HOW TO Troubleshoot iPhone to Exchange 2003 authentication failure

Thanks for the post.

I'm going to test the "Alias" issue tomorrow.  I will post back if that is the resolution.

I have read and verified setup using the docs from Apple.

Good tips on the MS articles.  I did test:

1. Form based authentication - both on and off, and w/high compression - no joy.
2. I've tested with both required and not required for the SSL config on the virtual dirs...

Still hoping someone can help me understand the logging of theses "authentication failures" on the Exchange side.

Thanks,
Tim

You shouldn't need to use IMAP for the iphone to work with Exchange.

Can you check your IIS settings against these: http://support.microsoft.com/default.aspx/kb/937635

The domain login name issue you talk about is only relevant if using IMAP or POP3 not Active-Sync

Check all the IIS settings here: http://support.microsoft.com/kb/937635

Make sure you are running Exchange Server Services Pack 2 you can download it from here: http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=535BEF85-3096-45F8-AA43-60F1F58B3C40&displaylang=en
If you are running Small Business Server 2003 then you need to ensure that you have SP2 for Exchange along with SP2 for Windows and SP1 for SBS: http://www.microsoft.com/windowsserver2003/sbs/downloads/sp1/default.mspx

Download the free tool from the appstore ActiveSync Test onto the iphone and run it with the settings you are entering in the configuration section, this will provide a detailed report on what needs to be done.

If you can upload this than that would be great.

Hi,

From what I can see you are not using IMAP at all.. You are using Exchange active sync.

Can you confirm that they iPhone is syncing on an internal wireless but not external via a celluar network.

If this is the case then can you confirm that iPhone can actually access the internet through the celluar network.. Just by surfing in Safari should do it..

Just for fun, can you post the testexchangeconnectivity.com test results as this could help..

Update.

1.  I've checked permissions again in IIS - they are correct - no joy.
2. I used the ActiveSync Tester app on the iphone and I'm getting back this error:

ActiveSync is not availible.  (ActiveSync detected, but access is denied.  [HTTP 403: Disable for this user]).

So I checked to make sure ActiveSync is enabled via ESM and AD.  It looks good from the server.

I can sync perfectly on the local wireless by specifying the internal ip addy of the server.  Does this verify ActiveSync is okay and I'm still at a authentication issue.

In regards to the other test at the test connectivity site - I have a pass on everything except the certificate chain - I'm using self-signed.

Thanks for the input,

Tim

What firewall do you have in place?

Is there any specific rules for OWA access? If yes then you need to make the same rule for Microsoft-Server-ActiveSync as well.

Also I would suggest, running a test for Exchange ActiveSync at http://testexchangeconnectivity.com and posting the results over here.

Also in ADUC, go to user properties --> Exchange Features
Check if you have anything disabled for this user.

Do you have OWA working on the same box?

If so then I suggest that you try accesing to with safari from the iPhone and see if that works.

This will confirm connectivity with the excahnge server...

Hmm.... could have helped if you would have provided 403.6 the first time itself. ;-)

"I've tested using https://testexchangeconnectivity.com/ , all test pass with exception of the "trust chain" (I have no problem w/that and have this phone working against another SBS 2003 box w/a signed cert.)"
- I am still not sure how did you pass this test with the IP address restriction in place.


" I need to make sure I didn't open up a security hole by doing this to the default web site."
- AFAIK, If you have IP address restriction in place in IIS, then the issue you faced will resurface time and again. You cannot possibly map all the IP addresses and keep them 'allowed' on the restriction tab.
From what I have seen, there is no major concern if you have no restrictions on the Default Web Site. Infact 99% people will be running default web site without any IP restrictions in IIS atleast.
For Security purpose you can check your firewall settings. That would be a better place if you would like to secure access to the server.

The strange thing is I never seen the 403.6 error (ip address restriction) until I ran the exchange connectivity test for the last time.  All previous tests before were coming back as "pass" w/exception of the certificate chain.  The only thing I did different when running the final test was to check the box to "Ignore trust for SSL"...perhaps this allowed the connectivity test to run completely..??

Anyway, I should have picked up on this right away - but I have to say I'm no fan of how IIS enforces security...

Thanks for the input.

Tim