Publishing Microsoft CRM 4.0 through ISA Server 2006

1. Introduction

Last February I collaborated with Henning Petersen from the CRM Team on CRM 3 through ISA Server 2006. After this post, we received a lot of requests for an article on publishing CRM 4 using the Internet Facing Deployment option (IFD). This post is going to answer those requests. For this post we chose to let ISA handle the SSL Certificates as this is the common scenario for ISA deployments although other methods can be used.

We chose to focus this blog on letting CRM handle the authentication while letting ISA handle the SSL session. The main reason for using IFD despite ISA’s ability to provide forms based authentication was that the Microsoft Dynamics CRM Clients for Outlook would run into authentication problems if prompted with an ISA login. In order to get CRM running with IFD a good starting point is to study the IFD guide called How to configure an Internet-Facing Deployment for Microsoft Dynamics CRM 4.0 it can be downloaded from the Microsoft Download Center. The deployment guide will allow you to better understand the CRM 4 IFD concepts before you create any publishing rules on ISA Server.

2. Adjusting the CRM Server for External Publishing

To deploy this scenario the following topology was used:

64-bit RPC traffic fails across ISA Sever 2006

1. Introduction

This post describes an issue where two 64-bit Windows hosts are failing to communicate to each other using RPC . The hosts each operate in a network physically separated from each other by ISA Server 2006.  Figure 1 illustrates the basic scenario.

Change Tracking - Enterprise viewer

The Change Tracking tab is part of the ISA management console. But, it is implemented as an HTML files, and can operate outside the management console. To demonstrate this, I'll show how to use it as an enterprise Change Tracking viewer.

The Hook
If you look in C:\Program Files\Microsoft ISA Server\UI_Htmls\ChangeTrackingTab.htm, you'll notice that it has a body_onload() function, and that this function calls ChangeTracking_onload() if it exists. Also notice that it includes a script tags that tries to load ChangeTrackingAdditions.js. So, all we need is to create our own ChangeTrackingAdditions.js with ChangeTracking_onload() in it, and it will be called!

The Code
So, let's try it. Put the following into C:\Program Files\Microsoft ISA Server\UI_Htmls\ChangeTrackingAdditions.js:

function ChangeTracking_onload()
{
    if (WithinSnapin())
    {
        return; // Don't interfere with regular Management operation
    }

    var fpc = new ActiveXObject("FPC.Root");
    // To connect to remote CSS, call fpc.ConnectToConfigurationStorageServer here

    var entLog     = GetCTLog(fpc.Enterprise);
    var arrLogs    = GetCTLogCollection(fpc.Arrays);
    var entPolLogs = GetCTLogCollection(fpc.Enterprise.Policies);

    insertTableHTML(arrLogs, entPolLogs, entLog);
}
    
function GetCTLogCollection(CTContainerCollection)
{
    var logs="";
    var oEnum = new Enumerator(CTContainerCollection);
    for( ; !oEnum.atEnd(); oEnum.moveNext() )
    {
        logs = logs + GetCTLog(oEnum.item());
    }
    return logs;
}

function GetCTLog(CTContainer)
{
    try
    {
        var vendorSet = CTContainer.VendorParametersSets.Item("{1234C1BD-2502-4BDA-8EAD-B2DE4DD84A7D}");
        return vendorSet.value("changes");
    }
    catch (err)
    {
        return "";  // No CT log in this container
    }
}

Now, launch ChangeTrackingTab.htm from Windows Explorer.

• You'll get an Internet Explorer yellow warning bar where it warns you from active content. You can allow just this once, or cancel this warning for good: Internet Options -> Advanced -> Security section -> check "Allow active content to run in files on My Computer".
• You'll also get a warning that "An ActiveX control on this page might be unsafe…". This refers to the script's use of the ISA FPC.Root control - we can trust it, right?
• And now, you get change logs from all your arrays, enterprise and enterprise policies, all together!

This concludes the Change Tracking series. I hope you enjoyed it. Happy ISAing!

-Jonathan Barner, ISA Sustained Engineering Team

Change Tracking - Configuration via Script

Change Tracking configuration is stored together with ISA configuration, in a VPS (Vendor Parameter Set). Note that it's a different VPS than the change log! As we already know, you can configure Change Tracking either on the array or on the enterprise. This is implemented as one VPS for each array, and one for the whole enterprise.

You can configure enable/disable Change Tracking via a script which changes these VPSs. Note that the following script always changes the enterprise VPS on ISA Enterprise Edition - changing that to change just the current array is left as an exercise to the reader.

const fpcIsaStandardEdition = &H10&
const fpcIsaEnterpriseEdition = &H20&

Set fpc = CreateObject("FPC.Root")
If fpc.IsaEdition = fpcIsaStandardEdition Then
    Set VendorSets = fpc.GetContainingArray.VendorParametersSets
Else
    Set VendorSets = fpc.Enterprise.VendorParametersSets
End If

On Error Resume Next
Set VendorSet = VendorSets.Item( "{123558F0-6D04-4781-AC2B-5C54DCEDBCFD}" )
If Err.Number <> 0 Then
    Err.Clear
    On Error GoTo 0
    Set VendorSet = VendorSets.Add( "{123558F0-6D04-4781-AC2B-5C54DCEDBCFD}" )
End If
On Error GoTo 0

VendorSet("Enabled") = True
'VendorSet("AskDescription") = False
'VendorSet("MaxEntries") = 1000

VendorSets.Save 0, 0

WScript.Echo "Change Tracking is now enabled"

 -Jonathan Barner, ISA Sustained Engineering Team

Change Tracking - Modifying the Viewer

We've tried to get the Change Tracking viewer to cater to most people's needs. But you may have needs that it doesn't meet. Fortunately, you can customize the viewer to fit your needs!

As we already know, the Change Tracking log is stored as XML, which you can save using simple scripts. If you look at one such log, you'll notice that each log entry contains a "computer" attribute, which is the computer name on which the change was made.

Suppose you want to see this "computer" attribute in the log viewer. All you need to do is just modify the XSL file that transforms the log XML into viewable HTML:

1. Open C:\Program Files\Microsoft ISA Server\UI_Htmls\ChangeTracking.xsl in notepad or any other text editor.
2. Find the line that puts the username in the User column. It looks like this:
   

   <xsl:value-of select="@user" />

3. Replace it with lines that put the username and computer name:
   

   <b>user: </b><xsl:value-of select="@user" /><br />
   <b>computer: </b><xsl:value-of select="@computer" />

4. Save. Now hit refresh on the Change Tracking viewer, and you'll see the change!

Further customizations are left as an exercise to the astute reader. Hint: Try playing with the <xsl:sort> line.

-Jonathan Barner, ISA Sustained Engineering Team

Change Tracking - Other Uses

One of the unexpected uses I've found for Change Tracking is to learn how UI changes are translated to COM-level changes. For example, how is this radio button stored?

Let's enable Change Tracking, make some changes and try:

Policy Rule [PubExch] [PublishedServerType] changed from [fpcWebServerThruHTTP] to [fpcWebServerThruBothHTTPAndSSL]

Ah. All we need it to search for the property PublishedServerType, and there's our answer.

Another use is to find out what changes are made to ISA configuration outside the UI. For example, what does ISA setup, and specifically SP1 setup, do?

To check:
1. Install an ISA CSS
2. Enable Change Tracking on the Enterprise, apply.
3. Install an ISA Server, using a an ISA CD with SP1 integrated to it (See Administrative Installation section in KB885957).
3. Look at Change Tracking log of the new array:

You see several entries made by msiexec.exe (which is the process which runs ISA setup). You see that it makes some changes to logs and computer sets. You also see the new events and alerts added in SP1, and a new UUID added to the Exchange RPC Server protocol.

You can use the same technique to see what your 3rd-party add-on keeps in the ISA storage!

-Jonathan Barner, ISA Sustained Engineering Team

ISA Server 2006 SP1 - Test Button Issues

One of the features released in ISA Server SP1 is the Test Button feature. Its major purpose is to test the compatibility between an ISA Web publishing rule and the published Web server. Test Button works well in common deployment scenarios; however, in some fairly uncommon cases it might report inconsistent results, when it reports success to an ISA Server computer, while a user will fail to connect to the published server[i].

The main reasons for these inconsistencies are:

1.       Test Button doesn’t check rule conflicts. For example, when ISA Server has a “Deny All” rule prior to the publishing rule, a user won’t be able to access the published server even when Test Button reports success.

2.       Test Button doesn’t check the listener configuration. For publishing to succeed both rule and listener configurations must be valid. However, since Test Button checks only the rule configuration, the listener may have a wrong configuration (expired certificate, listening on a wrong network, etc).

3.       Directory content is published by means of a wildcard.
For example, there is a directory (e.g. pics/) containing some files (e.g. photo1.jpg, photo2.jpg) which are accessed from outside by direct links (e.g. http://www.contoso.com/pics/photo1.jpg). The publishing can be done in two ways:

·         Explicitly – by means of two publishing paths: pics/photo1.jpg, pics/photo2.jpg. In this case Test Button won’t have issues.

·         Implicitly – by means of a published path which includes all files and subfolders using /* (e.g. /pics/*). In this case Test Button will explicitly test the directory and even though it may report success, the user can still encounter problems related to the existence/access permissions of the content itself (e.g. photo1.jpg returns an HTTP response 403 or 404).

4.       HTTP response 403 (forbidden) for a directory published with wildcard. When testing a directory published with trailing /* (e.g. /pics/*) an HTTP response 403 is always regarded as success, assuming that the real publishing target is not the directory, but rather its content. However this approach can be misleading: when the Web server directory requires secure channel (SSL), but the ISA Server attempts to access it by means of HTTP, the response will also be 403. In this case Test Button will also report success, although the publishing will fail.

5.       Published path can’t be verified if one of the parent directories requires authentication. For example, if the published path is /ExistingDirWithAuth/NonExistingDir/*, the published server will respond with an HTTP response 401 (Authorization required) with no hint about NonExistingDir existence or permissions. In this case if the authentication delegation scheme meets the published server requirements, Test Button will report success, but a user might fail to access the resource.

6.       Client information is required.

a.       Forward original host name option is selected in the web publishing rule, but no public names are defined. In this case Test Button will forward FQDN of the ISA Server, which might be different from the name a user might use.  (A user may use any host name which successfully translates into the IP address that ISA Server listener is listening on.)

b.      Requests appear to come from the original client. This option is currently ignored by Test Button, while it can affect the publishing success for different users IP addresses.

7.       FBA is supported only for Exchange 2003 and Exchange 2007. While Test Button recognizes Forms Based Authentication (FBA) for Exchange 2003 and Exchange 2007 and warns a user when an incompatible authorization delegation scheme is used, it is currently unaware of FBA in other products (e.g. SharePoint 2007).

These limitations should be considered by the ISA Server administrator when there is inconsistency between Test Button results and an actual user experience.

Dima Datsenko

Software Development Engineer, ISA Server Sustained Engineering

Change Tracking - Odds and Ends

Date & Time
The Change Tracking log viewer show the date and time of every change.

• The time is recorded as UTC (Coordinated Universal Time), and displayed using the current computer's time zone.
• The time format is determined by the user's long date & time format. If you want, you can change them from Control Panel -> Regional and Language Options -> Customize: