{"id":6529,"date":"2014-04-20T08:17:00","date_gmt":"2014-04-20T08:17:00","guid":{"rendered":"https:\/\/unknownerror.org\/index.php\/2014\/04\/20\/client-connection-issue-security-support-provider-interface-sspi-authentication-failed-collection-of-common-programming-errors-2\/"},"modified":"2014-04-20T08:17:00","modified_gmt":"2014-04-20T08:17:00","slug":"client-connection-issue-security-support-provider-interface-sspi-authentication-failed-collection-of-common-programming-errors-2","status":"publish","type":"post","link":"https:\/\/unknownerror.org\/index.php\/2014\/04\/20\/client-connection-issue-security-support-provider-interface-sspi-authentication-failed-collection-of-common-programming-errors-2\/","title":{"rendered":"Client Connection Issue &#8211; Security Support Provider Interface (SSPI) authentication failed-Collection of common programming errors"},"content":{"rendered":"<p>First off let me start describing how I have the CRM server setup.\u00a0<\/p>\n<ul>\n<li>Single Server Install (CRM + SQL)<\/li>\n<li>HTTPS setup on non-standard port (4445), one binding and using an SAN certificate signed by our CA in our domain<\/li>\n<li>One domain user account used to run everything (IIS App Pool, Async Service, Deployment Service, etc&#8230;)<\/li>\n<\/ul>\n<p>When I run the following code\u00a0<\/p>\n<p><em>Uri discoUri = new Uri(&#8220;https:\/\/crmserver:4445\/XRMServices\/2011\/Discovery.svc&#8221;);<\/em><\/p>\n<p><em>ClientCredentials clientCredentials = new ClientCredentials();<\/em><br \/>\n<em>clientCredentials.Windows.ClientCredential = new System.Net.NetworkCredential(USERNAME, PASSWORD, DOMAIN);<\/em><\/p>\n<p><em>using (var _serviceProxy = new DiscoveryServiceProxy(discoUri, null, clientCredentials, null))<\/em><\/p>\n<p>\n<em>{<\/em><br \/>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ You can choose to use the interface instead of the proxy.<\/em><br \/>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 IDiscoveryService service = _serviceProxy;<\/em><\/p>\n<p><em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 RetrieveOrganizationsRequest orgsRequest = new RetrieveOrganizationsRequest()<\/em><\/p>\n<p>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 {<\/em><br \/>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 AccessType = EndpointAccessType.Default,<\/em><br \/>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Release = OrganizationRelease.Current<\/em><br \/>\n<em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 };<\/em> \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/p>\n<p><em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 RetrieveOrganizationsResponse organizations = (RetrieveOrganizationsResponse)service.Execute(orgsRequest);<\/em><\/p>\n<p>\n<em>}<\/em><\/p>\n<p>I get this exception:<\/p>\n<p><strong><em>Exception:<\/em><\/strong> <em>SOAP security negotiation with &#8216;https:\/\/crmserver:4445\/XRMServices\/2011\/Discovery.svc&#8217; for target &#8216;https:\/\/crmserver:4445\/XRMServices\/2011\/Discovery.svc&#8217; failed. See inner exception for more details.<\/em><\/p>\n<p><strong><em>Inner Exception:<\/em><\/strong> <em>Security Support Provider Interface (SSPI) authentication failed. The server may not be running in an account with identity &#8216;host\/crmserver&#8217;. If the server is running in a service account (Network Service for example), specify the account&#8217;s ServicePrincipalName as the identity in the EndpointAddress for the server. If the server is running in a user account, specify the account&#8217;s UserPrincipalName as the identity in the EndpointAddress for the server.<\/em><\/p>\n<p>I get this error running the code above, using the Plugin Registration Tool or other CRM tools from a computer other than the server. If I run the code\/tools on the server they run just fine.<\/p>\n<p>Since I&#8217;m using Kernel Mode in IIS 7.5 and a Domain User account I was under the assumption that HTTP SPN&#8217;s didn&#8217;t need to be setup, just for the heck of it I added two HTTP SPN&#8217;s against the Domain User account<\/p>\n<ul>\n<li>HTTP\/crmserver DOMAIN\\SERVICEACCOUNT<\/li>\n<li>HTTP\/crmserver.fqdn.local DOMAIN\\SERVICEACCOUNT<\/li>\n<\/ul>\n<p>And that didn&#8217;t seem to help either!<\/p>\n<p>Interestingly enough if I switch from HTTPS to HTTP I can connect from the client machinse so I&#8217;m really confused why an issue that appears to be Windows Authentication\/Kerberos related suddenly disappears once I use HTTP!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>First off let me start describing how I have the CRM server setup.\u00a0 Single Server Install (CRM + SQL) HTTPS setup on non-standard port (4445), one binding and using an SAN certificate signed by our CA in our domain One domain user account used to run everything (IIS App Pool, Async Service, Deployment Service, etc&#8230;) [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6529","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts\/6529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/comments?post=6529"}],"version-history":[{"count":0,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts\/6529\/revisions"}],"wp:attachment":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/media?parent=6529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/categories?post=6529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/tags?post=6529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}