CRM 2011 Kerberos Troubleshooting - Report Wizard FetchXml Related Issue

Hi all,

Recently one of our clients had issue when running reports created through the report wizard. After some investigations, it turned out that the FetchXMLDataSource is having some connection issue with an error log recorded something like: A call to SSPI failed, see inner exception.

 This is surely a kerberos authentication issue. After a few good hours reading documentations on how to set up proper kerberos for CRM 2011, I managed to get all working nicely. I summarised all what I've done so that it may help you down the track:


  1. Check the CRMAppPool service account whether you are using NetworkService or a domain account. The best practice is to use custom domain account (separate from your CRM admin account as well). In my case I have something like domain\CRM2011APP. If you set this up during installation it should at least be in the PrivUserGroup and PrivSqlServerGroup as well.

  2. Open your AD manager and check if that account has kerberos delegation enabled (On delegation tab). 

  3. On your IIS Manager (IIS 7/7.5), click your Microsoft Dynamics CRM website -> Authentication -> Windows Authentication -> Advanced settings. Make sure Kernel mode is ticked. Also check the Providers and make sure you have Negotiate and NTLM (in this order).

  4. Set the SPN to enable token delegation for the account to the CRM server. Let's say your CRM application server url is http://mycrm.domain.com:5555, then open your command prompt and enter in:
    • setspn -a http/mycrm domain\CRM2011APP
    • setspn -a http/mycrm.domain.com domain\CRM2011APP

  5. (From Microsoft KB2590774) Open IIS Manager. Expand the server and then select Sites. Then select the Microsoft CRM website. Under Management, select Configuration Editor. In the From: section above the properties select "ApplicationHost.config  For the "Section:" location, select system.webServer > security > authentication > windowsAuthentication. In the properties page, set useAppPoolCredentials to True, then select Apply. 
Do iisreset afterwards and try opening CRM, Outlook for CRM and the reports. It should work fine now.

P.S: Only the system.webserver windows authentication should have the useAppPoolCredentials to True. Leave the Microsoft Dynamics CRM windows authentication alone.

HTH,
Andreas  

Comments

  1. AnonymousNovember 26, 2012 at 7:35 AM

    Thanks for sharing all this info on CRM. Very helpfull!

    ReplyDelete

Post a Comment

Popular posts from this blog

SharePoint 2013 anonymous access add attachments to list item

Image
Hi, Sometimes you want to enable anonymous access to be able to add a list item but at the same time attaching some documents. After good few hours playing around trying to make this work, turns out that we can achieve this functionality. The trick is to use RunWithElevatedPrivileges method for the file upload. We also want the file upload functionality to be available on the NewForm.aspx as it wouldn't make sense to put it in other forms as any user would be able to upload files to other records. The result will be something like this: When it is saved, the user is redirected to the display form: The close button then will take the user back to the homepage (or any page you desire) The steps: 1. Create an ascx control to host your file upload control in your project.  Put the below script in the ascx as well (credit to this post ): The code behind: 2. Create custom form template. You have to put the ascx in the CONTROLTEMPLATES folder of the ...
Read more

Sitecore custom publish agent from specific node and at a specific time

Hi all, As you all know, scheduled publishing will not run automatically unless you enable PublishAgent task in Sitecore config. By default, all items that are in publish queue will get published when this task triggers. This includes all items in the final workflow state and all items that don't have workflows. Sometimes this is not what you want. Maybe you don't enable workflow on media items and you don't want the items to go live when they are not ready. The workaround is to create your own PublishAgent task. Looking at the one provided, we can easily extend the code to insert the RootItem to the PublishOptions (this only works with Full or Smart publish mode however): You will notice that on the Run method I check whether the server time is around the time I set in the parameter (thanks to this post for the code). This will enable us to run the task near the specific time we set (e.g. midnight). In the config patch, just add this to enable the custom agent...
Read more

CRM Plugin - Parent and Child Pipeline

This concept tends to confuse people often - and I was no exception. I came across this problem when trying to create custom auto-numbering for one of my projects. Creating auto-number for Opportunity is easy. This is because the user creates opportunity straight from the home screen - thus the plugin runs on parent pipeline. However, it's a different story if you are dealing with Quote entity. Quote can be created in 2 ways, through the home screen OR the opportunity screen. If you create it from the latter, it will run on the child pipeline and you will find that your plugin will not work. Registering it as a child pipeline is easy, but CRM makes it harder since you can't use ICRMService. Instead, you have to create CRMService manually by using this piece of code: Not only that, with the child plugin you can't use Query expression to fetch other entities in your code unless you register it as ASYNCHRONOUS plugin. Mark Kovalcson in his blog found out that: A C...
Read more