Mac Skype For Business Configuration Advanced Options

#Skype For Business Configuration Advanced Options Download Self Signed#

User Outside the Corp-Network using a domain joined laptopBefore we dig in, understand that Skype for business as well as previous version of Lync uses 3 different methods of authentication: User inside the Corp-Network using a domain joined laptop Skype4b Client вЂ“ AuthenticatingOk so the Client successfully located the frontend, now comes the fun part, authenticating against the frontend there are a number of scenarios to consider here: Well you get the idea рџ™‚Back to our example letвЂ™s consider that all your DNS requirements are there, what happens then is because the new employee sitting inside the Corp network, the client will get a response for the lyncdiscoverinternal record and then will contact the frontend pool and authenticate with it.In case you did not already catch on that, skype4b try to resolve either lyncdiscoverinternal or lyncdiscover which will let the client to know if it is inside or outside the Corp-Network.Just for your information the second time the user will try to sign-in the client will go directly to the Frontend pool, not going through the whole process again unless it cannot discover the lyncdiscoverinternal or you flushed the DNS. Will start with explaining how SkypeFB client locate the frontend, then moving forward will explain the Authentication process, this will be very handy for you when troubleshooting.So let us say that a new Employee joined the company, got his/her new companyвЂ™s laptop and sitting in the office, fired it up and started Skype for business client, wrote the SIP-address and password and clicked вЂњSign-InвЂќ, now what? What is happening in the background? Following video shows a step by step of the discovery mechanism that Skype for business client conduct to locate the frontend.Skype for business client autodiscover logicNote: in real life not all mentioned steps are conducted by the Skype for Business client.So as you see in the video, the Skype4b client is designed to search for the frontend pool using pre-coded DNS records, it gets the domain name from the userвЂ™s sip-address one in red (user sip-domain) then start adding to it pre-coded values in the following order:I did a test using a fake sip-domain to show you the logic in how Skype4b client discover the frontend IP-addresses, following screenshot is taken from MS Network Monitoring toolWhen the client cannot resolve the first DNS records it tries the second one, if not then the third if not thenвЂ¦.

another capture of my office 365 traffic Client will try to use the /root/user/ URL to get the info it need about the home pool, but first it will try to authenticate using the AD username and password (NTLM) which will return a 401 Unauthorized and attach the Web ticket services URL in the response for the client to go and obtain a certificate from it. /Root/user URL need authentication and used information about the userвЂ™s home pool and frontend. /root/domain URL accessed without need to authenticate and used to get general information about the Topology

Authentication traffic will be proxy via the Edge pool to the Pool (Director or Frontend) Client authenticate successfully and get a response from the Autodiscover services with the information needed in the format of xml, below is a real life capture from my office 365 accountAnd here is a short video to show the work flow of how authentication worksSkype for business authentication overview User Outside Corp-Network with domain joined laptop:External users trying to sign in from outside the Corp-Network using a domain joined machine, lets assume that the user never signed in before and have no certificate from Lync.Lync uses two method of authentications here:Assuming that the Lync Edge and the reverse proxy servers are deployed and have no problem the authentication process will be same as scenario one but with the following differences: Client start communicating to the userвЂ™s home frontend and go through step 3-5 again Client will get a response with where the userвЂ™s home pool is. Client then try again to authenticate with the Autodiscover services to obtain the information about home pool, but this time it will authenticate using the TLS-DSK method (Certificate)

Skype For Business Configuration Advanced Options Download Self Signed

Skype4b Mobile вЂ“ AuthenticatingMobile client authentication is very much the same as Scenario oneThatвЂ™s all, a quick deep dive into autodiscover and authentication of Skype for business clients, this article if understood can help you troubleshoot future problems with signing in and discovery.Wish you all and your families a very merry Christmas and happy new year. Skype4b Mobile вЂ“ Locating the FrontendSkype for business Mobile and windows Metro app clients are different in the discovery method than normal desktop clients, the Mobile clients try to resolve two DNS records to locate the pool:As best practice you should always point the lyncdiscover to the reverse proxy of your infrastructure where the services is published using a public SSL certificate, why you ask, because Skype4b mobile and windows app cannot request and download self signed certificate like normal desktop clients, thatвЂ™s why the public SSL certificate deployed on your reverse proxy is used.If the Mobile client or windows metro app client cannot resolve those two DNS records, the discover simply fail and user cannot login, the clients wonвЂ™t fail back to SRV records like in desktop client. User Outside Corp-Network with none domain joined laptop:So last scenario is user trying to sign in to Skype for business client on a none domain joined machine, assuming that the machine is not connected to the corp-network because allowing none domain joined machines to the internal corp-Network will be a stupid thing to do for so many reasons I wonвЂ™t discuss here, so letвЂ™s say the user will connect from a guest Wifi or a home which is considered a none corp-Network, the process will be same as scenario two with user and domain joined machines, the authentication traffic will be proxy to the pool via Edge, and then redirected to the Reverse proxy server to obtain and download certificate which will be stored in the personal store on the machine.The credentials will be saved in the Windows Credentials manager if you choose to save my credentials when signing in to Skype for business. now back again to proxy traffic via the Edge server, the Skype4b client will authenticate against the pool using TLS-DSK which will work and the user sign-in.Following is a video showing the steps of singing in. using NTLM authenticate against the Web services a self signed certificate is issued and stored in the client вЂњPersonal StoreвЂќ Edge will redirect the Client to the external web services URL, this services usually published by the Reverse Proxy

Mac Skype For Business Configuration Advanced Options