Microsoft Dynamics CRM Team Blog: CRM Authentication

[Blog bot]

Источник: http://blogs.msdn.com/crm/archive/20...ntication.aspx
==============

In this post, I will try to give you some insights on how CRM authentication works. Modification or updates to CRM authentication pipeline is not supported. This article should be for your reference purpose only.

CRM authentication framework has a pluggable modular structure. Where each supported authentication is plugged into the architecture. CRM supports different way of authenticating users based on the deployment SKU.

• On-Premise: In this deployment SKU there exists an AD in the system and the users authentication is handled seamlessly via integrated windows auth using Kerberos or ntlm.
• IFD / SPLA: This deployment SKU allows users to access their data over internet using a custom form based authentication. This style of authentication still requires an AD in the background to verify user and is used by many of the on-premise installations configured in IFD mode and as the primary mode of authentication provided by SPLA partners.
• Live: This deployment SKU is primarily used by the Microsoft Dynamics CRM online. The users are authenticated based on their Windows Live Ids.

In this post I will mainly talk with reference to the on-premise and IFD SKU authentication.

Analyzing the web.config file

Open the web.config file present on the CRM website in an editor and look at the following.

• The authentication node dictates the strategy CRM uses to authenticate users.

• There are two httpModules that CRM registers.
  

• MapOrg: This module is used only for on-premise (or IFD- internal) user request processing. The main task of this module is to get the organization name from the url (for regular http requests) or the authentication token (for sdk requests) and set it on the application context for latter use.
• CrmAuthentication: This is the main authentication module used by CRM. It accepts or rejects the request based on set of predicates and providers.

Note: These two module are not invoked in case of direct report server access, for example when you use the excel apps to refresh crm data working inside your intranet.

Analyzing the CRM authentication pipeline.



The CRM authentication pipeline is stored in the configuration database (MSCRM_CONFIG) in the AuthenticationSettings and AuthenticationSettingsProperties table.

The below query can be used to view the authentication pipeline.

<div style="border-bottom: silver 1px solid; text-align: left; border-left: silver 1px solid; padding-bottom: 4px; line-height: 12pt; background-color: #f4f4f4; margin: 20px 0px 10px; padding-left: 4px; width: 97.5%; padding-right: 4px; font-family: 'Courier New', courier, monospace; direction: ltr; max-height: 200px; font-size: 8pt; overflow: auto; border-top: silver 1px solid; cursor: text; border-right: silver 1px solid; padding-top: 4px" id="codeSnippetWrapper"> select a.ConfigurationName, ap.ColumnName, ap.NVarCharColumn
from dbo.AuthenticationSettings a, dbo.AuthenticationSettingsProperties ap
where a.id = ap.id
and ap.NVarCharColumn like <span style="color: #006080">'%