Michal Chmielus

Authenticate Azure App Service with Azure AD Security Group

Michal Chmielus — Tue, 06 Mar 2018 14:32:34 GMT

If you're developing Azure App Service i.e. ASP.NET MVC application and there is a requirement to authenticate current user against Azure AD Security Group you need to consider some steps: In th Startup.cs as the part of UseOpenIdConnectAuthentication add/change Notifications


                    Notifications = new OpenIdConnectAuthenticationNotifications()
                    {
                        RedirectToIdentityProvider = (context) =>
                        {
                            string appBaseUrl = ConvertToSsl(context.Request.Scheme) + "://" + context.Request.Host + context.Request.PathBase;
                            context.ProtocolMessage.RedirectUri = appBaseUrl;
                            context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl;
                            return Task.FromResult(0);
                        }
                    }

ConvertToSsl helps ensuring appBaseUrl starts with https protocol. The Azure AD Application provided as a ClientId in OpenIdConnectAuthenticationOptions should have some adjustement in the manifest. Please refer to manifest guideline. The change in the manifest is by adding / replacing line: "groupMembershipClaims" : "SecurityGroup" This is crutial to have desired authentication working properly. Obviously, there is one action pending - how to auhtorize user. Let's commit we're going to use a filter approach by creating custom attribute class which inherits from AuthorizeAttribute, i.e.:


public class AuthorizeBySg: AuthorizeAttribute

and override AuthorizeCore function, i.e.:


protected override bool AuthorizeCore(HttpContextBase context)
{
   if (!base.AuthorizeCore(context)) return false;
   return ClaimsPrincipal.Current.Claims.Any(c => c.Type == "groups" && mygroupId == c.Value);
}

mygroupId is an object ID of restricted Azure AD Security Group. Finally, decorate your Controller or methods in your Controller with newly created AuthorizeBySg attribute class.

Bulk load into Dynamics 365

Michal Chmielus — Mon, 15 Jan 2018 14:05:34 GMT

This is fairly common to massive data load into Dynamics 365. Here you can find useful link to bulk load. As you know there are some constraints while accessing Dynamics 365 over SDK (Microsoft.Xrm.Sdk.Client.OrganizationServiceProxy):

1000 requests in Microsoft.Xrm.Sdk.Messages.ExecuteMultipleRequest
2 concurrent Microsoft.Xrm.Sdk.Messages.ExecuteMultipleRequest

Firstly, you need to instantiate Microsoft.Xrm.Sdk.Client.OrganizationServiceProxy class and open the WCF channel to your CRM Organization. Then within a new Task create a new instance of OrganizationServiceProxy using recent instances of IServiceManagement and SecurityTokenResponse variables. Each OrganizationServiceProxy instance created within a Task can keep impersonated user. You would also need to feed variable actionRequest of Microsoft.Xrm.Sdk.Messages.ExecuteMultipleRequest which can be any of OrganizationRequest type.

Unit Testing Dynamics 365 plugin code

Michal Chmielus — Thu, 11 Jan 2018 13:33:35 GMT

Unit Testing is crutial in software development which helps you proofing your development efforts and delivery in regards to desired functionality. I'm not going to explain step by step how to create a Unit Test project in Visual Studio but focus on some remarkable topics. In Dynamics 365 plugin development I have been using Moq and Microsoft.VisualStudio.TestTools.UnitTesting namespaces. Let's assume you have already created Test project in Visual Studio. Since you're going to use Moq need to install. Navigate to Nuget Package Manager console and install: PM> Install-Package Moq In your test class add a namespace : using Moq; Ensure your class is public and decorated properly: [TestClass] for instance:

[TestClass]
public class TestAddContactToMarketingList

Implement your TestMethod and setup OrganizationService. Ensure you setup OrganizationService and call your business logic method, i.e: AddContactToMarketingList:

Utilize Data Export Service as data replication service in Dynamics 365

Michal Chmielus — Fri, 03 Nov 2017 14:39:34 GMT

It is always crutial to do not degradate the performance in CRM and frustrate users by slowly loading pages. Data Export Service is add-on service as Dynamics 365 (online) solution which replicates data to Azure SQL Database and this is fairly good solution however not perfect. In case you need to work in nearly real-time and there is a lot of plugins running against CRM online instance you need to consider another scenario described in this post. Below is the solution design diagram where you can find Azure components: Obviously Dynamics CRM is the ultimate source system which shares some data across over Data Export Service and signals over Service Endpoint to Azure Service Bus. The logic app picks the message up and proceed which is resulted in Dynamics CRM.

Call Dynamics 365 from Azure App Service

Michal Chmielus — Fri, 06 Oct 2017 12:06:22 GMT

In case you need to get or modify data in Dynamics 365 while calling from Azure Logic App I would recommend to use an action of Http type. This action provides you to request Dynamics 365 endpoint using most of relevant verbs (methods), among each other: GET, POST, PATCH, DELETE along with authentication header. This is mandatory to bind your 365 user prior to consume Dynamics 365 Web API. Please refer to my previous blog where explained how to do it. Dynamics 365 exposes RESTFul Web API with a plenty of features even fairly complex. Dynamics 365 Web API implements OData protocol hence you need to consider it while constructing requests. Below you can find the example how the Azure Logic App can be implemented. It accepts a CityName as an input parameter and is combined in the query sent to Web API resulted with accounts with a city of specified. [caption id="attachment_77" align="alignnone" width="820"] Azure Logic App is getting accounts from specified city[/caption] and a source code: [caption id="attachment_86" align="alignnone" width="820"] Logic App source code[/caption] Please note the authentication is critical and you must provision Azure AD Application along with the binding prior to implementing the Logic App. To obtain values retrieved by the Http action you need to use a property named 'value' which is an array. Logic App has a variety of string, conversion functions which would help you in parsing retrieved data. Please refer to the link .

Calling Dynamics 365 in custom API

There is lightweight approach to consume Dynamics 365 over Application User. The instance which you can further leverage is OrganizationWebProxyClient. Class signature:


public class OrganizationWebProxyClient : WebProxyClient, IOrganizationService

First of all you need to aquuire the token from Azure AD using for instance ADAL library.


var authenticationContext = new AuthenticationContext(authority);
var clientCredentials = new ClientCredential(clientId, clientSecret);
AuthenticationResult result = authenticationContext.AcquireTokenAsync(organizationUrl, clientCredentials).Result;

In case you are going to use early binding you would need to inject your type assembly. It is not enough to set the useStrongTypes argument to True in the constructor but load the assembly:


public OrganizationWebProxyClient(Uri serviceUrl, Assembly strongTypeAssembly);

The URL must contain the SDK client version. The client version is set to the version of the SDK assemblies that the client application was linked to. For example: https://myorg.crm4.dynamics.com/XRMServices/2011/Organization.svc/web?SdkClientVersion=8.2 Please refer to organization service endpoint What you need to provide:

clientId = Azure AD Application ID entered to Application ID attribute in your Dynamics Application User
clientSecret = Secret key generated on above Azure AD Application
authority = https://login.microsoftonline.com/{tenantId}/ {TenantId} - DirectoryID of your Azure AD
organizationUrl = Dynamics 365 instance i.e. https://myorg.crm4.dynamics.com
organizationEndpoint = Dynamics 365 instance including organization service endpoint, i.e. https://myorg.crm4.dynamics.com/XrmServices/2011/Organization.svc/web?SdkClientVersion=8.2


return new OrganizationWebProxyClient(organizationEndpoint, Assembly.Load({assembly name}))

How to bind Dynamics 365 with Azure Logic Apps

Michal Chmielus — Fri, 08 Sep 2017 12:08:32 GMT

If you want to call Dynamics 365 over Web API you have to enable binding between Dynamics 365 and Azure AD Application. In order to enable Dynamics 365 in Azure Logic App using Azure AD Authentication (OAuth) you need to create Azure AD Application (Application Identity) and grant sufficient permissions. There is already great guideline .

Create Azure AD Application

How to create Azure AD Application you can find here. Let’s create the Application called MyDynamicsApp for reference. You need to create a Key (secret). Don’t forget to copy the secret because it will appear only once you have created results you will not be able to obtain the value again regardless permission. Once you have created Azure AD Application you need to grant permissions to Dynamics 365 API by navigating to your recently created Azure AD Application and Required Permissions then click Add button and select Dynamics 365 from the API list. Under DELEGATED PERMISSIONS select permission and Save. To avoid displaying the consent form while browsing to your Dynamics 365 instance you can click Grant Permissions button which is visible when you navigate to Required Permissions.

Create CRM Application User

In order to enable systemuser in Dynamics 365 navigate to Settings -> Security -> Users and switch the view to Application Users. Either select already existing user or create a new one. Switch form view to Application User. Please be aware there is no need to have Office 365 user and a Dynamics 365 licence applied - you will have Application user with your Azure AD Application threated as an application identity. Now you are ready to enable application user with Azure Application Identity. Enter an Application ID of your MyDynamicsApp Application ID and save. Once you entered an Azure Application ID to Dynamics 365 SystemUser form you should be able to connect over WebAPI. In case you are still unauthorized follow these steps:

enter different valid Application ID
save systemuser
enter correct one Application ID
save systemuser

Your systemuser record will be updated with respective values obtained from Azure AD Application:

Application ID URI
Azure AD Object ID

Please ensure above values exist in Azure AD Application essentially Application ID URI is equal to App ID URI.

<< EDIT>> Since November 2017 below comments are no longer valid due to the fix in Dynamics 365 core.

Unfortunately, Application ID URI is read-only but is required to complete our goal. There is workaround, so you can update it programmatically.

Fetch systemUser entry by domainname - technical user email
Update applicationIdUri attribute of fetched systemUser entry with the APP ID URI (#2 on picture above) obtained from the Azure AD Application - MyDynamicsApp


QueryExpression query = new QueryExpression("systemuser")
{
ColumnSet = new ColumnSet("domainname", "applicationiduri", "systemuserid")
};
query.Criteria.AddCondition(new ConditionExpression("domainname", ConditionOperator.Equal, "[replace with CRM Technical User email adress]"));
OrganizationServiceProxy proxy; //TODO: instantiate the variable
var records = proxy.RetrieveMultiple(query);
if (records.Entities.Count == 1)
{
var entity = records.Entities.ElementAt(0);
entity.Attributes["applicationiduri"] = "[replace with APP ID URI (2) from the picture above]";
proxy.Update(entity);
}

Now you should be able to call Dynamics CRM over Web API