Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. An error message occurs in Microsoft Dynamics CRM 2011 when trying to access the CRM URL using a One-way Domain Trust

An error message occurs in Microsoft Dynamics CRM 2011 when trying to access the CRM URL using a One-way Domain Trust

Symptoms

Consider the following scenario. Microsoft Dynamics CRM 2011 and ADFS 2.0 are installed on a trusting domain and users are located on the trusted domain:

  • There is a one-way trust between two domains
  • Trusting domain: contoso.com
  • Trusted domain: fabrikam.com

The following error occurs when logging in to Microsoft Dynamics CRM 2011 using credentials from the trusted domain:

"There was a problem accessing the site. Try to browse to the site again.
If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

Reference number: <GUID>"

Additionaly, the following information is found in the Event Viewer from the ADFS server:

Log Name:      AD FS 2.0/Admin
Source:        AD FS 2.0
Date:          01/01/2012 10:00:00
Event ID:      111
Task Category: None
Level:         Error
Keywords:      AD FS
User:          SYSTEM
Computer:      ADFS.contoso.com
Description:
The Federation Service encountered an error while processing the WS-Trust request.
Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue 
 
Exception details:
Microsoft.IdentityServer.ClaimsPolicy.Language.PolicyEvaluationException: POLICY0018: Query ';userPrincipalName;{0}' to attribute store 'Active Directory' failed: 'Exception of type 'Microsoft.IdentityServer.ClaimsPolicy.Engine.AttributeStore.Ldap.LdapServerUnavailableException' was thrown.'. ---> Microsoft.IdentityServer.ClaimsPolicy.Engine.AttributeStore.Ldap.LdapServerUnavailableException

Using the LDP.exe tool to query a Domain Controller located on the trusted domain from the ADFS Server, using credentials from the trusting domain, the following error occurs:

0 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='NULL'; Pwd=<unavailable>; domain = 'NULL'}
Error <49>: ldap_bind_s() failed: Invalid Credentials.
Server error: 8009030C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece
Error 0x8009030C The logon attempt failed

↑ Back to the top

Cause

This problem occurs due to having a one-way domain trust configured. The ADFS service account needs to have rights to read attributes for users in the trusted domain. Without it, ADFS has no way of issuing claims.

↑ Back to the top

Resolution

To resolve this problem, there are two options:

  • If you are not authenticating users in the trusting domain, remove the ADFS server from the trusting domain and join it to the trusted domain. An ADFS Proxy server can be placed in the trusting domain so that users on the internet can authenticate via the proxy. Microsoft Dynamics CRM 2011 does not need direct communication with the ADFS server as it can pull the Federation Metadata from the ADFS Proxy. However, ADFS would need direct communication with CRM when setting up the relying party trust to get the federationmetadata from CRM, but only for the setup of the relying party trust. Once the relying party trust is created, communication can be terminated.
  • If you are authenticating users in the trusting domain as well as the trusted domain, add a new ADFS server to the internal domain and setup a federation trust between the two ADFS servers. You can still add an ADFS proxy to the trusting domain so internet users from the trusted domain can authenticate.

↑ Back to the top

More Information

To set up federation trust, follow the instructions from the link below:

Claims Access and Partner Companies
http://technet.microsoft.com/en-us/library/gg188605.aspx

↑ Back to the top

Keywords: kbmbsmigrate, kbmbspartner, vkball, kb

↑ Back to the top

Article Info
Article ID : 2698987
Revision : 1
Created on : 1/8/2017
Published on : 4/11/2012
Exists online : False
Views : 122