FIX: "You have attempted to access a restricted URL" error when you try to access OWA and are close to the idle session time-out period

Applies to: Forefront Unified Access Gateway 2010

Symptoms


You try to access the Microsoft Outlook Web App (OWA) through Microsoft Forefront Unified Access Gateway 2010. If you are close to the idle session time-out period, you do not see the session time-out warning message. Instead, you receive the following error code 109 message:
You have attempted to access a restricted URL.

Additionally, you may receive the following error code 152 message:
You are not a member of an ADFS group.

Note This problem occurs only if you have an HTTP redirect trunk and if users access Forefront Unified Access Gateway by using this trunk instead of going direct to the HTTPS trunk.

Cause


This problem occurs because the SessionTimeout.asp file includes DetectionParams.inc. This include file contains code that retrieves session information by using your Unified Access Gateway session cookie. When these conditions are met, the code tries to use the HTTP session cookie instead of the HTTPS session cookie. Therefore, the required session information is not found.

Resolution


This problem is fixed in Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 4.

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References


Learn about the terminology that Microsoft uses to describe software updates.