See below where we are closing an opportunity as LOST .

  Now, when we close it , it pops us with a separate window for close opportunity as shown below:-

We were trying to achieve this with out of the box workflow feature in CRM and every time we receive an email the description used to come as NULL. Soon, we isolated that the description field where we enter the data when an opportunity is lost,  is not the same “description” field that you see in Opportunity entity record form and add in your OOB workflow.

This description field is stored in ActivityPointerBase and not opportunity base and the entity we refer here is CLOSE OPPORTUNITY.

Researched and tried few things further and it was confirmed that this is not possible through OOB workflows to fetch this description field that you fill when an opportunity is lost .

We need to develop a custom plugin to achieve this requirement.

This is because the Opportunity entity has a 1:N relationship with the Opportunity Close entity, and you cannot access the 'N'  (related) records through the workflow.

 SOLUTION

• Thus, we created a very simple logic as how we can achieve this. Most of you must have had already achieved it but thought of sharing it on public forum so that it can help everyone.
• Firstly, we need to add one extra field to the Opportunity Entity –say  new_closingdescription.
• The Close Description field is to be added to the “Closed Opportunities” or “Won Opportunities” or “Lost Opportunities” views when you want to test if your code worked.
• Note that these fields do not need to be present on the Opportunity form.
• Next we need to create a simple plug-in which will run on "post-create" of an "Opportunity Close" record to copy the data from the Opportunity Close to the related Opportunity record.
• I have tested it in CRM 2013 and it works fine
• If you want to make it work for CRM 2015  make sure you add the dlls from CRM 2015 SDK as in my case I have added CRM 2013 SDK
• Below is the code for the plugin :-

                 using System;

                 using System.ServiceModel;

                 using Microsoft.Xrm.Sdk;

                 using Microsoft.Xrm.Sdk.Query;

                 namespace Microsoft.Mervynr.OpportunityClose

                             {

                                  public class OptyClose: IPlugin

                                     {

                                           void IPlugin.Execute(IServiceProvider serviceProvider)

                                                 {

                                                         IPluginExecutionContext context = (IPluginExecutionContext)serviceProvider.GetService(typeof(IPluginExecutionContext));

                                                         IOrganizationServiceFactory factory = (IOrganizationServiceFactory)serviceProvider.GetService(typeof(IOrganizationServiceFactory));

                                                         IOrganizationService service = factory.CreateOrganizationService(context.UserId); 

                                                         Entity entity = (Entity)context.InputParameters["Target"];

                                                         var description = entity.GetAttributeValue<string>("description");

                                                         var opportunityId = ((EntityReference)entity.Attributes["opportunityid"]).Id;

                                                         Entity opportunity = service.Retrieve("opportunity", opportunityId, new ColumnSet(new string[] { "new_closingdescription" })); 

                                                         opportunity["new_closingdescription"] = description;

                                                         service.Update(opportunity);

                                                }

                                    }

                          }

I have also attached my complete solution in this blog , if you would like to directly exact the dll and the field name created is new_closingdescription

I hope this blog as well helps others who are trying to achieve this and are not developers so that you can directly use this dll , register it in CRM and start working :)

Plug-ins.zip

Now, with latest release of CRM 2013 SDK Microsoft has provided a tool to achieve this and by which we will be able to export and import the duplicate detection rules using DataMigrationUtility.exe

We do not have any functionality in CRM in UI to export the duplicate detection rule or create a solution for it.  

• Download the CRM 2013 SDK from following link :-  

             https://www.microsoft.com/en-in/download/details.aspx?id=40321 

• Extract it and then go to tools folder  
• Remember the duplicate detection rules have to be unpublished before the export. 
• We will see a folder "CRM Configuration Migration". Open DataMIgrationUtility.exe tool.

Now follow below steps:  

1. Disable all duplicate detection rules from the organization you would like to export the duplicate detection rules from.
2. Next, open the tool you will see below screen:- 

3. Click on Create Schema and then continue, it will give us a login page. Make sure  we check on "Display list of available organizations"

4. Now based on your deployment select enter the details and login. Once it gets connected to the deployment we can select the organization we would like to export the rules from.

5. Once we select an organization it will ask us to select the solution and the Entity .
6. Then in drop down select  Entity as "DUPLICATE DETECTION RULES".  

7. Next, select all and say add fields and add entity

8. Similarly, add "Duplicate Rule Condition" as well  in SELECT Entity drop down and select all and say ADD Fields. Now, you should finally see like this:-

Then click on SAVE and then it asks you would you like to export the data--> Say YES and then you see below:-

9. Save it in some location 

10. And say EXPORT

11. Next it will show you progress as follows :-

12. It will notify once it is complete. This way we will get the schema file exported that we can import in any organization and get the duplicate detection rules.

IMPORT

Now, once we have the schema file we can import it to any other organization  :-  

Open tool again , select display all organization and login Select the organization we want to import duplicate rules in :-

Hope this helps all CRM users who were waiting for this feature in CRM for a long time!

SOAPUI tool is a third party tool. It is a quick simple tool to allow you to start testing your SOAP calls with very little effort. I have seen our Microsoft Dynamics CRM users using this a lot and recently I worked with one of my partners where he was using this tool all fine in CRM 2011 until he started using CRM 2013 and tested this tool and it failed with different errors.

I tried looking for information around this tool with regards to Dynamics CRM but found very few blogs and information around it. This is not a Microsoft built tool neither we(Microsoft) support it but I thought sharing by experience on this tool would be worth writing as it might help many of you who are using this tool and if they come across these error. Most of the articles talk about how to use it and all its steps but none mention about the issue you would face while connecting it for the first time.

How it works ?

To start with we grab the CRM .wsdl from our CRM application, which can be downloaded from the ‘Organization Service’ link under Settings---> Customizations ---> Developer Resources. Once we have this we should be ready to create a new SOAP UI project, by consuming the .wsdl we just  downloaded.

Open SOAP UI, and select ‘New Project’ from the File menu. In the ‘New SOAP Project window’, add a project name and open the organization.wsdl you just downloaded.  

In this tool  you will need to create the 3 headers that will be included when using Client side code. We can do this by expanding the Headers section on the bottom of the screen, and then by clicking on the ‘+’ icon to add each of the following headers. (For this call, I have taken example of  EXECUTE, so we will use ‘Execute’ as our action, but this would change depending on the action we want to use) 

Headers:

SOAPAction: (e.g. https://schemas.microsoft.com/xrm/2011/Contracts/Services/IOrganizationService/Execute as we are using execute method)

Content-type: text/xml; charset=utf-8

Accept: application/xml, text/xml, */*

Then we also choose the Auth for it to connect to CRM server. We have 3 options in here  Kerberos, NTLM, Basic. It works fine with NTLM and I have tested it successfully. Things to Remember while using this tool :-

• This tool does not work with IFD and works on Windows Authentication as far as from what I found during my research.

• Ideally it should work with Kerberos Authentication but I have seen it successful only in NTLM protocol for windows authentication.

We can use any way to get the SOAP request XML (using Soap Logger etc in CRM SDK).  

ISSUE

So, once we pasted the xml for SOAP request in SOAP UI tool for Dynamics CRM 2013 the SOAP response XML returned following error to us:- 

"HTTP Error 401 – Unauthorized: Access is denied" 

DETAILS and ANALYSIS DONE to FIND THE ROOT CAUSE

 We searched various forum and blogs and found many are complaining about the same error they are hitting using this tool with CRM 2013. 

Note: This blog just mentions my experience on this error and its resolution. This does not mean this would match with very user and every CRM deployment 

We looked at every possible place related to authentication and very setting in our server for authentication, SPN, Kerberos, user password name etc was all good!

 Finally after collecting multiple traces and analysis of NETMON logs we found below:-  

• We did test using both kerberos and NTLM authentication to connect to CRM 2013, we found that SOAPUI application is not responding to credential challenge (NTLM) by server and thus IIS rejects the request.
• Ntlm authentication failed because SOAPUI seems to be using Ntlm v1 w\o any encryption which is not default and not recommended. It seems Server hosting CRM 2013 is not configured to respond to Ntlm v1 w\o encryption security and thus authentication fails. 

If you see fiddler traces it fails exactly on these page WebResource.axd, ScriptResource.axd, Reserved.ReportViewerWebControl.axd as it used to in my last post.

ISSUE 

In CRM UI when we try and run the report from CRM we receive script error as follows:-

Webpage error details

User Agent:
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)

Timestamp: Fri, 5 Sep 2014 08:33:26 UTC

 Message: Syntax error

 Line: 1

Char: 1

Code: 0

URI: https://dynamics-app.mj.niksun.com/WebResource.axd?d=iTejnrBKj_lSxgH0zeqXUg7Hf6yGNH32DYgpUMJdCFrzVOMOGoL5TGoYlOLTxN6gYISiqx1NtzBzhEaJIQ9rW94zTEzTYfuoQUCQsrTOQnM1&t=634933840637882419

Message: 'Sys' is undefined

Line: 54

Char: 1

Code: 0

URI: https://dynamics-app.mj.niksun.com/NiksunDynamicsCRM/CRMReports/rsviewer/reportviewer.aspx

We also see that all the images in the report are missing, in case you do not get the script error pop up. 

I worked on this for hours together, ruled out all the possibilities of this script issue which I had mentioned in my previous blog but nothing helped. We checked all permissions for service accounts, all SPNs were good, made sure it is not IE issue, collected reporting and platform traces but none of these traces logged any errors which made my work even more difficult.  

After collecting all kinds of possible traces I was able to isolate this issue and crack it and hence decided to share my experience with you all who would come across this issue on CRM Reports.

RESOLUTION  

• Updating the CRM web.config file is not supported but still we have seen many of us are not aware of this and we end up editing it and start facing all sorts of unexpected issues. 
• We have various modules in it. One of the modules is <httpRedirect>. If you see our out of the box web.config file you won't find it in system.webserver unless we have done any changes in IIS in httpRedirect ,module. 
• We found that someone had manually updated the web.config file of CRM website as follows:-

            As the clarity of the screenshot is not good, please see below from CRM web.config file:-

             <httpRedirect enabled="true" destination=https://crm.contoso.com/AbcCRM/main.aspx# exactDestination="false" childOnly="true" /> 

               <httpErrors> 

                 <remove statusCode="403" subStatusCode="-1" />

                 <error statusCode="403" subStatusCode="-1" path=https://crm.contoso.com responseMode="Redirect" />

             </httpErrors>

           <urlCompression doDynamicCompression="true" />

• After we removed it completely after comparing it with default working CRM web,config file  and did IISRESET on CRM we were able to run all reports with no issue.  

            Note: Editing Web.config file of crm is not supported and can cause unexpected behaviors in CRM like this 

• Sometime this kind of scenarios become so complicated that it does not catch in crm plat traces too and hence becoming time consuming.  

ADDITIONAL CAUSES OF THIS ISSUE 

• In IIS we have httpRedirect and UrlRewrite modules.
• Please open it for Dynamics CRM website , if you see any custom rules in any of these for CRM, this can cause scripts error like this too on CRM reports. 
• By default in UrlRewrite we should see three rules for CRM(do not touch them). If you see any other custom rules apart from these three default rules please remove them and do an IISRESET to see if the issue gets resolved.

• By default httpRedirect in IIS looks like this for CRM website. 

Hope this blog will help many of us if we come across this issue on Report! 

This blog was continuation of below blog with same error different cause:-

https://blogs.msdn.com/b/arpita/archive/2012/07/21/microsoft-dynamics-crm-2011-unable-to-run-any-reports-due-to-missing-security-role-in-default-organization.aspx

1.png

As we all know CRM for outlook client is widely used by CRM users which gives them ease to access CRM directly in their Outlook, it is very important that we know if we have remnant of older version of Office Outlook it creates issues with certain CRM functionalities.  

For instance  if you have  recently upgraded from Outlook 2007 to Outlook 2013 32 bit or 64 bit.  

Recently, I saw a unique issue that occurs if Outlook 2007 remnants are left in your machine. We see that the CRM Reading pane in outlook client for CRM is showing only contact preview for all entity records.  

We click on accounts or contacts or leads but it opens your contact card from outlook in the reading instead of showing the actual record.  

We made sure that we uninstalled Outlook 2007 using a usual method of uninstall from control panel add and remove programs. Tried looking at various option how it is related to our reading pane issue.  

How to go about Troubleshooting such Issues

• I would advise everyone that first we should always start with checking Microsoft Office Interop Assembly in control panel "add and remove programs" for any kind of issue or any unexpected behavior in CRM. 
• Next, I wanted to make sure if we see any errors in Outlook while navigation in CRM section. So I enabled UI errors  

             File > Options > Advanced and in the Developers section check the 'Show add-in user interface errors' then restart.   

            There were no errors. 

• Next try following steps which is basic step everyone follows using, but still worth mentioning in this blog 

             1. Uninstall The Microsoft Dynamics CRM 2011/2013 Client from Control panel.

             2. Delete MSCRM folder from C:\Users\Your username\AppData\local\Microsoft\MSCRM

             3. Perform similar step for C:\Users\Your username\AppData\local\Microsoft\MSCRM and delete MSCRM folder if it exist.

             4. Uninstall Office 2007 Completely.

             5. Uninstall Office 2010

             6. Install Office 2010.

             7. Install Microsoft Dynamics CRM 2011/2013 Client.

• Then researched on registry keys that get added when we install Outlook. We found that whenever we install any version of Outlook we get following registry key added :- 

             [HKEY_CLASSES_ROOT\TypeLib\{00062FFF-0000-0000-C000-000000000046}\9.3]

             "PrimaryInteropAssemblyName"="Microsoft.Office.Interop.Outlook, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"

             This corresponds to Office 2007.

              If the user is using Office 2010, they will need to be using the following: 

             [HKEY_CLASSES_ROOT\TypeLib\{00062FFF-0000-0000-C000-000000000046}\9.4]

             "PrimaryInteropAssemblyName"="Microsoft.Office.Interop.Outlook,Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"@="Microsoft Outlook 14.0 Object Library

• So, based on Outlook versions it would different in different environment as below:-

             9.2 Outlook 2003

             9.3 Outlook 2007

             9.4 Outlook 2010

             9.5 Outlook 2013

            Of course  there are various other keys which get added with install of Outlook but this was one of the registries which was causing issue with CRM.  

• We checked that we had Outlook 2013 where we had issue with Reading pane showing us Contact card and even after uninstalling Outlook 2007 it had this registry and it  wasn’t  removed during its uninstallation. 
• Thus we made sure we have required permission to rename or delete the Outlook 2007 registry key 9.3 to 9.3_old so that it does not refer to this anymore. Thus, we renamed it  
• Restarted the Outlook and checked the issue was resolved 

Additional Information 

In certain scenario you might get an error while deleting or renaming this key 

"Cannot delete 9.3. Error while deleting key"

 For this you can follow below kb :-

 https://support.microsoft.com/kb/2021860

The answer is yes, Microsoft Dynamics CRM 2013 instance can be used on Microsoft Dynamics CRM 2011 Outlook Client . In this scenario we need to remember that you cannot take data offline by using Go offline. To take data offline, upgrade to CRM 2013 for Outlook.

Make sure you have at least Microsoft Dynamics CRM 2011 Update Rollup 12 applied. Only Microsoft Dynamics CRM 2011 for Outlook with Microsoft Dynamics CRM 2011 Update Rollup 12 or later update rollup is compatible with Microsoft Dynamics CRM Server 2013.

Then, I further read in our CRM 2013 implementation guide and it is explicitly mentioned that although Microsoft Dynamics CRM 2011 for Outlook with Microsoft Dynamics CRM 2011 Update Rollup 6 is supported for upgrade to CRM 2013 for Outlook, CRM 2011 for Outlook with CRM 2011 Update Rollup 6 is incompatible with Microsoft Dynamics CRM Server 2013.

Reference to the content in IG guide:

https://msdn.microsoft.com/en-us/library/hh699711.aspx

Here is the link for both the outlook clients:

CRM 2011 Outlook Client

https://www.microsoft.com/en-au/download/details.aspx?id=27821

CRM 2013 Outlook Client

https://www.microsoft.com/en-us/download/details.aspx?id=40344

Microsoft Dynamics CRM 2013 Implementation Guide

https://www.microsoft.com/en-us/download/details.aspx?id=40322

I read about this table and found lot of queries that we can use to get useful information about picklists in CRM.  

Note: Modifying data in this table is not recommended and not supported by Microsoft Support.

Table Structure

 Following  just returns a list of each picklist value:

SELECT e.Name, a.AttributeName, a.AttributeValue, a.Value, a.DisplayOrder

FROM Stringmap a INNER JOIN MetadataSchema.Entity e ON a.ObjectTypeCode = e.ObjectTypeCode

ORDER BY a.ObjectTypeCode, a.AttributeName, a.AttributeValue 

I came across an issue where we were unable to publish any customization in CRM 4.0 environment. We tried doing "Publish All Customization"  or tried publish on one entity(be it any entity in CRM) every time we failed with following error in UI :-

 "An error had occurred."

If we collect platform trace we will see following error every time :-  

Stack Trace Info: [SqlException: Cannot insert the value NULL into column 'StringMapId', table 'ABC_MSCRM.dbo.StringMap';  

The statement has been terminated.]  

Complete Platform Trace Error:- 

Error: Exception has been thrown by the target of an invocation. 

Error Message: Exception has been thrown by the target of an invocation.

Source File: Not available

Line Number: Not available

Request URL: https://mtlqacrm/ABC/AppWebServices/SystemCustomization.asmx

Stack Trace Info: [SqlException: Cannot insert the value NULL into column 'StringMapId',table 'ABC_MSCRM.dbo.StringMap'; column does not allow nulls. INSERT fails.

The statement has been terminated.]

   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) 

  at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)    at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)

   at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)

   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) 

   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)

   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)

   at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe)   at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()

   at Microsoft.Crm.CrmDbConnection.InternalExecuteNonQuery(IDbCommand command)    at Microsoft.Crm.CrmDbConnection.ExecuteNonQuery(IDbCommand command, Boolean impersonate)

   at Microsoft.Crm.CrmDbConnection.ExecuteNonQuery(IDbCommand command) at Microsoft.Crm.Tools.ImportExportPublish.StringMapPublisher.InsertNewStringMapValue(Int32 objectTypeCode, String attributeName, Int32 attributeValue, Int32 langId, String description, Int32 displayOrder)

   at Microsoft.Crm.Tools.ImportExportPublish.StringMapPublisher.UpdateMaps(EntityMetadata entity, Int32 langId) st Microsoft.Crm.Tools.ImportExportPublish.StringMapPublisher.PublishStringMaps()

   at Microsoft.Crm.Tools.ImportExportPublish.PublishXml.PublishAll(ExecutionContext context) at Microsoft.Crm.WebServices.PublishXmlService.PublishAll(ExecutionContext context)  

I wondered what is this StringMapId which was getting a NULL value and hence the failure. After I researched further, I found that it is a unique GUID value assigned to each picklist value in CRM. Then came the next question,why is it inserting a NULL value instead of a GUID and if it is a GUID who
inserts and creates this GUIDs for StringMapID?  

I collected SQL profiler and could see the insert queries being executed and resulted in failures.

 Example:-

INSERT INTO StringMap(ObjectTypeCode,AttributeName,AttributeValue,LangId,OrganizationId,Value,DisplayOrder) VALUES
(4414,'matchingentitytypecode',4414,1033,'17520689-b364-e211-891c-005056b412f9','DuplicateDetection Rule',1)

 ----------------------------------

 Finally, I realized that stringmapid column with stringmapids have GUIDs which are created at runtime with newid() function but were unable to understand why it is not able to generate and insert that and thus fails with the exception.

 Checked the table StringMapBase and then expanded the table and we could see following things:- 

• Columns
• Keys
• Constraints
• Triggers
• Indexes
• Statistics

 CAUSE OF THIS ISSUE  

This issue occurs when the following constraint in CONSTRAINTS section is missing      

    
DF_StringMap_StringMapId

REASON FOR THE INSERT QUERY FAILURE 

-This constraint is responsible to create GUID "StringMapId" in StringMapBase table. Thus if this is missing, NULL values would be passed while publishing any customization and hence it will error out every time.

 -This usually can happen when we follow unsupported ways to deleting or editing CRM database tables.   

RESOLUTION

 -We used option to create this missing constraint  with query ------------> right click CONSTRAINT in your vanilla org ------------> script as ------------> CREATE TO -----------> New query Window

 Ran following query in affected environment :-

USE [crm_MSCRM]

GO

ALTER TABLE [dbo].[StringMap] ADD  CONSTRAINT [DF_] DEFAULT (newid()) FOR [StringMapId]

GO 

Thus if we see above query it has a function NewID() for [StringMapId] which is responsible for creating runtime GUID while insert query runs on StringMap table which holds all picklist values.

-Hence it is must for us for all picklist values in stringmap table.

I hope this post helps.

-Log in to SQL Server where we have CRM databases <org>_MSCRM and MSCRM_CONFIG. We have 4 different tables from where we will have to fetch the user entries.

-SystemUserBase,

-SystemUserOrganizations,

-SystemUser and then

-Organization

Refer to the following diagram which will help you understand how different tables are related for a specific user.

Run following queries one by one and fetch the GUID values as follows:-

Run below query on ORG_MSCRM database :-

Select domainname,systemuserid from systemuserbase where domainname ='domainname\username'

Note:-

domainname\username is for the affected user.

Copy SystemUserID = 7F0F58A8-5ED0-E111-B576-00155D5AC438

Run following query in MSCRM_CONFIG database :-

USE [MSCRM_CONFIG]

select UserId from systemuserorganizations where CrmUserId='7F0F58A8-5ED0-E111-B576-00155D5AC438'

Copy UserId = D058E3E4-EF63-E111-97DA-00155D5AC42A

  USE [MSCRM_CONFIG]

select defaultOrganizationId from SystemUser where id='D058E3E4-EF63-E111-97DA-00155D5AC42A'

Copy default org id= 076DC913-4564-4569-9A8C-9CD1C4A4ABA2

USE [MSCRM_CONFIG]

select DatabaseName,UniqueName from organization where id = '076DC913-4564-4569-9A8C-9CD1C4A4ABA2'

Default Org XXX_MSCRM

This way we can find the default organization for any user.

'Sys' is undefined

Reportviewer.aspx

Code:0

OR
Message: Sys.WebForms.PageRequestManagerParserErrorException: The message received from the server could not be parsed. Common causes for this error are when the response is modified by calls to Response.Write(), response filters, HttpModules, or server trace is enabled.

Details: Error parsing near '

<html>

<head>

<t'.

Line:5

Char:84093

Code:0

URI: https://xx.xx.xx=74AQt8L28NlXxchvwXlsYTo2VcsDEcCgU-G7K7WIvjkCNhS4tK4pjW7bpQ_-pZg7pxIw-38HwOyhg7e83kXd0DnQUrpVJ4oLEUYKYtciF5JSSDZNGeszMARFLR2zrNYV_vrExgs67ryL4NYu9BADLs-UurxMAXQu1U5i44ZyVSc1&t=2610f696

OR

Webpage error details:

User Agent:Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2;.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)

Timestamp: Tue, 17 Jul 2012 22:43:06 UTC

Message: Object expected

Line: 60

Char: 1

Code: 0

URI: https://crm2011:5555/CRMTest/CRMReports/rsviewer/reportviewer.aspx

Message: Object expected

Line: 60

Char: 1

Code: 0

URI: https://crm2011:5555/CRMTest/CRMReports/rsviewer/reportviewer.aspx

Following are the screenshots of the error we see when running reports from web client:-

Following is the screenshot of the error message we receive from CRM outlook client :-

I collected the CRM platform traces and found we see below error message which is weird as my user has a system administrator security role in the CRM organization from here the user is unable to run the report and receive the script errors:-

Error: The user is not assigned any privileges.

Error Number: 0x80042F09

Error Message: The user is not assigned any privileges.

Error Details: The user is not assigned any privileges.

Source File: Not available

Line Number: Not available

Request URL: https://xxxxx/WebResource.axd?d=Mih2KhqNXiMEZcdPxFxoPU35ZpqXzx5IgE22KWlLHEGWElPjg7jxqVW8lNuhobKyfviBzEIss0CJLe14lrREo7AchKHgzXS7E5qUN7rDMW41&t=634670320007546920

Stack Trace Info: [CrmException: The user is not assigned any privileges.]

at Microsoft.Crm.MainApplication.Application_OnPostAuthenticateRequest(Object sender, EventArgs eventArguments)

----------------------------------

An error occurred during the Application_OnPostAuthenticateRequest :

Error: The user is not assigned any privileges.

Stack Trace: at Microsoft.Crm.MainApplication.Application_OnPostAuthenticateRequest(Object sender, EventArgs eventArguments)

----------------------------------

This issue looked really different to me until I found out how the authentication works when a user runs a report from a particular organization in CRM.

CAUSE OF THIS ISSUE

This issue occurs when a user does not have Security Role assigned to him in his default organization in CRM . Now, by user's default organization we mean that organization in entire CRM deployment where the user was first created.

For instance I have 3 organization ORG1, ORG2 and ORG3 in CRM . I created a user say user1 in AD and then created this user as a CRM user in ORG 1 for the first time. Thus, ORG1 becomes the default organization for this user. Next, if I create the same user user1 in ORG2 it will not make a difference ORG1 still will be the default organization for USER1.

Thus, if future if we remove the security role of user1 from ORG1 , USER1 will not be able to run any reports from ORG2 or ORG3. The user will get all the above mentioned script errors.

REASON FOR THE AUTHENTICATION FAILURE 

The issue is caused when the user is being authenticated to access the ScriptResource.axd, WebResource.axd and Reserved.ReportViewerWebControl.axd controls. The UserCache is being examined while running any report to authenticate the user using the default  organization information and since the user doesn't have any privileges in that organization, the authentication fails and throws an exception. 

RESOLUTION

To resolve this issue we should give a security role to the user in his default organization. Please follow the steps mentioned in the last section on how to find default organization for any CRM user.

I have also seen this issue occurring in scenarios where user's has security role in his default organization but that default organization  is being disabled and no more in use but still present in deployment manager. Hence, in such cases either delete the disabled or unused organization from CRM deployment or enable the organization. 

To know HOW TO FIND DEFAULT ORGANIZATION FOR ANY USER IN MULTIPLE ORGANIZATION CRM DEPLOYMENT please refer to following blog :-

https://blogs.msdn.com/b/arpita/archive/2013/01/23/how-to-find-default-organization-for-any-user-in-multiple-organization-crm-deployment.aspx

Continuation of this issue in case this blog does not resolve the problem:-

https://blogs.msdn.com/b/arpita/archive/2014/09/24/unable-to-run-crm-2011-and-crm-2013-reports-sys-is-undefined.aspx

Once we enter our credentials we receive following error :- 

HTTP Error 401 - Unauthorized Access is denied.

An error has occurred.

We receive following error in event viewer of ADFS server (Application and Services Logs -> ADFS 2.0 -> Admin ) :-

 Exception information:

Exception type: SecurityTokenException

Exception
message: ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry. To accept security tokens from this issuer, configure the IssuerNameRegistry to return a valid name for this issuer.

at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)

at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)

at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)

at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)

at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)

at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)

at Microsoft.Crm.Authentication.Claims.CrmFederatedAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)

at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

 OR

Encountered error during federation passive request. 

Additional Data

Exception details:

Microsoft.IdentityServer.Web.AuthenticationFailedException: ID3034: Authentication failed.

at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)   

at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)

at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)

at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)

at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)

The signing certificate in AD FS shows two Token-decrypting and Token-signing certificates with one Primary and one Secondary status:-

As you can see, there are two signing certificates, the second signing certificate was created by AD FS automatically because the first signing certificate was reaching it's expiration date. This feature - AD FS creating a new self-signed certificate when the old one nears expiration - is called Auto Certificate Rollover.

 In the CRM server database it still has the old certificate entry and hence the authentication starts failing. The issue will get resolved once the database  gets updated with new values after we re-configure.

Cause

The Token-signing certificate and Token-Decrypting certificate in ADFS gets automatically renewed by AD FS , by Auto Certificate Rollover feature because these certificates reached their expiration date. This feature - AD FS creating a new self-signed certificate when the old one nears expiration - is called Auto Certificate Rollover. 

Resolution

 In ADFS management Console update the Federation metadata URLs and do an IIS reset on CRM server. Next, restart the ADFS service.

If above steps do not resolve the issue please follow below steps:-

1) In CRM server go to Deployment Manager and then disable the Claims Based Authentication.

2) Do an IISReset on CRM server

3) Re-configure Claims- Based Authentication from Deployment manager keeping all the settings same.

4) Re-configure IFD through deployment manager.

5) Do an IISRESET again on CRM server

6) In ADFS management console in ADFS server , update the corresponding Federation
Metadata URLs.