Exchange must have forms-based authentication enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259647	EX19-MB-000008	SV-259647r960759_rule		Medium

Description
Identification and Authentication provide the foundation for access control. Access to email services applications in the DOD requires authentication using DOD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based logon should be used by the OWA website. Because the DOD requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other preauthenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled. If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.

Description

Identification and Authentication provide the foundation for access control. Access to email services applications in the DOD requires authentication using DOD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based logon should be used by the OWA website. Because the DOD requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other preauthenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled. If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.

STIG	Date
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-63386r942253_chk )
Open the Exchange Management Shell and enter the following command: Get-OwaVirtualDirectory \| Select-Object -Property ServerName, Name, Identity, *Authentication If the value of "FormsAuthentication" is not set to "False", this is a finding.

Fix Text (F-63294r942254_fix)
Open the Exchange Management Shell and enter the following command: Set-OwaVirtualDirectory -Identity <'IdentityName'> -FormsAuthentication $false Note: must be in quotes. Example for the Identity Name: \owa (Default website) Restart the IIS service.