Can OWA Replace the Outlook Client and the VPN?

IPAQ2000 writes "This past week, I attended a panel discussion sponsored by Microsoft and other major players in the space. One of the ideas brought up by one of the expert panel attendees from a company called Seaside Software claimed that large organizations should rely mainly on Outlook Web Access (OWA) for Exchange 2K access for remote users. He claimed that OWA access with SSL makes it perfect for secure access and saves the hassle of the VPN client support. I can see how avoiding the VPN client and the Outlook client together on desktops around large organizations (like mine) could be a good thing (by saving money), and how moving to OWA for remote users makes sense. In fact, it looks like MS themselves are putting much more emphasis on the browser in Exchange 2003 (OWA and Outlook are almost identical) so that users can run whatever version is appropriate for their needs, according to connectivity speeds, location, etc. There was a discussion regarding mobility and remote solutions in the enterprise. I thought that this might be a good subject for a Slashdot discussion, especially as it relates to Exchange. What do you think about OWA as main way of accessing Exchange, especially as OWA keeps getting richer with each version of Exchange?"

Comments

Not as great as it looks

[DetrimentalFiend]

I just used this today at work (we have the latest version of exchange) and it's really a pain compared to outlook. I'm sure as they add features and functionality it'll be nicer (and it's sure nicer from a management standpoint), but I'm still not thrilled with the interface. Currently we have everyone in the office running normal outlook with a few people (including us IT staff) trying out the web version of exchange when needed.

Re:Not as great as it looks

[Jeremiah Cornelius]

Here are some of the problems with OWA:

* IIS must be secured against cross-site and Unicode attacks. In reality, this means URLScan and IISLockdown. URLScan often makes undeliverable, messages which can be accessed via the Outlook 'fat' client. Example: the message with a subject-line 'This is the Visio...' will be acceptable to Outlook. OWA will turn this subject-line into the document name at the end of a URL. URLScan sees 'https://(fq.servername)/exchange/This is the Visio....msg', and parses the sequence of four 'dots' as a possible directory traversal. Access is denied! User sees a 404, big PITA. Expect lots of tech support calls on issues similar to this one.

* All the groovy advanced features are supported only under IE. Other browsers get a functional, if unexceptional subset. There is no activeX plugin or anything - MS just uses nifty, DHTML and VBScript for drag-n-drop, etc. in OWA. The server-side ASP on OWA effectively generates a different, alternate interface for non-IE clients.

Weigh your options, and see if it isn't better to publish Exchange access through an SSL-style VPN appliance like Neoteris or Aventail.

Cross Platform as well as remote users

[elliotj]

Considering that a native OS X Outlook client is the one major app that makes it annoying to use a Mac on a Windows network, improvements in OWA are very welcome.

Up to this point, OWA hasn't been an acceptable subsitute for me, but I would like it to be. It's lightweight (esp. compared to Outlook), cross platform and definitely better in X2K than it was in X5.5.

I wonder what MS will have as the additional features you get in 'real' Outlook as OWA gets better. I have heard they're considering a native OS X Outlook client, but I'm not holding my breath.

This would be great for cross platform users. One of the reasons people like the mac is that you can use Office on a unix workstation, but without Outlook, it's still slightly kludgy.

VPN not used for just Outlook though

[SpaFF]

While this seems a feasable idea for people who use VPNs just for outlook, sometimes you need a VPN connection because you need a "workplace" IP. Many organizations have websites, fileshares, etc. which are only available if you are trying to access them from an IP address that is on the local network.

Also AFAIK OWA doesn't let you do things like set up filtering rules, personal folders, and other things that the Outlook client allows you to do.

OWA isn't that great

[Bishop]

Ofcourse MS is pushing OWA over SSL. MS does not have a good VPN product.

I have used both Outlook and OWA. I did not like OWA. I found that OWA was slow. Meeting reminders did not work. Autosave was tempremental. I lost a few emails when OWA lost its connection to the server (the fault of my ISP). In short useing real Outlook was better.

There are also security risks with OWA. Unless you outfit every user's browser with a SSL cert then a user can use any web browser to read their email. Before you know it you have your users checking their coporate email from Internet cafes and other insecure places. Furthure an attacker would like nothing better to do then start guessing at passwords and reading coporate email.

If you are going to manage SSL certs you might as well go whole hog and run a VPN. A VPN provides both security and an additional ammount of control to system administrators.

As others have written accessing the intranet is more then just access to email. VPNs also allow users to access file servers, and company internal webservers.

VPNs work and provide your users with more then just email. OWA over SSL is a hack.