HAProxy 2.2 with Exchange 2019 - Continious password prompt

Help!
1

Hello,

i’m a bit stuck setting up my HAProxy reverse proxe in combination with Exchange.

I have several webservers but only 1 public IP so i opted for HAProxy as reverse Proxy.

All my websites work except for the Exchange 2019 - Outlook connection.

When i fire up outlook from an external connection i continuously get prompted for a password.
Internally (or when i configure my hosts file to point to the reverse-proxy) everything works great.

I’m a bit at a loss what the problem could be.
I’ve stripped my config file to remove my public address etc. and i removed the other sites/acl’s.
Can you please take a look at my config and tell me how i f-ed up? :slight_smile:

Here is my cfg file: https://pastebin.com/Gk56CmCn

Thanks in advance for any advise :slight_smile:

2

What do you have for the following on your CAS?

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
KeepAliveTime

3

The KeepAliveTime key is not present.

4

add the key, and set it for a value that is equal or less than your HA backend server timeout value.

I personally I have mine set to 30 minutes, and have my HA backend timeouts for client (front end) and server timeout (backend) set to the same
“KeepAliveTime”=dword:001b7740
or 1800000 for decimal. unit is milliseconds

5

thanks for the advice.
Unfortunately: no dice :frowning:

i set the reg-key; restarted the CAS server, double checked HAproxy time-out values but still continuous password prompts :frowning:

6

whats your updated cfg look like?

7

Hi, this is my current config: https://pastebin.com/KSMaYbhe

8

try comment/remove all of the http-keep-alive

ie
timeout http-keep-alive
option timeout http-keep-alive

9

i don’t get it…the password pop-ups keep coming back.

ntlm should be proxied correctly…

10

perhaps it an issue with your stickiness. what happens if you only configure a single backend without the cookie/stickiness etc…

11

Exchange 2019 CU11 + HAProxy 2.4.18
I have a similar problem with Outlook authorizations. The configuration is standard. The only thing I noticed is that the authorization is transmitted incorrectly (our mail domain differs from the UPN). I enter the correct data when requesting a username and password.

Den.Klim@secdomain.net 172.31.14.91 VM-Exch01.domain.ru TDCF.domain.ru apr 10,2023 03:33:20 PM Failure Bad user name krbtgt/domain.ru 22229 - 0xffffffff A Kerberos authentication ticket (TGT) was requested for secdomain.net from VM-Exch01.domain.ru. Status : Failure. . Error : Bad user name

12

Did you manage to fix this problem? Im having the same issue where /mapi posts are getting a 401 error. Ive been around the internet serveral times trying different things with no improvement.

13

The problem was Windows Extended Protection not working. To get it to work you need to setup the proxy as a ssl bridge and use the same ssl cert on the proxy and the exchange server. This makes setting up auto renew of lets encrypt certificates very difficult.
I switched off Extended protection until I figure out how to solve the above issues.