Export (0) Print
Expand All

Troubleshoot Microsoft Dynamics CRM Server IFD

Dynamics CRM 2013

Applies To: Microsoft Dynamics CRM 2011, Microsoft Dynamics CRM 2013

 

Did you… Reference

Configure DNS records?

See “DNS configuration” in the downloadable document

Install and bind your certificate on the Microsoft Dynamics CRM website?

See “Certificate selection and requirements” in the downloadable document

Add an AD FS signing certificate as a trusted certificate under the CRMAppPool account profile?

See “Enable AD FS token signing” in the downloadable document

Change the binding type for Microsoft Dynamics CRM websites to HTTPS and use the correct web addresses in Deployment Manager?

Configure the Microsoft Dynamics CRM Server for IFD

Give the CRMAppPool account the rights to use an existing certificate used by Microsoft Dynamics CRM as signing certificate? This could be the wildcard certificate installed on the Microsoft Dynamics CRM server.

Configure the Microsoft Dynamics CRM Server for claims-based authentication

Run the Configure Claims-Based Authentication Wizard from Microsoft Dynamics CRM Deployment Manager? Have you specified the correct URL in this wizard? Have you selected the appropriate encryption certificate?

Configure the Microsoft Dynamics CRM Server for claims-based authentication

Configure relying party trust in AD FS for Microsoft Dynamics CRM internal claims endpoint? Have you provided the correct URL for the Microsoft Dynamics CRM IFD claims endpoint? Have you setup the correct rules for the relying party trusts?

Configure the AD FS server for claims-based authentication

Configure the AD FS server for IFD

Use the following to verify your AD FS settings.

  1. Open Event Viewer.

  2. Expand Applications and Services Logs. Expand AD FS. Click Admin.

  3. Review the events looking for errors.

Events such as Event ID 184 describing an unknown relying party trust could indicate missing host records in DNS or incorrect path configuration for the relying party’s federation metadata URL.

  1. Open the AD FS Management console.

  2. Under Trust Relationships, click Relying Party Trusts. Verify the relying party trusts are enabled and not displaying an alert.

  3. Right-click the relying party trust and click Properties. Click the Identifiers tab. You should see identifiers like the following.

    Relying party trust for claims: internalcrm.contoso.com

    Identifiers for internal

    Relying party trust for IFD: auth.contoso.com

    IFD identifiers Auth

If your identifiers aren’t similar to the above examples, check the path entered for the relying party’s federation metadata URL on the Monitoring tab and check your DNS records.

When attempting an internal claims-based authentication connection, you might receive prompt for your credentials. Try the following steps.

  1. Add the add website address for the AD FS server (for example, https://sts1.contoso.com) to the Trusted Intranet Zone in Internet Explorer.

  2. Turn off Extended Protection. On the server running IIS for the Microsoft Dynamics CRM website:

    Turn off extended protection on the Microsoft Dynamics CRM website.

    1. Open IIS.

    2. Select the Microsoft Dynamics CRM website.

    3. Under IIS, double-click Authentication.

    4. Right-click Windows Authentication, and then click Advanced Settings.

    5. Set Extended Protection to Off.

If the Microsoft Dynamics CRM website fails to display or produces the following error: HTTP Error 401.1 - Unauthorized: Access is denied, there are two steps to try to resolve this issue:

  1. You might need to update the Federation metadata URLs and do an IIs reset. See KB2686840.

  2. You might need to register the AD FS server as a service principal name (SPN). See “Register the AD FS server as a service principal name (SPN)” in the downloadable document.

An authentication error can occur if the time between the AD FS and the Microsoft Dynamics CRM server differs by more than 5 minutes. See Windows Time Service Technical Reference for information on how to configure time synchronization on your servers.

See Also

Send comments about this article to Microsoft.

© 2014 Microsoft Corporation. All rights reserved.
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft