Return
-
Title
How to ensure a user session is logged out when using the Defender version of Cloud Access Manager with OWA -
Description
When using the Defender version of Cloud Access Manager, how can you ensure the session is logged out, even if the user does not close their browser. -
Cause
Users may forget to log out of their Cloud Access Manager session or close the browser.
This could allow another user to log in using their details. -
Resolution
RESOLUTION 1:
Configure a load balancer in front of the Cloud Access Manager proxy server to redirect to the following URL when the Cloud Access Manager proxied OWA logged-out page is rendered: https://proxy-hostname/?EndWebSession
(change proxy-hostname to your specific proxy name)This URL triggers the Cloud Access Manager logout sequence killing all session cookies.
Here is an example of the log out URL for OWA 2010:
https://CAM Proxy App URL/owa/auth/logoff.aspx?Cmd=logoff&src=exchThe load balancer would be configured to look for this URL and then redirect to the Cloud Access Manager kill session URL.
RESOLUTION 2:Edit the OWA logoff.aspx and configure it to redirect to the Cloud Access Manager logout URL.
For example, on the logoff.aspx add the following lines to get the redirection:
window.navigate('HYPERLINK "https:///"https://proxy-hostname/?EndWebSession') Owa.ExecCommand.execute(document, "ClearAuthenticationCache", false);The logoff.aspx file should be in a directory similar to:
%ProgramFiles%\Microsoft\Exchange Server\V14\ClientAccess\Owa\authThe Exchange Administrator will be able to confirm the exact location of the logoff.aspx file.