MS-Exchange WebDAV authentication on clustered environment

What is NLB (Network load balancing) clustered environment?

 

Clustered environment is not a single server; it is the virtual address of NLB cluster which is comprised of our CAS and HT Exchange server nodes (In case of Exchange server cluster).

When Windows NLB has been properly configured, all servers in the NLB cluster are represented by a single virtual IP address and by a fully qualified domain name (FQDN). When a client request comes in, it will be sent to all servers in the Windows NLB cluster. The client will then be mapped to a particular server and the request to the other servers will be dropped. It means to say that, you can use affinity to direct specific client request to particular member servers. You can even configure each member server with a priority.

Figure below shows a very simple setup consisting of two Exchange 2007 Client Access servers configured in a Windows NLB. Both Client Access servers accept the client requests and send them to the respective back-end servers depending on the type of request.

For Example: When we go to https://exchange.portmail.com/owa, the login page is provided directly to you by either of our CAS/HT nodes. There are no redirects for CAS/HT traffic.

When we create any request for cluster, the cluster takes this request and forwards it to front servers (In case of Exchange, it is CAS (client access server) server). Now front servers handle the request and pass it on required mail box.

Exchange WebDAV Cluster connection construction when Exchange and Mailbox users in different domain

In some cases, Exchange users and Mailbox users belong to different domains and may be in different machines as well.

For Example: Your Exchange user belongs to ‘staff.ad.portmail.com’ and Mailbox users belong to ‘portmail.com’.

For this environment, if you want to establish connection with Exchange server using WebDav protocol, you need to keep following things in your mind. These are,

1)  If Exchange user belongs to parent node, Exchange user comes with parent domain let’s say ‘staff.ad.portmail.com\\utest2’ else it belongs to child node depends on Exchange configuration.

2)  If Mailbox user belongs to child node, Mailbox user comes with child domain let’s say ‘utest2@.portmail.com’ else it belongs to parent node depends on Exchange configurations.

3)  In each connection call, if Exchange server is configured with FBA (Form based authentication), we receive FBA cookie each time whether it is right call or not.  As of my understanding,

Right cookie is as,

fbaCookie :sessionid=aecf3dac-0666-4cfd-b44d-2eb8eb9d01a7; cdata=1ahtoUs9q7ak1MUcDlGkScTjyTzCu9H66h3C773lTKg2mq7Kpt6uMxNAl5DamkGCmG3UDmMa0KkeLTEKOItTNrF/H4vKf3TMip/l5vg==

 - Starts from characters

Wrong cookie is as –

fbaCookie :sessionid=45f6a15a-d323-411e-91fe-6607e2106cd7; cdata=1UuQOsRhVdWkf08JG1FANQllsWgvVCLsHy5nciGMLd/3+AoIEvF0ligBSZGEm58QD3rUzNx7UPku94S+9yFW/Ww==

-  Starts from numbers.

Exchange WebDAV FBA authentication

This cookie returns once you authenticated with Exchange server and you can find this from authenticated response. This cookie contains sessionid and cadata both. You need to pass this query for each Exchange operation (Basically for authentication).

Reference Taken From - 
http://www.redline-software.com/eng/support/articles/msexchange/2007/load-balancing-exchange-2007-client-access-servers-windows-network-technology-part1.php