How To: Clear the FedAuth Cookie on OWA/ECP Logout (Exchange 2013 and 2016)

Version Affected: Exchange 2013 — all SecureAuth Identity Provider (IdP) versions. Exchange 2016 — SecureAuth IdP 9.2 and later.

 

Overview

This article explains how to configure an Internet Information Services (IIS) URL Rewrite rule on the Exchange Client Access Server (CAS) so that logging out of Outlook Web App (OWA) or the Exchange Control Panel (ECP) fully clears the SecureAuth WS-Federation (WS-Fed) session. Without this rule, Exchange does not clear the FedAuth cookie that SecureAuth sets during sign-in, so a user who signs out of OWA or ECP remains authenticated to SecureAuth even though Exchange itself has signed them out.

The steps are the same for Exchange 2013 and Exchange 2016, except for the URL pattern used in step 6 below.

In this article

• Configure the OWA URL Rewrite Rule
• Configure the ECP URL Rewrite Rule

Configure the OWA URL Rewrite Rule

1. On the Exchange CAS, open IIS Manager.
2. Navigate to the OWA site within IIS.
3. In the Features View, click URL Rewrite.
4. Add a new blank incoming rule.
5. Name the rule — for example, OWA logout.
6. Set the pattern to \b(logon.aspx)\b on Exchange 2013, or \b(logoff.owa)\b on Exchange 2016.
7. Set the Action Type to Redirect.
   
   
   
   
   
8. Set the Redirect URL to:
   https://<exchange-server>/owa/?wa=wsignoutcleanup1.0&wreply=https://<secureauth-idp>/<realm>/restart.aspx
   
   Replace <exchange-server> with the hostname of your OWA server, and <secureauth-idp>/<realm> with the hostname and realm number of your SecureAuth IdP.

Configure the ECP URL Rewrite Rule

Repeat the same rule on the ECP site so that signing out of ECP also clears the session.

1. On the Exchange CAS, open IIS Manager.
2. Navigate to the ECP site within IIS.
3. In the Features View, click URL Rewrite.
4. Add a new blank incoming rule.
5. Name the rule — for example, ECP logout.
6. Set the pattern to \b(logon.aspx)\b on Exchange 2013, or \b(logoff.owa)\b on Exchange 2016.
7. Set the Action Type to Redirect.
8. Set the Redirect URL to:
   https://<exchange-server>/ecp/?wa=wsignoutcleanup1.0&wreply=https://<secureauth-idp>/<realm>/restart.aspx
   
   using the same <exchange-server> and <secureauth-idp>/<realm> values as the OWA rule.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.