Lync 2013 Hosting Pack - cannot join external non federated meetings anonymously with desktop client

Question

Hello,
I Have a setup of LHP 2013. We have been testing federation and connections to external on-premises meetings.
Right now users with lync desktop client (2013 and patched) cannot connect to external 3rd party meetings without using the ?SL=1 and using the Wep App.
Desktop Client gives error on log file:
ms-user-logon-data: RemoteUser
Authentication-Info: TLS-DSK qop="auth", opaque="58FBAFA0", srand="0B8651AD", snum="15", rspauth="b63e033e6376b48ec973718f7369e3b90b0d75ba", targetname="lyncfe2.hoster.fi", realm="SIP Communications
Service", version=4
Content-Length: 0
Via: SIP/2.0/TLS 172.20.10.7:49680;received="public.ip";ms-received-port=55863;ms-received-cid=48400
From: "cloud.testuser"<sip:[email protected]>;tag=8f59b0fb81;epid=c7d2e31185
To: <sip:[email protected];gruu;opaque=app:conf:focus:id:5P20J0SK>;tag=C258840F87FD8713D4ADE01307F32C5B
Call-ID: 386e091eb7794fb286b858984349fccd
CSeq: 1 INVITE
ms-diagnostics: 27000;reason="To-Uri Domain is not in the sender-tenant allow list";source="LYNCFE2.hoster.fi";appName="OutgoingFederation"
Server: OutgoingFederation/5.0.0.0
From some old post I have read that was a bug in Lync client that did not allow fail-back to anonymous login with non-federated lync organization, but this has been fixed long ago.
If I do setup a federation beetween the organizations the meetings connect ok.
Thanks for help!
BR, Jouni 

Answer 1

Hi Johan,
Lync client in test has been fully updated.
I Think I found what was causing this. In my tests, I added and removed domains from allowed and blocked domains list, in tenant config.
First after tenant organization has been provisioned the AllowedDomains looks like this:
Get-CsTenantFederationConfiguration -Tenant 10828ff2-165d-440f-9c00-6ce374ff0c6d
Identity              : Global
AllowedDomains        : Microsoft.Rtc.Management.WritableConfig.Settings.Edge.AllowAllKnownDomains
BlockedDomains        : {}
AllowFederatedUsers   : True
AllowPublicUsers      : True
SharedSipAddressSpace : False
And joining to non-federated meetings works correctly.
After fiddling with the allowed and blocked domains settings (adding and removing domains) settings look like this:
Identity              : Global
AllowedDomains        : Microsoft.Rtc.Management.WritableConfig.Settings.Edge.AllowList
BlockedDomains        : {}
AllowFederatedUsers   : True
AllowPublicUsers      : True
SharedSipAddressSpace : False
When I check what the "AllowList" keeps in, it is empty as it should:
$tenant = Get-CsTenant | Where-Object {$_.Name -eq "tenantname"}
$x = Get-CsTenantFederationConfiguration -Tenant $tenant.TenantId
$x.AllowedDomains
AllowedDomain : {}
If I set the AllowedDomain backup to original form meeting connections begin to work.
$all = New-CsEdgeAllowAllKnownDomains
Set-CsTenantFederationConfiguration -Tenant 10828ff2-165d-440f-9c00-6ce374ff0c6d -AllowedDomains $all
But now im just not very sure how I should setup the federation settings as per tenant/ExternalAccesspolicy/AccessEdgeConfiguration.. hmm..
BR, Jouni