So I want to reply here. I know this is a few months old but I want to provide a response as more on the documentation end.
I have been working with a CRM customer that was using Kemp LoadMaster as well. In a collaboration effort with Kemp, we were able to determine the root cause of the issue and how to fix it.
The problem is that Kemp uses VIA headers rather than any sort of custom headers by default. VIA headers are explained in section 14.45 in the URL below:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
Essentially what happens is that the URLs for the CRM requests are changed from the internal or external CRM urls to the FQDN of the server. This results in the requests going to CRM with the authentication method of Kerberos. The problem here is that CRM is expecting a claim. You will notice that CRM never sends a 302 to ADFS because the request is not being done by the internal/external claims URL. So how do we fix this?
Well we need Kemp to use a custom header that is going to be the same on every request. We can do that in Kemp in a couple of ways. You only need to use one of these two settings outline below.
1. Modify Persistence
If you wish to use persistence, then the recommended Persistence option is Super HTTP. You can find more about this option here, page 26:
http://www.kemptechnologies.com/fileadmin/content/downloads/documentation/6.0/KEMP_LoadMaster_Configuration_Guide.pdf
To accomplish this task using Persistence, follow the instructions below:
a. Access the Kemp web interface
b. Click on Virtual Services
c. Click on View/Modify Services
d. Locate the Virtual Services for CRM and click on Modify
e. Click on Standard Options
f. Next to Persistence Options, change it to Super HTTP
g. Click on Advanced Properties
h. On Add Header to request set it to the following:
FRONT-END-HTTPS:on
i. Click on Set Header
2. Add a custom header
If you do not wish to use persistence, we can easily add a custom header to these requests. To do that follow these instructions:
a. Access the Kemp web interface
b. Click on Rules & Checking
c. Click on Content Rules
d. Click on Create New …
e. Set the following:
Rule Name: adfrontendheader
Rule Type: Add Header
Header Field to be Added: FRONT-END-HTTPS
Value of Header Field to be Added: on
f. Click on Create Rule
g. Click on Virtual Services
h. Click on View/Modify Services
i. Locate the Virtual Services for CRM and click on Modify
j. Click on Advanced Properties
k. Click on Show Header Rules
l. Under Request Rules, change the drop down to “Add Header: addfrontendheader”
m. Click on Add
After you have one of the Custom Header options set within Kemp, now you need to access the Deployment Manager on the CRM server.
1. Within the Deployment Manager, click on Microsoft Dynamics CRM
2. On the right side of the Actions pane, click on Properties
3. Now click on Web Address
4. Click on Advanced
5. If you are using the load balancing option within Kemp, ensure you check “This deployment uses an NLB”
6. Under SSL Header, enter the following:
FRONT-END-HTTPS:on
7. Click OK > OK
Now when accessing CRM, you should be properly redirected to the ADFS server and get a proper Claim. I hope this helps anyone using a Kemp LoadMaster. I will be soon publishing this same information within an article on the Dynamics CRM Support Team blog found here:
https://community.dynamics.com/product/crm/crmtechnical/b/dynamicscrmsupportblog/default.aspx
