Exchange OWA Remote File Access and Related Features

Transcription

1 Exchange 2007 OWA Remote File Access and Related Features Overview The version of Outlook Web Access that comes with Exchange 2007 now provides access to Windows file shares and SharePoint document libraries located on servers inside the network from directly within the OWA interface, even if the user is outside the firewall. Remote File Access is used in conjunction with two new features; Direct Document Access: The ability to open files in the native application. WebReady Document Viewing: The ability to convert a file and render it in a web browser. Administrators may configure Direct File Access and WebReady Document Viewing such that users: Are free to open specific file types in either the native application or in the web browser. Are forced to open specific file types in the web browser and restricted from opening them in the native application. Are forced to open specific file types in the native application and restricted from opening them in the web browser. Are forced to open specific file types in the web browser as a prerequisite to being permitted to be opened in the native application. Are forced to save a file to disk as a prerequisite to being permitted to be opened in the native application. Are restricted from opening specific file types altogether. Features and Terminology Remote File Access An OWA 2007 feature which allows end users to access files on Windows file shares and SharePoint document libraries located on servers inside the network from directly within the OWA interface. Is turned on by default for both login methods. Login Method: There are two login methods in OWA. When users logon using the OWA logon screen, they can select This is a public or shared computer (public method) or This is a private computer (private method). Login method of public is only available if you use forms based authentication. If you use any other authentication (basic, integrated, etc), users will logon using the private login method. Hint: if you OWA 2007 Remote File Access Timothy L. Hollingworth Page 1 of 12

2 see the OWA logon page, you are using forms based authentication. If you see a two tiered popup logon prompt, you are not using forms based authentication. Configuration of settings for Direct File Access and WebReady Document Viewing can be done separately for public and private login methods. Direct File Access An OWA 2007 feature that allows end users to open a file from within an OWA session in the files native application. Works for message attachments, files attached to posts in public folders, public folder FreeDocs and files that are accessed via Remote File Access. Is really just a marketing term for what Windows has been doing for a long time opening downloaded files in the native application except that Specific file types may be blocked from being opened in the native app, allowed to be opened in the native app or forced to be saved to disk before they may be opened in the native app. Does not control file types that can be opened via WebReady Document Viewing. Files types that are blocked from Direct File Access (on the blocked list) are never permitted to be opened in the native app, even if the same file type is on the Force Save to Disk list. WebReady Document Veiwing A feature of OWA 2007 that allows end users to open supported file types in a web browser without having the native application for that file type installed on the client machine. Currently (8/07) only supports file types.doc,.dot,.pdf,.pps,.ppt,.rtf and.xls. Administrators may allow, block or force specific file types from being rendered in the web browser. Does not control file types that can be opened via Direct File Access. Why Care? Public Folders are going away: Legacy Exchange Servers and Outlook clients utilize Public Folders to synchronize and publish Free/Busy data. Outlook 2007 clients now query the Availability Service on the Client Access server which in turn retrieves Free/Busy data directly from end user s mailboxes. Similarly, legacy Offline Address Lists are published via public folders whereas Offline Address Books (formerly Offline Address Lists) are now published via http virtual directories on the client access server for Outlook If this does not convince you that public folders are going away, the fact that Microsoft has said so should. For smaller organizations with mobile workers who are used to accessing data from public folders, the idea of moving public folder data to file shares is not too far fetched. Creation of an NTFS based file share with a folder structure that mirrors the public folder hierarchy, moving documents such as spreadsheets, presentations and PDF files from public folders to the file share and allowing mobile workers to access that data via OWA may be a very simple and elegant solution. Microsoft is OWA 2007 Remote File Access Timothy L. Hollingworth Page 2 of 12

3 advising customer s with distributed environments and those with large volumes of unstructured data such as calendars and discussion threads, to migrate that data to SharePoint. Ease of use: For administrators responsible for making data available to end users, the ubiquitous Windows file share is easy to understand, easy to virus scan, easy to backup and restore, can be subjected to quotas, can make use of DFS, etc. Public folders have a much higher administrative overhead and replication has always been a sore spot. Portability: WebReady Document Viewing allows users to view supported document types in a web browser without the document s native application installed on the client machine. Used in conjunction with Remote File Access, users now have much greater access to documents on the network. Increased Security: With legacy versions of OWA, in order to open a document from a public folder (or message for that matter) the document s native application has to be installed on the client machine. When a user accesses the file, he is prompted to either save the file to disk or to open it using the file s native application as determined by file associations on the local computer. Even if the user chooses to open the file, it is still downloaded to the Temporary Internet Files folder and then opened from the IE cache on disk! This caused a gaping security hole for corporations concerned about leaving intellectual property hanging around in the browser cache on computers in hotel lobbies and at client s sites. Administrators can now prevent specific (or all) file types from being opened in their native applications and/or saved to disk. For supported file types, WebReady Access allows administrators to force rendering inside the browser window. If the client access server requires SSL for OWA and if the browser does not save encrypted pages to disk (IE default), there will be no trace of the file on the client machine after the browser session is closed. Increased Exposure: While the block and allow lists for Remote File Access are not populated, we now have a mechanism whereby administrators can quite easily expose every file share and SharePoint library in the organization directly to the internet. Although authentication mechanisms, access control lists and things like SSL still govern access, advising customer s of the potential exposure during the design phase and incorporating these features into your functional specifications should be best practice. Settings Property Pages and Settings: Configuration of Remote File Access and related features such as Direct File Access and WebReady Document Viewing is performed on the properties of the owa virtual directory on the client access server. Open the Exchange Management Console and navigate to Microsoft Exchange Server Configuration Client Access Outlook Web Access (right click) owa. Settings are on a per client access server basis. OWA 2007 Remote File Access Timothy L. Hollingworth Page 3 of 12

4 Can configure different settings for the private logon method or the public logon method. Default settings for Remote File Access for the private logon method. Default settings for the public logon method are the same. Enable Direct File Access: Enables opening file types in the native application. o Customize Button: Specifies how Direct File Access handles specific types of files and attachments. The Customize dialog for Direct File Access. OWA 2007 Remote File Access Timothy L. Hollingworth Page 4 of 12

5 o o o o Allow: Specifies a list of file types that are permitted to be opened in the native application. Block: Specifies a list of file types that are blocked from ever being opened in the native application (even if they are on the Force save list). Force Save: Specifies the types of files that must be saved to disk before they can be opened in the native application. This is an override for Direct File Access. Unknown Files: What to do with unknown files. Options are to block opening in the native app, permit opening in the native app or force save to disk before permitted to be opened in the native app. Enable WebReady Document Viewing: Enables conversion and rendering of the file in the web browser. o Force WebReady Document Viewing when a Converter is Available: Forces the file to be opened in the web browser whenever a converter is available. o Supported File Types Button: Controls conversion for specific file types. Access Files from the Following Locations on Remote File Servers: o Windows File Shares: Turns on/off OWA access to Windows File shares. On by default. o Windows SharePoint Services: Turns on/off OWA access to SharePoint document libraries. On by default. Remote File Servers Tab: Configures which servers the end user will be allowed to access files from. Remote file servers tab on the properties of the owa virtual directory OWA 2007 Remote File Access Timothy L. Hollingworth Page 5 of 12

6 Block: Servers which users are not allowed to access Allow: Servers which users are permitted to access Unknown Servers: What to do when the user requests files from a server that is not known. Domain Suffix: A list of suffixes that are treated as internal. If users specify a server using an FQDN and the domain suffix matches the suffixes on this list, the user will be able to access the server. Some Basic Rules Settings are on a per client access server basis. If you disable Direct Document Access and WebReady Document Viewing for both the public and private login methods (public computer access and private computer access tabs), the Document button will disappear from OWA. Direct File Access and WebReady Viewing affects all file access within OWA including message attachments, public folder post attachments, public folder freedocs and files accessed via Remote File Access. If you enable Direct File Access and disable WebReady Viewing, the user will only be permitted to open the specified file types in the native application. If you disable Direct File Access and enable WebReady Viewing, the user will only be permitted to open the specified file types in the web browser. For supported file types, if you enable Direct File Access and enable WebReady Viewing, the user will have a choice of opening the specified file types in the native app or in the web browser. For supported file types, if you enable Direct File Access and enable WebReady Viewing and elect to force WebReady Viewing, the user will not have a choice of opening the specified file types in the native app or in the web browser. The file must be opened in the web browser first. Only after the file is opened in the web browser, may it be opened in the native app. Because SSL is required for OWA 2007 o If the user opens a file using WebReady Viewing and the Do not save encrypted pages to disk is enabled (IE default), the file will not be saved to disk in the browser cache. o If the user opens a file using WebReady Viewing and the Do not save encrypted pages to disk in the client web browser s advanced settings is disabled, (not IE default), the file will be saved to disk in the browser cache. If you open a file via Direct File Access in the file s native application, it will be saved to the IE cache! OWA 2007 Remote File Access Timothy L. Hollingworth Page 6 of 12

7 The Client Experience Direct File Access and WebReady Document Viewing OWA Client Experience Direct File Access WebReady Document Viewing OWA Client Experience Enabled Disabled Client may open the file in the native app or save it to disk. Enabled (force save to disk) Disabled Client may save the file to disk and only then will be client be permitted to open the file in the native application. The client is not permitted to open the file in a web browser. Enabled Enabled (no force) Client may open the file in the native app, save it to disk or if the file type is supported, open it in a web browser. Enabled Enabled (force) If the file type is supported, client must open it in a web browser and only then may the client open the file in the native application or save it to disk. Enabled (force save to disk) Enabled (force) If the file type is supported, client must open it in a web browser. The client may then save the file to disk and only then may the file be opened in the native application. Disabled Enabled (force or no force) If the file type is supported, the client may open it in a web browser. If the file type is not supported, it may not be opened or saved to disk. Disabled Disabled The client may not open the file. OWA 2007 Remote File Access Timothy L. Hollingworth Page 7 of 12

8 Logon using the private or public logon method Click the Documents button in the lower left hand corner OWA 2007 Remote File Access Timothy L. Hollingworth Page 8 of 12

9 Click Open Location on the top left hand corner, type a host name, FQDN or UNC path and click Open The files in the share appear in the main pane. Note that you can add this location to your favorites. Sweet! OWA 2007 Remote File Access Timothy L. Hollingworth Page 9 of 12

10 If we allow Direct Document Access and are not forcing WebReady Document Viewing, double clicking the file will yield the familiar open/save dialog. Clicking Open will open the file in the native application. It will be saved in the browser Cache! Depending on whether we permit or block Direct File Access and permit or block WebReady Document Viewing, the right click menu will yield different options. These settings also effect the behavior of message attachments. Direct Document Access and WebReady Document viewing both enabled. OWA 2007 Remote File Access Timothy L. Hollingworth Page 10 of 12

11 Direct Document Access disabled and WebReady Document viewing enabled. Direct Document Access enabled and WebReady Document Viewing disabled. OWA 2007 Remote File Access Timothy L. Hollingworth Page 11 of 12

12 In this example, we have both Direct Document Access and WebReady Document Viewing enabled but we are forcing WebReady Document Viewing. Since a converter for.doc files is available, only the option to Open as web page was available in the message. Only when the attachment is opened as a web page are we given the option to open it in its native application. Results of converting a.doc file and rendering in the browser.. Shell Commands A complete list of shell commands supporting the OWA virtual directory is available at us/library/bb aspx OWA 2007 Remote File Access Timothy L. Hollingworth Page 12 of 12