How to send ADFS 2.x SAML token to Dynamics CRM On-Premises Organization Data service?

3
votes

I am integrating a PHP project with Microsoft Dynamics CRM and am successfully using OAuth with Azure AD and ADFS 3.0 to retrieve access tokens which I can then use in my REST calls to the Dynamics CRM Organization Data OData service (/XRMServices/2011/OrganizationData.svc) in the format:

Authorization: Bearer {access_token}

Now I am trying to add support for on-premises Dynamics instances that use ADFS 2.x where OAuth is not supported. I know that I can get a ws-trust token or SAML bearer token from the ADFS server using a RequestSecurityToken message. My question is after retrieving the token, how can I use that token in calls to the Dynamics CRM Organization Data OData service (OrganizationData.svc). I know that for the Dynamics CRM Organization SOAP web services (Organization.svc), I would simply include the token assertions in the header of my SOAP calls. But I want to use the token if possible for my OData REST calls.

Can the ADFS SAML token be included in the HTTP Authorization header somehow or is there a custom header required for this. I haven't had any luck finding an example of how to do this. Again, this is from PHP so I don't have access to any of the .NET based ADAL or CRM libraries which abstract much of this away and simplify it.

1
phpazureoauthdynamics-crmadfs
Turns out that you can simply take the Assertion returned in the RetrieveTokenResponse and pass that as the Bearer token in the HTTP Authorization header and both the SOAP Organization.svc and the REST oData OrganizationData.svc will accept them. – anderly

1 Answers

3
votes

Turns out that you can simply take the Assertion returned in the RetrieveTokenResponse and pass that as the Bearer token in the HTTP Authorization header and both the SOAP Organization.svc and the REST oData OrganizationData.svc will accept them.