Publishing Exchange 2007 OWA using NTLM with Forefront TMG?

Is there any benefit to making a separate rule for OWA in TMG so that NTLM can be used for authentication from the TMG server to the CAS?  This article suggests it when using ISA 2006, but I haven't been able to tell any difference and security shouldn't be an issue since we use SSL: http://www.isaserver.org/tutorials/Publishing-Exchange-2007-OWA-Exchange-ActiveSync-RPCHTTP-2006-ISA-Firewall-Part6.html 
mbrombAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
mbrombConnect With a Mentor Author Commented:
I'm just rereading the following MS articles.  I think it's making more sense to me now.

http://technet.microsoft.com/en-us/library/bb794751.aspx#AppendixD
http://technet.microsoft.com/en-us/library/bb232199(EXCHG.80).aspx
0
 
Keith AlabasterEnterprise ArchitectCommented:
Tom is as good a source of info on this subject as any - and, now that he works for Microsoft in the Forefront team - he is well worth listening to. If he is unsure of the reasoning - but states it needs doing - then it ceases to be a question of benefit and moves into the 'what screws up if I don't do it that way' territory.

Again - he states he is not sure why it has to be done and if he doesn't know, given his access to the developers, then I doubt we will be able to give a rationale for it either.



0
 
mbrombAuthor Commented:
Good Explanations in these articles
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows PowershellĀ® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
aymanqCommented:
No benefit at all

YOu will still have to use FBA from outside , and between ISA and CAS is SSL as you say so there is no extra security feature, the article was just to illustrate this ability
0
 
mbrombAuthor Commented:
Well, if TMG is handling the authentication for you, and it is using NTLM then I would think you would get the benefit of NTLM even if using froms-based.
0
 
Keith AlabasterEnterprise ArchitectCommented:
I see you have accepted your own answer so therefore no further input is required.
0
 
mbrombAuthor Commented:
I would be willing to talk to the moderators or do what I can to give away the points if my answer is incomplete.  the documents state the benefits, and it seems they apply with ISA or TMG when publishing Exchange, but if I've got that wrong then that's a better answer.  If using forms-based on the listener nullifies using NTLM for delegation I would like to know.
0
 
aymanqCommented:
I still beleive that using NTLM over SSL channel is same as using Basic authentication over SSL from security perspective.

You wont be required to enter your password again as ISA or TMG will use your password entered through FBA and use it against internal OWA VD.

The only thing I can see is if you didnt enable OWA Virtual Directory fro basic authentication "enabled by default" then you will need to use Integrated Windows Authentication delegation only.
0
 
mbrombAuthor Commented:
From a security perspective I agree, but I wanted to know the difference from a functional perspective.   According to the articles i posted above, there are additional functiona available using NTLM as the delegation auth.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.