search

WaelHamze / dyn365-ce-vsts-tasks

VSTS Extension for Dynamics 365 Customer Engagement
https://marketplace.visualstudio.com/items?itemName=WaelHamze.xrm-ci-framework-build-tasks
GNU General Public License v3.0
117 stars 56 forks source link

Authentication Question #85

Closed GuySimcox closed 4 years ago

GuySimcox commented 5 years ago

Hi I'm after some advice for using this application. My Client has Azure AD and Synced with on Prem AD. But my concern is that they have Multi-Factor (MFA) and Single Sign On (SSO) Authentication turned on for their users. Probably with password reset. I intend to store the secrets in Azure Key Vault however what is the best practice for using this app from a connection/user/service account perspective? Ideally it doesn't use MFA SSO or have password reset as I suspect these aren't possible anyway. Any advice would be much appreciated. Thanks Guy

GuySimcox commented 5 years ago

After researching Dynamics 365 CE application users. Might we be able to utilise one of this with this?

Thanks Guy

WaelHamze commented 5 years ago

@GuySimcox could you use a non interactive user for automation?

GuySimcox commented 5 years ago

@GuySimcox could you use a non interactive user for automation?

@WaelHamze thanks for your quick reply. I'm unsure how the none interactive user would be configured. Would this be another from Azure or On Prem AD or User within Dynamics only, if possible. I also assume they would have to have different access polices etc... Its not an area I've worked with before. With a previous client is was configured with on prem AD sync yet the service accounts we used where still xxx@xxx.onmicrosoft.com. Is this what you are suggesting?

Thanks again Guy

GuySimcox commented 5 years ago

Ok, I've managed to configure connect and obtain an OAuth connection string via the configuration of an Azure Registered App. I've given the Dynamics App User system admin role. So I guess if this App uses the Xrm Connecters in the same way as XrmToolBox I should be able to use this connection string with this app. I will give it ago and report back here. Unless that is you have already tried and no it's not going to work? :)

GuySimcox commented 5 years ago

@WaelHamze Hi Unfortunately I cannot get this to work with a connection string in this App or XrmToolBox. Only works via XrmToolBox connection wizard preview for OAuth Azure App. This is a shame as it eliminates the need for a none interactive user accounts. Maybe this should be a recommendation for future development. Thanks anyway a great tool for Azure DevOps however I'm going to have to look at how to provision a none interactive user instead.

Cheers Guy

WaelHamze commented 4 years ago

@GuySimcox sorry for late response.

You can use client secret: https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/xrm-tooling/use-connection-strings-xrm-tooling-connect

WaelHamze commented 4 years ago

Closing this due to inactivity, please re-open if needed.