x Want to participate? Join the group to interact
  • State Not Answered
  • Replies 5 replies
  • Subscribers 74 subscribers
  • Views 1202 views
  • Users 0 members are here
Browse Forums
Announcements
105
topics
32
replies
General Discussion
6k
topics
18k
replies
Proconsult

About Windows authentication, Integrated NT security for database & tomcat services

Posted By

Hi,

My first post on this forum but I read it almost everyday.

Nice to meet you ! :)

----------------------------------------------------------------------------------------

I'm having trouble trying to set up Sage CRM 7.1 (actually i7.5 french version but the core is equal to v7.1 EN) with Windows user authentication, Database connection through IIS NT Integrated security, and the way tomcat services connect to the DB.

1) I expose my first problem :

My customer has high security principles regarding how applications and users should connect to the DBs.

Their major requirement is that SQL Server should not allow connections through SQL users (for instance, sa login is disabled). It's ok for the setup process, but once CRM is installed we must find a way for CRM to be able to connect using a dedicated Windows account that has dbowner rights on the CRM database.

How can I manage to setup this properly ?

We have succeeded by changing the account that runs the application pools for CRM and CRM rewriter and checking the appropriate option in the Admin/System parameters/Database/Use Integrated NT Windows security. It works for all SageCRM standard accesses to the database it seems, but...

Issue #1.1 :How can we do the same for tomcat services ?

When we looked a little deeper in the SQL Server logs we can clearly see that Tomcat still uses its own default "sa" sql login credentials.

Ok no problem let's change the jdbc settings file in the tomcat/webapps/web-inf folder and let's restart the services we thought. (I put the login "sa" and "password" lines in comment and added in the connectionstring "Integrated Security=SSPI" (but I suppose I'm wrong).

But then the tomcat logs tells us that this config is wrong. So once again how to do this properly?

I read a lot about this but it's always general and very detailed so it's a lot of waisted time. Maybe a detailled article could help a lot of partners all around the world ?

Issue #1.2 : We found some errors in the SQL Logs something that lead us to this article :

http://blogs.msdn.com/b/sqlserverfaq/archive/2010/10/27/troubleshooting-specific-login-failed-error-messages.aspx

Did anyone had this kind of connection error ?

EDIT : What I'm thinking now by reviewing my questions before posting it is that in IIS I let both Anonymous logon & Windows authentication enabled. Is it correct or not ?

2) Now my second issue : Allowing Windows Users authentication in SageCRM.

I created two different crm logins with the same names than the corresponding AD users, set up properly the default domain name and the parameter Admin/Users/User settings/Use automatic IIS login session to Yes.

Once done I tried to login and it worked. No need to specify the password anymore the login is automatic. Very nice but...

As soon as I tried to login with another Windows session using the other crm user associated with the other windows login, I found out that I was still connected with the previous login...
Strange behaviour but you need more explanations...

In fact I had the following settings in CRM & IIS

- the first crm account (= the first Windows login) is the one that is parametered in the crm application pool (lets call this Windows account CRMPoolAccount).

- This CRMPoolAccount has the rights to connect to the CRMDB & is Domain admin.

- This CRMPoolAccount is a CRM login too.

- Use automatic IIS login session to YES + default domain specified

- IIS CRM Application pool that runs with CRMPoolAccount account (and the same the CRM Rewriter application pool)

- Use Integrated NT Windows security for Database connection in sagecrm is parametered.

Where did I miss something for this second issue ?

PS : Our server is 2008R2 64bits, with IIS 7.0

Thanks in advance for your ideas.

Valérian

  • 0

    Hi,

    For the tomcat service to use windows login you can follow the below steps.

    1. Go to Run and type “services.msc”.
    2. Select tomcat service of your CRM and right click on it and select Properties.
    3. Go to “Log On” tab and here select “Local System Account” radio button.
    4. Then Click on Apply button and then Ok.

    To enable Windows Authentication for CRM you can follow below steps.

    1. Go to IIS.
    2. Make Windows Authentication enabled for the site.
    3. Then Login to CRM and go to Administration -> Users -> User Configuration.
    4. Set “Use IIS Auto login” to Yes and click on save.

    To check the working of Windows authentication you can follow below steps.

    1. When we enabled windows authentication for CRM then, when we try to login to CRM it will take your system user name and password to Login and you will be logged in successfully.
    2. To check your windows login is working correctly or not. Open Internet Explorer and select Internet Options.
    3. Go to Security tab and click on “Custom Level” button.
    4. In this go to “User Authentication” section and check “Prompt for user name and password” radio box and click on OK button.
    5. Then try to open CRM in IE. It will prompt for User name and password. Here you have to enter your user name and password and check whether it is working correctly or not.

    Hope this helps!

    Regards,

    Dinesh

  • 0

    Thank you I will try it as is and let you know asap.

    Regards,

    Valérian

  • 0

    I just read your answer and it only concerns one point.

    Does it works combined with the alternate windows db connection for sagecrm and tomcat services instead of the sql sa db connection ?

  • 0

    Hi, now Windows Authentication for CRM is enabled.

    It works correctly.

    So my last question is still opened :

    Is it possible for Sage CRM AND tomcat services to access to the database using a Windows Authentication instead of SQL login (generally we use the "sa" account by default) ? What about the jdbc properties & the connection string then ?

  • 0

    Hi,

    the answer is :

    Tomcat MUST use a SQL login. It is NOT possible to user a windows authentication for Tomcat even though it is possible for IIS based functions. (7.1 and 7.2 are concerned as far as I know)

*Community Hub is the new name for Sage City