Capsule Workspace Oauth

[Lars_de_Mooy]

Hi all,

We used Capsule Workspace for business mail for many years, the best advantage is that you only have to allow a connection from the public IP to exchange online and you can block all the rest. Capsule is making a connection to the remote access gateway and the remote access gateway makes a session to ExO.

Now last week Microsoft finaly depricated basic auth in ExO that Capsule needs to connect.

The only way to make the connection again is to upgrade to R81.20 that had the Oauth for Capsule Workspace option.

We upgraded our environment and configured the enterprise app in Azure and made all the configs on the mobile asscess GW on the checkpioint side. The problem is that the authentication to the Mobile access GW is all fine but the authentication to Azure Oauth ends up with a 401 error. I spended last week to troubleshoot and created all the relevant logging.

Is there anyone that have this setup working that may faced the same issues and was able to fix them ?

I am at the end of my knowlage and need this to work asap.

Hope someone has some good tips to get us in the right track.

Best rgrds Lrs

[Lars_de_Mooy]

can you please post your finings so i can see what could be possible wrong in my config ?

[Lars_de_Mooy]

Hi Phoneboy,

the Oauth is working but i dont see any e-mails the client logs attached

09.02 10:13:59 ║ERROR║ ║BMCDSTACK║ <RequiredFoldersMappingOperation (122): 0x2827d0980> -[LoadFoldersInformationOperation beginAsyncProcess]_block_invoke_4 RequiredFoldersMappingOperation failed: Error Domain=SyncCPConnectionErrorDomain Code=5 "(null)" UserInfo={ErrorMessageKey=Error Domain=NSURLErrorDomain Code=-1 "(null)", StatusCodeKey=403}

09.02 10:13:59 ║INFO║ <RequiredFoldersMappingOperation (122): 0x2827d0980> -[AsyncOperation completeAsyncProcess] Ending

09.02 10:13:59 ║ERROR║ ║BMCDSTACK║ <0x282870b40> -[LoadFoldersInformationOperation completeAsyncProcess] Operation failed: Error Domain=SyncCPConnectionErrorDomain Code=5 "(null)" UserInfo={ErrorMessageKey=Error Domain=NSURLErrorDomain Code=-1 "(null)", StatusCodeKey=403}

[PhoneBoy]

Unfortunately, there's not enough there for me to suggest.
TAC has suggested some other debugs that we'll probably need.
I'm also checking with R&D to see what they suggest here.

[Lars_de_Mooy]

Yes today i have generated all the requested logs again with the new situation that the oauth is working but no emails showing. I would really appriciate if you can please check that for me.

[Spectrumtech_MS]

Lars,

Apologies for the delay.

Our client had a similar environment to yours where custom domain is used to log into M365 rather than the *.onmicrosoft.com.

While OATH is working (when OATH is configured correctly using the onmicrosoft.com domain), Capsule failed to retrieve email or log into Exchange Online.

We have worked around it by having users logged in, directly, to M365. See screenshots attached. Users are prompted to login to M365 (once) and following sessions used the locally cached credentials. Of course if the password changes, they will be prompted to log in again.

[Lars_de_Mooy]

Hi thanks for the reply i dont know what you mean.

If Oauth is working correctly as in my case the user gets prompted in the login process of capsule to login to exchange online.

This process is working good.

What do you mean by "having users logged in, directly, to M365" ?

[Lars_de_Mooy]

Ok i think i understand by setting the setting in the first screenshot SSO_config you force the users to login to o365.

If they login there are they using their custom domain UPN email address or the onmicrosoft.com one ?

[Spectrumtech_MS]

UPN uses the custom domain name not “@onmicrosoft.com”

[Lars_de_Mooy]

I am totally lost here.

This is what the engineer just wrote on TAC.

How can you think of changing all users their upn's

Hi Lars,

I understand the situation, however, having a different suffix is not supported. Per sk103721:

The account's 'E-mail' field must be in the form of:

username@myofficeaccount.onmicrosoft.com

(According to the username and domain name specified in the Office 365 account)

Alternatively, you may configure internal users (on the Smart Console) whose username is in the form of:

username@myofficeaccount.onmicrosoft.com

Hope this answers your question.

Best regards,

[Lars_de_Mooy]

Hi our problem was related to the way capsule is working after the upgrade from basicauthentication to Oauth.

Capsule is now setting up the connection to EWS directly and not with the firewall in between like it did with basic auhentication.

We are not allowed to allow connections from the public network to EWS and thats the reason we bought capsule lics.

With basic authtication enabled only the firewall needs access to EWS to read te mailboxes.

Now Oauth is introduces Capsule needs to make a direct connection to EWS after authentication so no way we can use the product anymore because than we need to allow EWS from all public network.

Tnx for the attention