CRM

  • Allow website to use Kerberos

  • Create an SPN for CRM

  • setspn -a http/crm-2011.test.local Domain/User

AD

  • Open TMG Computer Account in AD and allow delegation to the SNP you created earlier.

TMG

  • Install DoD Root Certificates (http://iase.disa.mil/pki-pke/function\_pages/tools.html)

  • Install Tumbleweed on TMG Server ***** this is extremely important on gov sites that use this software.  *****

  • Import Tumbleweed client configuration file

  • Disable HTTPS Inspection and NIS in TMG

  • Publish DoD E-mail certs to the NT Auth Store

  • certutil -dspublish -f NTAuthCA

  • Make sure GPO for TMG machine is updated with the following.

  • Policies -> Windows Settings -> Security Settings -> Public Key Policies -> Certificate Services Client - Auto-Enrollment

  • Configuration Model should be enabled and Renew expired certificates and Update certificates should both be checked.

  • Create Listener

  • Create Rule

  • Under Authentication Delegation choose Negotiate (Kerberos/NTLM).  In the SPN box enter the one you created earlier (http/crm-2011.test.local).

  • Under Traffic -> Filtering -> Configure HTTP turn off “Verify normalization” otherwise you will get 500 errors (http://googleguilt.blogspot.com/2011/04/crm-2011-tmg-2010-error-500-12217.html)

USERS

  • Add the EDIPI number from the back of the CAC to the User Principal Name on the AD account (ie 123456789@mil)
  • When creating the CRM users you should still use their original AD user name (ie DOMAIN\rick.wilson) not the EDIPI.