2

Okay, I think this is a fairly simple task, but I'm having a little trouble testing reliably and working out what I've done wrong. I tried to follow the Apache mod_rewrite documentation, but it doesn't appear to be working the way I expected.

I have an Apache server running as a reverse proxy in front of an Exchange CAS for public OWA access, and we want to intercept ActiveSync traffic (simple pattern match) and redirect it to an AirWatch Secure Email Gateway (SEG) URL. All other (i.e. web browser OWA) traffic should be sent along to the CAS as usual.

So what we started with is something like this, and this works perfectly for OWA access, but doesn't do the ActiveSync-to-SEG redirect:

<VirtualHost *:443>
  ServerName webmail.company.com:443
  RewriteEngine on
  RewriteRule ^/$ https://webmail.company.com/exchange [R,L]
  <Location />
    Order allow,deny
    Allow from all
    # This is the CAS's internal IP
    ProxyPass https://10.100.10.209/
    ProxyPassReverse https://10.100.10.209/
  </Location>
</VirtualHost>

So I added this line (the one in the middle) in an attempt to rewrite URLs that begin with "/Microsoft-Server-Activesync/[whatever]" into "https://seg.company.com/Microsoft-Server-Activesync/[whatever]":

<VirtualHost *:443>
  ...
  RewriteEngine on
  RewriteRule ^/Microsoft-Server-Activesync?(.+)$ https://seg.company.com/Microsoft-Server-Activesync?$1 [R]
  RewriteRule ^/$ https://webmail.company.com/exchange [R,L]
  ...
</VirtualHost>

When I made this change (in test, of course), the traffic I'm sending to it from a mobile device does not appear to be getting redirected. Instead the ActiveSync traffic just flows along to the Exchange CAS as usual like the rule is not being triggered.

So, two questions:

  1. Am I doing something obvious wrong with the RewriteRule I added?, and
  2. How can I troubleshoot this a little more intelligently than, "Hit ActiveSync URL in a browser, check web server logs to find out where it went"?

Thanks in advance!

Regards, Jon Heese

1 Answer 1

2

Heh, that config looked familiar for a reason. Hey Jon! Hopefully I didn't leave too many messes for you to clean up.

I think you're most of the way there. One little case sensitivity issue, the phones should be sending /Microsoft-Server-ActiveSync instead of /Microsoft-Server-Activesync, so that would miss the match. Also, not sure if the requests will always have something following that path, so we'll want to have it still work if the capture is just a zero-length string (and if there's a query string, it's just carried through - we can completely ignore it and it'll be preserved).

Something like this:

RewriteRule ^/Microsoft-Server-ActiveSync(.*)$ https://seg.company.com/Microsoft-Server-ActiveSync$1 [R,L]

The L flag's not really necessary with the current config, but is generally good to have just to make sure no rewrites further down the line end up fiddling with the redirect target.

Try swapping that in, and if it doesn't work, a good way to dig further into what's happening would be to turn on a RewriteLog file, and turn up RewriteLogLevel 9.

1
  • Funny, you and I must have come to the same conclusions in parallel... I realized yesterday afternoon, after looking over the rule again that the ActiveSync URL didn't necessarily continue past the pattern I was matching on (don't know why I assumed it did at first), and removed the ?s. I forgot to come back here and update my question, but you deserve the correct answer anyhow. :) I didn't realize that the S in Activesync was capitalized, but it worked (on an iPhone 5 with iOS 6.1.something) without that change. But I will go ahead and make that change today, just in case. Thanks, Shane!
    – Jon Heese
    Aug 29, 2013 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .