D365 Connector Connection Issues - Connection Strings & Log Location

Question

I am having trouble testing the connection to my remote instance of D365.

I can access it via the browser at https://xxxxxxx.crm.dynamics.com

This is a 9.3 install with DEF and D365 Connector version 4.0.0.

I have tried various connection string formats, and each of them have received different error messages:

<!-- Results in error: Metadata contains a reference that cannot be resolved: 'https://xxxxxxx.crm4.dynamics.com/XRMServices/2011/Organization.svc?wsdl&sdkversion=9 -->
<add name="Sitecore.DataExchange.Staging" connectionString="AuthType=Office365;Url=https://xxxxxxx.crm4.dynamics.com;User id=xxxxxxx;Password=xxxxxxx" />
  
<!-- Results in error:  An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail -->
<add name="Sitecore.DataExchange.Staging" connectionString="AuthType=Office365;Url=https://xxxxxxx.crm.dynamics.com;Username=xxxxxxx;Password=xxxxxxx" />
  
<!-- Results in error: The authentication endpoint Kerberos was not found on the configured Secure Token Service -->
<add name="Sitecore.DataExchange.Staging" connectionString="AuthType=AD;Url=https://xxxxxxx.crm.dynamics.com" />
  
<!-- Results in error: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. -->
<add name="Sitecore.DataExchange.Staging" connectionString="Url=https://xxxxxxx.crm.dynamics.com;Username=xxxxxxx;Password=xxxxxxx" />
    
<!-- Results in error: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. -->
<add name="Sitecore.DataExchange.Staging" connectionString="AuthType=Office365;Url=https://xxxxxxx.crm.dynamics.com;[email protected];Password=xxxxxxx" />
  
<!-- Results in error: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. -->
<add name="Sitecore.DataExchange.Staging" connectionString="url=https://xxxxxxx.api.crm.dynamics.com/XRMServices/2011/Organization.svc; [email protected];password=xxxxxxx;organization=xxxxxxx;authentication type=2" />

<!-- Results in error: Metadata contains a reference that cannot be resolved: 'https://xxxxxxx.dynamics.com/XRMServices/2011/Organization.svc?wsdl&sdkversion=9 -->
<add name="Sitecore.DataExchange.Staging" connectionString="url=https://xxxxxxx.crm.dynamics.com/XRMServices/2011/Organization.svc?singleWsdl; userid=xxxxxxx;password=xxxxxxx;organization=xxxxxxx;authentication type=2" />
  

I can connect to the D365 instance just fine using XrmToolBox. In fact, that's where I got the first connection string that I tried:

AuthType=Office365;Url=https://xxxxxxxx.crm.dynamics.com;Username=xxxxxxxx;Password=xxxxxxxx

What other connection string formats might work (assuming these errors aren't a result of permission/configuration issues)? I already tried the proposed solution here, but in my case xxxx.crm4.xxxx is not a valid endpoint.

Where are these connection errors being logged to? So far I have looked in the following places:

• Event Viewer
• IIS logs
• Sitecore logs
• XConnect logs

After decompiling the DLL that performs this check, it doesn't appear to do any logging. It just returns the result:

troubleshooterResult = TroubleshooterResult.FailResult(string.Concat("Exception during connection. Read more in log file. ", exception.Message), exception);
    
return troubleshooterResult;

Answer 1

As @kamil mentioned, there was a notable Microsoft deprecation that recently came into full effect. The TLDR; is:

WS-Trust authentication type that is used by custom clients to connect to Dataverse is deprecated. We are making this change to remove a security protocol (WS-Trust) that is inherently insecure by current encryption standards.

Effective April 2022, the authentication protocol will be retired for all new and existing environments within a tenant. The retirement of new environments starts April 1, 2021 and rolls out gradually in all regions within a 6-week window.

More info can be found here.

Sitecore released fixes for this in Sitecore Connect for Microsoft Dynamics 365 for Sales 7.0.0 (release notes), and after speaking with Sitecore support, they provided a hotfix for version 4 (Hotfix 500295).

Regarding hotfixes, the usual warning applies:

The hotfix was built specifically for Sitecore Dynamics CRM connector 4.0 and you should not install it on other Sitecore versions or in combination with other hotfixes, unless explicitly instructed by Sitecore Support.

For this hotfix, I would recommend manual installation rather automatically installing the .zip.

After applying the hotfix, I was able to connect to the D365 instance with this connection string format:

AuthType=ClientSecret;ClientId=xxxxxxx;ClientSecret=xxxxxxx;Url=https://ORG_NAME.api.crm.dynamics.com/;

As far as I can tell, this is the best-practice method of connecting to an organization with 2FA/MFA enabled. See this Microsoft guide to learn more about best practices for authentication.

After applying the hotfix, I did run into other connection string issues when running pipeline batches. I saw this error in the job logs: CRM ConnectionString cannot be null or empty. The way I fixed the issue was by creating a new tenant AFTER applying the hotfix.

Regarding the log location of the connection troubleshooter errors, I can confirm that if you want to see the full stack trace, you must write your own Sitecore.DataExchange.Providers.DynamicsCrm.Endpoints.OrganizationEndpointTroubleshooter and specify it as the Troubleshooter type on the Dynamics Organization Endpoint item.