'Security Negotiation Exception' during plug-in execution in CRM2013

A few months ago, we experienced an issue during a plugin execution in the dev. environment. We were using Scribe Insight for integration. We were using the “Microsoft Dynamics CRM publisher” for scribe that registered a plugin on the contact entity. Everything was working perfectly until we received the following error:

Unhandled Exception: System.ServiceModel.FaultException`1[[Microsoft.Xrm.Sdk.OrganizationServiceFault, Microsoft.Xrm.Sdk, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]: The following error has occurred in the Scribe Change History plug-in: System.ServiceModel.Security.SecurityNegotiationException: Microsoft Dynamics CRM has experienced an error. Reference number for administrators or support: #0CCC3255  

Cause

During troubleshooting we found the following entry in the event viewer of the backend server. 

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server serviceaccountname. The target name used was HTTP/CRMFrontEndServer. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (DomainName) is different from the client domain (DomainName), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server 

The “EventSourceName” was Kerberos.

Looking at the error we hypothesised that there was an SPN issue for the CRMFrontEndServer server.

You can receive this error for any plugin published in the sandbox. It will only happen if the sandbox service is not installed on the same server as CRM web site and kerberos authentication is enabled for the website.
 

Resolution

We used the following account to list all the SPNs registered for the serviceaccountname.
setspn –l domain\serviceaccountname

The command displays only the SPN registered on the HTTP/CRMfrontEndServer.CRM.domainname.com  (Fully Qualified domain name of the CRM front end server).

We added a new SPN on the servername using the following command setspn –a http/CRMFrontEndServer domain\serviceaccountname That was it. We restarted the sandbox service and the error was gone.

For more information on SPNs and their configuration you can check out this KB article from Microsoft. http://support.microsoft.com/kb/929650 

Client side notifications in CRM2013- Part 2

This is second part of my last blog Client side notifications in CRM2013- Part 1. This blog will explain how to display notifications on form level.

Important points regarding form level notifications

• You can display multiple notifications on form.
• The height of the notification area is limited so If you have too many notification then user may have to scroll down to see the rest of notifications.
• The new notification is added at the top of notification area.

The following 2 methods are available to display and clear the notification on form.

1. setFormNotification  - Xrm.Page.ui.setFormNotification(message, level, uniqueId);

There are 3 parameters for this method


• message- The text of the notification
• level- it decides the icon infront of the message. It can be an “ERROR” or a “WARNING” or a “INFO”
• unique- It can be any unique text string. it has to be unique as we use this uniqueId to clear the notification

2. clearFormNotification  - Xrm.Page.ui.clearFormNotification(uniqueId);

There is only one parameter for this method


• uniqueId – it is same that is used to set the form notification

For this blog I have created two functions. 

• formNotification1 – This function displays an error notification if the value of  “noofemplyees” attribute is less than 5.
• formNotification2– This function displays an warning notification if the value of  “address1_postalcode” attribute is not 2150.

Code

function formNotification1()
{   
     //check if the value is greater than 5
    if (Xrm.Page.getAttribute("numberofemployees").getValue() <= 5) {

         //set the notification with an error icon
         Xrm.Page.ui.setFormNotification("Employees number should be more than 5", "ERROR", "noofemployees");
    }
    else
   {
       //clear the notification
       Xrm.Page.ui.clearFormNotification("noofemployees");
  }
  }

function formNotification2()
{   
     //check if the postal code is not 2150
    if (Xrm.Page.getAttribute("address1_postalcode").getValue() != "2150") {

         //set the notification with a warning icon
         Xrm.Page.ui.setFormNotification("Account is not located in Parramatta", "WARNING", "postcode");
    }
    else
   {
       //clear the notification
       Xrm.Page.ui.clearFormNotification("postcode");
  }
  }

Result

setNotication VS setFormNotification

setNotification	setFormNotification
set notification on the control	set notification on the form
can create just one notification per control	can create multiple notification on the form
only supports error notifications	supports error, warning and info notifcations
can’t save the form without clearing the notification	can save the form with the notifications

If you are interested in creating a similar functionality in CRM2011, check one of my old blog How to display a warning message on the CRM form. It looks like Microsoft has copied our idea.

Client side notifications in CRM2013- Part 1

In CRM2011, there was no out of box functionality to show notifications on the entity forms. We have used alert function of JavaScript to pop up the message boxs. There was no way to show the error messages on the form except using web resources. Microsoft has introduced some new JavaScript methods to achieve this functionality in CRM2013.
In CRM2013,notifications can be displayed on form level and/or on field level. This blog will explain How to use notification next to specific control on the entity form.
We can use the following 2 methods to display and clear the notification next to field/control on the form

1. setNotification- Xrm.Page.getControl(controlname).setNotification(message) :

            This method will display a message near the control to indicate that data is not valid. When this method is used on Microsoft Dynamics CRM for tablets a red "X" icon appears next to the control. Tapping on the icon will display the message.
     2.  clearNotification- Xrm.Page.getControl(controlname).clearNotification() :
            Remove a message already displayed for a control. We have to remove the notification to save the form.
Here is the JavaScript code I wrote to display the notification if the “No of Employees” entered on account form is less than 5.

function fieldNotification() 
{
    //get the control
    cont = Xrm.Page.getControl("numberofemployees");

    //check if the value is greater than 5
    if (cont.getAttribute().getValue()<=5)
    {
        //set the notification
         cont.setNotification("The number of employees should be more than 5");
    }
    else
   {
       //clear the notification
       cont.clearNotification();
   }
    
}

The above screen shot displays the notification next to “No of employees” control.

Note

This method is only available for updated entities. Please check the CRM SDK for the list of updated entities.