wizard to configure Kerberos Constrained Delegation, so for now just leave the default of 401 request and click Next. On Step 14 Portal Link, the default settings will create icons in the portal for Outlook Web App – access, if a portal is used. Also, if the lower check box is selected, the portal will open Outlook Web app in a new window when it is accessed. Click Next. On Step 15 Exchange Application Authorization, you can leave the default, which enables all – authenticated users to access Exchange. This only means that they can try to access Outlook Web App. Any Outlook Web App policies you created in Exchange still apply, including OWAEnabled set to false. Or, you can restrict who can access Outlook Web App on Forefront UAG by selecting from a list of groups or even restrict access down to the user level by adding individual users to this list. Click Next and then Finish on the final page of the wizard to return to the management console. In the Applications section of the console, highlight the Exchange 2010 OWA application you just created, then click the Edit button to bring up the application properties. Use the scroll arrows to navigate to the Authentication tab Click on the Use Kerberos Constrained Delegation radio button and leave the default Application SPN of http/* - this allows UAG to substitute the name of each server in the farm as necessary when requesting Kerberos service tickets. Click OK to close the properties box and then click the Save icon in the UAG console toolbar to save the configuration. Click the Activate icon to back-up the existing configuration and activate this new configuration. This is a standard way to publish OWA using UAG, and at this stage, if a user were to connect to the external interface of the UAG server they would see the UAG Forms Based Authentication page. In order to configure this trunk to use certificate based authentication we need to make some additional changes.
wizard to configure Kerberos Constrained Delegation, so for now just leave the default of 401 request and click Next. On Step 14 – Portal Link, the default settings will create icons in the portal for Outlook Web App access, if a portal is used. Also, if the lower check box is selected, the portal will open Outlook Web app in a new window when it is accessed. Click Next. On Step 15 – Exchange Application Authorization, you can leave the default, which enables all authenticated users to access Exchange. This only means that they can try to access Outlook Web App. Any Outlook Web App policies you created in Exchange still apply, including OWAEnabled set to false. Or, you can restrict who can access Outlook Web App on Forefront UAG by selecting from a list of groups or even restrict access down to the user level by adding individual users to this list. Click Next and then Finish on the final page of the wizard to return to the management console. In the Applications section of the console, highlight the Exchange 2010 OWA application you just created, then click the Edit button to bring up the application properties. Use the scroll arrows to navigate to the Authentication tab Click on the Use Kerberos Constrained Delegation radio button and leave the default Application SPN of http/* - this allows UAG to substitute the name of each server in the farm as necessary when requesting Kerberos service tickets. Click OK to close the properties box and then click the Save icon in the UAG console toolbar to save the configuration. Click the Activate icon to back-up the existing configuration and activate this new configuration. This is a standard way to publish OWA using UAG, and at this stage, if a user were to connect to the external interface of the UAG server they would see the UAG Forms Based Authentication page. In order to configure this trunk to use certificate based authentication we need to make some additional changes.
UsingTMGandUAGtoSecurelyPublishOutlookWebAppAndExchangeActiveSyncWithCertificateBasedAuthentication.docx