What sounds interesting to me is preparing a CRM DR (Disaster Recovery) environment in Azure IaaS. An extension of CRM On-Premise deployment by adding replica domain controller(s) (DC), additional CRM Server(s) in same deployment and SQL AlwaysOn Availability Group (AG) replica node. After a few days spent playing with lab environment and reusing some of the learnings from my previous  POC attempt Hybrid IT: SQL Always on Availability Group Replica Node in Azure IaaS, I could get a Hybrid CRM environment to usable state. Hybrid because out two CRM servers one is On-Premise Hyper-V VM and other is Azure IaaS VM, same way there is an additional domain controller and one of SQL AG replica node residing on Azure IaaS VMs.

Here is a diagram of the topology I planned and configured. The On-Premise environment running completely on Hyper-V, Azure VMs are under typical Azure subscription. RRAS server is configured as gateway for On-Premise systems and IPSec VPN tunnel connects On-Premise VPN device (RRAS Server) with the Azure gateway.

Figure 1 Hybrid Dynamics CRM Deployment

Configuring On-Premise part of Deployment:

Primary milestone of the project is preparing and configuring On-Premise side of the deployment. Comprising of five (5) virtual machines. A domain controller, CRM server, RRAS server for sit-to-site VPN and two SQL Nodes. Here is an outline of the steps to get the On-Premise infrastructure working.

• Setup Active Directory domain by creating first domain controller.

• Setup RRAS server- Here is the document describing Site-to-Site VPN configuration steps in detail.

• Setup SQL AlwaysOn Availability Group with 2 On-Premise replicas. There are multiple resources available with focus on different aspects of the process. This is the document which closely resembles configuration approach I followed. Closely because, I skipped Availability Group Listener creation and I am using newer versions of OS, SQL then those referred in this document.

Additional Domain Controller on Azure VM:

With Site-to-Site VPN in action, Azure IaaS is visible as an extension of Hyper-V virtual network. Depending on Windows Firewall configuration, one can verify/test connectivity by pinging VM on Azure from On-Premise VM. After this connectivity is established, its matter telling your AD Domain about this new site from Sites and Service. Post this step an Azure VM can be promoted as an additional domain controller. Detailed steps are outlined in this Azure documentation.

SQL AlwaysOn Replica in Azure:

SQL AlwaysOn offers a neat feature, Add Azure Replica Wizard. This nifty wizard takes away a lot of ground work required for preparing an Azure VM to be an AlwaysOn Replica. It takes care of creating a VM, adding it to domain, Failover Cluster and finally to AlwaysOn Availability Group. Here is a blog post describing requirements and a good usage walkthrough of Add Azure Replica Wizard. This document doesn’t talk about SQL Availability Group Listener but below is another good resource that well describes Listener configuration. Document below is using the Add Azure Replica Wizard for identical purpose as my configuration scenario including pointers to Listener configuration steps.

Extend on-premises AlwaysOn Availability Groups to Azure - https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-sql-server-extend-on-premises-alwayson-availability-groups/.

Add Azure Replica Wizard preforms multiple stages of the configuration. Depending on the environment, there are possibilities of exceptions at some stage. I would refer blog post to get an idea of known issues with the Add Azure Replica Wizard.

I suggest installing latest service pack and cumulative updates for SQL Server. Not just SQL Server this rule applies for any software you use. This takes out chances of running into issues those are already addressed by released fixes.

SQL AlwaysOn Listener:

Next is the AlwaysOn Listener configuration. I followed below document to create/configure AlwaysOn Listener for my Hybrid AlwaysOn Availability Group.

Configure an ILB listener for AlwaysOn Availability Groups in Azure - https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-sql-server-configure-ilb-alwayson-availability-group-listener/

This document covers good details for you to follow through. Alternatively, you can choose to use this ready script provided by SQL AlwaysOn team. I chose not use the ready script but walked through steps to create ILB Listener. How clients connect to the AlwaysOn Listener and how to control some of the behaviors is well described here. Refer to “MultiSubnetFailover Keyword and Associated Features” section for relevant information.

Dynamics CRM Servers:

Hybrid SQL Availability Group is functional and has replicas across sites, On-Premise and Azure IaaS. Last phase of the project is installing and configuring CRM servers. First step of this last phase is to bring up two web servers to host CRM application on both sites, one is Azure IaaS VM and other is On-Premise Hyper-V VM. CRM server setup remains same as a typical On-Premise environment. Install first CRM server creating a new CRM deployment pointing to standalone SQL Server. First I installed CRM On-Premise server pointing to On-Premise SQL node 1. Yes, at this stage we won’t tell CRM about the SQL High Availability. For details on CRM full server installation one can refer this page. For 2^nd server on Azure VM, I ran CRM server setup choosing option to connect to existing deployment pointing to On-Premise SQL Node 1. This document can be referred for detailed information on installing CRM server on additional servers in same CRM deployment.

On successful completion of CRM server setup on both servers, we have two CRM servers hosting Full Role. Browsing CRM website pointing to either of servers works normally. Being in same CRM deployment, either of the CRM server points to same back-end configuration and organization databases.

Dynamics CRM 2015 Implementation Guide provides good information on how to configure an existing CRM deployment to leverage SQL AlwaysOn high availability. Below is the CRM product documentation page describing the configuration process step by step.

Set configuration and organization databases for SQL Server 2012 AlwaysOn failover - https://technet.microsoft.com/en-us/library/jj822357.aspx

Out of above document, Cluster and SQL Availability Group creation step changes a little. Here we already have AlwaysOn Availability Group. We would add CRM databases to our existing Availability Group then resume following the document from step “Create the SQL logins…” up to the bottom. Making changes to connection string as described configures CRM Application to use the Availability Group Listener “HYBRIDSQLAGL” instead of AlwaysOn replica node name. This configuration allows CRM server to connect to SQL Databases in Availability Group irrespective of Replica node hosting the databases. CRM Application can continue to function and remain accessible even in situations when On-Premise or Azure IaaS servers are not accessible.

MultiSubnetFailover keyword is required as we have multi-subnet listener for an AlwaysOn Availability Group Listener. Refer to this article for more information on MultiSubnetFailover keyword of connection string.

What I described here is an example or can be called a POC (proof of concept). Disaster Recovery Strategy heavily relies on Recovery Point Objective (RPO) and Recovery Time Objective (RTO) directives from business. Depending on business and environmental requirements there could be need for additional resources and configuration steps to support multiple unique combinations. For Example: deploying a Hybrid AD FS deployment can be added to above topology and it would support your CRM Internet Facing Deployment (IFD) to be accessible over internet. ADFS on Azure VMs blog post gives good overview of scenarios and general information about it.

Additional Resources:

SQL AlwaysOn Team Blog - http://blogs.msdn.com/b/sqlalwayson/

Microsoft Server Software support for Microsoft Azure virtual machines - https://support.microsoft.com/en-us/kb/2721672

Performance Guidance for SQL Server in Windows Azure Virtual Machines - http://blogs.msdn.com/b/sqlcat/archive/2013/06/17/performance-guidance-for-sql-server-in-windows-azure-virtual-machines.aspx

ADFS on Azure VMs - http://blogs.technet.com/b/abizerh/archive/2013/11/19/adfs-on-azure-vms.aspx

Hope this helps! Cheers!

Bhavesh Shastri

Here I am talking about an interesting issue while running Dynamics CRM Reports. When I faced this for first time it felt rare corner scenario but recently I worked with a couple of more customers who ran into same issue. This type of strange issues can take good amount of time to investigate/troubleshoot so worth sharing.

Running any CRM report fails with error stating Reporting Extensions (Data Connector) is not installed. Of course Reporting Extensions (Data Connector) is installed and in fact it’s been removed and reinstalled in attempt to fix the issue, but no difference in error. Below is how error reads/looks like:

Reporting Error

Reports cannot be run because the Connector for Microsoft SQL Server Reporting Services, a required component for reporting is not installed on the server that is running Microsoft SQL Server Reporting Services.

Looking deeper, SSRS Event logs reports failure loading CRM extension.

Log Name:      Application
Source:        Report Server (MSSQLSERVER)
Date:          7/10/2015 3:11:55 PM
Event ID:      108
Task Category: Extension
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SSRSBox
Description:
Report Server (MSSQLSERVER) cannot load the MSCRM extension.

Same event log error is there for other Report Server extensions as well. MSCRMFETCH, SQLPDW, TERADATA are other exception those fail to load within SSRS.

Report Server Service log file also complains about not being able to load the file or missing files.

extensionfactory!ReportServer_0-1!9f8!07/08/2015-02:28:31:: e ERROR: Exception caught instantiating MSCRMFETCH report server extension: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.DllNotFoundException: Unable to load DLL 'SRSDataConnectorBootstrapper.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
 at Microsoft.Crm.Reporting.DataExtensionShim.Common.NativeMethods.CreateManagedObject(String fullAssemblyPath, String assemblyName, String typeName, Object& obj)

extensionfactory!ReportServer_0-1!9f8!07/08/2015-02:28:31:: e ERROR: Exception caught instantiating TERADATA report server extension: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.IO.FileNotFoundException: Could not load file or assembly 'Teradata.Client.Provider, Version=12.0.0.0, Culture=neutral, PublicKeyToken=76b417ee2e04956c' or one of its dependencies. The system cannot find the file specified.
File name: 'Teradata.Client.Provider, Version=12.0.0.0, Culture=neutral, PublicKeyToken=76b417ee2e04956c'

All the files being reported in above exceptions were present on expected path and Report Server service account was given adequate permissions. ProcMon comes to mind as handy tool for investigating file access issues. After good analysis of working and non-working logs could nail it down to VC++ runtime dlls missing or being wrong versions on non-working environment. VC++ runtime is a required component for SSRS extensions to load and function properly.

Once we knew its VC++ runtime fix was relatively easy and quick. Either replace the wrong file with appropriate version from working environment or remove and reinstall Visual C++ Redistributable Package from Microsoft download page. The Visual C++ Redistributable Packages that ships in Redist folder of Dynamics CRM installation media can also be used.

The file msvcr100.dll in C:\Windows\System32 folder was missing in one of the environment, just placing this file from a working environment resolved the issue. After correcting missing/wrong file or reinstalling VC++ runtime, restarting SSRS, IIS on CRM server and clearing IE cache resolves the errors loading SSRS extensions and CRM Reports render w/o any issues.

Hope this helps! Cheers!

Bhavesh Shastri

Search functionality of this Articles feature relies on SQL Server Full-Text Search feature and leverages the contains() function as described in the Full-Text Search feature page. We came across an interesting scenario through a customer report as well as internal testing. Searching for specific keywords does not show expected published articles.

Here is screenshot of such example for keyword “use”, there are published articles with keyword "use" in the grid:

However, search results doesn’t show any of those when search for "use" keyword:

Figured SQL query formulated by CRM for above search and executed directly in SQL Management Studio, no records returned! Looking deeper, this turned out expected behavior from SQL standpoint. SQL Server uses Stopwords to prevent a full-text index from becoming bloated. SQL Server has a mechanism that discards commonly occurring strings (Stopwords) that do not help the search. The TechNet article below describes this feature and how to customize or disable usage of Stopwords.

Configure and Manage Stopwords and Stoplists for Full-Text Search -https://technet.microsoft.com/en-us/library/ms142551(v=sql.110).aspx

While there could be multiple options available for administering SQL Stopwords and Stoplists here is one approach that can help to tweak system Stoplist to meet the requirements. The following are step by step instructions along with screenshots for making it easy to follow.

1. Create a new Full-Text Stoplist from context menu shown in below screenshot

2. Choose to create from System Stoplist (can be an empty one too but that’s not recommended as it bloats Full-Text index size). If empty Stoplist is created then remaining steps to delete stopword should be skipped.

3. Right click on new stop list and get to properties window below, delete Stopword you don’t require. Here I removed “use”

4. Attach this custom stop list to Article entity Full-Text index

ALTER FULLTEXT INDEX ON dbo.documentindex SET STOPLIST = MyStopList;

Note: Above command attaches the custom Stoplist to dbo.documentindex that’s tied to knowledge base Articles. Custom Stoplist should be attached to the Full-Text index tied to the entity for which default Stoplist is drawing unexpected results. For example, below is the command to attach custom Stoplist to Account entity Full-Text Index:

ALTER FULLTEXT INDEX ON dbo.Accountbase SET STOPLIST = MyStopList;

5. Rebuild CRMFullTextCatalog from context menu option

6. You can see the difference in output of below queries showing ‘use’ keyword present in system Stoplist but not in our custom Stoplist.

select * from sys.fulltext_system_stopwords

where language_id = 1033 and stopword='use'

select * from sys.fulltext_stopwords MyStopList

where language_id = 1033 and stopword='use'

Now searching by “use” keyword in CRM should yield expected results.

At the time of writing this custom Stoplist is possible only with CRM On-Premise environment but not with CRM Online.

Hope this helps! Cheers!

Bhavesh Shastri

Greetings!

Lately, I came across to Azure IaaS offerings in a casual conversation with a cloud savvy acquaintance. Site-To-Site and Point-To-Site VPN offerings as part of IaaS triggered obvious thoughts of extending an on-premise environment for different purposes like DR (Disaster Recovery), Dev, Test etc. Azure Express Route offering is likely option for enterprises but Site-To-Site and Point-To-Site VPN options are significant for smaller or lower environments and/or to facilitate remote sites, user(s) connections access to applications. 

First thing that sounds interesting is to prepare a DR environment in Azure IaaS. An extension of on-premise deployment by adding replica domain controller (DC), and SQL Always On Availability Group (AG) replica node. After a couple of weeks spent consuming different documentations, videos, thoughts and importantly playing in Lab environment, I could get a Hybrid SQL Always Availability Group functional. Hybrid because two out of three SQL Nodes are on-premise Hyper-v VM and third one is Azure IaaS VM, same way there is an additional domain controller running on Azure VM. It’s really lengthy configuration process to cover step by step (click by click) here but I am describing an overview of each configuration milestones with drill down links to materials/documentation for each milestone.

Here is a diagram of the topology as I planned and configured. My on-premise environment is running on Hyper-v whereas Azure VMs are under typical 30 day trial open for all. RRAS server is configured as a gateway for on-premise systems and a VPN device forming an IPSec VPN tunnel from on-premise to the Azure gateway.

OS and Server Software versions:
SQL 2012 Sp1 on Windows server 2008 R2 sp1
DC on Windows Server 2008 R2 sp1
RRAS on Windows Server 2012 R2

Topology Diagram:

I am skipping the detailed steps for Windows OS, Domain Controller, WSFC Cluster, SQL Server, Always On installation/configuration as its well described in other resources available on internet. However, here is a listing for sequence reference:

1. Three Hyper-v VMs running Windows Server 2008 R2 sp1 (DC, SQL Nodes)
2. A Hyper-v VM running Windows Server 2012 R2 (RRAS for Site-to-Site VPN to Azure Gateway)
3. Domain configuration by promoting first DC
4. Join member servers to Domain (RRAS, SQL Node 1, SQL Node 3)
5. Verify/Install hotfix mentioned in this support KB on all cluster nodes
6. Install Failover Clustering on both nodes, create a cluster by consuming an unused static IP from on-prem subnet
7. Install SQL Server on both nodes as standalone default instance, Enable Always On
8. Create Always On Availability Group, Add a test DB to Availability Databases, A Listener pointing to unused on-premise IP address for Availability Group. Here is a screen capture video of end to end process.
9. Test connecting by AG Listener name from either nodes, or ODBC connection from DC

Now let’s start at this state when on-premise SQL Always On AG is configured and working fine.

Site-To-Site VPN:

First step is to setup a VPN tunnel to connect on-premise network and Azure virtual network. Azure IaaS supports IPSec VPN tunneling and can be configured against various devices from Cisco, Juniper, and F5 etc. I used Windows Server 2012 Routing and Remote Access Service (RRAS) as VPN device in my test lab. Here is the link to document I followed, this well describes step-by-step method to configure VPN for RRAS and has reference to links talking about other devices.

Additional DC on Azure VM:

With Site-to-Site VPN in action, Azure IaaS is visible as an extension of Hyper-v virtual network. Depending on Windows Firewall configuration, one can verify/test connectivity by pinging VM on Azure from on-premise VM. After this connectivity is established, its matter telling your AD Domain about this new site from Sites and Service. Post this step Azure VM can be promoted as an additional domain controller on Azure VM. Detailed steps are outlined in this Azure documentation.

Add Azure VM as node to WSFC cluster and replica to SQL Always On Availability Group:

SQL 2014 introduces a pretty cool feature “Add Azure Replica wizard”, an extension to original “Add Replica” wizard of SQL Always On. This wizard can come in play once the site-to-site VPN is in place. This wizard takes care of creating VM in Azure, joining Domain, Adding as node to cluster and finally adding node as replica to Always On Availability Group. This “Add Azure Replica wizard” is SQL 2014 feature but can be used with SQL 2012 as well by installing management tools. Here is a post that walks through the wizard in detail.

However, I decided not use this wizard and took the approach to manually configure what wizard does. Below are the steps that worked smoothly to add my Azure SQL Node as a replica to existing Availability Group that I created on-premise.

1. Create a VM in could from gallery image "Windows Server 2008 R2 SP1" under same cloud service and storage account where Azure DC is residing
2. Verify/Install hotfix mentioned in this support KB
3. Join to domain
4. Install Failover Clustering
5. Add the VM as a node to cluster, now AZSQL3(SQL AG Node 3) should be visible as 3rd node in on-premise Cluster
6. Install SQL 2012 as standalone default instance, enable SQL Always ON
7. Add an unused IP address  from Azure VLAN subnet to existing AG listener
8. Add node as replica for existing Availability Group
9. Test connecting by listener name
10. Test Failover to and from SQL Node on Azure VM.

Point-To-Site VPN:

Azure virtual network can also be configured to support Point-To-Site VPN so it allows connections from clients on open internet. Here is a detailed document describing step by step process to configure it. However, if you want to use the same Virtual Network on which you have already configured Site-To-Site VPN then you can start with enabling Point-To-Site connection on Azure Virtual network page, add address range and resume above document from “Create your certificates” section.

Observations:

A DNS record is created for cluster name pointing to IP specified while creating cluster. Listener name has two DNS records, one tied to on-prem subnet IP and other pointing to Azure virtual network IP.

What I described here as a solution is just an example or can be called a POC. Depending on environmental and business requirements there could be additional resources and configurations to support multiple combinations and permutations.

Important call out is the list of supported Microsoft Server Software, here is a support KB that announces supported MS products to run on Azure virtual machines. If your application is custom server application then it may require to pass through typical test cycle. Azure Status Dashboard is a handy utility that gives a niche service status view for each Azure services.

I am keen to uncover possibilities with IaaS and other MS Server products. Looking forward to spend some more time in near future and share the experience.

Hope this helps! Cheers!

Bhavesh Shastri

I faced this question from a friend and colleague pointing out my previous post on silently configuring CRM Outlook Client. Ask was coming from a need to remove all the configured organization for a bunch of CRM for Outlook clients. Not so uncommon, could be testing, upgrade or migration scenarios. Here is the script which does the job. It’s a batch script, no frills and can be hooked to as logon script through Active Directory.

Snippet of the script:

The script file is available on TechNet Gallery.

In Above script, configuration log file is written to C: drive in crmclientinstall.log file. Logging can be disabled by removing /l switch and log file path-filename from ConfigWizard.exe parameters. This path can be changed as per the requirement and log file contains useful information for troubleshooting.

Ideally, this script should be attached as User logon script through Active Directory Group Policy Object and advisable to enable group policy “Run Logon Script Visible”. TechNet page describes how to attach User logon script and other TechNet page describes how to create a GPO.

Hope this helps! Cheers!

Bhavesh Shastri

Hello Everyone!

Sometime back I came across need for provisioning a bunch of CRM organizations for users/participants in Test/Lab environment. I had the CRM 2013 deployment and the list of participants but wasn’t really interested in clicking through the new organization wizard for 45+ times. So thought of using CRM 2013 PowerShell cmdlets to get those orgs provisioned. After bit of digging on cmdlets and couple of trial runs I could get a PowerShell Script that takes csv file as parameter and create CRM organization for each name in the parameter file.

Here is an extract of the script that I used for the purpose, full script file is available for download on same post.

In above script organization name is same as username and an AD account was created by another PowerShell Script, i.e. - John Doe user’s AD account name is JDoe, Orgname is JDoe and same username is passed as –Sysadmin so user would be added with CRM System Administrator role to his/her organization. TechNet community galleries carries a good document and also samples of scripts that can be used to create AD users from a CSV file. One may also be able to find some good ones with a quick internet search…

Here is how the .csv file looks like that should be passed as parameter for above script. Additional fields can be provided in .csv file as per requirement given the script above is modified to parse/use those fields.

Icing would be to have an IFD enabled CRM deployment. In such case, it becomes necessary to create DNS records for each organization URL. For that, I employed another script which used DNSCMD command to add records consuming same .csv file that was parameter for org creation PowerShell Script. Here is TechNet link that describes DNSCMD and options.

Hope this helps!

Thank you!

Bhavesh Shastri

script.txt

Hearing questions on previous post I thought of checking CRM Outlook on the same VM. Luckily I didn’t nuke it right after the purpose so could get the CRM for Outlook Configuration Wizard spinning by starting Windows 7 VM, installing Office and CRM for Outlook.

Configuration wizard prompted for credentials, thrown an error after I entered credentials. Looking at config log it seemed like authentication failure. Here is snippet from configuration log:

07:50:38| Error| Error connecting to URL: https://crm.contoso.com:444/XRMServices/2011/Discovery.svc Exception: Microsoft.Crm.CrmException: Authentication failed
   at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.AuthenticateClaims()
   at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.SignIn()
   at Microsoft.Crm.Outlook.ClientAuth.ClientAuthProvidersFactory`1.SignIn(Uri endPoint, Credential credentials, AuthUIMode uiMode, IClientOrganizationContext context, Form parentWindow, Boolean retryOnError)
   at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.DeploymentInfo.LoadOrganizations(AuthUIMode uiMode, Form parentWindow, Credential credentials)
   at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.InternalLoadOrganizations(OrganizationDetailCollection orgs, AuthUIMode uiMode, Form parentWindow)

Above stack and exception from CRM doesn’t tell me the cause of failure, looking the ADFS event logs and debug tracing also left me clueless. Learnt from Fiddler trace that it’s a 503 Service Unavailable for the mex endpoint of ADFS, i.e. - https://sts.contoso.com/adfs/services/trust/mex. Browsed mex end point URL in IE to see 503 and again looked at ADFS event logs and debug trace but nothing relevant. Restarted ADFS service to see if there is something and I see it’s an error telling it couldn’t enable FS endpoints.

Event ID:      102
Description:
There was an error in enabling endpoints of Federation Service. Fix configuration errors using PowerShell cmdlets and restart the Federation Service.
 
Additional Data
Exception details:
System.ServiceModel.AddressAlreadyInUseException: There is already a listener on IP endpoint 0.0.0.0:808. This could happen if there is another application already listening on this endpoint or if you have multiple service endpoints in your service host with the same IP endpoint but with incompatible binding configurations. ---> System.Net.Sockets.SocketException: Only one usage of each socket address (protocol/network address/port) is normally permitted 

Reason is clear and this VM being CRM server I know its CRM Sandbox service listening on 808 port, TechNet reference. This is where an ADFS configuration option comes handy. NetTcpPort is a setting available with ADFS tells ADFS to use a port other than 808, here is an article referring this setting. After setting my ADFS service to use port 809 using below PowerShell command and restarting ADFS service, mex endpoint could be browsed normally and so my CRM for Outlook configuration worked like a song.

Set-ADFSProperties –nettcpport 809

Hope this helps and Thank you!

Bhavesh Shastri

CRM 2011 Outlook client provides silent configuration option to help administrators to deal with situations where users are remote, travelling and/or non-savvy to run Configuration Wizard with correct inputs. Configuring CRM 2011 Outlook client using silent method in a claims enabled environment can pose a challenge. The client Configuration Wizard when run in claims enabled environment and silent (/Q switch); the wizard expects the user’s CRM credentials in Credential Manager (a.k.a. Windows Vault) found in Control Panel->User Account->Manage your Credentials. In case of non-silent configuration when it doesn’t find CRM credential in Windows Vault it prompts user to enter CRM credentials and saves it to Vault based on user input for remembering credentials.

In case of silent configuration (i.e. /Q switch with Microsoft.Crm.Application.Outlook.ConfigWizard.exe) user’s credentials are expected in the Windows Vault. If configuration wizard doesn’t find the credentials or it’s not in required format, the wizard fails to configure the client and error like below is reported in configuration log file:

Stack Trace

13:43:35| Error| Error connecting to URL: https://orgname.domain.com/XRMServices/2011/Discovery.svc Exception: Microsoft.Crm.CrmException: Credentials required
at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.AuthenticateClaims()
at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.SignIn()
at Microsoft.Crm.Outlook.ClientAuth.ClientAuthProvidersFactory`1.SignIn(Uri endPoint, Credential credentials, AuthUIMode uiMode, IClientOrganizationContext context, Form parentWindow, Boolean retryOnError)
at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.DeploymentInfo.LoadOrganizations(AuthUIMode uiMode, Form parentWindow, Credential credentials)
at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.InternalLoadOrganizations(OrganizationDetailCollection orgs, AuthUIMode uiMode, Form parentWindow)
13:43:35| Error| Exception : Credentials required at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.LoadOrganizations(AuthUIMode uiMode, Form parentWindow)
at Microsoft.Crm.Application.Outlook.Config.ClientConfig.AddDeployment(DeploymentsDeployment[] deployments, AuthUIMode uiMode)
at Microsoft.Crm.Application.Outlook.Config.ClientConfig.Run(Boolean runInsideOutlook)
at Microsoft.Crm.Application.Outlook.Config.ClientConfig.Start(String[] args, Boolean runInsideOutlook)
13:43:35|Verbose| Method entry: Microsoft.Crm.Application.Outlook.Config.ClientConfig.Terminate
13:43:35| Info| Exit code: Failure
13:43:35|Verbose| Method exit: Microsoft.Crm.Application.Outlook.Config.ClientConfig.Terminate
13:43:35| Info| === Microsoft Dynamics CRM for Outlook Configuration Wizard logging stopped: 10/30/2012 1:43:35 PM ===

Possible Solution/Recommendations

Simple solution is to add the credentials to Windows Vault before running configuration wizard; same is described in this blog post by field engineering team. In case silent configuration and/or non-savvy user this could be a challenge for system administrators.

Cmdkey command can be great help in this situation. Here is TechNet document describing cmdkey command http://technet.microsoft.com/en-us/library/cc754243(v=WS.10).aspx.
This command can be used in logon batch script like below example to add the credentials before running the Configuration Wizard and then calling the Microsoft.Crm.Application.Outlook.ConfigWizard.exe with required switches and parameters.

Here is the sample logon script:

@echo off
ECHO Logon Script to configure CRM Outlook client
@echo on
@echo off
reg query HKCU\Software\Microsoft\MSCRMClient /v OrgId
IF errorlevel=1 ( GOTO Configure) ELSE ( GOTO End)
:Configure
cmdkey /generic:Microsoft_CRM_https://orgname.domain.com/ /user:%username%@%userdnsdomain% /pass
ECHO Configuring CRM Outlook client
cd C:\Program Files (x86)\Microsoft Dynamics CRM\Client\ConfigWizard
Microsoft.Crm.Application.Outlook.ConfigWizard.exe /Q /i c:\config.xml /l c:\crmclientinstall.log
:End
ECHO CRM Outlook client is configured.
PAUSE
EXIT

Basic requirements

There are few basic requirements for the entry made to Windows Vault;

• It must be added as generic credential
• Internet or Network Address must specified as Microsoft_CRM_https://orgname.domain.com/ (don’t miss the slash (/) at the end of URL)
• The Username must be in UPN format, i.e.@. E.g. – Jdoe@contoso.com.

When using CMDKEY command with /pass switch and w/o password supplied as parameter CMDKEY prompts for password. To get this command to work as part of logon script it’s mandatory that you have Run Logon Script Visible Group policy enabled. Run logon scripts visible can be found under User Configuration\Administrative Templates\System\Script and here is TechNet document describing this policy. http://technet.microsoft.com/en-us/library/cc975927.aspx

Thanks & Regards
Bhavesh Shastri

Hello Everyone!

I was checking how Dynamics CRM IFD goes with new version of AD FS that comes along with Windows Server 2012 R2 (i.e. - ADFS 3.0) and internet search yielded hazy or misleading information. Somewhere it said WAP (Web Application Proxy) is a must which perplexed me more. So thought of setting it up in lab to see what it looks like. Now I have it working in my one VM lab environment and writing this post to share some key experiences.

I had all the CRM pre-requisites in place and got CRM 2013 website working normally. Curious enough I installed, configured AD FS and configured Claims URL for CRM which worked as expected, woo! My first milestone. Obviously, next was to get IFD URL working. Got configuration in place on both AD FS and CRM side and testing IFD URL was not too big of a surprise, I got an error from my STS before I got the sign-in page prompting for username and password. This is what the error reads like in UI:

An error occurred. Contact your administrator for more information.
Error details
•Activity ID: 00000000-0000-0000-0d00-0080000000fd
•Relying party: crmauth.namma.com
•Error time: Thu, 06 Mar 2014 14:58:06 GMT
•Cookie: enabled
•User agent string: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.3; WOW64; Trident/7.0; Touch; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)

Here is the report in Event Viewer:

Log Name:      AD FS/Admin
Source:        AD FS
Date:          3/6/2014 6:58:06 AM
Event ID:      364
Task Category: None
Level:         Error
Keywords:      AD FS
User:          BSHASTRIDOMAIN\bshastri
Computer:      bshastriw2012.bshastridomain.local
Description:
Encountered error during federation passive request.

Additional Data
Protocol Name:
wsfed
Relying Party:
https://crm.namma.com:444/

Exception details:
Microsoft.IdentityServer.Service.Policy.PolicyServer.Engine.InvalidAuthenticationTypePolicyException: MSIS7102: Requested Authentication Method is not supported on the STS.
   at Microsoft.IdentityServer.Web.Authentication.GlobalAuthenticationPolicyEvaluator.EvaluatePolicy(IList`1 mappedRequestedAuthMethods, AccessLocation location, ProtocolContext context, HashSet`1 authMethodsInToken, Boolean& validAuthMethodsInToken)
   at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.RetrieveFirstStageAuthenticationDomain(Boolean& validAuthMethodsInToken)
   at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.EvaluatePolicy(Boolean& isLastStage, AuthenticationStage& currentStage, Boolean& strongAuthRequried)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthMethodsFromAuthPolicyRules(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthenticationMethods(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

After good digging around on above exception telling “Requested Authentication Method is not supported….” I found the configuration setting which dictates allowed Authentication Methods. This is under AD FS Management Console->Authentication Policies->Global Settings->Edit->. Here is a screenshot:

I am on one box setup and browsing IFD URL locally so my request is surely being considered from Intranet by whatever logic is used to decide source of request. I am not sure on what basis a request is labeled Intranet or Extranet by AD FS 3.0, that’s different investigation I am keen on:).  Back to the exception, checking Form Authentication method for Intranet allowed to get IFD URL working. This guess was based on the fact that CRM does ask for Form Based Authentication when we browse IFD URL. Below are redirection URLs given by CRM with different wauth parameters:

Browsing internal CRM URL asks for Integrated Authentication:

https://sts.namma.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fcrmint.namma.com%3a444%2f&wctx=rm%3d1%26id%3ded7bd6f6-ca7a-4cf1-ab8d-6a07fc3c3773%26ru%3d%252fdefault.aspx&wct=2014-03-06T16%3a25%3a38Z&wauth=urn%3afederation%3aauthentication%3awindows

Browsing external CRM URL asks for Integrated Authentication:

https://sts.namma.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fcrm.namma.com%3a444%2f&wctx=rm%3d1%26id%3ddf0e3ef6-ddd0-4d13-ad61-086239cf5ffc%26ru%3dhttps%253a%252f%252fcrm.namma.com%253a444%252fdefault.aspx&wct=2014-03-06T16%3a22%3a27Z&wauth=urn%3aoasis%3anames%3atc%3aSAML%3a1.0%3aam%3apassword

Wauth parameter reference can be found here on TechNet.

Hope this helps!

Thank you!

Bhavesh Shastri

Today we’re are going to talk about the unexpected/Inaccurate federation metadata XML generated by CRM federation metadata URLs. I have seen many people getting into this. Let’s take a deep dive into usage of federation into CRM.

We all know that CRM 2011 uses AD FS 2.0 to provide claims based authentication. For AD FS STS (Security Token Service) to provide a Security Token (SAML Token) for CRM application to consume AD FS has to know some basic information like format, content (basically claims) etc. so that the Token issued by AD FS STS is consumable by CRM application.

Being application’s requirement CRM 2011 has to tell AD FS on what format, information it should have SAML token. CRM 2011 achieved this by providing Federation Metadata URL from which AD FS can retrieve the Federation Metadata for CRM application.

CRM maintains separate external and internal endpoints so it can tell AD FS to authenticate the internal users (users on the company network/VPN) to be authenticated using Kerberos authentication and the external users using AD FS form based authentication. Here is a sample of what external and internal URL may look like:

External Federation metadata URL:

https://crmauth.namma.com/FederationMetadata/2007-06/FederationMetadata.xml

Internal Federation metadata URL:

https://crmint.namma.com/FederationMetadata/2007-06/FederationMetadata.xml

Further to clarify internal Federation metadata URL is the one which you specify on Web Address tab of Deployment Properties in Deployment Manager tab. External Federation metadata URL is the one specified in text box “Enter the external domain where your Internet-lacing servers are located:” on 3rd page on Configure Internet Facing Deployment wizard in Deployment manager.

Ideally, both internal and external Federation Metadata XML has different CRM endpoints specified to tell AD FS to differentiate the authentication behavior.

In odd situations you may see both internal and external CRM federation metadata URLs returning external end points in XML. When such wrong end points are given by internal federation metadata URL, browsing internal URL shown AD FS sign-in page, 404 on providing credentials on the AD FS sign-in page.

Here are screenshots for pictorial representation of this behavior:

You can see in above example that both internal and external URL exhibits external endpoints which is unexpected.

This behavior happens when there is default port number specified with Internal URL under deployment properties. Port 443 is not required when HTTPS (SSL) is specified as its default port for HTTPS communication. However, there could be a situation in which CRM website HTTPS bindings has a custom port specified e.g. 444. In such scenarios one have to specify port 444 explicitly as its not known to be HTTPS communications port. Removing the port number 443 gives expected Federation Metadata XML. In other words, specifying internal URL like internalcrm.crm.namma.com instead of internalcrm.crm.namma.com:443 followed by IIS reset returns expected behavior.

Here is a sample screenshot:

Thanks-
Bhavesh Shastri