How to fix 401 error on exchange 2019 owa and ecp ADFS authentication

Question

How to fix 401 error on exchange 2019 owa and ecp ADFS authentication

Chibwe Kapambwe 0

Am trying to setup adfs authentication for owa and ecp in exchange 2019, using 2019 adfs. Both servers are running on a common local network. ADFS works fine, i have some tests using the test login page, communication with active directory is also fine. The problem i have is, owa and ecp are failing to redirect to adfs login page, i followed the official guide provided on this https://learn.microsoft.com/en-us/exchange/clients/outlook-on-the-web/ad-fs-claims-based-auth link.

I have nothing in the event viewer on both servers, anything that could give me more information on why am getting 401 error, instead of a redirect to adfs.

0 comments

2 answers

Your answer

Answer 1

Andy David - MVP 160.3K MVP Volunteer Moderator

I would verify the OWA and ECP virtual dirs again to ensure they include ADFS auth set to $true

Have you restarted IIS?

If you do a F12 in the browser and do a network trace does anything pop out?

Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -OAuthAuthentication $false -WindowsAuthentication $false

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -OAuthAuthentication $false -WindowsAuthentication $false

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 2

Ceyhun KIRMIZITAS 0 Microsoft External Staff

If the AD FS settings are already correct, I would check the IIS and Exchange HTTP Proxy logs next.

For the failed request, check the HTTP status and substatus in IIS and correlate the same timestamp with the OWA HTTP Proxy logs.

I documented how I use these logs together for OWA authentication troubleshooting here: https://ceyhunkirmizitas.net/exchange-owa-authentication-troubleshooting-iis-logs-part-4/

I would also use the browser F12 Network trace to confirm whether Exchange returns the redirect to AD FS or the 401 happens before that point.

0 comments