Claims Based Authentication - generate wrong Relying Party Identifier

(0) Share

Report

Posted on by Loredana Iacob

Hello,

I am trying to set-up the Claim based authentication for Dynamics 365 On-Premises.

I have installed and configured AD FS on the same box with crm - windows server 2016.

I have successfully configured crm server for claim-based authentication using Deployment Manager and security token service federation metadata url.

I've got some issues during the configuration of claim-based for AD FS - the generated identifiers are wrong - should be only one: internalcrm url as is mention on microsoft documentation.

Please see the generated list below:

Any advice or suggestions is very much appreciated.

Thank you.

I have the same question (0)

All responses (2)

Answers (0)

Suggested answer

Pedro Cadavez de Fr... on at

Like (1)

Report

Hello Loredana,

Hope you are well.

It seems you might be hitting the general problem when using ADFS on the same server as CRM.

Your internalCRM relying party trust is reading ADFS federation metadata and not CRM due to both being listening on the same port.

We don't reccomend this due to by default there is a conflict on CRM and ADFS using https:443 and CRM sandbox using TCP:808 while adfs also uses it.

In case you still want to go ahead the general reccomendation is to move CRM to use another port like 444 and keep ADFS on 443 due to the extra settings ADFS needs to be able to change correctly a port (bindings, etc). And change ADFS tcp port to 809.

Please use these articles:

https://interactivewebs.com/index.php/crm/how-to-set-up-microsoft-crm-2016-ifd-on-windows-2012-r2-server/

https://crmtipoftheday.com/668/adfs-and-crm-on-the-same-server/

If you still have doubts, let us know.

Was this reply helpful? Yes No
Loredana Iacob 15 on at

Like (0)

Report

Thank you so much for your help, Pedro.

Yes, you are right, the federation metadata urls on 443 seems to be reserved by AD FS. I've followed the provided suggestions and it runs smoothly now.

I still have a question, please. I am trying to configure IFD for enable the server based integration between Dynamics 365 On-premises and Sharepoint online - needed just for document storage feature. The point is that we would like to keep the CRM in the local network, just for internal access. Can this be possible, please?

Thanks.

Kind regards,

Loredana

Was this reply helpful? Yes No