How to Configure Access Control (AAA)

Step 1. Configure Kerberos Authentication on the Barracuda Load Balancer ADC

Ensure that you have already configured the Kerberos Authentication service. For instructions, see How to Integrate an External Authentication Server.

Step 2. Configure your SharePoint Servers 

1. Navigate to your SharePoint Web Admin Site > Web Applications > Authentication Providers.

2. Select the Enable Windows Authentication check box.

3. Select the Integrated Windows authentication check box and then select Negotiate (Kerberos).
   
    

Step 3. Assign Kerberos Authentication Service to the SharePoint Service

1. Go to the ACCESS CONTROL > Authentication page.

2. Next to the service, click Edit. 

3. In the Edit Authentication Policy section:

   1. Set the Status to On.

   2. From the Authentication Service list, select the alias of the Kerberos service you created in Step 1.

4. Click Save.

Step 4. Configure an Authorization Policy for the SharePoint Service

Configure an authorization policy to control the access of authenticated users to your SharePoint Application. You can configure access by user, group, or both user and group. In the policy, specify the URL, host, and extended match patterns for requests that must be handled by the policy.

1. Go to the ACCESS CONTROL > Authorization page. 

2. In the Add Authorization Policy section, click Add. The authorization policy appears in the Existing Authorization Policies section.

   1. From the Service list, select the SharePoint service.
   2. Enter a name for the policy.
   3. Set the Status to On.
   4. Specify the URL, host, and other expressions that must match requests.

   5. Specify the Login Method. If you want to create a custom login or challenge page, select HTML Form.

3. Next to the policy, click Edit.

4. In the Edit Authorization Policy window, specify if you want to allow or deny the request to all authenticated users or only to specific users and groups.

5. Set Send Basic Authentication to On.

6. Click Save.

Step 5. Verify your Setup

1. Navigate to your SharePoint site via the FQDN of your VIP address. 

2. After the Barracuda Load Balancer ADC authentication page loads, enter the user credentials of a user account that has access to the SharePoint Application.

Step 1. Configure LDAP Authentication on the Barracuda Load Balancer ADC

Ensure that you have already configured the LDAP authentication service. For instructions, see How to Integrate an External Authentication Server.

Step 2. Configure your Exchange 2013 Servers

1. Navigate to the Exchange Control Panel at https://<fqdn of CAS>/ecp.

2. Click Servers > Virtual Directories.

   

3. Click the first OWA page for one of the servers and click the edit icon.

   

4. Click authentication. 

5. Click Use one or more standard authentication methods, and then select the Integrated Windows Authentication and Basic Authentication check boxes.

6. Repeat steps 1 to 5 for the other OWA site on the other CAS as well as the ECP pages on your other CAS. 

7. Go back to SERVERS > SERVERS, and edit one of the CAS.

8. Click Outlook Anywhere.

   

    

9. Verify the internal and external host name settings and then click Allow SSL Offloading. 

10. Repeat for the other CAS.

11. Next, open the Exchange Management Shell on your CAS and run the following commands.
    Get-OutlookAnywhere -Server <ServerName> -ADPropertiesOnly | Set-OutlookAnywhere -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods Basic, Ntlm
     

    

12. Reset the IIS to ensure that the changes are applied.

    

Step 3. Assign LDAP Authentication Service to the Exchange 2013 Service

1. Go to the ACCESS CONTROL > Authentication page.

2. Next to the service, click Edit. 

3. In the Edit Authentication Policy section, click Save.

   1. Set the Status to On.

   2. From the Authentication Service list, select the alias of the LDAP service you created in Step 1.

   3. (Optional) S pecify the URL where users are redirected if their authentication fails because their passwords expired in the Auth Password Expired URL. Users are redirected to reset their passwords. 

Step 4. Configure an Authorization Policy for the Exchange 2013 Service

Configure an authorization policy to control the access of authenticated users to your Exchange OWA. You can configure access by user and/or group. In the policy, specify the URL, host, and extended match patterns for requests that must be handled by the policy.

1. Go to the ACCESS CONTROL > Authorization page. 

2. In the Add Authorization Policy section:Click Add. The authorization policy appears in the Existing Authorization Policies section.

   1. From the Service list, select the Exchange 2013 service.
   2. Enter a name for the policy.
   3. Set the Status to On.

   4. Specify the URL, host, and other expressions that must match requests.

      If you specify "/* " as the URL match, add the following Authorization Policies with the specified URL match and set the Status to Off:

      • /Microsoft-Server-ActiveSync*
      • /rpc/rpcproxy.dll
      • /autodiscover/autodiscover.xml 

      As an alternative to setting /* as the URL match and adding the other "Off" policies, you can specify policies for individual pages you want users to authenicate on before accessing the server, such as the OWA (Outlook Web Access) or ECP (Exchange Control Panel) pages.

      You can create the following Authorization Policies with the Status set to On:

      • /owa*
      • /ecp*

   5. Specify the Login Method. If you want to create a custom login or challenge page, select HTML Form.

3. Next to the policy, click Edit.

4. In the Edit Authorization Policy window, specify if you want to allow or deny the request to all authenticated users or only to specific users and groups.

   1. Set Send Basic Authentication to On.

5. Click Save .

  Step 5. Verify your Setup

1. Go to: https://<FQDN of your Exchange 2013 VIP Address>/owa

2. After the Barracuda Load Balancer ADC authentication page loads, enter the user credentials of a user account that has access to OWA. 

Step 1. Configure LDAP or Kerberos Authentication on the Barracuda Load Balancer ADC

Ensure that you have already configured the LDAP or Kerberos authentication service. For instructions, see How to Integrate an External Authentication Server.

Step 2. Configure your Exchange 2010 Servers

1. Open the Internet Information Services (IIS) Manager.
2. In the left pane, find and select the site that you are modifying.
3. In Features View for the selected site, double-click Authentication.
   
4. On the Authentications page, select Windows Authentication.
5. In the Actions pane, click Enable to use Windows authentication. The status for Windows Authentication then changes to Enabled.
   
6. Open the Exchange Management Console.
   
7. In the console tree, locate the virtual directory that you want to use Integrated Windows authentication.
8. Select Server Configuration and then select Client Access.
9. For each server hosting the Outlook Web App virtual directory:
   1. Select the server and click the Outlook Web App tab.
      
   2. In the work pane, select the virtual directory that you want to configure to use Integrated Windows authentication, and click Properties in the Actions pane.
   3. In the Properties window, click the Authentication tab.
   4. Click Use one or more standard authentication methods, and select the Integrated Windows authentication check box.
      
10. Click OK.
11. Restart the IIS for each server that you configured to use integrated Windows authentication.

Step 3. Assign LDAP Authentication Service to the Exchange 2010 Service

1. Go to the ACCESS CONTROL > Authentication page.

2. Next to the service, click Edit. 

3. In the Edit Authentication Policy section, click Save.

   1. Set the Status to On.

   2. From the Authentication Service list, select the alias of the LDAP service you created in Step 1.

   3. (Optional) Specify the URL where users are redirected if their authentication fails because their passwords expired in the Auth Password Expired URL. Users are redirected to reset their passwords. 

Step 4. Configure an Authorization Policy for the Exchange 2010 Service

Configure an authorization policy to control the access of authenticated users to your Exchange OWA. You can configure access by user, group, or both user and group. In the policy, specify the URL, host, and extended match patterns for requests that must be handled by the policy.

1. Go to the ACCESS CONTROL > Authorization page. 

2. In the Add Authorization Policy section, click Add. The authorization policy appears in the Existing Authorization Policies section.

   1. From the Service list, select the Exchange 2010 Service
   2. Enter a name for the policy.
   3. Set the Status to On.
   4. Specify the URL, host, and other expressions that must match requests.

   5. Specify the Login Method. If you want to create a custom login or challenge page, select HTML Form.

3. Next to the policy, click Edit.

4. In the Edit Authorization Policy window, specify if you want to allow or deny the request to all authenticated users or only to specific users and groups.

5. Click Save.

Step 5. Verify Your Setup

1. Go to: https://<FQDN of your Exchange 2010 VIP Address>/owa

2. After the Barracuda Load Balancer ADC authentication page loads, enter the user credentials of a user account that has access to OWA.

1. In the IIS Manager, click Application Pools in the left pane. All running applications then appear in the right pane.
   
2. Identify the application to associate with the user. Right-click the application, and select Advanced Settings.
3. In the Advanced Settings window, click the button next to Identity.
   
4. In the Application Pool Identity window, select Custom account and click Set. 
5. Enter the username and password for the user that you created in Active Directory, and click OK.
   

6. In the IIS server's Applicationhost.config file, set useAppPoolCredential to true. The file is located at:
   /windows/system32/inetsrv/config/Applicationhost.config

   For example:

   <location path="Default Web Site"> 
   <system.webServer> 
   <security> 
   <authentication> 
   <anonymousAuthentication enabled="false" /> 
   <windowsAuthentication enabled="true" useKernelMode="true" useAppPoolCredentials="true"> 
   <extendedProtection tokenChecking="None" /> 
   </windowsAuthentication> 
   </authentication> 
   </security> 
   </system.webServer> 
   </location>

Step 1. Configure LDAP Authentication on the Barracuda Load Balancer ADC

1. Go to the ACCESS CONTROL > Authentication Services page, and click the LDAP tab.
2. In the settings, specify the following:
   • Alias for the IBM Domino LDAP server
   • IP address and port of the server
   • Base DN: O= <Organization Name>
   • Administrator account credentials for Bind DN (Username) and Bind Password
   • Login Attribute: uid
3. Click Test LDAP to verify that a connection can be established with the LDAP server. The test results display at the bottom of the page. If the test fails, re-enter and re-test the LDAP settings.
4. Click LDAP Discovery to verify that users can be found with the attributes and filters that you entered. If you want to view detailed query results, select the Verbose check box. In the test results:
   • A green dot means the information has been verified

   • A red dot means the information needs to be corrected

     Although a red dot is displayed next to Base DN, it can be ignored. Click Add.

5. If any information is incorrect or missing, edit the field and click LDAP Discovery.
6. After your settings have been validated, click Add. 

The LDAP service appears in the Existing Authentication Services section.

Step 2. Configure your IBM Domino Servers 

Ensure that HTTP basic authentication is enabled on your IBM Domino servers. For higher security, enable SSL on your servers so that your authentication information is not sent in clear text.

Step 3. Assign LDAP Authentication Service to the IBM Domino Service

1. Go to the ACCESS CONTROL > Authentication page.

2. Next to the service, click Edit. 

3. In the Edit Authentication Policy section, click Save.

   1. Set the Status to On.

   2. From the Authentication Service list, select the alias for the LDAP service that you created in Step 1.

Step 4. Configure an Authorization Policy for the IBM Domino Service

Configure an authorization policy to control the access of authenticated users to your IBM Domino iNotes site. You can configure access by user, group, or both the user and group. In the policy, specify the URL, host, and extended match patterns for requests that must be handled by the policy.

1. Go to the ACCESS CONTROL > Authorization page. 

2. In the Add Authorization Policy section, click Add. The authorization policy appears in the Existing Authorization Policies section.

   1. From the Service list, select the IBM Domino service.
   2. Enter a name for the policy.
   3. Set the Status to On.
   4. Specify the URL, host, and other expressions that must match requests.

   5. Specify the Login Method. If you want to create a custom login or challenge page, select HTML Form.

3. Next to the policy, click Edit.

4. In the Edit Authorization Policy window, specify if you want to allow or deny the request to all authenticated users or only to specific users and groups.

5. Set Send Basic Authentication to On.

6. Click Save.

Step 5. Verify your Setup

1. Go to: https://<FQDN of your IBM Domino VIP Address>/webadmin

2. After the Barracuda Load Balancer ADC authentication page loads, enter the user credentials of a user account that has access to web admin site.