How to Set Up Microsoft CRM 2016 IFD on Windows 2012 R2 Server
We already have a popular post for the configuration of IFD setup with CRM 2015, CRM 2013, CRM 2011. Now we are updating this post to support CRM 2016.
Microsoft have a compatibility listing for CRM 2016 here: https://support.microsoft.com/en-us/kb/3124955
The Development Setup
Once again we are running this configuration as a test environment for development. As such we will be running, we are running the server on a Hyper V server. A single VM machine, that is running a fully patched version of:
- Windows 2012 R2 SP2 64 Bit – (MSDN File: en_windows_server_2012_r2_x64_dvd_2707946)
- SQL 2014 R2 64 Bit – SQL Server 2014 Standard Edition x64 – (MSDN File: en_sql_server_2014_standard_edition_x64_dvd_3932034) – Patched to SP2
- Microsoft Dynamics CRM Server 2016 – en_microsoft_dynamics_crm_server_2016_x86_x64_dvd_7171743
NOTE: The Domain we have used for setup with this dev server is: iwebscrm16.com You can substitute your domain in place throughout these step by step IFD instructions CRM 2016.
Getting Windows Server Ready
1. Install and Update Windows 2012 R2.
2. From the Server Manager – Add Roles and Features
3. Role-Based or Feature-Based instilllation
4. Select the Server from the Pool (usually the default option)
5. Scroll Down and Select Web Server IIS
6. Add Features
And .NET 3.5 Features
7. Next / Next
8. under Web Server Roles (IIS) Use the default options, but add under Performance – Dynamic Content Compression
9. Next / Install
10. Update Window Server again as there is likely a restart update available.
11. After Restart. Ensure that you turn off the IE enhanced security. It’s Crap and no one benefits from it. This is done in the Server Manager under Local Security.
SQL 2014 Setup
1. First Up have the Windows Server Join the Domain you will be using.
2. Reboot and login with the domain admin account.
3. Start the SQL Install Disk
4. Click Instillation / New SQL Server Stand Alone
5. Enter Product Key / Next
6. Agree to Terms / Next
7. use Microsoft Update / Next
8. Ignore the Windows Firewall Warning at this Stage
9. Select SQL Server Feature Instillation / Next
10. Select: Database Engine Service / Full Text Indexing / Reporting Service Native / Management Tools Basic and Complete / Next
11. Leave Default Name
12. Server Configuration Default and Next
13. Windows Authentication Mode / Add Current User (Remembering we are logged in as a Domain Admin domain/administrator)
14. Install and Configure / Next
15. Install
16. After Completion, Check again for Windows Updates and Reboot. (At the time of writing this blog, the SP 1 for SQL 2014 will be installed if your install disks do not already have this. Like everything Microsoft, it’s not super reliable until they SP1 their product!).
Getting your Active Directory OU Ready
1. Login to your Active Directory Domain Controller as a Domain Administrator
2. Using the Active Directory Users and Computers, Select the Root and Create a new OU named something like Microsoft CRM 2016
3. Log Out of the Active Directory Domain Server.
Installing CRM 2016
During the install, we were asked to install services associated with the services required for CRM 2016.
We Selected all options on install:
Select “Create New Deployment” and enter theServer Name as the SQL server. 
If you are not sure of the name, Right Click “This Computer” from the start menu, and select Properties:
Browse to the OU we created in the Steps Above Getting the AD OU Ready, and select the OU we created there. “CRM 2016″
We selected the default account for authority. Note that the blog referenced above suggests a dedicated account for security. As we are setting up a dev environment we did not bother with this.
IMPORTANT
Create a new Website with port 5555
As we intend to set up the Email Router service on this server later, we set this server “VSERVER06” in this instance as the server for email router service, or you can leave this blank.
We set “CRM2016″ As the default initial test environment deployment.
Reporting Server defaulted to the server name/reportserver
We received a few warnings about the install:
For a deployment that is more secure, the Microsoft Dynamics CRM Sandbox Processing Service should be run under a least-privileged domain user account that is not shared by other Microsoft Dynamics CRM services on this computer.
For a deployment that is more secure, the Microsoft Dynamics CRM VSS Writer Service should be run under a least-privileged domain user account that is not shared by other Microsoft Dynamics CRM services on this computer.
Data encryption will be active after the install or upgrade. We strongly recommend that you copy the organization encryption key and store it in a safe place. For more information, see http://go.microsoft.com/fwlink/?LinkId=316366.
The only one of real interest in our Dev environment would be the last item. making a backup of data encryption keys is always a good idea.
Test First
Test that your CRM setup is working. Go to the local computer name (ours is vserver12) on the correct port: http://vserver12:5555
We called our Deployment of CRM – “CRM2016″ in the CRM Setup phase above, so the URL redirects to: http://vserver12:5555/CRM2016/main.aspx
Because we were were logged in as the server administrator, we were able to load, but may take some time to fire up the various server requirements.
Apply a Wildcard SSL Certificate
In CRM, the accessing of deployments is handled by the sub domains. So if we call a deployment (known as organisation) “business1″ we will access that as: https://business1.domain.com:444 (note the the :444 will be because of how we set up Internet Facing Deployment.
For testing, we purchased a standard Wildcard SSL certificate that applied that to the IIS Server
In our case we registered a test domain: iwebscrm16.com and set the SSL wildcard to: *.iwebscrm16.com and applied that cert to the server. The services we used for purchasing the wildcard certificate were starts.com who provide a very cost effective certificate services. Once authenticated, certificates are free to issue.
Application for a certificate
Here, I will be a wildcard certificate, for example, describes how to create a certificate:
1) Open IIS Manager
2) Click the server name in the main screen double click Server Certificates
3) In the right panel, click Create Certificate Request…
4) fill in the following diagram each column, click Next
5) Cryptographic Service Provider Properties page change the Bit Length to at least 2048 click Next.
6) In the File Name page, enter C: \ req.txt , and then click Finish. (You can save it any place you like, with any name)
7) Open the certificate in Notepad, and copy the contents.
This is the text that is pasted into the Start SSL Certificate request page to generate the certificate:
8) After you finish generating the certificate text in StartSSL.com (Note that Start SSL is no longer an SSL certificate provider, we suggest ssl2buy.com) you get a bunch of code that looks similar to the request code. Copy that generated code
9) Paste the code back into a new Text / Notepad Document on the Web server, but call it something that ends in .cer (not .txt).
10) back to the IIS Manager, click No. 3) Step graph Complete Certificate Request …
11) Select the the file you created at point 9 above to complete the request.
12) Click OK.
Note: We did get an error message: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
In this instance, it turned out to be a crappy Microsoft Error. After doing some research, we found that it was likely meaningless and the cert installed correctly. We rebooted the machine and logged in again, to find that the CERT was there installed as we wanted it to be.
Binding site for the default SSL certificate
1) Open IIS Manager.
2) In the Connections panel, expand Sites , click Default Web Site.
3) In the Actions pane, click Bindings.
4) In the Site Bindings dialog box, click Add.
5) Type select HTTPS.
6) SSL Certificate , select the certificate you just created *. contoso.com , and then click OK.
Ours is *.iwebscrm15.com
7) Click Close.
For the CRM 2016 binding site SSL certificate
This is in effect repeating the above process like you did for the default certificate, but using a different port (444 for example). This way you are binding the same certificate to the two websites in your IIS instance.
1)Open IIS Manager.
2) In the Connections panel, expand Sites , click CRM Web Site.
3) In the Actions pane, click Bindings.
4) In the Site Bindings dialog box, click Add.
5) Type select HTTPS.
6) SSL Certificate , select the certificate you just created *. contoso.com .
7) Port to select a different 443 (e.g. 444 ) and port number, and then click OK
8) Click Close.
DNS configuration
We are going to add a few DNS “A” records so that the records listed in point 1-4 below in DNS Goal are resolving correctly to the IP address of your CRM server.
There are two ways you can achieve the desired result. But first lets understand the desired result.
- We make the assumption that your server is running at least one static IP address.
- Because this is Internet Facing, that IP needs to be accessible to the world.
- That same IP can be used for access to your server both internally on the matching we are playing with, and externally form anyone on the net.
Lets Get Basic
Start a Command Prompt, and work out what your IP address of the server is.
Click START > RUN > CMD
Type IPCONFIG – Enter
Under the name: IPv4 Address is a number that looks like: 66.34.204.220
That is Your IP Address of the Server.
The DNS Goal
Make sure that when you PING xxx.domain.com that it points to that IP address. Both for the world and for you when you do that on your server.
(xxx is the sub domain that we are about to configure.)
To configure CRM, we need some sub domains to point to the server IP.
Adding records in DNS like this:
- sts1.domain.com
- auth.domain.com
- dev.domain.com
- internalcrm.domain.com
- Your ORG name. org.domain.com (Where ORG is the CRM deployment name of your organization or organizations), e.g.
- crm2016.iwebscrm16.com (We usually set up a dev environment with CRM2016 being the year of the version. Just something we select to do).
- adfs.domain.com (used for reference to the ADFS server)
- one for the root domain so that domain.com points to the same server. (This is for the ADFS logout URL)
We have two setup here: CRM and CRM2016. So we need to configure crm.iwebscrm16.com and crm2016.iwebscrm16.com (Not necessary but our choice for this instance).
DNS The Easy Way!
The really easy way to solve all this (now we have explained the background) is to simply create a * A record that points to the machine we are using to set up the CRM system.
Test DNS
You must be able to ping all of those names and get the correct server IP address. Both from computers on the internet, and from the server. At the command prompt, type “ping sts1.iwebscrm15.com” for example with our config. Ping them all to be sure you get them correct.
Note: If you have added the DNS records, but still encounter name resolution problems, you can try running on the client ipconfig / flushdns to clean up the cache. You can also click the DNS server root and click CLEAR CACHE so that the server is responding with the latest updates.
Note: Don’t bother proceeding past this step if you cannot ping your sub domains internally and externally correctly.
Firewall configuration
You need to set the firewall to allow the CRM 2013 and the AD FS 3.0 port used by the incoming data stream. HTTPS (SSL) is the default port 443.
For Initial setup testing etc. We recommend just turning the thing off. Better start from a place where it does not muck you around, then turn it all back on after you are successful.
1) In Windows 2012 I can’t frigging work out how to find anything. Literally! But most things you can search for. As is the case here if you search for “Firewall”. Select the firewall option:
2) Select Turn Windows Firewall on or off
4) Turn Off or On Firewall
Just turn it all off for now. (Remember to come back, turn it on and allow access for the unusual port 444 that you configured earlier for the SSL on the CRM site. But for testing and setting up… the last things you want is to be banging your head agains a firewall.
Snapshots
Just a reminder that at this point we have been keeping snapshots on our Hyper-V environment to allow us to fail back to a location and try again. This is really useful for the setup of something like this that has a lot of moving parts.
Configuration Claim-based authentication –internal access
Configure the internal access Claim-based authentication requires the following steps:
- Install and configure AD FS 3.0
- Set Claims-based authentication configuration CRM 2016 server.
- Set the Claims-based authentication configuration AD FS 3.0 server.
- Test claims-based authentication within the access.
Install and configure ADFS 3.0
This article uses Active Directory Federation Services (AD FS) 3.0 to provide a security token service (security token service or STS ).
Note: AD FS 3.0 will be installed to the default site, so install AD FS 3.0 , you must have CRM 2016 installation in the new site. (Remember we said that earlier)
IIS Looks like this if it is correctly installed: 
If you only see the default website with CRM installed in that. Start AGAIN! – We are working with the process as shown here.
Install ADFS Server Role
From Server Manager – Add A Server role for: Active Directory Federation Services
Click Install at the last step.
After if Finishes:
Click the Configure the Federation Services on this server.
Configure AD FS 3.0
1 Click on Configure the federation service on this server.
2 In the AD FS 3.0 Management page , click AD FS 3.0 Federation Server Configuration Wizard .
3 In the Welcome page , select Create the first federation server in a federation server farm, and then click Next.
4 Select next to continue with the current administrator (must be a domain admin).
5 Choose your SSL certificate (the one we created and imported above i.e. *.iwebscrm15.com ) ,add a Federation Service name ( Selecting the second one for the dropdown in this instance iwebscrm15.com, don’t select the one with the wildcard in the name, so not the *.iwebscrm15.com for example.), then Select a Service Display Name for your business – selecting the one that is NOT starting with a *, then click Next.
6 Open PowerShell and run the following command: “Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)”
If you don’t you will se the error: Group Managed Service Accounts are not available because the KDS Root Key has not been set.
7 We specified the Administrator account for the service account, as security is not our primary concern here with a Dev environment. You could and probably should use a defined account for a production environment.
7 Create a database on this server using Windows Internal Database (or you can use SQL instance in the step below), click Next.
Or use the local SQL instance etc if you have one. (Because we have SQL installed on this same server. We are using this SQL instance for the database host.
Note that this will create two new databases in SQL.
8 Review Options click Next
9 Pre-requisits checklist, click Configure
10 You should see a message that “This Server was successfully configured
11 Close out the Instillation progress window
Verify the AD FS 3.0 is working
Follow the steps below to verify that the AD FS 3.0 is working :
1 Open Internet Explorer.
Under Internet Options
Security / Local Intranet
Sites / Advanced
Add *.domain.com to the websites. In our case here we added: *.iwebscrm16.com
Close all this down when added.
2 Now we need browse to the the federation metadata in Internet explorer to test access is working.
Use this URL below as an example to browse to your own server. Remembering that we set up a DNS entry earlier for “ADFS’ on your domain, thus you should be able to browse to the URL below replacing our domain name with yours and have it access the server we are configuring.
- https://adfs.iwebscrm16.com/federationmetadata/2007-06/federationmetadata.xml
(Replace your domain name in place of ours iwebs16.com)
3. to ensure that no certificate associated with the warning appears, and you can view the certificate to be sure it is showing.
Check the certificate is correct and working by clicking on the padlock looking thing and viewing certificate.
Take another Snapshot!
Claims-based authentication configuration CRM 2016 server
After you install and configure the AD FS 3.0 , we need to configure the Claims-based authentication before setting CRM 2016 binding types and the root domain.
1 Open the CRM Deployment Manager.
2 In the Actions pane , click Properties .
3 Click the Web Address page.
4 In the Binding Type , select HTTPS .
5. Change the Server name to the internalcrm.domain.com:444 format. In our case here. internalcrm.iwebscrm16.com:444
6. Then Apply
7. Then OK to close
8 In the Deployment Manager console tree, right-click Microsoft Dynamics CRM, and then click Configure Claims-Based Authentication.
9 Click Next on the Welcome page
10 On the Specify the security token service page, enter the Federation metadata URL, in our case because we setup a DNS record for “adfs” we are going to use that: https://adfs.iwebscrm16.com/federationmetadata/2007-06/federationmetadata.xml
Note: that this is the same URL we tested ADFS was set up correctly on in the steps above. Also note that the step of adding the domain to internal sites in the IE security settings that we did above is an important one! If you can’t hit that URL on the web browser of the server and get a clean XML defined page, then you deployment will not work.
11 Click Next then select the certificate that we created perviously for the *.domain connection
12 Select Next
Note: At this point it is possible to get an error something along the lines of “Encrypted Certificate Error”. This is implying that the account used to run CRM does not have access to the Private Key of the certificate being used. Skip forward to point 25 below, and add the service accounts that CRM is using to the private key of the certificate to be used. This will ensure that this next configuration step has access to the certificate. Then come back to this point and continue.
13 Select Apply (BUT – NOT FINISH)
14 IMPORTANT – Click View Log File
15 Scroll to the end, and Copy the URL from the bottom of the file.
This will be used in the next configuration.
Note: that this is different to the URL used in step 4 above, as it represents the internal URL. Subtle but vital (and the cause of frustration the first 10 times we tried this). In our case the URL looked like this: https://internalcrm.iwebscrm16.com:444/FederationMetadata/2007-06/FederationMetadata.xml
16 Click Finish.
Set the CRM AppPool account and the Microsoft Dynamics CRM Encryption certificate.
17 Right Click the Start Button and select RUN
18 Type MMC and enter
19 Select File / Add/Remove Snap-in
20 Select Certificates and Add
21 Select Computer Account
22 Local Computer is selected, so click Finish
23 Expand the console tree / Personal / Click Certificates
24 Right click the certificate we used for the CRM endpoint, and select All Tasks / Manage Private Keys
25 Select Add
Note here: If you do not have the “adfssrv and drs” accounts listed, you will have problems. The solution though is to do this at this point:
Open Powershell as Administrator and run: dir Cert:\LocalMachine\My\
Then using the thumbprint of the Certificate related to this install, run the following command again in Powershell: Set-AdfsSslCertificate -Thumbprint19A0100267EB5D2FC0132260995F6D38C40EBEA1
This will add the two above mentioned accounts to the security of the certificate. This we found in one setup was not automatically done and caused us a large headache.
26 Select Advanced
27 Select Find Now
28 Scroll Down and Find the NETWORK SERVICE Account
29 Select OK / OK
Ensuring that the NETWORK SERVICE has Read Access
Note: We have used the NETWORK SERVICE account here because that is the one associated with the CRMAppPool used in IIS by default for the Microsoft Dynamics CRM Website that was automatically configured with the CRM setup.
If you are using another account for running the application pool, then you should ensure that this account has access to the encryption certificate. Some details can be found here.
30 Validate that you can browse to the URL above. If you cannot view this in a browser, then have a look again at your permissions on the certificate in relation to the account on the application pool in IIS for CRM. Read above: Claims-based authentication configuration CRM 2016 server.
The URL Above that we are checking is the one from the View Log step, that we said to copy.
Once you can browse this URL, you are done if it fails, then repeat the process till you can access the URL on the server in question. Note: Often it is confusion over the port :5555 that defaults in CRM Deployment Manager Web settings and the HTTPS Port :444 that we defined in the binding for the Microsoft CRM Dynamics Website. So double check that you have the correct port set in the Deployment Manager, then run the steps again following that setting.
Checkpoint the Hyper-V at this point.
Claims-based authentication configuration AD FS 3.0 server
Start AD FS 3.0 Management. In the Navigation Pane, expand Trust Relationships, and then click Claims Provider Trusts. Under Claims Provider Trusts, right-click Active Directory, and then click Edit Claims Rules.
In the Rules Editor, click Add Rule, In the Claim rule template list, select the Send LDAP Attributes as Claims template, and then click Next
Step10: Create the following rule
Claim rule name: UPN Claim Rule (or something descriptive)
Attribute store: Active Directory
LDAP Attribute: User Principal Name
Outgoing Claim Type: UPN
Click Finish, and then click OK to close the Rules Editor
After you enable claims-based authentication, you must configure Dynamics CRM Server 2016 as a relying party to consume claims from AD FS 3.0 for authenticating internal claims access.
Add Relying Party Trusts to AD FS
Start AD FS Management. Select Trust Relationships / Relying Party Trusts. Then On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.
On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL you copied earlier from the log file during the creation of the CRM Claims Based Authentication. e.g. https://internalcrm.iwebscrm16.com:444/FederationMetadata/2007-06/FederationMetadata.xml – Note it is probably still open in your browser in the background.
On the Specify Display Name page, type a display name, such as CRM Claims Relying Party, and then click Next.
Click Next on the multi-factor authentication options.
On the Choose Issuance Authorisation Rules page, leave the Permit all users to access this relying party option selected, and then click Next.
On the Ready to Add Trust page Click Next
On Finish Page, click the checkbox option to Open the Edit Claim Rules, Next, and then click Close.
The Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule.
In the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next.
Create the following Rule #1
Claim rule name: Pass Through UPN (or something descriptive)
Incoming claim type: UPN
Pass through all claim values
Click Finish.
In the Rules Editor, click Add Rule, in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next
Create the following Rule #2
Claim rule name: Pass Through Primary SID (or something descriptive)
Incoming claim type: Primary SID
Pass through all claim values
Click Finish
In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.
Create the following rule #3
Claim rule name: Transform Windows Account Name to Name (or something descriptive)
Incoming claiming type: Windows account name
Outgoing claim type: Name
Pass through all claim values
Click Finish, and when you have created all three rules, click OK to close the Rules Editor.
Click OK
Enable Forms Authentication
AD FS in Windows Server 2012 R2, forms authentication is not enabled by default.
Open the AD FS management console and click Authentication Policies. Under Primary Authentication, Global Settings , Authentication Methods, click Edit.
Under Intranet, enable (check) Forms Authentication.
So now we have claims setup for CRM.
Add the ADFS server to the Local intranet zone.
We previously added the *.domain.com or in our case, *.iwebscrm16.com to the Local intranet zone in Internet explorer on the server. If you have not done this you should do it now. Then:
1. Open Internet Options Select the Advanced tab. Scroll down and verify that under Security Enable Integrated Windows Authentication is checked.
2. Click OK to close the Internet Options dialog box.You will need to update the Local intranet zone on each client computer accessing Microsoft Dynamics CRM data internally.
Specify the security token service
1 Open a command line tool .
2 Enter the following command : ( application, in your own environment, substitute the name of the name of the command line )
“setspn -a http/sts1.iwebscrm16.com fserver4\VSERVER40”
– Note – remove the “ “
fserver4\VSERVER12 = the domain / machine name of the server.
c: \> iisreset
Probably good to do a Snapshot again!
Configure Internet-Facing Deployment in CRM Deployment Manager.
1 Open the CRM Deployment Manager.
2 In the tree structure , right-click Microsoft Dynamics CRM , and then click Configure Internet-Facing Deployment.
3 Click Next.
4 Fill in the correct domain information for the Web Application
Thus we use:
- Web Application Server Domain: iwebscrm16.com:444
- Organization Web Service Domain: iwebscrm16.com:444
- Web Service Discovery Domain: dev.iwebscrm16.com:444
Leave the Default option for the Internet Facing Server Location
System Checks work
IFD Summary looks like this. Then Apply
Finish
9. Open a command line tool, run: iisreset
ADFS Relying Party Trust for the IFD Endpoint
Effectively you are creating the third Relying party trust in your deployment and the second that you have manually set up at this point. We are doing this again as this is now for the IFD endpoint.
Step 1: Start AD FS Management. On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.
Step 2: On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL to locate the federationmetadata.xml file. This federation metadata is created during IFD Setup.
For example, https://auth.iwebscrm16.com:444/FederationMetadata/2007-06/FederationMetadata.xml (Remember to replace your domain for ours)
Type this URL in your browser and verify that no certificate-related warnings appear.
Step 3: On the Specify Display Name page, type a display name, such as CRM IFD Relying Party, and then click Next
Step4: On the Choose Issuance Authorization Rules page, leave the Permit all users to access this relying party option selected, and then click Next.
Click Next
Step 5: On the Ready to Add Trust page, click Next, and then click Close.
Step 6: If the Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule
Step 7: In the Claim rule template list, select the Pass Through or Filter an Incoming Claimtemplate, and then click Next.
Step 8: Create the following rule#1
Claim rule name: Pass Through UPN (or something descriptive)
Incoming claim type: UPN
Pass through all claim values
Click Finish
Step 9: In the Rules Editor, click Add Rule, and in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next
Step 10: Create the following rule#2
Claim rule name: Pass Through Primary SID (or something descriptive)
Incoming claim type: Primary SID
Pass through all claim values
Click Finish
Step 11: In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.
Step 12: Create the following rule #3
Claim rule name: Transform Windows Account Name to Name (or something descriptive)
Incoming claim type: Windows account name
Outgoing claim type: Name
Pass through all claim values
Click Finish, and when you have created all three rules, click OK to close the Rules Editor.
Now, you should see three Relying Party Trusts in the ADFS Trust Relationships.
Step 13 – Change Port
Open Powershell and run this command
Set-ADFSProperties –nettcpport 809
Restart the ADFS in Services
Restart IIS in CMD
iisreset
Browse to the URL: https://sts1.iwebscrm16.com/adfs/services/trust/mex (replacing the iwebscrm16.com with your domain). You should be abel to hit this URL and get a result looking like this:
Test External Access to CRM 2016 with IFD
Now, you should use the claims certified external access CRM 2016 a. In IE the browser CRM 2016 external address (for example: https://crm2016.iwebscrm16.com:444/main.aspx ), you should have success with login.
Problems We Encountered
While developing this blog post we encountered many small errors along the way. We have reverted to CheckPoints and fixed the instructions to allow you to avoid them. One thing we would say is that when resolving errors, it is most likely associated with the AD FS IFD login. When this happens, the AD FS Event Log is your best friend. Hit the Event ID errors up in google and resolve as best you can. Checkpoints are also your friend here!
Turn the Firewall Back On
As you may expect, this is a rather important last step
1. Turn on all Firewall Settings as they were at the start
2. Click Advanced Settings
3. Click Inbound Rules / New Rule
4. Select Port / Next
5. Select TCP and Specify Port 444
6. Allow the Connection
7. Domain, Private and Public all ticked.
8. Give it a name like: CRM Port 444
And you are about finished. Remember if in the future you are mucking with something and getting no place. Turn off the Firewall as a starting point. Banging heads with firewalls is a waste of time!
Remember to test access again externally!
Your Feedback and Our Services
Please post a comment or note if you have anything to add about these notes. We welcome feedback that helps us improve them.
If you have a need for CRM 2016 Developer Services, we offer professional services and support for CRM 2016. This includes upgrade services for upgrading from any of the past CRM releases to new ones. We also write custom plugin solutions and are specialists with advanced web services and portals that connect to CRM for many applications. http://www.interactivewebs.com/crm and websites.
ADFS 2.1 and 3.0 is not dependent on IIS website. it is running under the hood HTTP.sys (kernal level), so correct your post also snapshots are not correct. best is to take a deep look and proof read.
Thanks for your feedback. I had another quick look through the blog which is an updated and re posted version of our CRM 2015 and CRM 2013 post. There are significant changes and most of the important images have been updated. I could not see the reference to the ADFS 2.1 dependence on IIS. Perhaps I missed it again. But honestly the point of the blog is to help someone with intermediate knowledge get CRM 2016 working in a dev IFD environment. We are not trying to educate people to pass MCSE exams here, just help them jump through the many hoops and avoid some pitfalls along the way. Still I appreciate the feedback.
check this part in your post and correct. ADFS 2012 / R2 has no dependency on IIS.
+++++++++++++++++++++++++++++++++++
Note: AD FS 3.0 will be installed to the default site, so install AD FS 3.0 , you must have CRM 2016 installation in the new site. (Remember we said that earlier)
IIS Looks like this if it is correctly installed: image
If you only see the default website with CRM installed in that. Start AGAIN! – We are working with the process as shown here.
+++++++++++++++++++++++++++++++++++++
** ADFS in Win 2012 and 2012 R2 … known as ADFS 2.1 and 3.0 respectively.
Having the same root domain name for ADFS and CRM will get you into trouble if you’re planning to add other relying parties, e.g. web site or SharePoint.
http://crmtipoftheday.com/2015/12/23/avoid-using-the-same-domain-for-adfs-and-crm/
https://support.microsoft.com/en-us/kb/3045286
That is an interesting article you have written. We did not know that and in the past have just accepted that it was easier for host certain iframe pages replicated within the CRM environment, rather than break our heads trying to get ADFS behaving as we would have expected it to.. Thanks again for posting it!
Hi you guys,
Thank you for a great guide!
I´m done configuring IFD for Dynamics CRM and everything is working fine internally and externally (but only on port 5555 – no-SSL)
However when i´m trying to reach Dynamics CRM on port 444 externally, I get the certificate error (as i´ve made a self-signed certificate) but when I accept and get redirected to ADFS i get this error: DNS_PROBE_FINISHED_NXDOMAIN. Something wrong with the DNS i guess, how can i configure the DNS to get the CRM working externally when accessing it through SSL?
That sounds like a DNS configuration issue. You could potentially use the HOSTS file on the computer you are young to browse and effectively tell it where to find the server you want to hit. Have a google of “hosts file” settings.
Hi,
I am facing problem when configure the MSCRM 2016 IFD based on steps above. My ADFS is a separate server.. Do you have any guideline this kind of setup?
Not by way of steps I can point you to that are published. Sorry.
hi,
On final step of ADFS 2.0 IFD configuration, i am getting an error like
“Error message: MSIS7612: Each party on relying trust must be unique across all relying party trusts in ADFS 2.0″
I don’t know why i am getting such error. Please help me out to resove this.
what do i to do?
Some people had the same problem with the configuration of the CRM 2015 IFD. Down the bottom of this link: http://www.interactivewebs.com/blog/index.php/crm/how-to-set-up-crm-2015-ifd-on-windows-2012-and-adfs-3-0/ you will see some error messages relating to your error, and a listed solution.
Your tutorial does not result in a functional CRM installation, it is full of errors. Cost many countless hours, started over with a different tutorial now have it running. Not pleased but thanks for trying.
We have multiple dev an live setups configured based on these instructions. So they work for us well. Would be good to have more positive feedback about what you found to not work?
HI. good job i think
thanks for posting this.
I am about to use the above steps for a production environment, do u have an updated version of the guides? are there anything i should keep an eye on?
By the way, we are already running ADFS 2.0 in the organisation for other applications. Can we still use the same ADFS server for CRM deployment?
We do not have any plans to upgrade ADFS at the moment until second quarter of next year.
Any advice on this ??
please help
ADFS 2.0 should work. we have a guide that uses ADFS 2.0 on CRM 2015. I expect it should work with 2016 however I have not specifically checked the minimum requirements for CRM 2016.
Hello and thanks for the guide!
I have a question regarding the marketplace, i am not able to get it running.
When i try to access Setting -> Dynamics Marketplace i get: An error has occurred.
In event viewer : Event code: 3005
Exception type: XmlException
Exception message: For security reasons DTD is prohibited in this XML document. To enable DTD processing set the DtdProcessing property on XmlReaderSettings to Parse and pass the settings into XmlReader.Create method.
Any help will be appreciated.
Thanks
Hi, and thank you for contacting us. We have not seen this error message before, but our research would indicate that this is likely related to the virtual memory of the server in question. Even though you may have a lot of RAM available, it could be that it has been set to be limited in how it is utilised, or the SQL Server or other server services are taking up the majority of the RAM. There is a thread that is talking about this here: https://social.msdn.microsoft.com/Forums/sqlserver/en-US/1be6ab1c-7c89-4dc5-8474-f7d0770431f0/for-security-reasons-dtd-is-prohibited-in-this-xml-document-to-enable-dtd-processing-set-the?forum=sqlreportingservices
Great write up! Helped get setup after 3 runs; mostly due to me overlooking a couple of things. The only thing I find now that CRM for Outlook does not authenticate. I get the login screen at https://crm.mydomain.com:444
Any ideas?
Try adding the main.aspx to the url
Hi and thank you for this great guide.
I have encountered one problem though; after logging (redirecting to adfs works great) in at https://crm.mydomain.com:444 I get “404 not found. This directory might have been moved…”; however if I add /main.aspx the site pops up and works wihthout any issues. The problem is that Outlook CRM does not work/find the directory this way.
I cannot be sure why it is not auto redirecting. There should be a default document defined in the Microsoft Dynamics CRM, IIS default documents definition that is default.aspx Entry type: inherited. If this is missing or there are some additional, then you may have issues. In the Default Website Default Document definition, there should be a Default.asp entry too. This is normally what directs you via the authentication system to the correct URL.
Hello!
Thank you SO MUCH for this detailed step-by-step guide. It rescued my situation, cause Microsoft Dynamics CRM App for mobile devices `cannot work without valid SSL and IFD.
But, I can’t find information about HOW to CHANGE ssl at server without troubles and hidden puzzles…So, my setup was with temporary SSL self-signed, and now I have valid public SSL cert. Now I must to bind that new one to … IIS, and CRM, and IFD… My head will bang out!!.. Can you help with my question?
Regards
You need to bind to the site. I think our later guides for setup of 2016 should give you a hint at the direction you need to go.
Hi
Can i install it on two servers? Active Directory, DNS and ADFS on one server and SQL Server, IIS and Dynamics CRM on other server?
Thanks
Should work.
Not working for me.
I have setup a system with DNS and Active Directory and then on other server i joined it on domain, installed MS SQL Server 2014 and IIS.
When i try to install MS Dynamics CRM 2016, on selection of Organizational Unit of Domain – it says no OU found.
Kindly let me know the solution for this if any.
Thanks
The OU is generally referring to the Unit location within your active directory. If the location you specify (CRM2016 for example) is missing. You can just create it in your AD.
hi , thanks for guide . how can I opening crm on default ssl port 443 ?
The way I see it is that you will need two IP addresses, so that you can assign the second IP to the CRM site, and use the default SSL entry on that. This is because the HTTPS is used on the default site for the IFD authentication connection.
Great tutorial, it help me a lot! My setup was slightly different. Since we already have ADFS server setup on our domain and it is used for a few applications I didn’t install the ADFS role on the CRM server. I’ve also decided to go for a “crm.domain.com” certificate rather than “*.domain.com” wildcard certificate. Because of this I’m stuck at step 11 in “Claims-based authentication configuration CRM 2016 server” section of the tutorial. Since I don’t have a wildcard certificate I’m not sure what certificate should I use to setup claims-based authentication, any suggestions?
Very informative article.. i have a question regarding accessing CRM from outside of local network after successful setup of IFD.
My deployment structure:
1. physical server (Vsrv) with hyper-V
2. Virtual Server (DC) with Active-Directory
3. Virtual Server (SQL)
4. Virtual Server (CRM) with IIS ADFS and CRM
All servers are windows server 2012 r2
Physical server is connected to router (DHCP) and have static IP setup through the virtual switch setup by hyper-v
all virtual servers have static ip and server 3 and 4 are part of domain server DC
IFD is successfully setup after all installations.
Question:
What settings are required to access CRM Server from outside of network?
Any help would be highly appreciated
Well it sounds from the question that each server has only an internal IP address, and not an external or internet visible IP address. The article is designed in such a way that all Virtual Machines have their own external facing IP address. This could be achieved in other ways using routing through firewalls, however there are so many ways this could be done it is hard to advise you based on this information. Essentially though, the DNS servers need to hand out an external IP address to a user such that when they type in an the URL for CRM, they are being handed an external IP address that takes them either directly or via routing to the virtual CRM machine with IIS. Hope this is some help.
Thanks for the reply. it was helpful though.
Its true all VMs IPs are internal but I have one external IP which i use to RDP with the physical server on which all VMs are installed. I forward port in my router to point to my physical server for RDP and it works fine. I add 444 port to point to my crm server but it does not work.
Do i need some external entries in my DNS server to point to public IP ?
Technically no, but you may have some trouble with this if you are not well versed on routing.
Hi. Thank you a lot for your guide. We used it and successfully set up the CRM+ADFS deployment. But when I am trying to connect to CRM from USD by IFD endpoint – there is an error:
The authentication endpoint Username was not found on the configured Secure Token Service!
at Microsoft.Xrm.Sdk.Client.IssuerEndpointDictionary.GetIssuerEndpoint(TokenServiceCredentialType credentialType)
at Microsoft.Xrm.Sdk.Client.ServiceConfiguration`1.AuthenticateInternal(AuthenticationCredentials authenticationCredentials)
at Microsoft.Xrm.Sdk.Client.ServiceConfiguration`1.AuthenticateFederationInternal(AuthenticationCredentials authenticationCredentials)
at Microsoft.Xrm.Sdk.Client.ServiceConfiguration`1.Authenticate(AuthenticationCredentials authenticationCredentials)
at Microsoft.Xrm.Tooling.Connector.CrmWebSvc.ClaimsIFDFailOverAuth[T](IServiceManagement`1 servicecfg, Uri homeRealm, ClientCredentials userCredentials, ClientCredentials deviceCredentials, Int32 depthLevel, Boolean tryNetworkCred)
at Microsoft.Xrm.Tooling.Connector.CrmWebSvc.CreateAndAuthenticateProxy[T](IServiceManagement`1 servicecfg, Uri ServiceUri, Uri homeRealm, ClientCredentials userCredentials, ClientCredentials deviceCredentials, String LogString)
at Microsoft.Xrm.Tooling.Connector.CrmWebSvc.DiscoverOrganizations(Uri discoveryServiceUri, Uri homeRealmUri, ClientCredentials clientCredentials, ClientCredentials deviceCredentials)
at Microsoft.Xrm.Tooling.CrmConnectControl.CrmConnectionManager.ValidateServerConnection(CrmOrgByServer selectedOrg)
Dont you have an idea, what could be the reason? What should I check?
I already enabled and disabled Username endpoint with the same result.
With regards, Yuriy.
There are some post install processes to run. They can be found here: https://technet.microsoft.com/en-us/library/hh699726.aspx – I suspect these have not been run by you.
Hey i have done all the necessary things, when i got to IFD configuration i am getting an error that the external domain name can not be accesed, please any help.
Likely to be a DNS settings error that the server is not referring to a valid DNS server for reference.
Thx. Great tutorial.
Your tutorial only shows DNS settings for everything on a single machine.
Can you clarify the DNS settings when the ADFS server is on a separate machine.
Essentially you only need make the ADFS server set to the sub domain you are using for the ADFS server.
Hello,
Thank you for the instructions. I was able to follow all the steps but I have an issue where if I go to my IFD site https://crm2016.externaldomain.com:444 it redirects me to https://externaldomain.com/adfs/ls/?wa=wsignin…. That brings a “page cannot be found” as the correct link. If I add crm2016 to the beginning of that link making it https://crm2016.externaldomain.com/adfs/ls/?wa=wsignin… then I am presented with the login page for ADFS and I can successfully log in. We use externaldomin.com:443 for other traffic and cannot route ssl traffic to our crm2016/adfs server.
Any ideas where I can make the change so that I am redirected to the right link?
Thank you,
Endri.
Sounds like the settings for your ADFS setup are incorrectly configured with the wrong sub domain.
What a monster! thanks!
Hi,
thanks for the excellent step by step tutorial.
Quick question: is it mandatory to have an orgname.domain.com url configured. I usually pick the company name as orgname when installing crm, which is the same as the domain name. So am i stuck with domain.domain.com as external url ?
Great post,
I have ADFS and CRM seperated.
How do I do Point 25 regarding the Private Key for the certificate?
Regards
Jean
This is using the Microsoft Certificates management plugin.
I want to add company email as a login option in ADFS 4.0. What attribute shall I add in my replying party trusts for both internal and external CRM access.
Excellent post!