail.Company.com/owa
InternalAuthenticationMethods : {Basic, Fba, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Fba}
Identity                      : CAS06\owa (Default Web Site)
Url                           : {}
Exchange2003Url               :
FailbackUrl                   :
InternalUrl                   : https://webmail.Company.com/owa
ExternalUrl                   : https://webmail.Company.com/owa
InternalAuthenticationMethods : {Basic, Fba, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Fba}
Identity                      : CAS04\owa (Default Web Site)
Url                           : {}
Exchange2003Url               :
FailbackUrl                   :
InternalUrl                   : https://webmail.Company.com/owa
ExternalUrl                   : https://webmail.Company.com/owa
InternalAuthenticationMethods : {Basic, Fba, Ntlm, WindowsIntegrated}
ExternalAuthenticationMethods : {Fba}
I have noticed that FBA is set on the new servers does this need turning off and if so is this on IIS or in Exchange?
the link that you have provided talks about creating new Vdir for TMG we are looking at removing TMG and replacing it with KEMP load balancers would we still need to have two Vdir to make FBA work internally and externally
 to make a new vdir do you need a new IP address? and what are the steps required in Exchange and IIS to get this working.
thanks
Jason