Configure the SSO Exchange Monitor

After you install the Exchange Monitor, you must configure the SSO Agent to use the Exchange Monitor.

For a detailed explanation of how the Exchange Monitor works, see About Active Directory Single Sign-On (SSO). For information about how to install the Exchange Monitor, see Install the WatchGuard SSO Exchange Monitor.

Best Practices

For the most reliable SSO deployment, we recommend that you use the SSO Client as the primary SSO method for Windows and Mac OS X computers. You can use the Exchange Monitor as a backup SSO method for Windows and Mac OS X computers that are not shared by many users. You can also configure the Exchange Monitor as the primary SSO method for Linux computers, and mobile devices with Android, iOS, and Windows.

Configuration Requirements

To use the Exchange Monitor for SSO:

• You must enable the Exchange Monitor option in the SSO Agent
• You must add a contact domain in the SSO Agent (the domain name and IP address for the Exchange Monitor), if you have:
  • One domain and the SSO Agent is not installed on your domain controller
  • More than one domain, and the Exchange Monitor and SSO Agents are installed on different domains
• When you add a domain for the Exchange Monitor, you must specify the IP addresses and the session check interval for the Microsoft Exchange server. The session check interval specifies the amount of time before the Exchange Monitor logs off a user that does not appear in the IIS log messages on your Exchange Server as active. The default setting is 40 minutes. You must specify an interval of at least 5 minutes.
• Users must launch a mail client on their computers before they can access the Internet. This generates the IIS log messages on your Exchange Server that the Exchange Monitor requires for SSO.

If you include more than one Exchange Monitor in the Contact Domains list, the SSO Agent queries the first entry in the list for the user credentials and group information. If the first Exchange Monitor is not available, the SSO Agent contacts the next monitor in the list. This process continues until the SSO Agent finds an available Exchange Monitor

Configure the SSO Agent

To configure the SSO to use the Exchange Monitor:

1. Log in to the SSO Agent Configuration Tool.
2. Select Edit > SSO Agent Contacts Settings.
   The SSO Agent Contacts Settings dialog box appears.
   
3. Click Add.
   The Domain Settings dialog box appears.
4. For the Type option, select Exchange Monitor.

5. In the Domain Name text box, type the name of the domain that you want the Exchange Monitor to contact for user credentials.
   You must type the name in the format domain.com.
6. In the IP Addresses of Microsoft Exchange Server text box, type the IP addresses for the domain.
   To specify more than one IP address for the Exchange Server, separate the IP addresses with a semicolon, without spaces.
7. To change the Session Check Interval setting from the default setting of 40 minutes, type or select a new interval.
8. Click OK.
   The domain information you specified appears in the Contact Domains list.

Test the SSO Port Connection

To verify that the SSO Agent can contact the Exchange Monitor, you can use the SSO Port Tester tool. For more information, see Troubleshoot Single Sign-On (SSO).

See Also

About Active Directory Single Sign-On (SSO)

Install the WatchGuard Single Sign-On (SSO) Client

Install the WatchGuard SSO Exchange Monitor

Choose Your Single Sign-On (SSO) Components

Troubleshoot Single Sign-On (SSO)

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.