Part 2: Logging into SecurEnvoy 2fa enabled Exchange 2016 OWA portal loops back to the login page

As a follow up to my previous post:

Logging into SecurEnvoy 2fa enabled Exchange 2013/2016 OWA portal loops back to the login page
http://terenceluk.blogspot.com/2018/05/logging-into-securenvoy-2fa-enabled.html

I eventually had to upgrade the environment with the latest SecurEnvoy server 9.3.502:

… but quickly noticed that IE and Edge browser allowed me to successfully log into Outlook Web App but Chrome would loop back to the login page:

After not having any luck with the configuration I included in my previous blog post, I opened up a ticket with SecurEnvoy to troubleshoot and the engineer asked that I turn on the debug (Trace) mode to collect logs of the login process:

The logs were generated in the directory: C:\DEBUG

… which I sent over so he could analyze the entries and the response I received was:

Thanks for sending over the trace files.  I notice that the redirect to your OWA site performed after 2FA has been achieved contains favicon.ico at the end of the path.  The linked patch has been created to overcome this issue. 

I went ahead and downloaded the patch provided:

… replaced the webauthfilter64.dll file as per instructions, performed an IISReset on the Exchange server and was able to successfully log into OWA with the Chrome browser.

Deploying SecurEnvoy 2FA with Exchange Server 2016 OWA

I recently had to deploy SecurEnvoy 2FA with Exchange Server 2016’s OWA and noticed that there wasn’t official documentation for the configuration so I thought I’d write this blog post to outline the steps I used.  Note that the steps outlined in the Exchange 2013 documentation is accurate and the steps below are the same but I’ve added additional post deployment tasks for customizing the login page.

Environment Information

SecurEnvoy: Version 9.1.501 (https://www.securenvoy.com/support/downloads.shtm)
Microsoft Exchange: Exchange 2016 CU8
Server Operating System: Windows Server 2016

Deployment Steps

Begin by downloading the SecurEnvoy package from the portal:

Extract the securenvoy.zip package and navigate into the Release9.1.501 folder::

Proceed into the Agents folder and navigate into the Microsoft Server Agent folder:

Run the setup.exe executable:

Install the agent:

Configure the SecurEnvoy server or servers in the SecurEnvoy Servers tab:

Note that you’ll need to add the Exchange server to the SecurEnvoy server as a Radius client via the administration console:

Once configured, ensure that the Test Server option returns a Server OK status:

Click on the IIS Authentication tab and enable the Include SecurEnvoy Plugin in IIS option then click Update:

Answer OK to the prompt asking to install the CGI module:

Restart IIS when asked:

Launch IIS (Internet Information Services Manager), select the Default Web Site node and then double click the SecurEnvoy Two Factor Authentication node:

Enable the Enable Authentication On Site option and click Apply:

You will get an OK displayed to confirm the change:

Navigate the owa node and double click the SecurEnvoy Two Factor Authentication node:

Enable the Enable Authentication On /owa option, click Apply and restart IIS:

Hit the refresh button and SecurEnvoyAuth node should appear:

Right click on the SecurEnvoyAuth node, Manage Application then Advanced Settings…:

Verify that the Application Pool is configured as MSExchangeOWAAppPool:

Select the top node under Start Page and double click the SecurEnvoy Two Factor Authentication node:

Uncheck Allow non secure connections (http) option:

Add the following to the Logoff URL’s:

/owa/auth/logon.aspx
/owa/auth/logoff.aspx

Restart IIS when asked:

The portal should now display the SecurEnvoy login screen:

Assuming you would like users to use their username to login, ensure that you have configured a default domain for the portal with either of the following options:

Option #1 – Configure a default domain within the SecurEnvoy configuration

Option #2 – Configure a default domain within Exchange admin center

Navigate to the Exchange server’s C:\windows directory and open the file seiis.ini, locate the DefaultDomain= line and add the domain name:

-----------------------------------------------------------------------------------------------------------------------------------------------------

If the above is not configured and you use only the user name to log in then you would get the following loop:

Message: Passcode OK

Redirecting to secured resource, please wait

If you don't redirect after a short time Click here

-----------------------------------------------------------------------------------------------------------------------------------------------------

With the above configured, proceed to by backing up:

passcodeok.htm
auth.htm
accessdenied.htm

… located in \Program Files(x86)\SecurEnvoy\Microsoft IIS Agent\WEBAUTHTEMPLATE then copying the SecurEnvoy supplied OWA login page by navigating to

C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\SAMPLES\OWA2016

… and copying the 3 htm files into:

C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEBAUTHTEMPLATE

The login page should look as such:

I’m not completely sure why but the 4 deployments I’ve been in did not include the images so the following are the for the broken / missing images:

…/securenvoyauth/images/top.gif

…/securenvoyauth/images/heading_logo.gif

…/securenvoyauth/images/buttons/oneswipe.gif

…/securenvoyauth/images/buttons/send.gif

…/securenvoyauth/images/blackbottom.gif

I choose to remove the following images because:

…/securenvoyauth/images/heading_logo.gif – this icon did not seem necessary

…/securenvoyauth/images/buttons/oneswipe.gif – this button never worked for my deployments

The heading logo doesn’t look good and one Swipe doesn’t seem to work

The customizations I made to the page to look as such are as follows:

The pages to edit are:

Auth.htm
Accessdenied.htm
Realtime.htm

Initial Logon Page – auth.htm

1. Copy blackbottom.gif into the directory C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEB\images (this is to fix the broken banner at the bottom)
2. Copy <yourLogo>.png into the directory: C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEB\images
3. Open auth.htm in the directory: C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEBAUTHTEMPLATE
4. Change the title between the <title> tags to <YourCompany> Webmail
5. Search for the line referencing the image heading_log.gif and remove it

<IMG height="23" alt="" src="/securenvoyauth/images/heading_logo.gif" width="27" align="middle" border="0">

6. Search for the line referencing the image oneswipe.gif and remove the following:

onload="se_oneswipe_init('placeFocus()', '/securenvoyauth/images/buttons/oneswipe.gif', 'USERID', 'PIN', '', 'send');"

7. Search for the line referencing top.gif and replace it with <yourLogo>.png
8. Search for the line setting the background colour #edf2f8 and change it to #ffffff (white)
9. Add font-family: Arial; for style2, style4, style5 and style6
10. Change all styles with x-small as the font size to small

**Note that I did a Google search of SecurEnvoy OWA pages and downloaded the missing blackbottom.gif and send.gif images.

Access Denied Page – accessdenied.htm - displayed if incorrect credentials are entered

Repeat a subset of the steps required for initial logon page.

1. Open accessdenied.htm in the directory: C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEBAUTHTEMPLATE
2. Change the title between the <title> tags to <YourCompany> Webmail
3. Search for the line referencing the image heading_log.gif and remove it

<IMG height="23" alt="" src="/securenvoyauth/images/heading_logo.gif" width="27" align="middle" border="0">

4. Search for the line referencing top.gif and replace it with <YourLogo>.png
5. Search for the line setting the background colour #edf2f8 and change it to #ffffff (white)
6. Add font-family: Arial; for style2, style4, style5 and style6
7. Change all styles with x-small as the font size to small

2FA Page - realtime.htm – displayed for SecurEnvoy code

1. Open realtime.htm in the directory: C:\Program Files (x86)\SecurEnvoy\Microsoft Server Agent\WEBAUTHTEMPLATE
2. Search for the line referencing top.gif and replace it with <YourLogo>.png
3. Search for the line setting the background colour #edf2f8 and change it to #ffffff (white)
4. Add font-family: Arial; for style1, auto-style1, auto-style2, auto-style3

I’ve tried logging out of the webmail portal and was sent back to the login screen so I don’t think modifications are required for the logout.htm file.

Hope this helps!

Logging into SecurEnvoy 2fa enabled Exchange 2013/2016 OWA portal loops back to the login page

Problem

You’ve completed configuring your Exchange 2013/2016 OWA (Outlook Web App) for 2-factor authentication with SecurEnvoy and proceed to test the login portal:

You’re proceed to enter the 2^nd factor passcode:

The authentication is successful with the following message displayed:

Authentication OK

Logging on to Exchange Please Wait …..

… but the screen refreshes and you are passed back to the login screen:

Solution

One of the reasons why this behavior would be exhibited is if you do not have a default domain configured and you’re logging in with only the user name and not domain\username. To test, try logging in with domain\username and if you are successful then you have the following 2 choices:

Option #1 – Configure a default domain within the SecurEnvoy configuration

Navigate to the Exchange server’s C:\windows directory and open the file seiis.ini:

Locate the DefaultDomain= line and add the domain name:

Option #2 – Configure a default domain within Exchange admin center

Navigate to servers > virtual directories, select the server hosting the OWA website, open the properties of the owa (Default Web Site), click on authentication, change the default Domain\user name option to User name only and select a default domain:

Alternatively, you could also use the following PowerShell cmdlets to review the OWA authentication configuration:

Get-OwaVirtualDirectory -Server tmrukexowa01 | FL LogonFormat,DefaultDomain

The following can configure the OWA authentication:

Set-OwaVirtualDirectory

The above should correct the issue and allow you to log into OWA successfully.