Azure to Dynamics CRM 2011:如何实现 AD 身份验证

为了在我们的CRM安装中更好地显示数据，我们有一个Azure网站，它基本上读取我们想要处理的CRM数据（员工的工作时间），并使用Telerik（使用定期约会的调度程序）将它们转换为更易于阅读的格式。Telerik 约会永远不会转换回来，因此它是与 CRM 的只读连接。

我们已经使用固定用户进行身份验证使产品运行良好，但是当我们想要使用当前登录的用户进行身份验证时，我们遇到了涉及AD的障碍。 下面的代码中的currentUserId通过表单中的查询字符串传递。

private OrganizationServiceProxy CreateOrganizationService(String serverAddress, String organizationName, Guid currentUserId)
{
    var discoveryServiceUri = serverAddress.Contains("http") ? new Uri(String.Format("{0}/XRMServices/2011/Discovery.svc", serverAddress)) : new Uri(String.Format("http://{0}/XRMServices/2011/Discovery.svc", serverAddress));
    System.Diagnostics.Trace.TraceInformation("current discoveryUri: " + discoveryServiceUri);
    var credentials = new ClientCredentials();
    // Get the user's logon credentials.
    credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;
    System.Diagnostics.Trace.TraceInformation("current user: " + CredentialCache.DefaultNetworkCredentials.UserName);
    // Get the target organization.
    var organizationUri = GetOrganizationAddress(organizationName, discoveryServiceUri, credentials, null);
    System.Diagnostics.Trace.TraceInformation("current organization: " + organizationUri);
    var serviceProxy = new OrganizationServiceProxy(organizationUri, null, credentials, null);
    // This statement is required to enable early-bound type support.
    serviceProxy.EnableProxyTypes();
    if (currentUserId == Guid.Empty)
    {
       currentUserId = GetUserId(serviceProxy);
    }
    if (currentUserId != Guid.Empty)
       serviceProxy.CallerId = currentUserId;
    return serviceProxy;
}

上面的代码用于在服务器端创建CRM连接。

private Uri GetOrganizationAddress(String organizationName, Uri discoveryServiceUri, ClientCredentials credentials, ClientCredentials deviceCredentials)
    {
        if (discoveryServiceUri == null)
            throw new Exception("DiscoveryServiceUri is null. Please specify a valid configuration details to connect crm server.");
        using (var serviceProxy = new DiscoveryServiceProxy(discoveryServiceUri, null, credentials, deviceCredentials))
        {
            // Obtain organization information from the Discovery service.
            {
                // Obtain information about the organizations that the system user belongs to.
                System.Diagnostics.Trace.TraceInformation("getting organizationss now");
                OrganizationDetailCollection orgs = DiscoverOrganizations(serviceProxy);
                System.Diagnostics.Trace.TraceInformation(orgs.Count + " organizations discovered");
                if (orgs.Count > 0)
                {
                    int orgNumber = 0;
                    for (int n = 0; n < orgs.Count; n++)
                    {
                        if (orgs[n].UniqueName == organizationName || orgs[n].FriendlyName == organizationName)
                        {
                            orgNumber = n + 1;
                            System.Diagnostics.Trace.TraceInformation("orgs[n].UniqueName: " + orgs[n].UniqueName);
                            System.Diagnostics.Trace.TraceInformation("orgs[n].friendlyName: " + orgs[n].FriendlyName);
                            break;
                        }
                    }
                    if (orgNumber > 0 && orgNumber <= orgs.Count)
                    {
                        Version version = new Version(orgs[orgNumber - 1].OrganizationVersion);
                        System.Diagnostics.Trace.TraceInformation("version: " + version.Build);
                        // Return the organization Uri.
                        Uri uri =  new Uri(orgs[orgNumber - 1].Endpoints[EndpointType.OrganizationService]);
                        System.Diagnostics.Trace.TraceInformation("uri:" + uri);
                        return uri;
                    }
                    throw new Exception(string.Format("The specified organization '{0}' does not exist.", organizationName));
                }
                throw new Exception(string.Format("You do not belong to any organizations on the specified server. DiscoveryServiceUri '{0}'", discoveryServiceUri.AbsoluteUri));
            }
        }
    }

下面的代码是出错的地方：

private OrganizationDetailCollection DiscoverOrganizations(IDiscoveryService service)
    {
        var orgRequest = new RetrieveOrganizationsRequest();
        System.Diagnostics.Trace.TraceInformation("orgrequest made");
        var orgResponse = (RetrieveOrganizationsResponse)service.Execute(orgRequest);
        System.Diagnostics.Trace.TraceInformation("orgresponse retrieved: " + orgResponse);
        System.Diagnostics.Trace.TraceInformation("orgResponse.details: " + orgResponse.Details);
        return orgResponse.Details;
    }

它在 Execute（orgRequest） 命令上出错。我已经追踪到AD身份验证的一个问题，即我的凭据似乎是错误的。我想在第一种方法中将当前正在使用CRM（不是CRM用户帐户）的AD用户帐户使用的AD凭据传递给凭据对象。

目的是此应用程序只能从 Dynamics CRM 2011 内部使用，但理论上它也应该在平台外部工作以进行测试。

编辑：刚刚意识到我忘记了我的堆栈跟踪：

System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.
   at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)
   at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)The caller was not authenticated by the service.
Server stack trace: 
   at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)
   at System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan timeout)
   at System.ServiceModel.Security.SecurityProtocol.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.ClientSecurityChannel`1.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)