Accessing non-Azure Web API (hosted in IIS locally) from Dynamics 365 plugin

Question

Good morning everyone,

I am attempting to pull data from a locally-hosted (in IIS) Web API from a Dynamics 365 plugin. I set up the Web API to use "Individual User Accounts" and made it publicly available. That is working correctly in Postman when I test it as I can get the token fine, then use that token for queries.

My thought was that in the plugin I would request a token using an HttpWebRequest and then use that token for future queries.

My problem is that I cannot call that Web API from a Dynamics 365 plugin at all as I get a security error when I attempt to run the code in the Plugin Registration Tool. Here is what my research has yielded on the topic.

1.) I cannot access the Web API because I have not registered it in/as a "Microsoft Azure Web App." My question on this would be that since we were not planning on using Azure (and I am not sure it fits the safety specifications of this project) "do I have to register it with Azure?"

This quote below is from MSDN on the topic of web service calls in plugins. I'm not sure what I'm missing/violating in my setup.

Web access

Sandboxed plug-ins and custom workflow activities can access the network through the HTTP and HTTPS protocols. This capability provides support for accessing popular web resources like social sites, news feeds, web services, and more. The following web access restrictions apply to this sandbox capability.

Only the HTTP and HTTPS protocols are allowed.

Access to localhost (loopback) is not permitted.

IP addresses cannot be used. You must use a named web address that requires DNS name resolution.

Anonymous authentication is supported and recommended. There is no provision for prompting the logged on user for credentials or saving those credentials.

2.) I have found a lot of people saying that the Plugin Registration Tool will always throw a security error due to my plugin being sandboxed. Does everyone just use trace logs for debugging this?

3.) I have been researching the use of Dynamics 365 Web Hooks but I need this plugin to execute on the "RetrieveMultiple" Event. Is that something I can do with D365 Web Hooks?

Thank you all so much for your help. Have a great day.

Answer 1

Your webservice should have a public accessible https-URL, so dynamics 365 can access it from anywhere. You should secure your webservice by a login mechanismn.

As testing, security and configuration advice you should not add url, username and password in your plugin code, instead make it configurable in a crm record. So you can develop and test on a different webservice instance and your production instance connects to the right webservice without changing the code before deployment.