I recently hit a problem with CWA being published behind TMG, CWA was accessible internally from a terminal server but would throw the above error when login was attempted via TMG’s reverse proxy.
The solution (for me – there is a fair bit written about this involving SPNs which were not the issue in this case), was to enable anonymous authentication on the AuthMainCommandHandler.ashx file (within the /cwa directory) within IIS & all is well again, it is reported that this issue only occurs on Server 2008 & is an issue with the site creation wizard.
My colleague Simon also hit this issue publishing CWA behind UAG, so worth checking.
February 10th, 2010
neilc
Found this useful link on a blog by the good people at communicationsserverteam.com and thought it was worth a mention.
Article: http://communicationsserverteam.com/archive/2010/01/25/726.aspx
Basically free high-level overview for following features:
- Instant Messaging
- Presence
- Contact Management
- Audio and Video
- Desktop Sharing
- Office Application Integration
- Add a Live Meeting
- Communicator Web Access
You can register for these sessions on the following link:
https://events.livemeeting.com/967/15027/reg.aspx?pc=05
Neil Cruickshanks
looks like no-one else has mentioned this here so I’ll get in first 
The OCS product group have announced an online tool you can use to test your OCS connectivity from the Internet. Nice and useful if you are testing a deployment and don’t have a spare line/3g card fro testing from the outside.
it’s here https://www.testocsconnectivity.com/
