Integration with Exchange 2003

Transcription

1 DME version 3.6 Integration with Exchange 2003 Installing DME Created on Microsoft Exchange 2003

2

3 Contents Contents Integration with Microsoft Exchange Active Directory preparation... 2 AD users... 2 AD groups... 3 Rooms and resources... 4 WebDAV setup... 5 IIS in Exchange Mail access in Exchange Mailbox level access... 8

4 Integration with Exchange 2003 : 2012 Excitor A/S Integration with Microsoft Exchange 2003 This section describes the integration between the DME server and Microsoft Exchange When integrating the DME server with a Microsoft Exchange system, the authentication and authorization system is the Active Directory (AD); the DME server interfaces with the AD using LDAP. This document provides information for setting up an Exchange server to accept connections from a DME connector. In addition, prerequisites and requirements for a successful integration between the DME connector and Exchange server are discussed. Please note that this document does not cover all aspects of the Exchange server's functionality, and the Exchange server documentation should be consulted as a supplement to this information. Please note that if Exchange 2003 is running on Windows 2008 and AD 2008, authentication may require special setup. For more information about this we refer to the Microsoft knowledgebase. To set up Microsoft Exchange 2003 with DME, you must go through the following steps: 1 Set up firewall rules (described in the interactive document "DME Firewall Rules" at the DME Install site 2 Set up Active Directory. 3 Set up WebDAV on all servers. 4 Set up mail access. Active Directory preparation When the firewall rules have been set up, your Exchange Active Directory must be prepared for DME. The DME server connects to Active Directory via connectors to verify user credentials and group memberships. In addition, information regarding the location of the user's mailbox is retrieved (that is, server name and file path). For the DME server to operate completely integrated to the existing collaboration system, information regarding mail server and mail store for each user must be available through Active Directory. AD users DME's point of entry into AD is through a user called DME_Server. This user is required in order to get mandatory information about the users (mail server, address, group membership etc.). The connection to the AD is through LDAP/LDAPS. Make sure that the DME_Server user has the required read access. 2

5 Integration with Microsoft Exchange 2003 : Active Directory preparation Create a Standard Domain User in Active Directory called DME_Server (case sensitive), and allow it to have its own mailbox. Do not use a Domain Administrator Account or give the DME_Server user Domain Administration rights. Ensure that it is only a member of the Domain Users group, and do not make it a member of any other group. The AD lookup identity DME_Server can be used to scan the users' mailboxes for new e- mails (see Mail access in Exchange 2003 on page 6) for push mail purposes. AD groups DME requires the presence of the AD/LDAP groups DME_User, DME_Superuser, and DME_Admin. The members of these groups have different levels of access to DME (see below). The actual groups in Exchange can have other names, and in that case you must use those group names in DME instead. This can be configured in the Access rights fields in the Domain setup panel of the connector performing authentication in the DME Server Administration web interface: For more information, see the online help (click in the web interface). In Active Directory, create the following groups: DME_Admin, DME_Superuser (optional), and DME_User. The group names are case sensitive, and the groups must not be added to any other groups. 3

6 Integration with Exchange 2003 : 2012 Excitor A/S One DME connector is bound to one Active Directory domain to authenticate the users. The Group scope can therefore be Domain local, and the Group type should be Security for each group. According to Microsoft documentation, having a group scope of Domain local allows the groups to include groups of larger scope (Global and Universal). Please contact your DME partner if your AD setup involves multiple AD Domains. Add the Administrator users to the DME_Admin group, superusers to the DME_Superuser group, and the regular synchronization users to the DME_User group. Administrators are the people that have access to administer the DME server through the DME Web Administration Interface. Superusers can manage settings for groups or users (see the DME Server Web Administration Reference). Please note that members of the DME_Admin and DME_Superuser groups do not have the privileges of the DME_User group by default; if they are also regular users of DME, they must be added to the DME_User group as well. Rooms and resources On Exchange 2003, rooms and resources (R&R) are defined as users. The DME connector needs to be able to distinguish between regular users and R&R users to be able to submit a list of Rooms and Resources to DME clients. This list is required by DME users when they select rooms and resources in connection with creating a meeting invitation on the client. To this end, you need to add meta data fields to the R&R users. Using the ADSIEDIT utility from Microsoft, add a field called msexchresourcemetadata to the R&R users. If the user is room, enter the value ResourceType:Room in the new field; if the user is a resource, enter the value ResourceType:Resource. The DME connector will now be able to submit a list of Rooms and Resources to the clients on request. 4

7 Integration with Microsoft Exchange 2003 : WebDAV setup WebDAV setup In Exchange 2003, the DME server connects to the Active Directory using the LDAP protocol for user validation and the WebDAV protocol for access to the Exchange data (for instance retrieving mails, calendar information, etc.). Hence, all Exchange 2003 serves must be configured to run WebDAV. Exchange can only be accessed using WebDAV if Outlook Web Access (OWA) has been enabled for the mailbox in question. To enable the OWA, go to the DME_Server user record in Active Directory > Exchange Features (tab) > Protocols (Category). The Exchange Features tab is only available if Active Directory is accessed on a server where Exchange has been installed: Click the Outlook Web Access protocol, and click Enable to enable the OWA. 5

8 Integration with Exchange 2003 : 2012 Excitor A/S IIS in Exchange Start the IIS manager. 2 Open Properties for the Exchange site. 3 Click Edit... in the group Authentication and access control. 4 The setting Enable anonymous access must be Disabled. Otherwise, when the connector tries to access Exchange, it will receive "HTTP 403 Forbidden" error messages. 5 Click OK, OK, and restart the IIS. Mail access in Exchange 2003 In order to be able to notify each user of new etc., DME must have access to scan the users' mailboxes for changes. DME supports two modes of mail scan: 6

9 Integration with Microsoft Exchange 2003 : Mail access in Exchange Using the users' own user name and password. If the option Store user password (encrypted) is selected in the section Server configuration > Authentication in the DME Server Administration Web Interface, the user's ID and password will be used for mail scanning. The user password is encrypted on the DME server. This works without any additional configuration. 2 Using an AD lookup identity (DME_Server) for all mail scanning. See AD users on page 2 for information about creating the DME_Server user. This Domain User will also act as the Service Account to operate the DME Server as a Service (see Administration Tools > Services in Exchange). The same user account is used for logging in to the LDAP server when needed (for this purpose, user name and password are entered in the Domain setup panel of the connector in the DME Server Administration Web Interface). 3 If Exchange 2003 is configured to use "Form Based Authentication", DME must be configured to use "Basic" authentication. This is done in the field Auth. scheme in Connector setup > and PIM > General (Exchange). Any other type of authentication scheme would result in error messages, most likely a "440 error" like this in the connector log: Logger: [dme.base.exchange2003.exchangesession] from thread: pool-1-thread-42 Message: Error response during propfind: Responsecode='440', Query='', Response='null' 7

10 Integration with Exchange 2003 : 2012 Excitor A/S Mailbox level access To enable the DME server to scan a user's mailbox for new s, the user specified as Active Directory lookup identity must have access to the user's mailbox. This is done either by allowing the Active Directory lookup identity to have full access to each individual user's mailbox, or by allowing the identity to have full access to the Mailbox Store (this is recommended, as it will be applied to all registered users in AD and saves time). To set mailbox level access 1 Locate the DME_Server user record in Active Directory. 2 Select Properties > Exchange Advanced. This tab is only available if Active Directory is accessed on a server where Exchange has been installed. 3 Click Mailbox Rights... 8

11 Integration with Microsoft Exchange 2003 : Mail access in Exchange Check Full mailbox access in the Allow column. To set mailbox store access 1 Open the Exchange System Manager. 2 Locate the First Storage Group (see illustration below). 3 Right-click the Mailbox Store, and select Properties. 4 In the Security tab, add the DME_Server user with Full Access. 9