Some items can’t be deleted. They were either moved, already deleted, or access was denied
So this is my story about deleting emails from OWA J. The past and the future …
More than Two years ago my attack and defense team and I were supposed to provide a federation solution for one of the government departments. We chose ADFS (Active Directory Federation Services) which was in BETA2.
Our mission was to provide a solution to enable user from domain X to use its own credentials and access OWA from domain Y (without AD trust) and also provide SSO.
The main problem was that ADFS and OWA 2003 didn’t worked together and the interesting thing that we found out was that ADFS uses ISAPI Extension as does OWA. However the ADFS ISAPI extensions weren't designed to transfer credentials to another ISAPI extension so we developed HttpHandler that will act as proxy between two sites on the same IIS Server. Each site had its own ISAPI extension – it was against all odds!!! And it worked! We managed to provide SSO to OWA from domain X with credentials from domain Y!!!
But … we bumped into the following error while trying to delete emails
To make a long story short, the problem was the length of the URL that we forwarded from the proxy to the back-end web site
After more than two years, I had a very strategic project in one of the top insurance companies, and I bumped into this error again. This time the architecture was different, we had two reverse proxies that was installed in-front of the front-end exchange server
The first thing that I wanted to analyze is the difference between the request and the response when surfing directly to the OWA and through the reverse proxy
The printscressn below simulats not-working scenario traffic. You can see that after the “BDELETE” WEBDAV request (session 138) there is a “SEARCH” WEBDAV request (session 174) that is not suppose to be there
The printscressn below simulats working scenario traffic. You can see that after the “BDELETE” WEBDAV request (session 138) there is no “SEARCH” WEBDAV request as the first example
After debugging I identified the problem, in the response to the “BPROPPATCH” WEBDAV request I found HTTP/1.1 “502 Bad Gateway” instead of HTTP/1.1 200 response:
As usual I opened RFC 2616 and searched for “Bad Gateway” because I wasn't sure i remembered this part. This was my direction to the solution:
10.5.3 502 Bad Gateway
“The server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request.”
Once I was sure this was the problem I started debugging it from the configuration side. After I changed the host header on the second reverse proxy to the original host header I managed to delete emails
<DeviceZ>