Lync 2013 Certificate type: "OAuthTokenIssuer"

When requesting certificates in a Lync 2013 you will notice a new certificate type called “OAuthTokenIssuer”. OAuth stands for “Open Authentication” and is a protocol for server-to-server authentication and authorization. OAuthTokenIssuer certificate is a global certificate. Exchange 2013, SharePoint Server, and Lync Server 2013 support server-to-server authentication.  If you are not running one of these servers then you will not be able to fully implement OAuth authentication. Authentication and authorization is based on the exchange of security tokens; these tokens grant access to a specific set of resources for a specific amount of time. Lync Server 2013 must be able to securely communicate with other applications and server products. You can configure Lync Server 2013 so that contact data is stored in Exchange Server 2013; however, this can only be done if Lync Server and Exchange are able to securely communicate with one another. Although it's possible to use one authentication mechanism for Lync-to-Exchange communication and a separate mechanism for Lync-to-SharePoint communication, a better and more efficient approach is to use a standardized method for all server-to-server authentication and authorization. When you assign this OAuth certificate, it is replicated via the CMS and is assigned to all of the Lync Server 2013 servers that require OAuth. So when requesting the OAuthTokenIssuer certificate in Lync Server 2013, you will only request it once and CMS will replicate it to the other servers

To determine whether or not a server-to-server authentication certificate has already been assigned to Microsoft Lync Server 2013, run the following command from the Lync Server 2013 Management Shell: Get-CsCertificate -Type OAuthTokenIssuer

If no certificate information is returned you must assign a token issuer certificate before you can use server-to-server authentication. Any Lync Server 2013 certificate can be used as your OAuthTokenIssuer certificate: For example, your Lync Server 2013 default certificate can also be used as the OAuthTokenIssuer certificate. The OAUthTokenIssuer certificate can also be any Web server certificate that includes the name of your SIP domain in the Subject field. The primary two requirements for the certificate used for server-to-server authentication are these: 

1. The same certificate must be configured as the OAuthTokenIssuer certificate on all of your Front End Servers
2. The certificate must be at least 2048 bits.

If you do not have a certificate that can be used for server-to-server authentication you can obtain a new certificate, import the new certificate, and then use that certificate for server-to-server authentication.

Ref: http://technet.microsoft.com/en-us/library/jj205253
http://technet.microsoft.com/en-us/library/jj204817%28v=ocs.15%29

ACL Error when Publishing Lync 2013 Topology

When Publishing Lync 2013 Topology you may come across this permission error.
 
Error Description in Log file:

Failed Adding “Access Write” permission for “RTCHS Universal Services” on “share”. Access control list (ACL) might fail on UNIX files shares. Refer to the deployment guide to manually set the ACLs in the file share.

This is due to a permission's error on your LyncShare. The fix is to give Full Control access on the “Share tab”, not the “Security” tab.

1. Right Click your Lync File Share
2. Select Properties
3. Go To Sharing Tab
4. Select Advanced Sharing
5. Select Permissions
6. Add Full/Change/Read permissions to the follow Groups:
7. RTCHS Universal Services
8. RTC Component Universal Services
9. RTC Universal Server Admins
10. RTC Universal Config Replicator
11. Click OK
12. Republish Topology

The New Lync Connectivity Analyzer

Here is the new Microsoft Lync Connectivity Analyzer. This tool will help Lync administrators determine whether the deployment and configuration of their on-premises Lync Server environment meets the requirements to support connections from Lync Windows Store app and Lync mobile apps. Lync Connectivity Analyzer will help you test and troubleshoot connections to your on-premises servers from these apps. You can perform the connection tests over your internal network or over an external network that connects to Lync Server. Lync Connectivity Analyzer provides a report with detailed information about each connection step, with links to online documentation when a test fails.

To obtain the Lync Connectivity Analyzer, visit the Microsoft Download Center:

• Microsoft Lync Connectivity Analyzer (32 Bit)
• Microsoft Lync Connectivity Analyzer (64 Bit)

New set of Visio stencils for Exchange, Lync and SharePoint 2013

The much anticipated release of the new Visio stencils are here. I will also post the link to the downloads on my "Links" page. This download contains more than 300 icons to help you create visual representations of Microsoft Office or Microsoft Office 365 deployments including Microsoft Exchange Server 2013, Microsoft Lync Server 2013, and Microsoft SharePoint Server 2013.

SharePoint, Exchange, Lync and Office 2013 Link to download
Exchange 2013 - Link to download

Lync 2013 call forwarding - Issues with Call Forwarding

Are you in the middle of deploying a new SIP trunk deployment and having troubles with Lync 2013 call forwarding. The common problem is not allowing you to forward any calls to your cellphone, use call forwarding or simring. The first item you want to check is that EnableSipRefer is set to $False cmdlet: CsTrunkConfiguration -EnableReferSupport $False.