0

Currently, I am trying to connect PHP website with MS Dynamics 2013. I found the following example (https://github.com/rocketeer007/php-dynamics-crm-2011) to connect to but it is not working.

I provided the configuration but is getting following error i.e.

string(576) "http://www.w3.org/2005/08/addressing/soap/faults:Sendera:InvalidSecurity 
An error occurred when verifying security for the message."

I couldn't find more information about the soap response.

Here is the more information that I am sending in my request i.e.

     **NOTE: For example purposes below I have changed the URLs**

    //Parameters values used in the below CURL
    $soapUrl = https://example.crmserver.com/adfs/services/trust/13/usernamemixed
    $headers = 'POST /adfs/services/trust/13/usernamemixed HTTP/1.1
     Host: adfs.crmserver.com
     Connection: Keep-Alive
     Content-type: application/soap+xml; charset=UTF-8
     Content-length: 1481'

     $content = '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
    <a:Action s:mustUnderstand="1">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</a:Action>
    <a:ReplyTo>
        <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
    </a:ReplyTo>
    <a:To s:mustUnderstand="1">https://adfs.crmserver.co.nz/adfs/services/trust/13/usernamemixed</a:To>
    <o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1">
        <u:Timestamp u:Id="_0">
            <u:Created>2015-07-16T04:09:52.00Z</u:Created>
            <u:Expires>2015-07-16T04:10:52.00Z</u:Expires>
        </u:Timestamp>
        <o:UsernameToken u:Id="user">
            <o:Username>desktop\abc_service.mrl</o:Username>
            <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</o:Password>
        </o:UsernameToken>
    </o:Security>
</s:Header>
<s:Body>
    <trust:RequestSecurityToken xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
        <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
            <a:EndpointReference>
                <a:Address>https://dev2013.crm.crmserver.co.nz/XRMServices/2011/Discovery.svc</a:Address>
            </a:EndpointReference>
        </wsp:AppliesTo>
        <trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
    </trust:RequestSecurityToken>
</s:Body>

    // Request
    $cURLHandle = curl_init();
    curl_setopt($cURLHandle, CURLOPT_URL, $soapUrl);
    curl_setopt($cURLHandle, CURLOPT_RETURNTRANSFER, TRUE);
    curl_setopt($cURLHandle, CURLOPT_TIMEOUT, self::$connectorTimeout);
    curl_setopt($cURLHandle, CURLOPT_SSL_VERIFYPEER, TRUE);
    curl_setopt($cURLHandle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_NONE);
    curl_setopt($cURLHandle, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($cURLHandle, CURLOPT_POST, 1);
    curl_setopt($cURLHandle, CURLOPT_POSTFIELDS, $content);
    curl_setopt($cURLHandle, CURLOPT_HEADER, false);
    curl_setopt($cURLHandle, CURLOPT_HTTPAUTH, CURLAUTH_ANY);

    $responseXML = curl_exec($cURLHandle);
    if(curl_exec($cURLHandle) === false)
    {
         echo 'Curl error: ' . curl_error($ch);
    }
    else
    {
         echo "no error <br />";
         var_dump($responseXML);
    }

I tried to see the error but get following i.e. no error

I am stuck and researched over the internet and couldn't find anything on it therefore, is posting over here...

More Information: When I tried this from command line i.e. curl -H "Authorization: Bearer" https://dev2013.crm.example.com/XRMServices/2011/Discovery.svc -v

Then, I got the following output i.e.

About to connect() to dev2013.crm.appserv.co.nz port 443 (#0)
*   Trying x.x.x.x... connected
* successfully set certificate verify locations:
*   CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
* Server certificate:
*  subject: C=AU; ST=Sydney; L=Sydney; O=Example Ltd; CN=*.crm.example.com
*        start date: 2015-06-24 00:00:00 GMT
*        expire date: 2017-08-22 23:59:59 GMT
*        subjectAltName: dev2013.crm.example.com matched
*        issuer: C=US; O=thawte, Inc.; CN=thawte SSL CA - G2
*        SSL certificate verify ok.
> GET /XRMServices/2011/Discovery.svc HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: dev2013.crm.example.com
> Accept: */*
> Authorization: Bearer
>
< HTTP/1.1 200 OK
< Connection: Keep-Alive
< Set-Cookie: ISAWPLB{11FDD9E3-24F0-455D-8590-436AF3F4D26D}={B0F3D377-6B32-45C6-A517-DA83209E8EA4}; HttpOnly; Path=/
< Content-Length: 3127
< Date: Thu, 16 Jul 2015 03:26:39 GMT
< Content-Type: text/html; charset=UTF-8
< Server: Microsoft-IIS/8.5
< Cache-Control: private
< X-AspNet-Version: 4.0.30319
< REQ_ID: 5b87d8d2-8b5e-4979-b090-7df14a3a1603
< Set-Cookie: ReqClientId=751fb9c2-ac10-478a-b933-2117420c660c; expires=Thu, 16-Jul-2065 03:26:39 GMT; path=/; secure; HttpOnly
< X-Powered-By: ASP.NET

It means that there is no issue with connecting to CRM using the above discovery server.

Looking for instant help on the error and the best recommendation to get authentication from the CRM using PHP SOAP webservices.

Thanks in advance.

Cheers,

1
  • Remove the <u:Timestamp>... block... May 31, 2016 at 16:22

2 Answers 2

0

Jason Lattimer has an updated example using IFD.

http://jlattimer.blogspot.com.au/2015/02/soap-only-authentication-using-php.html

At a glance there seems to be a few discrepancies. Firstly you don't have a message ID (Should be just under the action line)

<a:MessageID>urn:uuid:{A RANDOM GUID GOES HERE}</a:MessageID>

Secondly you have the following line

<o:UsernameToken u:Id="user">

Which I walso believe should be a GUID

<o:UsernameToken u:Id="{GUID GOES HERE}">

Finally you look like you're pointing to the Discovery Service where I think you should be pointing to the organisation service.

Organization.svc

I haven't done any PHP-IFD stuff myself so I'd suggest going to Jason's blog and comparing it with yours.

2
  • Hi Campey, Thanks for your response to my question. I have tried the Jason's Lattimer Blogs GetHeaderOnPremise($username, $password, $url) as well and is getting the same error from the request. In addition, I have provided the GUID and Organization.svc URL as mentioned in the function but in vain. Jul 16, 2015 at 23:51
  • Is your development server and CRM server in the same timezone?? If the times of the servers are different this will cause security issues.
    – Campey
    Jul 19, 2015 at 22:51
0

Campey, thanks for your time. Both DEV and LIVE Servers are in the same timezone the only difference that I have found the DEV server timezone is 10 minutes behind from the LIVE server.

I corrected the time on DEV server and then the authentication problem is solved.

Thanks everyone for investing time to read the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.