HAProxy 2.2 with Exchange 2019 - Continious password prompt

Help!
1

Hello,

i’m a bit stuck setting up my HAProxy reverse proxe in combination with Exchange.

I have several webservers but only 1 public IP so i opted for HAProxy as reverse Proxy.

All my websites work except for the Exchange 2019 - Outlook connection.

When i fire up outlook from an external connection i continuously get prompted for a password.
Internally (or when i configure my hosts file to point to the reverse-proxy) everything works great.

I’m a bit at a loss what the problem could be.
I’ve stripped my config file to remove my public address etc. and i removed the other sites/acl’s.
Can you please take a look at my config and tell me how i f-ed up? :slight_smile:

Here is my cfg file: https://pastebin.com/Gk56CmCn

Thanks in advance for any advise :slight_smile:

2

What do you have for the following on your CAS?

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
KeepAliveTime

3

The KeepAliveTime key is not present.

4

add the key, and set it for a value that is equal or less than your HA backend server timeout value.

I personally I have mine set to 30 minutes, and have my HA backend timeouts for client (front end) and server timeout (backend) set to the same
“KeepAliveTime”=dword:001b7740
or 1800000 for decimal. unit is milliseconds

5

thanks for the advice.
Unfortunately: no dice :frowning:

i set the reg-key; restarted the CAS server, double checked HAproxy time-out values but still continuous password prompts :frowning:

6

whats your updated cfg look like?

7

Hi, this is my current config: https://pastebin.com/KSMaYbhe

8

try comment/remove all of the http-keep-alive

ie
timeout http-keep-alive
option timeout http-keep-alive

9

i don’t get it…the password pop-ups keep coming back.

ntlm should be proxied correctly…

10

perhaps it an issue with your stickiness. what happens if you only configure a single backend without the cookie/stickiness etc…

11

Exchange 2019 CU11 + HAProxy 2.4.18
I have a similar problem with Outlook authorizations. The configuration is standard. The only thing I noticed is that the authorization is transmitted incorrectly (our mail domain differs from the UPN). I enter the correct data when requesting a username and password.

Den.Klim@secdomain.net 172.31.14.91 VM-Exch01.domain.ru TDCF.domain.ru apr 10,2023 03:33:20 PM Failure Bad user name krbtgt/domain.ru 22229 - 0xffffffff A Kerberos authentication ticket (TGT) was requested for secdomain.net from VM-Exch01.domain.ru. Status : Failure. . Error : Bad user name