世紀互聯Office365 Exchange混合部署無法使用(use)Microsoft Federation Gateway(MFG)查詢忙閑信息問題,配置OAuth步驟

2022-02-14 欄目:行業新聞

在(exist)Office365 Exchange2013混合部署環境中,Free/Busy忙/閑信息的(of)查詢可以(by)通過兩種方式:

  1. 通過Microsoft Federation Gateway以(by)及本地(land)和(and)雲端之間的(of)Organizational RelationShip(由混合向導創建)
  2. 通過配置Open Authentication(OAuth)以(by)及本地(land)和(and)雲端的(of)IntraOrganizationConnector來(Come)實現

而21V Office365無法使用(use)傳統的(of)日曆忙/閑信息共享(通過Microsoft Federation Gateway來(Come)進行Free/Busy lookup),21V的(of)Office365混合環境中,Exchange 2013雖然可以(by)創建MFG,但是(yes)無法用(use)來(Come)做忙/閑信息的(of)查詢方式, 以(by)下是(yes)世紀互聯版(21Vianet)Office365當中手動配置OAuth的(of)步驟,配置OAuth其實是(yes)有現成的(of)向導來(Come)自動配置,但是(yes)有些情況下,向導配置出(out)來(Come)後,OAuth無法工作(do),這(this)種情況下,可以(by)嘗試手動配置,并且,對于(At)本地(land)Exchange 2013/Exchange 2010或者Exchange 2013/Exchange 2007 Mixed混合環境,也需要(want)手動配置OAuth:

  1. 爲(for)Exchange Online組織創建授權服務器對象

在(exist)本地(land) Exchange Management Shell中運行以(by)下命令

New-AuthServer -Name "MicrosoftAzureACS" -AuthMetadataUrl https://accounts.accesscontrol.chinacloudapi.cn/<yourverified-domain>/metadata/json/1

運行成功後,驗證配置如下:

2. 爲(for)Exchange Online組織啓用(use)Partner Application

Get-PartnerApplication | ?{$_.ApplicationIdentifier -eq "00000002-0000-0ff1-ce00-000000000000"-and $_.Realm -eq ""} | Set-PartnerApplication -Enabled $true

3. 導出(out)本地(land)授權證書

在(exist)此步驟中,你需要(want)運行腳本去導出(out)本地(land)的(of)授權證書,然後導入到(arrive)Exchange Online

将以(by)下文本保存到(arrive)名爲(for) ExportAuthCert.ps1. 的(of)PowerShell腳本文件中:

$thumbprint = (get-authconfig).CurrentCertificateThumbprintif((test-path $env:SYSTEMDRIVE\OAuthConfig) -eq $false){ md $env:SYSTEMDRIVE\OAuthConfig}cd $env:SYSTEMDRIVE\OAuthConfig $oAuthCert = (dir Cert:\LocalMachine\My) | where {$_.Thumbprint -match $thumbprint}$certType = [System.Security.Cryptography.X509Certificates.X509ContentType]::Cert$certBytes = $oAuthCert.Export($certType)$CertFile = "$env:SYSTEMDRIVE\OAuthConfig\OAuthCert.cer"[System.IO.File]::WriteAllBytes($CertFile, $certBytes)

在(exist)本地(land)Exchange Management Shell當中運行腳本,如下圖:

4. 将本地(land)授權證書上(superior)載到(arrive)Azure Active Directory ACS

将以(by)下腳本保存爲(for) Azure-Auth.ps1

Connect-MsolService;

Import-Module msonlineextended;

$CertFile = "$env:SYSTEMDRIVE\OAuthConfig\OAuthCert.cer"

$objFSO = New-Object -ComObject Scripting.FileSystemObject;

$CertFile = $objFSO.GetAbsolutePathName($CertFile);

$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate

$cer.Import($CertFile);

$binCert = $cer.GetRawCertData();

$credValue = [System.Convert]::ToBase64String($binCert);

$ServiceName = "00000002-0000-0ff1-ce00-000000000000";

$p = Get-MsolServicePrincipal -ServicePrincipalName $ServiceName

New-MsolServicePrincipalCredential -AppPrincipalId $p.AppPrincipalId -Type asymmetric -Usage Verify -Value $credValue

然後使用(use) Azure AD powershell 運行腳本(在(exist)彈出(out)窗口輸入Office365全局管理員賬号密碼 )

5. 使用(use)Azure Active Directory爲(for)外部本地(land)Exchange HTTP端點注冊所有主機名頒發機構

在(exist)此步驟中,您必須爲(for)每一(one)台發布到(arrive)公網的(of)本地(land)Exchange服務器運行此腳本,建議使用(use)通配符,例:假設可通過 https://mail.contoso.com/ews/exchange.asmx從外部訪問Exchange。在(exist)這(this)種情況下,就可以(by)使用(use) *.contoso.com,可以(by)涵蓋autodiscover.contoso.com和(and)mail.contoso.com端點。不(No)過,不(No)會涵蓋頂級域contoso.com,如果Exchange 2013客戶端訪問服務器可通過頂級主機名頒發機構從外部訪問,則您必須也将該主機名頒發機構注冊爲(for)contoso.com.

将以(by)下腳本保存爲(for) RegisterEndpoints.ps1

$externalAuthority="*.contoso.com"

$ServiceName = "00000002-0000-0ff1-ce00-000000000000";

$p = Get-MsolServicePrincipal –ServicePrincipalName $ServiceName;

$spn = [string]::Format("{0}/{1}", $ServiceName, $externalAuthority);

$p.ServicePrincipalNames.Add($spn);

Set-MsolServicePrincipal –ObjectID $p.ObjectId –ServicePrincipalNames $p.ServicePrincipalNames;

在(exist)Azure AD PowerShell當中運行腳本:

6. 創建從本地(land)到(arrive)Office365的(of)IntraOrganizationConnector

在(exist)本地(land)Exchange PowerShell運行以(by)下命令:

New-IntraOrganizationConnector -name ExchangeHybridOnPremisesToOnline -DiscoveryEndpoint https://partner.outlook.cn/autodiscover/autodiscover.svc-TargetAddressDomains <contoso.partner.mail.onmschina.cn>

驗證

7. 創建從Office365到(arrive)本地(land)的(of)IntraOrganizationConnector

首先将Windows PowerShell連接到(arrive)Exchange online(步驟https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx), 然後運行以(by)下命令:

New-IntraOrganizationConnector -name ExchangeHybridOnlineToOnPremises -DiscoveryEndpoint https://autodiscover.contoso.com/autodiscover/autodiscover.svc-TargetAddressDomains contoso.com

驗證配置:

8. 爲(for)Exchange 2013 SP1之前的(of)服務器配置AvailabilityAddressSpace

如果您本地(land)有Exchange 2013 SP1之前版本的(of)Exchange服務器,如Exchange 2010,請先确保您爲(for)這(this)些服務器安裝了(Got it)最新的(of)RU補丁,然後配置如下的(of)Address Space

Add-AvailabilityAddressSpace -AccessMethod InternalProxy –ProxyUrl <your on-premises External Web Services URL> -ForestName <your Office 365 service target address> -UseServiceAccount $True

驗證配置

現在(exist),您已配置完成,可以(by)用(use)以(by)下步驟驗證OAuth

在(exist) Exchange 2013 server, 運行以(by)下命令:

Test-OAuthConnectivity -Service EWS -TargetUri https://partner.outlook.cn/ews/exchange.asmx-Mailbox <On-Premises Mailbox> -Verbose | fl

驗證結果輸出(out)爲(for)Success

2. 在(exist)Exchange Online PowerShell當中,運行以(by)下命令:

Test-OAuthConnectivity -Service EWS -TargetUri <external hostname authority of your Exchange On-Premises deployment>/metadata/json/1 -Mailbox <Exchange Online Mailbox> -Verbose | fl

現在(exist),您可以(by)測試Free/Busy忙/閑信息共享是(yes)否工作(do)正常(例:本地(land)郵箱可以(by)看O365郵箱的(of)日曆忙/閑,O365郵箱可以(by)看本地(land)郵箱的(of)日曆忙閑信息)