I am able to access the manual autodiscover URL and see the traffic hitting the FE through my proxy, but I get a 401 access denied when attempting the webticket request:

2011-12-22 13:33:33.580 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/141:Request to get web ticket for https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root
2011-12-22 13:33:33.581 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/254:No Cached web-ticket found.
2011-12-22 13:33:33.581 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/291:Received request for a new token for https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root
2011-12-22 13:33:33.582 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../credentialManager/private/CCredentialManager.cpp/264:getSpecificCredential returning the following credential for credType (1) serviceId (4)
2011-12-22 13:33:33.583 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../credentialManager/private/CCredentialManager.cpp/161:Credential information: credType (1) signInName () domain () username () password.empty() (1) compatibleServiceIds(0)
2011-12-22 13:33:33.583 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/392:Executing request of type WebTicketRequest destined for https://lync.sipdomain.com/webticket/webticketservice.svc
2011-12-22 13:33:33.584 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../metaDataManager/private/CMetaDataManager.cpp/322:Received a request to get the meta data of type 2 for url https://lync.sipdomain.com/webticket/webticketservice.svc
2011-12-22 13:33:33.585 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/862:Found a binding with AuthType 1
2011-12-22 13:33:33.586 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../credentialManager/private/CCredentialManager.cpp/264:getSpecificCredential returning the following credential for credType (1) serviceId (1)
2011-12-22 13:33:33.586 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../credentialManager/private/CCredentialManager.cpp/161:Credential information: credType (1) signInName (jeff.barnett@sipdomain.com) domain () username (domain/jeff.barnett) password.empty() (0) compatibleServiceIds(0)
2011-12-22 13:33:33.587 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/privateIos/CTransportThread.cpp/156:Added Request(WebTicketRequest) to Request Processor queue
2011-12-22 13:33:33.588 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/207:Waiting on the token
2011-12-22 13:33:33.588 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/privateIos/CTransportThread.cpp/339:Sent Request(WebTicketRequest) to Request Processor
2011-12-22 13:33:33.589 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CTransportRequestRetrialQueue.cpp/502:Submitting new req. <unknown>
2011-12-22 13:33:33.590 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/321:<SentRequest>
2011-12-22 13:33:33.590 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/880:Submitting Authenticated AutoDiscovery request to https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root/user
2011-12-22 13:33:33.591 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/324:To:https://lync.sipdomain.com/webticket/webticketservice.svc
2011-12-22 13:33:33.592 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/1359:Ignoring GetUserUrlOperation event as current state is 6
2011-12-22 13:33:33.592 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/340:HttpHeader:Accept text/xml, application/soap+xml, application/octet-stream
2011-12-22 13:33:33.593 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/1361:Request url was http://lyncdiscover.sipdomain.com/?sipuri=sip:jeff.barnett@sipdomain.com
2011-12-22 13:33:33.594 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/340:HttpHeader:Content-Type text/xml; charset=utf-8
2011-12-22 13:33:33.595 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/340:HttpHeader:SOAPAction http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue
2011-12-22 13:33:33.596 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/349:<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><wst:RequestSecurityToken xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" Context="ff1c2bf6-bc4d-4348-8101-40da5b2479af"><wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</wst:TokenType><wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:Address>https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:Entropy><wst:BinarySecret>XXXXXXXXXX</wst:BinarySecret>et></wst:Entropy><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
2011-12-22 13:33:33.596 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/352:</SentRequest>
2011-12-22 13:33:33.597 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/private/CHttpRequestProcessor.cpp/362:Sending request(WebTicketRequest) to server type = 1
2011-12-22 13:33:33.600 Lync[104:7a27] PERFORMANCE TESTPERF /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/platform/_buildIos/../tracing/privateIos/CMPerfTrace.mm/75:PerfBegin|16|Time=2011-12-22T13:33:33.598|MemoryUsage=26435584|UsedTick=72196.000000|TotalTick=812633.000000|BatteryLevel=0.600000|WifiSent=564560|WifiReceived=1795536|WwanSent=163609|WwanReceived=405455
2011-12-22 13:33:33.601 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:33.909 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for UcwaAutoDiscoveryRequest
2011-12-22 13:33:33.911 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for UcwaAutoDiscoveryRequest
2011-12-22 13:33:33.912 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (UcwaAutoDiscoveryRequest)isHeadersAvailable = true  responseHeadersHandle = 64d3c0
2011-12-22 13:33:33.914 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 200 for request UcwaAutoDiscoveryRequest
2011-12-22 13:33:33.915 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/private/CHttpRequestProcessor.cpp/137:Received response of request(UcwaAutoDiscoveryRequest) with status = 0x0
2011-12-22 13:33:33.915 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/422:<ReceivedResponse>
2011-12-22 13:33:33.916 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Cache-Control no-cache
2011-12-22 13:33:33.916 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Connection keep-alive
2011-12-22 13:33:33.917 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Content-Length 437
2011-12-22 13:33:33.917 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Content-Type application/vnd.microsoft.rtc.autodiscover+xml;v=1
2011-12-22 13:33:33.918 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Date Thu, 22 Dec 2011 19:33:27 GMT
2011-12-22 13:33:33.918 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Expires -1
2011-12-22 13:33:33.919 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:MobileLyncInternalUse-x509-CertificateData 0Ç´0Çì†

61Q
2011-12-22 13:33:33.919 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Pragma no-cache
2011-12-22 13:33:33.920 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Server nginx/1.0.10
2011-12-22 13:33:33.920 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:StatusCode 200
2011-12-22 13:33:33.921 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:X-AspNet-Version 2.0.50727
2011-12-22 13:33:33.921 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:X-MS-Server-Fqdn vmLyncFE.domain.local
2011-12-22 13:33:33.922 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:X-Powered-By ASP.NET
2011-12-22 13:33:33.922 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/435:<?xml version="1.0" encoding="utf-8"?><AutodiscoverResponse AccessLocation="External" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Root><Link token="Domain" href="https://lync.sipdomain.com/Autodiscover/AutodiscoverService.svc/root/domain"/><Link token="User" href="https://lync.sipdomain.com/Autodiscover/AutodiscoverService.svc/root/user"/></Root></AutodiscoverResponse>
2011-12-22 13:33:33.923 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/438:</ReceivedResponse>
2011-12-22 13:33:33.924 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../ucwaAutoDiscovery/private/CUcwaAutoDiscoveryResponse.cpp/116:location value is external
2011-12-22 13:33:33.925 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../ucwaAutoDiscovery/private/CUcwaAutoDiscoveryResponse.cpp/187:User url is https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root/user
2011-12-22 13:33:33.926 Lync[104:5403] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/private/CHttpRequestProcessor.cpp/266:Sending event to main thread for request(0x650088)
2011-12-22 13:33:34.479 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:34.481 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:34.482 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 6bf0c0
2011-12-22 13:33:34.483 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:34.484 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:35.059 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:35.060 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:35.061 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 64e090
2011-12-22 13:33:35.062 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:35.063 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:35.581 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:35.583 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:35.583 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 64d4d0
2011-12-22 13:33:35.585 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:35.585 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:36.316 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:36.317 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:36.317 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 6429d0
2011-12-22 13:33:36.319 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:36.319 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:37.294 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:37.297 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:37.298 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 24b1910
2011-12-22 13:33:37.299 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:37.300 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:38.239 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:38.240 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:38.241 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 6437e0
2011-12-22 13:33:38.242 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:38.243 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://lync.sipdomain.com/webticket/webticketservice.svc persistent id as 14
2011-12-22 13:33:38.616 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-22 13:33:38.618 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-22 13:33:38.619 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = 64ceb0
2011-12-22 13:33:38.620 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest
2011-12-22 13:33:38.621 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/600:Not send authenticating request(WebTicketRequest).  isAuthObjectValid - 1, areCredentialsValid - 1, m_sendRequestCount - 7
2011-12-22 13:33:38.622 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/private/CHttpRequestProcessor.cpp/137:Received response of request(WebTicketRequest) with status = 0x0
2011-12-22 13:33:38.624 Lync[104:7a27] PERFORMANCE TESTPERF /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/platform/_buildIos/../tracing/privateIos/CMPerfTrace.mm/95:PerfEnd|16|Time=2011-12-22T13:33:38.623|MemoryUsage=26497024|UsedTick=72272.000000|TotalTick=813638.000000|BatteryLevel=0.600000|WifiSent=564560|WifiReceived=1795536|WwanSent=174191|WwanReceived=422959
2011-12-22 13:33:38.628 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebticketRequest.cpp/197:Decoding the WebTicket Response
2011-12-22 13:33:38.630 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebticketRequest.cpp/202:WebTicket RSTR received.
2011-12-22 13:33:38.631 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/422:<ReceivedResponse>
2011-12-22 13:33:38.632 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Connection keep-alive
2011-12-22 13:33:38.633 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Content-Length 1293
2011-12-22 13:33:38.633 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Content-Type text/html
2011-12-22 13:33:38.634 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Date Thu, 22 Dec 2011 19:33:32 GMT
2011-12-22 13:33:38.634 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:MobileLyncInternalUse-x509-CertificateData 0Ç´0Çì†

61Q
2011-12-22 13:33:38.635 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Server nginx/1.0.10
2011-12-22 13:33:38.635 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:StatusCode 401
2011-12-22 13:33:38.636 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:Www-Authenticate NTLM
2011-12-22 13:33:38.636 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:X-MS-Server-Fqdn vmLyncFE.domain.local
2011-12-22 13:33:38.637 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/430:HttpHeader:X-Powered-By ASP.NET
2011-12-22 13:33:38.637 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/435:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>

<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>

<style type="text/css">

<!--

body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}

fieldset{padding:0 15px 10px 15px;}

h1{font-size:2.4em;margin:0;color:#FFF;}

h2{font-size:1.7em;margin:0;color:#CC0000;}

h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}

#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;

background-color:#555555;}

#content{margin:0 0 0 2%;position:relative;}

.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}

-->

</style>

</head>

<body>

<div id="header"><h1>Server Error</h1></div>

<div id="content">

 <div class="content-container"><fieldset>

  <h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>

  <h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>

 </fieldset></div>

</div>

</body>

</html>

2011-12-22 13:33:38.638 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../common/TransportUtilityFunctions.cpp/438:</ReceivedResponse>
2011-12-22 13:33:38.640 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/private/CHttpRequestProcessor.cpp/266:Sending event to main thread for request(0x247dfc0)
2011-12-22 13:33:38.641 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/370:Received webticket resposne with status 570621954
2011-12-22 13:33:38.641 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/1022:Raising WebTicketEvent for https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root and https://lync.sipdomain.com/webticket/webticketservice.svc with status 570621954
2011-12-22 13:33:38.642 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/605:Web-Ticket retrieval for url https://lync.sipdomain.com/autodiscover/autodiscoverservice.svc/root completed with status 570621954
2011-12-22 13:33:38.642 Lync[104:707] ERROR TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/671:Failing the original request as we weren't able to get thewebticket
2011-12-22 13:33:38.643 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestManager/private/CRequestManager.cpp/100:Failing secure request UcwaAutoDiscoveryRequest with status 570621954
2011-12-22 13:33:38.643 Lync[104:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../transportManager/private/CTransportManager.cpp/624:Notifying response of request(UcwaAutoDiscoveryRequest) with status = 0x22030002
2011-12-22 13:33:38.644 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CTransportRequestRetrialQueue.cpp/293:Req. event received: responseErrorCode=E2-3-2
2011-12-22 13:33:38.645 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CTransportRequestRetrialQueue.cpp/870:No more req. timing out
2011-12-22 13:33:38.645 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/973:Received autodiscovery response with status 570621954
2011-12-22 13:33:38.646 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/931:Raising Autodiscovery event with status 570621954 for eventType 0
2011-12-22 13:33:38.647 Lync[104:707] ERROR APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryServiceRetrialWrapper.cpp/348:Auto-discovery failed. Analysing the failure
2011-12-22 13:33:38.647 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryServiceRetrialWrapper.cpp/425:Raising Autodiscovery event with status 570621954 for eventType 0
2011-12-22 13:33:38.648 Lync[104:707] ERROR APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CLogonSession.cpp/1050:Auto-discovery failed, aborting sign-in!
2011-12-22 13:33:38.649 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CLogonSession.cpp/845:CLogonSession::setNewActualState() state=0
2011-12-22 13:33:38.658 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../infrastructure/private/CUcwaAutoDiscoveryService.cpp/361:Serialized sipuri=sip:jeff.barnett@sipdomain.com intUcwa= extUcwa= intADRoot= extADRoot= location=1 networkType=0
2011-12-22 13:33:38.679 Lync[104:707] INFO APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/platform/_buildIos/../persistentStorage/private/CPersistableComponentBase.cpp/191:Storing 3 out-of-sync components took 22ms
2011-12-22 13:33:38.681 Lync[104:707] INFO UI /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/ui/CMAppDelegate.mm/374:UpdateViews
2011-12-22 13:33:38.682 Lync[104:707] INFO UI /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/ui/CMAppDelegate.mm/440:ActualState = IsSignedOut DesiredState = BeSignedIn DataAvailable = 0 Showing UI = CredentialTableViewController
2011-12-22 13:33:38.685 Lync[104:707] INFO UI /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/ui/CMAppDelegate.mm/1088:handling floating views
2011-12-22 13:33:38.685 Lync[104:707] ERROR APPLICATION /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/applicationLayer/_buildIos/../objectModel/private/CAlertReporter.cpp/52:Alert received! Type 16384, level 0, error E2-3-2, context ''
2011-12-22 13:33:38.686 Lync[104:707] INFO UI /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/ui/utilities/CMUIUtil.mm/968:Mapped error message is 'Can’t sign in. Please check your account information and try again.'
2011-12-22 13:33:38.687 Lync[104:707] INFO UI /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/ui/alert/CMAlertViewController.mm/350:alert received type 16384, error 570621954, error string Can’t sign in. Please check your account information and try again.

 

The Mcx test completes successfully from the FE server and I am logged in successfully from the Lync client on my workstation so the credentials are valid for this user account.  Has anyone else run into this issue?

TIA

Is this failing internal and  externally?  What are you using to load balance your web server internally?  i'm trying to take your TMG/ISA server out of the loop.  If you connect directly using wifi, bipassing proxy servers do you receive the same error? 

I get the same 401 error during an internal attempt as well:

 

2011-12-23 07:33:19.323 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpStreamPool.cpp/124:Setting url - https://poolFQDN/webticket/webticketservice.svc persistent id as 31
2011-12-23 07:33:19.363 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 2 for WebTicketRequest
2011-12-23 07:33:19.365 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/462:Received stream event = 16 for WebTicketRequest
2011-12-23 07:33:19.365 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/506:Received kCFStreamEventEndEncountered (WebTicketRequest)isHeadersAvailable = true  responseHeadersHandle = b471cb0
2011-12-23 07:33:19.367 Lync[104:7a27] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestProcessor/privateIos/CHttpConnection.cpp/548:Response status = 401 for request WebTicketRequest

 

I am running a standard edition so I don't have the need for a load balancer.

 

Thanks!

Here are the results showing the Test-CsMcxP2PIM commandlet:

Trying to get web ticket.
Web Service url :
https://poolfqdn:443/WebTicket/WebTicketService.svc
Using NTLM\Kerb auth.
GetWebTicketActivity completed.
'STActivity' activity completed in '2.5029983' secs.
'STActivity' activity started.
Trying to get web ticket.
Web Service url :
https://poolfqdn:443/WebTicket/WebTicketService.svc
Using NTLM\Kerb auth.
GetWebTicketActivity completed.

Is the internal poolFQDN on the certificate or the external Web service name?  I have the pool name on the internal cert and the external web services name on the public cert thats on the TMG box.

I also saw that the sip name (email address) and the UPN need to be the same although I have a few test users that work even though this is different.

Mike

That looks very similar to the error I had which was solved by specifiying the AD Username....

I understand requiring domain/username/password is caused by your UPN (User Principle Name), under the account tab in ADUC being different than your SIP address (email).  I opened Active Directory Domain and Trusts (ADDaT), right-click on the ADDaT and chose properties.  I then added the SIP domains (SMTP Domains) as UPN Suffixes, three in my case, and now they appear under the account tab for each user in ADUC in the dropdown box.  As I enable a user for the Lync pilot I change the dropdown to match their SMTP domain and I dont need to use domain/username/password.  I plan to write a script for full rollout.

 

Mike

• Edited by mniccum Friday, December 23, 2011 8:40 PM

I understand requiring domain/username/password is caused by your UPN (User Principle Name), under the account tab in ADUC being different than your SIP address (email).  I opened Active Directory Domain and Trusts (ADDaT), right-click on the ADDaT and chose properties.  I then added the SIP domains (SMTP Domains) as UPN Suffixes, three in my case, and now they appear under the account tab for each user in ADUC in the dropdown box.  As I enable a user for the Lync pilot I change the dropdown to match their SMTP domain and I dont need to use domain/username/password.  I plan to write a script for full rollout.

 

Mike

• Edited by mniccum Friday, December 23, 2011 8:40 PM

I understand requiring domain/username/password is caused by your UPN (User Principle Name), under the account tab in ADUC being different than your SIP address (email).  I opened Active Directory Domain and Trusts (ADDaT), right-click on the ADDaT and chose properties.  I then added the SIP domains (SMTP Domains) as UPN Suffixes, three in my case, and now they appear under the account tab for each user in ADUC in the dropdown box.  As I enable a user for the Lync pilot I change the dropdown to match their SMTP domain and I dont need to use domain/username/password.  I plan to write a script for full rollout.

 

Mike

• Edited by mniccum Friday, December 23, 2011 8:40 PM

Hi Everyone,

 

I have same issue, any idea about this?

 

Thanks

Hello,

Have anyone been able to troubleshoot the error?

Could not get a webticket

Using NTLM\Kerb auth

Thanks in advance.

rgds

Hi Jeff,

This error message indicates one of the following conditions:

·          The Lync 2010 mobile client can discover the correct Lync Online server. However, it cannot find the sign-in address that was entered by the user.

·          The password is incorrect.

Please use the nslookup command and a public DNS server to determine whether the DNS CNAME record is configured correctly.

If the user has the option, have the user switch between Wi-Fi and 3G to determine whether the issue can be scoped to one kind of connection. If sign in continues to fail on a 3G data connection, although the CNAME DNS records are configured, it may be an issue with the cellular service provider’s data connection.

In addition, please check the proxy setup. For details, see KB2636313, KB2636318 and KB2636320. Hope helps.

All of my private and public DNS entries reference the external pool fqdn for the autodiscover CNAME per the guidance of the Mobility document so allow movement of clients inside and outside of the corporate environment.

I did test the webticket URL (https://external_pool_fqdn/webticket/webticketservice.svc) in my browser and was challanged for credentials.  I attempted several user accounts and all eventually came back with the same 401 unauthorized response.

I then attempted the internal webticket URL (https://poolfqdn.domain.local/webticket/webticketservice.svc) and a page was displayed that I assume was a successful authentication as it had rendered content from the server:

"You have created a service.

To test this service, you will need to create a client and use it to call the service...."

After this I went back to my FE and modified the Mcx configuration to only hand out the internal URL.  I also updated the DNS to resolve the autodiscover back to my internal pool fqdn.  After this I was able to sign in through the iphone over internal wireless.

I am running a non-TMG setup so I will need to do some verification of the config and test external access again, but that's where I stand so far.  I will keep others having issues updated...

For the external pool, try the following, https://external_pool_fqdn:4443/webticket/webticketservice.svc it should work, but do not try to open the url locally on the lyncserver. Try it from another server.

Rgds,

Proactive_Jeff: See my post from last week re: internal URLs. I got it working as well this way, but it's intended to look for the external web services URL (even for the McxInternal parameter) as Jeff Schertz explains exceptionally well.

I was getting a bunch of these as well. It seems like a common issue on the web and no one has an answer for it. Anyway, I ended up testing a few different scenarios and came up with something.

We are running an EE server farm internally and have TMG as a reverse proxy for web services hosted off that farm. In the Access Rule for this service (on the TMG), we have it forwarding to the web farm where we have both servers listed. If I remove the other members of the farm so that only one Lync front end server is listed in there, I have no issues connecting internally or externally. When I add the farm members back in, the mobility app begins exhibiting the same webticket behavior as before as soon as I sign in the next time.

Not exactly sure what's going on here, if one server is getting the request and another is responding or what. Seems strange though. Basically I can only get it to work if I ensure that only one physical front end server is being targetted.

 

We are experiencing the same "401 for request WebTicketRequest" error. The strange thing in our situation is that the Lync Mobile client IS working for Windows Phone and Android but IS NOT working for the iPhone or the Ipad.

While testing the devices are all connected to the exact same wifi network and are proxied to the director via the same UAG box.

 

just checking .. are you using "username@domain.com" as the format of the usrename instead of using "domain\username"?  I had this mixed up recently and recieved the issues with authorization 401 errors.

We are using the email address as the Lync address and the "domain\username" in the username field.
This is working just fine for Windows Phone and Android except for the IOS devices.

Entering the https://external_pool_fqdn/webticket/webticketservice.svc with my credentials returns the service page.
Same goes for the Lyncautodiscover, which al tests succesfull and returns a file download.

All tests from https://www.testocsconnectivity.com/ are also succesfull.  

• Edited by ITmab Thursday, January 26, 2012 8:07 AM

We are using the email address as the Lync address and the "domain\username" in the username field.
This is working just fine for Windows Phone and Android except for the IOS devices.

Entering the https://external_pool_fqdn/webticket/webticketservice.svc with my credentials returns the service page.
Same goes for the Lyncautodiscover, which al tests succesfull and returns a file download.

All tests from https://www.testocsconnectivity.com/ are also succesfull.  

• Edited by ITmab Thursday, January 26, 2012 8:07 AM

We are using the email address as the Lync address and the "domain\username" in the username field.
This is working just fine for Windows Phone and Android except for the IOS devices.

Entering the https://external_pool_fqdn/webticket/webticketservice.svc with my credentials returns the service page.
Same goes for the Lyncautodiscover, which al tests succesfull and returns a file download.

All tests from https://www.testocsconnectivity.com/ are also succesfull.  

• Edited by ITmab Thursday, January 26, 2012 8:07 AM

You don't happen to be using Squid or Apache as a reverse proxy are you?

I had the exact same problems with everything working fine _EXCEPT_ for iOS devices through SQUID.

Since setting up TMG, everything is working fine.

http://social.technet.microsoft.com/Forums/en-US/ocsedge/thread/77752c28-15f0-40b8-b1e0-78c79805239b#6f355b73-8a95-493c-b960-845c211522c6

 

Proactive_Jeff: See my post from last week re: internal URLs. I got it working as well this way, but it's intended to look for the

 

We are running an EE server farm internally and have TMG as a reverse proxy for web services hosted off that farm. In the Access Rule for this service (on the TMG), we have it forwarding to the web farm where we have both servers listed. If I remove the other members of the farm so that only one Lync front end server is listed in there, I have no issues connecting internally or externally. When I add the farm members back in, the mobility app begins exhibiting the same webticket behavior as before as soon as I sign in the next time.

Not exactly sure what's going on here, if one server is getting the request and another is responding or what. Seems strange though. Basically I can only get it to work if I ensure that only one physical front end server is being targetted.

 

it is not supported to use TMG as a load balancing sollution for the Lync Web Services. TMG should publish a VIP on a hardware load balancer and HLB should be using a cookie based persistence.

cookie based persistence on TMG is causing problems for lync mobility, that's why everything works fine when you have just a single server in your webfarm. either leave a single server or switch tmg to source based persistence, but keep in mind, source based persistence would break mobility in certaain scenarios (like hitting another server, because client ip changed after  switching from wifi to 3g for example)

We are using Microsoft UAG 2010 as a reverse Proxy. I'm aqctually guessing that it might be the "http to https" redirect which is causing the issues.
Unfortunately I haven't been able to sort out the native http listner as we are running out op external IP addresses on the box.

ITmab....we seem to be running into the same config issue as you with a 2-node UAG Array, Lync, and iOS login failures....

Were you able to get any further on this?

Unfortunately I haven't had much time troubleshooting this issue, thus far I have been unable to resolve the issue.

After some time I finally managed to get an IP available for publishing the HTTP trunk.
Both HTTP and HTTPS are now available for the iOS clients.

Unfortunately I'm still unable to login with the iOS clients where as WP7 and Android devices work like a charm.

All Basic external tests function as expected:

http: or https://lyncdiscover.domain.com/ both return the file which directs to director
http: or https://lyncdiscover.domain.com/autodiscover/autodiscoverservice.svc/root

https://director.domain.com/webticket/webticketservice.svc prompts for credentials when opened externally

The Webservice is set to negotiate mode.

2012-02-27 14:56:26.518 Lync[10161:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../webTicket/private/CWebTicketSession.cpp/1022:Raising WebTicketEvent for https://director.mab.com/autodiscover/autodiscoverservice.svc/root and https://director.mab.com/webticket/webticketservice.svc with status 570556417
2012-02-27 14:56:26.519 Lync[10161:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/605:Web-Ticket retrieval for url https://director.mab.com/autodiscover/autodiscoverservice.svc/root completed with status 570556417
2012-02-27 14:56:26.520 Lync[10161:707] ERROR TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../authenticationResolver/private/CAuthenticationResolver.cpp/671:Failing the original request as we weren't able to get thewebticket
2012-02-27 14:56:26.521 Lync[10161:707] INFO TRANSPORT /Users/comobuildadmin/se_wave1_idx/src/dev/CoMo/transport/_buildIos/../requestManager/private/CRequestManager.cpp/100:Failing secure request UcwaAutoDiscoveryRequest with status 570556417

To exclude the certificate from being an issue I even installed the Root CA of Geotrust on the IPad with the Iphone Config utility.

Hi,

Try changing the security method in CSCP to negotiate, other than the NTLM. IOS client will not authenticate without it.

Hi,

The security method in the CSCP (Security, Web service, Global) is set to negotiate.

Hi,

We have the exact same issue.

UAG 2010 SP1 Update 1.

Lync 2010 CU4, Web Service security is set to Negotiate.

All mobile devices work except for iOS.

When connecting IPAD to the internal network I can connect using the Lync App, but not from outside.

Any idea?

Applied CU5 yesterday and unfortunately the issue still persists.

Apple has released an update to the client.

After applying it everything works like a charm

• Proposed as answer by amatzia Tuesday, March 20, 2012 2:51 PM

Apple has released an update to the client.

After applying it everything works like a charm

• Proposed as answer by amatzia Tuesday, March 20, 2012 2:51 PM

Apple has released an update to the client.

After applying it everything works like a charm

• Proposed as answer by amatzia Tuesday, March 20, 2012 2:51 PM

I can indeed confirm that after applying the Lync IOS client update the IOS devices now also work like a charm.
Finally we can deploy Lync to our iPhone & iPad clients just like the Windows Phone and Android users.

I have same problem :(

could not get a web ticket

do you resolve problem?

I have same problem...

My internal domain is "int.domain.com" and my external domain "domain.com.br", if user is user@int.domain.com.br login successfull, but user@domain.com.br fail.

Fail: Received webticket resposne with status 570621954

Success:Received webticket resposne with status 0

Help-me Please

Can you elaborate a little more?

what sip address is configured for the user?

what UPN suffix is configured for the user?

what is configured in your SRV records?

Sip address is user@domain.com

UPN Sufix is int.domain.com

DNS:

int.domain.com

• _sipinternaltls._tcp 5061
• adminlync
• dialin
• lyncdiscover
• lyncdiscoverinternal
• meet
• sip

domain.com

• _sipinternaltls._tcp 5061
• adminlync
• dialin
• lyncdiscover
• lyncdiscoverinternal
• meet
• sip

All of my private and public DNS entries reference the external pool fqdn for the autodiscover CNAME per the guidance of the Mobility document so allow movement of clients inside and outside of the corporate environment.

I did test the webticket URL (https://external_pool_fqdn/webticket/webticketservice.svc) in my browser and was challanged for credentials.  I attempted several user accounts and all eventually came back with the same 401 unauthorized response.

I then attempted the internal webticket URL (https://poolfqdn.domain.local/webticket/webticketservice.svc) and a page was displayed that I assume was a successful authentication as it had rendered content from the server:

"You have created a service.

To test this service, you will need to create a client and use it to call the service...."

After this I went back to my FE and modified the Mcx configuration to only hand out the internal URL.  I also updated the DNS to resolve the autodiscover back to my internal pool fqdn.  After this I was able to sign in through the iphone over internal wireless.

I am running a non-TMG setup so I will need to do some verification of the config and test external access again, but that's where I stand so far.  I will keep others having issues updated...

Hi,

I was facing the same problem with Windows Phone 8 devices.

I was able to obtain the web ticket internally (FrontEnd.domain.com), but not externally (lyncWebExt.domain.com).

I have a reverse proxy with ARR, and here was the problem. I haven't check the Keep Alive in the proxy option in ARR. After checking it, i was able to connect with 2010 and 2013 clients in Windows phones.

Best regards,

mikanke

Hi Makanke

You mean the "Keep Alive" option in each one of the rules of the ARR Proxy? or is there any Global option somewhere else that you checked?

Regards,

Jorge

• Edited by Jorge Salinas Wednesday, April 02, 2014 11:07 PM

I solved by installing IIS Application Request Routing (ARR) 3

I'm using Windows Server 2012 R2 for the Reverse Proxy

I could never make it work with ARR 2.5 (included the patch)

Hope it helps..!

You Jorge - ROCK!

I've been troubleshooting this for 2hours and simply updating AAR from 2.5 to 3.0 made iOS work instantly!

Thank you sir, 

Lewis