ACS and CRM Online - Cannot Create Identity Provider - Federation Metadata Fails

Question

I'm trying to create an ACS WS-Federation identity provider that uses CRM Online as the identity provider. When I try to enter the federation metadata for CRM Online, it breaks. If I use the federation metadata url

https://[orgname].crm.dynamics.com/FederationMetadata/2007-06/FederationMetadata.xml

the error is shown on the page "Unable to download a WS-Federation metadata document from the specified URL." The URL works if I browse to it.

If I download the XML file from the browser and then try to upload the file into the identity provider creation page, the whole web page throws an exception (no details, because the web.config is not configured to show remote errors).

Anyone gotten past this?

Answer 1

CRM is an app, not an IdP. You are trying it on the opposite side. It should be configured as a "Relying Party". The Federation Metadata document can describe both ends: IdP and RP.

I haven't tried CRM on ACS though, so I'm not sure it will work. (it should, but...). I do remember that it requires token encryption.