Outlook Web Access (OWA) mailbox name on Exchange 2003: OWA, Exchange, Outlook Web Access, IIS

Outlook Web Access (OWA) mailbox name on Exchange 2003

We have Outlook Web Access set up on a Windows 2003 server running Exchange 2003. The default page for the OWA site is OWALogon.asp, which we have customized to show our company logos, instructions for usage, etc. The default page also has two controls: a text box into which the user enters their mailbox name; and an OK button they click after entering their mailbox name. After the user submits the form, they are prompted for their domain credentials. After entering credentials, their mailbox is displayed.

During a recent addition of a user to our domain and testing of this user's OWA access, we noticed that we can enter anything we want into the mailbox name field and as long as the domain credentials are correct, the user is passed into their mailbox. For example, if the user's mailbox name is 'JDoe' and his domain account is 'JohnD', I can enter whatever I want into the mailbox name as long as I log in as JohnD. After I log in, mailbox JDoe is displayed.

In looking at this, we've noticed that the JavaScript in the page, shown below, only checks to ensure that the mailbox name is not blank. If blank, the page reloads. If not blank, the domain credentials dialog box is displayed. In essence, it appears that the mailbox simply isn't required and IIS resolves the username/password to the correct mailbox after the domain credentials are submitted.

Can anyone tell us if:
1) This is normal behavior; ie, the requirement of data entry into the mailbox name serves only as a weak security measure, supposedly to further deter unauthorized access?
2) OWALogon.asp is missing code that checks for a valid mailbox name?
3) We're possible missing a server update or have something configured incorrectly?

Please let us know if further information is required to diagnose the issue. Thanks.

<%
mailbox = Request("mailbox")
If mailbox <> "" Then
    Response.Redirect "/Exchange/" & mailbox
Else
%>
 
<HEAD>
<script language="JavaScript">
<!--
function MM_popupMsg(msg) { //v1.0
  alert(msg);
}
//-->
</script>
</HEAD>
 
<BODY onLoad="MM_popupMsg('BOILERPLATE SECURITY WARNING')">
 
<table width="95%" cellspacing="2" cellpadding="2" border="0">
<tr>
<td>
<form action='OWALogon.asp'>
<div align="center">
<IMG src="logos.gif" width="400" height="63"><BR>
</div>
 <H1 align="center"><font face="Arial, Helvetica, sans-serif">Outlook Web Access</font></H1>
<div align="center">
<font face="Arial, Helvetica, sans-serif"><b>Mailbox Name:</b></font>
<input name='mailbox'>
<input type='submit' value='OK'>
</div>
</form>
 
<%
End If
%>

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:

Select all Open in new window

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Question

Outlook Web Access (OWA) mailbox name on Exchange 2003

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

OWA

Exchange