[SOLVED] Cannot get outlook 2016 to work

ozy

Hello,

I'm a Zarafa / Kopano refugee and currently trying Grommunio as replacement for my mail server.
So far so good, I've installed the server using the ISO, it was pretty straight forward.

I've setup a test domain, can connect with my android phone, can use the webmail, but there's no way I'm getting Outlook 2016 to work with my test user.
I've searched the forum before, tried various things, but I can't get this resolved.

Here's what I did so far:
Autodiscover seems to work with my phone
Autodiscover seems to work according to MS exchange connectivity tests
Tested with PASS=password gromox-dscli -e test@example.tld which returns * Response has validated

What doesn't work:
Microsoft Remote Connectivity Analyzer:
The autodiscover part works of course. The "Testing the MAPI Mail Store endpoint on the Exchange server." failed.
I've read somewhere in this forum that it never worked. I'm posting the result anyways since it might bring some more insight:

Testing the MAPI Mail Store endpoint on the Exchange server.
An error occurred while testing the Mail Store.
Test Steps

Attempting to log on to the Mailbox.
An error occurred while logging on to the Mailbox.
Additional Details
The MAPI Mailbox Execute (EcDoRpcExt2) operation failed with status 1206.
Status Code: 1206
HTTP Response Headers:
transfer-encoding: chunked
x-requesttype: Execute
x-requestid: 40d88bac-4dc4-4535-a3ec-775b1155c1b9:2
x-clientinfo: 66f48988-e105-4cac-95c4-c2cd4e0b1063:1
x-responsecode: 0
x-pendingperiod: 30000
x-expirationinfo: 900000
x-serverapplication: Exchange/15.00.0847.4040
Cache-Control: private
Content-Type: application/mapi-http
Date: Sat, 23 Sep 2023 11:40:03 GMT
Set-Cookie: sid=tez6str56nd0etuepeycrfteecz9t5z3,sequence=557866fb-5f58-4286-8c98-da5eecdd1d0a
content-security-policy: default-src 'self' data:; frame-src * blob:; connect-src * data: blob:; font-src * data:; img-src * data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'self'; base-uri 'self'; frame-ancestors 'self';
permissions-policy: accelerometer=(), autoplay=(self), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), keyboard-map=(self), magnetometer=(), microphone=(self), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(), usb=(), web-share=(self), xr-spatial-tracking=(self)
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: none
x-xss-protection: 1; mode=block
referrer-policy: no-referrer

Here's what happens whenever I try to connect my Outlook 2016 client:

Sorry for the french Outlook message, the english translation would be

The action cannot be completed. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action

I've grepped in all grommunio logs while trying to create the outlook profile:

==> /var/log/grommunio/nginx-autodiscover-access.log <==
192.168.201.1 - - [23/Sep/2023:13:46:51 +0200] "POST /autodiscover/autodiscover.xml HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:51 +0200] "POST /autodiscover/autodiscover.xml HTTP/1.1" 200 598 "-" "Outlook/16.0 (16.0.4266.1001; MSI; x64)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:51 +0200] "POST /autodiscover/autodiscover.xml HTTP/1.1" 200 3401 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"

==> /var/log/grommunio/nginx-sync-access.log <==
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:51 +0200] "OPTIONS /Microsoft-Server-ActiveSync HTTP/1.1" 200 5 "-" "Outlook/16.0 (16.0.4266.1001; MSI; x64)"

==> /var/log/grommunio/nginx-mapi-access.log <==
192.168.201.1 - - [23/Sep/2023:13:46:51 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:51 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - - [23/Sep/2023:13:46:51 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:51 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - - [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - - [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - - [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - - [23/Sep/2023:13:46:52 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 401 0 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"
192.168.201.1 - test@example.tld [23/Sep/2023:13:46:53 +0200] "POST /mapi/nspi/?MailboxId=74657374-406e-6574-7065-72660c000000@example.tld HTTP/1.1" 200 121 "-" "Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro)"

I have no idea where to search. No errors in the logs. No logs at all in /var/log/gromox. journalctl doesn't show anything special either.
Grommunio is behind a Haproxy for SSL offloading and security reasons.
Maybe there's a special conf for haproxy ? Didn't find anything specific in the docs /forum.

Grommunio is AFAIK the first ever native MAPI speaking server... I want to love grommunio, I really want to.
Any clue is welcome at this point 😉
Thanks.

crpb

Just a hint for Outlook, create some other mailaccount or even the grommunio-host with imap in a fresh profile.
Then you can use the Outlook-Internal test described here on the client.
And maybe those registry-settings might help. (Official MS reference)

I personally only use/deploy it with SRV-Records and registry-settings like that.

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover]
"ExcludeExplicitO365Endpoint"=dword:00000001
"ExcludeLastKnownGoodURL"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
"ExcludeHttpsAutoDiscoverDomain"=dword:00000001
"ExcludeHttpRedirect"=dword:00000001
"ExcludeScpLookup"=dword:00000001
"ExcludeSrvRecord"=dword:00000000
"EnableOffice365ConfigService"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\AutoDiscover]
"ExcludeExplicitO365Endpoint"=dword:00000001
"ExcludeLastKnownGoodURL"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
"ExcludeHttpsAutoDiscoverDomain"=dword:00000001
"ExcludeHttpRedirect"=dword:00000001
"ExcludeScpLookup"=dword:00000001
"ExcludeSrvRecord"=dword:00000000
"EnableOffice365ConfigService"=dword:00000000

ozy Grommunio is behind a Haproxy for SSL offloading and security reasons.
Maybe there's a special conf for haproxy ? Didn't find anything specific in the docs /forum.

That should normaly work..

ozy

@crpb Thank you for your reply.
Didn't think about the IMAP trick to get the diag window 😉 Good one !

I've actually tried the registry hacks too, without success.

I ended up finding the culprits:

My Outlook version was buggy
Using Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.4266; Pro) I couldn't connect properly.
Using Microsoft Office/16.0 (Windows NT 10.0; MAPI 16.0.5404; Pro) I could connect

The difference between both outlook versions is just that I got into Windows updates, enabled updates for other Microsoft products, and made myself a coffee while waiting. Both are Outlook 2016.

Accents aren't allowed in passwords
See https://github.com/grommunio/gromox/issues/69

Hopefully this might help someone 😉

WalterH

I assume you have an issue with your internal autodiscover URL. Which result you get for:
ping -a autodiscover.example.tld ?
Replace example.tld with your domain - the same domain you used with MS exchange connectivity tests. The IP address returned by ping, must be the (internal) IP address of the grommunio server.

ozy

WalterH Thank you for your help, but this is actually resolved for me since it was an outlook issue.
I could confirm this since an outlook 2019 client could connect while the non updated outlook 2016 client couldn't.
Once updated, the outlook 2016 client worked flawlessly.

As for the DNS, I didn't have any problem with internal/external URL since I use NAT reflection which allows me to access the external URL from my local network, and the server is configured to use external URL for internal lookups too.

Pros:
Every request is syslogged
Cons:
It makes a roundtrip to the firewall

Mfg.