Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have just installed an Exchange 2010 CAS server. Instead of moving everything and renaming and adding certificates, we merely added the CAS as a totally new name. The legacy environment has webmail.domain.com. We opted to test prior to changing our DNS entries. So for our new environment, we are using webmail2.domain.com. We have added a redirect to the legacy boxes for the 2003 mailboxes. The redirect works to the legacy boxes using a new URL (which will eventually become the legacy name during coexistence - mail.domain.com ---which is the webmail.domain.com server).

The redirect works, but the users are prompted to login twice. They login to the 2010 OWA and the redirect displays the 2003 OWA login page. I would like single sign on. Another issue is that even when testing the login, it errors out and says that the user can't be authenticated. Is it that the redirect points to a name that hasn't been added to IIS?

Forms Based Authentication is enabled on the 2003 servers as well.

I hope I explained it well enough. Essentially, we are trying to test the 2010 environment in a production environment prior to changing the DNS entries and changing certificates.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you have manually created a redirect on the CAS remove it. Exchange 2010 CAS will automatically redirect a user to the correct OWA page based on the Mailbox type (legacy, User). You want to configure the "Exchange2003Url" on the OWA Virtual directory. This tells OWA what URL to send Users to if their mailbox still exists on the Exchange 2003 servers.

Also note that setting it up in this way will allow the Exchange 2010 CAS to pass the authentication form across to the Exchange 2010 Front End server. This will ensure users do not have to re-authenticate once redirected.

Get-owavirtualdirectory | fl name,Exchange2003Url,RedirectType

Set-owavirtualdirectory -exchange2003Url "https://webmail.domain.com/exchange"

share|improve this answer
    
I actually used that command in the EMS to point to the new legacy URL. The problem is not that the redirect doesn't work, it does. The problem is that the 2003 OWA logon page comes up and won't authenticate users. I can literally type in the new URL and get the 2003 OWA-- still can't logon. I'm not sure if it's because we have yet to actually rename the legacy environment totally. It's still in charge and is still webmail.domain.com. The redirect goes to mail.domain.com. –  liquid101 Mar 24 '11 at 16:43
    
**Continued... we have given the new environment webmail2.domain.com to test prior to cutting over. –  liquid101 Mar 24 '11 at 16:43
    
If you go to webmail.domain.com/exchange and try to log into a mailbox on Exchange 2003 what happens? The Exchange 2003 Front End server should still function regardless of the Exchange 2010 environment. Also note that if you plan to move your environment to use webmail.domain.com as your email domain you should consider setting up a new subdomain for use in coexistence. i.e. legacy.domain.com that points to the same IP of the Exchange 2003 Front end server(s). –  Cheekaleak Mar 24 '11 at 17:12
    
The 2003 FE works fine with it's original name. I can logon with USERNAME/PASSWORD. When we test the new name that it will be called "mail.domain.com", we get the 2003 logon page, but it won't authenticate, it sends a logon error like the USERNAME or PASSWORD is incorrect. Which is strange since it's the same server. That being said, the new "mail" name is a VIP. Could the load balancer be stripping the logon credentials somehow? –  liquid101 Mar 24 '11 at 17:29
    
Okay so to clarify then: going to webmail.domain.com/exchange (ex03) works. going to mail.domain.com/exchange (same ex03) does not work? These are pointing to the same internal IP? What happens when you try by IP? –  Cheekaleak Mar 24 '11 at 17:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.