CRM 2013 Warning Data encryption will be active after the install or upgrade.

When importing a database from CRM 2011 to CRM 2013, you may receive an error:

Screenshot 2014 08 21 16 27 06

Data encryption will be active after the install or upgrade. We strongly recommend that you copy the organization encryption key and store it in a safe place. For more information, see http://go.microsoft.com/fwlink/?LinkId=316366.

Understanding This

Microsoft Dynamics CRM 2013 uses standard SQL Server cell level encryption for a set of default entity attributes that contain sensitive information, such as user names and email passwords for Server-Side Sync and authentication tokens for Yammer integration capabilities.  This feature can help organizations meet FIPS 140-2 compliance by ensuring that the data is encrypted “at rest” so that local database admins cannot read the data in the database tables directly.  For Microsoft Dynamics CRM Online, all new and upgraded organizations use data encryption.  For on-premise versions of Microsoft Dynamics CRM 2013, users who have the system administrator security role (and in the PrivUserGroup) can activate data encryption or change the encryption key after data encryption is enabled in the Settings > Data Management > Data Encryption area.  After you activate data encryption, you cannot turn it off. NB: For on-premises versions of Microsoft Dynamics CRM:

  • Changing the encryption key requires SSL configured on the Microsoft Dynamics CRM website. (This requirement can be averted by a work-around described herein, which should only be used for testing purposes.  The point of having data encryption is to have data be encrypted both in transit and at rest.)
  • It is a best practice is to change the encryption key once every year.
  • The encryption key is required to activate data encryption when you import an organization database into a new deployment or a deployment that has had the configuration database (MSCRM_CONFIG) re-created after the organization was encrypted.  You can copy the original encryption key to Notepad and paste it into the Settings > Data Management > Data Encryption dialog box after the organization import is completed.
  • When you re-enter the data encryption key, we recommend that you run the Microsoft Dynamics CRM web application using Internet Explorer to paste the encryption key into the Data Encryption dialog box.

Copy your organization data encryption key.  It is strongly recommend that you make a copy of your data encryption key.  This is particularly important for on-premise deployments that may need to reactivate data encryption after a redeployment or failure recovery.

 

How to copy a CRM 2013 Data Encryption Key for an Organization

  1. Sign in to Microsoft Dynamics CRM as a user with the system administrator security role.
  2. Go to Settings > Data Management > Data Encryption.
  3. In the Data Encryption dialog box, select Show Encryption Key, in the Current encryption key box select the encryption key, and copy it to the clipboard.


CRM 2013 Data Encryption https errorHowever, if the Microsoft Dynamics CRM website is not configured for HTTPS/SSL, the Data Encryption dialog box will not be displayed.  Instead, you’ll get the error noted at the right.  For a more secure deployment, we recommend that you configure the website for HTTPS/SSL.  As a work-around, it is possible to get at the CRM 2013 Data Encryption settings even if the website is not configured for HTTP/SSL.  To do so, use a tool that can be used to modify CRM database tables, such as Microsoft SQL Server Management Studio and open the configuration database (MSCRM_CONFIG); in the DeploymentProperties table, set DisableSSLCheckForEncryption to 1.  In order to set the property use the following SELECT and UPDATE statements:

<span style="color: #000000;">SELECT [ColumnName],[BitColumn]
FROM [MSCRM_CONFIG].[dbo].[DeploymentProperties]
WHERE ColumnName='DisableSSLCheckForEncryption'
 
UPDATE [MSCRM_CONFIG].[dbo].[DeploymentProperties]
SET [BitColumn]=1
WHERE ColumnName='DisableSSLCheckForEncryption'</span>

CRM 2013 Data Encryption KeySaving CRM 2013 Data Encryption w Unicode

After performing an IISReset on the CRM Server, you’ll be able to see the encryption screen.  Paste the encryption key in to a text editor, such as Notepad. As a best practice, save the text file that contains the encryption key on a computer in a secure location on an encrypted hard drive.  Also note that if you keep the default encryption key with all the special hieroglyphic characters, you’ll need to save the file with Unicode encoding — see screenshot below.  Also, note, there is one data encryption key per organization.

Testing our system, I backed-up our test Adventure Works CRM organization database, and restored it as AdvWrks2.  I imported (re-deployed) the AdvWrks2 database to create a new CRM org.  I browsed to Settings => Admin => Users, and selected my User.  I changed the Primary E-mail address and hit save.  Here’s where I got a “Data Encryption error — There are encrypted fields in the organization database, but the data encryption feature isn’t activated.” What this means is that the org that I originally backed-up had encryption enabled, and we copied and re-deployed that org to the new org — which is now requiring data encryption be activated with the Encryption Key from the original org. I went ahead and activated using the Encryption Key that I had previously saved, and got the good news that the Encryption Key was activated successfully.
CRM 2013 Data Encryption - encryption not activated error

So we’ve seen CRM 2013 Data Encryption be activated automatically, by simply installing CRM, as noted in the highlighted paragraph at the top of this post. We also know that Data Encryption will be enabled on all CRM Online deployments.

We’ve further seen that when an encrypted CRM database is restored and redeployed it requires that data encryption be activated with the appropriate encryption key. If you ever think you may want to restore your CRM organization database for disaster recovery or redeploy your CRM system for testing or operational reasons, you simply must save off the encryption key of your existing CRM system. 

Reference: http://www.crmphilly.com/crm-2013-data-encryption/

CRM 2011 to 2013 “Database cannot be started in this edition of SQL Server” error when restoring a Microsoft Dynamics CRM database.

When restoring a database that is a backup of a CRM 2011 database and you are restoring it to a CRM 2013 server running SQL 2012 but not Enterprise, you may receive an error: 

“Database cannot be started in this edition of SQL Server” error when restoring a Microsoft Dynamics CRM database.

This error only happens when the original SQL instance was running an enterprise version and the destination server is not.

Screenshot 2014 08 21 15 45 58

The Cause

When Microsoft Dynamics CRM 2011 is installed using a Microsoft SQL Server Enterprise edition, a partition is created for the auditing functionality of Dynamics CRM 2011. The AuditBase table uses partitioning which is only available for Microsoft SQL Server Enterprise.

The Solution

Use the following Steps and Script to remove the partitioning. The following script recreates all the indexes on the Primary partition and then drops the partition.

Be sure to have a database backup of the ‘Org_MSCRM’ before performing the following steps. 

1. Restore the ‘Org_MSCRM’ database to a Microsoft SQL Server Enterprise edition. It is recommended to backup and restore the database instead of running the script on the production database.

2. Run the following script against the restored database.

IF EXISTS (SELECT name FROM sys.partition_schemes WHERE name='AuditPScheme')
BEGIN
 SELECT 
  CASE WHEN ind.type != 1 
   THEN 
    'DROP INDEX [dbo].[AuditBase].' + QUOTENAME(ind.name) + ' ' 
   ELSE ' ' 
  END + 
  'CREATE ' + CASE is_unique WHEN 1 THEN 'UNIQUE ' ELSE '' END  +
  ind.type_desc + ' INDEX ' + QUOTENAME(ind.name  COLLATE SQL_Latin1_General_CP1_CI_AS )  + ' ON [dbo].' +  QUOTENAME(OBJECT_NAME(object_id)) + ' (' +
   
  REVERSE(SUBSTRING(REVERSE((
   SELECT name + CASE WHEN sc.is_descending_key = 1 THEN ' DESC' ELSE ' ASC' END + ','
   FROM
    sys.index_columns sc
    JOIN sys.columns c ON sc.object_id = c.object_id AND sc.column_id = c.column_id
   WHERE
    OBJECT_NAME(sc.object_id) = 'AuditBase' AND
    sc.object_id = ind.object_id AND
    sc.index_id = ind.index_id
   ORDER BY index_column_id ASC
   FOR XML PATH('')
        )), 2, 8000)) + ')' +
  CASE WHEN ind.type = 1 
   THEN 
    ' WITH (DROP_EXISTING = ON) ON [PRIMARY]' 
   ELSE 
    ' ' 
  END  as Script 
 INTO #indexesScript
 FROM sys.indexes ind
 JOIN sys.partition_schemes ps on ind.data_space_id=ps.data_space_id 
 WHERE
  OBJECT_NAME(object_id) = 'AuditBase'
  AND ps.name = 'AuditPScheme' 
  AND is_unique_constraint = 0 
 SELECT * FROM #indexesScript 
 
 DECLARE @recreateScript nvarchar(max)
 DECLARE indScript CURSOR FOR
 SELECT Script FROM #indexesScript
 OPEN indScript
 FETCH NEXT FROM indScript INTO @recreateScript
 
 WHILE @@FETCH_STATUS = 0   
 BEGIN   
  BEGIN TRANSACTION t1
  Execute sp_executesql @recreateScript
  
  IF @@ERROR > 0
  BEGIN 
   ROLLBACK TRAN t1
   declare @message varchar(max)
   set @message = 'Audit history recreate index failed. SQL: ' + @recreateScript 
      RAISERROR (@message, 10,1)
  END
  ELSE
  BEGIN
   COMMIT TRAN
  END
  FETCH NEXT FROM indScript INTO @recreateScript   
 END   
 DROP PARTITION SCHEME AuditPScheme
 DROP PARTITION FUNCTION AuditPFN
  
 CLOSE indScript   
 DEALLOCATE indScript 
 DROP TABLE #indexesScript
END

3. Once the script is complete you can backup the database and now you should be able to restore the database to a Microsoft SQL Server Standard edition.

Editing (Without Word) and Deleting Content

You’ve got this website and you want to change some of your wording because it just doesn’t feel right, it’s only a quick change and you’re not on your computer so you don’t have Word. Not a problem! Step 1, log in to your website using the login link in the top right.

loginImage

Now the magic can happen. Go to the section of the page you’re not happy with, put your mouse over it and a border will appear around it, in the bottom left of this newly bordered box you’ll see those 2 wonderful words “Edit Content”, click them.

editContent

A new page will load displaying your content, go in and change whatever wording you’d like then scroll down a little and click Save.

contentEditor

Undoing Changes

Crisis! You’ve accidentally rid of something you really needed and you can’t remember what it was! Crisis averted. Go back into “Edit Content” scroll all the way down to the bottom. You will see “Version History” with an arrow next to it, click it and it will expand down with the last few changes.

versionHistory

Select the last version you know was safe and click the little green button to the right of it. When you scroll up your content will be back how it was, (now you can make more changes if you want), click “Save”. Done!

Maybe you’ve decided it’s all wrong! It has to go! Very carefully put your mouse over the gear symbol next to the edit pencil, hover over it and a menu will appear. In there you’ll see “Delete”, click to remove it, but only if you’re sure!

deleteModule

Editing Websites With Word 365

It is time! Your website is up and running, but you’ve got some information burning away that needs to go on the website. Step 1: Log in to the website (top right hand corner of the site).

loginImage

Now you’re logged in, you’ll see a bit black bar at the top of the screen, we need to edit the page, so click on “Edit Page” to the top right hand side of the page. Then in the menu that opens, click “Edit this Page”.

editMode

Next, in the top right of the area you want to edit you’ll see 3 icons, hover over the pencil to show a menu. Click “Edit in Word” (To see how to do it without Microsoft Word check out our post on “Editing (Without Word) and Deleting Content”).

editInWord

If this is your first time, something strange will happen, a box will open and tell you that you need to install something. Lets get briefly technical for those who care, but you can skip to the next paragraph if you just want to get on with it. We’ve installed something called a “module” that will allow the website to open Word 365 and Accept information from Word 365 because we built it to suit Microsoft’s software. They however did not build Word with us in mind (rude right?), so this software install lets Word know how to send your content to the website.

downloadAddin

We now need to install this bit of software so click “Download Word Addin” Then follow the install prompts to get Word 365 comfortable with our software.

When complete we can open our content in Word 365 and edit the  content in the same way we would edit any other document, then it’s just a matter of clicking the big orange “Publish” and your website gets updated!

publishContent

Office 365 Website for Business

Small Business Website that Integrates with Office 365

Screenshot 2014 08 19 08 46 43

Today we are please at announce the launch of the Microsoft Office 365 Website for business site. This website is aimed to help small business (and large) get ready access to web technologies that are designed to work directly with the Microsoft Office 365 suite of products.

With the Office 365 Website product, you will receive a website ready to promote your small business, but still be able to interact with the website users, and data directly from your Office 365 tools.

Some of the Stand out Office 365 Website integrations:

  • Using Outlook to link to the website registered users.
  • Using Outlook to track the social activity of users on the site
  • Using MS Word to edit content of the site
  • Linking Outlook Contacts to your Bulk Email marketing

Creating a Website using Office 365 

Creating a Website Using Office 365 has never been easier. You simply pick from one of our many templates, and provide us with the basics of your business website content. We will then configure the site for you and setup the necessary components to connect your website to your Office 365 subscription suite. We do all the initial setup and hold your hand while you walk through the site.

Creating Office 365 Website

To get started creating an Office 365 Website all you need to do is contact us.

Proudly created and supported by InteractiveWebs.

CRM 2013 Reporting is not enabled Message in CRM Deployment Manager

You Receive the Message “Reporting is not enabled”

And as the name suggests, this is because you have not installed the CRM Reporting feature. To Install the CRM 2013 Reporting Extension

Screenshot 2014 08 03 00 27 58

Add the SQL Server Data Tools option to the SQL 2012 server.

Screenshot 2014 08 03 00 29 19

Add features

Screenshot 2014 08 03 00 31 02

Select SQL Server Data Tools

Screenshot 2014 08 03 00 31 33

Next Next Install Etc till you are all done.

Install the CRM Report Authoring Extensions

D:\BIDSExtensions\i386\Setup\BIDSExtensions.exe

Following the standard setup process, then..

Install the Reporting Extensions

D:\Server\amd64\SrsDataConnector\SetupSrsDataConnector.exe

That’s it. You now will have the message from the Deployment Manager removed, and the necessary reporting Extensions installed.

CRM 2013 splash screen crash on Setup DVD / ISO

CRM 2013 splash screen crash on Setup DVD / ISO

After so many years, with the Splash screen crash of CRM 2011, the boys at Microsoft have not bothered to fix that problem. You start the screen

Screenshot 2014 08 03 00 16 22

Then before long you see this.

Screenshot 2014 08 03 00 17 03

Search around the net, and you find a bunch of old data relating to CRM 2011 and the same problem. Some suggestions are to uninstall various version of IE (The worlds Words Browser) or other similar crap. Not really much help when you are on a Windows 2012 R2 server with the newest release of CRM install ISO. Note: This is the sort of stuff I hope the new CEO will fix one day!

Other Solutions incorrectly reference the files to install from.

The Solution

These are the correct locations for CRM 2013:

  • Install Microsoft Dynamics CRM Server[Drive]:\Server\amd64\SetupServer
  • Install Microsoft Dynamics CRM Report Authoring Extension[Drive]:\BIDSExtensions\i386\SetupBIGSExtensions.exe
  • Install Microsoft Dynamics CRM Reporting Extensions[Drive]:\Server\amd64\SrsDataConnector\SetupSrsDataConnector.exe
  • Install Microsoft Dynamics CRM for Outlookx86: [Drive]:\Client\i386\SetupClient.exex64: [Drive]:\Client\amd64\SetupClient.exe
  • Install Microsoft Dynamics CRM Email Routerx86: [Drive]:\EmailRouter\i386\SetupEmailRouter.exex64: [Drive]:\EmailRouter\amd64\SetupEmailRouter.exe

The trust relationship between this workstation and the primary domain failed Windows 2012 R2 Hyper-V snapshot

The trust relationship between this workstation and the primary domain failed Windows 2012 R2 Hyper-V

Screenshot 2014 08 02 23 22 38

After working with Hyper-V and Snap shots, you may find that a previously working domain member machine gets this error message. This is because the Domain Controller will automatically update passwords of Machine Accounts every 30 days, and a restored snapshot may not match the new pass.

The solution

  1. On the effected client machine open PowerShell
  2. Run the following command “Reset-ComputerMachinePassword” or specify the credentials switch if the account your running PowerShell with doesn’t have the correct AD perms for the CMDlet “Reset-ComputerMachinePassword –credential Domain\Adaccount” (You will be prompted for the domain password).
  3. After running this give the client machine a restart

After Reboot, the server will function correctly.

CRM 2013 IFD An error occurred An error occurred. Contact your administrator for more information.

CRM 2013 IFD An error occurred An error occurred. Contact your administrator for more information. 

When trying to setup up IFD with CRM 2013, we kept getting the error:

An error occurred. Contact your administrator for more information.          

  • Activity ID: 00000000-0000-0000-0300-0080030000ed
  • Relying party: CRM IFD Relying Party
  • Error time: Sat, 02 Aug 2014 08:32:56 GMT

 

Little or no additional information in the Event Log:

We had attempted to setup IFD with ADFS 3.0 and at the time there was very little additional information available for this setup. The MSDN blog that we followed was good, but for ADFS 2.1.

The Solution.

ADFS 3.0 Extra Steps

To say these steps are “fucking important” is to under estimate the value I place in the 2 weeks it took me to resolve the ADFS 3.0. 

Enable Forms Authentication

AD FS in Windows Server 2012 R2, forms authentication is not enabled by default.

1. Log on to the AD FS server as an administrator.

2. Open the AD FS management console and click Authentication Policies.

3. Under Primary Authentication, Global Settings, Authentication Methods, click Edit.

4. Under Intranet, enable (check) Forms Authentication.

Screenshot 2014 08 02 18 06 40


Add the ADFS server to the Local intranet zone.

1. In Internet Explorer, click Tools, and then click Internet Options.

2. Click the Security tab, click the Local intranet zone, and then click Sites.

3. Click Advanced.

4. In Add this website to the zone, type the URL for your AD FS server, for example, https://sts1.contoso.com.

5. Click Add, click Close, and then click OK. 

6. Select the Advanced tab. Scroll down and verify that under Security Enable Integrated Windows Authentication is checked.

7. Click OK to close the Internet Options dialog box.You will need to update the Local intranet zone on each client computer accessing Microsoft Dynamics CRM data internally. To use Group Policy to push this setting to all domain-joined internal client computers do the following.

CRM 2013 IFD Setup with ADFS 3.0 on Windows 2012 R2 Hosted Setup

We already have a popular post for the configuration of IFD setup with CRM 2011. This post is to help those wanting to do the same thing with CRM 2013. That is… configure IFD for CRM 2013.

Reference the Microsoft Document here: http://www.microsoft.com/en-au/download/details.aspx?id=41701

The Existing Setup

Because this is a test environment, we are running the server on a Hyper V server. A single VM machine, that is running a fully patched version of:

  • Windows 2012 R2 SP2 64 Bit – (MSDN File: en_windows_server_2012_r2_x64_dvd_2707946
  • SQL 2012 R2 64 Bit - (MSDN File: en_sql_server_2012_standard_edition_with_service_pack_2_x64_dvd_4351706)
  • Microsoft CRM 2013 64 Bit – (MSDN File: en_microsoft_dynamics_crm_server_2013_sp1_x86_and_x64_4330464)

How to Install CRM 2013

We pretty much followed a combination of these instructions:
http://blogs.msdn.com/b/niran_belliappa/archive/2013/11/05/step-by-step-installing-dynamics-crm-2013-on-windows-server-2012.aspx

But we needed some additional steps for the ADFS 3.0. They are mentioned below.

We then Patched the Server to latest updates, then ran SP1 for CRM 2103. http://support.microsoft.com/kb/2941390

Importantly

When we setup CRM, we selected the option to NOT use the default website, but configure a new one with the default settings of port 5555. This is necessary as you will see later.

 

Backup First

In all things Microsoft world, it is vital what you establish a working point to avoid unnecessarily installing things all over again. To get things working we have started fresh over 4 times.

Hyper V is great for this, as we just stopped the server, and made a copy of the VHD file. Then when it is time to start all over, it is just a matter of restoring from copy/backup.

 

Test First

Test that your CRM setup is working. Go to the local computer name (ours is VSERVER07) on the correct port: http://vserver07:5555

We called our Deployment of CRM – “CRM2013″ So the URL redirects to: http://vserver07:5555/CRM2013/main.aspx

and after being prompted for login, we are in and testing.

Screenshot 2014 07 05 16 16 21

 

Apply a Wildcard SSL Certificate

In CRM, the accessing of deployments is handled by the sub domains. So if we call a deployment “business1″ we will access that as: https://business1.domain.com

For testing, we purchased a standard Wildcard SSL certificate that applied that to the IIS7 server.

We uses Start SSL who provide cheap as you find on the net (free) but requires you to jump through a LOT of hoops to get familiar with issuing certificates. 

Application for a certificate

Here, I will be a wildcard certificate, for example, describes how to create a certificate:

1) Open IIS Manager

2) Click the server name in the main screen double click Server Certificates

3) In the right panel, click Create Certificate Request…

image

4) fill in the following diagram each column, click Next

image

5) Cryptographic Service Provider Properties page change the Bit Length to 2048 click Next.

Screenshot 2014 07 05 18 50 18

6) In the File Name page, enter C: \ req.txt , and then click Finish. (You can save it any place you like, with any name)

7) Open the certificate in Notepad, and copy the contents.

Screenshot 2014 07 05 18 53 05

This is the text that is pasted into the Start SSL Certificate request page to generate the certificate:

Screenshot 2014 07 05 18 55 03

8) After you finish generating the certificate text in StartSSL.com you get a bunch of code that looks similar to the request code. Copy that generated code

9) Paste the code back into a new Text / Notepad Document on the Web server, but call it something that ends in .cer  (not .txt). 

10) back to the IIS Manager, click No. 3)  Step graph Complete Certificate Request …

11) Select the the file you created at point 9 above to complete the request.

12) Click OK.

So that we completed the wildcard certificate request, and import of the new .CER certificate, ready for use.

Binding site for the default SSL certificate

1) Open IIS Manager.

2) In the Connections panel, expand Sites , click Default Web Site.

3) In the Actions pane, click Bindings.

image

4) In the Site Bindings dialog box, click Add.

5) Type select HTTPS.

6) SSL Certificate , select the certificate you just created *. contoso.com , and then click OK.

image Ours is interactivewebs.com

7) Click Close.

 

For the CRM 2013 binding site SSL certificate

This is in effect repeating the above process like you did for the default certificate, but using a different port (444 for example).

1)Open IIS Manager.

2) In the Connections panel, expand Sites , click CRM Web Site.

3) In the Actions pane, click Bindings.

4) In the Site Bindings dialog box, click Add.

5) Type select HTTPS.

6) SSL Certificate , select the certificate you just created *. contoso.com .

7) Port to select a different 443 (e.g. 444 ) and port number, and then click OK

 Screenshot 2014 07 05 19 22 30

8) Click Close.

 

DNS configuration

We are going to add a few DNS “A” records so that the records listed in point 1-4 below in DNS Goal are resolving correctly to the IP address of your CRM server.

There are two ways you can achieve the desired result. But first lets understand the desired result.

  1. We make the assumption that your server is running at least one static IP address.
  2. Because this is Internet Facing, that IP needs to be accessible to the world.
  3. That same IP can be used for access to your server both internally on the matching we are playing with, and externally form anyone on the net.
Lets Get Basic

Start a Command Prompt, and work out what your IP address of the server is.

Click START > RUN > CMD

Type IPCONFIG – Enter

Under the name: IPv4 Address is a number that looks like: 66.34.204.220

image

That is Your IP Address of the Server.

The DNS Goal

Make sure that when you PING xxx.domain.com that it points to that IP address. Both for the world and for you when you do that on your server.

(xxx is the sub domain that we are about to configure.)

To configure CRM, we need some sub domains to point to the server IP.

Adding records in DNS like this:

Screenshot 2014 07 05 19 28 02

  1. sts.domain.com
  2. auth.domain.com
  3. dev.domain.com
  4. Your ORG name.  org.domain.com (Where ORG is the CRM deployment name of your organization or organizations), e.g.
  5. internalcrm.domain.com (used later for internal definition of the CRM server access).
  6. adfs.domain.com (used for reference to the ADFS server)
  7. one for the root domain so that domain.com points to the same server. (This is for the ADFS logout URL)

Screenshot 2014 07 10 18 04 02

We have two setup here: CRM and CRM2013. So we need to configure crm.iwebscrm.com and crm2013.iwebscrm.com.

Test DNS

You must be able to ping all of those names and get the correct server IP address. Both from computers on the internet, and from the server.

Note: If you have added the DNS records, but still encounter name resolution problems, you can try running on the client ipconfig / flushdns to clean up the cache. You can also click the DNS server root and click CLEAR CACHE so that the server is responding with the latest updates.

image

Note: Don’t bother proceeding past this step if you cannot ping your sub domains internally and externally correctly.

 

Firewall configuration

You need to set the firewall to allow the CRM 2013 and the AD FS 2.0 port used by the incoming data stream. HTTPS (SSL) is the default port 443.

For Initial setup testing etc. We recommend just turning the thing off. Better start from a place where it does not muck you around, then turn it all back on after you are successful.

1) Control Panel

2) Search Firewall

3) Check Firewall Status

4) Turn Off or On Firewall

Screenshot 2014 07 05 19 33 53

Just turn it all off for now. (Remember to come back, turn it on and allow access for the unusual port 444 that you configured earlier for the SSL on the CRM site.

 

Configuration Claim-based authentication -internal access

Configure the internal access Claim-based authentication requires the following steps:

  • Install and configure AD FS 3.0
  • Set Claims-based authentication configuration CRM 2013 server.
  • Set the Claims-based authentication configuration AD FS 3.0 server.
  • Test claims-based authentication within the access.

Install and configure ADFS 3.0

CRM 2013 with a variety of STS provider ( STS Provider ) together. This article uses Active Directory Federation Services (AD FS) 3.0 to provide a security token service (security token service ).

Note: AD FS 2.0 will be installed to the default site, so install AD FS 3.0 , you must have CRM 2013 installation in the new site. (Remember we said that earlier)

IIS Looks like this if it is correctly installed: image

If you only see the default website with CRM installed in that. Start AGAIN!

 

Install ADFS Server Role

From Server Manager – Add A Server role for: Active Directory Federation Services

Screenshot 2014 07 05 19 39 54 

After if Finishes: 

Screenshot 2014 07 05 19 41 52

Click the Configure the Federation Services on this server.

Configure AD FS 3.0

1 Click on Configure the federation service on this server.

2 In the AD FS 3.0 Management page , click AD FS 3.0 Federation Server Configuration Wizard .

3 In the Welcome page , select Create the first federation server in a federation server farm, and then click Next.

Screenshot 2014 07 05 19 43 52

4 Select next to continue with the current administrator (must be a domain admin).

Screenshot 2014 07 10 16 34 34

5 Choose your SSL certificate (the choice of a certificate created *.domain.com ) ,add a Federation Service name ( for example , sts1.contoso.com), and Select a Service Display Name for your business – selecting the one that is NOT starting with a *, then click Next.

Screenshot 2014 07 10 16 36 32

6 Open PowerShell and run the following command: “Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)”

 Screenshot 2014 07 10 16 40 55

If you don’t you will se the error: Group Managed Service Accounts are not available because the KDS Root Key has not been set.

7 Create a database on this server using Windows Internal Database, click Next.

Screenshot 2014 07 10 16 43 30

Or use the local SQL instance etc if you have one.

Screenshot 2014 07 31 22 00 47

8 Review Options click Next

Screenshot 2014 07 10 16 44 45

9 Pre-requisits checklist, click Configure

Screenshot 2014 07 10 16 45 44

10 You should see a message that “This Server was successfully configured

Verify the AD FS 3.0 is working

Follow the steps below to verify that the AD FS 3.0 is working :

1 Open Internet Explorer.

2 Enter the federation metadata of the URL , for example:

https://adfs.iwebscrm.com/federationmetadata/2007-06/federationmetadata.xml

(Where sts.contoso.com represents the DNS A record we setup earlier.  sts.yourdomainname.com)

3. to ensure that no certificate associated with the warning appears, and you can view the certificate to be sure it is showing.

Screenshot 2014 07 31 18 22 17Screenshot 2014 07 31 18 23 18

 

Claims-based authentication configuration CRM 2013 server

After you install and configure the AD FS 3.0 , we need to configure the Claims-based authentication before setting CRM 2013 binding types ( Binding type ) and the root domain (root Domains) .

Following these steps to set up CRM 2013 bound for the HTTPS and configure the root domain address :

1 Open the CRM Deployment Manager.

2 In the Actions pane , click Properties .

Screenshot 2014 07 10 17 07 03

3 Click the Web Address page.

4 In the Binding Type , select HTTPS .

Screenshot 2014 07 10 17 09 07

5. You can most likely select Apply at this point, and the default internal address for the CRM will work fine. We however created a new A record in the DNS for “internalcrm” and pointed it to this new server. This allows us to user a clear path for the internal URL.

6 For example, *. contoso.com wildcard certificate, you can useinternalcrm.contoso.com:555 as the network address.

Screenshot 2014 07 10 17 58 12

7 Click OK.

8 In the Deployment Manager console tree, right-click Microsoft Dynamics CRM, and then click Configure Claims-Based Authentication.

Screenshot 2014 07 10 17 59 37

9 Click Next on the Welcome page

10  On the Specify the security token service page, enter the Federation metadata URL, such as
https://adfs.fabrikam.com/federationmetadata/2007-06/federationmetadata.xml. In our case because we setup a DNS record for “adfs” we are going to use that: 
https://adfs.iwebscrm.com/federationmetadata/2007-06/federationmetadata.xml

Screenshot 2014 07 10 18 08 28

11 Click Next then select the certificate that we created perviously for the *.domain connection

Screenshot 2014 07 10 18 07 28

12 Select Next 

Screenshot 2014 07 10 18 09 58

13 Select Apply then Finish

Screenshot 2014 07 10 18 10 31

Screenshot 2014 07 10 18 11 45

 

14 IMPORTANT – Click View Log File

15 Scroll to the end, and Copy the URL from the bottom of the file.

image- This will be used in the next configuration. Note that this is different to the URL used in step 4 above, as it represents the internal URL. Subtle but vital (and the cause of frustration the first 10 times we tried this). In our case the URL looked like this: https://adfs.iwebscrm.com/federationmetadata/2007-06/federationmetadata.xml

16 Click Finish.

17 Validate that you can browse to the URL above. If you cannot view this in a browser, then have a look again at your permissions on the certificate in relation to the account on the application pool in IIS for CRM. Read above: Claims-based authentication configuration CRM 2013server.

18. Once you can browse this URL, you are done here.

 

Claims-based authentication configuration AD FS 3.0 server

After completion of the previous step, the next step we need AD FS 3.0 to add and configure the statement provider trust ( claims Provider trusts ) and the relying party trust ( Relying Party trusts ).

Configure claims provider trusts

Start AD FS 3.0 Management. In the Navigation Pane, expand Trust Relationships, and then click Claims Provider Trusts. Under Claims Provider Trusts, right-click Active Directory, and then click Edit Claims Rules.

Screenshot 2014 07 10 18 27 02


In the Rules Editor, click Add Rule, In the Claim rule template list, select the Send LDAP Attributes as Claims template, and then click Next

Screenshot 2014 07 10 18 27 33


Step10: Create the following rule

Claim rule name: UPN Claim Rule (or something descriptive)
Attribute store: Active Directory
LDAP Attribute: User Principal Name
Outgoing Claim Type: UPN

Screenshot 2014 07 10 18 34 58

Click Finish, and then click OK to close the Rules Editor

After you enable claims-based authentication, you must configure Dynamics CRM Server 2013 as a relying party to consume claims from AD FS 3.0 for authenticating internal claims access.

Start AD FS Management. On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.

On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL you copied earlier from the log file. So that will be https://internalcrm.domain.com/FederationMetadata/2007-06/FederationMetadata.xml. This is the same internalcrm A recored that we checked earlier in the process.

Screenshot 2014 07 10 18 38 23

On the Specify Display Name page, type a display name, such as CRM Claims Relying Party, and then click Next.

Screenshot 2014 07 10 18 40 57

Click Next on the multi-factor authentication options.

Screenshot 2014 07 10 18 41 35

On the Choose Issuance Authorisation Rules page, leave the Permit all users to access this relying party option selected, and then click Next.

Screenshot 2014 07 10 18 41 44

On the Ready to Add Trust page, click the checkbox option to Open the Edit Claim Rules, Next, and then click Close.

Screenshot 2014 07 10 18 42 10

The Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule.

Screenshot 2014 07 10 18 42 52

In the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next.

Screenshot 2014 07 10 18 44 21

Create the following Rule #1
Claim rule name: Pass Through UPN (or something descriptive)
Incoming claim type: UPN
Pass through all claim values

Click Finish.

Screenshot 2014 07 10 18 44 59

Screenshot 2014 07 10 18 50 07

In the Rules Editor, click Add Rule, in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next

Screenshot 2014 07 10 18 50 26

Create the following Rule #2

Claim rule name: Pass Through Primary SID (or something descriptive)
Incoming claim type: Primary SID
Pass through all claim values

Click Finish

Screenshot 2014 07 10 18 51 11

Screenshot 2014 07 10 18 51 23

In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.

Screenshot 2014 07 10 18 51 59

Create the following rule #3

Claim rule name: Transform Windows Account Name to Name (or something descriptive)
Incoming claiming type: Windows account name
Outgoing claim type: Name
Pass through all claim values

Screenshot 2014 07 10 18 53 05

Click Finish, and when you have created all three rules, click OK to close the Rules Editor.

Screenshot 2014 07 10 18 53 20

So now we have claims setup for CRM.

ADFS 3.0 Extra Steps

To say these steps are “fucking important” is to under estimate the value I place in the 2 weeks it took me to resolve the ADFS 3.0. 

Enable Forms Authentication

AD FS in Windows Server 2012 R2, forms authentication is not enabled by default.

1. Log on to the AD FS server as an administrator.

2. Open the AD FS management console and click Authentication Policies.

3. Under Primary Authentication, Global Settings, Authentication Methods, click Edit.

4. Under Intranet, enable (check) Forms Authentication.

Screenshot 2014 08 02 18 06 40


Add the ADFS server to the Local intranet zone.

1. In Internet Explorer, click Tools, and then click Internet Options.

2. Click the Security tab, click the Local intranet zone, and then click Sites.

3. Click Advanced.

4. In Add this website to the zone, type the URL for your AD FS server, for example, https://sts1.contoso.com.

5. Click Add, click Close, and then click OK. 

6. Select the Advanced tab. Scroll down and verify that under Security Enable Integrated Windows Authentication is checked.

7. Click OK to close the Internet Options dialog box.You will need to update the Local intranet zone on each client computer accessing Microsoft Dynamics CRM data internally. To use Group Policy to push this setting to all domain-joined internal client computers do the following.


Test claims-based authentication within the access

You should now be able to use the claims certified to the internal access CRM 2013

1 Open the Deployment Manager.

2 Expand the Deployment Manager node , and then click onOrganizations .

3 Right-click your organization , and then click Browse . so you can open the CRM web page of ( for example:https://internalcrm.contoso.com:444 ).

image

Screenshot 2014 08 02 18 10 57

Trouble Shooting

If the CRM web page can not be displayed, then run the following iisreset and then try again.

image

If the CRM web page still does not show, then you may need to setup AD FS 3.0 server setup a SPN (Service Principal Name) . Re-run the Claims-Based Authentication Wizard, and then browse to the Specify the security token service page, note the AD FS 3.0 server in the Federation metadata URL in the name. (In this case sts1.interactivewebs.com )

http://blogs.msdn.com/b/crm/archive/2009/08/06/configuring-service-principal-names.aspx

image

1 Open a command line tool .

2 Enter the following command : ( application, in your own environment, substitute the name of the name of the command line )

c: \> setspn -a http/sts1.interactivewebs.com fserver4\VSERVER08$

fserver4\VSERVER08 = the domain and machine name of the server.

image

c: \> iisreset

3 and then re-access the Microsoft Dynamics CRM Server 2013 site, so you should be able to successfully access to the CRM 2013 Web page.

http://technet.microsoft.com/en-us/library/gg188614.aspx

If you receive ADFS – sts1 errors.

There was a problem accessing the site. Try to browse to the site again.
If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.
Reference number: xxx

And or if you look in your log files under ADFS 2.0 You will see errors like this.

image

In our case, this was because we used the external Metadata URL and not the Internal URL that we should have copied from the “View Log File” When configuring the Claims Based Authentication. Step 14 in the section above.

image

image

Note the difference between this:

https://internalcrm.interactivewebs.com:444/FederationMetadata/2007-06/FederationMetadata.xml

and the original meta data check we did with:

https://sts1.interactivewebs.com/federationmetadata/2007-06/federationmetadata.xml

We incorrectly figured it would be pulling the same XML data. It does NOT!

 

Configuration Claim-based authentication -external access

Open to the CRM 2013 Data Claims-based authentication of external access, you need to do the following steps:

1 complete contents of the previous section: Configuring Claim-based authentication- internal access.

2 for the IFD configuration CRM 2013 server.

3 for the IFD configuration AD FS 3.0 server.

4 Test claims-based authentication external access.

The IFD configuration CRM 2013 server

When opening Claims certified internal access, you can open by IFD external claims visited. The following describes using the IFDConfiguration Wizard to configure, if you want to learn how to use PowerShell to be configured, refer to the English original.

1 Open the Deployment Manager.

2 In the tree structure , right-click Microsoft Dynamics CRM , and then click Configure Internet-Facing Deployment.

Screenshot 2014 08 02 18 14 52

3 Click Next.

Screenshot 2014 08 02 18 15 20

4 Fill in the correct domain information for the Web Application, Org, and Discovery Web services. Remembering here that in our case: *.interactivewebs.com was the name of the wildcard certificate used, and that PORT 444 was the port we configured for the CRM Web Instance in the bindings for IIS.

Thus we use:

  • Web Application Server Domain: interactivewebs.com:444
  • Organization Web Service Domain: interactivewebs.com:444
  • Web Service Discovery Domain: dev.interactivewebs.com:444 
     

Note – Enter the domain name, rather than the server name .

  • If the CRM installed on the same server or servers are installed in the same domain, then the Web Application Server Domain and Organization Web Service Domain should be the same .
  • Web Service Discovery Domain must be a Web Application Server Domain as a subdomain like the  “dev.” that we setup in DNS earlier.
  • domain name must be on the SSL certificate name

Domain examples :

  • Web Application Server Domain: contoso.com: 444
  • Organization Web Service Domain: contoso.com: 444
  • Web Service Discovery Domain: dev.contoso.com: 444

Screenshot 2014 08 02 18 16 57

For more information on the website, please refer to Install Microsoft Dynamics CRM Server 2013 on multiple computers(http://go.microsoft.com/fwlink/?LinkID=199532 )

5 In the Enter the external domain where your Internet-facing servers are located input box , enter for your internet to CRM 2013 server located outside the domain of information, and then click Next.

Screenshot 2014 08 02 18 18 00

You must specify the domain specified in the previous step Web Application Server Domain sub-domains . default , will be “auth.” added to the Web Application Server Domain before.

Domain examples :

  • External Domain: auth.contoso.com: 444

6 In the System Checks page , if there is no problem, click Next.

Screenshot 2014 08 02 18 18 43

7 In Review your selections and then click Apply page , confirm your input , and then click Apply.

Screenshot 2014 08 02 18 19 12

8 Click Finish .

Screenshot 2014 08 02 18 19 37

9. Open a command line tool, run: iisreset

 

The IFD configuration AD FS 3.0 server

After you have enabled IFD on the Microsoft Dynamics CRM Server 2013 you will need to create a relying party for the IFD endpoint on the AD FS server.
(Steps below are from the MSDN Blog. 

Step6: Start AD FS Management. On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.

image

Step7: On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL to locate the federationmetadata.xml file. This federation metadata is created during IFD Setup.

For example, https://auth.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml.

Type this URL in your browser and verify that no certificate-related warnings appear.

image

Step8: On the Specify Display Name page, type a display name, such as CRM IFD Relying Party, and then click Next

image

Step9: On the Choose Issuance Authorization Rules page, leave the Permit all users to access this relying party option selected, and then click Next.

image

Step10: On the Ready to Add Trust page, click Next, and then click Close.

image

Step11: If the Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule

image

Step12: In the Claim rule template list, select the Pass Through or Filter an Incoming Claimtemplate, and then click Next.

image

Step13: Create the following rule#1

Claim rule name: Pass Through UPN (or something descriptive)

Incoming claim type: UPN

Pass through all claim values

Click Finish

image

Step14: In the Rules Editor, click Add Rule, and in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next

image

Step15: Create the following rule#2

Claim rule name: Pass Through Primary SID (or something descriptive)

Incoming claim type: Primary SID

Pass through all claim values

Click Finish

image

Step16: In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.

image

Step17: Create the following rule #3

Claim rule name: Transform Windows Account Name to Name (or something descriptive)

Incoming claim type: Windows account name

Outgoing claim type: Name

Pass through all claim values

Click Finish, and when you have created all three rules, click OK to close the Rules Editor.

image

Test claims-based authentication to access external

Now, you should use the claims certified external access CRM 2013 a. In IE the browser CRM 2013 external address (for example: https://org.contoso.com:444 ), you will see the following pages:

Screenshot 2014 08 02 18 24 18

Enter the user name password, log CRM 2013.

 

https://www.dropbox.com/s/cx3fk8spnc756g8/Screenshot%202014-08-02%2018.18.43.png

Information and support for Windows, DotNetNuke, Microsoft Servers, Microsoft CRM and general technical tips.