Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Problem using Internal and External addresses with Claim based auth and IFD

Posted on 2011-03-21
Last Modified: 2012-05-11
Hi All

I'm trying to get my system setup to use IFD for the external addresses and have a separate internal address that internal users use, so that they don't have to authenticate using IFD.

I have followed the new guide for setting up Claims based auth & IFD, and IFD works fine for both internal and extenral users, but I cannot get the internal address working. When I try the Internal address on the local LAN, I get a windows login prompt, and even if I type the users name and password in the in domain\username and username formats it doesn't login.

Anyone have any pointers?



Question by:WayneATaylor
  • 3
  • 2
LVL 29

Expert Comment

by:Feridun Kadir
ID: 35179216
Did you set up two relying parties in AD FS?  You need two, one specifying the internal address and one specifying the external address.
LVL 10

Author Comment

ID: 35179222

Yes I did do this. The only difference in the two is the endpoint address, is that correct?

LVL 29

Expert Comment

by:Feridun Kadir
ID: 35221686
That is correct.
Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

LVL 10

Author Comment

ID: 35221736
Its still not working for me then, I get connect fine on the External address. I get the ADFS login fine and all works, but when I try and use the Internal address I get the windows login and cannot get into it!


Accepted Solution

petesvendson earned 500 total points
ID: 36013681
If you are getting prompted for credentials when attempting to access CRM over the internal access point you need to keep in mind that CRM is redirecting the request to ADFS with a URL indicating that the user has a Kerberos ticket. Meaning Kerberos traffic must resolve.

1. Make sure that your FQDN name for ADFS is in the Intra net site zone in IE (by default IE will only send Kerberos tickets to Intranet sites

2. Ensure that you have a HOST SPN for the ADFS URL under the Machine Account (assuming that KernelMode Auth is turned ON on the ADFS website. (Yes I did mean HOST SPN and not HTTP SPN ADFS need HOST. By default Kernel Mode Int auth should be turned on -- if not then the SPN goes under the SVC account running your ADFS IIS AppPool Account.

Most likely you are running into Issue #1. If not let me know and we can drill further.
LVL 10

Author Closing Comment

ID: 37381532
I actually reinstalled and it seemed to work in  the end!

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Having trouble getting your hands on Dynamics 365 Field Service or Project Service trial? Worry No More!!!
Desired Skill Set for Microsoft Dynamics CRM Technical Resources – Part I
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question