Thursday, 26 April 2012

CRM Email Router errors with ADFS

I've been trying hard to get too involved with the detail of ADFS and Claims authentication, but I've not been able to avoid it completely (though as an aside, maybe I should try and adhere to the MCT renewal perspective that believes you cannot be an expert in more than one of Dynamics, Development, or IT Professional).

One issue I got involved is that the Crm Email Router can end up continually crashing if it can't connect to ADFS. This is a significant server stability problem, as the Dr Waston errors can cause the server to be compute bound, taking resources from other services. The symptom is a lot of errors in the event log like 'The authentication endpoint Username was not found on the configured Secure Token Service'. One consideration is whether you have the endpoint configured in ADFS (see http://www.powerobjects.com/blog/2011/06/22/error-with-crm-2011-adfs-and-email-router/ for an example), but another consideration is service dependencies.

In most environments, ADFS would run on a different server from the Crm Email Router, but in smaller or test environments they may run on the same machine. This causes a problem, as the ADFS service is set by default for a delayed start, whereas the Crm Email Router service is not. Therefore the Crm Email Router starts before ADFS, it fails to connect, and all the errors start occurring.

The solution I applied was to set a service dependency so that the Crm Email Router is dependent on the ADFS service. This can be done via a registry value:
  1. Use regedit to go to the HKLM\System\CurrentControlSet\Services\MSCRMEmail key
  2. Add a Multi-string (REG_MULTI_SZ) value 'DependOnService'
  3. Set the value to adfssrv (or add this value if there were already a dependency)

4 comments:

Tudorian said...

Hi,

A have the same problem but the ADFS server is not installed on the same machine as the email router. I followed the instructions from power objects but still the email router is crashing with the exception bellow.

Any ideas?

Thanks

The E-mail Router service could not process a provider work item using assembly: M
icrosoft.Crm.Tools.EmailProviders.dll and class: Microsoft.Crm.Tools.Email.Providers.Pop3PollingMailboxProvider.
System.NotSupportedException: The authentication endpoint Username was not found on the configured Secure Token Service!
at Microsoft.Crm.ServiceProxyCache`1.BuildServiceProxy(Uri serviceUrl, Credential credentials, Uri homeRealmUrl,
String passportEnvironment, String onlineServiceEnvironment, IServiceConfiguration`1 serviceConfiguration) at
Microsoft.Crm.ServiceProxyCache`1.GetNewServiceProxy(Uri serviceUrl, Credential credentials, Uri homeRealmUrl,
String passportEnvironment, String onlineServiceEnvironment) at
Microsoft.Crm.Tools.Email.Providers.Utility.GetOrganizationUrl(Uri discoveryServiceUrl, Credential credentials, String organizationName) at
Microsoft.Crm.Tools.Email.Providers.Utility.GetCrmService(Uri discoveryUri, String authMode, String userName, String password) at
Microsoft.Crm.Tools.Email.Providers.CrmPollingMailboxProvider.Run() at Microsoft.Crm.Tools.Email.Agent.ServiceCore.ExecuteProviderWork(Object providerQueueRequestObject)

Dhruva said...

Awesome......Got my issue resolved ...Thanks a ton for your help!!!!

Umar Saleem said...

Awesome solution... After lot of search... it worked for us.

sam fisher said...
This comment has been removed by a blog administrator.