Lessons learned from using the CRM IFD tool

With Microsoft Dynamics CRM 4.0, you can configure your CRM implementation to work internet facing. In other words, users can access CRM without having to be logged in to your network or using VPN, and they can access all functionality, including reports.

From implementing a couple of IFD environments, I have found a few things that may not be clear from the documentation for the IFD tool.

1. When you unzip the ifd tool, you have to save it to the c:\program files\microsoft crm (or whatever your crm program file name is)\tools folder, otherwise it will not run.
2. When you run the IFD tool, you will need to specify only the domain name in the SDK and root domain fields—do not enter anything like crm.domain.com—just domain.com
3. Your external URL for your crm needs to be in the form of crmorgname.domain.com. You will know your CRM org name because when you run the IFD tool, it will display it in the gray box in the lower left corner of the form. You will need to set up a CNAME in DNS with the name of the CRM org name pointing to the CRM URL. If you want to have your external url be something other than your crm org name, you will need to set up a CNAME pointing to the org name URL.
4. If you use an ISA or other firewall, you will need to enable forms authentication for the CRM server.
5. After running the IFD tool, when you go to the external url, you should see a blue login form, not the windows login box, if your IFD deployment has been successful. If you see the Windows login dialog box, CRM is trying to authenticate via Windows Authentication, not IFD mode. This login form will be located at http://crmurl.domain.com/signin.aspx

Also, be sure that if you want IFD users to be able to run reports, that you install the SRS connector. The SRS connector is located in the CRM installation.

Comments

[Andrey Gupalo]

Hi!
"If you use an ISA or other firewall, you will need to enable forms authentication for the CRM server."
How to publish a IFD CRM server behind ISA 2006? What tuning in delegation of authentification it is needed to do in a Web publishing rule, if HTTPS listener used FBA authentification and wildcard certificate *.mycompanyname.org?

Web publishing rule does not work, only Server publishing rule (https) working.

My testing CRM deployment hosting a few organizations:
https://org1.mycompanyname.org
https://org2.mycompanyname.org

[RTW]

OK, I did everything as you mentioned. Still getting a 400 error when trying to access the site.

I have checked ISA the path name is in place.

I ran the tool again, checked DNS says it is OK

Now why do I get a 400 error. Do you have any suggestions?

[tomasK]

Hi,

thanks for this post. But when I go from external URL (http://crmorgname.domain.com) I get Windows login dialog box and when I go straight to http://crmorgname.domain.com/signin.aspx and set my credentials, the authentication works. Is it ok? Or should I set anything else, becouse when I set only On Premise in IFD Tools the authentication from http://crmorgname.domain.com/signin.aspx faild.

Thanks,

Tomas

[Ben]

Thanks for the article. Is there any way I could put a link on the IFD Sign-in page to a third party Password Reminder application?

[Joel Lindstrom]

Ben,

You could possibly edit the signin.aspx page; however, be aware that it is not supported by Microsoft.

[Eduardo]

I've managed to get my CRM working with ifd. I can see the form-based autentication page instead the windows's authentication box but I'm unable to identify over that form. I allways get "Wrong user and password". I use the same user and password I've used using the web with OnPremise mode.
¿Any ideas?
Thanks in advance, I'm getting crazy

[Joel Lindstrom]

two things to try:

1. If your AD user is in the same domain as CRM is installed, just enter your user ID and password, not your domain\userid.

2. Make sure that the asynchronous processing service is running on the CRM server. IFD logins do not work if the Asynch service is not running.

3. When you run the IFD tool, if your crm web site is on a port other than 80, enter the port number with your external domain in the form. For example, "customereffective.com:5555" Then when you enter the IFD URL, enter the port as well.

[Dinesh]

Has anyone done modifications to the "signin.aspx" page? If yes please respond. We also need to place a "Forgot Password" feature on this IFD login page.

Thanks in advance,
Dinesh

[Joel Lindstrom]

Dinesh,

Yes, it is possible ;however, be aware that this is not supported. If you go down this road you will need to thoroughly test each update or upgrade, as your modified ASPX page will likely be overwritten at some point.
Also, this file is shared between all organizations, so if you change it for one, everybody will see the modified ASPX page.

[Alex]

Are there any mainstream addon's not supported on IFD?