Disclaimer - this isn't my area of expertise, I'm learning as I go, if I need to adjust level of detail here or redact information please let me know, no offense intended.
Customer needed to pass a PCI scan and the last high item was that when certain HTTP message were sent to the CAS server (really just blasted at the IP which happens to host the CAS server/exchange backend), without a URL specified, it was still responding with a message that disclosed its internal IP.
The fix (at least to pass the scan) - was to add a 'binding' in IIS for the 'default web site' which houses CAS and is currently the only listener for HTTPS/443 structured as:
- Type - HTTPS
- Hostname - CASFQDNHERE
- Port - 443
- IP Address - *
Although the scan now passes (presumably because when the unqualified header comes in there's no matching binding - before there was a binding as mentioned above that had no value in the 'hostname' field), users have reported a popup prompting them to sign in from outlook. When they enter credentials, it just keeps reprompting them. If you close the prompt, it stays away for a variable length of time but will eventually re-pop. Mail delivery is un-impacted.
I've already tried removed cached credentials from credential manager and having the user input fresh credentials to no effect.
Very much looking forward to any feedback / help - thanks in advance!!