Exchange Alternate Service Account (ASA) causing multiple prompts

Chaz 1 Reputation point
2020-08-24T15:30:07.21+00:00

Hello,

I followed an article kerberos-auth-for-load-balanced-client-access and it works great with SSO into OWA and all, no issues there. SPN's are added and created successfully however, I have began to notice NON domain joined clients that were working, are getting de-authenticated after about one hour and are always getting asked to re-enter credentials. Once they enter their credentials again, they will have access for about an hour or less and then they must enter username and password again.

I am also experiencing this on my Outlook App on Android. I am always having to enter my username/password again just to update my inbox, and its really annoying. Before configuring the ASA when users login their sessions were good to go all day

What can I do that Mobile devices and other NON domain joined clients dont have to keep entering their credentials?

Other info:

  • Server 2016
  • Exchange 2016 Version 15.1 (Build 1591.10)
  • Load balanced behind Citrix ADC
  • MAPI used for OA
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,331 questions
0 comments

8 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 141K Reputation points MVP
    2020-08-24T15:46:10.277+00:00

    I would look into your load balancer and start there.
    Load balanced behind Citrix ADC

    Thats usually where a timeout would be enforced.

    P.S. You are far behind on the CUs for Exchange. You should be at CU16/17.

  2. Lucas Liu-MSFT 6,161 Reputation points
    2020-08-25T07:21:43.917+00:00

    Hi Chaz,
    I agree with Andy.

    1. According to my research, the instability of load balanced may cause this kind of problem. It is recommended that you contact the supplier to check Load balanced.
    2. According to the research on the article you provided, if your internal users use it normally and external users can work normally after entering the correct credentials, I think the Kerberos authentication you configured is correct.
      In addition, please check the “Remember my credentials” when you enter your username and password. And you could check if there have any related error logs in the Event Viewer.
  3. Chaz 1 Reputation point
    2020-08-26T15:44:35+00:00

    My apologies guys, I have been able to gain better clarification on this. Please see notes below.

    Users using Outlook with MAPI over HTTP work just fine as long as they select "remember credentials" upon logging in. The only issue we are having is Mobile devices using the EAS service constantly have to login frequently. The EAS clients both internal/external have the same experience. The issue persists when bypassing the Load Balancer as well.

    0 comments
  4. Andy David - MVP 141K Reputation points MVP
    2020-08-26T16:03:06.107+00:00

    Hi @Chaz
    Ok this sounds like a different issue that got introduced. Kerberos auth is specific to Outlook clients, not ActiveSync

    Are you seeing heartbeat interval errors in the event logs similar to this?

    https://learn.microsoft.com/en-us/previous-versions/office/exchange-server-operations-management-pack-2010/ff360297(v=exchg.140)?redirectedfrom=MSDN

    Note:
    The default maximum heartbeat interval is 3,540 seconds (59 minutes).

    Are there any other network devices in front of the Exchange Servers? Typically you want those devices ( firewalls, load balancers etc) to have a heartbeat interval longer than Exchange is set to,.

    The hour session timeout matches up, so this may be the issue.

    0 comments
  5. Chaz 1 Reputation point
    2020-08-26T17:02:48.08+00:00

    Yes, that is exactly the error I am seeing. Is the mobile device not sending the heartbeats to exchange by chance? or is it possible the firewall or something else is cutting the session off early?