DUO OWA 2.2 App & 404 Errors through Reverse Proxy

[colombo01]

Hi All,

I am running Exchange 2019 on Server 2019 with the latest CU 13. My configuration is that my exchange server is behind an IIS reverse proxy using url rewrite to rewrite the subdomain back to the exchange server. I do not have any restrictions on the specific directories as noted in the reverse proxy document:
https://help.duo.com/s/article/3392?language=en_US

I have been using version 1.1 of the DUO OWA app for several years now without any issues. I recently upgraded to very 2.2 to take advantage of the universal prompt. After testing things the prompt shows up and everything seems to be working properly from my internal network. However, when I test things from outside my network I get a 404 error with a big long nasty url string https://subdomain.domain.com/oauth/v1/authorize client_id=…

I’ve tried changing back to the traditional prompt in the DUO admin panel and no changes. I uninstalled version 2.2 and reinstalled 1.1 and everything is working properly again.

I assume this is a result of the reverse proxy since things work properly internally, however I’m not sure what the cause is and how to resolve it. I don’t know if the specific url/error code contains anything of help but I can share if needed.

Thanks
Josh

[DuoKristina]

Please contact Duo Support about this if you have not already. It may be a bug with the implementation of the redirect_uri value in our OIDC API in the OWA v2 plugin with reverse-proxy/URL rewrite configurations.

[colombo01]

Kristina,

Thank you for the reply. I just sent support an email and I’ll see what they come back with.

Thanks!
Josh

[User666]

I have the same issues.

Everything was working perfectly with 1.1 and still works perfectly internally.

I had done everything Josh had done, but I had also tried putting a hostname block for *.duosecurity to try and stop it going through the url rewrite engine without success. (thin chance, but was worth a shot!)

Thanks
Ian

[Sascha K.]

Hi everyone,

Could someone solve the problem? I have the same problem.

Thanks!

[colombo01]

If you have a paid account I’d recommend contacting Support to elevate the issue. I do not have a paid account and received feedback that paid users’ issues would be a priority.

[Bryan_MFA]

The OWA 2.0.x adapter uses the Duo Universal Prompt to complete multi-factor authentication. With that approach, the Duo OWA adapter performs an HTTP redirect to the Duo server, so the Duo server URL must not be rewritten by the reverse proxy.

It should be possible to resolve the reported issue by updating the outbound URL rewrite rule(s) on the reverse proxy server.

Open the IIS Manager

• Select the ‘Site’ where the URL Rewrite rules are configured. The rewrite rules can be overridden within the site hierarchy, so be sure to select the correct site node. eg) ‘Default Web Site’ or ‘Default Web Site’\owa or ‘Default Web Site’\ecp

• From the right-pane, double-click the URL Rewrite icon

• You will likely see one or more ‘Outbound’ rules

• In the “Pattern” text box, enter regex that deliberately excludes duosecurity URL from being rewritten.

For example, the regex below can be added to the existing pattern to exclude duosecurity.com URL from outbound rewrite.
(?!^..duosecurity.com/.$)(^.$)*

Before clicking ‘Apply’ to save the updated pattern, you can test/refine the pattern by clicking the ‘Test pattern…’ action button next to the text box.

In ‘Input data to test:’, enter a Duo server URL. eg) https://myserver.duosecurity.com/oauth/v1/authorize?test_param=GoDuo

The Test Results should display a message like:
The input data to does not match the pattern

Before saving, make sure that URL that should be rewritten still match the pattern.
For URL that should be rewritten, the Test Results should display a message like:
The input URL path matches the pattern

After applying the updated rewrite pattern, test the OWA logon to see if the reported issue is resolved.

I hope this helps.

[colombo01]

Bryan,

Thank you for the reply! I will try and test this out this week and report back.

Thanks!
Josh

[Legacy777]

Hello,

I am unable to get this to work.  I'm not sure if it's the regex expression or the specific attributes to select in the outbound rule.  Any additional feedback/input is appreciated.  Below is how I have it configured.

Thanks

[DuoKristina]

@Legacy777 You didn't enter the same regex string that Bryan suggested. What happens when you try your current rule (how does it not work)? What logging is available to you to verify processing of your rule?

[Legacy777]

Hi Kristina,

The regex string Bryan suggested does not work either and doesn't provide the results mentioned when testing the expression, which is why I modified it.  Either expression actually causes OWA and ActiveSync to not work outside of the internal network.  I will need to review the logs in more detail to see what information is available to verify processing of the rule.

[DuoKristina]

You're probably better off contacting Duo Support if you have not already. They can dedicate time to reviewing your logs, config, etc.

[Legacy777]

I contacted support but didn't get a response back.

However, I did some more testing and research and the fix is actually very simple.  No outbound url rewrite rules need to be defined, "Reverse rewrite host in response headers" just needs to be unchecked in the Application Request Routing proxy settings.  Please see screen shots below showing what needs to be changed:

Open IIS Manager, select your server, and select Application Request Routing

Select "Server Proxy Settings"

Uncheck "Reverse rewrite host in response headers" and then select "Apply"

Anyone that is having this issue I would suggest verifying your configuration and ensuring unchecking this won't cause any other undesirable results.

Below are some links/references regarding this setting if you want to dig into it more.

IIS Url Rewrite overwriting external urls 
URL Rewrite keeps original host Location when reverse proxy 301 redirects 
Prevent ARR with UrlRewrite from re-writing Location header for a 302 redirect 
Application Request Routing – (Reverse Proxy and Troubleshooting ARR, URLRewrite Issues) 

This works for RDWeb as well OWA and I would assume work for any other applications behind IIS's reverse proxy.

Josh