Whats the best practice for securing Web VPN OWA access?
I'm authenticating user accounts on active directory via ACS, and using a WebVPN ACL to tie down access to the OWA web page URL. Should I issue users with new usernames/passwords purely for the WebVPN authentication, or use the same AD username for WebVPN and OWA login? Using the same username/password for both WebVPN and OWA seems a bit weak to me.
I thought about using digital certificates for Web VPN user authentication but this kinda defeats the object of being able to access email from any internet connection which is the requirement.
Would be interested in how other people have implemented this.
Peter.
