CRM SDK Connection String to CRM Online with Federated AD

(0) Share

Report

Posted on by Brad Sprigg

985

Hi all

I am looking to connect Visual Studio to CRM Online, in a situation where we are dealing with a customer's CRM Online which has been federated with their AD for single-sign on. At this point I have been unable to connect from outside their network, using a very similar connection string to what is working with another CRM Online instance that isn't federated.

For the working instance, and connecting via Microsoft.Xrm.Tooling.Connector, I am using a connection string like

AuthType=Office365; Url=workingcrminstance.crm6.dynamics.com; Username=brad_sprigg@workinginstance.onmicrosoft.com; Password=xxxxxxx

Using the customer's CRM Online instance, I use a similar connection string and I am unable to connect. The CrmServiceClient object returns a LastCrmError of "Unable to Login to Dynamics CRMOrganizationServiceProxy is null".

Using Fiddler, I can see it redirect to the customers ADFS and then there is an error 500 code when it tries to get a response from /adfs/services/trust/13/usernamemixed

The message returned is "The security token could not be authenticated or authorized."

When I log into their CRM Online via a browser, I enter the email address in the CRM Online login screen, which redirects to the customers ADFS, where the login is instead entered in the format DOMAIN\username.

Has anyone dealt with this type of environment with the SDK and how did you manage to connect to their instance?

edit: Incidentally, trying to connect with XrmToolbox returns the same message of "The security token could not be authenticated or authorized."

*This post is locked for comments

I have the same question (0)

All responses (4)

Answers (0)

Inogic 709 on at

Like (0)

Report

Try with using updated assemblies for “CRM 2016 update 1” within your application to connect online CRM.

Thanks!
Sam

Was this reply helpful? Yes No
Brad Sprigg 985 on at

Like (0)

Report

Hi Sam, thanks for the reply. I have since tried the assemblies from both the Dynamics 365 and CRM 2016 Update 1 SDKs and both give the same result.

I am starting to think there is something strange with their Federated AD setup, the fact that the redirect relies on an email format login, and their ADFS login gateway does not like this format and instead wants DOMAIN\username could be throwing it off.

Was this reply helpful? Yes No
Luca Vaccari on at

Like (0)

Report

Hi Brad,

I'm dealing with a similar scenario in a Dynamics 365 context. Did you find any solution ? I'm trying to connect using a federated account to a Dynamics 365 online environment.

Thanks

Luca

Was this reply helpful? Yes No
Suggested answer

a33ik 84,331 Most Valuable Professional on at

Like (0)

Report

Brad,

Have you tried to use domain\accountname in your conectionstring?

Was this reply helpful? Yes No