OWA Vault v6sp4 implementation not working

[Richard_Cheung]

Hi all

I am trying to update my installations for OWA from v5 to v6.0sp4.

What I have been testing with is my backend exchange cluster, with a front end server, and a vault server, all running windows 2003 sp2 / exchange 2003 sp2. 

In my testing, even if I connect directly to the backend server via OWA, I do see the vault icons / stubs, I do see the archive explorer or search archives buttons.    I can click on a vaulted message and open it.   When I do, along the top of the window it says

"The archived item is currently unavailable.  If you choose reply or forward, only the content shown below will be included.  click here to preview the original item"

If I try to 'click there' to see the original item, or if I try to click on archive explorer etc, I get an error

"The remote server returned an error: (403) forbidden"

This is the same for all users on this backend exchange cluster, where I have installed the EnterpriseVaultv6sp4OWA backend software.

I am thinking it is something to do with the communications between my backend exchange server and my vault server not configured properly in my EV OWA implementation, but am not certain why.   Have followed the administrator's guide implementation instructions to the letter.

Normal MAPI clients working on this server are working fine.

Has anyone come across this?

[MichelZ]

Richard
You may want to include the IP Addresses of the Vaultserver as well.
But looks basically OK.

Cheers
Michel

[jimbo2]

Richard,

The proxycfg looks good to me.

1. Run ipconfig on the problem Exchange server.

2. Attempt to retrieve an item from the problem server to force an error. Record the time.

3. Check the IIS log on the EV server (today's date). Check for a received call toward the bottom from the IP address recorded in step one at the time recorded in step two.

4. Post the lines.

(Looking for the exact 401.X message).

Also,

Jim S.

[Richard_Cheung]

here is the IIS log - obviously edited out our domain / server names.

vaultid=14F1E74AB1174C249910F7AC373C8BAE41110000myvaultserver.domain.com&savesetid=994000000000000~2... 80 - 128.6.5.7 - 401 2 2148074254
2007-11-29 22:52:32 10.1.1.3 GET /EnterpriseVault/download.asp VaultID=1B24758B83F2BBA4E8427193F5DCFBF671110000myvaultserver.domain.com&SaveSetID=627000000000000~200711071241420000~1~C8DFDBF7CDA14340865AABF2920ADE9&CacheIfCollected=0 80 SANTOS\trati 10.200.110.63 EnterpriseVault 200 0 0
2007-11-29 22:52:33 10.1.1.3 GET /EnterpriseVault/restoreo2k.asp vaultid=14F1E74AB1174C249910F7AC373C8BAE41110000myvaultserver.domain.com&savesetid=994000000000000~2... 80 - 128.6.5.7 - 401 1 0
2007-11-29 22:52:33 10.1.1.3 GET /EnterpriseVault/download.asp VaultID=15955E6B9D5C7E24B91F61583A58630D71110000myvaultserver.domain.com&SaveSetID=233000000000000~200711072211210000~0~DEF1FFEABD3C4C25A8090DA554D86D2&CacheIfCollected=0 80 - 10.200.110.63 EnterpriseVault 401 2 2148074254
2007-11-29 22:52:33 10.1.1.3 GET /EnterpriseVault/restoreo2k.asp vaultid=14F1E74AB1174C249910F7AC373C8BAE41110000myvaultserver.domain.com&savesetid=994000000000000~2... 80 - 128.6.5.7 - 401 1 5

where

10.1.1.3 = vault server IP

128.6.5.7 = faulty exchange server IP.

Note: this was all working when we were on the previous version (version 5)

Message Edited by Richard Cheung on 11-29-2007 03:08 PM

Message Edited by Richard Cheung on 11-29-2007 03:09 PM

Message Edited by Richard Cheung on 11-29-2007 03:11 PM

[jimbo2]

Richard,

Just a guess that can't hurt.

Try setting the setting in the article below on the exchange server's IE profile. Login as the VSA and set it.

http://seer.entsupport.symantec.com/docs/294125.htm

Jim S.

[Richard_Cheung]

tried that. didnt work.

a 401 is yet another error in the background...   it is as tho it is not authenticated correctly?

[jimbo2]

Can you do an IIS reset on the Exchange server that is having the problem? You are on the West Coast correct?

Jim S.

[Richard_Cheung]

Im in Australia mate.  Did the IIS reset.  

Please note: again this is only for OWA - normal Outlook access via this server works fine.    We are only working on the update of OWA extensions.

If I went directly to this faulty backend exchange server via OWA,  I see the vault icons, but I cant actually open or even preview any vaulted message.  It hangs with an hour glass and a blank window, but opening the message or anything shows just blank (no error)

if I went via my OWA front end to this faulty backend exchange server via OWA, I DONT see the vault icons, but I can preview any vaulted message, I just cant accessed them fully.

problem with backend install?

[jimbo2]

Richard,

There is an Enterprisevaultproxy directory on the backend server.

1. Compare the permissions to the one that is working.

2. Compare a file names backend.ini to the one that is working.

Sounds like the Enterprisevaultproxy is not proxying correctly.

Jim S.

[Richard_Cheung]

have compared directory securities and file contents, all looks the same.

the only difference between the two exchange backend servers is that one is on a WAN, the other is local.

But it was all working okay prior to the upgrade, and as I said, this is only affecting this exchange server since the OWA extensions were updated.

[jimbo2]

Richard,

Here are two lines below from your IIS log. The first line is a download.asp that was successful and from system

10.200.110.63.  IWA authentication looks good. Look for this in "GOOD Authentication" (SANTOS\trati 10.200.110.63 EnterpriseVault 200 0 0). There are authentication credential being passed. This could have been from a client machine.

The second line is a restoreo2.asp from the faulty Exchange server 128.6.5.7. (128.6.5.7 - 401 1 0). The authentication line is missing which indicates to me that IWA does not seem to be working.

This seems to point back to:

http://support.microsoft.com/kb/253667

GOOD Authentication

2007-11-29 22:52:32 10.1.1.3 GET /EnterpriseVault/download.asp VaultID=1B24758B83F2BBA4E8427193F5DCFBF671110000myvaultserver.domain.com&SaveSetID=627000000000000~200711071241420000~1~C8DFDBF7CDA14340865AABF2920ADE9&CacheIfCollected=0 80 SANTOS\trati 10.200.110.63 EnterpriseVault 200 0 0

Error Authenticating

2007-11-29 22:52:33 10.1.1.3 GET /EnterpriseVault/restoreo2k.asp vaultid=14F1E74AB1174C249910F7AC373C8BAE41110000myvaultserver.domain.com&savesetid=994000000000000~200707190321480000~0~A5C152BC4C5A45EB8F147D8912D3E5A&mbx=cherits@domain.com&server=faultyexchangeserver&restorelocation=3&foldername=Deleted%20Items 80 - 128.6.5.7 - 401 1 0

I would be curious to compare a line from an exchange server that is working to the line of the faulty exchange server.

Jim S.

[Richard_Cheung]

Here are the corresponding logs for a test account called 'a5' on the working server.

2007-12-02 05:19:49 W3SVC100 10.1.2.51 GET /enterprisevaultmail/a5/Inbox/Exactly....EML cmd=preview 80 - 10.1.2.51 Exchange-Server-Frontend-Proxy/6.5+Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+InfoPath.2;+.NET+CLR+2.0.50727) 401 1 0
2007-12-02 05:19:49 W3SVC100 10.1.2.51 GET /enterprisevaultmail/a5/Inbox/Exactly....EML cmd=preview 80 DOMAIN\a5 10.1.2.51 Exchange-Server-Frontend-Proxy/6.5+Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+InfoPath.2;+.NET+CLR+2.0.50727) 200 0 0
2007-12-02 05:19:51 W3SVC100 10.1.2.51 GET /mail/a5/Inbox/Exactly....EML cmd=preview 80 DOMAIN\a5 10.1.2.54 Exchange-Server-Frontend-Proxy/6.5+Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+InfoPath.2;+.NET+CLR+2.0.50727) 200 0 0
2007-12-02 05:19:51 W3SVC100 10.1.2.51 GET /mail/a5 cmd=EVSettings 80 DOMAIN\a5 10.1.2.54 Exchange-Server-Frontend-Proxy/6.5+Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+InfoPath.2;+.NET+CLR+2.0.50727) 302 0 0

I checked the Microsoft KB article, and checked the IIS config of both the working & faulty exchange servers - they both have the same sort of authentication methods selected (basic & integrated)

I know it is an authentication issue but am a bit stumped now as to where / how to fix it.