Ever go through the trouble of modifying OWA so that when users click Logoff, they're also logged out of the Secure Access (IVE)session? And, then the Exchange folks upgrade and poof, you're work is gone. Now you have to negotiate time with Exchange folks, again, to work your magic. You can take the Exchange folks (and others) out of the equation by using the IVE Single Sign-On feature to accomplish the logout. While it's not quite as nice, this method is very effective. I use it for OWA, Sharepoint and other rewritten web apps. Here are example steps for OWA:
Note: These steps assume that you already have OWA working through your Secure Access appliance. Some of the steps may be different depending on your environment (versions, load balancing, DNS, etc).
1. Go to Resource Policies --> Web --> Selective Rewriting and create a new policy.
2. Name the policy whatever you like. I named mine "Don't rewrite IVE".
3. In the Resources field, enter "https://", the external hostname (FQDN) of your IVE, and ":443/*". For example: https://webmail.company-x.com:443/*
4. Apply the policy to the your OWA role.
5. Choose the "Don't rewrite content: Redirect to target web server" action.
6. Click the Save Changes button.
7. Next, go to Resource Policies --> Web --> SSO Form Post and create a new policy.
8. Again, name the policy whatever you like. I named mine "OWA Single Sign-Off".
9. In the Resource field, enter the URL to your OWA logoff page. You can logon to your internal OWA URL and click logoff to discover the URL. Mine looks like https://exchangefe.company-x.net:443/exchweb/bin/USA/logoff.asp.
10. Apply the policy to the your OWA role.
11. Choose the "Perform the POST defined below" action.
12. In the POST to URL field, enter the URL of you IVE logout page. For example: https://webmail.company-x.com/dana-na/auth/logout.cgi.
13. Click Save Changes.
14. Try it out.
Now when someone clicks the Logoff button in OWA, the IVE will see the OWA logoff URL as a Single Sign-On resource and Post to the IVE logout URL. Tada! IVE session logged out!
The downside to using this "feature" is that the internal session may not be logged out because the IVE is intercepting. But, most of these web apps have a session time-out. And, I'd rather have a internal session unresolved than an external session...
Message Edited by Russ on 10-20-2009 01:51 PM
