Tuesday, 28 January 2014

Dynamics CRM 2013 ADFS 2.1 with windows 2012 - CRM Outlook client issue

If you configuring ADFS with Windows 2012 you will find that you can't configure the CRM Outlook Client. This is due to a bug in ADFS 2.1 which does not correctly set it's ADFS ActiveMexEndPoint to the correct location.

When you attempt to configure the CRM Outlook client you get:

14:44:16|  Error| Error connecting to URL: https://mycrm.com:444/XRMServices/2011/Discovery.svc Exception: Microsoft.Crm.CrmException: Authentication failed
   at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.AuthenticateClaims()
   at Microsoft.Crm.Outlook.ClientAuth.ClaimsBasedAuthProvider`1.SignIn()
   at Microsoft.Crm.Outlook.ClientAuth.ClientAuthProvidersFactory`1.SignIn(Uri endPoint, Credential credentials, AuthUIMode uiMode, IClientOrganizationContext context, Form parentWindow, Boolean retryOnError)
   at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.DeploymentInfo.LoadOrganizations(AuthUIMode uiMode, Form parentWindow, Credential credentials)
   at Microsoft.Crm.Application.Outlook.Config.DeploymentsInfo.InternalLoadOrganizations(OrganizationDetailCollection orgs, AuthUIMode uiMode, Form parentWindow)

In CRM the information for the ADFS ActiveMexEndpoint it's hold on the FederationProvider table column: ActiveMexEndPoint this information is written every time you configure Claims-Based Authentication. On the MSCRM_CONFIG database run the following command:

select * from FederationProvider

The default url looks like this:

And you need to update it to:

To udpate the ActiveMexEndpoint run the below query on your SQL database MSCRM_CONFIG database.

update FederationProvider
set ActiveMexEndpoint = 'https://myadfs.domain.com/adfs/services/trust/mex'

Alternatively you could run the following Powershell:

You can also apply a hotfix released specifically to correct this issue:

If you need assistance configuring ADFS in your company feel free to contact me on: nuno.m.costa@gmail.com

Thursday, 16 January 2014

Dynamics CRM Office365 email relay

This article walks you through how to relay CRM email to office 365 using both Email router and a SMTP virtual server.

The idea is to get the email router to forward all emails to the virtual SMTP server. Why use a SMTP virtual server? You can relay email to virtually any Mail server on the internet and the greatest advantage is to relay email from different senders e.g. if you have users in CRM where their primary email address is not the same as your company email address. With the virtual SMTP server you can choose where to send emails from those users.

Also and this is where we focusing our configuration is the ability for the SMTP server to relay emails to office365. Office 365 settings are the following:

  • SMTP server: smtp.office365
  • Port: 587
  • TLS 

We will go through the following items:

  1. Self-signed certificate
  2. Office365 settings
  3. SMTP server configuration
  4. SMTP domain configuration
  5. CRM Email Router
  6. Read Me

To install the SMTP server on windows 2008 or 2012 you use Windows Roles and Features control panel. Adding the new SMTP role to the server will automatically include the IIS management 6.0 mmc snap-in console to your administration tools this is required to manage the SMTP virtual server.

Note: Because Office 365 requires TLS you will need a certificate, a self-signed certificate will work perfectly.

1. Generate a self-signed certificate
Using IIS 7 console highlight the Server and click certificates:

On the right-hand side Click on create self-signed certificate. fill in the details and click finish

2. Office365 Set up
Before we configure the SMTP server we need to have an account which is allowed to connect to office365 and allowed to relay email to other users.

Navigate to portal.office365.com and navigate to Users and Groups click on the user account you want to use.

After you click on the user account go to licenses and make sure the user account has an Exchange Online license.

The account also needs SendAs permissions on the office365 exchange online instance. To set this permission you use the following powershell commands:

$Cred = Get-Credential
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic –AllowRedirection
Import-PSSession $s
Add-MailboxPermission -User -AccessRights FullAccess
Add-RecipientPermission -AccessRights SendAs -Trustee  

you can read more about the commands on the following articles:

3. Configuring SMTP server
Open the IIS 6.0 management console and you should see the below screenshot. right click the SMTP virtual server and click properties

On the General tab you don't have to change anything here unless you want to enable logging:

Click on the Access tab, here we need to make sure the relay options allow the email router to relay email. Click On the button Relay

Below I've chosen All except the list below, you can be specific here and specify the email router IP address so only the email router can relay email.

Delivery Tab will define the general settings of the SMTP virtual server:
  • Outbound connection Port
  • Default smart host (this is the server where emails are sent to)
  • Authentication with the smart host
Click on Outbound Connections.

And change the port to 587

Click on Advanced button and type:
  • FQDN (your office 365 domain): mydomain.onmicrosoft.com
  • Smart Host: smtp.office365.com

Click on outbound Security and choose:
  • Basic Authentication
  • type username@domain.onmicrosoft.com
  • tick the TLS box

4. SMTP Domain
we need a domain to tell the SMTP server that for this specific domain we want to send this emails to that smart and this is the beauty of having a SMTP virtual server.

Click on domains and right click select new domain.

Select 'Remote domain'

Type your office 365 domain:

when your domain is created on the domain section right click and select properties:

On the below screen:
  • Tick the box to allow incoming email to be relayed to this domain
  • Choose Forward all mail to smart host
  • Click on Outbound Security

Type the user account and password for office365 and tick the box TLS.

5. Email Router configuration
Okay we are almost there :)
Now the email router needs to be configured to point at the virtual SMTP server so it can send all CRM emails to the SMTP server to be processed.

On the email router configuration create a new outgoing profile and on the Email server type your new SMTP virtual server if is located on the same server you can type localhost.

Now link your deployment with the new outgoing configuration profile.

Read Me
If you need assistance configuring office365 relay email please let me know on nuno.m.costa@gmail.com

Hope the article was helpful. if you need to relay email to multiple domains in office365 you can add extra domains, if you need relay email to domains outside office365 you can add a new virtual server to hold the other domains.