Problem using Internal and External addresses with Claim based auth and IFD

Posted on 2011-03-21
Last Modified: 2012-05-11
Hi All

I'm trying to get my system setup to use IFD for the external addresses and have a separate internal address that internal users use, so that they don't have to authenticate using IFD.

I have followed the new guide for setting up Claims based auth & IFD, and IFD works fine for both internal and extenral users, but I cannot get the internal address working. When I try the Internal address on the local LAN, I get a windows login prompt, and even if I type the users name and password in the in domain\username and username formats it doesn't login.

Anyone have any pointers?



Question by:WayneATaylor
  • 3
  • 2
LVL 29

Expert Comment

ID: 35179216
Did you set up two relying parties in AD FS?  You need two, one specifying the internal address and one specifying the external address.
LVL 10

Author Comment

ID: 35179222

Yes I did do this. The only difference in the two is the endpoint address, is that correct?

LVL 29

Expert Comment

ID: 35221686
That is correct.
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

LVL 10

Author Comment

ID: 35221736
Its still not working for me then, I get connect fine on the External address. I get the ADFS login fine and all works, but when I try and use the Internal address I get the windows login and cannot get into it!


Accepted Solution

petesvendson earned 500 total points
ID: 36013681
If you are getting prompted for credentials when attempting to access CRM over the internal access point you need to keep in mind that CRM is redirecting the request to ADFS with a URL indicating that the user has a Kerberos ticket. Meaning Kerberos traffic must resolve.

1. Make sure that your FQDN name for ADFS is in the Intra net site zone in IE (by default IE will only send Kerberos tickets to Intranet sites

2. Ensure that you have a HOST SPN for the ADFS URL under the Machine Account (assuming that KernelMode Auth is turned ON on the ADFS website. (Yes I did mean HOST SPN and not HTTP SPN ADFS need HOST. By default Kernel Mode Int auth should be turned on -- if not then the SPN goes under the SVC account running your ADFS IIS AppPool Account.

Most likely you are running into Issue #1. If not let me know and we can drill further.
LVL 10

Author Closing Comment

ID: 37381532
I actually reinstalled and it seemed to work in  the end!

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

On Sep 22nd 2014 Microsoft released Update Rollup 1 for Microsoft Dynamics CRM 2013 Service Pack 1 and back in July Update Rollup 3 was released.  So we now have:   Update Rollup 1Update Rollup 2Update Rollup 3Service Pack 1Update Rollup 1 for S…
Automatically creating a Trello card using data from a Microsoft Dynamics CRM record turned out to be an easy project that yielded great results.  Here's how I did this for an internal team at General Code.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now