Configuring Lync and Exchange as Partner Applications

After Autodiscover is configured, Lync and Exchange can be configured as partner applications by exchanging certificates using the authentication metadata documents exposed on each side. On the Exchange 2013 side, a PowerShell script named Configure-EnterprisePartnerApplication.ps1 is provided, and is used to connect to the URL of the Lync 2013 metadata document and retrieve the required information from it. The default URL for the Lync authentication metadata document is https://<LyncFqdn>/metadata/json/1, where <LyncFqdn> is the fully qualified domain name of a Lync Front End Server. For example, the following procedure would be used to configure Lync as a partner application for the companyabc.com Exchange 2013 deployment:

1. Log on to a system where the Exchange 2013 administrative tools are installed using an account that has administrative rights to Exchange.

2. Open the Exchange Management Shell, and navigate to the Exchange scripts directory, which is by default C:Program FilesMicrosoftExchange ServerV15Scripts.

3. Execute the following command:

.Configure-EnterprisePartnerApplication.ps1 -AuthMetadataUrl https://lyncse1.companyabc.com/metadata/json/1 -ApplicationType Lync

4. If the command is successful, the script creates a disabled user account linked to the partner application, and assigns several Exchange management roles to the account to grant the required permissions, as shown in Figure 21.1.

Figure 21.1. Configuring Lync as a partner application in Exchange.

5. To prepare the system for new OAuth connections, execute the iisreset command on both the Client Access and the Mailbox Servers in the site.

On the Lync 2013 side, the New-CsPartnerApplication cmdlet is used to configure Exchange 2013 as a partner application for Lync. The default URL for the Exchange authentication metadata document is https://autodiscover.<domain>/autodiscover/metadata/json/1, where <domain> is the DNS domain of the Exchange systems. For example, follow these steps to configure Exchange as a partner application for the companyabc.com Lync deployment:

1. Log on to a system where the Lync administrative tools are installed using an account that is a member of the CsAdministrator group, and has administrative rights on the local system.

2. Open the Lync Server Management Shell, and execute the following command:

New-CsPartnerApplication -Identity exchange -ApplicationTrustLevel full -MetadataUrl https://autodiscover.companyabc.com/autodiscover/metadata/json/1

3. If the command is successful, the properties of the new partner application are displayed, as shown in Figure 21.2.

Figure 21.2. Configuring Exchange as a partner application in Lync.

After Lync and Exchange have been configured as partner applications, server-to-server authentication between the systems can be tested by using the Lync Server Management Shell to execute a synthetic transaction. The Test-CsExStorageConnectivity cmdlet has been provided for this purpose. This synthetic transaction uses OAuth to write an item into the conversation history folder of an Exchange 2013 mailbox, and then optionally deletes the item. For example, the following command is used to test server-to-server authentication between Lync and Exchange for companyabc.com, specifying the SIP URI of a Lync user who has an Exchange 2013 mailbox:

Test-CsExStorageConnectivity -SipUri [email protected] -Binding NetTCP -DeleteItem -HostNameStorageService lyncse1.companyabc.com