Search code examples
c#office365exchangewebservices

Exchange Online and EWS with Basic Auth stopped working

I want to use EWS managed API with basic authentication to connect to Exchange Online.

But in my application the EWS AutodiscoverService is unable to retrive mailbox settings (GetUserSettings) from Exchange Online when using basic authentication, but oAuth works just fine.

I get a Microsoft.Exchange.WebServices.Data.ServiceRequestException with the message "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 40.101.50.162:444"

I have been using basic auth for several years and a few days ago it just stopped working. Is it no longer possible to use basic authentication with Exchange Online and EWS?

Code sample

var ads = new AutodiscoverService
             {
                 RedirectionUrlValidationCallback = url => true,
                 EnableScpLookup = false
             };
ads.Credentials = new NetworkCredential( svcUsr, svcPwd ); // using these will throw an exception
ads.Credentials = new OAuthCredentials( token.AccessToken ); // these works
var res = ads.GetUserSettings( mailBox, UserSettingName.GroupingInformation );

The Exception

Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. Unable to connect to the remote server ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 40.101.28.194:444
       at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
       at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
       --- End of inner exception stack trace ---
       at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
       at System.Net.HttpWebRequest.GetRequestStream()
       at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetRequestStream()
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()
       --- End of inner exception stack trace ---
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()
       at Microsoft.Exchange.WebServices.Autodiscover.GetUserSettingsRequest.Execute()
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetUserSettings(List`1 smtpAddresses, List`1 settings, Nullable`1 requestedVersion, Uri& autodiscoverUrl)
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetSettings[TGetSettingsResponseCollection,TSettingName](List`1 identities, List`1 settings, Nullable`1 requestedVersion, GetSettingsMethod`2 getSettingsMethod, Func`1 getDomainMethod)
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetUserSettings(List`1 smtpAddresses, List`1 settings)
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetSoapUserSettings(String smtpAddress, List`1 requestedSettings)
       at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetUserSettings(String userSmtpAddress, UserSettingName[] userSettingNames)
       at EWSAutoDiscovery.Program.Main(String[] args) in C:\Program.cs:line 57

Things tested and verified [Update 1]

  1. I have verified that some EWS operations still work with basic auth, e.g. SyncFolderItems.
  2. I have verified that the service account user nor the EXO General Config has an Authentication Policy.
  3. I have created an Authentication Policy that enables BasicAuth on all protocols and assigned it to the EXO Organization Config DefaultAuthenticationPolicy parameter.
  4. I have assigned the Authentication Policy to the service account as well as the target user.
  5. I have removed and reapplied the ApplicationImpersonation role on the service account.
Solution

  • Autodiscovery with Basic Authentication started to work again during the night, for all O365/Azure tenants using my application.

    Microsoft must have fixed something on their side that they broke a few days ago.