Please add support for AD authentication type

[NorDroN]

[MattB-msft]

This is an area we are exploring but have not committed too as of yet. In general we are strongly encouraging the use of ADFS for On Premises systems.

[impr3ssi0n]

Also interested in the possibility of the AD authentication type. Please add this.

[ttkoma]

Please any news by this?

[stepanhakobyan]

Please. We want to (and partially do) upgrade our services to .NET Core and further. But without .NET Core client libraries to connect to On Premise Dynamics 365 it is a no go.
Microsoft wants us to upgrade everything to .NET (core), but the Dynamics team does not, or provides a very difficult path. It should be easy and painless.

[MattB-msft]

Insofar as formal support for AD, AD Federated, and Remote AD domain federation, there is an increasing potential we will be able to support it in the future based on .net 5 baseline. Still TBD as we are seeking a way to support this that would not require a patch to onPremise.

The direct issue there is the realm of things that come with AD support that were baked into the previous client. Most of which are dropped with the WS-TRUST deprecation for Online.

You can use oAuth onPremise assuming you have an ADFS deployment to work with, we do document setting that up in the onpremise deployment documents for CRM 2016+. and this is what we would recommend when working with OnPrem for now.

[FixRM]

@MattB-msft, all server-to-server auth schemas are officially NOT supported for on-premise. It's documentation issue, I have support ticket about that: 2107050040001964. OAuth silent authentication seems partly working, but with IntegratedSecurity option but that means running in context of ActiveDirectory authenticated user process.

[impr3ssi0n]

Any news on this? We have migrated to v9 and want to migrate everything to .Net core to take full advantage of it.

[ONYXDave]

@MattB-msft you mentioned that there is a document on how to setup ADFS oAuth for CRM 2016+. Could you provide a link. All I can find is how to setup ADFS but without oAuth. Why was WS-Trust dropped just because it was depreciated for Online?

[FixRM]

@ONYXDave there is no such document, only this video: https://www.youtube.com/watch?v=26OnuDSOZf4

[MattB-msft]

This is documented folks.
It starts with configuring IFD: https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/deploy/configure-internet-facing-deployment?view=op-9-1
then once configured.. you use this command ( Doc) to enable OAuth in CRM OnPrem : https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/deploy/post-installation-configuration-guidelines-dynamics-365?view=op-9-1#configure-the-oauth-provider

Also, S2S was not stated to work for OnPrem @FixRM ,
We realized that the doc's were misleading there and fixed that recently to clearly state that S2S only works online.

for onPrem you need to use named user accounts

[FixRM]

I guess folks are asking how to setup S2S (non-user interactive) auth process @MattB-msft. This video basically tells how to do it with OAuth password flow which is suitable for the task. It requires lot of additional steps on top of documented configuration.

[MattB-msft]

@FixRM
In on-prem .. Application Users ( S2S / Confidential Client ) are not support at all. you would use a named user ( using oAuth is fine ) for that configuration. I will look thought the video and pass it on to our Auth folks to have a look at updating our documentation with any missing steps. Thanks for pointing it out.

Our documentation was not clear on the subject of application users up till recently when the question came up and we clarified the documentation.

There is an undocumented path of using Azure AAD for OnPrem that can support an Application User / S2S path. Its undocumented as there are unsupported modifications required to support Dynamics's Outlook Web Integration which we hope to sort out in the future.

[FixRM]

@MattB-msft that's right, we use named users. The problem here is to somehow get OAuth token without user interaction

[abelykh0]

Can you reuse some code from https://github.com/Data8/DataverseClient, since it is MIT?