Digipass for Outlook Web Access (OWA) VM3.0: troubleshooting guide. Creation date: 14/05/2007 Last Review: 31/05/2007 Revision number: 2

Transcription

1 Digipass for Outlook Web Access (OWA) VM3.0: troubleshooting guide Creation date: 14/05/2007 Last Review: 31/05/2007 Revision number: 2 Document type: Whitepaper Security status: EXTERNAL Summary This document describes how to troubleshoot a Digipass for Outlook Web Access environment on IIS6. In this document you will find detailed information about possible issues in the Vasco filter for OWA on IIS6. Troubleshooting 1) Vasco Forms based filter for OWA overview Vasco has a filter for Basic authentication and Forms based Authentication. Both filters work according to the same principle, but the executable and configuration options are different. Be sure to install the filter that complies with the authentication method used by OWA. The purpose of the Vasco Filter is to trap the username and One Time Password (OTP) entered in the logon screen of the OWA before the information is sent to the Exchange server. The Username and OTP are sent to the Vacman Middleware (VM) for validation of the OTP. If this validation is successful VM will send the stored static password from its local database back to the Vasco Filter. From there on the username and password are sent to Active Directory for verification of the necessary access rights to the mailbox that is being accessed. More detailed information about the working principles of the software can be found in the figures below..doc 31/05/ :04 Page 1 of 10

2 OWA login without Digipass ) User enters his username and Windows password on the OWA Login page 2) Exchange validates the user against the Active Directory database 3) User is granted access to his mailbox.doc 31/05/ :04 Page 2 of 10

3 OWA login with Digipass ) The user enters his username and Digipass password (OTP) on the OWA login page (This can be the Exchange server or a web server publishing the OWA page) 2) The Vasco IIS module (Vasco filter) intercepts the Username and OTP and sends them to the Middleware server for validation 3) After a successful verification, the Middleware sends the Username and the Stored Middleware Password 4) The Vasco IIS module fills out the username and static password on the OWA login page. 5) Exchange validates the user against the Active Directory database 6) User is granted access to his mailbox.doc 31/05/ :04 Page 3 of 10

4 2) Outlook Web Access setup: After having installed Exchange 2003 you need to make sure that the Outlook Web Access is functioning correctly before the Vasco filter is installed. If this is not the case please check the following link for more information: Microsoft Knowledge base on Outlook Web Access in Exchange ) Troubleshooting and log files Both the Vasco IIS module (filter) and the Middleware can generate log files. You need to determine which setup you are using to perform the correct troubleshooting steps and find out where exactly the necessary information (log files) can be found. Below you will find the most common setup scenarios. a) Vasco filter and Middleware server installed on the Exchange server. All log files will be on the same server in the Vasco installation directories b) Vasco filter installed on Exchange server, Middleware server installed on member server The filter log files will be on the Exchange server while the Middleware log files will be on the member server c) Vasco filter installed on front-end Exchange server, Middleware installed on back-end Exchange server The filter log files will be on the Front-End Exchange server while the Middleware log files will be on the Backend server.doc 31/05/ :04 Page 4 of 10

5 4) Creating the log files To discover the problem in the configuration it is of course very helpful to have log files. These log files are not created by default since logging consumes a lot of disk space. The options to create log files need to be enabled in case of authentication problems and disabled afterwards, when the OWA setup with Vasco Digipass is working correctly. Enable logging in the Vacman Middleware: Click on Start => Programs => Vasco => Authentication Server Configuration: Select the Full Tracing option and click OK : To activate the new configuration, the service needs to be restarted. Press the yes.doc 31/05/ :04 Page 5 of 10

6 button in the popup-up window: After enabling this option all Middleware events are logged to a text file. The default name and location of this log file is: C:\Program Files\Vasco\Vacman Middleware 3\Log\dpauthserv.trace Enable logging in the Vasco filter: Click on Start Programs Vasco Digipass Pack for OWA Forms/Basic Authentication Digipass Pack for OWA Forms/Basic Authentication Configuration: Select the Full Tracing option and click OK :.doc 31/05/ :04 Page 6 of 10

7 To activate the new configuration, the IIS Admin service needs to be restarted (for example by using the iisreset command on a command prompt) After enabling this option all Vasco Filter events are logged to a text file. The default name and location of this log file is: C:\Program Files\Vasco\Digipass Pack for OWA Forms Authentication\Log\vmextcfg.trace or C:\Program Files\Vasco\Digipass Pack for OWA Basic Authentication\Log\vmextcfg.trace 5) Step by step test scenario 1. Enable logging on the filter and in Middleware 2. Follow the steps as described in the Digipass for OWA Forms (or Basic) Authentication Guide in section 3.3 Configure Authentication server 3. In VM, create a new policy to experiment with, do not change the pre-defined policies created by the installation procedure. To create a new policy, copy the VM3.0 Windows Password replacement policy to test policy 4. In the test policy properties, check/change the following paramaters: On the Main Settings tab: Set the authenticator to Digipass/Password Backend Authentication: Always Protocol: Windows On the User Settings tab: Enable DUR.doc 31/05/ :04 Page 7 of 10

8 Enable Autolearn Enable Stored Password Proxy Set the Windows Group Check to No Check 5. Assign a policy to the component assign the test Policy to the OWA Web Interface component 6. Manually create a user dptest and an exchange mailbox in Active Directory 7. Try to login to OWA using the UserID dptest and his static password 8. Normally, the Vacman Middleware user is created by the DUR process. If DUR was disabled you need to create the Middleware user manually, and configure the correct static password (identical to the Active Directory password). 9. If the authentication was successful, import a demo DPX file A demo DPX key is created during the installation process in the subfolder DPX of the Middleware installation directory The DPX key for the demo DPX files key is always 32 times the nr 1 ( ) 10. Assign the Digipass to the user dptest in the Middleware MMC 11) Try to login to OWA using the user dptest and his OTP 6) Checking and understanding the log files After having enabled debugging in both the Middleware and the Vasco filter a new authentication attempt needs to done to make sure that the problem is logged in the log files. It is important to examine both the filter and the Middleware trace files simultaneously. Check the entries that happened at the same time in the filter and in the Middleware and correlate the events. When going through the log files it is very important to understand the information in the log files since this is the key to solving the problem. Following an authentication attempt from the filter to the middleware and back, gives a complete overview of what happened during the authentication attempt. If no filter trace file was created then there is a configuration issue in the filter. Please check the Digipass Pack for OWA administration manual. Follow the troubleshooting section step by step. Please make sure to use the correct documentation. There is a document describing Basic Authentication and another document describing Forms-Based authentication..doc 31/05/ :04 Page 8 of 10

9 7) Troubleshooting your setup step by step: Step 1: Checking if the Vasco filter log files exist Problem: No filter trace file is created. This is usually caused by the filter not being on the correct place in the IIS server so that the filter does not see any authentication requests coming in. Solution Check the troubleshooting section of the Digipass Pack for OWA administration guide Step 2: Communication between Filter and Middleware Problem: No entries in the Middleware log file, however authentication attempts are seen in the filter trace file Solution: Solve the communication issue between the filter and the Middleware server. Possible issues are: - the Middleware server address specified in the filter configuration is not corresponding to the IP address of the Middleware server. - The communications port between the filter and the Middleware is blocked. The default communication port used between filter and middleware is When firewalls are used, make sure TCP port is opened between the filter and the Middleware server. Step 3: Error messages are logged Both the OWA filter and the Middleware produce messages in the trace files. It is best to check both the OWA filter trace and the Middleware trace for these messages. Below you find a list of the known error messages and their solution. Error code: <1> Error message: <Serial [xxxxxxxxxx] Application [xxxxxx] OTP Incorrect - [Validation Failed]> Cause: When mistyping the Server (Static) PIN code or OTP Solution: Correctly enter the PIN and OTP Error code: <201> Error message: <Serial [xxxxxxxxxx] Application [xxxxxx] OTP Incorrect - [Code Replay Attempt]> Cause: The Digipass OTP has already been used before Solution: Wait at least 36 seconds before retrying to log in. Never login more than once with the same OTP since this will always fail.doc 31/05/ :04 Page 9 of 10

10 Error code: <-202> Error message: <Serial [xxxxxxxxxx] Application [xxxxxx] OTP Incorrect - [Response Too Small]> Cause: The user did not type his complete (PIN+)OTP Solution: Make sure the user enters his full OTP (With PIN if required) Error code: <-205> Error message: <Serial [xxxxxxxxxx] Application [xxxxxx] OTP Incorrect - [Response Not Decimal]> Cause: The user tries to login using his static password after the grace period has expired Solution: Make sure users only use their Digipass OTP after the expiry of the Grace Period Windows Authentication failed: [1326] [Logon failure: unknown user name or bad password.] Cause: The user s static password does not correspond with the Middleware password while using Local and Windows authentication Solution: If Autolearn is enabled let the user login using Windows Password (+PIN) +OTP. If Autolearn is not enabled please make this change manually in the Middleware. Error code: <1007> Error message: <Digipass User account is locked> Cause: The password or OTP have been entered incorrectly too many times. By default the user lock threshold is set to 3 attempts Solution: An administrator needs to uncheck the locked checkbox on the user record Applies to: Vacman Middleware 3.0 and Digipass Pack for OWA More information: Documentation: VACMAN Middleware Administration Guide.pdf Digipass Pack for OWA Basic Authentication Guide A4.pd Digipass Pack for OWA Forms Authentication Guide A4.pdf.doc 31/05/ :04 Page 10 of 10