Exchange 2013 OWA Intergration - More than 1 CAS - not working?

Question

Hello,
Not sure why I can't get this working properly in my test lab. My admin user is unable to sign in through OWA to Lync but the actual client works fine. I get the "there is an error, contact your system administrator." I followed the TechNet article
here http://technet.microsoft.com/en-us/library/jj688098.aspx. Here is my configs
PS C:\Users\Administrator.R5A> get-cspartnerapplication
Identity : Exchange
AuthToken : Value=https://autodiscover.domain.tld/autodis
cover/metadata/json/1
Name : Exchange
ApplicationIdentifier : 00000002-0000-0ff1-ce00-000000000000
Realm : domain.tld
ApplicationTrustLevel : Full
AcceptSecurityIdentifierInformation : False
Enabled : True
PS C:\Users\Administrator.R5A> get-csoauthconfiguration
Identity : Global
PartnerApplications : {Name=Exchange;ApplicationIdentifier=00000
002-0000-0ff1-ce00-000000000000;Realm=DOMAIN.
TLD;ApplicationTrustLevel=Full;AcceptSecuri
tyIdentifierInformation=False;Enabled=True
OAuthServers : {}
Realm :
ServiceName : 00000004-0000-0ff1-ce00-000000000000
ExchangeAutodiscoverUrl : https://autodiscover.domain.tld/autodiscover/a
utodiscover.svc
ExchangeAutodiscoverAllowedDomains :
PS C:\Users\Administrator.R5A> get-cstrustedapplication
Identity : torsv-excas01.domain.tld/urn:application:outlook
webapp
ComputerGruus : {torsv-excas01.domain.tld sip:[email protected];gruu;opaque=srvr:outlookweba
pp:ybjGB5gixFCrsTQrQHNQHAAA}
ServiceGruu : sip:[email protected];gruu;o
paque=srvr:outlookwebapp:ybjGB5gixFCrsTQrQHNQHAAA
Protocol : Mtls
ApplicationId : urn:application:outlookwebapp
TrustedApplicationPoolFqdn : torsv-excas01.domain.tld
Port : 5199
LegacyApplicationName : outlookwebapp
Identity : torsv-excas02.domain.tld/urn:application:outlook
webapp
ComputerGruus : {torsv-excas02.domain.tld sip:[email protected];gruu;opaque=srvr:outlookweba
pp:NVWngwaX91yyXJLGooUVkwAA}
ServiceGruu : sip:[email protected];gruu;o
paque=srvr:outlookwebapp:NVWngwaX91yyXJLGooUVkwAA
Protocol : Mtls
ApplicationId : urn:application:outlookwebapp
TrustedApplicationPoolFqdn : torsv-excas02.domain.tld
Port : 5199
LegacyApplicationName : outlookwebapp
PS C:\Users\Administrator.R5A> get-CsTrustedApplicationPool
Identity : TrustedApplicationPool:torsv-excas01.domain.tld
Registrar : Registrar:sip.domain.tld
FileStore :
ThrottleAsServer : True
TreatAsAuthenticated : True
OutboundOnly : False
RequiresReplication : False
AudioPortStart :
AudioPortCount : 0
AppSharingPortStart :
AppSharingPortCount : 0
VideoPortStart :
VideoPortCount : 0
Applications : {urn:application:outlookwebapp}
DependentServiceList : {}
ServiceId : 1-ExternalServer-1
SiteId : Site:MySite
PoolFqdn : torsv-excas01.domain.tld
Version : 6
Role : TrustedApplicationPool
Identity : TrustedApplicationPool:torsv-excas02.domain.tld
Registrar : Registrar:sip.domain.tld
FileStore :
ThrottleAsServer : True
TreatAsAuthenticated : True
OutboundOnly : False
RequiresReplication : False
AudioPortStart :
AudioPortCount : 0
AppSharingPortStart :
AppSharingPortCount : 0
VideoPortStart :
VideoPortCount : 0
Applications : {urn:application:outlookwebapp}
DependentServiceList : {}
ServiceId : 1-ExternalServer-2
SiteId : Site:MySite
PoolFqdn : torsv-excas02.domain.tld
Version : 6
Role : TrustedApplicationPool
 Test-CsExStorageConnectivity works fine.
What's weird is when I try testing OWA IM login and use the SIP debugger I see this entry.
Start-Line: NEGOTIATE sip:127.0.0.1:5061 SIP/2.0
FROM: <sip:sip.domain.tld>;ms-fe=torsv-lync01.domain.tld
TO: <sip:sip.domain.tld>
CALL-ID: 4a017cf0e45a4bd7b1a78bdd83821277
CSEQ: 1 NEGOTIATE
VIA: SIP/2.0/TLS 192.168.1.9:65137
MAX-FORWARDS: 0
CONTENT-LENGTH: 0
SUPPORTED: NewNegotiate
SUPPORTED: ECC
REQUIRE: ms-feature-info
SERVER: RTC/5.0
$$end_record
Why are the TO and From fields showing the same thing? What am I missing
Exchange CAS 1 and CAS 2 running Exchange 2013 SP1 on Server 2008 R2
Lync 2013 with latest windows updates.

Answer 1

For anyone that finds this in Google and has separated Exchange 2013 roles or had this issue I resolved it with the help of Microsoft.
First issue
- Web.config edits on MBX servers instead of CAS. You do NOT do any web.config edits on the CAS server. The reason is the CAS server proxies the request to Mailbox servers and the actual server connecting to Lync is your mailbox servers.
- Verify that your IIS port 443 binding on your mailbox server for both backend / default website the certificate matches and has all the names in it. 
- Thumbprint that you put in your web.config file should be the cert thumbprint currently equipped on your Mailbox server.
Second issue I had was the Lync config wasnt correct. We deleted all the trusted application servers and recreated the trusted application server by creating new multi trusted app. added in the two CAS servers. then recreated the New-CsTrustedApplication
to tie with the newly created application server pool.
iisreset on all the servers and then the issue was resolved!
The reason why the SIP request was malformed was due to not having the web.config edits done properly.