Website under construction

1.
The user attempts to access a published web application through a telephone client. 
2.
The app sends an HTTPS request to the URL published by Web Application Proxy. 
3.
If the request does not contain credentials, Web Application Proxy returns an HTTP 401 response 
to the app containing the URL of the authenticating AD FS server. 
4.
The user sends the HTTPS request to the app again with authorization set to Basic and user name 
and Base 64 encrypted password of the user in the www-authenticate request header. 
5.
Because the device cannot be redirected to AD FS, Web Application Proxy sends an authentication 
request to AD FS with the credentials that it has: user name, password, and, if available, device 
certificate. The token is acquired on behalf of the device. 
6.
To minimize the number of requests sent to the AD FS, Web Application Proxy validates 
subsequent client requests by using cached tokens for as long as the tokens are valid. Web 
Application Proxy periodically cleans the cache. You can view the size of the cache by using the 
performance counter. 
7.
If the token is valid, Web Application Proxy forwards the request to the server backing the service 
and the user is granted access to the published web application. 
To do this, go back to the ADFS01 server and create a nonclaims-aware relying party for ActiveSync, 
as depicted in Figure 2-79. 
Figure 2-79:
Relying party trusts 
Next, go to the WAP01 server, publish the ActiveSync application by using HTTP Basic, and then select 
the ActiveSync nonclaims-aware relying party, as shown in Figure 2-80. 
Figure 2-80:
Supported clients 
Note that this relying party is visible only when a nonclaims-aware relying party has been defined on 
the AD FS server, as demonstrated in Figure 2-81. 

---

79 
CHAPTER 2 | Software-defined datacenter 
Figure 2-81:
Relying party options 
Complete the remainder of the wizard, configuring the external and server URL backing the service. 
The end result is shown in Figure 2-82. 
Figure 2-82:
All published web applications 
Notice that the Microsoft ActiveSync published application uses the AD FS For Rich Clients 
preauthentication method.