Integration with Exchange 2007/2010

Transcription

1 DME version 3.6 SP1 Integration with Exchange 2007/2010 Installing DME Created on Microsoft Exchange 2007/2010

2

3 Contents Integration with Microsoft Exchange 2007/ Active Directory preparation... 2 AD users... 2 AD groups... 3 Mail access in Exchange 2007/ EWS access... 4 Scanner access... 7 Multiple Exchange servers Attachment size readout Common errors... 11

4 Integration with Exchange 2007/2010 : 2012 Excitor A/S Integration with Microsoft Exchange 2007/2010 This section describes the integration between the DME server and Microsoft Exchange 2007/2010. When integrating the DME server with a Microsoft Exchange system, the authentication and authorization system is the Active Directory (AD); the DME server interfaces with the AD using LDAP. This document provides information for setting up an Exchange server to accept connections from a DME connector. In addition, prerequisites and requirements for a successful integration between the DME connector and Exchange server are discussed. Please note that this document does not cover all aspects of the Exchange server's functionality, and the Exchange server documentation should be consulted as a supplement to this information. To set up Microsoft Exchange 2007/2010 with DME, you must go through the following steps: 1 Set up firewall rules (described in the interactive document "DME Firewall Rules" at the DME Install site 2 Set up Active Directory. 3 Identify server with Client Access Role. 4 Set up mail access. Active Directory preparation When the firewall rules have been set up, your Exchange Active Directory must be prepared for DME. The DME server connects to Active Directory via connectors to verify user credentials and group memberships. In addition, information regarding the location of the user's mailbox is retrieved (that is, server name and file path). For the DME server to operate completely integrated to the existing collaboration system, information regarding mail server and mail store for each user must be available through Active Directory. AD users DME's point of entry into AD is through a user called DME_Server. This user is required in order to get mandatory information about the users (mail server, address, group membership etc.). The connection to the AD is through LDAP/LDAPS. Make sure that the DME_Server user has the required read access. 2

5 Integration with Microsoft Exchange 2007/2010 : Active Directory preparation 1 Create a Standard Domain User in Active Directory called DME_Server (case sensitive). 2 Allow the new user it to have its own mailbox. Do not use a Domain Administrator Account or give the DME_Server user Domain Administration rights. Ensure that it is only a member of the Domain Users group, and do not make it a member of any other group. The AD lookup identity DME_Server can be used to scan the users' mailboxes for new e- mails (see Mail access in Exchange 2007/2010 on page 4) for push mail purposes. AD groups DME requires the presence of the AD/LDAP groups DME_User, DME_Superuser, and DME_Admin. The members of these groups have different levels of access to DME (see below). The actual groups in Exchange can have other names, and in that case you must use those group names in DME instead. This can be configured in the Access rights fields in the Domain setup panel of the connector performing authentication in the DME Server Administration web interface: For more information, see the online help (click in the web interface). In Active Directory, create the following groups: DME_Admin, DME_Superuser (optional), and DME_User. The group names are case sensitive, and the groups must not be added to any other groups. 3

6 Integration with Exchange 2007/2010 : 2012 Excitor A/S One DME connector is bound to one Active Directory domain to authenticate the users. The Group scope can therefore be Domain local, and the Group type should be Security for each group. According to Microsoft documentation, having a group scope of Domain local allows the groups to include groups of larger scope (Global and Universal). Please contact your DME partner if your AD setup involves multiple AD Domains. Add the Administrator users to the DME_Admin group, superusers to the DME_Superuser group, and the regular synchronization users to the DME_User group. Administrators are the people that have access to administer the DME server through the DME Web Administration Interface. Superusers can manage settings for groups or users (see the DME Server Web Administration Reference). Please note that members of the DME_Admin and DME_Superuser groups do not have the privileges of the DME_User group by default; if they are also regular users of DME, they must be added to the DME_User group as well. Mail access in Exchange 2007/2010 In order to enable integration between Exchange 2007/2010 and DME, you are required to set up to areas of permissions: Anonymous access to the EWS DME scanner access to user mailboxes This is described in the following sections. EWS access The DME integration with Exchange 2007 requires that anonymous access to the EWS is Disabled. The DME integration with Exchange 2010 requires that anonymous access to the EWS is Enabled. 4

7 Integration with Microsoft Exchange 2007/2010 : Mail access in Exchange 2007/2010 Anonymous access is configured in the IIS manager. The configuration of Exchange 2007 is different from the configuration of Exchange 2010, and the configuration is described separately below. Note that if Exchange 2007 is running on Windows 2008 and AD 2008, authentication may require special setup. For more information about this we refer to the Microsoft knowledgebase. As of DME 3.6 SP1 there are two ways of using NTLM authentication: Java native NTLM support and Oakland NTLM. This is configured on the connector. By default, the DME connector is configured to use the native Java NTLM. However, in some cases you need to switch to using Oakland. For instance, you need to use Oakland for Exchange 2010 if NTLM SSP v2 is required (the local policy security setting Network security: Minimum session security for NTLM SSP based (including RPC) servers is set to Require NTLMv2 for the CAS server), or if you experience that the connector hangs when using NTLM. For more information, see the Connector installation document. EWS in Exchange Start the IIS manager. 2 Open Properties for the EWS site. 3 Click Edit... in the group Authentication and access control. 4 The setting Enable anonymous access must be Disabled. Otherwise, when the connector tries to access the EWS, it will receive "HTTP 403 Forbidden" error messages. 5

8 Integration with Exchange 2007/2010 : 2012 Excitor A/S EWS in Exchange Start the IIS manager. 2 Go to the EWS site/application. 3 Click Authentication. 4 Check the Anonymous Authentication setting: 5 Anonymous Authentication must be Enabled. 6

9 Integration with Microsoft Exchange 2007/2010 : Mail access in Exchange 2007/2010 Scanner access The second part of enabling integration between DME and Exchange is to grant the DME notification scanner access to look for changes in the users' mailboxes. In order to be able to notify each user of new etc., DME must have access to scan the users' mailboxes for changes. DME supports two modes of mail scan: 1 Using the users' own user name and password. If the option Store user password (encrypted) is selected in the section Server configuration > Authentication in the DME Server Administration Web Interface, the user's ID and password will be used for mail scanning. The user password is encrypted on the DME server. This works without any additional configuration. 2 Using an AD lookup identity (DME_Server) for all mail scanning. See AD users on page 2 for information about creating the DME_Server user. This Domain User will also act as the Service Account to operate the DME Server as a Service (see Administration Tools > Services in Exchange). Note that in mixed 2003/2007 environments, the DME_Server user must have a 2007 mailbox in order to be able to scan 2007 mailboxes. Now give the DME_Server user full administrator access to client mailboxes. To do this, you have two options: 1. Using the Exchange Management Shell: 1. To give the service user (DME_Server) access rights to the mailbox store of all users at a given point in time, pipe the Add-MailboxPermission command into the Get- Mailbox command like this: Get-Mailbox Add-MailboxPermission -user "DME_Server" -AccesRights FullAccess 2. To add the right to an individual user (every new user created after running the command above), use: Add-MailboxPermission -Identity "user" -User "DME_Server" - AccessRights FullAccess 7

10 Integration with Exchange 2007/2010 : 2012 Excitor A/S 3. A shortcut to executing the Add-MailboxPermission right to all existing mailboxes is to If you want to want to give access to DME_Server at mailstore level, that is for all users (current and future), you can run the following command (according to this Microsoft technote Add-ADPermission -identity "mailbox database" -user "DME_Server" - ExtendedRights Receive-As According to some sources, you may have to add the undocumented ms-exch- Store-Admin access right as well by adding,ms-exch-store-admin to the command above. However, according to the following Microsoft KB article there is a bug in the Add- ADPermission command, so on your version of Exchange 2007 or 2010 this may not work. If this is the case, best practice would be to run the commands in items 1 and 2 above. To check if it works, run the Get-MailboxPermission -Identity "User" command on a user you suspect is not working (a user getting a DME error "unable to fetch inbox" or similar when using the DME_Server scan user): If the console lists the DME_Server with (FullAccess) and IsInherited set to True, then you MUST run the Add-MailboxPermission command in item 2 above. Another way to test if the DME_Server user has the correct access to the user mailbox is by using the OWA. Log in as DME_Server, and use the drop-down box in the upper right-hand corner to open another user's mailbox. If the attempt fails, then DME_Server does not truly have full access. 2. Using the Exchange Management Console: 1. Go to Recipient Configuration 2. Click Mailbox 3. In the middle window, click the user to which you want DME_Server to have full access 4. Right-click, and select Manage Full Access Permission In the pop-up window, click Add Select DME_Server, and click OK 7. Click Manage 8

11 Integration with Microsoft Exchange 2007/2010 : Mail access in Exchange 2007/2010 -as illustrated in the following: 9

12 Integration with Exchange 2007/2010 : 2012 Excitor A/S Multiple Exchange servers If the Exchange 2007 system contains more than one mail server, you must identify the mail server which has the Client Access role (not the Mailbox role). To ascertain this, open the Exchange Management Console on the Exchange server: Enter the IP address or name of this client access mailbox (QAT-EX2K7 in the example below) in the Functions setup panel of the connector in the DME Server Administration Web Interface (the field Server in the illustration below). If you only have one mail server, you do not need to complete this field; if you have more than one server with the Client Access role, you only need to enter the IP address or server name for one of them if they are at the same location. Exchange 2007 contains an administrative group called FYDIBOHF23SPDLT. Sometimes DME recognizes this administrative group as the mail server, but this is not correct. You can prevent this from happening by tweaking the regular expression which extracts the mail server from LDAP in the field Server regexp in the Functions setup panel of the connector. Attachment size readout For some reason, reading out the size of attachments is not possible using Exchange Web Services (EWS). To work around this limitation, you can set up DME to use the WebDAV protocol for this purpose (as in Exchange 2003). To enable DME to do this, you must do the following: 10

13 Integration with Microsoft Exchange 2007/2010 : Common errors 1 WebDAV must be running on your Exchange 2007/2010 server. This is the Exchange service in the IIS Manager. 2 In the DME web interface, edit the Exchange connector(s) responsible for synchronizing and calendar, and click the Functions setup panel. 3 In the Exchange integration > Advanced section, make sure the field Read attachment sizes (2007/2010) is selected. 4 In the Connection section, check the field Secure (SSL). This setting describes the connection to the WebDAV service, and must match the corresponding setting in the IIS WebDAV setup: 1. In IIS Manager, open your Web Site, and click Exchange. 2. In the Directory Security tab, click Edit... in the Secure communications section of the dialog. 3. In the Secure Communications dialog, check the setting of the field Require secure channel (SSL). If Require secure channel (SSL) is selected in IIS, then make sure the field Secure (SSL) is also selected in the connector. If IIS does not require a secure channel, then you are free to choose the setting of Secure (SSL) in the connector. Common errors The following are examples of common errors you may encounter when running DME against Exchange 2007 and above. The errors are shown when running the automatic diagnostic test (click Test connection in the Functions setup panel of the connector): The DME connector hangs when testing the connection to your Exchange server using NTLM as authentication. As of DME 3.6 SP1 there are two ways of using NTLM authentication: Java native NTLM support and Oakland NTLM. This is configured on the connector. By default, the DME connector is configured to use the native Java NTLM. However, in some cases you need to switch to using Oakland. For instance, you need to use Oakland for Exchange 2010 if NTLM SSP v2 is required (the local policy security setting Network security: Minimum session security for NTLM SSP based (including RPC) servers is set to Require NTLMv2 for the CAS server). If the connector hangs, switch to using the Oakland NTLM authentication method. See the Connector installation document for more information. 8) Mail scan login User - dme.base.exchange2007.exchangeexception: Find folder operation error. Exchange returned error code: ErrorItemNotFound (The specified object was not found in the store.) -> The DME_Server user does not have access the the mailbox of the user. 8) Mail scan login User - null -> The Secure Collaboration server is configured to True in DME, but the IIS is not set to use SSL, or the IIS is not running. 11

14 Integration with Exchange 2007/2010 : 2012 Excitor A/S 8) Mail scan login User - dme.base.exchange.exchangeerrorloginexception: Login error. User: DME_Server@Domain to server QAT-EX2K7 (uri: Authentication scheme: BASIC; Connection is unencrypted -> This error can occur if you have configured the DME server to synchronize against Exchange 2003, when it should be Exchange 2007 (Connector setup > Functions in the Connector tab; see below). WebDAV = Exchange 2003; Web service = Exchange 2007/10. 1) Connection to LDAP ( ) No communication with LDAP server -> The LDAP server is down, or a wrong address is configured on the DME server for the LDAP server (Server configuration > Authentication > Authentication server/ldap server in the Server tab). 8) Mail scan login User - dme.base.exchange2007.exchangeexception: Find folder operation error. Exchange returned error code: ErrorAccessDenied (Access is denied. Check credentials and try again.) -> Possibly the DME_Server user does not have a mailbox. 8) Mail scan login User - dme.base.exchange2007.communicationexception: org.apache.axis2.axisfault: Transport error: 503 Error: Service Unavailable OR User - dme.base.exchange2007.communicationexception: org.apache.axis2.axisfault: Stream closed -> The IIS (Default Web Site) is stopped. 8) Mail scan login User - dme.base.exchange2007.communicationexception: org.apache.axis2.axisfault: Transport error: 403 Error: Forbidden -> EWS (Exchange Web Services) in the IIS is set to use SSL, and DME is not. Furthermore, if you have been using the Add-ADPermission command to grant the DME_Server user access to all mailboxes, the DME_Server might appear to have the required "full access". However if this setting is "inherited" then it may not work through EWS. For more information, including reference to the relevant Microsoft KB articles, see item 1.3 in Scanner access on page 7. 12