Authenticating programmatically to Exchange Server 2003 FBA
In one of my projects I had to read data from Exchange Server 2003 programmatically. I had access to Outlook Web Access that used Form Based Authentication (FBA). After some hacking and testing I got authentication part of my utility work. The point was easy - before making WebDAV requests to Exchange Server we need authentication cookies, so there is active session we can use.
At first let's see namespaces I used in my code to get FBA stuff work.
using System.Text;
using System.Net;
using System.Security.Authentication;
using System.Web;
And here is the authentication method that returns session cookies if authentication succeeded. You can use these cookies if you have to execute WebDAV queries by example.
private CookieCollection DoExchangeFBA(string server, string
userName, string password)
{
var uri = server + "/exchweb/bin/auth/owaauth.dll";
var request = (HttpWebRequest)HttpWebRequest.Create(uri);
request.Method = "POST";
request.CookieContainer = new CookieContainer();
request.ContentType = "application/x-www-form-urlencoded";
request.AllowAutoRedirect = false;
request.ServicePoint.Expect100Continue = false;
server = HttpUtility.UrlEncode(server);
userName = HttpUtility.UrlEncode(userName);
password = HttpUtility.UrlEncode(password);
var bodyString = "destination={0}&flags=0&username={1}";
bodyString += "&password={2}&SubmitCreds=Log+On&";
bodyString += "forcedownlevel=0&trusted=0";
bodyString = string.Format(bodyString, server,
userName, password);
var body = Encoding.ASCII.GetBytes(bodyString);
request.ContentLength = body.Length;
ServicePointManager.Expect100Continue = false;
var stream = request.GetRequestStream();
stream.Write(body, 0, body.Length);
stream.Close();
var response = (HttpWebResponse)request.GetResponse();
if (response.Cookies.Count < 2) throw
new AuthenticationException("Failed to login to OWA!");
return response.Cookies;
}
If you are using Exhange Server 2007 then you have different authentication address and you get back only one cookie.