ISA Server 2006 addresses the Contoso issues by making their applications available over the Internet in a secure way.

No Direct Access to Server from the Internet

SSL Packet Inspection

Authentication

ISA Server 2006 overcomes the difficulties of using client access VPN connections in the following ways:

• Access to published applications is via a Web browser.
  
• Applications are now more widely available and more accessible than remote access VPNs due to the use of SSL. You can access your published applications behind firewalls, from connections using network address translation (NAT), and from other networking devices that might otherwise be blocking remote access VPN connections.
  
• The reconnect process is easier and quicker, due to SSL. If your connection to the Internet is disconnected, you no longer need to reconnect via the remote access VPN dialer. After Internet access is reconnected, you can go back to your published application.
  
• Partners, vendors, and employees who are not in the office can easily access the required information in a secure way.
  

LDAP authentication is similar to Active Directory authentication, except that the ISA Server computer does not have to be a member of the domain. ISA Server 2006 connects to a configured LDAP server over the LDAP protocol to authenticate the user. Every Windows domain controller is also an LDAP server, by default, with no additional configuration changes required. By using LDAP authentication, you get the following benefits:

• ISA Server 2006 Standard Edition server or ISA Server 2006 Enterprise Edition array members in workgroup mode. When ISA Server is installed in a perimeter network, you no longer need to open all of the ports required for domain membership.
  
• Authentication of users in a domain with which there is no trust relationship.
  

For more information about LDAP, see Appendix B: LDAP Configuration.

To configure LDAP authentication, you need to:

Create an LDAP Server Set

Create an LDAP User Set

Create an LDAP Server Set

Create an LDAP User Set

Outlook Web Access provides Web browser access to e-mail, scheduling (including group scheduling), contacts, tasks, and collaborative information stored in Exchange Storage System folders. Outlook Web Access is used by remote, home, and roving users.

RPC over HTTP enables users to access e-mail with Office Outlook 2003 over the Internet. Exchange Server 2003, together with Outlook 2003 and Windows Server 2003, support the use of RPC over HTTP to access servers that are running Exchange Server. By using RPC over HTTP, users no longer have to use a VPN connection to connect to Exchange mailboxes. Users who are running Outlook 2003 on client computers can connect to an Exchange server in a corporate environment from the Internet.

When you publish Outlook Web Access servers and RPC over HTTP through ISA Server, you are protecting the Outlook Web Access server and the RPC over HTTP proxy server from direct external access because the name and IP address are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the Outlook Web Access server or RPC over HTTP proxy server according to the conditions of your mail server publishing rule.

Further, when you publish Outlook Web Access, ISA Server enables you to configure forms-based authentication, enforce required authentication methods, enable two-factor authentication, control e-mail attachment availability, and provide centralized logging.

The New Exchange Server Publishing Wizard also enables you to publish Outlook Mobile Access and Exchange ActiveSync®. Outlook Mobile Access provides users with access to Outlook from mobile devices. Using Exchange ActiveSync, you can synchronize with high levels of security, directly to your Exchange mailboxes from Microsoft Windows Mobile®-based devices, such as Pocket PC, Pocket PC Phone Edition, and Smartphones.

Before You Begin

In this section, the assumptions for the scenario are reviewed. Information worksheets are provided to assist in gathering the necessary information required when using the New Web Listener Wizard and the New Exchange Publishing Rule Wizard.

Scenario assumptions

The following assumptions apply to the scenario:

• Exchange Server 2003 is installed and configured on exchange01.
  
• Exchange Server 2003 is installed and configured on owa01. The owa01 computer should be configured as an Exchange front-end server. For more information about Exchange Server front-end and back-end configurations, see the following:
  
  • "Front-End and Back-End Server Topology Guide for Exchange Server 2003 and Exchange 2000 Server" at the Microsoft TechNet Web site
    
  • "Configuring an Exchange Front-End Server" at the Microsoft TechNet Web site
    

  Important:
  On owa01, do not select the Exchange Server 2003 forms-based authentication option. Forms-based authentication should be configured on the ISA Server Web publishing rule.

• The owa01 computer has an SSL certificate installed from dc01 with a common name of owa01.corp.contoso.com. The internal URL is https://owa01.corp.contoso.com/exchange.
  
• The external common name (fully qualified domain name or FQDN) is mail.contoso.com.
  
• The isa01 computer has the root CA certificate for dc01 installed. This is necessary for ISA Server to accept the validity of the certificate on owa01.
  
• The isa01 computer has an SSL certificate installed from router01 with the common name of mail.contoso.com.
  
• The FQDN mail.contoso.com will resolve to the IP address 172.16.0.104, which is installed as a secondary IP address on isa01.
  

Information worksheets

Update the following table with information that will be used when you use the New Web Listener Wizard.

Property	Value
Web listener name	Name: ________________________
Client connection security Note the following: If HTTP is selected, information between the ISA Server computer and the client will be transferred in plaintext. If HTTPS is selected, a server certificate needs to be installed on the ISA Server computer.	HTTPS or HTTP (circle one)
Web listener IP address	Network: ___________________ Optional Specific IP address: ___.___.___.___ Note: If this specific IP address is not the primary network adapter IP address, a secondary IP address needs to be installed on the ISA Server computer before creating the Web listener.
Authentication settings Web listener SSL certificate Note   This is only required if HTTPS has been selected for client connectivity security.	___Use a single certificate for this Web listener. Certificate issued to: _______________________ ___Assign a certificate for each IP address. (This option will only be available if a specific IP address has been assigned to the Web listener.) Certificate issued to: _______________________
Single sign on settings	___Enable single sign on. Single sign on domain name: ___________________________

Update the following table with information that will be used when you use the New Exchange Publishing Rule Wizard.

Property	Value
Exchange publishing rule name	Name: ________________________
Services	Exchange version: ____________ __Outlook Web Access __Outlook RPC over HTTP __Outlook Mobile Access __Exchange ActiveSync
Publishing type	__Publish a single Web site. or __Publish a server farm of load balanced servers. and Server farm name:_____________
Server connection security	HTTPS or HTTP (circle one) Note the following: If HTTP is selected, information between the ISA Server computer and the Web server will be transferred in plaintext. If HTTPS is selected, a server certificate needs to be installed on the Web server.
Internal publishing details	Internal site name (FQDN): ______________________ If the FQDN is not resolvable by the ISA Server computer: Computer name or IP address:_____________________
Public name details	Accept request for: __This domain name:______________ or __Any domain name
Select Web listener	Web listener:________________
User set	List user sets that will have access to this rule: _________________ __________________

Walk-Through

The following computers are required for this walk-through:

• dc01
  
• exchange01
  
• owa01
  
• storage01 (for Enterprise Edition)
  
• isa01
  
• router01
  
• client01
  

The following procedures are used to publish Outlook Web Access and RPC over HTTP:

Create a server farm (optional)

Create a Web listener

Create an Exchange Web client access publishing rule

Create a server farm (optional)

When you have more than one Web server providing access to the same content, you can use ISA Server 2006 to provide load balancing for these servers. This will enable you to publish the Web site once, instead of having to run the wizard multiple times. Also, this eliminates the need for a third-party product to load balance a Web site. If one of the servers is unavailable, ISA Server 2006 will detect that the server is not available and will direct users to servers that are working. ISA Server 2006 verifies on regular intervals that the servers that are members of the server farm are functioning. The server farm properties determine the following:

• Servers included in the farm
  
• Connectivity verification method that ISA Server will use to verify that the servers are functioning
  

Server farm considerations:

• There is a second Exchange front-end server named owa02.corp.contoso.com.
  
• Both servers have a server certificate installed with the following FQDN: owa.corp.contoso.com.
  

Perform the following procedure to create a server farm.

To create a server farm

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, click New, and select Server Farm. Use the wizard to create the server farm as outlined in the following table.

Page	Field or property	Setting
Welcome	Server farm name	Type Exchange OWA.
Servers	Servers	Select Add and enter either the IP addresses or names of your servers: owa01.corp.contoso.com owa02.corp.contoso.com
Connectivity Monitoring	Apply this method	Select Send an HTTP/HTTPS "GET" request to the following URL.
Completing the New Server Farm Wizard	Reviews settings.	Click Back to make changes and Finish to complete the wizard.

1. When the wizard completes, click Yes in the Enable HTTP Connectivity Verification dialog box.
   
2. Click the Apply button in the details pane to save the changes and update the configuration.
   

For more information about connectivity verifiers, see the product Help.

Create a Web listener

When you create a Web publishing rule, you must specify a Web listener to be used when creating the rule. The Web listener properties determine the following:

• Which IP addresses and ports on the specified networks will listen for Web requests (HTTP or HTTPS).
  
• Which server certificates to use with which IP address.
  
• Which authentication method to use.
  
• Number of concurrent connections that are allowed.
  
• Single sign on (SSO) settings.
  

Use the information on the worksheet that you filled in previously, and perform the following procedure to create a Web listener.

To create a Web listener

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, click New, and then select Web Listener. Use the wizard to create the Web listener as outlined in the following table.

Page	Field or property	Setting
Welcome	Web listener name	Type FBA.
Client Connection Security	Connection type, either SSL or not SSL.	Select Require SSL secured connections with clients.
Web Listener IP Addresses	Listen for incoming Web requests on these networks ISA Server will compress content Select IP Addresses	Select the External network. Check box should be selected (default). See External Network Listener IP Selection page.
External Network Listener IP Selection	Listen for requests on Available IP Addresses	Select Specified IP addresses on the ISA Server computer in the selected network. Select 172.16.0.104 and click Add.
Listener SSL Certificates	A Web listener can use a single certificate for all of its IP addresses, or a different certificate for each IP address.	Select Assign a certificate for each IP address. Select IP address 172.16.0.104 and click Select Certificate.
Select Certificate	Select a certificate	Select the certificate issued to mail.contoso.com and click Select. The certificate must be installed before running the wizard.
Authentication Settings	Specify how clients will provide credentials to ISA Server Select how ISA Server will validate client credentials	Select HTML Form Authentication. Select LDAP (Active Directory).
Single Sign On Settings	Enable SSO for Web sites published with this Web listener SSO domain name	Clear this check box. SSO will be enabled later in the solution. Leave this field blank.
Completing the New Web Listener Wizard	Review settings.	Click Back to make changes or Finish to complete the wizard.

Create an Exchange Web client access publishing rule

When you publish an internal Web server through ISA Server 2006, you are protecting the Web server from direct external access because the name and IP address of the server are not accessible to the user. The user accesses the ISA Server 2006 computer, which then forwards the request to the internal Web server according to the conditions of your Web server publishing rule. An Exchange Web client access publishing rule is a Web publishing rule that contains default settings appropriate to Exchange Web client access.

Use the information on the worksheet that you filled in previously, and perform the following procedure to create an Exchange Web client access publishing rule.

To create an Exchange Web client access publishing rule

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Tasks tab, click Publish Exchange Web Client Access. Use the wizard to create the rule as outlined in the following tables.

For a single Web server, use the table in New Exchange Publishing Rule Wizard for a single Web site.

New Exchange Publishing Rule Wizard for a single Web site

Page	Field or property	Setting
Welcome	Exchange Publishing rule name	Type Exchange OWA Publishing.
Select Services	Exchange version Web client mail services	Select Exchange Server 2003. Select Outlook Web Access and Outlook RPC/HTTP(s).
Publishing Type	Select the type of publishing.	Select Publish a single Web site or load balancer.
Server Connectivity Security	Choose the type of connections ISA Server will establish with the published Web server or server farm.	Select Use SSL to connect to the published Web server or server farm.
Internal Publishing Details	Internal site name	Type owa01.corp.contoso.com. Important: The internal site name must match the name of the server certificate that is installed on the internal Web server. Note: If you cannot properly resolve the internal site name, you can select Use a computer name or IP address to connect to the published server and then type the required IP address or name that is resolvable by the ISA Server computer.
Public Name Details	Accept requests for Public name	This domain name (type below) Type mail.contoso.com.
Select Web Listener	Web listener	Select FBA.
Authentication Delegation	Select the method used by ISA Server to authenticate to the published Web server	Select Basic authentication.
User Sets	This rule applies to requests from the following user sets	Select All Authenticated Users and click Remove. Click Add, select LDAPUsers, click Add, and then click Close.
Completing the New Exchange Publishing Rule Wizard	Review settings.	Click Back to make changes and Finish to complete the wizard.

1. Click the Apply button in the details pane to save the changes and update the configuration.
   

Go to SSL Bridging.

New Exchange Server Publishing Rule Wizard for a server farm

Page	Field or property	Setting
Welcome	Exchange Publishing rule name	Type Exchange OWA Publishing.
Select Services	Exchange version Web client mail services	Select Exchange Server 2003. Select Outlook Web Access and Outlook RPC/HTTP(s).
Publishing Type	Select the type of publishing.	Select Publish a server farm of load balanced Web servers.
Server Connectivity Security	Choose the type of connections ISA Server will establish with the published Web server or server farm.	Select Use SSL to connect to the published Web server or server farm. Note: A server certificate must be installed on the published Web servers and the root CA certificate must be installed on the ISA Server computer.
Internal Publishing Details	Internal site name	Type owa.corp.contoso.com. Important: The internal site name must match the name of the server certificate that is installed on the internal Web servers. Note   If you cannot properly resolve the Internal site name, you can select Use a computer name or IP address to connect to the published server and then type the required IP address or name that is resolvable by the ISA Server computer.
Specify Server Farm	Select the Web mail farm you want to publish	Select Exchange OWA.
Public Name Details	Accept requests for Public name	This domain name (type below) Type mail.contoso.com.
Select Web Listener	Web listener	Select FBA.
Authentication Delegation	Select the method used by ISA Server to authenticate to the published Web server	Select Basic authentication.
User Sets	This rule applies to requests from the following user sets	Select All Authenticated Users and click Remove. Click Add, select LDAPUsers, click Add, and then click Close.
Completing the New Exchange Publishing Rule Wizard	Review settings.	Click Back to make changes and Finish to complete the wizard.

1. Click the Apply button in the details pane to save the changes and update the configuration.
   

SSL bridging

SSL bridging is used when ISA Server ends or initiates an SSL connection. In ISA Server 2006, SSL bridging is automatically configured when the specified Web listener is configured to listen for HTTPS traffic.

Specifically, SSL bridging works in the following scenarios:

• A client requests an SSL object. ISA Server decrypts the request, and then encrypts it again and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. ISA Server decrypts the object and then encrypts it again and sends it to the client. SSL requests are forwarded as SSL requests.
  
• A client requests an SSL object. ISA Server decrypts the request and forwards it to the Web server. The Web server returns the HTTP object to ISA Server. ISA Server encrypts the object and sends it to the client. SSL requests are forwarded as HTTP requests.
  

For incoming Web requests, an external client uses HTTPS to request an object from a Web server located on your Internal network. The client connects to ISA Server on a port—by default, port 443.

After receiving the client's request, ISA Server decrypts it, terminating the SSL connection. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server (FTP, HTTP, or SSL).

If the secure Web publishing rule is configured to forward the request using HTTPS, ISA Server initiates a new SSL connection with the publishing server, sending a request to port 443. Because the ISA Server computer is now an SSL client, it requires that the publishing Web server responds with a server-side certificate.

Test Exchange publishing rule

In this section, you will test the new Exchange publishing rule that you just created.

Test Outlook Web Access

From the router01 or client01 computer, use the following procedure to test the new Exchange Web client access publishing rule.

Note   Make sure that you have the root CA of the issuing CA of the mail.contoso.com certificate installed.

To test the Outlook Web Access publishing rule

1. Open Microsoft Internet Explorer.

2. Browse to the following URL: https://mail.contoso.com/exchange and use the following details to log on:

   1. Domain\user name: corp\mberg
      
   2. Password: Passw0rd
      

1. You can now read and send e-mail messages.
   

Test RPC over HTTP

This procedure must be done from client01.

Note:
We recommend configuring Outlook without RPC over HTTP. Confirm that Outlook is working properly on the Internal network before configuring RPC over HTTP.

To test RPC over HTTP from Outlook 2003 from client01 from the Test_Internet network

1. Change the following account setting in Outlook 2003:

   1. On the Outlook 2003 Tools menu, select E-mail Accounts.
      
   2. Select View or change existing e-mail accounts, and then click Next.
      
   3. Select your Microsoft Exchange account and click Change.
      
   4. Click More Settings.
      
   5. If you receive an error from Outlook that it could not connect to Exchange, click Cancel and continue to step H.
      
   6. Click the Connection tab, select Connect to my Exchange mailbox using HTTP, and then click Exchange Proxy Settings.
      
   7. Type mail.contoso.com in Use this URL to connect to my proxy server for Exchange in Connection settings.
      
   8. Select Mutually authenticate the session when connecting with SSL and type msstd:mail.contoso.com in Principal name for proxy server.
      
   9. Select Basic Authentication for Proxy authentication settings.
      

1. Click OK to close the Exchange Proxy Settings dialog box.
   
2. Click OK to close the Microsoft Exchange Server dialog box.
   
3. Click Next and then click Finished to close the E-mail Accounts dialog box.
   
4. Restart Outlook.
   

1. When you restart Outlook, you will be presented with a logon dialog box. Enter the user name and password and click OK.
   

Note:
For RPC over HTTP to work, both when the user is out of the office and when the user is in the office, the FQDN mail.contoso.com must resolve to the external address when users are in the office and when connected to the Internet.

ISA Server 2006 works with Windows SharePoint Services and SharePoint Portal Server 2003, to enhance security.

Using the combined collaboration features of Windows SharePoint Services and SharePoint Portal Server 2003, users in your organization can easily create, manage, and build their own collaborative Web sites and make them available throughout the organization.

When you publish SharePoint portal sites to the Internet, you provide employees, who are not in the office, access to the information that they need to complete their jobs, no matter where they are located, without compromising security.

When you publish a SharePoint site through ISA Server, you protect the SharePoint site from direct external access because the name and IP address of the SharePoint site are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the published SharePoint site according to the conditions of your SharePoint publishing rule.

When you publish a SharePoint site, ISA Server enables you to configure forms-based authentication, enforce a required authentication method, enable two-factor authentication, control attachment availability, and control centralized logging.

Before You Begin

Walk-Through

The following computers are required for this walk-through:

• dc01
  
• storage01 (Enterprise Edition)
  
• isa01
  
• sps01
  
• router01
  

The following sections describe how to configure the solution:

Edit the Web listener

Publish SharePoint site

Test SharePoint publishing

Edit the Web listener

You need to modify the Web listener, created in Create a Web listener, so that the ISA Server computer listens for requests on the IP address 172.16.0.103, and uses the portal.contoso.com server certificate only on this IP address. The Web listener will then listen for Exchange Web client requests on 172.16.0.104, using the certificate that matches the public name used for Exchange Web client access, and will listen on 172.16.0.103 for SharePoint client requests, using the certificate that matches the public name used for SharePoint client access.

To edit the Web listener

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click FBA, and then select Properties.

3. Select the Networks tab. Select External and click Address.

4. Select 172.16.0.103 from the Available IP Addresses column, click Add, and click OK.

5. Click the Certificates tab, and then:

   1. Select 172.16.0.103 and click Select Certificate.
      
   2. Select portal.contoso.com and click Select.
      

6. Click OK to close the properties of the FBA Web listener.

Publish SharePoint site

Use the information on the worksheet that you filled in previously, and perform the following procedure to publish a SharePoint site.

To publish the SharePoint site

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Tasks tab, click Publish SharePoint Sites. Use the wizard to create a rule as outlined in the following table.

Page	Field or property	Setting
Welcome	SharePoint publishing rule name	Type Publishing SharePoint.
Publishing Type	Publishing type options	Select Publish a single Web site or load balancer.
Server Connection Security	Choose the type of connections ISA Server will establish with the published server or server farm	Select Use SSL to connect to the published Web server or server farm.
Internal Publishing Details	Internal site name	Type sps01.corp.contoso.com. Important: The internal site name must match the name of the server certificate that is installed on the internal Web servers. Note   If you cannot properly resolve the internal site name, you can select Use a computer name or IP address to connect to the published server and then type the required IP address or name that is resolvable by the ISA Server computer.
Public Name Details	Accept requests for Public name	This domain name (type below) Type portal.contoso.com.
Select Web Listener	Web listener	Select FBA.
Authentication Delegation	Select the method used by ISA Server to authenticate to the published Web server	Select NTLM authentication.
Alternate Access Mapping Configuration	For complete integration and functionality, you need to configure alternate access mapping on the published SharePoint site.	Select SharePoint AAM is already configured on the SharePoint server.
User Sets	This rule applies to requests from the following user sets	Select All Authenticated Users and click Remove. Click Add, select LDAPUsers, click Add, and then click Close.
Completing the New SharePoint Publishing Rule Wizard	Review settings.	Click Back to make changes and Finish to complete the wizard.

1. Click the Apply button in the details pane to save the changes and update the configuration.
   

Note:
If the SharePoint site does not contain confidential information, you can choose Use non-secured connections to connect the published Web server or server farm on the Server Connection Security page. The connection from the user to the ISA Server would be via HTTPS. The connection from the ISA Server to the internal published server the connection would be via HTTP.

Test SharePoint publishing

On the router01 or client01 computer, perform the following procedure to test the new SharePoint publishing rule.

Note:
Make sure that you have the root CA certificate of the issuing CA of the portal.contoso.com certificate installed.

To test SharePoint publishing

1. Open Internet Explorer.

2. Browse to the following url: https://portal.contoso.com. Use the following details to log on:

   1. Domain\user name: corp\mberg
      
   2. Password: Passw0rd
      

You should be in the portal now.

1. On the right side, select External OWA under Links for You.
   
2. This will open a new ISA Server logon page so you can open the published Outlook Web Access site you created earlier.
   

This is not ideal, because users must log on multiple times with the same credentials. This might be confusing, generating unnecessary support calls. This also increases the time it takes to complete a task. When users are rushed, such as trying to depart on an airplane flight, they might not be able to complete the task. For this reason, you should configure SSO, as described in the next topic.

When users access two different Web sites, such as an Outlook Web Access site and a SharePoint site, users should not have to provide the same credentials again when they click a link to open another site.

The ISA Server 2006 SSO feature reuses user credentials for another published server, eliminating the need to reenter credentials a second or third time. This will enhance the user experience, because users will click a link that will open another Web application without having to provide their credentials.

The following assumptions apply:

• Outlook Web Access is successfully published.
  
• SharePoint Portal Server is successfully published.
  

The following computers are required:

• dc01
  
• storage01 (Enterprise Edition)
  
• isa01
  
• sps01
  
• exchange01
  
• owa01
  
• router01
  

The following sections describe how to configure the solution:

Modify a Web Listener to Enable Single Sign On

Test Single Sign On Between SharePoint Portal Server and Outlook Web Access

Modify a Web Listener to Enable Single Sign On

To modify a Web listener to enable single sign on

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand ISA01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click FBA, and then select Properties.

3. Click the SSO tab. Select Enable Single Sign On. (Typically, this is enabled by default. You disabled SSO when you created the Web listener in Create a Web Listener.)

4. Click Add to specify the SSO domains for the Web listener.

5. Enter .contoso.com and click OK.

6. Click OK to close the FBA Properties dialog box.

7. Click the Apply button in the details pane to save the changes and update the configuration.

Important:
When enabling SSO, be sure to provide a specific SSO domain. Providing a generic domain, such as .co.uk, will allow the Web browser to send the ISA Server SSO cookie to any Web site in that domain, creating a security risk.

Note the following:

• There is no support for SSO between different Web listeners.
  
• Published servers must share the same DNS suffix. For example, you can configure SSO when publishing mail.contoso.com and portal.contoso.com. You cannot configure SSO when publishing mail.fabrikam.com and portal.contoso.com.
  

Test Single Sign On Between SharePoint Portal Server and Outlook Web Access

On the router01 or client01 computer, perform the following procedure to test the new SharePoint publishing rule.

To test single sign on between SharePoint Portal Server and Outlook Web Access

1. Open Internet Explorer.

2. Browse to the following URL: https://portal.contoso.com. Use the following details to log on:

   1. Domain\user name: corp\mberg
      
   2. Password: Passw0rd
      

1. On the right side, select External OWA under Links for You.
   
2. This will automatically open the user's Outlook Web Access page.
   
3. Log off from the Outlook Web Access page.
   
4. You can log on to https://mail.contoso.com/exchange, open an e-mail message called New External Portal, and then click the link in the e-mail message to open the SharePoint portal site.
   

When publishing a Web site, we recommend that users open an HTTPS connection between them and the ISA Server computer to protect the sensitive information that is being transferred over the Internet. This requires that users enter a URL such as https://portal.contoso.com. If the user just enters portal.contoso.com, the user will receive the following error.

Users have a tendency not to enter the HTTPS portion of the URL even when going to a secured Web site. This behavior has been reinforced by Web administrators who have scripted their Web sites to redirect users to an HTTPS page, even when they enter HTTP. This is done to reduce the number of Help desk calls by users when they cannot open the URL they are trying to open.

To enable HTTP to HTTPS redirection, perform the following procedure.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click the Web listener, and then select Properties.

3. Select the Connections tab.

4. Select Enable HTTP connections on port and confirm that the listening port for HTTP is 80.

5. Confirm that Enable SSL (HTTPS) connections on port is selected and is listening on port 443.

6. Select Redirect all traffic from HTTP to HTTPS.

1. Click OK to close the properties of the Web listener.
   
2. Click the Apply button in the details pane to save the changes and update the configuration.
   

It is good security policy to require your users to change their passwords on a regular basis. Users who are not in the office on a regular basis need a method to change their passwords when they are not in the office.

When using forms-based authentication, you can inform users that their passwords are going to expire in a specific number of days and you can enable your users to change their passwords so they do not expire. Users will also be able to change an expired password.

To configure the Change Password option when using LDAP authentication, LDAP needs to be configured with the following settings:

• Connection to the LDAP servers must be over a secured connection. This requires an SSL certificate to be installed on the Active Directory server. For more information about enabling LDAP over SSL, see "How to Enable LDAP over SSL with a third party certification authority" at the Microsoft Support Web site.
  
• The ISA Server computer needs to have the root certificate for the CA that issued the SSL certificate installed on the Active Directory servers.
  
• Connection to the LDAP servers cannot be via a global catalog.
  
• A user name and password that are used for verifying user account status and changing passwords are required.
  

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click the Web listener, and then select Properties.

3. Select the Forms tab.

4. Select Allow users to change their passwords and Remind users that their password will expire in this number of days. The default number of days is 15.

1. Click OK to close the properties of the Web listener.
   
2. Click the Apply button in the details pane to save the changes and update the configuration.
   

The users will now see the following logon screen. Notice the option I want to change my password after logging on.

To properly configure LDAP authentication, you need to configure an LDAP server set and at least one login expression.

LDAP Server Set

An LDAP server set is a grouping of LDAP servers, which ISA Server uses to perform user authentication. All the servers in an LDAP server set share the same LDAP connection settings.

The following table lists the properties of an LDAP server set.

Item	Description	Comment
LDAP server set	Listing of LDAP servers available for LDAP user authentication. All servers listed will share the same LDAP connection settings.	Required.
LDAP servers	Listing of LDAP servers available for LDAP user authentication. Note the following: When there is more than one server, the servers are queried in the order in which they are listed. If a server does not respond, it will be in time-out for 1 minute. If the same server does not respond again after the 1 minute time-out, the time-out will continue to double until the time-out reaches 32 minutes. At that point, the time-out stays at 32 minutes. When ISA Server connects to the server, the time-out counter is reset. We recommend that you configure more than one LDAP server to provide redundancy for user authentication.	Minimum of one server is required.
Active Directory domain	Enter the domain name of the domain where the user accounts are defined. The name of the domain can be in one of the following formats: FQDN: corp.contoso.com Distinguished name: DC=corp,DC=contoso,DC=com	Optional if Use Global Catalog (GC) has not been selected.
Use global catalog	If your LDAP servers are also configured to be global catalog servers, select the Use Global Catalog (GC) option and you do not need to specify an Active Directory domain name. To use the Change Password option, this option must not be selected.	Optional. Note   The Password Management feature does not work when an LDAP server set is configured with this property.
Connect LDAP servers over secure connection	Select the Connect LDAP servers over secure connection option, if you want the connection between the ISA Server computer and the LDAP server to be encrypted via SSL. For more information about enabling LDAP over SSL, see "How to Enable LDAP over SSL with a third party certification authority" at the Microsoft Support Web site.	Optional. Note: To use the Change Password option, this option must be selected.
User name and password	This option is only required if you want to use the Password Management option with forms-based authentication. Because the ISA Server computer will not be a member of the domain, you need to specify a user name and password that will be used for verifying user account status. This account can be any domain account, even a restrictive user account. This account is used by the ISA Server to bind to the LDAP server and query the properties of the user who is logging on. This account is not involved when changing the user's password.	Optional.

Login Expression

Before You Begin

Update the following table with information about the LDAP server set and login expressions.

Item	Value
LDAP server set	Name: _________________
Server name	Name: ___________________ or IP address: ___.___.___.___
Active Directory domain name	FQDN or distinguished name: _____________________________
Use global catalog	Yes or no (circle one)
Connect LDAP servers over secure connection	Yes or no (circle one) Note   If you have selected to connect over a secure connection, confirm that the proper certificates have been installed.
User name and password	User name: ______________ Password: ________________
Login expression	__________________ For example: corp\*

To create an LDAP server set, see Create an LDAP Server Set.

Note:
Use the LDP.exe tool to test the connectivity between the ISA Server computer and the LDAP server. LDP.exe, by default, is located in the following location: %PROGRAMFILES%\Support Tools directory.

Windows SharePoint Services allows teams to create Web sites for information sharing and document collaboration, benefits that help increase individual and team productivity. Windows SharePoint Services is a component of the Windows Server 2003 information worker infrastructure and provides team services and sites to the Microsoft Office System and other desktop programs. It also serves as a platform for application development. Including such information technology (IT) resources as portals, team workspaces, e-mail, presence awareness, and Web-based conferencing, Windows SharePoint Services enables users to locate distributed information quickly and efficiently, as well as connect to and work with others more productively.

For more information about Windows SharePoint Services, see the Windows SharePoint Services home page.

SharePoint Portal Server 2003 enables enterprises to develop an intelligent portal that seamlessly connects users, teams, and knowledge so that people can take advantage of relevant information across business processes to help them work more efficiently. SharePoint Portal Server 2003 provides an enterprise business solution that integrates information from various systems into one solution through single sign on and enterprise application integration capabilities, with flexible deployment options and management tools. The portal facilitates end-to-end collaboration by enabling aggregation, organization, and search capabilities for people, teams, and information. Users can find relevant information quickly through customization and personalization of portal content and layout, as well as by audience targeting. Organizations can target information, programs, and updates to audiences based on their organizational role, team membership, interest, security group, or any other membership criteria that can be defined.

SharePoint Portal Server 2003 uses Windows SharePoint Services sites to create portal pages for people, information, and organizations. The portal also extends the capabilities of Windows SharePoint Services sites with organization and management tools, and enables teams to publish information in their sites to the entire organization.

For more information about SharePoint Portal Server, see the SharePoint Portal Server home page.

To properly configure alternate access mapping settings, you need the software versions discussed in the following table.

Consider the following:

• Configuration of alternate access mapping for Windows SharePoint Services is done from a command prompt with the Stsadm.exe command.
  
• Configuration of alternate access mapping for SharePoint Portal Server is done via Central Administration for the SharePoint Portal Server Web administration.
  

Note:
If you are running SharePoint Portal Server, we recommend also configuring alternate access mapping settings for Windows SharePoint Services.

Scenario

Windows SharePoint Services Configuration

SharePoint Portal Server Configuration

For SharePoint Portal Server, you need to configure the alternate access mapping method (zone), which automatically configures both the incoming and outgoing setting.

To configure alternate access mapping for SharePoint Portal Server

1. Click Start, point to Programs, point to SharePoint Portal Server, and then click SharePoint Central Administration to open the SharePoint Central Administration application.

2. On the SharePoint Portal Server Central Administration for SPS01 page, in the Portal Site and Virtual Server Configuration section, click Configure alternate portal site URLs for intranet, extranet, and custom access.

3. On the Configure Alternate Portal Access Settings page, point to Default Web Site, and then click the arrow that appears.

4. On the menu that appears, click Edit.

5. On the Change Alternate Access Setting page, in the Extranet URL box, type the extranet URL https://portal.contoso.com.

6. Click OK.

Note:
This only configures alternate access mapping for SharePoint Portal Server services. If your site is also using Windows SharePoint Services services, you need to also configure alternate access mapping for Windows SharePoint Services.

We do not recommend publishing two sites with the same host name. If you had two internal Web sites, http://site1 and http://site2, do not publish them using the same host name, http://external.contoso.com/site1 and http://external.contoso.com/site2.

The more secure publishing method is to publish each site with a unique host name, http://site1.contoso.com and http://site2.contoso.com.

Users should be educated to properly log off from kiosk workstations. This is especially important when using published applications that do not have a log off button and when single sign on is configured.

If a user is accessing a published application, a cookie is stored on the local computer. If the application does not have a log off button, and the user browses to another Web page and then leaves the kiosk without logging off, the cookie is still on the computer and still valid. Another user could use this cookie to access any other published application that has been configured as a single sign on published application.

The following best practices should be used when using public computers to access the Internet:

• Perform logoff on published applications, if available.
  
• Delete cookies after you finish using published applications.
  
• Delete temporary Internet files that Office created when working with SharePoint Portal Server.
  
• Close all browser windows.
  
• Log off from Windows, if possible.
  

Note:
Cookies created by ISA Server will time out by default in 30 minutes.

You should ensure that your Web application is designed to resist session riding attacks (also known as cross-site-posting, cross-site-request-forgery, or luring attacks) before publishing it using ISA Server.

When you publish RPC over HTTP, the ISA Server log may contain Failed Connection entries including Error 64: "The specified network name is no longer available" (ERROR_NETNAME_DELETED). You can safely ignore these entries, which are a response to how Exchange handles the RPC over HTTP connection.

The language settings of the user’s browser determine the language of the forms that ISA Server uses. This is automatic and there are no configuration changes required.

The following conditions need to be taken into account when client certificate authentication has been configured.

Multiple Client Certificates Installed on Client Computer

Single Sign On and Client Certificate Authentication