Authorization for the OWA Add-in on Exchange Server 2003

Category: Installing and upgrading
Date: May 2009
Product: Exchange Server Archiver

If you are using Exchange Server 2003 and you install the UAA Service on a different computer from the Exchange server, to use the OWA Add-in you must allow delegation of credentials to the UAA Service.

This is because the UAA Service requires the identity of the user who is attempting to access the message in order to authorize access to the archived mailbox.

Allowing delegation of credentials to the UAA Service

You are recommended to raise the functional level of the domain to Windows Server 2003 (or higher), and then constrain the delegation to calling the HTTP service on the UAA Service computer.

If you do not want to raise the functional level, you can set up the Exchange server to be trusted for delegation to any service; however this is not recommended.

To configure the Exchange server to be trusted for delegation to the HTTP service on the UAA Service computer:

On the Domain Controller, open Active Directory Users and Computers.
Right-click the domain, and then click Raise Domain Functional Level.
Under Select an available domain functional level, select Windows Server 2003.
Click Raise.
Navigate to the name of the computer on which Exchange Server is installed.
Right-click the name, and then click Properties.
On the Delegation tab, select Trust this computer for delegation to specified services only, and Use any authentication protocol.
Click Add.
Specify the name of the UAA Service computer and click OK.
In the Add Services dialog box, from the list of Available Services, select http and click OK.
On the Properties dialog box, click OK.