Debugging sandboxed plugins

Debugging sandboxed plugins

by | May 6, 2011

Microsoft Dynamics CRM 2011 includes a feature to allow sandboxing of plugins. This means that the program execution is fenced off from the rest of the server to avoid any buggs or exploit attempts in the plugins to affect the rest of the server. This is most useful in the CRM Online and partner hosted deployments but can also be used in normal on-premise solutions to fence off some risky code.

When developing plugins, I strongly recommend a local CRM installation, even if the deployment of the plugin is going to be on CRM Online. It is not possible to step-debug programs on CRM online for natural reasons, and the shotgun-debugging approach that is available from the CRM Plugin SDK is quite rough and does increase development time.

Normally when step-debugging plugins, you would attach to the w3wp process for the CRM app-pool.

However, you do have to remember that plugins that are registered to be run in the sandbox, actually are executed under a different process hence you cannot attach to the w3wp process when debugging but instead have to attach to the Sandbox process.

If you would like, it is also possible to register the plugin outside the sandbox first while developing and the re-register it in the sandbox later. Some errors might, however, only show when working with sandboxed plugins so it is also good to be able to debug these.

Do note that it I have installed the sandbox to use Network Servce as the executing account, this is not recommended for production deployments, since that will nullify some of the security features of the sandbox. Instead a dedicated minimum security account should be used to block the process from accessing anything outside the sandbox.

Gustaf Westerlund
CEO, Chief Architect and co-Founder at CRM-konsulterna AB

www.crmkonsulterna.se

CRM 2011 Online and datawarehousing

by | Mar 11, 2011

I attended a half day presentation by Microsoft yesterday on the subject of Dynamics CRM 2011 and integrations. It seems that many parterners are a bit hesistant to integrating Dynamics CRM 2011 Online and are promoting the on-premise versions when the issues of integration are important.

Microsoft did a good job in showing that they do have sufficient technology to handle integrations to Dynamics CRM 2011 Online including the Azure based technology ACS – Access Control System that together with Active Directory Federation Services 2.0 can be used to allow Dynamics CRM 2011 Online to use a local AD as authenticator. It is probably not as easy as setting up a normal on-premise solution but at least it can be done and there hopefully are some whitepapers or Youtube-clips on how it is done.

One of the issues that were discussed was the issue of integrations in reagards to Business Intelligence and data warehousing. This is usually done using SQL Integration Service (SSIS) with direct SQL communication. Their suggestion on how to address this issue was to use the new OData interface that exists in Dynamics CRM 2011. I am no SQL expert but I do believe that this being a standardized protocol, integrations will be possible. However, there will still be issues with performance as the amounts of data that need to be transfered are quite large and the OData protocol is still a strict pull-protocol which does not allow for trigger-based updates.

Another issue that I asked about was the licensing issue in regards to Dynamics CRM 2011 Online. Take the following example: A large company of about 40 000 employees has about 500 people activly working in with Dynamics CRM 2011 Online for SalesForceAutomation. A data warehouse is created and data is integrated from many different systems, ERP, production systems, quality control systems and CRM. CRM being the customer data master. SharePoint is used as the global Intranet platform and some of the data from the data warehouse is published on the SharePoint portal to all employees. For instance our currently 10 most important customers. So, the 39 500 employees are only viewing a minute part of the customer data, and it indirecty, via the data warehouse, originates from the CRM system. What licenses in CRM are required for these users?

In the case of an on-premise installation, the best licensing option for Dynamics CRM is the Application Platform Agreement (APA) that is sort of a “free-for-all pass” which is negotiated with Microsoft. However, in the Online environment there is no correlating licensing agreement to the APA. I explicitly asked Micrsoft how this was to be licensed and their answer is that 40 000 separate users licenses are required for Dynamics CRM 2011 Online, making it a rather impossible option, in other words forcing the company to either an on-premise solution, removing some of the data from the data warehouse/Intranet or moving to another CRM supplier. Neither of which is in line with showing off the power of Microsofts cloud services.

I hope this is just a temporary flaw since it does limit Microsofts business opportunities with larger companies and I would think it is probable that some similar agreement form that matches the on-premise APA will be introduced.

On the other hand, the External Connector license is not required at all for CRM Online (or SPLA) making it even more interesting for smaller CRM customers as customer/event/portal integrations are more and more common.

Gustaf Westerlund
CEO, Chief Architect and co-Founder at CRM-konsulterna AB

www.crmkonsulterna.se

CRM 2011 Release Candidate and installation

by | Dec 16, 2010

As most of you dedicated CRM nerds most certainly already know, the Release Candidate for CRM 2011 has been released.

As we at CRM-Konsulterna want to act as we preach, we have of course installed it and are now trying it out.

We are a small company and do not yet have an AD except one for our development environments on our virtual server host that we rent. So, our computers are not part of the domain that the CRM resides in.

An interesting thing about the Outlook client installation was that when we tested the connection, it worked just fine, but when trying to press the OK button in the configuration wizard, it just complained with the following error message “The server address (URL) is not valid.”.

After some digging, I found that the reason was that the stored URL that the discovery service returns is actually the computer name, and since our working computers arn’t part of the CRM:s AD, it couldn’t find it.

The simple fix is to add an entry in the local hosts file located in “C:WindowsSystem32driversetchosts” (if you installed windows to C:Windows of course).

There is probably some entry in the database, where this is located as well, I had a quick look but didn’t find it. If you know where, please let me know. The registry serverurl in the MSCRM key does not seem to be right. At least it does not change the webservice http://www.blogger.com/s displayed in the customizations pages of CRM.

CRM 2011 looks and feels, really good, there are some minor buggs but it is a large step from CRM 4 which is a very good application as well.

Gustaf Westerlund
CEO, Chief Architect and co-Founder at CRM-konsulterna AB

www.crmkonsulterna.se

CRM 2011 and Internet Facing Deployment

by | Nov 1, 2010

I have now had the time to look quite a bit at CRM 2011 beta and it looks really good. The Dynamics CRM team at Microsoft have been really busy.

One of the features I really liked about CRM 4 was Internet Facing Deployment. It opens a lot of doors and my current company offers it quite a lot.

I had a look at this feature in CRM 2011 beta and it is both a really interesting feature and a disappointment. It is based on a completely new architecure, called Claims based authentication which allows any type of authenticator to authenticate users for Dynamics CRM. For example, LinkedIn, Facebook or Windows Live ID could be used to authenticate user in Dynamics CRM.

This is really interesting since it allows for many types of authentication providers, even custom made. However, since the technique is a bit more complex than the old IFD technology in CRM 4.0 it will also require some more configuring. As far as I have understood it is for instance dependant on Active Directory Federation Service 2.0.

I tried setting it up correctly in CRM 2011 beta in a demo environment, with a set up similar to CRM 4.0 with authentication using the AD, which I believe probably still will be mostly used (maybe Live Id will be used quite a lot as well) but after a couple of hours felt that my skills in Active Directory in Windows Server 2008 R2, Federation Service 2.0 and the more technical details of claims based authentication have some rather large white areas, I left it alone.

It is a very interesting technique and I hope that there will be good how-tos around for how to set this up correctly, most preferably a wizard or two, for AD and Live Id authentication.

Another interesting aspect of this is the legacy support of IFD customizations from CRM 4.0. Since this technique is quite different from how this is handled in CRM 4.0, I wonder how Microsoft are going to create full legacy support for old applications, since they are within the “supported” framework which according to Microsofts promises, should mean they are auto-upgradable.

If you have anything to add on this subject, feel free to add a comment. Especially if you know of a good instruction of how to set this up correctly! 

Gustaf Westerlund
CEO, Chief Architect and co-Founder at CRM-konsulterna AB

www.crmkonsulterna.se