Understanding Front-End Servers

Balance OWA performance, security, and ease of use

Authentication
A traditional front-end server/back-end server deployment handles user authentication in one of two ways:

Pass-through authentication—The front-end server simply forwards the request to the back-end server, which performs the authentication.
Dual authentication—The front-end server authenticates the initial user request, then forwards the request to the appropriate back-end server, which authenticates the request again.

Because the front-end server needs to determine the user's identity to forward the request to the appropriate back-end server, pass-through authentication requires an explicit logon. I don't recommend pass-through authentication for OWA access. Pass-through authentication lets anonymous HTTP requests go directly to the back-end server, thus exposing your server to rogue HTTP requests and potential Denial of Service (DoS) attacks. Pass-through authentication is also less desirable than dual authentication because most OWA users prefer to type the simplest possible URL. Figure 3 shows an explicit logon with pass-through authentication. . . .

This is a very nice article. I am in the middle of building front and backend servers and this article explains on a simple way how it works and what to do.
thanks....

Wil Crijnen October 23, 2003

How do I setup a Pseudo Front-End Server (Windows 2000 server, Exchange 2000)?

Keith Runion November 17, 2003

A very useful explanation to understand the different authentication types into your exchange organization via a webbrowser.

Jörgen hjärtenflo May 12, 2004

Well Kierien, your articles are as good as your classes. Great article and I fully enjoyed last years connections conference.

themarlboroman June 19, 2004

For front end servers what version can you use. Standard or enterprise??

changari August 29, 2004 (Article Rating:

)

Great article on Front end servers on exch 2003!

I have a question, can a front end server in one forest/exch org forward email to a backend server in another forest/exch org.
Our DNS knows about each other, and other things are in place to allow inter-working of the forests. Two-way trusts are setup also.

billybubba8it October 20, 2004

Excellent article

Anonymous User January 30, 2005 (Article Rating:

)

NOW I understand!

Anonymous User February 25, 2005 (Article Rating:

)

This article is helpful in getting the concept. I do have the following inquiry though:

1) You mentioned explicit and implicit logon. Is it possible to restrict to just one? Say, I only one implicit logon. So if the users type in explicit logon then it will not work.

2) If I have two geographic locations say, one in NY and the other in LA and I want to use WLB/NLB for OWA logon. Two servers involved in Front-end servers one in LA and the other in NY. I want to have LA users logon through LA and the NY users through NY OWA Front End servers. In this scenario is the NLB/WLB is feasible? What's your take on this?? I have DC, GC in each loacation.

Thanks-
Jaxy-

Jaxy999 December 03, 2005 (Article Rating:

)

Where is the article? :(

charlestejana April 07, 2008 (Article Rating:

)

See More Comments 1 2

You must log on before posting a comment.

If you don't have a username & password, please register now.