Neruna Join the beta

Guides · For admins

Connecting Exchange (EWS)

Neruna Desktop talks to Exchange 2013 or later via Exchange Web Services: mail, calendar and contacts – directly or behind a reverse proxy with a client certificate.

Requirements

  • Exchange 2013, 2016, 2019 or Subscription Edition. For Exchange Online (Microsoft 365) there is a separate account type with the Microsoft sign-in.
  • EWS is allowed for the mailbox (Get-CASMailbox anna | fl EwsEnabled).
  • The address https://server/EWS/Exchange.asmx can be reached from the computer via HTTPS.

Setting up in Neruna

  1. Add account → Microsoft Exchange (EWS).

  2. Server: the host name is enough (mail.example.com), Neruna adds /EWS/Exchange.asmx. Enter other paths as a full address. Left empty: Neruna looks for the address in the domain's configuration and in Neruna's directory.

  3. User: anna@example.com (UPN) or COMPANY\anna; empty = e-mail address.

  4. Neruna checks the connection before saving; mail, calendar and contacts then come as one account.

Sign-in

Automatic
What the server offers: Kerberos/NTLM (Negotiate) or Basic. On Linux and macOS without extra packages.
Basic
Right away with user name and password, without the server asking. For reverse proxies that do not pass NTLM through.
Client certificate only
No password: the proxy checks the client certificate and signs in at Exchange (e.g. with Kerberos constrained delegation).

Reverse proxy with client certificate

If the proxy in front of Exchange requires a certificate, choose it in the account under “Client certificate”: from a file (.p12/.pfx – Neruna keeps it with its password in the computer's keychain, not in the database) or, on Windows and macOS, straight from the user's certificate store, smart cards included. Neruna presents the certificate as soon as the proxy asks for it – even if the proxy's list of accepted issuers does not name it.

The proxy has to pass /EWS/ through, long requests included. NTLM needs the same connection for several requests; if the proxy does not keep it, choose “Basic”.

What is synced

Email
Folders and mail (the newest 2000 per folder, older ones on request), read, flagged, answered; search on the server. New mail every minute.
Calendar
Calendars with series and their exceptions. Exchange sends invitations, acceptances and declines itself.
Contacts
Contact folders with name, company, three e-mail addresses, phone numbers, addresses, note and birthday.

Not yet: shared mailboxes and public folders, out-of-office reply, distribution lists, contact photos.

Checking and troubleshooting

If the address answers with 401, EWS is reachable and asks for a sign-in:

curl -sI https://mail.example.com/EWS/Exchange.asmx
curl -sI --cert-type P12 --cert client.p12:password https://mail.example.com/EWS/Exchange.asmx
401
User name or password wrong – or the proxy does not pass NTLM through: try “Basic”.
400 / 403
The proxy requires a client certificate or does not accept the chosen one.
404
Wrong address – the usual one is /EWS/Exchange.asmx.
TLS
Server certificate error: for test servers the account offers “Accept any server certificate”.

So that Neruna finds the address itself: have the EWS address added to Neruna's directory (info@neruna.org) or put it in your own autoconfig file as <incomingServer type="exchange"> with <ewsURL>.