Forms-Based Authentication in OWA 2003

Exchange Server 2003 Outlook Web Access (OWA) supports forms-based authentication technology. Also known as cookie authentication, this feature circumvents the risks associated with the common human frailty of either forgetting to log off or not logging off correctly and the inherent problems with browsers caching user credentials. Because improper logoffs and cached user credentials can leave your systems vulnerable to unauthorized users, many companies have been reluctant to enable OWA. With the instructions I provide here, you can enable forms-based authentication for your OWA deployment and reduce the security risks associated with such a deployment.

The Problem
OWA is a Web-based application that uses HTTP to let client browsers communicate with Exchange. OWA encapsulates requests and responses in HTTP messages, which, in their simplest form, consist of three parts: the type of request or response, host headers that qualify the request or response, and the message body. The browser takes appropriate action—displaying the body of the message, redirecting to a different URL, or challenging the user for credentials before resending the request—according to the response the browser receives from the server. . . .