CRM 2016 Outlook Client SSPI negotiation failed multiple domains

(0) Share

Report

Posted on by Jeroen de Wit

Hi,
I am struggling to configure the Outlook client (Office 2010 x86, Windows 7) at my customer. They are using two domains to authenticate their users.
Domain A (rad.lan) Domain B (ocw.local) has a one-way trust configured between them. CRM is installed in the rad.lan domain and running under HTTPS (no IFD configured).
The web client works perfectly fine but I am unable to configure the Outlook Client which results in an SSPI negotiation failed error.

CRM 2016 SP1
HTTPS (443, no IFD)
Host header in DNS is a c-name and resolves correctly (same in IIS & deployment manager)
Correct date/time zones
Correct certificates

I have tried forcing credentials on my laptop (connected through VPN) using both credential manager and editing the configuration file (to use custom credentials instead of default Windows) but this also result in an access is denied error when searching for organizations.
Now the implementation guide states that users from another domain cannot configure the Outlook Client and that this is an unsupported scenario (without stating which is supported):

Users in a different domain cannot install Dynamics 365 for Outlook

If the user domain account is in a domain different from the Dynamics 365 organization, the user will receive an error message (see below) when installing Dynamics 365 for Outlook. This is not a supported scenario.
Error message:
There is a problem communicating with the Microsoft Dynamics 365 server. The server might be unavailable. Try again later. If the problem persists, contact your system administrator.
The caller was not authenticated by the service.

Can anyone clarify on this? Am I forced to implement IFD to make this situation work?
Kind regards,
Jeroen de Wit

*This post is locked for comments

I have the same question (0)

All responses (4)

Answers (0)

Suggested answer

Andreas Cieslik 9,267 on at

Like (0)

Report

Please check CRM's AD requirements:

technet.microsoft.com/.../hh699704.aspx

states:

For users who access Microsoft Dynamics 365 from another domain and are not using claims-based authentication, a one-way trust must exist in which the domain where the Microsoft Dynamics 365 Server is located trusts the domain where the users are located.

and:

To add users to Microsoft Dynamics 365 that are not authenticated by using claims-based authentication, a two-way forest trust is required.

Was this reply helpful? Yes No
Jeroen de Wit on at

Like (0)

Report

This explanation seems very ambiguous to me. There is a one-way trust present between the domain that has the CRM installed (rad.lan) and the external domain (ocw.local). I'll have to check whether the OCW domain is in a different forest. If so a two-way trust is required if I understand this correctly?

Nevertheless, trying to configure a rad.lan user results in "access is denied" exceptions from my device. I can see the user successfully log-on in the event viewer on the CRM front-end server and Fiddler doesn't give me much information what kind of request is sent which would case the access denied message....

Was this reply helpful? Yes No
Suggested answer

Andreas Cieslik 9,267 on at

Like (0)

Report

Maybe this thread can guide you towards the right direction:

community.dynamics.com/.../181986

You could try to use ADFS server and setup IFD to work around this issue.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hello. Tenfold can also help in integrating Microsoft Office 365 and Microsoft and enabling click to dial in Outlook. They also support MS Dynamics integration. Our click to dial also works on webpages opened in Chrome. www.tenfold.com/.../dynamics

Was this reply helpful? Yes No