Can add an samlple for Exchange2013-OWA login ?

[AaronFromCN]

Currently, the WS-Fed module has only been tested with sharepoint 2013. It should also be tested at least with exchange 2013-OWA .

I tried to do it for myself , but encountered 440 "Login Timeout" :

ModuleName
ADFSFederationAuthModule
Notification
AUTHENTICATE_REQUEST
HttpStatus
440
HttpReason
Login Timeout
HttpSubStatus
0
ErrorCode
The operation completed successfully.
(0x0)
ConfigExceptionInfo

Can I get some help ? Thanks so much !

[AaronFromCN]

@AlistairDoswald , can anybody help ?

[AlistairDoswald]

@AaronYaoCN We've tried the module with several ws-fed clients, but not Exchange 2013-OWA. I'm guessing that you posted the logs in Exchange, but do you have any logs from Keycloak during the login sequence? It would also help if you told me the login sequence goes for you. For example, do you get to the Keycloak login screen?

Another question, have you got keycloak with wsfed module to work with another ws-fed service provider (client in keycloak parlance), so that you can rule out a misconfiguration of keycloak?

On my end I don't know if I have an Exchange 2013-OWA available for testing, but I'll see what I can do.

[AaronFromCN]

@AlistairDoswald, Thanks a lot for your reply. In fact, I have tried the following steps for myself :

(1) Have got keycloak-wsfed module to work with idp-test-client, proving that I have got a good keycloak-wsfed service.
(2) Installed two Windows Server 2016.
(3) Configured a ADFS 4.0 service on one server and installed Microsoft Exchange Server 2016 on another.
(4) Opened a Chrome and accessed link https://mail.contoso.com/owa/ , and then Chome was redirected to https://sts.contoso.com/adfs/ls/ .
(5) Input username/password, I logined sucessfully and got management-UI for the user's mails.
(6) Referenced to https://proofid.com/blog/single-sign-on-to-outlook-web-access-using-pingfederate/ .
(7) Replaced the ADFS service with keycloak-wsfed, and let keycloak-wsfed using the same signing certificate with ADFS.
(8) Opened a Chrome and accessed link https://mail.contoso.com/owa/ , and then Chome was redirected to keycloak-wsfed.
(10) At this step, got an error: "WE'RE SORRY ...Invalid redirect uri".
(11) Added "&wreply=https%3a%2f%2fmail.contoso.com%2fowa%2f" to the end of URL link, it was good seeing the login page with keycloak-wsfed.
(12) Input username/password, I logined to keycloak-wsfed sucessfully.
(13) At the same time , Chome was redirected to https://mail.contoso.com/owa/ , and posted a wresult <t:RequestSecurityTokenResponse>...</t:RequestSecurityTokenResponse> to it.
(14) At this step , got an "440 Login Timeout" error.

There are so many details for the integration with Exchange-OWA, so I hope that if you can give an example like Sharepoint will be good for us.

Thanks again!

[AaronFromCN]

@AlistairDoswald , can I get some suggest ?

[AlistairDoswald]

@AaronYaoCN There's a few steps within your description which I find strange, and that maybe you can investigate further:

• steps (10)-(11): Normally you shouldn't get a invalid redirect URI. If you can't get the outlook to send a wreply, you can set the base url in the keycloak client config to https://mail.contoso.com/owa/ and it should avoid this error. However, this doesn't help with your 440 (unless this step takes a really long time, leading to an actual timeout).
• steps (12)-(14): This is what I really wanted to know: whether keycloak logged in. Since it did, it means that there's a problem with the reply that was sent to Exchange. A point to look at would be the assertion that was sent by Keycloak to Exchange-OWA. When working with Sharepoint, there was some attributes that had to be set to the correct value for the login to happen correctly, and if they weren't set, Sharepoint would raise an error. Maybe you're having the same problem? Could you check the differences in the attributes between the ADFS and Keycloak? If you want, you can send me the full reply URIs and xml assertions of ADFS and Keycloak, and I can also have a look.

[AaronFromCN]

@AlistairDoswald,

• steps (10)-(11): I have fixed it after I set the base url in the keycloak client config to https://mail.contoso.com/owa/. Thanks !

• steps (12)-(14): I attached two files for your reference:
  adfs-ok.txt is the Chrome's post request from ADFS server to https://mail.contoso.com/owa/ and it works ok .
  keycloak-440.txt is the Chrome's post request from keycloak-wsfed server to https://mail.contoso.com/owa/ and it encounters 440.

adfs-ok.txt
keycloak-440.txt

[AlistairDoswald]

@AaronYaoCN Is it correct that in your ADFS case the Exchange-OWA is configured to expect a claim with the name upn, and with the Keycloak case the Exchange-OWA is configured to expect a claim with the name upngg ?

[AaronFromCN]

@AlistairDoswald , Thanks for your analysis . In fact , "upngg" is just my debug info for testing . It is not the reason that result in 440 error.

After I compared the authentication steps carefully between ADFS and keycloak-wsfed , I found that ADFS hasing one step was the key one .

Between step (12) and (13) , ADFS will repsponse a 302 to browser and let it sending the GET Login-Request again.

And then I refered to ADFS and let keycloak-wsfed responsing a Login-Request to browser before step (13), I logined to Exchange-OWA successfully. The 440 error disappeared and the logout was OK, too.

My problem is sovled now . Thanks for your help again.

[saravananxlnc]

@AlistairDoswald , Thanks for your analysis . In fact , "upngg" is just my debug info for testing . It is not the reason that result in 440 error.

After I compared the authentication steps carefully between ADFS and keycloak-wsfed , I found that ADFS hasing one step was the key one .

Between step (12) and (13) , ADFS will repsponse a 302 to browser and let it sending the GET Login-Request again.

And then I refered to ADFS and let keycloak-wsfed responsing a Login-Request to browser before step (13), I logined to Exchange-OWA successfully. The 440 error disappeared and the logout was OK, too.

My problem is sovled now . Thanks for your help again.

@AaronFromCN , Please can you share the complete steps for Exchange 2013 OWA

[davidus05]

Would need the steps to integrate on Exchange Server 2016/13 OWA too, please.

[Quebrantos]

I managed to login to OWA 2013 using this module, but now I have a problem when login out.
At logout I get the error "Logout Failed" on the browser and on the Keycloak Server I get this in the log: "ERROR [com.quest.keycloak.protocol.wsfed.WSFedLoginProtocol] (default task-15) Can't finish WS-Fed logout as there is no logout binding set. Has the redirect URI being used been added to the valid redirect URIs in the client?"

Any way, I'll try to explain the config I have done in case it's useful for anyone. And if someone can help me to solve the logout issue it would be most welcome.

1.- Create and configure the LDAP User Federation with the domain. Then create a new LDAP Mapper inside

2.- Create a new Authentication Flow. (I have not been able to use Forms Authentication for what I think is a referrer problem)

3.- Create and configure the client overriding the Authentication Browser Flow

4.-Configure a Mapper on the client to pass the AD's userPrincipalName as an atribute named "upn"

5.- On the Exchange server, you have to add to the "Trusted Root CAs" the certificate that you get here:

6.- Configure Exchange to use ADFS Authentication with the Exchange Management Shell:
$uris = @("https://testowa.testowa.local/owa/","https://testowa.testowa.local/ecp/")
Set-OrganizationConfig -AdfsIssuer "https://keycloak.testowa.local:8443/auth/realms/master/protocol/wsfed/" -AdfsAudienceUris $uris -AdfsSignCertificateThumbprint ""

[artemsenkq]

Hello guys! Is there any progress? I'm trying to connect ws-fed 8.0.1 with Exchange 2016 and every time without success.

This page isn’t working If the problem continues, contact the site owner.
HTTP ERROR 440

SAML-tracer-export-2021-02-13T13_52_34.507Z.zip

[kirankumar-grootan]

@AaronFromCN @Quebrantos I also ended up with 440 error. What was done from your end to fix this issue ?