Microsoft Exchange Server 2013 : Accessing and using Exchange Admin Center (part 2) - Authenticating and proxying connections

When you access Exchange Admin Center in a browser, a lot is happening in the background that you don’t see. Although you access the application using a specific Client Access server in your organization, Client Access servers themselves only act as front-end proxies. They authenticate and proxy connections for Mailbox servers, and the Mailbox servers perform the actual back-end processing. To understand this process better, consider the following scenario:

You’re an administrator for Pocket-consultant.com, which has three Client Access servers (CAServer11, CAServer23, and CAServer42) and two Mailbox servers (MailServer18 and MailServer26). Your mailbox is located on MailServer26. When you log on to Exchange Admin Center using https://casserver23.pocket-consultant.com/ecp as the access URL, CAServer23 authenticates your request and proxies the connection to MailServer26. Any administration tasks you perform are processed on MailServer26 and the results are passed back to you via CAServer23.

As shown in Figure 2, you can examine the configuration settings for Exchange Admin Center and other applications using Internet Information Services (IIS) Manager. The Client Access server to which you connect processes your remote actions via the ECP application running on the default website. The physical directory for this application is %ExchangeInstallPath%\ClientAccess\Ecp. This application runs in the context of an application pool named MSExchangeECPAppPool. In the %ExchangeInstallPath%\ClientAccess\Ecp directory on your server, you’ll find a web.config file that defines the settings for the ECP application.

Figure 2. Viewing the applications that handle Exchange processing.

The Mailbox server where your mailbox resides performs its tasks and processing via the ECP application running on the Exchange Back End website. The physical directory for this application is %ExchangeInstallPath%\ClientAccess\Ecp. This application runs in the context of an application pool named MSExchangeECPAppPool. In the %ExchangeInstallPath%\ClientAccess\Ecp directory on your server, you’ll find a web.config file that defines the settings for the ECP application.

Because the Client Access role and the Mailbox role can be installed on the same server, the Client Access server to which you connect and the Mailbox server where your mailbox resides can actually be the same physical server. In this case, the proxying between front-end and back-end services uses the same technique but involves only a single server.