Outlook ask for password in cycle after repo to supported change

ladas

Hi everybody.

Because we still have problems with public folders sync with outlook and nobody is able to answer my questions (or do not want to say it is a bug) I decided to switch repo to supported.
I cloned my vm, change server IP address (because of test environment), IP address in /etc/hosts record, use @WalterH howto for change settings apt (thank you Walter, very useful post 🙂 ) and run dist-upgrade.
There were some errors unfortunately as ussual, I must remove /usr/share/grommunio-common/nginx/upstreams.d/grommunio-dav-upstream.conf, create directory /var/lib/grommunio-web/sqlite-session to be possible to finish upgrade and reboot server. Now it seems everything works.
I have one domain which is not used yet, so I created new user, set local dns correct records for server name and autodiscover. I can log in as new user from web gui. I configured outlook account, outlook asked for certificate acception (domain is not in certificate yet), and unusually asked for password again, again, again. When I cancel this dialog account was possible to save. When I start outlook again, it still asked for password. I overwrited password at admin gui for new user but it not helped.
Can somebody tell where could be problem, please? I searched log files, but did not find anything usable.
Thank you for any answer.

WalterH

To change the repository, did you follow this instructions: https://community.grommunio.com/d/1012-convert-grommunio-from-the-community-edition-to-the-supported-edition ?

ladas

WalterH
Hi Walter. Thank you for for your answer. Yes I used it, thank you for your howto. It worked for first kick. Only Outlook cannot authorize. Account was created successfully but still ask for user password. Web GUI works properly for the user.

WalterH

Did you the update with zypper dup and did you reboot the server?

ladas

WalterH
my server has debian11 background so I use "apt-get update" and "apt-get dist-upgrade".

WalterH

Do you see any errors in: tail /var/log/grommunio/* -f ?

ladas

WalterH
unfortunately nothing. When I start outlook, it ask for password, I add it, it ask again, ... BUT at log is nothing 🙁
I can try remove Outlook account and set it up again.

ladas

ladas
When I configure account at outlook again this is only new log records:
2023/05/12 21:06:41 [error] 805#805: *684 output on closed stream while sending to client, client: 10.0.3.32, server: _, request: "POST /autodiscover/autodiscover.xml HTTP/2.0", upstream: "https://[::1]:10443/autodiscover/autodiscover.xml", host: "autodiscover.domain.de"
10.0.3.32 - - [12/May/2023:21:06:41 +0200] "POST /autodiscover/autodiscover.xml HTTP/2.0" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPICPL 16.0.16327; Pro)"
10.0.3.32 - username@domain.de [12/May/2023:21:06:54 +0200] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 3465 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPICPL 16.0.16327; Pro)"

WalterH

You stated the certificate do not match the URL. Is ist possible to get a Lets Encrypt certificate that matches the server URL?
You my need to setup a split DNS for the mail and Autodiscover URL, so the certificate matches both URLs.
Outlook is sometimes very tricky if the certificate do not match.

ladas

WalterH
Hi Walter,
I have my own CA and all our customers servers use our signed certificates. We just import our CA into client devices. It is easy, we have control, independence and servers necessary need not to have access into internet 🙂 Most of our servers works off-line. For mails we use mail gateway which send emails out and forward incoming emails into local networks.
But back to my problem. I configured my new account in production server (the same which I configured at upgraded server clone) and outlook connected and create account for first kick. Just ask for certificate acceptation and start. So it seems the problem is not here, unfortunately 🙁
I can clone and upgrade repos with new user and we will see, if something change.

Just another question. When I generate certificate for server I add all necessary domains into one certificate. Is it possible to generate certificate for each domain separately and match them into bundle certificate? Will it work with nginx? Thank you for your answer.

WalterH

ladas Is it possible to generate certificate for each domain separately and match them into bundle certificate?

I assume this can work, but I did not test this. Try out and report if it works?

ladas

WalterH
Hi Walter,
I found the problem in the end! It was in autodiscover configuration. I hope I will explain it clearly. I cloned my production vm and moved it to our test environment. It means to another network. So I changed IP address (for details you can look above at the first post) . I repaired DNS records according to new server address. BUT. On server we host mailboxes for five domains. One of them is not used yet, so I planed to use it for my tests, rest of the DNS records was left untouched (they are set for production server which is in use). I created new user for unused domain and tried to connect outlook to the cloned server. BUT at cloned server was autodiscover configuration left unchanged for main server domain. And DNS record for this main domain was pointed to production server. And at production server there was not new user 🙂.
At the end I made upgrade to supported version during night. Unfortunately problems with Public folders which I described in other thread did not changed at all. It seems nobody use it because it is really broken and there is no information here.
Walter, thank you very much for the tips and help. Can you change this thread as solved, please?

WalterH

ladas Perfect, this explain the issue. Autodiscover and DNS is sometimes a pain.