.zip files from Mac OS show up as green/encrypted

Posted on May 1, 2013 by InteractiveWebs

Green files and folders on Windows 7 indicate they are encrypted.

Usually this is a function of a program that will make these files encrypted for a reason. Security is usually the reason. But…

An interesting little bug in the process of creating a .zip file on a mac and moving it over to a Windows computer.

When a .zip file is created according to standards for .zip files found here:

http://www.pkware.com/documents/casestudies/APPNOTE.TXT

They specify that .zip archives include a tag informing about itself to the program trying to decompress the archive. This tag information is known as the “version made by” and as the name suggest, it would tag information about the program version of .zip and the files system in use.

 0 - MS-DOS and OS/2 (FAT / VFAT / FAT32 file systems)
          1 - Amiga                     2 - OpenVMS
          3 - UNIX                      4 - VM/CMS
          5 - Atari ST                  6 - OS/2 H.P.F.S.
          7 - Macintosh                 8 - Z-System
          9 - CP/M                     10 - Windows NTFS
         11 - MVS (OS/390 - Z/OS)      12 - VSE
         13 - Acorn Risc               14 - VFAT
         15 - alternate MVS            16 - BeOS
         17 - Tandem                   18 - OS/400
         19 - OS/X (Darwin)            20 thru 255 - unused

When the Mac system encrypts the files, it marks them with the attribute of being UNIX based files. Correct considering the Mac operating system is based on UNIX.

The problem arises at the Windows end. Because Windows is created by the most arrogant computer company in the world, it does not recognise that a .zip file could have been created with a computer that is not running Windows. It fails to correctly see the flag as UNIX and marks the files as Encrypted.

Leaving Files Encrypted

If the files are left as encrypted, you may find that there are problems if the files are shred on a network drive etc. Taking ownership will not change this flag, and resetting permissions does nothing.

The Easy Fix – Remove Encrypted Tag

Removing the incorrect Encrypted Flag on a green file in Windows 7, or Windows Server is really easy. Right click the file or files (holding the shift key to select multiple folders and files) then Click: Properties / Advanced / Un-tick the Encrypted Option

That’s about it. All fixed.

CRM 2011 Email Router Setup and Settings

Posted on January 12, 2013 by InteractiveWebs

Often with the setup of CRM 2011. Users experience messages about Pending e-mail warning and sometimes email messages are not sending.

This can be especially frustrating as both the CRM email queuing and tracking system and the Email router application are terrible to help you understand exactly what is going on with your CRM e-mail.

We mentioned some of the issues we have experience here:

http://www.interactivewebs.com/blog/index.php/server-tips/crm-2011-email-router-problemsshes-a-fickle-bitch/

Here are some basic setup tips for email in Microsoft CRM 2011

1. Out of the box, CRM does not send email messages. You need to configure an application known as CRM 2011 Email Router to have email messages send.

2. You also need a working SMTP (email server) that is configured to allow the relay of email messages from email accounts at your domain name. This can be achieved with Amazon SES message service or your own servers. We can assist you setup Amazon SES if you need assistance with this.

3. You should install and configure your Email Router. Some notes to help you may include these: http://www.interactivewebs.com/blog//?s=email+router

Recommended email settings in CRM 2011

1. Out of the box. CRM will only be able to send email messages to leads, contacts, and accounts. Until you change this setting found in the Admin / System Settings in CRM.

2. Avoid delayed email messages in CRM by Approve Email Address. In the Administration / Users. Go into each user and approve the configured email address.

There is a view of users who are Pending Email address approval to help identify who is needing approval.

Also uncheck the option for Process emails only for approved users and process email only for approved queues. Administration / System Settings.

3. Configure users email settings to use the email router for outbound email messages. (optionally inbound configuration too).

Our recommendation is to set the outbound processing for the email router. This will allow emails generated by the crm system to be delivered right away via the email router. This also means that you do need to install and configure the email router.

The above settings can be set automatically for all users by the use of a simpler out of the box workflow that runs on create of new users.

4. The next setting is recommended. Knowing that email can be tracked in CRM with the outlook client:

Email messages can automatically be tracked too.

5. The all powerful features of creating contacts in CRM when and email address is not known.

This is a great way to automatically get more leads or contacts (depending on your business) in crm. And depending on your business can also be a great way to pollute your crm full of contacts or leads that you don’t want.

Troubleshooting Tips

To troubleshoot an E-mail Router outgoing profile configuration, follow these steps:

Make sure that you follow the incoming profile configuration procedures in the E-mail Router Configuration Manager Help.
For more information about how to configure an incoming profile, see the E-mail Router configuration information in the latest version of the Installing Guide that is included in the Microsoft Dynamics CRM 4.0 Implementation Guide.
Refer to the following sections for information about how to resolve commonly encountered outgoing profile issues.

Test Access error

If there is a problem with your outgoing e-mail configuration, you may receive the following error message when you click Test Access on the E-mail Router Configuration Manager:

"Outgoing status: Failure – An error occurred while checking the connection to e-mail server EXSERVERNAME. The requested address is not valid in its context"

If you receive this message, follow these steps to troubleshoot the problem:

Run a telnet command to verify that connectivity is functioning between the computer that is running CRM Router and the Exchange Server. For example, start the TELNET utility and enter the following command:
TELNET EXSERVERNAME PORT
Make sure that you have no antivirus services running on the Exchange Server computer that prevent connection by using port 25.
For information about how to configure the SMTP server to allow relay messages from Microsoft Dynamics CRM, see KB article 915827.

E-mail error when message sent from the Web application

Symptom: When a user sends an e-mail message by using the Web application, the user might receive one of the following messages:

This message has not yet been submitted for delivery. 1 attempts have been made so far.

The message delivery failed. It must be resubmitted for any further processing.

Resolution: For information about how to resolve this issue, see KB article 915827.

Load Data error

When you click Load Data in the E-mail Router Configuration Manager, you receive the following error:

The E-mail Router Configuration Manager was unable to retrieve user and queue information from the Microsoft Dynamics CRM server. This may indicate that the Microsoft Dynamics CRM server is busy. Verify that URL ‘http://OrganizationName‘ is correct. Additionally, this problem can occur if the specified access credentials are insufficient. To try again, click Load Data. (The request failed with HTTP status 404: Not Found.)

To resolve this problem, follow these steps:

Make sure that the user account that is running the E-mail Router Configuration Manager service is a member of the Active Directory PrivUserGroup security group.
The account that is specified in the Access Credentials field on the General tab of the E-mail Router Configuration Manager must be a Microsoft Dynamics CRM administrative user. If the access credentials are set to Local System Account, the computer account must be a member of the Active Directory PrivUserGroup security group.
Make sure that the URL is spelled correctly. The organization name in the URL field is case-sensitive and must be spelled exactly as it appears in the Microsoft Dynamics CRM server. To view the organization name as it appears in the Microsoft Dynamics CRM server, start the Web application. The organization name appears in the upper-right corner of the application window.
The DeploymentProperties table may have incorrect values if you have modified the port or hostheaders on your Web site. To update the DeploymentProperties table see, KB article 950248.

Pending Email warning

On the Email Router, configure:

1. Check event view for Email Router related errros

2. Change the send email

3. Restart CRM email Router service

4. Reduce the pooling time and conneciton timeout

Automatically Resending Failed Email Messages

The Advanced find can be used to find email messages that have not sent. A workflow can also be created to resend messages automatically. However constant failures is going to indicate a problem some other place. So the use of this automatic workflow should not be introduced in place of fixing your sending issues.

Steps to create the workflow to re-send failed e-mails:

1. Create a new Workflow in CRM | Processes on the E-mail entity

2. Set the workflow to be Available to Run “As an on-demand process”, Change the scope to Organization and uncheck “Record is created”. This will make the workflow available to run On-Demand, function for all e-mails in the organization and also not run when every time a new e-mail is created as we just want to use this when needed on specific e-mails.

3. Click “Add Step” and choose “Change Status”

4. Set the E-mail to a status of “Pending Send”

5. Click Save and then Activate in the toolbar. Click ”OK” to the message to confirm you want to Activate the workflow and then click “Close” on the workflow.

Advanced Find to see how many e-mails are in a failed status:

1. Open Advanced Find by clicking the “Advanced Find” button in the CRM ribbon

2. Select “E-mail Messages” in the Look For option set and then select “Status Reason” and set it equal to “Failed”. Then click the Results button in the Advanced Find ribbon.

3. You can refine the results using the filter criteria from here as well in case you do not want to re-send all of the e-mails. Once you are done, multi-select the e-mails you want to re-send and then click the “Run Workflow” button in the CRM ribbon.

4. Select the e-mail workflow that you created using the steps above and click OK.

The workflow will then run and change the status of all the e-mails you had selected back to “Pending Send”. This is an asynchronous process, so it may take a few minutes depending on your current asynchronous workload in CRM. Then the CRM e-mail router will process them again and send them out through SMTP as expected.

Still Need Help?

Here at InteractiveWebs we know how terrible this component of Microsoft CRM is. Actually, in our opinion, it is difficulties like these that really shows Microsoft is not at all interested in giving it’s customers a good experience. Much of the multitude of steps and better monitoring could be fixed with very little effort from Microsoft, yet after years of CRM, much remains the same.

In any case, if you need paid administration assistance to get your email working on your CRM system, be it Cloud Microsoft Hosted, IFD, or On Premises, we are available. Please contact us at: http://www.interactivewebs.com by submitting a support ticket.

CRM 2011 Rollup 10 Invalid Argument Error

Posted on September 4, 2012 by InteractiveWebs

CRM 2011 Rollup 10 Killed My CRM

After installing CRM 2011 Rollup 10 (not 9 as that is MIA) you receive an Invalid Argument messages as per the image above. This happens after you login to an IFD deployment.

For all we know it may happen on the CRM on premises but we have not managed to test that.

You may also have a CRM Platform Trace Error:

Crm Exception: Message: A non valid page number was received: 0, ErrorCode: –2147220989

CRM’s Fetch Throttling abilities have been disabled or modified from the default values.
Re-enable CRM’s default Fetch Throttling settings.

The solution

1. START | RUN | “regedit” | OK

2. Locate and select the registry subkey: HKEY_LOCAL_MACHINESoftwareMicrosoftMSCRM

Change the value on: TurnOffFetchThrottling

to 0

In fact if you find either MaxRowsPerPage or the TurnOffFetchThrottling registry keys set them both to 0 or delete them.

3. START | RUN | “iisreset” | OK

(This will restart IIS)

Opencart on IIS 7.5 Windows 2008 Server FTP Permissions Changing

Posted on August 11, 2012 by InteractiveWebs

Opencart and PHP running on IIS, we found Permissions incorrect on uploaded files

After working with IIS server running PHP, we found the files uploaded through the web interface of the opencart CMS failed to inherit the correct permissions.

After spending weeks time to resolve this problem, believing that it was a glitch that required file permissions to be reset we found an easy solution.

The Problem

The problem lies with the PHP system running on IIS. When you use a web interface to upload files to your PHP CMS website, they are initially loaded to the PHP defined temporary folder. The temporary folder is set in the PHP.ini file.

To find this file and check the setting, you do this:

Open IIS and select PHP Manager

NewImage

Then Check phpinfo()

NewImage

Then search the php.ini file that opens for “upload_tmp_dir”

Notice that the default location (unless you have changed it) is: c:\windows\temp

NewImage

Now navigate to that folder on your IIS server rick click and select Properties / Security Tab and find the IIS_IUSRS security group.

NewImage

Edit the permissions there to match the permissions of your IIS website folder that is causing you the grief. Probably Read Write at least is needed.

Why the solution works.

As files are uploaded through the website interface, they land in the temp directory. Once there they inherit the temp directory permissions before being moved onto the website folders. By adding the website security to the temp folder, you allow the files to move across with the correct permissions set.

This would be applicable for WordPress running on IIS server, or Opencart.

WordPress 3.5 Manual Fix

Below is the manual fix you can apply to be able to get your WordPress 3.5 install working correctly, there are two options that should work.

1) In the file wp-config.php, add the following line before “That’s all, stop editing”

define( 'WP_TEMP_DIR', ABSPATH . 'wp-content/' );

2) In the file /wp-includes/class-http.php comment out lines 144 and 145, which look like the following:

if ( ! is_writable( dirname( $r['filename'] ) ) )
	return new WP_Error( 'http_request_failed', __( 'Destination directory for file streaming does not exist or is not writable.' ) );

After applying one of the above fixes you should be able to add/upgrade your plugins and upgrade your themes, and will allow you to use the auto upgrade feature when WordPress version 3.5.1 is released.

Opencart .php on IIS 7.5 Permission Denied

Posted on July 31, 2012 by InteractiveWebs

The Problem

We ran into an interesting issue while playing with Opencart on IIS 7.5. The issue was around a common third party module being used called Magic Zoom Plus.

The error showed it’s self with the loading of some junk text at the beginning of many pages when loading.

The text looked like this:

Warning: file_put_contents(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): failed to open stream: Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 171Warning: unlink(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 172Warning: rename(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus

.css~backup,C:\inetpub\wwwroot\www.domain.com\admin\controller\module\

magictoolbox/magiczoomplus.css): Access is denied. (code: 5) in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 173Warning: file_put_contents(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): failed to open stream: Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 171Warning: unlink(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 172Warning: rename(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/

magiczoomplus.css~backup,C:\inetpub\wwwroot\www.domain.com\admin\controller\module

\magictoolbox/magiczoomplus.css): Access is denied. (code: 5) in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 173Warning: file_put_contents(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): failed to open stream: Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 171Warning: unlink(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 172Warning: rename(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus

.css~backup,C:\inetpub\wwwroot\www.domain.com\admin\controller\module\

magictoolbox/magiczoomplus.css): Access is denied. (code: 5) in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 173Warning: file_put_contents(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): failed to open stream: Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 171Warning: unlink(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 172Warning: rename(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus

.css~backup,C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox

/magiczoomplus.css): Access is denied. (code: 5) in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 173Warning: file_put_contents(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): failed to open stream: Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 171Warning: unlink(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus.css): Permission denied in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 172Warning: rename(C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/magiczoomplus

.css~backup,C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox/

magiczoomplus.css): Access is denied. (code: 5) in C:\inetpub\wwwroot\www.domain.com\admin\controller\module\magictoolbox\module.php on line 173

We knew immediately that it is a windows server permission error. However the strange thing is that we were pretty sure that the permissions were correct. We looked around at the settings and found them to be correct too.

The Solution

We ended up going to the website root, and selecting permission (on the server with RDP) and resetting the entire folder and all sub folders permissions. This fixed the problems. Can’t explain why but this is the second time we have needed to do this while running PHP on IIS. May be time to change back to a real php server.

The Permanent Fix

We have done details here that explain how to stop the being necessary.

http://www.interactivewebs.com/blog/index.php/server-tips/opencart-on-iis-7-5-windows-2008-server-ftp-permissions-changing/

SmarterMail Autodiscover setup configuration

Posted on July 29, 2012 by InteractiveWebs

Setup of SmarterMail Autodiscover configuration

A simple understanding of autodiscover is that it is the configuration necessary to allow advanced email programs like macmail and outlook to configure themselves with only an email address and password. No more telling clients all the server settings necessary to get them all setup.

At least that is the theory.

Exchange server has supported it for some time, but configuration under a multi domain setup is a total pain in the butt. Typical off MS to dream something up, then balls it up in the implementation.

SmarterMail does a much better job of it. Configuration is virtually non existent, it basically just works.

http://portal.smartertools.com/KB/a2415/set-up-auto-discovery-with-smartermail.aspx

But their article is a little skimp for the non server admins.. so this is a step through course.

Assuming that you are using Microsoft DNS server for your DNS hosting (and I realise that most probably don’t but it is the more difficult to configure), this is how you add the SRV records mentioned in the article above.

On the DNS server, select New other record on the domain in question.

Scroll down and select SRV

Type the name: _autodiscover

Change the port to: 443

Put in your mail servers address that will respond to an HTTPS request.

The resulted record looks like this:

If you click on the _tcp link, it will look like this:

Local Testing

On your local machine, bring up a command prompt “CMD” and type in nslookup:

Gives this:

Type in “set type=SRV”

Then type in :_autodiscover._tcp.dnnform.com (replace dnnfrom.com with your domain that you just configured above) It should reply wiht the sver hostname matching the record you created in the DNS server above:

External Testing

Performing an external test of the SRV record, and the fact that the server responds with XML reply.

Navigate to: https://www.testexchangeconnectivity.com

Select the Outlook Autodiscover from the list of services.

Enter an email address on the domain you have just set up with the service.

In the case above, we are using the domain “dnnform.com” so the test address we will use is: test.dnnform.com (it does not need to exist on the smartermail server)

The Domain \ User name: test\test (it will not be used)

Password: test (it will not be used)

Then perform test.

The result you are looking for when expanded looks something like this.

This shows that the request was directed to and received some XML response from the server.

All good.

Help

If anyone needs professional assistance with their SmarterMail setup or similar, please feel free to contact us on our website at: http://www.interactivewebs.com

Opencart – HTTP Error 500.50 – URL Rewrite Module Error 0×80070005 Handler StaticFile

Posted on July 27, 2012 by InteractiveWebs

Problem

500 – Internal server error.

There is a problem with the resource you are looking for, and it cannot be displayed.

While working with Opencart shopping cart on an IIS server, we encountered this while browsing to a static image file that was uploaded as a website logo file.

Solution

The problem turned out to be related to IIS permissions. The folder structure hosting the website needed: IIS_IUSRS(<servername>\IIS_IUSRS) – modify to include Modify permissions.

As per this article: http://www.interactivewebs.com/blog/index.php/websites/creating-a-new-opencart-deployment-on-a-windows-server-iis/

Once we fixed that the problems all were solved.

AD FS certificate rollover CRM 2011

Posted on July 9, 2012 by InteractiveWebs

You find that you can’t logon to your CRM 2011 IFD deployment that you have configured around 12 months earlier.

SERVER Log Error show: 1309

Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 9/07/2012 12:09:59 PM
Event time (UTC): 9/07/2012 2:09:59 AM
Event ID: 50c7c9d7c3ba4b839bca7c72b9edf410
Event sequence: 51779
Event occurrence: 11
Event detail code: 0

Application information:
    Application domain: /LM/W3SVC/2/ROOT-1-129862684501956875
    Trust level: Full
    Application Virtual Path: /
    Application Path: C:\Program Files\Microsoft Dynamics CRM\CRMWeb\
    Machine name: VSERVER08

Process information:
    Process ID: 3208
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE

Exception information:
    Exception type: SecurityTokenException
    Exception message: ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry. To accept security tokens from this issuer, configure the IssuerNameRegistry to return a valid name for this issuer.
   at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)
   at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)
   at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)
   at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
   at Microsoft.Crm.Authentication.Claims.CrmFederatedAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Request information:
    Request URL: https://auth.interactivewebs.com:444/default.aspx
    Request path: /default.aspx
    User host address: 124.189.39.157
    User: FSERVER4\Administrator
    Is authenticated: True
    Authentication Type: Negotiate
    Thread account name: NT AUTHORITY\NETWORK SERVICE

Thread information:
    Thread ID: 15
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: True
    Stack trace:    at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)
   at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)
   at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)
   at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
   at Microsoft.Crm.Authentication.Claims.CrmFederatedAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Custom event details:

And you find an error in the login attempt that gives you a 401 error.

ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry. To accept security tokens from this issuer, configure the IssuerNameRegistry to return a valid name for this issuer.

Cause

The likely cause is that the ADFS certificate rollover has happened. Basically the self issued certificate that is used and configured as part of your IFD setup with CRM and AD FS has issued a new certificate around 1 week before the expiry of the old one.

If you start the SD SF services and look under:

Service >> Certificates

You will notice a primary and secondary certificate.

The Fix

Basically the certificate automatically rolls over to a new one and ADFS won’t authenticate any more. Here are the steps that seem to fix this issue:

Open windows Powershell as administrator (right click runas)
Run the following commands:
add-pssnapin Microsoft.adfs.powershell
set-adfsproperties -autocertificaterollover $true
update-adfscertificate -urgent
Run the CRM deployment manager
Run through Configure Claims-Based Authentication Wizard (no changes)
Run through Configure Internet-Facing Deployment Wizard (no changes)
Restart the adfs service
From a Command Prompt “cmd” Type
net stop adfssrv
then
net start adfssrv
Restart the Microsoft Asynchronous processing service
From Services Windows
Click the Restart Icon while the Service is selected
run an iisreset from the elevated command prompt
Start RUN “cmd”
iisreset

From here you should be good to go.

If you need assistance with CRM IFD setup see this post: http://www.interactivewebs.com/blog/index.php/server-tips/microsoft-crm-2011-how-to-configure-ifd-hosted-setup/

NOTE: In our case, the running through of the authentication wizard had defaulted the names back to the server name. We needed to manually put in the address correctly as per the setup of the IFD explained in the link above.

ERROR The terminal server has exceeded the maximum number of allowed connections. RDP Solution

Posted on April 5, 2012 by InteractiveWebs

Using RDP from windows to access a remote server of Windows 2003. The problem sometimes appears that you cannot connect with an error reported as:

ERROR The terminal server has exceeded the maximum number of allowed connections

The Problem

The cause of this is that you have remote sessions that have not exited correctly. Either the connection to the server was lost, or the user simply clicked the close X at the top of the session.

AND

You have your settings in Terminal Server set to hold dropped or inactive sessions either for a period of time or forever.

To Solution

At the Start Button on the computer where you would normally run Remote Desktop Connection from.

Click Start

Run

Type in “mstsc.exe –admin”

Then enter the connection details that you would normally use, and away you go.

Creating a New OpenCart Deployment on a Windows Server IIS

Posted on March 31, 2012 by InteractiveWebs

We are going to cover the deployment of an OpenCart (open source shopping cart) on a Windows 2003 Server, 2008 Server.

We are assuming that the server is setup to run IIS websites, and that you have some general idea about running websites in general on IIS. If this is not the case and you are learning from scratch. Better to learn on Linux server.

Assuming you want to get OpenCart running on IIS.

Step 1 – Web Platform Installer

Install the Microsoft Web Platform Installer on the server from this link.

http://www.microsoft.com/web/downloads/platform.aspx

In Windows 2003 you need to:

Go to the directory on your server: C:\php

Find the file: php.ini

Edit the file in a text browser, finding the following lines:

extension=php_curl.dll

extension=php_gd2.dll

extension=php_mysql.dll

And remove the ; before each line:

Then save the file.

Start a Command Prompt “cmd” and type “iisreset”

This enabled MySQL, GD, and cURL,

Step 2 – Setup PHP on the server.

Start the Web Platform Installer and search PHP in the top right of the search window.

Select and install the latest version of PHP from the list.

Step 3 – Install MySQL on the server.

Also from the Web Platform Installer, search “MySQL” and install that.

During the install, you will be asked for a password for the –root- user. This is the Administrator account and the password should be very well guarded and complex.

Step 4 – Create a Database in MySQL.

Open the My SQL Command Line Tool and enter the –root- password selected above.

Modify the following script to replace the database name, user name and password.

create database mydb;

CREATE USER ‘myuser’@’localhost’ IDENTIFIED BY ‘mypassword‘;
CREATE USER ‘myuser‘@’%’ IDENTIFIED BY ‘mypassword’;

GRANT ALL PRIVILEGES ON mydb.* TO ‘myuser‘@’localhost’;
GRANT ALL PRIVILEGES ON mydb.* TO ‘myuser‘@’%';

FLUSH PRIVILEGES;

Enter your own values where highlighted above.

Copy and paste that line by line into the MySQL Command Line Window. You only need to run one from the first two, then one from the second two.

If you need to change a password.

SET PASSWORD FOR 'myuser'@'localhost' = PASSWORD('newpass');

SET PASSWORD FOR 'myuser'@'%' = PASSWORD('newpass');

FLUSH PRIVILEGES;

Step 5 – Download and unzip to Web Located Folder the contents of OpenCart

Download here: http://www.opencart.com/index.php?route=download/download

The contents of the download package is in a folder called “upload”

Extracted in our case to a folder we called: opencart.interactivewebs.com

Step 6 – Create an IIS instance to hit that directory.

Using the IIS skills that we suggested you should have. Create a new site that hits the directory you dropped the Upload contents to above.

For Windows make sure the following folders and files permissions allow Read and Write.
image/
image/cache/
cache/
download/
config.php
admin/config.php

Step 7 – Set the permissions for IIS.

From the Exploring, Right click the folder with the web files in it, and select Security Tab. Modify the permissions for:

IUSR – Modify (you will probably need to add this)

IIS_IUSRS(<servername>\IIS_IUSRS) – modify

Step 8 – Visit the home page.

Visit the store homepage
e.g. http://www.example.com or http://www.example.com/store/

Accept the license

Check the permissions you need.

Fill in the following details with the relevant information.

Using the MYSQL database settings you created above.

As per the instruction above, you need to delete the Instillation directory.

Step 9 – Deleted this directory.

Restart IIS from the command prompt again. “iisreset”

Common problem if permissions are not set correctly.

http://www.opencart.com/index.php?route=documentation/documentation&path=7_57

Exchange Server 2010 Outlook Autodiscovery Tricks

Posted on January 15, 2012 by InteractiveWebs

I have been trying to work out for some time, a really easy way for AutoDiscovery services in outlook to be directed to the correct address allowing for easy user configuration of services.

Without going into all the details, I have tried all the methods described in (yet another) Microsoft Whitepaper.

http://technet.microsoft.com/en-us/library/bb332063(EXCHG.80).aspx

Had some level of success but while working through this stuff I discovered by mistake a little discussed method.

A new feature is available that enables Outlook 2007 and later to use DNS Service Location (SRV) records to locate the Exchange Autodiscover service.

Discussed here: http://support.microsoft.com/?kbid=940881

To Hell with the the WhitePaper, this works fantastically well. It is everything that I need it to be.

Migrate from IIS 7.0 to IIS 7.5 in a new Windows 2008 R2 Server

Posted on October 22, 2011 by InteractiveWebs

Moving from one IIS 7.0 server to IIS 7.5 is relatively easy and there are a number of tools that can assist you. Probably the best is the Web Deploy tool mentioned here:

http://www.iis.net/download/WebDeploy

This tool can allow you to package up and migrate the entire web sites, including configuration and database files etc.

Because our IIS 7 server is almost dead, it prevented us from configuring the tool. The install files see .Net 2.0 as required, and although it was installed we were unable to get the server to see it as installed. Anyway we tried all sorts of things, and finally gave up. (Good opportunity to rag on Microsoft, but we will leave that alone).

So now we find a need to migrate without the good tools.

Migration

We shared the IIS root folder on the source server. Then pulled all the folders containing websites across from that server to the same location on the new server.

In IIS manager, you need to export the config from the already-configured server. In IIS manager, click the Server node, and go to Shared Configuration under Management.

We then clicked to Export – on the right.

Enter the path you’d like to export the config to, and set an encryption key password:

Note: One thing here that is a real BITCH is that they make you select a pass that is so complex you absolutely have to write it down. We never suggest writing down passwords but they are out of control in what they make you do with this.

Copy administration.config, applicationHost.config, and configEncKey.key to your new server to a temp location.

On the new server, go back to the “Shared Configuration” section and check “Enable shared configuration.” Enter the location in physical path and click “Apply.” It should prompt for the encryption password that you had set. Enter it, and reset IIS.

After resetting IIS (command prompt “iisreset”), go back to Shared Configuration and uncheck “Enable shared configuration.” Click apply. You should see this:

Click YES and it will import all of the settings from your Shared Config into the local config on your new IIS server.

At this point, all you should need to do is change your server-specific site bindings, and it should be good to go.

Bindings

How to add binding information to a site

Open Internet Information Services (IIS) Manager:
- If you are using Windows Server 2008 or Windows Server 2008 R2:
  - On the taskbar, click Start, point to Administrative Tools, and then clickInternet Information Services (IIS) Manager.
- If you are using Windows Vista or Windows 7:
  - On the taskbar, click Start, and then click Control Panel.
  - Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
In the Connections pane, expand the server name, expand Sites, and then click the Web site on which you want to configure the bindings.
In the Actions pane, click Bindings…
In the Site Bindings dialog box, click Add..

5. In the Add Site Binding dialog box, add the binding information, and then click OK.

Your session in Microsoft Dynamics CRM is about to expire. CRM 2011 Extend Session Time

Posted on September 3, 2011 by InteractiveWebs

Sick of seeing the message “Your session in Microsoft Dynamics CRM is about to expire. To continue working, you must sin in again.” and would like to extend the session time so as not to bother you as often?

This is quite easy with an IFD setup of CRM 2011. We have an IFD configuration and setup that we use to test settings and some of our CRM Portal – Linking to DotNetNuke on.

Taking the server as configured as described here: http://www.interactivewebs.com/blog/index.php/server-tips/microsoft-crm-2011-how-to-configure-ifd-hosted-setup/

We ended up with an ADFS Relying Party Trust that is named “CRM IFD Relaying Party”

This is the name we must use in the Windows PowerShell program to make the necessary changes.

To Extend the Auto Logout of IFD CRM 2011

1. Start Windows PowerShell

2. Copy and Paste the following command into PowerShell and hit enter (you can right click to paste):

Add-PSSnapin Microsoft.Adfs.PowerShell

3. Check you have the correct name of the Relying party trust by typing the following:

Get-ADFSRelyingPartyTrust -Name "relying_party"

Where you replace “replying_party” with the name of your relying party trust. In our case we would use:

Get-ADFSRelyingPartyTrust -Name "CRM IFD Relaying Party"

You should see a bunch of junk, indicating that you have the correct name:

4. Now type the following command:

Set-ADFSRelyingPartyTrust -Targetname "relying_party" -TokenLifetime 480

Where you replace the “relying_party” with the name of your relying party. Again in our case we would use:

Set-ADFSRelyingPartyTrust -Targetname "CRM IFD Relaying Party" -TokenLifetime 480

Note that the 480 is in minutes. You can change that value up or down as required.

We chose to use 24 hours for example.

That’s all there is to it. Close the PowerShell and you are done.

CRM 2011 XRM Performance Problem IIS Dynamic Compression

Posted on September 3, 2011 by InteractiveWebs

Microsoft CRM 2011 allows XRM services that use application/soap+xml content type.

When you install Microsoft CRM 2011 in an IFD / hosted environment, it is smart enough to automatically configure IIS gzip compression on the website.

What it does not do, is configure the

C:\Windows\System32\Inetsrv\Config\applicationHost.config

file to compress XRM calls out of the CRM database.

In a test we were performing for an update to our Microsoft CRM 2011 Portal technology, we found that retrieving a list of around 20,000 items returned a 19 MB data package without gzip dynamic compression. Not huge but pretty big! What amazed us was that after enabling dynamic compression on the XRM data, this reduced from 19 MB to 890 KB, a huge performance improvement!

We also noticed that the Microsoft Hosted CRM 2011 service already has this compression enabled, so we figured if it is good enough for them, then we should give it a shot.

How to Enable XRM gzip Compression in IIS

Navigate to: C:\Windows\System32\Inetsrv\Config\applicationHost.config

and open it in your favourite editor.

Search for the Section: “<httpCompression directory=”

And in that section you will probably find an entry that looks like this:

<add mimeType="application/x-javascript" enabled="true" />

Below that, add the following:

<add mimeType="application/soap+xml" enabled="true" />

So the file looks like this:

Note: We are making the assumption that you are on Windows 2008, and that CRM 2011 was successfully installed, and that this in turn enabled IIS compression on the Microsoft CRM website.

These steps should massively improve data access to CRM using XRM calls.

Turn off Microsoft CRM 2011 5000 limit on data retrieval via SDK

Posted on September 2, 2011 by InteractiveWebs

With CRM 4.0 and Microsoft CRM 2011 there is a default limit for the number items that can be retrieved when making various types of web service calls into the CRM.

Typically this limit is set to 5000 but with some types of calls it will return 7000. In any case, the process to remove the limit and set it to 20,000 is very easy.

On the server running CRM

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then select the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\MSCRM
On the Edit menu, point to New, and then click DWORD Value.
Type TurnOffFetchThrottling, and then press ENTER.
Right-click TurnOffFetchThrottling, and then click Modify.
Type a number other than 0 in the Value data box, and then click OK.

Note Step 6 lets you retrieve the number of records specified in the Count attribute of your fetch statement.
On the File menu, click Exit.

CRM 2011 Email Router Problems–She’s a Fickle Bitch

Posted on July 29, 2011 by InteractiveWebs

CRM 2011 Email Router Problems–She’s a Fickle Bitch

Since we published an extensive set of step by step instructions on how to setup CRM 2011 as an Internet Facing Deployment IFD.

We have continued on to find a few issues with the Email Router Tool that are probably worth sharing.

The Tool Does Not Connect to Exchange 2010 like the CRM 4.0 tool.

We had a previous test environment that included CRM 4.0 and the well patched Email Router Tool. It was talking nicely to Exchange Server 2010 using the Exchange Web Service URL: https://server.domain.com/EWS/Exchange.asmx

In our instance the HTTPS was configured with an service signed certificate that was a trusted provider. In other words. We purchase an expensive certificate and used that for testing a real world deployment. No self signed junk.

That all hummed nicely, but we find that in CRM 2011, the Email Router Incoming Settings, using the same settings are worked in 4.0 fails.

Name: FirstName Last Name
Incoming Status: Failure – No results were found.

Note: It is worth noting that after you import an Organization into CRM 2011 from CRM 4.0 that all the user credentials in each users CRM E-mail setting for user defined access:

have the wrong passwords. They need to be reset.

We have not fixed this yet!

Try as we may, and generally we know what we are doing with this stuff, we have not as yet found a solution. We tried heaps of things, from opening up Non SSL access to the Exchange Server to running REG EDITS on the CRM server. Nothing as yet!

We can verify that the URL can be hit from the CRM server (Where the Email Router Resides) and that the return of information is the same as it was for CRM 4.0 Email Router.

We also have verified that the Error Changes once user pass words are made invalid.

Incoming Status: Failure – The remote Microsoft Exchange e-mail server returned the error “(401) Unauthorized”. Verify that you have permission to connect to the mailbox. The request failed with HTTP status 401: Unauthorized.

Indicating that it is authenticating correctly.

We have deployed Rollup 2 at this time, and really are starting to think it is a bug. So we are about to get the BIG Microsoft Involved with a support ticket. Will let you know how that works out.

One Big Problem

We did not think a lot of the issue, and left our test Environment sitting doing a few things that included a DotNetNuke integration that was running some automatic billing processes from web service calls into CRM. This generated email messages in CRM that needed to be sent, and naturally the email router would have sorted that.

Again, we thought nothing of that.

We also noted that huge amounts of memory were being allocated toward the CRM test server in Hyper-V. Like 12-14 GB. That that was high, being that it was a SQL server and website in essence. Memory sits nicely at around 3-4 GB if things are working well.

What we have since discovered is that with the invalid inbound CRM – Exchange access, the CRM Email Router service consumed huge amounts of memory (Over 48 GB if allowed), and also bogged down process time to the point that nothing else ran on the server.

She’s a Fickle Bitch! and obviously there is a memory leak of epic proportions there some place.

The solution, was to remove the invalid Inbound Rule while we sort out what the heck is going on with the program.

Stay Tuned….

UPDATE

After much mucking around, we found our problem.

In our instance the Default Global Address List had us listed, but our mailbox was tied to another custom address list, that was not listing our address correctly due to a typo. The access to the GA was being blocked by custom security settings.

This comes back to the same post above. Although nothing to do with the check box about “Hide from Exchange address lists” – we were in effect being hidden from the address list that mattered.

CRM 2011 IFD Multi-Tenency Migration Tips

Posted on July 25, 2011 by InteractiveWebs

Today we posted a blog about How to configure IFD Hosted Setup in CRM 2011

Following on from that we tested the migration from CRM 4.0 hosted CRM instillations to the newly configured test environment for CRM 2011.

We ran into a few problems (and a few things we did not know) and thought others may benefit from this.

CRM Migration

The process was reasonably simple for us and for that reason we will just list the steps.

Backup the CRM 4.0 database to file.
On the new CRM 2011 SQL server, perform a normal SQL database restore from the backup file.
Use the CRM 2011 deployment tool to “Import and Organisation”. Specifying the obvious settings for the database selection and user mapping. (In our case, we were on the same domain, so user mapping was easy).

All this worked well, but there were a few problems when we went to browse the new Org from outside the server. In other words, using the IFD to access the org.

Internally the org was accessible with https://internalcrm.domain.com/orgname but external access: https://orgname.domain.com:xxx failed.

The Problems

First one

Was simple but only because we have seen it before. Originally we had accessed the org from our IE 9 browser with https://org.domain.com and accessed the CRM 4.0 IFD. Actually we used it for over a year.

Now we wanted to use the new IFD on CRM 2011, but on the same browser. We found when going to: https://org.domain.com:444 that the browser was not even rendering the request for user name and pass that we expected:

The IE failure gave no message or indication of why. Basically a 404 failure to hit anything useful.

Yet in another “real browser” (not IE) we could at least get prompted for user and pass info.

The Cause

IE really sucks with clearing old data. The delete all / clear cache / remove cookies appears on the outset to dump everything, but it does not. In our case, it cached something from the previous connection to CRM 4.0 that was killing our access. We then also deleted data in “C:\Windows\Temp” Can’t explain what the cause is… I would just rather put it down to the fact that IE 9 “blow chunks” (big ones).

The solution is to manually navigate to the Temporary Internet Files directory under Windows, and manually delete everything you find in there. That fixes the page rendering issue.
More information here: http://www.interactivewebs.com/blog/index.php/crm/crm-2011-server-error-404-file-or-directory-not-found/

The Second One

Second, we entered a user name and pass, and received a message:

There was a problem accessing the site. Try to browse to the site again. If the problem persists, contact the administrator of this site and provide the reference number to identify the problem. Reference number: numbers

There was a matching set of AD FS 2.0 Event Logs that looked like this:

A token request was received for a relying party identified by the key ‘https://org.domain.com:444/default.aspx’, but the request could not be fulfilled because the key does not identify any known relying party trust.
Key: https://org.domain.com:444/default.aspx

This request failed.

User Action
If this key represents a URI for which a token should be issued, verify that its prefix matches the relying party trust that is configured in the AD FS configuration database.

and

Encountered error during federation passive request.

Additional Data

Exception details:
Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust ‘https://org.domain.com:444/default.aspx’ is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details.
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)

The solution

An easy one, but something we did not know. With CRM 2011 in IFD. Each time you add an org, you need to update your Relying Party Trusts from Federation Metadata. Big words that mean…

Open AD FS Management Tool
Expand Trust Relationships
Click on Relying Party Trusts
Click on you IFD Trust, Right Click and Select Update From Federation Metadata

I have no idea why this is not automatically updated every time the service starts, or even every time the service is called upon….

In any case, that fixed the issue and we are on our way for testing our CRM – DotNetNuke integration suite with CRM 2011 and DotNetNuke 6.0. Wish us luck.

Microsoft CRM 2011 How to Configure IFD Hosted Setup

Posted on July 24, 2011 by InteractiveWebs

171

Like many, we have struggled to configure Microsoft CRM 2011 as an Internet Facing Deployment. There is quite a bit of disjointed and some what typical Microsoft "junk" on how to set this up.

So after reading the White Papers, blogs and YouTube videos on the topic, I figured I would need notes for myself as much as anything. This is mostly because I am yet to find one single example that covered the setup I was after. That being:

Single Server

On an existing domain

Running true IFD ready for customer access.

The last point it telling, as all the Microsoft examples give a self generated SSL cert, that really is an example of a DEV environment only. We want to test the "real deal", and don’t mind spending a few $ on a real Certificate to see this in a true working environment.

The Existing Setup

Because this is a test environment, we are running the server on a Hyper V server. A single VM machine, that is running a fully patched version of:

Windows 2008 R2 SP1 64 Bit
SQL 2008 R2 64 Bit
Microsoft CRM 2011 64 Bit

Interesting enough, something that always takes me 15 min, it ensuring I download the correct version of the ISO files from MSDN. I get it that I am somewhat lame, but if you get a wrong version you can waste a load of time and energy later.

With a list looking like this it can be painful. Anyway, these are the files we used for install:

For those who care, the VM was set to run with 6000 MB ram, and fold out to use more.

Importantly

When we setup CRM, we selected the option to NOT use the default website, but configure a new one with the default settings of port 5555. This is necessary as you will see later.

Backup First

In all things Microsoft world, it is vital what you establish a working point to avoid unnecessarily installing things all over again. To get things working we have started fresh over 4 times.

Hyper V is great for this, as we just stopped the server, and made a copy of the VHD file. Then when it is time to start all over, it is just a matter of restoring from copy/backup.

Test First

Test that your CRM setup is working. Go to the local computer name (ours is VSERVER08) on the correct port: http://vserver08:5555

We called our Deployment of CRM – "CRM2011" So the URL redirects to: http://vserver08:5555/CRM2011/main.aspx

and after being prompted for login, we are in and testing.

Apply a Wildcard SSL Certificate

In CRM, the accessing of deployments is handled by the sub domains. So if we call a deployment "business1" we will access that as: https://business1.domain.com

For testing, we purchased a standard Wildcard SSL certificate that applied that to the IIS7 server.

We will let you work out that bundle of joy, but a few tips.

1. Godaddy was about as cheap as you find on the net.

2. Setup involves creating a certificate request from within IIS, then pasting that text into the online providers order system. They then generate the certificates that you then import back into IIS and the server.

Application for a certificate

Here, I will be a wildcard certificate, for example, describes how to create a certificate:

1) Open IIS Manager

2) Click the server name in the main screen double click Server Certificates

3) In the right panel, click Create Certificate Request…

4) fill in the following diagram each column, click Next

5) Cryptographic Service Provider Properties page to keep the default, click Next.

6) In the File Name page, enter C: \ req.txt , and then click Finish.

7) Run cmd , run

certreq-submit -attrib "CertificateTemplate: WebServer" C: \ req.txt

8) Select the CA , click OK.

9) the certificate is stored as C: \ Wildcard.cer . ( 7-9 can also be in the CA to complete)

10) back to the IIS Manager, click No. 3) Step graph Complete Certificate Request …

11) Select the C: \ Wildcard.cer , Friendly name named *. contoso.com , of course, you can take a different name.

12) Click OK.

13) so that we completed the wildcard certificate request.

Additional SSL Certificate Imports

1) RUN MMC at the start / search

2) Select File / Add Remove Snapin – Select Certificates – ADD

Computer Account

NEXT / Finish

3) Expand the first two folders, and Right Click on the Certificates Folder and select: All Tasks / Import.

4) Browse to your wildcard SSL certificate file, and import that into the Personal and Trusted Root Certification Authorities.

Ensure that you

Binding site for the default SSL certificate

1) Open IIS Manager.

2) In the Connections panel, expand Sites , click Default Web Site.

3) In the Actions pane, click Bindings.

4) In the Site Bindings dialog box, click Add.

5) Type select HTTPS.

6) SSL Certificate , select the certificate you just created *. contoso.com , and then click OK.

Ours is interactivewebs.com

7) Click Close.

8) Repeat for the Personal certificate folder.

For the CRM 2011 binding site SSL certificate

1) Open IIS Manager.

2) In the Connections panel, expand Sites , click CRM Web Site.

3) In the Actions pane, click Bindings.

4) In the Site Bindings dialog box, click Add.

5) Type select HTTPS.

6) SSL Certificate , select the certificate you just created *. contoso.com .

7) Port to select a different 443 (e.g. 444 ) and port number, and then click OK

8) Click Close.

DNS configuration

For MS CRM 2011 configuration Claims-based authentication, you need the DNS to add some records to make CRM 2011 for each breakpoint can be resolved correctly.

There are two ways you can achieve the desired result. But first lets understand the desired result.

We make the assumption that your server is running at least one static IP address.
Because this is Internet Facing, that IP needs to be accessible to the world.
That same IP can be used for access to your server both internally on the matching we are playing with, and externally form anyone on the net.

Lets Get Basic

Start a Command Prompt, and work out what your IP address of the server is.

Click START > RUN > CMD

Type IPCONFIG – Enter

Under the name: IPv4 Address is a number that looks like: 66.34.204.220

That is Your IP Address of the Server.

The DNS Goal

Make sure that when you PING xxx.domain.com that it points to that IP address. Both for the world and for you when you do that on your server.

(xxx is the sub domain that we are about to configure.)

To configure CRM, we need some sub domains to point to the server IP.

sts.domain.com
auth.domain.com
dev.domain.com
Your ORG name. org.domain.com (Where ORG is the CRM deployment name of your organization or organizations), e.g.

We have two setup here: CRM and CRM2011. So we need to configure crm.interactivewebs.com and crm2011.interactivewebs.com.

Hosting Your Own DNS

If you host your own Domain Name Server (DNS) and you host the domain name that you are using to setup IFD. Then configuring an A record for the above mentioned sub domains is easy.

START > Administrative Tools > DNS

Find your Domain Name

Right Click and select NEW HOST A

Add an A record that points to your servers IP address.

Repeat this process for all of the above mentioned sub domains. auth, sts1, dev, and your own organization names.

Test DNS

You must be able to ping all of those names and get the correct server IP address. Both from computers on the internet, and from the server.

Note: If you have added the DNS records, but still encounter name resolution problems, you can try running on the client ipconfig / flushdns to clean up the cache. You can also click the DNS server root and click CLEAR CACHE so that the server is responding with the latest updates.

Note: Don’t bother proceeding past this step if you cannot ping your sub domains internally and externally correctly.

Firewall configuration

You need to set the firewall to allow the CRM 2011 and the AD FS 2.0 port used by the incoming data stream. HTTPS (SSL) is the default port 443.

For Initial setup testing etc. We recommend just turning the thing off. Better start from a place where it does not muck you around, then turn it all back on after you are successful.

Configuration Claim-based authentication -internal access

Configure the internal access Claim-based authentication requires the following steps:

Install and configure AD FS 2.0 .
Set Claims-based authentication configuration CRM 2011 server.
Set the Claims-based authentication configuration AD FS 2.0 server.
Test claims-based authentication within the access.

Install and configure AD FS 2.0

CRM 2011 with a variety of STS provider ( STS Provider ) together. This article uses Active Directory Federation Services (AD FS) 2.0 to provide a security token service (security token service ).

Note: AD FS 2.0 will be installed to the default site, so install AD FS 2.0 , you must have CRM 2011 installation in the new site. (Remember we said that earlier)

IIS Looks like this if it is correctly installed:

If you only see the default website with CRM installed in that. Start AGAIN!

Download the AD FS 2.0

From the following link to download the AD FS 2.0

Active Directory Federation Services 2.0 RTW( http://go.microsoft.com/fwlink/?LinkID=204237 ).

Install AD FS 2.0

In the installation wizard, select the federation server role installed, for more information refer to

Install the AD FS 2.0 Software( http://go.microsoft.com/fwlink/?LinkId=192792 ).

Configure AD FS 2.0

1 in the AD FS 2.0 server, click Start , then click AD FS 2.0 Management .

2 In the AD FS 2.0 Management page , click AD FS 2.0 Federation Server Configuration Wizard .

3 In the Welcome page , select Create a new Federation Service , and then click Next.

4 In the Select Deployment Type page , select Stand-alone Federation Server , and then click Next.

5 Choose your SSL certificate (the choice of a certificate created *. contoso.com ) ,add a Federation Service name ( for example , sts1.contoso.com), and then click Next.

Note: Only you as the AD FS 2.0 sites when using the wildcard certificate, only need to add the Federation Service name.

6 Summary page, click Next.

7 Click Close to close the AD FS 2.0 Configuration Wizard.

Note: If you have not added ( sts1.contoso.com ) to add DNS records, then do it now.

Verify the AD FS 2.0 is working

Follow the steps below to verify that the AD FS 2.0 is working :

1 Open Internet Explorer.

2 Enter the federation metadata of the URL , for example:

https://sts1.contoso.com/federationmetadata/2007-06/federationmetadata.xml

3. to ensure that no certificate associated with the warning appears.

Claims-based authentication configuration CRM 2011server

After you install and configure the AD FS 2.0 , we need to configure the Claims-based authentication before setting CRM 2011 binding types ( Binding type ) and the root domain (root Domains) .

According to the following steps to set up CRM 2011 bound for the HTTPS and configure the root domain address :

1 Open the CRM Deployment Manager.

2 In the Actions pane , click Properties .

3 Click the Web Address page .

4 In the Binding Type , select HTTPS .

5. Ensure that the network address for the binding CRM 2011 site SSL certificate and SSL ports. Because you configured for internal access to Claims-based authentication, so the address of the host for the root domain name. Port number must IIS in CRM 2011 is set in the port the same site.

6 For example, *. contoso.com wildcard certificate, you can useinternalcrm.contoso.com: 444 as the network address.

7 Click OK .

Note: If the CRM Outlook client configuration using the old binding value, then the need to be updated to use the new value. + Make sure you have a DNS entry for: internalcrm.

From the CRM 2011 is passed to the AD FS 2.0 of Claims data you need to use the Claims-Based Authentication Configuration Wizard (described below) specified in the certificate for encryption. Therefore, CRM Web application CRMAppPool account must have read the certificate’s private key encryption ( Read ) permissions.According to the following steps to give this permission:

1 in CRM 2011 server , run the Microsoft Management Console (Start => Run MMC).

2 Click Files => Add / Remove Snap-in …

3 left panel, select Certificates , click Add to add to the right panel.

4 In the pop-up window, select Computer account .

5 next page, select Local Computer , click Finish .

6 Click OK .

7 Expand the Certificates ( Local Computer ) => Personal, select Certificates .

8. In the middle panel, right-click you will be in the Claims-Based Authentication Configuration Wizard to specify the encryption certificate (in this case *. contoso.com ), click All Tasks => Manage Private Keys.

9 Click Add , add CRMAppPool account (if you are using Network Service , select the account directly), and then give Read permissions.

Note: You can use IIS Manager to view CRMAppPool what account to use. In the Connections panel , click Application Pools , and then see CRMAppPool under Identity .

10 Click OK .

Configure Claims-Based Authentication

Below, we setup Claims-Based Authentication Configuration Wizard ( Configure Claims-Based Authentication Wizard ) to configure the Claims-Based Authentication. To learn how PowerShell to configure Claims-Based Authentication, refer to the English original.

1) Open the Deployment Manager.

2) on the left navigation panel, right-click Microsoft Dynamics CRM , and then click Configure Claims-Based Authentication.

3) click Next.

4) In the Specify the security token service page , enter the Federation metadata URL, such as

https://sts1.interactivewebs.com/federationmetadata/2007-06/federationmetadata.xml

Note: The data is usually in the AD FS 2.0 website. Can this URL copied into IE to seeFederation metadata , to ensure that this is the correct URL . Using IE to access the URL can not have a certificate-related warnings (Ignore that crap!)

5) Click Next .

6) In the Specify the encryption certificate page , click on Select…

7) select a certificate, where we choose *.interactivewebs.com.

8) This certificate is used to encrypt the transmitted AD FS 2.0 authentication security token service security token.

Note: Microsoft Dynamics CRM service account must have the private key encryption certificate Read permission.

10 Click Next . Claims-Based Authentication Configuration Wizard validates the token and certificate you specified.

11 In the System Checks page, if the test passed, click Next .

12 In the Review your selections and then click Apply page , just to confirm the input, and then click Apply .

13. On this page, note which of the URL , because then, you will use this URL to add a trusted party ( Relying Party ) to the security token service.

14 IMPORTANT – Click View Log File

15 Scroll to the end, and Copy the URL from the bottom of the file.

- This will be used in the next configuration. Note that this is different to the URL used in step 4 above, as it represents the internal URL. Subtle but vital (and the cause of frustration the first 10 times we tried this).

16 Click Finish.

17 Validate that you can browse to the URL above. If you cannot view this in a browser, then have a look again at your permissions on the certificate in relation to the account on the application pool in IIS for CRM. Read above: Claims-based authentication configuration CRM 2011server.

18. Once you can browse this URL, you are done here.

Claims-based authentication configuration AD FS 2.0server

After completion of the previous step, the next step we need AD FS 2.0 to add and configure the statement provider trust ( claims Provider trusts ) and the relying party trust ( Relying Party trusts ).

Configure claims provider trusts

You need to add a claims rule come from Active Directory to obtain user ‘s UPN (user principal name) and then as a UPN delivered to MS CRM . Follow these steps to configure the AD FS 2.0 to UPN LDAP attribute as a claim is sent to the relying party ( Relying Party ):

1 installed in the AD FS 2.0 on the server , open AD FS 2.0 Management.

2 In the Navigation Pane , expand the Trust Relationships , and then click the Claims Provider Trusts.

3 In the Claims Provider Trusts under , right-click Active Directory , and then click Edit Claims Rules.

4 in the Rules Editor , click Add Rule.

5. In Claim rule template list , select the Send LDAP Attributes as Claims template ,and then click Next.

6 Create the following rule:

Claim rule name: UPN Claim Rule ( or other descriptive name )

· Add the following mapping:

Attribute Store: Active Directory
LDAP Attribute: User Principal Name
Outgoing Claim Type: UPN

7 Click Finish , then click OK close the Rules Editor.

Configuration relying party trusts

In the open claims-based authentication, you must ensure CRM 2011 server configured as a relying party to use from the AD FS 2.0 statement to internal access claims certification.

1 Open AD FS 2.0 Management.

2 In the Actions menu, click Add Relying Party Trust.

3 In the Add Relying Party Trust Wizard , click Start.

4 In the Select Data Source page , click Import Data about the Relying Party Online or published on a local Network , enter the positioning federation metadata.xml file URL.

Federation metadata is set Claims when created. Use Claims-Based Authentication Configuration Wizard. The URL used here is IMPORTANT – Read point 14 in the above section. It is the URL retrieved from the VIEW LOG FILE That we did when from configuration of Claims Based Authentication: In this case

https://internalcrm.interactivewebs.com:444/FederationMetadata/2007-06/FederationMetadata.xml

Note: Ensure that no certificate-related warnings appear when hitting the URL.

5 Click Next .

6 In the Specify Display Name page , enter a display name, such as CRM Claims Relying Party , and then click Next.

7 In the Choose Issuance Authorization Rules page , choose Permit All users to access this Relying Party , and then click Next.

8 In the Ready to Add Trust page , click Next , then click Close .

9. When the Rule Editor appears , click Add Rule . Otherwise , the Relying Party Trusts list , right-click you create a relying party objects, click the Edit Claims Rules , and then click Add Rule.

10. In Claim rule template list , select the Pass Through or Filter an Incoming Claim template, and then click Next.

11 create the following rule:

· Claim rule name: Pass Through UPN ( or other descriptive name )

· Add the following mapping:

Incoming claim type: UPN
Pass through All claim values

12 Click Finish .

13 In the Rule Editor , click Add Rule , in Claim rule template list , select the Pass Through or Filter an Incoming Claim template , and then click Next :

· Claim rule name: Pass Through Primary SID ( or other descriptive name )

· Add the following mapping:

Incoming claim type: Primary SID
Pass through All claim values

14 Click Finish .

15 In the Rule Editor , click Add Rule

16. In Claim rule template list , select the Transform an Incoming Claim template , and then click Next.

17 create the following rule:

· Claim rule name: Transform Windows Account Name to Name ( or other descriptive name )

Incoming claim type: Windows account name
Outgoing claim type: Name
Pass through All claim values

18 Click Finish , to create a good three rule later , click OK close the Rule Editor

Test claims-based authentication within the access

You should now be able to use the claims certified to the internal access CRM 2011 a

1 Open the Deployment Manager.

2 Expand the Deployment Manager node , and then click on Organizations .

3 Right-click your organization , and then click Browse . so you can open the CRM web page of ( for example: https://internalcrm.contoso.com:444 ).

Trouble Shooting

If the CRM web page can not be displayed, then run the following iisreset and then try again.

If the CRM web page still does not show, then you may need to setup AD FS 2.0 server setup a SPN (Service Principal Name) . Re-run the Claims-Based Authentication Wizard, and then browse to the Specify the security token service page, note the AD FS 2.0 server in the Federation metadata URL in the name. (In this case sts1.interactivewebs.com )

http://blogs.msdn.com/b/crm/archive/2009/08/06/configuring-service-principal-names.aspx

1 Open a command line tool .

2 Enter the following command : ( application, in your own environment, substitute the name of the name of the command line )

c: \> setspn -a http/sts1.interactivewebs.com fserver4\VSERVER08$

fserver4\VSERVER08 = the domain and machine name of the server.

c: \> iisreset

3 and then re-access the Microsoft Dynamics CRM Server 2011 site, so you should be able to successfully access to the CRM 2011 Web page.

http://technet.microsoft.com/en-us/library/gg188614.aspx

If you receive ADFS – sts1 errors.

There was a problem accessing the site. Try to browse to the site again.
If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.
Reference number: xxx

And or if you look in your log files under ADFS 2.0 You will see errors like this.

In our case, this was because we used the external Metadata URL and not the Internal URL that we should have copied from the "View Log File" When configuring the Claims Based Authentication. Step 14 in the section above.

Note the difference between this:

https://internalcrm.interactivewebs.com:444/FederationMetadata/2007-06/FederationMetadata.xml

and the original meta data check we did with:

https://sts1.interactivewebs.com/federationmetadata/2007-06/federationmetadata.xml

We incorrectly figured it would be pulling the same XML data. It does NOT!

Configuration Claim-based authentication -external access

Open to the CRM 2011 Data Claims-based authentication of external access, you need to do the following steps:

1 complete contents of the previous section: Configuring Claim-based authentication- internal access.

2 for the IFD configuration CRM 2011 server.

3 for the IFD configuration AD FS 2.0 server.

4 Test claims-based authentication external access.

The IFD configuration CRM 2011 server

When opening Claims certified internal access, you can open by IFD external claims visited. The following describes using the IFD Configuration Wizard to configure, if you want to learn how to use PowerShell to be configured, refer to the English original.

1 Open the Deployment Manager.

2 In the tree structure , right-click Microsoft Dynamics CRM , and then click Configure Internet-Facing Deployment.

3 Click Next.

4 Fill in the correct domain information for the Web Application, Org, and Discovery Web services. Remembering here that in our case: *.interactivewebs.com was the name of the wildcard certificate used, and that PORT 444 was the port we configured for the CRM Web Instance in the bindings for IIS.

Thus we use:

Web Application Server Domain: interactivewebs.com:444
Organization Web Service Domain: interactivewebs.com:444
Web Service Discovery Domain: dev.interactivewebs.com:444

Note – Enter the domain name, rather than the server name .

If the CRM installed on the same server or servers are installed in the same domain, then the Web Application Server Domain and Organization Web Service Domain should be the same .
Web Service Discovery Domain must be a Web Application Server Domain as a subdomain like the "dev." that we setup in DNS earlier.
domain name must be on the SSL certificate name

Domain examples :

Web Application Server Domain: contoso.com: 444
Organization Web Service Domain: contoso.com: 444
Web Service Discovery Domain: dev.contoso.com: 444

For more information on the website, please refer to Install Microsoft Dynamics CRM Server 2011 on multiple computers( http://go.microsoft.com/fwlink/?LinkID=199532 )

5 In the Enter the external domain where your Internet-facing servers are located input box , enter for your internet to CRM 2011 server located outside the domain of information, and then click Next .

You must specify the domain specified in the previous step Web Application Server Domain sub-domains . default , will be "auth." added to the Web Application Server Domain before.

Domain examples :

External Domain: auth.contoso.com: 444

6 In the System Checks page , if there is no problem, click Next.

7 In Review your selections and then click Apply page , confirm your input , and then click Apply.

8 Click Finish .

9. Open a command line tool, run: iisreset

The IFD configuration AD FS 2.0 server

To open CRM 2011 on the IFD , you need to add AD FS 2.0 server for the IFD to create a relying party endpoints. Follow these steps:

1 open AD FS 2.0 Management .

2 In the Actions menu, click Add Relying Party Trust.

3 In the Add Relying Party Trust Wizard , click Start .

4 In the Select Data Source page , click Import Data about the Relying Party Online or published on a local Network , enter the positioning federation metadata.xml file URL.

Note – This is almost the same URL as we used previously, but has the .auth sub domain that we used in point 4 above. For use the Federation metadata is configured IFD when created. In this case https://auth.interactivewebs.com:444/FederationMetadata/2007-06/FederationMetadata.xml .

Check in your browser the URL, to ensure that no certificate-related warnings appear.

5 Click Next.

6 In the Specify Display Name page , enter the display name , such as CRM IFD Relying Party , and then click Next.

7 In the Choose Issuance Authorization Rules page , select the Permit all users to access this relying party options , and then click Next.

8 In the Ready to Add Trust page , click Next , then click Close .

9. If the Rule Editor appears , click Add Rule. Otherwise , the Relying Party Trusts list ,right-click you create a relying party objects, click the Edit Claims Rules, and then click Add Rule.

10. In Claim rule template list , select the Pass Through or Filter an Incoming Claim template, and then click Next.

11 create the following rule:

· Claim rule name: Pass Through UPN ( or other descriptive name )

· Add the following mapping:

Incoming claim type: UPN
Pass through All claim values

12 Click Finish .

13 In the Rule Editor , click Add Rule , in Claim rule template list , select the Pass Through or Filter an Incoming Claim template , and then click Next :

· Claim rule name: Pass Through Primary SID ( or other descriptive name )

· Add the following mapping:

Incoming claim type: Primary SID
Pass through All claim values

14 Click Finish .

15 in the Rules Editor , click Add Rule ,

16. In Claim rule template list , select the Transform an Incoming Claim template , and then click Next .

17 create the following rule:

· Claim rule name: Transform Windows Account Name to Name ( or other descriptive name )

Incoming claim type: Windows account name
Outgoing claim type: Name
Pass through All claim values

18 Click Finish , you have created three rule later , click OK close the Rule Editor .

Test claims-based authentication to access external

Now, you should use the claims certified external access CRM 2011 a. In IE the browser CRM 2011 external address (for example: https://org.contoso.com:444 ), you will see the following pages:

Enter the user name password, log CRM 2011.

Final Notes

An additional log cleanup step here.

Like anything Microsoft, this was not easy. It took us over 10 attempts drawing on over a dozen resources to get this worked out. For us, the main tripping points related the the meta data URL’s used in configuring the endpoints. Our fault, but it also appears to be a common error to other administrators on the net.

To Microsoft – you documentation sucks badly! If I never read another White Paper it will be too soon!

Thanks to – Jackie Chen (Chen Pan) Your blog was GOLD!

Leaving Files Encrypted

The Easy Fix – Remove Encrypted Tag

Here are some basic setup tips for email in Microsoft CRM 2011

Recommended email settings in CRM 2011

Troubleshooting Tips

Pending Email warning

Automatically Resending Failed Email Messages

Still Need Help?

CRM 2011 Rollup 10 Killed My CRM

The solution

Opencart and PHP running on IIS, we found Permissions incorrect on uploaded files

The Problem

Why the solution works.

WordPress 3.5 Manual Fix

The Problem

The Solution

The Permanent Fix

Setup of SmarterMail Autodiscover configuration

External Testing

Help

Problem

500 – Internal server error.

There is a problem with the resource you are looking for, and it cannot be displayed.

Solution

Cause

The Fix

The Problem

To Solution

Step 1 – Web Platform Installer

Step 2 – Setup PHP on the server.

Step 5 – Download and unzip to Web Located Folder the contents of OpenCart

Step 6 – Create an IIS instance to hit that directory.

Step 7 – Set the permissions for IIS.

Step 8 – Visit the home page.

Step 9 – Deleted this directory.

Migration

Bindings

How to add binding information to a site

To Extend the Auto Logout of IFD CRM 2011

How to Enable XRM gzip Compression in IIS

CRM 2011 Email Router Problems–She’s a Fickle Bitch

We have not fixed this yet!

One Big Problem

CRM Migration

The Problems

First one

The Cause

The solution

The Existing Setup

Importantly

Backup First

Test First

Apply a Wildcard SSL Certificate

Additional SSL Certificate Imports

Binding site for the default SSL certificate

For the CRM 2011 binding site SSL certificate

DNS configuration

Lets Get Basic

The DNS Goal

Hosting Your Own DNS

Test DNS

Firewall configuration

Configuration Claim-based authentication -internal access

Install and configure AD FS 2.0

Download the AD FS 2.0

Install AD FS 2.0

Configure AD FS 2.0

Verify the AD FS 2.0 is working

Claims-based authentication configuration CRM 2011server

Configure Claims-Based Authentication

Claims-based authentication configuration AD FS 2.0server

Configure claims provider trusts

Configuration relying party trusts

Test claims-based authentication within the access

Trouble Shooting

Configuration Claim-based authentication -external access

The IFD configuration CRM 2011 server

The IFD configuration AD FS 2.0 server

Final Notes

Also Look at these Updates