Chapter 14: Securing Outlook Web Access

Overview

Oh, what tangled webs we weave , When we first practice to deceive.

”Sir Walter Scott

Microsoft Outlook Web Access was a very clever feature when it was first introduced in Microsoft Exchange 5.5. The original version was a set of Active Server Pages (ASPs) that used version 1.0 of the Collaboration Data Objects (CDO) library, which in turn made Messaging Application Programming Interface (MAPI) calls to the Exchange server to fetch mail data. This approach worked reasonably well, but it had some limitations: it didn t scale well, and it was completely dependent on IIS 4, which was not as stable as Outlook Web Access demanded. The use of ASPs for getting mail data and rendering it to the user allowed administrators to customize their Outlook Web Access installations, but overall performance was hurt by the need to interpret the ASPs each time a user logged in, refreshed his or her mailbox, or composed a new message.