Office Communicator Web Access (CWA) enables users who have not installed the Office Communicator client to sign in to Office Communications Server by using a Web browser. Table 3-6 lists the platform and browser matrix that Communicator Web Access supports.

The CWA server role must be installed on a computer joined to your Active Directory forest, because it needs Active Directory connectivity to authenticate and authorize user access. CWA can be deployed for users inside and outside the organization’s network.

CWA supports forms-based authentication, integrated Windows authentication (IWA), or custom authentication. Forms-based authentication can be used for external users. IWA refers to the native authentication protocols Kerberos and NT LAN Manager (NTLM) that are supported by Active Directory. IWA is supported only for internal usage. Custom authentication enables administrators to use a third-party authentication system to enable single sign-on or two-factor authentication. Custom authentication can be used for both internal and external users. After the user is authenticated, CWA determines the user’s home server and registers the user. Because the home server trusts the CWA server, no further authentication is performed. CWA then proxies all traffic to and from the user’s home server, as shown in Figure 3-8.

Figure 3-8. Internal deployment of CWA

The process illustrated in Figure 3-8 is as follows:

Collocating CWA on the same physical computer as another supported server role will diminish the overall performance of your server. Most customers in smaller deployments collocate CWA with a Director to avoid the cost and management of another physical server. If you have deployed Office Communicator to all your users, usage of CWA is likely to be light enough for a Director to handle because Office Communicator will be the primary client.

When making CWA accessible from outside your organization’s firewall, it is strongly recommended that you secure your CWA server by using a reverse proxy such as Microsoft Internet Security and Acceleration (ISA) Server 2006 in your network perimeter. When configuring CWA for external access, you should use port 443. This topology is illustrated in Figure 3-9.

Figure 3-9. External deployment of CWA

Table 3-7 lists the system requirements for CWA, including supported browsers.