Configuring Single Sign-On for Microsoft Exchange 2010

Last published : Sep 03, 2026
The following section describes the configuration of Single Sign-On (SSO) for Microsoft Exchange 2010 on NetScaler Gateway. The SSO for Outlook Web Access (OWA) 2010 does not work in the following conditions:
  • Using the forms based authentication on Microsoft Exchange 2010.
  • Load balancing virtual server with authentication, authorization, and auditing traffic management policy.
Note: This configuration works only for load balancing virtual server with authentication, authorization, and auditing traffic management policy. It does not work for SSO in OWA 2010 with clientless VPN.
The following steps are prerequisites that you must consider before configuring SSO for Microsoft Exchange 2010 on NetScaler Gateway.
  • The Action URL for SSO form is different in OWA 2010. Modify the traffic management policy accordingly.
  • You require a rewrite policy to set the PBack cookie in the logon.aspx request. In normal scenarios, you set the PBack cookie at the client and click Submit.
  • When you are using SSO, the response to logon.aspx is consumed and the NetScaler Gateway generates the form request. The cookie is not attached in the form submission request.
  • The OWA server expects the PBack cookie in the form submission request. The rewrite policy is required to attach the PBack cookie in the form submission request.
Related information
Configuring Single Sign-On

Perform the following by using the CLI

  1. Configure the authentication, authorization, and auditing traffic management
    add tm formSSOAction OWA_Form_SSO_SSOPro -actionURL "/owa/auth.owa" -userField username -passwdField password -ssoSuccessRule "http.RES.SET_COOKIE.COOKIE(\"cadata\").VALUE(\"cadata\").LENGTH.GT(70" -responsesize 15000 -submitMethod POST
  2. Configure the traffic management policy and bind the policy
    • add tm trafficAction OWA_2010_Prof -appTimeout 1 -SSO ON -formSSO Action OWA_Form_SSO_SSOPro
    • add tm trafficPolicy owa2k10_pol "HTTP.REQ.URL.CONTAINS(\"owa/auth/logon.aspx\")" OWA_2010_Prof
    • bind tm global -policyName owa2k10_pol -priority 100

Rewrite configuration using CLI

At the command prompt, type:
  • add rewrite action set_pback_cookie insert_after "http.REQ.COOKIE.VALUE(\"OutlookSession\")" "\";PBack=0\"" -bypassSafetyCheck YES
  • add rewrite policy set_pback_cookie "http.REQ.URL.CONTAINS(\"logon.aspx\")" set_pback_cookie
  • bind rewrite global set_pback_cookie 100 END -type REQ_DEFAULT

Alternate rewrite configuration

In rare cases, the Microsoft Outlook might not issue OWA session cookies and the Pback cookies might also not get inserted. The issue might occur after you have run the preceding commands to implement the rewrite configuration.
To overcome such scenarios and as a workaround, you can configure the following commands instead of the rewrite configuration.
At the command prompt, type:
  • add rewrite action set_pback_cookie insert_http_header "Cookie" '"PBack=0"'
  • add rewrite policy set_pback_cookie "http.REQ.URL.CONTAINS(\"logon.aspx\")" set_pback_cookie
  • set rewrite policy set_pback_cookie -action set_pback_cookie
  • bind rewrite global set_pback_cookie 100 END -type REQ_DEFAULT