Microsoft KB Archive/307347

= Secure OWA Publishing Behind ISA Server May Require Custom HTTP Header =

Article ID: 307347

Article Last Modified on 10/29/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2000 Standard Edition

-



This article was previously published under Q307347



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
When you are using Web Publishing in Internet Security and Acceleration (ISA) Server 2000 to securely publish Microsoft Outlook Web Access (OWA), OWA users may experience one or more of the following symptoms if the SSL connection is terminated at the ISA Server computer:  The users may receive security warnings that are similar to the following security warning:

This page contains both secure and nonsecure items. Do you want to display the nonsecure items?

 The users may receive multiple authentication prompts from the OWA server because of a mix of HTTP and HTTPS that is being used. No security key lock that indicates a secure connection is shown in the browser.

If the OWA Web Publishing rule is configured to &quot;Require secure channel (SSL) for published site&quot;, OWA users may receive the following error message in the browser instead of receiving the preceding symptoms:

403 Forbidden - The page must be viewed over a secure (that is, Secure Sockets Layer (SSL)) channel. Contact the server administrator. (12211) Internet Security and Acceleration Server



CAUSE
This problem may occur because the published OWA server sometimes needs to send the OWA client absolute URL references.

When the OWA client uses SSL to connect to the ISA Server computer (and when you terminate the SSL connection at the ISA Server computer), the type of traffic that is between the ISA Server computer and the OWA server is HTTP. As the OWA server receives HTTP, it dynamically creates the URLs it sends back to the OWA client by using http:// instead of https://. This causes a mix of HTTP and HTTPS to be used between the OWA client and the ISA Server computer, and which may create the symptoms that are described in the &quot;Symptoms&quot; section of this article.



RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this problem:  Obtain and install the latest service pack for ISA Server 2000.For additional information about how to do so, click the article number below to view the article in the Microsoft Knowledge Base:

313139 How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack

 Stop the Web Proxy service.</li> Start Registry Editor.</li> Locate and click the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters

</li> Create a new DWORD value that is named AddFrontEndHttpsHeader, and then give this new value a data value of 1.</li> Start the Web Proxy service.</li></ol>

WORKAROUND
To work around this problem, use any of the following methods.

Method 1
In ISA Server, publish OWA by using Server publishing instead of Web publishing.

Method 2
Instead of terminating SSL at the ISA Server computer, use SSL Bridging so that a new SSL connection is established between ISA Server and the internal OWA server.

Method 3
Write a Web filter in ISA Server that adds the custom HTTP Header &quot;Front-End-Https: On&quot;. Note this procedure has basically the same effect the procedure that is described in the &quot;Resolution&quot; section of this article. For more information about Web Filters, see the ISA Server Software Development Kit.

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

This problem was corrected in ISA Server 2000 SP1.

<div class="moreinformation_section">

MORE INFORMATION
If you have the ISA Server computer add the &quot;Front-End-Https: On&quot; custom HTTP header, OWA will recognize this header, and then return its URLs by using https:// instead of http://.

NOTE: &quot;Front-End-Https: On&quot; is a custom HTTP header that is only recognized by OWA and Exchange. If you publish other applications behind ISA in a similar scenario, and experience the same symptoms as described in this article, then adding this custom HTTP header will have no effect.

Keywords: kbproductlink kbenv kberrmsg kbexchange2000sp3fix kbprb KB307347

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.