However, the HTTP SPN is needed for Report Wizard reports to run as per Microsoft KB article 2590774. NOTE: If IIS is running in Kernel Authentication Mode (which is the default and recommended mode) then it should not be necessary to register SPNs for CRM because in Kernel Authentication Mode IIS run as the computer account. Where CRMServerName is the DNS (fully qualified domain name) name of the server where CRM is installed and CRMAppPoolAccountName is the name of the account use for the CRMAppPool application pool (this can be determined in IIS). Setspn -s HTTP/ CRMServerName Domain CRMAppPoolAccountName Of course if the service account is Network Service, then the SPN is created for the server. The CRM Implementation guide describes adding an HTTP SPN for the server however this article (and others) suggest adding a HOST SPN for the ADFS service account. Where adfsURL is the URL for the AD FS 2.0 service and adfsserver is the internal name of the server running AD FS 2. Setspn -s HTTP/ adfsURL Domain adfsserver$
ItemĪD FS Server (when using Claims-based authentication
But as soon as more than one server is involved (including NLB clusters) then you must set SPNs. If CRM and the SQL Server that hosts the CRM databases are running on the same computer then you might be able to get away with not setting SPNs. Setspn -S HTTP/ domainaserver1$ SPNs required for CRM If the account used for the service is Network Service, Local Service or Local System then the SPN must be registered against the computer account:
The SPN must be registered on the usera account. If the service ran on port 999 then the SPN is: Note that HTTP in the SPN is not the same as the protocol type in a browser. He describes an SPN as a name that identifies a program that deals with credentials.Ĭonsider a process running in IIS that is accessed using the DNS name and the application pool for the process is running under the user account, domainausera. I like the explanation provided by Brian Murphy-Booth. What is an SPN?Īn SPN is a mapping that associates a service with the account responsible for the service and supports mutual Kerberos authentication. When setting up Microsoft Dynamics CRM it is likely that you will have to configure Service Principal Names (SPN).
0 kommentar(er)
