Microsoft Dynamics CRM 2011 Claims-based Authentication White Paper

The product team released the Claims-based Authentication white paper today.  It’s available to download on the Microsoft Download Center.  In this paper, it covers the following topics:

• Authentication Models for internal and external access
• Planning for Claims-based Authentication
• How to Implement Claims-based Authentication
• etc…

Go download the Claims-based Authentication White Paper and start reading!

CRM 2011 RTM Released Today!

The CRM Product Team has been working days and nights to get this release out to us.  Many Kudos to that team for releasing it nearly two weeks early.   You may download the RTM release on Microsoft Download Center now.

Here are the product keys just in case you are looking for them.

• Microsoft Dynamics CRM Workgroup Server 2011 (5 CAL limit): H84KC-JH8DF-7PDYK-TXBXR-2RMMT
• Microsoft Dynamics CRM Server 2011 (no CAL limit): MQM2H-JYYRB-RRD6J-8WBBC-CVBD3

CRM 2011 SDK Update 5.0.1

The SDK team announced the release of the latest CRM 2011 SDK.  I knew that they work really hard to improve the content in there.  They are just an awesome group of people to work with, they listened to our feedbacks and trying their best to provide samples to make our customization experience easier and better. You may download the latest CRM SDK on the download center and on MSDN.

Amy pointed out some highlights for the new SDK and here are some of them:

• Binaries updated to the latest version
• Samples now work on IFD deployments with improved authentication code
• New topics, samples and walkthroughs for using the SOAP endpoint for Web resources
• New PowerShell information and samples
• Updates and additions based on feedback from customers and reviewers

Thanks to the SDK team!!!

Reference an image in Web Resource from Site Map or Ribbon

CRM 2011 has this excellent solution concept which I like it a lot!  If you can master on how to leverage solutions in CRM 2011, it’s quite powerful when you are doing customizations in CRM.  When doing Site Map or Ribbon customization, I often need to reference to an image. 

In the previous versions of CRM, I have to place the images into the ISV or the IMG folder under the CRM web site, and then reference to that image path.  CRM 2011 has totally changed, it’s trying to stay away from the ISV folder and everything now has to store in the Web Resource. 

So what is Web Resource?  You may just think of Web Resource as a folder within CRM that you can upload files to, it stores HTML pages, Silverlight Controls, Images, XML files and etc… If you would like to use them in CRM form, you can just insert them on to the form.  If you like to use them in Site Map or Ribbon, all you need to do is to use the $webresource: directive to specify a Web resource image to use as an icon in the ribbon or in the application navigation using Site Map. The following sample shows how to specify icons for a button in the ribbon.

<Button Id="MyISV.opportunity.form.actions.FlyoutAnchor.Button.1"
 Image16by16="$webresource:new_/imgs/icon16.png"
 Image32by32="$webresource:new_/imgs/icon32.png"
/>

So if you want to reference an image in Web Resource from Site Map, follow the steps below:

 

1. Upload the image to Web Resource.
2. Export Site Map.
3. Update Site Map and use $webresource: directive to specify a Web Resource image.
4. Import Site Map.
5. Publish All Customization.

New! CRM 2011 Installation–Specify Service Accounts

CRM 2011 RC now allows us to specify service accounts during the setup process.  You can specify the service account for the Application Service, Deployment Web Service, Sandbox Service and Asynchronous Service to run as.  In a single server environment, you can just use NETWORK SERVICES for the installation.  However if you are installing CRM in an enterprise multi server environment, the recommendation is to have a specify service accounts each of the services.  For best practices and instructions on how to install CRM in a multi server environment, please refer to the CRM 2011 Implementation Guide.

I would like to share our setup experience with the community just in case you run into a similar situation.  During our setup, we didn’t receive all green checks from the System Check wizard.  We had several warnings related the Microsoft Dynamics CRM Server User Input so I dig into the warnings with Michael from the Product Group.  Thanks for his help, he resolved for us. 

Problem

The reason that we got the warnings is because the admin is using the installing user account for the service accounts.  What happens is when the first organization is created, the installing user is created as the first user in the organization.  Since there is a user in the organization with the same credential as the service accounts for the asynchronous service, application service and the sandbox service, all the sudden the “SYSTEM” user is now subject to the same constraints as an actual user which means that the user must be enabled, need a user role and etc…, otherwise the system will stop functioning.  A lot of bad things could happen.  For example, some grids in CRM are populated with data that is retrieved as SYSTEM, when data is retrieved as SYSTEM, it is retrieve in GMT format. However if the Application Service is running under a service account which is also an user in CRM, when retrieving data the data will return with the users time zone setting instead of GMT.  There are more bad things could happen…

Solution

If it’s for a non-production environment, you may ignore the warnings and proceed with your installation.  But for production environment, this will cause problems later on.  The recommendation is to use a different service account for each of those services.  However if you preferred not to manage extra service accounts, you may use a same service account for Application Service, Deployment Web Service, Sandbox Processing Service, Asynchronous Process Service as long as the installing account is different than the service account for the services. 

If you decided to use a different service account for each of the services, just create the service accounts in your AD. you don’t have to grant any permissions to the accounts, the installation process will take care of the permissions for you!  For your reference, here’s a list of accounts and permissions that we used for our installation.

Account	Application Service Account	Reporting Service Account	Async Service Account	Sandbox Service Account	Installer
CRM Server	none	none	none	none	Local Admin
SQL Server	none	none	none	none	Local Admin, SQL Admin
Reporting Server	none	none	none	none	Local Admin
AD	none	none	none	none	Group Admin

Gotchas

If you are running into an error telling you that “This account doesn’t have Performance Counter Permissions”, you need to follow the steps below to resolve the problem.

1. Open Server Manager.
2. Go to Configuration > Local Users and Groups > Groups.
3. Add the service accounts to the Performance Log Users group.
4. Install CRM with again.

Anyway, Thanks to Richard and Felix for discovering the problems for me and thanks to Richard for doing the installation for us!

新年快乐！

我祝大家身体健康，工作顺利， 家庭幸福。

Happy Chinese New Year of the Rabbit!

Happy Chinese New Year to all of you!  Best wishes to you and your family!