Android Skype for Business issue with Exchange iApp

What is the backend environment? Are you pure Exchange 2013, or Exchange 2013/2010 co-existence?

2 x Exchange 2013 CAS servers Update: If I change my Exchange profile >> Exchange Web Service >> Front End Authentication from Basic-NTLM to Basic I manage to get the calendar information in the Android app but still having the error message about

We had some similiar issues when we stood up our Exchange 2013 environment recently. Here are some troubleshooting steps that might help; 1. Take a tcpdump on the F5 capturing the login attempt from a single device (filter to the host). 2. Check the tcpdujmp, along with the debug logs from Skype for Android for both the autodiscover, and the login call. 3. Validate that both Autodiscover, and EWS services are set to support baisc authentication *For number 3, this is critical. It is a limitation of the Skype mobile client that only basic authentication is supported, no other method will work.

Thanks for the response. 1. I tried that with F5 support but I could not decrypt the output with ssldump tool. It appears I need to use a differen cipher in order to be able to do that. 2. What do you mean debug logs from the Skype for Android, how can I get that? 3. As I mentioned, EWS had Basic+NTLM enabled, which didn't work. When I changed to Basic only, it seemed to work partially but still gives an error. How did you eventually resolve your issues?

On a pre-v12.0 system, go to System ›› Logs : Configuration : Options and enable Debug for Access Policy and SSO. On v12 and later, click Access Policy ›› Event Logs : Log Settings, select the log-settings you have assigned to your virtual, click Edit>Access System Logs, and make sure Access Policy, SSO, and ECA are checked. Then you can do a 'tail -f /var/log/apm' to see what APM is doing with those requests.

Correction on that...on v12, you assign the log-settings on the Logs tab under Access Policy ›› Access Profiles : Access Profiles List>.

Thanks. Access Policy, SSO and ECA are set to Notice, I guess I need to set Debug

Correct. If you don't have access to the cli then you can see these messages in the GUI via Access Policy ›› Manage Sessions. Once you find the Android client session, you can click on it and drill down into the reports to view debug messages for that session.

I did the debug but still not able to get to the bottom of it. If the EWS auth is set to Basic+NTLM I see this in the logs: ~~~ 2016-04-27 19:23:59 /Common/exchange_external:Common:aed70e0a: Following rule 'Successful' from item 'NTLM Auth Result' to item 'SSO Credential Mapping' 2016-04-27 19:23:59 /Common/exchange_external:Common:aed70e0a: CREDENTIAL MAPPING agent: Master encrypt failed, null plain password ~~~ If it is set to Basic, the logs look normal, but the Android agent still gives the error message that it can't connect to server.