Questions[crm](server)

Scenario

Our company has two web servers. Our main doman, domain.com is hosted offsite using a hosting provider (In this case, Netfirms). One of our subdomains, subdomain.domain.com is hosted onsite and is reached via a CNAME entry in the DNS records at domain.com. Our e-mail server is hosted at domain.com and therefore we can only create [email protected] e-mail addresses. Our CRM system is hosted on subdomain.domain.com, and generates URL links based on subdomain.domain.com. This is useful for generating links in e-mails sent out to contacts, but it is unfortunately also generating cc e-mail addresses in the form [email protected].

Thoughts

We do have a catchall email account setup at domain.com, but anything sent to subdomain.domain.com is not caught here. Is this because domain.com and subdomain.domain.com are at two separate IP addresses, and therefore anything sent to subdomain.domain.com looks for a mail server there instead of domain.com?

What can I do?

Do I need to setup a mail server @ subdomain.domain.com just to catch these? Is there someway to redirect mail traffic sent to subdomain.domain.com to domain.com?

Is this a good scneario for an MX entry in the DNS records? I'm a bit new to DNS records and how they work. HOST should be set to subdomain.domain.com, I imagine and POINTS_TO set to mx.somain.com, but what about Priority?

--EDIT--

Current MX table at domain.com

Priority    HOST    POINTS_TO
30          @       mx.domain.com
30          @       mx.domain.com
30          *       mx.domain.com
30          @       mx.domain.com
30          *       mx.domain.com
30          *       mx.domain.com

The hosting provider uses Roundcube to handle mail.

I have an on-premise installation of Dynamics CRM 2016 which has claims-based authentication configured using an ADFS 4.0 (Server 2016) instance. Logging into CRM works fine via ADFS. I have a separate Node.js application trying to access the CRM Web API using the ADAL library provided by Microsoft to perform authentication. I have created an ADFS client using PowerShell for this Node app that has a Client ID and Secret. When the Node code executes to acquire a token from ADFS to use for calling the CRM Web API, I get the error MSIS9605: The client is not allowed to access the requested resource. Clearly the call is reaching ADFS, but I cannot seem to find a way to configure ADFS to allow the client to access the other resource protected by ADFS.

Here is the output of Get-ADFSRelyingPartyTrust:

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        : https://crm.mysite.com/
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {, , }
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                : [Subject]
                                         CN=*.mysite.com, OU=Domain Control Validated

                                       [Issuer]
                                         CN=Go Daddy Secure Certificate Authority - G2, 
                                       OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, 
                                       S=Arizona, C=US

                                       [Serial Number]
                                         2DC..............91

                                       [Not Before]
                                         11/23/2016 9:41:00 PM

                                       [Not After]
                                         1/19/2018 3:51:41 PM

                                       [Thumbprint]
                                         2FC..................AADD

Identifier                           : {https://demo.mysite.com/, https://crm.mysite.com/}
NotBeforeSkew                        : 0
EnableJWT                            : True
AlwaysRequireAuthentication          : False
Notes                                : 
OrganizationInfo                     : 
ObjectIdentifier                     : 8e869c1e-..........8b5a
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         : 
Name                                 : crm.mysite.com
AutoUpdateEnabled                    : True
MonitoringEnabled                    : True
MetadataUrl                          : https://crm.mysite.com/federationmetadata/2007-06/federationmetadata.xml
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           : 
IssuanceTransformRules               : @RuleTemplate = "PassThroughClaims"
                                       @RuleName = "Pass Through UPN"
                                       c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]
                                        => issue(claim = c);

                                       @RuleTemplate = "PassThroughClaims"
                                       @RuleName = "Pass Through Primary SID"
                                       c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"]
                                        => issue(claim = c);

                                       @RuleTemplate = "MapClaims"
                                       @RuleName = "Transform Windows Account Name to Name"
                                       c:[Type == 
                                       "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
                                        => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", 
                                       Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, 
                                       ValueType = c.ValueType);

                                       @RuleTemplate = "PassThroughClaims"
                                       @RuleName = "App Claim"
                                       c:[Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-clie
                                       nt-application"]
                                        => issue(claim = c);


DelegationAuthorizationRules         : 
LastPublishedPolicyCheckSuccessful   : True
LastUpdateTime                       : 1/4/2017 8:24:16 PM
LastMonitoredTime                    : 1/5/2017 8:02:07 PM
ImpersonationAuthorizationRules      : 
AdditionalAuthenticationRules        : 
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        : 
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }

Here is the Node.js function using ADAL (https://github.com/AzureAD/azure-activedirectory-library-for-nodejs). I realize it has Azure in the title but it is successfully communicating with ADFS and there are comments in the issues log stating that what I am doing is possible.

let ADAuthenticationContext = require('adal-node').AuthenticationContext;

const authorityHostUrl = 'https://sso.mysite.com';
const tenant = 'adfs';
let authorityUrl = authorityHostUrl + '/' + tenant;
const clientId = 'c43002e2-............67c';
const clientSecret = 'lT..................jjh';

const resource = 'https://crm.mysite.com/';


let crm = module.exports = {};

let context = new ADAuthenticationContext(authorityUrl, false);

crm.test = function() {
    context.acquireTokenWithClientCredentials(resource, clientId, clientSecret, function(err, tokenResponse) {
        if (err) {
            console.log('well that didn\'t work: ' + err.stack);
        } else {
            console.log(tokenResponse);
        }
    });
};

Also, from the ADFS Event Log:

Encountered error during OAuth token request. 

Additional Data 

Exception details: 
Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9321: Received invalid OAuth request. The client 'c43002e2-f1a6-4786-9234-f71e971c167c' is forbidden to access the resource 'https://demo.mysite.com/'.
   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId)
   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthClientCredentialsContext.ValidateCore()

Any insight would be great as I am pretty new to ADFS and the message seems to indicate something in ADFS is not correct.

As I said in the title we have to migrate MS Dynamics CRM 4.0 Server and database from our local network, to an external datacenter. This datacenter has different domain and active directory. The first issue we have to solve is AD authentication for users. The ideas we have are:

• Make a new AD at the datacenter and trust domains.
• Use ADAM (technet libraries say that CRM does not work with this)
• Make a copy of the existing AD and move it to the new place.

I would be grateful to everyone who could give any idea.

The Apache2 server and PHP version seem to be in order, but when I launch the CRM installer at

http://localhost/<CRM dir>/install.php

The wizard says I need a minimum of PHP 5.1 and preferably PHP 5.2.x. The thing is, I am running PHP 5.2.8, and I know this from running

php --version

Plus, I spent a bunch of time learning how and (I thought, successfully) compiling PHP 5.2.8. It is quite likely I screwed up and don't have some libraries I need, but I'm not sure where to look first.

Thanks in advance.

PS - I know some of you will suggest going to the CRM's forums... I tried this; these are not good. I much prefer the expertise I get here on the Stack Exchange sites.

What open source(or not) CRM do you use ? i have come across Tactilecrm and it's kinda' great.