Security update for ASP.NET and CRM

Today Microsoft released a security update for a vulnerability with ASP.NET.  If you are using CRM via CRM Online this has already been patched for you.  If you are running CRM on-premise you need to take action.

The security advisory can be found here.  The urgency around this is related to details being released at a security conference yesterday.

Turn on Communication and Collaboration as needed in CRM 2011

In prior versions of CRM you had to decide at the time you created an entity if you wanted things like Notes, Activities etc. enabled.  Now in CRM 2011 you can defer that decision and make it anytime in the future.  When you had to make a final decision at time of entity creation it used to be always a good idea to turn them on if you “Think” you might ever need them.  Now, I would say the opposite, don’t turn them on till you need them.

Keep in mind that the + after the item indicates that once you turn it on it can’t be turned off.

Sometimes the toughest part of learning a new version is forgetting old version habits!

CRM + Silverlight Book Released

Silverlight has always been a good fit for extending the Microsoft Dynamics CRM user experience.  CRM 2011 takes that a step further by providing first class support including the ability to host Silverlight content as web resources on the server.  Silverlight can be used for a little widget on a form to a full blown rich page of content.  In fact, we start out the book by talking about where it is a good fit and where it isn’t.

The Silverlight + CRM book takes the best parts of our Silverlight Jumpstart book and adds a ton of CRM specific content.  In fact I think its safe to say right now it’s the most CRM + Silverlight content found anywhere.  We cover everything from where Silverlight can be used with CRM to how to use OData and the WCF services to perform data and service actions.  You can read the full table of contents here.

If you’ve purchased one of our other books check your e-mail we sent you a really good discount.  If you haven’t bought one of our books or are just too lazy to look in your email here’s some codes to help you along as well.

Discount Code	Product	Price
DaveBlog	ebook	$19.99
DaveBlogPrint	print	$34.99
DaveBlogBoth	print + ebook	$54.98

You can find the book site at http://www.silverlightpluscrm.com

Finally, I know a number of you have been asking me about updates to our full CRM book CRM as a Rapid Application Development Platform. We have been crazy busy working on that as well. In fact, last night was another late night!  Part of what takes so long is not just updating content but making sure we cover new CRM 2011 features.  Got ideas for either of these books of stuff we should cover?  Send it over but only if you don’t mind if we write about it!

CRM 2011 Dialog Response Data Type Matters

I’ve seen a number of people using CRM 2011 Dialogs run into the issue of not setting your data type on a Prompt and Response.  Before I get too far, if you haven’t looked at Dialogs in CRM 2011 jump over here and watch this video first before you continue.  The scenario we are talking about here is imagine if you have a OptionSet on an entity and you want to collect a value from a user running a Dialog and set the OptionSet value on the entity from the response of the user.  For our discussion imagine if you created a FavoriteColor option set on Contact and you are updating it by running a dialog that person running the dialog can collect the contacts favorite color.  So I probably have a Page in my dialog that has a Prompt and Response that looks something like the following :

Next, I setup the response detail and choose a response type of Option Set.  First of all, don’t confuse choosing Option Set here with anything to do with the Contact entity that has a real OptionSet attribute on it for the contacts favorite color. There is not currently anyway that you can pull those values  and reuse them here to avoid duplication.  Trust me I’ve suggested that be changes so hopefully we will see it in the future where you can simply reuse the values!

Notice that the Data Type is set by default to Text.  This is where a lot of people fail to make the important change.  You must set this to integer if you want to have any luck ever assigning the value collected to an OptionSet field on an entity.  Another great reason to make sure you change it right away is the fact that you can’t change it after the prompt and response is saved unless you delete it and start over.  You have been warned!

In the mean time you need to setup your favorite colors using the Response Values section of the form as you can see below.

So for our example we’ve added Red, Green and Blue or RGB!  The Value field on the right is really important if you are trying to collect values that will be used to set OptionSet values on an entity if that is the case these values must match the values of the attribute OptionSet.  So for example  they may be like 100,0001 or some large number to keep them unique if that is the case you MUST use the same values here if you ever expect it to work.

Once you take care of those two things using Dialogs to collect OptionSet values is possible.  Hopefully in the future Dialogs will be enhanced so we can reuse the OptionSet values from the global definition.  

What other features would you like to see Dialogs have?

Fast Path to Views and Records

You’ve probably figured out one of the things they’ve done in CRM 2011 is reduce the amount of clicks to get to things.  Here’s one that you might not have seen yet.  If you look at your sitemap you will see the usual suspects Account, Contacts and whatever else you have hanging around there. It probably looks something like the following if you haven’t changed it a bunch:

After Mouse Over

See that little arrow to the right side of the Accounts item?  Click right there and you now see the following

So quickly you can Create a New Record, Go to a Specific System or Personal View and navigate to recently viewed records.  Those are all specific to the entity that you clicked on.  You can get global recently viewed and even pin them by looking here:

Notice the little push pin to the right of each item.  Using this you can pin them to the list.  This has the obvious use for the sales people to pin their 5 accounts they are assigned but it also can be used for any other record type so I think it has value for most people using CRM.

What’s your favorite feature in CRM 2011 that others might not have discovered?

OData/Silverlight–Issue with Relationships

A little while back I blogged about how when using the default behavior of OData from Silverlight all properties are sent with each server update by default.  I also included in that blog post a link to the CRM Team blog post with a work around you can find that here.

The workaround is designed to track properties that are changed on an entity and only ship those to the server during a create or update.  Turns out, the work around doesn’t appear to send N:1 relationships to the server depending on how you set or modify the value of the property.

Imagine you have an entity Book and the Book Entity had a N:1 relationship to Contact and a attribute crmbook_contactid was created on the entity.  If you set the value of this like the following:

bookInstance.crmbook_contactid = new EntityReference {id=idValue,Contact.LogicalName};

You will find this won’t send the value to the server. If you are curious, the id and logicalname properties are marked as changed in the tracking of what is dirty, but not the crmbook_contactid property.  What I have found to work is the following:

First, Create the entity Reference

var myRef = new EntityReference {id=idValue,Contact.LogicalName};

Then set the value

bookInstance.crmbook_contactid = myRef;

Setting it this way I found properly triggered the change notification for crmbook_contactid causing it to be marked as dirty and sent as part of the create or update.

Tales from the Sandbox–Constructor Exceptions

Sometimes when you play in the sandbox you can get sand kicked in the face.  That was the case with building this plug-in thought I would share the story with you in case it saves you a few minutes. 

You probably know by now that if you build a plugin that runs in the sandbox it is running in partial trust.  In fact you might have even had it kill your plug-in when you executed it due to a security violation.  Many times its really obvious what is going on, and then other times like this one it might be elusive what the problem is.

This story started with building a new plug-in and trying to run it.  All it would produce was a simple “Security Exception” message on invocation.  No trace, nothing.  This started in on-line so I took it on-premise, tried it there same thing.  Checked tracing log, nothing useful.

I then tried to see if I could reproduce the exception outside of CRM.  The quickest way I found to get a partial trust environment was a simple console application – go to security settings and turn on Click Once, and set it for partial trust.  By default this is pretty locked down so you might find it too restricting but for some scenarios I think it might be helpful.  In fact it did identify one small thing that was wrong, but in the end I still got the same Security Exception message.

After gutting the plugin to nothing much left and still getting the error it was obvious I was missing something obvious.  What I failed to reproduce and/or check was the constructor getting called that took the config/secure config and in this case that was causing an exception, that exception ultimately hit some non sandbox friendly code in the constructor and killed the execution.  The net result was the simple Security Exception message with no other details.  So if you get that simple message – check your constructor.

Don’t trip on your own feet when using OData

CRM 2011 exposes a REST endpoint using the OData prototcol for working with data from Web Resources.  When using the endpoint from Silverlight the most common way is to use the generated proxy classes that are produced when you add a reference to the endpoint or by running DataSvcUtil.  When working with these generated classes and the default behavior of the WCF Data Services client all fields are sent to the server when an update is done on an object instead of just the changed fields.  This has some undesired effects like auditing being updated more often then it should not to mention if you have workflows triggering on any of the fields they will detect the change as well even though your app may have only modified a single unrelated field.  A particularly nasty surprise can be found also when you later decide to turn on field level  security and the user doing the update doesn’t have access to the field all of a sudden you will get errors due to the update.

Not all is doom and gloom, you can fix this by a few tweaks to the generated data context to ensure that when changes are posted to the CRM server that only the modified fields are sent.  You can find details and the code to add on the CRM team blog here.