Jump to content
Compatible Support Forums
Sign in to follow this  
francoisp

OWA - Authentication Problems

Recommended Posts

Hi there, I've got the following problem in OWA.

 

The user goes to http://www.server.com/exchange/ and then gets Windows Challenge Response for UserName & Pass (not the owa login screen - Problem 1) then it authenticates and takes the user to his mailbox no problem, but when this user John goes and change the http://www.server.com/exchange/john to another user paul" rel="nofollow" target="_blank">http://www.server.com/exchange/paul he can then send/receive as that user without re-authentication? The users got plain and simply Domain User/User rights and that's it? (Problem 2)

 

Any ideas?

 

Thanks

 

Share this post


Link to post

Ideas....

 

Sounds like a permissions issue to me. Can your users access each other's email by changing their settings within outlook? If so, that might be the answer.

 

But, still sounds like permissions.....

Share this post


Link to post

Yes they can, if I log on as John and change Outlook Exchange box to Paul voila !

 

What now!?

Share this post


Link to post

Do you do this by design? Just curious. Since this is a security risk. If not, restrict their ability to do this in Exchange itself. I'd love to be more detailed on how to do this, but unfortunately, I do not have exchange running here.

 

Anyway, since you said that you can easily change that in oulook, then they also have permission to do this in OWA. So, restrict their access in Exchange itself. I may be repeating myself, but, now I know this is an Exchange issue. Perhaps removing John and Paul from the Exchange admins group could help. Unless they are admins.

 

Hope this helps...if not, then I'll see if I can point you in the right direction.

Share this post


Link to post

Okay, the users are not part of the admins group at all. Domain Users \ User, In exchange Everyone has send/receive prevlidges and that it?

Share this post


Link to post

That should be it. Log off, log back on as a user. CHeck to see if said user can access other user's email. If can't, try online.

 

Once again, this is just from the top of my head, last time I used exchange 2 years ago. If I remember correctly, you need to change the top level exchange tree for permissions. Ugh, to many years....

Share this post


Link to post

In addition. Do the users have the same password? Also, do you have local caching disabled, and save password disabled?

Share this post


Link to post

The problem was on the Forms Based Authentication, set to HIGH, I have disabled that and changed the permissions on the TOP level, restarted exhange and seems to be working now, Thx a lot, PS.. the users did not have the same password.

Share this post


Link to post

Glad I could help. Like my pitiful excuse was before, its been awhile since I last used Exchange. I'm happy that I could point you in the right direction.

 

Yes, the m[censored]change.org is a nice site.

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×