CrmSvcUtil.exe throwing a 401 unauthorized error

1
votes

I have a crm 2011 instance running on a box that is joined to a domain. I'm trying to run crmsvcutil from outside the domain using the following.

CrmSvcUtil.exe /out:Xrm.cs /url:http://crm.mydomain.com/MSCRMDEV/XRMServices/2011/OrganizationData.svc/ /domain:MYDOMAIN  /u:mydomain\username /p:mypassword /namespace:Xrm /serviceContextName:XrmServiceContext

This generates the following error

CrmSvcUtil.exe Error: 0 : Exiting program with exit code 2 due to exception : System.InvalidOperationException: Metadata contains a reference that cannot be resolved: 'http://crm.mydomain.com/XRMServices/2011/OrganizationData.svc/?wsdl'. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at System.ServiceModel.Description.MetadataExchangeClient.MetadataLocationRetriever.DownloadMetadata(TimeoutHelper timeoutHelper) at System.ServiceModel.Description.MetadataExchangeClient.MetadataRetriever.Retrieve(TimeoutHelper timeoutHelper) --- End of inner exception stack trace --- at System.ServiceModel.Description.MetadataExchangeClient.MetadataRetriever.Retrieve(TimeoutHelper timeoutHelper) at System.ServiceModel.Description.MetadataExchangeClient.ResolveNext(ResolveCallState resolveCallState) at System.ServiceModel.Description.MetadataExchangeClient.GetMetadata(MetadataRetriever retriever) at Microsoft.Xrm.Sdk.Client.ServiceMetadataUtility.RetrieveServiceEndpointMetadata(Type contractType, Uri serviceUri, Boolean checkForSecondary) at Microsoft.Xrm.Sdk.Client.ServiceConfiguration1..ctor(Uri serviceUri, Boolean checkForSecondary) at Microsoft.Xrm.Sdk.Client.ServiceConfiguration1..ctor(Uri serviceUri) at Microsoft.Xrm.Sdk.Client.OrganizationServiceConfiguration.AdjustServiceEndpoint(Uri serviceUri) at Microsoft.Xrm.Sdk.Client.OrganizationServiceConfiguration..ctor(Uri serviceUri) at Microsoft.Xrm.Sdk.Client.ServiceConfigurationFactory.CreateConfiguration[TService](Uri serviceUri) at Microsoft.Crm.Services.Utility.SdkMetadataProviderService.CreateOrganizationServiceEndpoint() at Microsoft.Crm.Services.Utility.SdkMetadataProviderService.Microsoft.Crm.Services.Utility.IMetadataProviderService.LoadMetadata() at Microsoft.Crm.Services.Utility.CrmSvcUtil.Run() at Microsoft.Crm.Services.Utility.CrmSvcUtil.Main(String[] args)

The trace from Fiddler

HTTP/1.1 401 Unauthorized Cache-Control: private Content-Length: 0 Server: Microsoft-IIS/7.5 X-AspNet-Version: 4.0.30319 WWW-Authenticate: Negotiate WWW-Authenticate: NTLM X-Powered-By: ASP.NET Date: Mon, 06 Aug 2012 00:44:07 GMT Proxy-Support: Session-Based-Authentication No Proxy-Authenticate Header is present. WWW-Authenticate Header is present: Negotiate WWW-Authenticate Header is present: NTLM

The user/pass are that of a domain admin which is also a crm admin. What am I missing? The interesting thing to note is that the URL in the error message does not contain the ORG name

'http://crm.mydomain.com/XRMServices/2011/OrganizationData.svc' <--- missing the org name here

from IIS logs I see a 401.5 which is "An ISAPI extension or CGI application denied the request":

2012-08-12 16:50:03 192.168.230.201 GET /MYORGNAME/XRMServices/2011/OrganizationData.svc wsdl+OnBeginRequest:08/12/2012-16:50:03.527+LogEntries:0+SqlCalls:0+SqlCallsMs:0+GC:1+OnEndRequest:16:50:03.528 80 - 192.168.230.201 - 401 5 0 3 2012-08-12 16:50:03 192.168.230.201 GET /XRMServices/2011/OrganizationData.svc wsdl+OnBeginRequest:08/12/2012-16:50:03.538+LogEntries:0+SqlCalls:0+SqlCallsMs:0+GC:1+OnEndRequest:16:50:03.538 80 - 192.168.230.201 - 401 5 0 4

1
dynamics-crm-2011
This is happening when running locally on the CRM box itself so does not seem like a cross domain issue – Abhijeet Patel
if you navigate to the endpoint as the user what happens? – James Wood
navigation via browser woks fine. challenge/response when going cross domain anh integrated auth when in the domain – Abhijeet Patel
are you able to run svcutil from the machine in that case, just to rule out any cross domain wackyness. – James Wood
Correction. I'm getting a challenge response locally (on the crm box) as well, so kerberos issue perhaps? if I do an add service ref in VS(from the non domain box) I get a challenge response prompt ( twice) after which I can see the service and can download the wsdl to generate the proxy – Abhijeet Patel

1 Answers