By default, UAG is configured to protect the web servers from
. This is viewed when you click on Edit for the Application and going to
Web Server Security
. This is listed under
Maximum size of POST request
By default, UAG allows a maximum of 49152 bytes for the POST request as per this setting for the shown content types. And what we noticed in the falling request in the UAG traces is that the Post Data Length on this request was 100933 (was higher than the default limit on UAG). The content type, in the case, was application/progressive-report. So, to overcome the issue, we added this content type on the UAG Server smuggling protection settings and increased the maximum size of POST request to a value that would accommodate the request. For testing in our environment, we just changed it to 491520 as it would have covered the Post Data Length of 100933. You would need to do more analysis to see what would fit your needs without over exposing your deployment from an attack perspective, but still allow your site to function.
This allowed the Export to succeed.
We then ran into an issue where when loading up the PowerPoint document, we would see the static image and not the
button. It is not able to communicate the proper responses when going through the UAG/ADFS. We also do not get prompted for credentials. If we look at the properties of the item on the sheet, we can see that this is the Silverlight ActiveX control and it is set to go to the XAP.
Web Application Proxy (WAP)
Exporting to PowerPoint itself did not have any issues, or additional configuration, when using WAP. Unfortunately, when trying to run the PowerPoint document, we still did not have the
button going through WAP. This is because going through WAP it was as if it was pure Forms Auth. Even looking at a Fiddler, the response back from the server was the form to get the login credentials. The Silverlight control doesn’t prompt for the credentials, and no really way to do that when it is wanting a web form.
The takeaway on this one is that we can get it to successfully export the report to a PowerPoint document, however, within the document itself, you will only have the static image of the report and not the interactive aspects of the report.