IFD Sign In Prompt for Dynamic Excel Exports

If you have set up IFD (internet facing deployment) within your organization and you attempt to export to a dynamic worksheet, you may be presented with the IFD Sign In prompt (see screenshot) presented in the CRM spreadsheet rather than having your data auto export to Excel.

If this happens, first try and navigate to the Data tab in Excel and click the "Refresh from CRM" icon. If that doesn't work, try with the "Refresh All" option.

If this still doesn't work, then do as follows:

• On the Data tab click Connections to open the "Workbook Connections" window
• Click Properties
• Click the Definition tab
• Click "Edit Query"
• Enter your credentials

After authenticating do as follows:

• Click Ok on the Error window (after entering credentials)
• Click Cancel on the Edit Web Query window
• Click Ok on the "Connection Properties" window
• Click Close on the "Workbook Connections" window

After having performed these steps, try to refresh once again first using the "Refresh from CRM" icon and if that doesn't work, click "Refresh All" and your data should appear.

I am not currently aware of a permanent solution for this issue.

Extending the IFD timeout

After deploying IFD, we noted that the default ADFS timeout setting was too short and kept on timing out users.

The IFD Configuration guide has a section describing how to modify the timeout setting. The following is a simple walkthrough:

• Open up a windows powershell session

• In ther powershell session type in: 
• Add-PSSnapin Microsoft.Adfs.PowerShell
• Get-ADFSRelyingPartyTrust -Name:"Relying_Party"
• Set-ADFSRelyingPartyTrust -TargetName:"Relying_Party" -TokenLifetime 480

Note that the Relying_Party value should be the Relying Party you see in ADFS. So in this example it would be "CRM External".

The token lifetime is in minutes, so 480 equals 8 hours.

CRM 2011 IFD Setup: Part 2

My previous post refers to some resources for setting up IFD in CRM 2011. Overall the process looks scarier than it actually is. And the benefit of having IFD is that you can access CRM without having to jump through any firewalls etc. in about the same way as you can access your webmail from any location (or maybe not in your case...?). Not to mention the fact that some third party solutions may require that you have IFD set up as a prerequisite for configuring the solution.

Anyway when you walk through the videos, you will have ended up creating at least 4 URLS (which you'll need to configure in your DNS):

• adfs.yourdomain.com (or sts1.yourdomain.com as shown in one of the videos) - External facing. URL used for authenticating to ADFS.
• auth.yourdomain.com - External facing. Your IFD federation endpoint.
• dev.yourdomain.com - External facing. Discovery web service.
• org1.yourdomain.com - External facing. Your IFD access URL for your CRM organization (org1 = whatever your CRM organization name is)

I say "at least 4" because you may end up with more. This would be the case if:

• You create an internal alias for your CRM deployment e.g. crm.yourdomain.com (you may do this even if you're not configuring IFD but as it's mentioned in the video I thought I'd mention it here too)
• Access to additional organizations in your CRM deployment. Relevant if you're a hosting partner or for whatever reason you decide to have multiple orgs in your company's deployment (this will be the subject of a future post). For example:
• org2.yourdomain.com
• org3.yourdomain.com
• ...
• orgn.yourdomain.com

CRM 2011 IFD Setup

Setting up an Internet Facing Deployment in CRM 2011 is very different from it's predecessor. CRM 2011 uses ADFS to enable the IFD access.

Microsoft has an article with links to white papers and a video for setting this up.It should be pointed out though that the above article originally linked to the following video for configuring IFD:

http://www.youtube.com/watch?v=T9jZIxDTsBw

At around the end of April, another video was linked to the article:

http://www.youtube.com/watch?v=ZD5qaa-G99E

The reason I mention this is because I think both videos are helpful. The original video is more useful if you are deploying ADFS on the same server as where you have CRM installed. Whereas the second is better if you are deploying ADFS on a separate server.

For example, when deploying ADFS on the same server as you have deployed CRM, you will only require a single Relying Party Trust (assuming a single domain), Whereas the second video will walk you through setting up two relying party trusts which can perhaps be confusing.

Just my 2 cents.