Tuesday, December 29, 2009

SPN Kerberos CRM 4.0 - Again

Another pain in the neck


In Microsoft Dynamics CRM 4.0 you might need to access the sql filtered views from a custom application. Using the webservices can be to slow in complex queries. So having a custom form using a sql connection with SSPI might be the answer.
BUT though your custom pages are placed inside the ISV folder of the CRM application, and you are using the appropriate security configurations for the sql connection - and you application is actually working outside the crm application (ie when you debug using the build in cassinni webserver in VS2008) - it might concider you being anonymous.
This is due to delegation using kerberos for the ServiceAccount that is running the SQL Service for the SQL instance of the CRM Databases.


In order to configure it correctly using the setspn tool from MS, it has been a hassle to me. Try and set it up - Try to see if it works! No error messages, no directions on what might be wrong.


A tool has been developed by Brian Murphy Booth, Escalation Support Engineer at MS Support. The tool can be downloaded here.
To save you from some of the troubles i discovered, place the in a new virtual directory in the root of the webserver.


As for clustered servers, you need to address that when you add a new back-end server.

No comments:

Post a Comment