Posted by (JavaScript must be enabled to view this email address) on Wed 11 Mar 2009

On our Windows 2008 infrastructure we had a major issue trying to get CRM and SharePoint 2007 to work as we expected.  The main issue was down to the Kerberos double hop issue which is ever present in Windows 2008 (Microsoft love to make things difficult for us); after some errorlog tracing we were able to find that there were several duplicate SPN’s:

1.    0x29 KRB_AP_ERR_MODIFIED
2.    0x19 KDC_ERR_PREAUTH_REQUIRED
3.    0xd KDC_ERR_BADOPTION

I started by deleting the duplicate SPNs using the following commands

setspn -d http/AD-SRV.domain.com domain\crmadmin
setspn -d http/AD-SRV.domain.com domain\svcmosscontent
setspn -d http/AD-SRV.domain.com domain\svcmossssp
setspn -d http/CRM-SRV.domain.com domain\crmadmin
setspn -d http/MOSS-SRV.domain.com domain\svcmossssp

Next we found that some of the machine accounts weren’t functioning correctly for kerberos, it appeared that the SPNs for these had gone AWOL too, so I recreated them with the following commands:

setspn -R CRM-SRV
setspn -R MOSS-SRV

MOSS and CRM still werent working but we were getting much more useful errors now, which led me to re-create the correct SPNs:

setspn -A http/CRM-SRV domain\crmadmin
setspn -A http/CRM-SRV.domain.com domain\crmadmin
setspn -A http/MOSS-SRV domain\svcmossssp
setspn -A http/MOSS-SRV.domain.com domain\svcmossssp
setspn -A MSSQLSvc/AD-SRV.domain.com:1433 domain\crmadmin
setspn -A MSSQLSvc/AD-SRV.domain.com:1433 domain\CRM-SRV$
setspn -A MSSQLSvc/AD-SRV.domain.com:1433 domain\MOSS-SRV$
setspn -A MSSQLSvc/CRM-SRV.domain.com:1433 domain\crmadmin
setspn -A MSSQLSvc/MOSS-SRV.domain.com:1433 domain\svcmossssp
setspn -A MSSQLSvc/MOSS-SRV:1433 domain\svcmossssp

A quick server reset later and we were ready to go!  MOSS and CRM functioning as they should be!

Posted by (JavaScript must be enabled to view this email address) on Tue 10 Mar 2009

Here is some example/helper code to create a hash function using the Microsoft Enterprise Library.

 
namespace YourApplication.Helper.Cryptography
{
    public static class CryptographyHelper
    {
 
        public static string DoHash(string Value)
        {
            MD5CryptoServiceProvider md5 = new MD5CryptoServiceProvider();
            byte[] input;
            byte[] output;
 
            string _salt = ConfigurationManager.AppSettings["salt"];
 
            //encrypt the password by hashing with the salt
            input = System.Text.ASCIIEncoding.ASCII.GetBytes(_salt + Value);
            output = md5.ComputeHash(input);
            string hash = Convert.ToBase64String(output);
            return hash;
        }
    }
}

Posted by (JavaScript must be enabled to view this email address) on Tue 10 Mar 2009

I am working on a project where a service application needs to interface with a webservice that implements a WS-Security authentication model.

WSE 2.0 provides the functionality for message level authentication, however WSE 2.0 does not integrate with Visual Studio 2008.

In order to get this to work I created the proxies using the WSDL command line utility and changed the base class from System.Web.Services.Protocols.SoapHttpClientProtocol to Microsoft.Web.Services2.WebServicesClientProtocol.
Here is an example of the code to set the username and password for the request object.

namespace YourApplication.Helper
{
    public static class RequestHelper
    {
 
        public static void PrepRequest(WebServicesClientProtocol si)
        {
            //get username and password for service request from config file
            string _password = ConfigurationManager.AppSettings["password"];
            string _username = ConfigurationManager.AppSettings["username"];
 
            //create the user token
            UsernameToken token = new UsernameToken(_username, YourApplication.Helper.Cryptography.CryptographyHelper.DoHash(_password), PasswordOption.SendHashed);
 
            //carry out the request
            SoapContext requestContext = si.RequestSoapContext;
            requestContext.Security.Tokens.Add(token);
 
        }
    }
}