Today I was trying to connect CRM Outlook Client with Dynamics CRM 2011 through VPN and got the typical "There is a problem communicating with the Microsoft Dynamics CRM Server...." error.
I clicked on the “View log” link at the end of this “friendly message”, and the log pointed me to the following problem:
Microsoft.Crm.CrmException: Logon failed because credentials are invalid ---> Microsoft.Crm.Passport.IdCrl.IdCrlException: GetAuthState() - Request Status:
at Microsoft.Crm.Passport.IdCrl.OnlineServicesFederationLogOnManager.LogonOrgId(String policy, String partner, LOGON_FLAG logonFlag)
Now, I found this error pretty odd as it was an On-premises deployment and not Online. Seems it was not the actual error for me. Obviously I tried it via Internet Explorer and it worked fine..
So, I decided to open Microsoft Dynamics Diagnostics tool in my client machine and turn on Tracing (which is much more trustworthy)! (Start –> All Programs –> Microsoft Dynamics CRM 2011 –> Diagnostics).
Then, run Configuration Wizard again and reproduce the error. Now you will find a new file in the following folder: C:\Users\<user>\AppData\Local\Microsoft\MSCRM\Traces
where <user> = current logged in user in the system
Once opened the tracing file found out the actual cause of the problem which was the following one:
Exception: System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.
at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)
at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)
As I was connecting through VPN and I was outside the company domain, my problem was with Windows Credentials, where credentials were stored for that web url.
So, the steps I followed to solve this problem were:
- Close Configuration Wizard.
- Open Windows Credentials store (Control Panel –> Credential Manager)
- Look for the credentials associated to the organization Url. (typically found under the convention “Microsoft_CRM_http://server:port)
- DELETE that record.
- Close Windows Credentials
- CLOSE Internet Explorer if opened
- Open Internet Explorer again
- Navigate through the organization Url, credentials will be prompted
- Specify the credentials in the format “domain\user” for the username part.
- You should be able to enter CRM and work with it in IE.
- Now, open again Configuration Wizard
- In the Server URL field write http://server:port (where server = your CRM server name and port the specific port if need, i.e. 5555). Do NOT include the name of any oranization here.
- Click on “Test Connection..”
- You should be able to get through CRM server successfully and choose the organization to connect to from Outlook.
Hope it helps to save somebody else’s time,
PP [twitter: @pabloperalta]
UruIT Dynamix | #1 in Dynamics CRM Nearshoring Services.
Co-author The CRM Field Guide