Freaky OWA Problem

[Richard Lea]

I am running Windows 2k Active Directory with Exchange 2k and SQL 2k. I am using OWA for email, calendar, etc access. Most PCs just point to the url (exchange.x.com/exchange) and get the standard log in prompt to manage their email. But, some PCs (win98 and win2k) get a 403 Forbidden message "You are not authorized to view this page".

From the message I assume that it is seeing the exchange server, but just not giving me access. Logons themselves don't seem to make a difference. Either the PC itself is authorized or not despite the log on that I use.

I thought it was a licensing issue. So, I added a ton of license to make sure it wasn't. I also manually cleared all of the license. All with no effect. This happens on both Win2k PCs and Win98 PCs.

Any ideas?

[Ron Kinner]

I suspect that the PC's which do not work are trying to automatically logon with their MS user login info. Look in IE/Tools/Internet Options/Advanced and see if
Enable Integrated Windows Authentication is checked. May be another option too depending on your version of IE.

Ron

[Jon Finley]

You need to look under Tools/Internet Options/Security Tab, then under either Internet (if you are NOT connecting to the server from behind the same firewall), or Local Intranet.

Select Custom Level, and scroll down until you see User Authentication / Logon

The settings should be: Automatic Logon only in Intranet zone.

If this does't work, try setting it at Prompt for user name and password.


Jon

[Sam Cochran]

this looks more like a web server configuration
issue --
where a logon document or cgi app is in a folder
that doesn't have it's permissions set in the
server's configuration...

(be sure to see the NOTE below for other info)

in the following example, (apache web server), if your
machine's ip was 10.10.0.7, you would get the
"403 forbidden" message if you tried to access
a logon screen in the "c:\LogonDocs" directory...

http://exchange.x.com/exchange/LogonDocs/Login.html

inside an httpd.conf file in apache would look
something like this:
(angle brackets replaced with square brackets)

[Directory "c:/LogonDocs/"]
order allow,deny
allow from exchange.x.com
allow from 10.10.0.3
allow from 10.10.0.5
[/Directory]

corrected, it'd look like this:

[Directory "c:/LogonDocs/"]
order allow,deny
allow from exchange.x.com
allow from 10.10.0.3
allow from 10.10.0.5
allow from 10.10.0.7
# or
# allow from all
[/Directory]

===========
NOTE:
===========
you might also see this if you are typing in the
remote machine's name in the address bar of a window,
in which case it'll attempt to connect to that
machine's default http port rather than opening
a folder via the file system...

...maybe, unless i'm all wet
and standing in left field... :-)