Lync 2013 to Exchange 2013 Oauth problem - Error:[OAuthTokenBuilder:GetAppToken] unable to continue building token; no locally configured issuer

Question

Hi,
I am having a problem getting OAuth to work from Exchange 2013 to Lync 2013.
I have read and following the instructions online and cannot see what I am doing wrong.
On the Exchange 2013 server, I get the following error when I run:
Test-OAuthConnectivity -Service EWS -TargetUri
https://exchserver2.domainname.local/ews/ -Mailbox "Jack"
RunspaceId : 920118a3-6ab2-45dc-9b68-de68133de95e
Task : Checking EWS API Call Under Oauth
Detail : The configuration was last successfully loaded at 01/01/0001 00:00:00 UTC. This was 1059263714 minutes
ago.
The token cache is being cleared because "use cached token" was set to false.
Exchange Outbound Oauth Log:
Client request ID: 19ad80f6-7751-429f-aac5-e802105fbbc6
Information:[OAuthCredentials:Authenticate] entering
Information:[OAuthCredentials:Authenticate] challenge from
'https://exchserver2.domainname.local/ews/Exchange.asmx' received: Bearer
client_id="00000002-0000-0ff1-ce00-000000000000",
trusted_issuers="[email protected]",Negotiate,NTLM
Information:[OAuthCredentials:GetToken] client-id: '00000002-0000-0ff1-ce00-000000000000', realm: '',
trusted_issuer: '[email protected]'
Information:[OAuthCredentials:GetToken] start building a token for the user domain 'domainname.co.uk'
Information:[OAuthTokenBuilder:GetAppToken] start building the apptoken
Information:[OAuthTokenBuilder:GetAppToken] checking enabled auth servers
Error:[OAuthTokenBuilder:GetAppToken] unable to continue building token; no locally configured issuer
was in the trusted_issuer list, realm from challenge was also empty. trust_issuers was
[email protected]
Error:The trusted issuers contained the following entries
'[email protected]'. None of them are configured locally.
Exchange Response Details:
HTTP response message:
Exception:
System.Net.WebException: The request was aborted: The request was canceled. --->
Microsoft.Exchange.Security.OAuth.OAuthTokenRequestFailedException: The trusted issuers contained the
following entries '[email protected]'. None of them are
configured locally.
at Microsoft.Exchange.Security.OAuth.OAuthTokenBuilder.GetAppToken(String applicationId, String
destinationHost, String realmFromChallenge, IssuerMetadata[] trustedIssuersFromChallenge, String
userDomain)
at Microsoft.Exchange.Security.OAuth.OAuthTokenBuilder.GetAppWithUserToken(String applicationId,
String destinationHost, String realmFromChallenge, IssuerMetadata[] trustedIssuersFromChallenge, String
userDomain, ClaimProvider claimProvider)
at Microsoft.Exchange.Security.OAuth.OAuthCredentials.GetToken(WebRequest webRequest,
HttpAuthenticationChallenge challengeObject)
at Microsoft.Exchange.Security.OAuth.OAuthCredentials.Authenticate(String challengeString, WebRequest
webRequest, Boolean preAuthenticate)
at Microsoft.Exchange.Security.OAuth.OAuthCredentials.OAuthAuthenticationModule.Authenticate(String
challenge, WebRequest request, ICredentials credentials)
at System.Net.AuthenticationManager.Authenticate(String challenge, WebRequest request, ICredentials
credentials)
at System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials
authInfo)
at System.Net.HttpWebRequest.CheckResubmitForAuth()
at System.Net.HttpWebRequest.CheckResubmit(Exception& e, Boolean& disableUpload)
at System.Net.HttpWebRequest.DoSubmitRequestProcessing(Exception& exception)
at System.Net.HttpWebRequest.ProcessResponse()
at System.Net.HttpWebRequest.SetResponse(CoreResponseData coreResponseData)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.Monitoring.TestOAuthConnectivityHelper.SendExchangeOAuthRequest(ADUser user,
String orgDomain, Uri targetUri, String& diagnosticMessage, Boolean appOnly, Boolean useCachedToken,
Boolean reloadConfig)
ResultType : Error
Identity : Microsoft.Exchange.Security.OAuth.ValidationResultNodeId
IsValid : True
ObjectState : New
It appears to work fine from Lync 2013 to Exchange 2013.
When I run: Test-CsExStorageConnectivity -sipuri [email protected] -Binding Nettcp -Verbose in Lync 2013 I get a successful outcome:
VERBOSE: Successfully opened a connection to storage service at localhost using
binding: NetNamedPipe.
VERBOSE: Create message.
VERBOSE: Execute Exchange Storage Command.
VERBOSE: Processing web storage response for ExCreateItem Success.,
result=Success, activityId=0bbdc565-4a05-4b57-bf95-0c75488a1ef6, reason=.
VERBOSE: Activity tracing:
2015/01/02 19:15:55.616 Autodiscover, send GetUserSettings request,
[email protected], Autodiscover
Uri=https://exchserver2.domainname.local/autodiscover/autodiscover.svc, Web
Proxy=<NULL>
2015/01/02 19:15:55.616 Autodiscover.EWSMA trace,
type=AutodiscoverRequestHttpHeaders, message=<Trace
Tag="AutodiscoverRequestHttpHeaders" Tid="30" Time="2015-01-02 19:15:55Z">
POST /autodiscover/autodiscover.svc HTTP/1.1
Content-Type: text/xml; charset=utf-8
Accept: text/xml
User-Agent: ExchangeServicesClient/15.00.0516.004
</Trace>
2015/01/02 19:15:55.624 Autodiscover.EWSMA trace, type=AutodiscoverRequest,
message=<Trace Tag="AutodiscoverRequest" Tid="30" Time="2015-01-02 19:15:55Z"
Version="15.00.0516.004">
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope
xmlns:a="http://schemas.microsoft.com/exchange/2010/Autodiscover"
xmlns:wsa="http://www.w3.org/2005/08/addressing"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<a:RequestedServerVersion>Exchange2013</a:RequestedServerVersion>
<wsa:Action>http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscove
r/GetUserSettings</wsa:Action>
<wsa:To>https://exchserver2.domainname.local/autodiscover/autodiscover.svc</
wsa:To>
</soap:Header>
<soap:Body>
<a:GetUserSettingsRequestMessage
xmlns:a="http://schemas.microsoft.com/exchange/2010/Autodiscover">
<a:Request>
<a:Users>
<a:User>
<a:Mailbox>[email protected]</a:Mailbox>
</a:User>
</a:Users>
<a:RequestedSettings>
<a:Setting>InternalEwsUrl</a:Setting>
<a:Setting>ExternalEwsUrl</a:Setting>
<a:Setting>ExternalEwsVersion</a:Setting>
</a:RequestedSettings>
</a:Request>
</a:GetUserSettingsRequestMessage>
</soap:Body>
</soap:Envelope>
</Trace>
2015/01/02 19:15:55.704 Autodiscover.EWSMA trace,
type=AutodiscoverResponseHttpHeaders, message=<Trace
Tag="AutodiscoverResponseHttpHeaders" Tid="30" Time="2015-01-02 19:15:55Z">
HTTP/1.1 200 OK
Transfer-Encoding: chunked
request-id: 5917d246-64b0-48e2-ad79-f9b6cffb5bea
X-CalculatedBETarget: exchserver2.domainname.local
X-DiagInfo: EXCHSERVER2
X-BEServer: EXCHSERVER2
Cache-Control: private
Content-Type: text/xml; charset=utf-8
Set-Cookie: ClientId=FTFXWUQWWRJVBMNBG; expires=Sat, 02-Jan-2016 19:15:55 GMT;
path=/;
HttpOnly,X-BackEndCookie=actas1(sid:S-1-5-21-3691024758-535552880-811174816-113
5|smtp:[email protected]|upn:[email protected])=u56Lnp2ejJqBx8jIn
sqbxpvSz8rHx9LLzp7O0sbOzcnSzcqcmZqem8aempmcgYHNz87K0s/N0s/Oq87Gxc7KxcrK;
expires=Sun, 01-Feb-2015 19:15:55 GMT; path=/autodiscover; secure; HttpOnly
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-FEServer: EXCHSERVER2
Date: Fri, 02 Jan 2015 19:15:55 GMT
</Trace>
2015/01/02 19:15:55.704 Autodiscover.EWSMA trace, type=AutodiscoverResponse,
message=<Trace Tag="AutodiscoverResponse" Tid="30" Time="2015-01-02 19:15:55Z"
Version="15.00.0516.004">
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<a:Action
s:mustUnderstand="1">http://schemas.microsoft.com/exchange/2010/Autodiscover/Au
todiscover/GetUserSettingsResponse</a:Action>
<h:ServerVersionInfo
xmlns:h="http://schemas.microsoft.com/exchange/2010/Autodiscover"
xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<h:MajorVersion>15</h:MajorVersion>
<h:MinorVersion>0</h:MinorVersion>
<h:MajorBuildNumber>1044</h:MajorBuildNumber>
<h:MinorBuildNumber>21</h:MinorBuildNumber>
<h:Version>Exchange2013_SP1</h:Version>
</h:ServerVersionInfo>
</s:Header>
<s:Body>
<GetUserSettingsResponseMessage
xmlns="http://schemas.microsoft.com/exchange/2010/Autodiscover">
<Response xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<ErrorCode>NoError</ErrorCode>
<ErrorMessage />
<UserResponses>
<UserResponse>
<ErrorCode>NoError</ErrorCode>
<ErrorMessage>No error.</ErrorMessage>
<RedirectTarget i:nil="true" />
<UserSettingErrors />
<UserSettings>
<UserSetting i:type="StringSetting">
<Name>InternalEwsUrl</Name>
<Value>https://exchserver2.domainname.local/EWS/Exchange.asmx</Value>
</UserSetting>
<UserSetting i:type="StringSetting">
<Name>ExternalEwsUrl</Name>
<Value>https://exchserver2.domainname.co.uk/EWS/Exchange.asmx</Value>
</UserSetting>
<UserSetting i:type="StringSetting">
<Name>ExternalEwsVersion</Name>
<Value>15.00.1044.000</Value>
</UserSetting>
</UserSettings>
</UserResponse>
</UserResponses>
</Response>
</GetUserSettingsResponseMessage>
</s:Body>
</s:Envelope>
</Trace>
2015/01/02 19:15:55.704 Autodiscover, received GetUserSettings response,
duration Ms=88, response=NoError
2015/01/02 19:15:55.706 Lookup user details,
sipUri=sip:[email protected], [email protected],
sid=S-1-5-21-3691024758-535552880-811174816-1135, [email protected],
tenantId=00000000-0000-0000-0000-000000000000
VERBOSE: Items choice type: CreateItemResponseMessage.
VERBOSE: Response message, class: Success, code: NoError.
VERBOSE: Item: Microsoft.Rtc.Internal.Storage.Exchange.Ews.MessageType, Id:
AAMkADAwNWZkZWI0LWM5NGYtNDUxNy05Nzk3LWZhZjRiY2Y4MTU4NwBGAAAAAADLP1MgTEXdQ7zQSlb
qPl++BwBauhRZTfLbTYZ+hBWtK784ANcdmUYqAACSqIurRqgYSZwMhT/IBw89AACnT6G9AAA=,
change key: CQAAABYAAACSqIurRqgYSZwMhT/IBw89AACnip6b, subject: , body: .
VERBOSE: Is command successful: True.
Test passed.
All my certificates on the Exchange 2013 and Lync 2013 servers are from my local CA.
I use APP with the public certificates as my reverse proxy for people connecting from outside the network.
In Lync, the OAuthTokenIssuer certificate created through the Lync deployment wizard is issued to domainname.local (my primary sip domain) and the Subject Alternative names include domainname.co.uk
I then exported this certificate to the Exchange Server and use the Set-AuthConfig to use this certificate for OAuth.
from what I read this was what I was supposed to do.
is this correct?
I have tried so many things I don't know what do to next.
Should the OAuth certificate in exchange be the one exported from Lync?
In Lync, should the OAuthTokenIssuer certificate include the servername or lyncserver.domainname.local or just be domainname.local like it is at the moment?
thank-you
jack

Answer 1

Thomas,
thanks for giving this the time. I have run the Configure-EnterpriseApplication.ps1 script following by remove-PartnerApplication so many times that I was wondering if there are other setting that
Configure-EnterpriseApplication.ps1 creates that aer not removed when you run
remove-PartnerApplication.
is there a way to completely remove everything that is confirmed when you run
Configure-EnterpriseApplication.ps1 so I can run Configure-EnterpriseApplication.ps1 without there being any configurations left from when I previously run that command?
thanks
jack
[PS] C:\Windows\system32>Get-PartnerApplication |fl
RunspaceId : cb2fb328-769d-4b32-8b7b-1fa35e2994f5
Enabled : True
ApplicationIdentifier : 00000004-0000-0ff1-ce00-000000000000
CertificateStrings : {MIIGcDCCBVigAwIBAgITPgAAARIHL+ig32UAAQAAAAABEjANBgkqhkiG9w0BAQUFADBcMRUwEwYKCZIm
iZPyLGQBGRYFbG9jYWwxHTAbBgoJkiaJk/IsZAEZFg1HdWlkZUNsb3RoaW5nMSQwIgYDVQQDExtHdWlkZ
UNsb3RoaW5nLUFQUFNFUlZFUjEtQ0EwHhcNMTUwMTEwMTIxODIzWhcNMTcwMTA5MTIxODIzWjB7MQswCQ
YDVQQGEwJHQjEPMA0GA1UECBMGTG9uZG9uMQ8wDQYDVQQHEwZMb25kb24xHzAdBgNVBAoTFkd1aWRlIEN
sb3RoaW5nIExpbWl0ZWQxCzAJBgNVBAsTAkhRMRwwGgYDVQQDExNHdWlkZUNsb3RoaW5nLmNvLnVrMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyzDzaLsjJfktsbwIJ998ihsZM/0rKGdIt8rIx00oc
HA7w0uVyz2UqnP9a8uRi6HkA7djbynlmGG0hKSUUQngXxz7q2dY6q9rcY5Rw2mJOMeppounx44FFp4+4e
5HQKviLTYo+3DBGIR0mYDqxanKPS00d0f7HDLvmVb90hjdrbE372JBdcNNHs2OHRqg37bN2fAbwd22c9x
2kvi0rESFnr+KcIGECVInCTHLJ7fwVqvi4hvRqtz7KLZsMXprpgeVDs45EMMRtwJ5Hw8uZR4CFz4dHSlo
dIVgDPn8Ns2vGhcUK0JU4WkDbjnqo1SJzHlqtNjiu//wGcn77PAiM0yhyQIDAQABo4IDCjCCAwYwCwYDV
R0PBAQDAgWgMCEGCSsGAQQBgjcUAgQUHhIAVwBlAGIAUwBlAHIAdgBlAHIwEwYDVR0lBAwwCgYIKwYBBQ
UHAwEwHQYDVR0OBBYEFOY3whPicRAXNsTDSIg3FexpaCKdMHUGA1UdEQRuMGyCH0x5bmNTZXJ2ZXIyLkd
1aWRlQ2xvdGhpbmcuY28udWuCH0x5bmNTZXJ2ZXIyLkd1aWRlQ2xvdGhpbmcubG9jYWyCE0d1aWRlQ2xv
dGhpbmcuY28udWuCE0d1aWRlQ2xvdGhpbmcubG9jYWwwHwYDVR0jBBgwFoAUDHst3gUSMGwvkiNTPavmi
UEWgtQwggEuBgNVHR8EggElMIIBITCCAR2gggEZoIIBFYaBzWxkYXA6Ly8vQ049R3VpZGVDbG90aGluZy
1BUFBTRVJWRVIxLUNBLENOPURvbVNlcnZlcjIsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2V
zLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9R3VpZGVDbG90aGluZyxEQz1sb2NhbD9jZXJ0
aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGQ
2h0dHA6Ly9jcmwuZ3VpZGVjbG90aGluZy5sb2NhbC9jcmxkL0d1aWRlQ2xvdGhpbmctQVBQU0VSVkVSMS
1DQS5jcmwwgdUGCCsGAQUFBwEBBIHIMIHFMIHCBggrBgEFBQcwAoaBtWxkYXA6Ly8vQ049R3VpZGVDbG9
0aGluZy1BUFBTRVJWRVIxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPUd1aWRlQ2xvdGhpbmcsREM9bG9jYWw/Y0FDZXJ0aWZpY2F0Z
T9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwDQYJKoZIhvcNAQEFBQADggEBAD
87GUPi02czEMO2Op0CeKBBpGwsfjYR9+RlC2uKAoH8PbWAxYNP3Ke6BtPeFy+95GGAJd5Z0+6LpO/AagA
+zeY/tocZQjy0pYaU4/TPZgD+ZB/8sU982msu+8waO316ipBcf/87n9ZW3Jjk5DcVbtwrZErrGRe9DEn8
QArN0jroLfaRtbDumse1Lp76+dxFuVhlLWcUXtIKaxm+UU9DS94EwJMtN54lDm3EG6hVdiGUR7TYqZU0K
HGm7HciIhuO+2rhAazOBiIAAW6wZRUpFKZONSVD6bKrQCzL12LvynQ7XC6Itgr4JGzNCmoN43dXwVCkWo
amTDdZY4h+QBqUvvY=}
AuthMetadataUrl : https://lyncserver2.domainname.local/metadata/json/1
Realm : domainname.local
UseAuthServer : False
AcceptSecurityIdentifierInformation : True
LinkedAccount : domainname.local/Users/LyncEnterprise-ApplicationAccount
IssuerIdentifier :
AppOnlyPermissions :
ActAsPermissions :
AdminDisplayName :
ExchangeVersion : 0.20 (15.0.0.0)
Name : LyncEnterprise-786f61476b634278a3c9b9e4ec08b660
DistinguishedName : CN=LyncEnterprise-786f61476b634278a3c9b9e4ec08b660,CN=Partner
Applications,CN=Auth Configuration,CN=domainname,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC=domainname,DC=local
Identity : LyncEnterprise-786f61476b634278a3c9b9e4ec08b660
Guid : 07495125-ccd4-4443-82d9-74fc3b955cdf
ObjectCategory : domainname.local/Configuration/Schema/ms-Exch-Auth-Partner-Application
ObjectClass : {top, msExchAuthPartnerApplication}
WhenChanged : 10/01/2015 17:14:55
WhenCreated : 10/01/2015 17:14:55
WhenChangedUTC : 10/01/2015 17:14:55
WhenCreatedUTC : 10/01/2015 17:14:55
OrganizationId :
Id : LyncEnterprise-786f61476b634278a3c9b9e4ec08b660
OriginatingServer : DomServer2.domainname.local
IsValid : True
ObjectState : Unchanged