Lync 2013 Mobility continues to not work

Question

Having issues getting mobility to work.
Simple environment:
Single server Edge pool
Single server EE pool
SQL clustered backend
All Lync 2013 CU1 at this point in time.
Potentially required reading:
Deploying Mobility (Technet)
Lync Mobility Deep dive
(based on 2010, but nearly the same in 2013)
http://masteringlync.com/2011/08/13/using-fiddler-to-troubleshoot-address-book-download-issues/
http://blogs.technet.com/b/nexthop/archive/2012/11/09/understanding-lync-server-autodiscover-to-support-the-lync-windows-store-app.aspx
Windows RT app uses the same method as IOS, and is more wiresharkable/tracable, so I am using that.
Client end errors:
Windows RT app (15.0.4481.1503) -  this client version cannot log in.
iOS - Can't sign in.  Please check your account information and try again.
I don't have a windows phone or android, so working with the clients I have.  (I understand these also do not work)
Fiddler trace of Windows RT app session:
 From the W3svc logs:
2013-03-20 03:53:17 1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user [email protected] 4443 - 75.122.79.199
LyncImm/15.0.4481.1503+(Microsoft+Lync) 401 0 0 35
LyncImm is
NOT a user agent listed in the CSCP - google "user agent" +lyncIMM turned up nothing.  Dead lead?
Lync connectivity analyzer shows it repeats the same webticket 401 over and over with:
Cookie  found in autodiscover response: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
  X-Ms-diagnostics: 28032;source="LyncFE.company.local";reason="The web ticket is invalid.";faultcode="wsse:InvalidSecurityToken"
  X-MS-WebTicketURL:
https://lyncweb.company.com/WebTicket/WebTicketService.svc
  X-MS-WebTicketSupported: cwt,saml
  X-MS-Server-Fqdn: LyncFE.company.local
  X-Content-Type-Options: nosniff
  Cache-Control: no-cache
  Date: Wed, 20 Mar 2013 04:12:20 GMT
  Server: Microsoft-IIS/7.5
  X-Powered-By: ASP.NET
  Content-Length: 1293
  Content-Type: text/html
LCA:  from inside, choosing Windows App - success!
LCA: from inside, choosing Lync Mobile Apps- fail:
Failed to obtain the WS-Metadata Exchange (MEX) document using GET for
https://lyncweb.company.com/Mcx/McxService.svc/mex.
The service did not require authorization.
LCA, from outside, choosing Windows App - hangs repeatedly on the HTTPS external channel.  (repeating 401's on webticket service)
LCA, from outside, choosing Choosing Lync Mobile apps  - failed, same as from inside #2
Here's what the LCA failure looked like:
2013-03-20 04:59:12
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 134
2013-03-20 04:59:12
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 155
2013-03-20 04:59:12
1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user
[email protected] 4443 - 75.122.79.199 -
401 0 0 35
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 126
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 158
2013-03-20 04:59:13
1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user
[email protected] 4443 - 75.122.79.199 -
401 0 0 31
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 126
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 148
2013-03-20 04:59:13
1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user
[email protected] 4443 - 75.122.79.199 -
401 0 0 33
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 121
2013-03-20 04:59:13
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 155
2013-03-20 04:59:13
1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user
[email protected] 4443 - 75.122.79.199 -
401 0 0 31
2013-03-20 04:59:15
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 125
2013-03-20 04:59:15
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 147
2013-03-20 04:59:15
1.2.3.4 GET /Autodiscover/AutodiscoverService.svc/root/user
[email protected] 4443 - 75.122.79.199 -
401 0 0 32
2013-03-20 04:59:15
1.2.3.4 POST /WebTicket/WebTicketService.svc/mex - 4443 - 75.122.79.199 - 200 0
0 120
2013-03-20 04:59:15
1.2.3.4 POST /WebTicket/WebTicketService.svc/Auth - 4443 - 75.122.79.199 - 200
0 0 151
Similar thread:
http://social.technet.microsoft.com/Forums/en-US/ocsmobility/thread/96c3fc3a-2f80-435a-8368-1a83dcd56e55/
http://msdn.microsoft.com/en-us/library/ff595929%28v=office.12%29.aspx
IOS attempt at sign on (version 4.3.8000.0000)
IIS log files:
2013-03-20 04:26:08
1.2.3.4 GET / sipuri=sip:[email protected] 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 200 0 0 1382013-03-20 04:26:08
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 0 0 802013-03-20 04:26:08
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074254 1292013-03-20 04:26:08
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074252 882013-03-20 04:26:08
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074254 782013-03-20 04:26:08
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074252 882013-03-20 04:26:09
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074254 782013-03-20 04:26:09
1.2.3.4 POST /webticket/webticketservice.svc - 4443 - 166.137.151.211
Lync%202010/1.6+CFNetwork/609.1.4+Darwin/13.0.0 401 1 2148074252 84
IOS log file was too large to post in message.
Running test-cmdlets:
$passwd1 = ConvertTo-SecureString "supersecure" -AsPlainText -Force $passwd2 = ConvertTo-SecureString "notontheinternet" -AsPlainText -Force $tuc1 = New-Object Management.Automation.PSCredential("domain\user1",
$passwd1) $tuc2 = New-Object Management.Automation.PSCredential("domain\user2", $passwd2) Test-CsMcxP2PIM -TargetFqdn lyncfe.company.local -Authentication Negotiate -SenderSipAddress sip:[email protected] -SenderCredential $tuc1 -ReceiverSipAddress
sip:[email protected] -ReceiverCredential $tuc2 -v
From <http://technet.microsoft.com/en-us/library/hh690024.aspx>
Results:
Target Fqdn   : lyncfe.company.com
Target Uri    :
https://lyncfe.company.com:443/mcx
Result        : Failure
Latency       : 00:00:00
Error Message : No response received for Web-Ticket service.
                Inner Exception:The HTTP request is unauthorized with client
                authentication scheme 'Ntlm'. The authentication header
                received from the server was 'Negotiate,NTLM'.
                Inner Exception:The remote server returned an error: (401)
                Unauthorized.
Diagnosis     :
                Inner Diagnosis:X-MS-Server-Fqdn : lyncfe.company.com
                Cache-Control : private
                Content-Type : text/html; charset=utf-8
                Server : Microsoft-IIS/7.5
                WWW-Authenticate : Negotiate,NTLM
                X-Powered-By : ASP.NET
                X-Content-Type-Options : nosniff
                Date : Wed, 20 Mar 2013 04:39:44 GMT
                Content-Length : 6639
Verbose comments on it:
Trying to get web ticket.
Web Service Url :
https://lyncfe.company.com:443/WebTicket/WebTicketService.svc
Using NTLM\Kerberos authentication.
Could not get a web ticket
CHECK:
 - Web service Url is valid and the web services are functional
 - If using Phone Number\PIN to authenticate, make sure they match the user uri
 - If using NTLM\Kerberos authentication, make sure you provided valid
credentials
URLs and ports all look OK, all services started.
Not using phone/PIN
I provided valid creds - the virtual directories show anon/NTLM for the Webticket vdir.
Any help is welcome - really want this issue put to bed!

Answer 1

I know this is an old thread, but I was struggling with the same error for mobility, and I hope this may help others in the same situation. 
On my scenario the issue was caused because the customer didn't use any reverse-proxy solution, instead the FE external website was directly published using a FortiGate box.
Given that scenario, there were 2 different certs installed on the FE server, 1 (internal RootCA) certificate was applied to the internal website, and another one issued by Godaddy was assigned to the external website manually from IIS console.
---I know this is far from a supported solution, but I was able to get it working after some investigation---
To solve the issue I use this article:
http://technet.microsoft.com/en-us/library/jj205253.aspx it explains how to check and assign the certificates for oAuth and I used these cmdlets to specify the Godaddy cert to the "WebServiceExternal" & "OAuthTokenIssuer" websites.
After that the mobility access for internal and external users started to work as expected, I've validated it with "Lync Connectivity Analyzer" and with different mobile clients on Android, IOS and Windows Store.
Hope this information may be useful.
Performance, Security & Design