I am writing a publicly available middleware web application to enable our application to communicate with Dynamics 365 to read and write data (i.e. Opportunities etc.)
Currently, i have implemented certificate based authentication, where the certificate is stored within the Azure App Service, the Certificate Thumbprint is stored within the app service's app settings and the Dynamics 365 instance url is provided via a JavaScript call to:
var globalContext = Xrm.Utility.getGlobalContext();
var url = globalContext.getClientUrl();
from some JavaScript in a Dynamics Web Resource that acts as an entry point to our application from within Dynamics (from a button click, the WebResource code is executed, which then does a window.open to the url of our application with some query string parameters generated via the Web Resource's JavaScript code)
I instantiate a new CrmServiceClient like this:
serviceClient = new CrmServiceClient(null, StoreName.My, KeyVaultConfig.CertificateThumbprint, new Uri(instanceUrl), true, null, KeyVaultConfig.RegisteredAppClientId, null, null);
The serviceClient.OrganizationServiceProxy is then cast as an IOrganizationService which is then used throughout the rest of the application to read and write data to Dynamics 365.
This all works fine, but i am very concerned about a security issue, if a hacker gets the URL to our application, with the appropriate querystring paramaters (i.e. the organisation's dynamics 365 instance url) they effectively have access to the Dynamics 365 instance via our application, because there are no other authentication checks carried out.
In other CRM integrations (i.e. Salesforce.com) we use the current SessionId of the user to pass to our application which has an expiry period, meaning if a hacker managed to get the URL, their access would expire soon after. This is not the case with Dynamics 365.
Does anyone have any suggestions I can implement to make this more secure? I dont want to add in an additional username/password prompt screen to the application every time it is accessed from within Dynamics 365 as this will put people off using it.
