Why is Communicator prompting me for credentials?

infoblog » Why is Communicator prompting me for credentials?

infoblog » Why is Communicator prompting me for credentials? — Thu, 16 Oct 2008 21:45:56 GMT

PingBack from http://blog.a-foton.ru/index.php/2008/10/16/why-is-communicator-prompting-me-for-credentials/

re: Why is Communicator prompting me for credentials?

Simon Barratt — Thu, 05 Feb 2009 05:42:27 GMT

Thanks for this - I was looking all over for this solution! I see the Communicator 2007 R2 does not generate the prompt at all, so I guess the authentication has changed somewhat in that release.

Thanks again!

re: Why is Communicator prompting me for credentials?

Tom Pacyk — Wed, 18 Feb 2009 11:05:44 GMT

I have a client with a similar issue that I managed to duplicate in a lab setup.

Short version is they are using Kerberos Constrained Delegation from ISA to Exchange for Outlook Anywhere with clients authenticating with NTLM via ISA 2006. Works beautifully. Deployed OCS 2007 and the Edge infrastructure and all the features work as expected with one small hiccup - external, domain joined clients repeatedly get prompted to authenticate to Exchange Web Services, but they never can successfully authenticate so there's an auth mismatch at some point. Having trouble figuring out where. Every single component of Exchange works great inside and outside so I know Autodiscover, EWS, UM and OAB are working fine.

Integrated Auth is enabled on the CAS for both the EWS and Autodiscover virtual directories. I've tried flipping Basic auth on both, or just one or the other and unsuccessfully. The client either gets the endless authentication or it just fails altogether without prompting.

My next step would be to try flipping the authentication provider method around as you indicated as the server-side fix. Any potential issues on the Exchange side with that adjustment?

Any other suggestions?

re: Why is Communicator prompting me for credentials?

Scott Oseychik — Wed, 18 Feb 2009 16:54:54 GMT

Hi Tom,

In terms of reversing the WWW-Authenticate headers provided by IIS (via Exchange CAS), our customers have found no ill side effects, and this workaround has been deployed repeatedly.

I hope this resolves your issue, and if not, feel free to contact me (via the contact form), and we'll go from there.

Scott Oseychik

re: Why is Communicator prompting me for credentials?

Henrik Garpenrud — Wed, 11 Mar 2009 22:34:22 GMT

Hi, this server-side fix is setting this on the Exchange CAS. But what about if we have an ISA in between? I have the exact same setup and errors as Tom.

Thansk in advance

re: Why is Communicator prompting me for credentials?

Scott — Thu, 12 Mar 2009 16:45:57 GMT

Now sure how to make this change in ISA, but you can use a combination of our STRACE and HttpReplay utilities to find how the WWW-Auth header is being received via the client:

Strace:

http://www.microsoft.com/downloads/details.aspx?familyid=f5ec767f-27f2-4fb3-90a5-4bf0d5f4810a&displaylang=en

Once you install it, open a cmd prompt, change to "C:\Program Files\STRACE" and issue the following command:

withdll /d:STRACE.dll_IE7 "C:\program files\microsoft office communicator\communicator.exe" (or whichever .exe you're trying to trace; but in this case, communicator.exe)

HttpReplay:

http://www.microsoft.com/downloads/details.aspx?familyid=d25ba362-c17b-4d80-a677-1faff862e629&displaylang=en

Take the logfile generated by Strace (default: it goes on the Desktop)

Move it to the C:\Program Files\HttpReplay directory

Open a cmd prompt, change to C:\Program Files\HttpReplay

Issue the following command:

Httpreplay <yourfilenamehere.log>

Presto! You should have a nice pretty webpage with all the relevant info. :-)

Scott Oseychik

Senior Escalation Engineer

Microsoft, Unified Communications Team

re: Why is Communicator prompting me for credentials?

Henrik Garpenrud — Fri, 13 Mar 2009 00:39:09 GMT

Hi Scott, thanks alot for your quick answer.

Could it complicate things that i run IE8 on Vista SP2_RC? Because strace doesnt seemt to collect any information.

If i do the client-side fix, i don't get thet popup, but rather a "Exchange Connection Error". It can't access the OAB/OOF... but Outlook can, perfectly..

Thanks in advance

re: Why is Communicator prompting me for credentials?

Scott — Fri, 13 Mar 2009 16:42:15 GMT

Hi Henry,

I haven't tried Strace/HttpReplay with IE8 + Vista SP2 RC, but I suspect you're correct. Was trying to save you the hassle of breaking out Network Monitor (or Wireshark).

My recommendation is to engage Microsoft Customer Support Services via http://support.microsoft.com & we'll get it figured out. :-)

Regards,

Scott Oseychik

re: Why is Communicator prompting me for credentials?

SSL74 — Tue, 24 Mar 2009 01:47:11 GMT

Nice article. Exactly what i am looking for.. but it's not working for me.

I'm connected by VPN. Opening Outlook 2007 doesn't prompt me anything. Autodiscover service test is Ok.

Oh yeah. OCS is installed on Windows 2008.

Opening communicator asks me for basic authentication window, but the olf fashionned-one (looks like an IIS6 authentication dialog box, not the one you screenshooted).

Tried the strace tool and so one, but really don't get how to use this trace. Can you be any help ?

Thak you ^^ :)

re: Why is Communicator prompting me for credentials?

Christian — Tue, 19 May 2009 23:42:41 GMT

Hi,

This did not fix my issue. I publish Outlook Anywhere with ISA.

I followed your article, the only thing that is different now is following:

in your example

Rest of my config

C:\Windows\System32\inetsrv>appcmd list config /section:windowsAuthentication

<system.webServer>

</providers>

</windowsAuthentication>

</authentication>

</security>

</system.webServer>

How can I change it ? Everything else is working perfectly. But I still get the Outlook Integration login. Can it be the windowsAuthentication config.

Christian

re: Why is Communicator prompting me for credentials?

Scott Oseychik — Wed, 20 May 2009 21:17:36 GMT

I'd try using Strace & HttpReplay to dig deeper into this:

Strace:

---------

http://www.microsoft.com/downloads/details.aspx?familyid=f5ec767f-27f2-4fb3-90a5-4bf0d5f4810a&displaylang=en

- Once you install it, open a cmd prompt, change to "C:\Program Files\STRACE" and issue the following command:

withdll /d:STRACE.dll_IE7 "C:\program files\microsoft office communicator\communicator.exe" (or whichever executable you're going to trace)

HttpReplay:

---------------

http://www.microsoft.com/downloads/details.aspx?familyid=d25ba362-c17b-4d80-a677-1faff862e629&displaylang=en

- Take the logfile generated by Strace (default: it goes on the Desktop)

- Move it to the C:\Program Files\HttpReplay directory

- Open a cmd prompt, change to C:\Program Files\HttpReplay

- Issue the following command:

Httpreplay <yourfilenamehere.log>

Presto! You should have a nice pretty webpage with all the relevant info. :-)

Hope this helps,

Scott Oseychik

re: Why is Communicator prompting me for credentials?

Tony Bennett — Fri, 22 May 2009 12:41:07 GMT

I have the very same problem Tom Pacyk had, with domain joined clients (using KCD via ISA, which work fine), and non domain joined clients all via ISA, but I've not been able to resolve the problem at all.

What im getting is that when I open communicator client, it fires the login for the mailbox, followed by an autodiscover prompt. When I look the report generated by srace/htpreply, I see that the client is tryingto mame a post to https://autodiscover.domainname/autodiscover/autodiscover.xml. Autodiscover is published via ISA, and if I open Outlook, everything appears to work ok (out of office etc).

I also tried the netiotation methods in IIS (NTLM, negotiate, mentioned at he top of the article), but no luck there at all. After some very late nights, I'm at my wits end with it, and am close to having to raise a call with Microsft, but wanted tp post here first to see if anyone had any other ideas.

Whatever logs need to be posted here, i'll gladly supply.

Hope you can help!

Thanks

re: Why is Communicator prompting me for credentials?

Scott Oseychik — Fri, 22 May 2009 15:54:26 GMT

Hi Tony,

Unfortuantely, the scenario I debugged did not involve ISA (and nor do I claim to be an ISA expert by any means); I think we definitely need to fully understand & resolve this "twist" on the issue, as many customers seem to be hitting the same problem.

My recommendation is to engage Microsoft Customer Support Services (http://support.microsoft.com), cite this blog entry, and we'll help figure this one out. I'll be out of the office (actually, out of the country!) all next week ... going onsite to debug a customer issue, but we have a very talented team in Unified Communications Support that shold be able to help nail this one.

Regards,

Scott Oseychik

Senior Escalation Engineer

Microsoft, Unified Communications Group

re: Why is Communicator prompting me for credentials?

joho0 — Wed, 01 Jul 2009 18:21:27 GMT

Scott,

Okay...MOC 2007 R2 connecting to Exchange 2007 running on Server 2008 x64 (IIS7). All is well except for this "Exchange Connection" issue. I implemented your client side fix and voila! Problem Solved. I then reverted that back (cause who wants a client side solution?) and then implemented the server side fix and...fail. I still get the same behavior as before. I even did an iisreset just to be certain. Still no love. Any ideas?

Thanks,

John

re: Why is Communicator prompting me for credentials?

Scott Oseychik — Thu, 02 Jul 2009 06:56:42 GMT

Hi John,

Are you running straight IIS7, or do you also have IIS6 compatibility installed as well? I may have more testing to do w/straight IIS7 ...

Thanks,

Scott Oseychik

re: Why is Communicator prompting me for credentials?

joho0 — Tue, 07 Jul 2009 18:32:28 GMT

4 days. That's what it took to fix this and in the end, I should've tried this first. For all those struggling, here's what I had to do...

First, some info:

Server A: Windows Server 2008 x64 SP2 w/ OCS 2007 R2 Enterprise (consolidated FE server)

Server B: Windows Server 2008 x64 SP2 w/ Exchange 2007 Enterprise SP1

Client: Vista x64 Business SP2 w/ MOC 2007 R2

Okay, client logs into MOC no problem, but gets the dreaded "Exchange Connection" error. MOC need to connect to exchange to get address book info. MOC uses exchange autodiscover to learn exchange OWA URL (using user's SIP login domain to query DNS for autodiscover SRV record). Ours is using an external URL (even internally) to avoid SAN certificate issues (one external cert for both internal and external, just always use external name for config...this works...no problems here). But MOC insists on using NTLM auth and is connecting to Exchange using external URL. If HTTP SPN doesn't exist for exchange server object in AD-DS using the external URL (HTTP/externalurl.domain.com), then NTLM will fail.

I used the following command to remedy:

setspn -A HTTP/<external.domain.url> <exchangeNETBIOSname>

Just substitute the external URL FQDN and the exchange server name (just hostname...not FQDN) where specified.

Enjoy!

re: Why is Communicator prompting me for credentials?

Scott Oseychik — Tue, 07 Jul 2009 18:35:36 GMT

joho0: Great work!! Please contact me via http://blogs.msdn.com/scottos/contact.aspx ... I'd like to discuss further.

Thanks,

Scott Oseychik

re: Why is Communicator prompting me for credentials?

joho0 — Tue, 07 Jul 2009 22:31:37 GMT

Sure thing Scott.

I just wanted to point out one huge error with my previous post. Everywhere I mention NTLM, just go ahead and substitute Kerberos. I know this is contrary to what you stated in your post, but my experience has been that NTLM is failing for unknown reasons and that only by fixing Kerberos (with the SPN entries in AD) was I able to resolve this issue. I know this to be true, and it took a few minutes to dawn on me, because Kerberos uses SPNs and NTLM doesn't, and that's the only thing I changed.

That would explain why forcing NTLM by switching off negotiate on the server side offered no help. Not sure why turning off negotiate on the client side caused NTLM to work all of a sudden. This may be a clue, as there are still some unknowns at work here, but I've verified this solution on some other domain pcs, so I'm not going to worry much about the NTLM issue.