Tilted Forum Project Discussion Community - View Single Post - RPC over HTTP instead of VPN

bendsley · 12-27-2004, 08:26 AM

A definition of RPC for people wondering:

A remote procedure call (RPC) is a protocol that allows a computer program running on one host to cause code to be executed on another host without the programmer needing to explicitly code for this. When the code in question is written using object-oriented principles, RPC is sometimes referred to as remote invocation or remote method invocation.

RPC is an easy and popular paradigm for implementing the client-server model of distributed computing. An RPC is initiated by the caller (client) sending a request message to a remote system (the server) to execute a certain procedure using arguments supplied. A result message is returned to the caller. There are many variations and subtleties in various implementations, resulting in a variety of different (incompatible) RPC protocols.

In order to allow servers to be accessed by differing clients, a number of standardized RPC systems have been created. Most of these use an interface description language (IDL) to allow various platforms to call the RPC. Examples of such systems include Sun RPC (sometimes called ONC RPC), the Distributed Computing Environment (DCE), Microsoft's DCOM (and ActiveX), which is based in part on DCE, and CORBA.

Recently a number of vendors have started using XML as the IDL, and HTTP as the network protocol. The advantage of this system, known as web services, is simplicity and standardization, the IDL is a text file that is widely understood, and HTTP is built into almost all modern operating systems. An example of such an RPC system is SOAP, developed in turn from XML-RPC.
===================================================================

1. Highly recommend you use ISA to front end it. As I mentioned in previous posts I used ISA's reverse proxy function to terminate a secure SSL channel at the ISA Server and then recreate another one separately to Exchange...why? primary reason is security. Secondary reason is that you can use OWA forms based logon with SSL and use the great compression functions that it now has.

2. You need Windows Server 2003 DCs and GCs in order for it to work. Also Exchange 2003 must be running on Windows Server 2003. Patch both the Windows Server install and get Exchange 2003 SP1 on aswell.

3. Install the RPC over HTTP service on the Exchange Server from Add/Remove programs.

4. Follow Q article 833401. If you have deployed Exchange 2003 SP1 it makes it a lot easier and you wont need to type as much in in terms of the registry settings that are required. You will need to add a registry setting to each GC though that Exchange will be accessing.

Test it by going to the https://mail.servername.com/rpc and authenticating. If it comes back and says "HTTP Error 403.2 - Forbidden: Read access is denied" then youve done everything right!

5. You need to configure your Outlook clients to use it as an option. You configure it in your email settings/Exchange Server settings, then the Connections tab and finally Exchange Proxy settings. You can just fill in the FQDN of your mail server thats being reverse proxied and if you want the next level of security to mutually authenticate then you need to put that in aswell. Tick the "On Slow networks connect using HTTP first then TCP/IP" and choose basic text authentication. Obviously, because you're using SSL to encrypt the channel your basic text credentials wont be compromised.

The client computer must be running Microsoft Windows XP Professional Service Pack 1 (SP1), and the update package that is described in the following Microsoft Knowledge Base article must be installed:

331320 Outlook 2003 performs slowly or stops responding when connected to Exchange Server 2003 through HTTP.
Note: The update package that is described in article 331320 is included in Microsoft Windows XP Professional Service Pack 2 (SP2). If you have installed Windows XP SP2, you do not have to install the update package that is described in article 331320.

-------------------------------------------------------------------
I implemented VPN where I work and it's fully what I suggest. This might be able to help you in getting started though.

12-27-2004, 08:26 AM	#2 (permalink)
bendsley Professional Loafer Location: texas	A definition of RPC for people wondering: A remote procedure call (RPC) is a protocol that allows a computer program running on one host to cause code to be executed on another host without the programmer needing to explicitly code for this. When the code in question is written using object-oriented principles, RPC is sometimes referred to as remote invocation or remote method invocation. RPC is an easy and popular paradigm for implementing the client-server model of distributed computing. An RPC is initiated by the caller (client) sending a request message to a remote system (the server) to execute a certain procedure using arguments supplied. A result message is returned to the caller. There are many variations and subtleties in various implementations, resulting in a variety of different (incompatible) RPC protocols. In order to allow servers to be accessed by differing clients, a number of standardized RPC systems have been created. Most of these use an interface description language (IDL) to allow various platforms to call the RPC. Examples of such systems include Sun RPC (sometimes called ONC RPC), the Distributed Computing Environment (DCE), Microsoft's DCOM (and ActiveX), which is based in part on DCE, and CORBA. Recently a number of vendors have started using XML as the IDL, and HTTP as the network protocol. The advantage of this system, known as web services, is simplicity and standardization, the IDL is a text file that is widely understood, and HTTP is built into almost all modern operating systems. An example of such an RPC system is SOAP, developed in turn from XML-RPC. =================================================================== 1. Highly recommend you use ISA to front end it. As I mentioned in previous posts I used ISA's reverse proxy function to terminate a secure SSL channel at the ISA Server and then recreate another one separately to Exchange...why? primary reason is security. Secondary reason is that you can use OWA forms based logon with SSL and use the great compression functions that it now has. 2. You need Windows Server 2003 DCs and GCs in order for it to work. Also Exchange 2003 must be running on Windows Server 2003. Patch both the Windows Server install and get Exchange 2003 SP1 on aswell. 3. Install the RPC over HTTP service on the Exchange Server from Add/Remove programs. 4. Follow Q article 833401. If you have deployed Exchange 2003 SP1 it makes it a lot easier and you wont need to type as much in in terms of the registry settings that are required. You will need to add a registry setting to each GC though that Exchange will be accessing. Test it by going to the https://mail.servername.com/rpc and authenticating. If it comes back and says "HTTP Error 403.2 - Forbidden: Read access is denied" then youve done everything right! 5. You need to configure your Outlook clients to use it as an option. You configure it in your email settings/Exchange Server settings, then the Connections tab and finally Exchange Proxy settings. You can just fill in the FQDN of your mail server thats being reverse proxied and if you want the next level of security to mutually authenticate then you need to put that in aswell. Tick the "On Slow networks connect using HTTP first then TCP/IP" and choose basic text authentication. Obviously, because you're using SSL to encrypt the channel your basic text credentials wont be compromised. The client computer must be running Microsoft Windows XP Professional Service Pack 1 (SP1), and the update package that is described in the following Microsoft Knowledge Base article must be installed: 331320 Outlook 2003 performs slowly or stops responding when connected to Exchange Server 2003 through HTTP. Note: The update package that is described in article 331320 is included in Microsoft Windows XP Professional Service Pack 2 (SP2). If you have installed Windows XP SP2, you do not have to install the update package that is described in article 331320. ------------------------------------------------------------------- I implemented VPN where I work and it's fully what I suggest. This might be able to help you in getting started though. __________________ "You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane." Last edited by bendsley; 12-27-2004 at 08:33 AM..