Exchange Owa 集成第三方认证

Pastore Antonio | 26 6 月, 2025

官方说明：

https://learn.microsoft.com/zh-cn/exchange/plan-and-deploy/post-installation-tasks/enable-modern-auth-in-exchange-server-on-premises

配置Exchange Server以使用混合新式身份验证 – Microsoft 365 Enterprise | Microsoft Learn

案例1：Outlook Web Access Single Sign-On (SSO) | On-premises Exchange OWA SSO

Outlook Web Access (OWA) SSO (Single Sign-On) solution by miniOrange provides seamless SSO to your Outlook Web Access (OWA) Application and on-premises Exchange server for secure SSO login. With miniOrange’s OWA SSO configuration, your users will be able to login to Outlook Web Access (OWA) and other SaaS or on-premises applications with your existing IDP credentials. miniOrange’s Outlook web access SSO provides IDP integration with ADFS, Okta, Onelogin, Microsoft Azure Active Directory, AWS Cognito etc. You can also connect miniOrange’s solution with Active Directory, LDAP, Google or use miniOrange as your directory in the cloud. We support multiple protocols like SAML,OAuth, LDAP, OIDC etc.

miniOrange and Outlook Web Access (OWA) Single Sign-On (SSO) integration supports the following features:

SP (Service Provider) Initiated Single Sign-On (SSO)
IdP (Identity Provider) Initiated Single Sign-On (SSO)

Connect with External Source of Users

miniOrange provides user authentication from various external sources, which can be Directories (like ADFS, Microsoft Active Directory, OpenLDAP, AWS etc), Identity Providers (like Microsoft Entra ID, Okta, AWS), and many more. You can configure your existing directory/user store or add users in miniOrange.

Prerequisites

All plans are required to do the single sign-on (SSO) configuration.

Follow the step-by-step guide given below for Outlook Web Access (OWA) Single Sign-On (SSO)

1. Configure Exchange in miniOrange IdP

Login into miniOrange dashboard from the Admin Console.
Go to Apps and click on Add Application button.
In Choose Application Type click on Create App button in SAML/WS-FED application type.
In the next step, search for your application from the list, if your application is not found. Search for “custom” and you can set up your app via Custom WS-Fed App.
Enter the following information in the respective fields.
- Custom Application Name: Outlook Web access Owa
- WT-Realm: https://{owa-url} e.g. https://mail.example.com/owa
- Reply URL: https://{owa-url} e.g. https://mail.example.com/owa
- Set WS-Fed validity period: 300s
Under Attribute Mapping section, enter the following attributes as shown below:
Click on Save.

2. Configure Exchange / OWA for Sign-On using miniOrange

After saving the app, go to Apps and click on the icon ‘ ‘ >> Metadata against the app saved.
Select Show Metadata Details to reveal the details shown in the image below.
Copy the WS-Federation Reply URL and download the X.509 Certificate.
Add above certificate (obtained in above step) to the Trusted People store on the Exchange Server using the steps below:
- Got to Management Console. Open run dialog (Win + R) and type mmc and press enter.
- In Management Console, go to File > Add or Remove Snap-ins (Ctrl + M).
- Search for Certificates on the left side and press Add.
- In the Certificate Snap In window, select Computer account and press Next. Then select Local Computer and press Finish.
- You will see an entry for Certificates (Local Computer) in the right pane. Click OK to close the Add or Remove Snap-ins window.
- You will see a branch named Certificates created under Console Root. Expand the Certificates branch and select Trusted People.
- Right click on Trusted People > Find > Import and click on Next.
- Choose the location of the downloaded certificate file you created above and click on Next, again Next and Finish.
- You have successfully added a Signing Certificate to Trusted People. Now close Management Console and choose No on the Save data prompt.

Execute the commands below on the Exchange Server using the Exchange Management Shell.
In the below command, ##Base URL## is the exchange/OWA host. The command has both URLs: One ending in / and the other one which does not contain a trailing slash.
$uris=@("https://##Base URL##/owa/","https://##Base URL##/ecp/","https://##Base URL##/owa","https://##Base URL##/ecp")
In the below command, the ##miniOrange URL## is the WS-Federation Reply URL. The Cert Thumbprint is the SHA-1 thumbprint of the certificate you downloaded.Note: Make sure the certificate thumb print is in uppercase.
Set-OrganizationConfig -AdfsIssuer "##miniOrange URL##" -AdfsAudienceUris $uris -AdfsSignCertificateThumbprint ##Cert Thumbprint##
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false -OAuthAuthentication $false
# Restart w3svc and was net stop was /y net start w3svc

3. Test SSO Configuration

Login to your OWA account.
You will be redirected to miniOrange IdP Sign On page.
Enter your miniOrange login credential and click on Login. You will be automatically logged in to your account.

案例2：

如何在Exchange Server 2019中配置OAuth 2.0以使用第三方身份验证平台

在现代企业环境中，安全性和用户体验是至关重要的。Exchange Server 2019提供了对OAuth 2.0的支持，这使得企业可以使用第三方身份验证平台（如Okta、Auth0等）来增强安全性并简化用户登录体验。本文将详细介绍如何在Exchange Server 2019中配置OAuth 2.0以使用第三方身份验证平台。

1.准备工作

1.1 确保Exchange Server 2019版本
确保你的Exchange Server 2019至少是CU13或更高版本。你可以通过以下命令检查当前版本：

Get-ExchangeServer | Select-Object Name, Edition, AdminDisplayVersion

1.2 更新Exchange Server
确保Exchange Server已更新到最新版本，以支持OAuth 2.0和其他相关功能。你可以通过以下命令安装最新的累积更新（CU）：

Install-ExchangeUpdate -Path "C:\path\to\update\ExchangeServer2019-KBxxxxx-x64.exe"

1.3 选择第三方身份验证平台
选择一个支持OAuth 2.0的第三方身份验证平台，如Okta、Auth0等。这些平台提供了强大的身份验证和授权功能，可以显著增强你的Exchange Server的安全性。

2.配置第三方身份验证平台

2.1 创建Exchange Server应用程序
在第三方身份验证平台中创建一个新的应用程序，获取必要的配置信息，如客户端ID、密钥、授权端点、令牌端点等。

Okta示例

登录到Okta管理控制台。
创建一个新的应用程序，选择“Web”或“原生”应用程序类型。
配置应用程序的重定向URI、客户端ID和客户端密钥。
获取授权端点和令牌端点。

Auth0示例

登录到Auth0管理控制台。
创建一个新的应用程序，选择“Web”或“原生”应用程序类型。
配置应用程序的重定向URI、客户端ID和客户端密钥。
获取授权端点和令牌端点。

3.配置Exchange Server

3.1 启用OAuth身份验证
验证并启用Exchange Server 2019的虚拟目录（如EWS、OAB、Autodiscover、ActiveSync等）的OAuth身份验证。

Get-MapiVirtualDirectory | Format-List Server, *auth*
Get-WebServicesVirtualDirectory | Format-List Server, *auth*
Get-OabVirtualDirectory | Format-List Server, *auth*
Get-AutodiscoverVirtualDirectory | Format-List Server, *auth*
Get-ActiveSyncVirtualDirectory | Format-List Server, *auth*

如果需要启用OAuth身份验证，可以使用以下命令（以WebServicesVirtualDirectory为例）：

Set-WebServicesVirtualDirectory -Identity "ServerName\EWS (Default Web Site)" -OAuthAuthentication $true

3.2 配置身份验证服务器对象
在Exchange Server中创建新的身份验证服务器对象，将其添加到受信任颁发者的列表中。

New-AuthServer -Type OAuth -Name "MyOAuthServer" -AuthMetadataUrl https://<oauth server FQDN>/metadata

将创建的身份验证服务器设置为DefaultAuthorizationEndpoint：

Set-AuthServer -Identity "MyOAuthServer" -IsDefaultAuthorizationEndpoint $true

3.3 启用组织级别的OAuth 2.0客户端配置文件
在组织级别启用OAuth 2.0客户端配置文件，允许客户端使用OAuth 2.0进行身份验证。

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

3.4 创建身份验证策略
创建允许使用现代身份验证的身份验证策略，并为用户分配该策略。

New-AuthenticationPolicy -Name "Allow Modern Auth" -OAuth2ClientProfileEnabled $true
Set-User -Identity User -AuthenticationPolicy "Allow Modern Auth"

3.5 配置OWA虚拟目录
配置Exchange Server 2019的OWA虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-OwaVirtualDirectory -Identity "ServerName\owa (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

3.6 配置ECP虚拟目录
配置Exchange Server 2019的ECP虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-EcpVirtualDirectory -Identity "ServerName\ecp (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

3.7 配置EWS虚拟目录
配置Exchange Server 2019的EWS虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-WebServicesVirtualDirectory -Identity "ServerName\EWS (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

3.8 配置OAB虚拟目录
配置Exchange Server 2019的OAB虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-OabVirtualDirectory -Identity "ServerName\oab (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

3.9 配置Autodiscover虚拟目录
配置Exchange Server 2019的Autodiscover虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-AutodiscoverVirtualDirectory -Identity "ServerName\autodiscover (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

3.10 配置ActiveSync虚拟目录
配置Exchange Server 2019的ActiveSync虚拟目录，禁用其他身份验证方法，仅保留OAuth身份验证。

Set-ActiveSyncVirtualDirectory -Identity "ServerName\Microsoft-Server-ActiveSync (Default Web Site)" -OAuthAuthentication $true -BasicAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

4.测试与验证

4.1 测试单点登录功能
使用支持OAuth 2.0的客户端（如Outlook for Windows、iOS邮件应用等）连接到Exchange服务器，验证是否能够通过第三方身份验证平台进行单点登录。

4.2 检查日志与错误信息
查看Exchange服务器、客户端以及第三方身份验证平台的相关日志文件，检查是否存在错误信息或异常情况，确保系统稳定运行。

5.注意事项

5.1 确保第三方身份验证平台的安全性
选择信誉良好的第三方身份验证平台，并确保其符合相关的安全标准和合规要求。

5.2 测试不同客户端的兼容性
不同的客户端对OAuth 2.0的支持情况可能有所不同，建议在配置完成后，使用多种客户端进行测试，以确保所有客户端都能够正常进行身份验证和访问Exchange邮箱资源。

5.3 监控和维护
在完成配置后，需要定期监控Exchange Server和第三方身份验证平台的运行状态，及时发现并解决可能出现的问题。同时，关注Exchange Server和第三方身份验证平台提供商的更新和公告，及时应用相关的安全补丁和改进措施。

浏览量： 18