Archive: form-based authentication in Exchange Server

This 2009 note records how I enabled Forms-Based Authentication (FBA) for Outlook Web Access in a legacy Microsoft Exchange deployment. It is not current Exchange administration guidance. Do not apply these steps to a current environment without checking the supported documentation for the exact product and version.

What the configuration changed

In that deployment, FBA changed the web sign-in behaviour in three practical ways:

1. An inactive session expired and required another sign-in.
2. Internet Explorer could not use its "Remember my password" option for the FBA sign-in.
3. Signing out ended the web session.

Earlier Exchange behaviour sometimes required users to close the browser to end a session. That was the operational problem this setup addressed.

Historical configuration steps

First configure OWA to use SSL. This post does not reproduce the certificate setup.

After SSL was in place, I enabled FBA on the HTTP Virtual Server in Exchange System Manager:

1. Open Exchange System Manager.
2. Locate and expand your server object.
3. Expand Protocols and then HTTP.
4. Right-click on the Exchange Virtual Server and choose Properties.
5. In the Settings tab, select the Enable Forms Based Authentication check-box.
6. Click OK and dismiss any warning messages by clicking OK again.
7. Restart the IIS services either from the Services snap-in or the IIS Admin snap-in.

Client access

The client used the same URL over HTTPS. Any certificate warning needed to be investigated rather than accepted. The exact authentication and client requirements depend on the Exchange version and current security policy.