Dynamics Ax Connector For Mobile Applications Download

-->

Dynamics Ax 2012 R3 Download
Microsoft Dynamics Connectors
Dynamics Ax Connector For Mobile Applications Download For Computer
Dynamics Ax Connector For Mobile Applications Downloads

Jan 06, 2017 Issuu company logo. To install the Microsoft Dynamics AX Connector for Mobile Applications 1) Download and unzip the Microsoft Dynamics AX Connector for Mobile Applications Zip.

Applies To: Microsoft Dynamics AX 2012 R3, Microsoft Dynamics AX 2012 R2

Note

This topic does not apply to versions of Microsoft Dynamics AX 2012 prior to cumulative update 6 for AX 2012.

The Windows Azure Service Bus adapter and the Service Bus configuration forms are included with cumulative update 6 for Microsoft Dynamics AX 2012.

With cumulative update 6 for Microsoft Dynamics AX 2012, you can configure Application Integration Framework (AIF) to use the Windows Azure Service Bus for integration with external applications. In other words, you can develop client applications that communicate with Microsoft Dynamics AX 2012 by using the Internet. The Service Bus acts as a message relay to pass service messages sent over the Internet to Microsoft Dynamics AX service endpoints on a private network and return the message responses to the client application.

To publish a Microsoft Dynamics AX 2012 service that listens to messages from the Service Bus you must configure a Service Bus namespace and register that namespace with AIF. You must also enable authentication. The Service Bus requires each on-premises service to be authenticated and authorized to listen on a particular address before establishing a new relay connection. Clients must also be authenticated and authorized before the Service Bus relays messages on their behalf. The Service Bus relies on the Windows Azure Access Control Services (ACS) for authenticating clients. Therefore, you must also configure trust relationships between the ACS and your security system. You can configure trust relationships by using Active Directory Federation Services (AD FS).

This topic describes the following steps which summarize the actions you must take to configure an environment to deploy Microsoft Dynamics AX services to the Service Bus:

Configure AD FS or contact the administrator of an existing AD FS and request that your ACS namespace be added as a relying party application.
Obtain the thumbprint of the X.509 token signing certificate that is used as the digital signature by the Security Token Service (STS) running on the AD FS.
Configure ACS. You must configure the ACS with the parameters related to the relying party in addition to the identity provider and rule groups that include a claim rule for the identity provider. For more information, see How to: Use ACS Management Service to Configure AD FS 2.0 as an Enterprise Identity Provider.
Enable authentication. You must set up trust relationships between Service Bus and AD FS and between Microsoft Dynamics AX and the Service Bus.
Configure the Service Bus parameters in Microsoft Dynamics AX. You must register the Service Bus namespace with AIF and enter authentication parameters by using the Microsoft Dynamics AX client.
Create an enhanced integration port that uses the Service Bus adapter.

For a code sample that implements a mobile application that uses the Service Bus, see Developing Secure Mobile Apps for Microsoft Dynamics AX 2012.

Prerequisites

Verify that the following steps are completed before you begin to configure the environment to deploy the Service Bus to publish Microsoft Dynamics AX services over the Internet:

Install Microsoft Dynamics AX web services on Internet Information Services (IIS). You must use IIS 7.5 or later versions. For more information, see Install web services on IIS.
Install cumulative update 6 for Microsoft Dynamics AX 2012, or Microsoft Dynamics AX 2012 R3, or the AIF Microsoft Azure Service Bus hotfix.
Configure a Microsoft Azure account. For more information, see Microsoft Azure web site.
Create a new Service Bus namespace. For more information, see How To: Create or Modify a Service Bus Service Namespace. The Service Bus uses ACS to implement Federated Authentication. A buddy namespace is created for the ACS when you create the Service Bus namespace. For example, if you create a Service Bus namespace contosomobile, the buddy namespace is contosomobile-sb.
Place the file Microsoft.ServiceBus.dll (v1.8) in the Bin folder of the web site where you deployed the service. The Microsoft.ServiceBus.dll is included with the Microsoft Azure Software Development Kit (SDK). To download the SDK, see Microsoft Azure SDK Download Page.

Configure AD FS

To configure authentication that MSDAX requires for clients that use the Service Bus as a message relay, you need the following:

The federation metadata URL or the file that is available from your configured AD FS server.
The thumbprint of the X.509 token-signing certificate that is used by the Federation Service.

Use the information in the following articles to configure the AD FS.

Important

If you do not set up your own AD FS, you can contact the administrator of an existing AD FS and request that your ACS namespace be added as a relying party application.

Obtain the thumbprint of the X.509 token-signing certificate

For more information about token signing certificates, see Certificate Requirements for Federation Servers and Add a Token-Signing Certificate.

To obtain the thumbprint of the X.509 token-signing certificate

Click Start > Administrative Tools > AD FS 2.0 Management to open the AD FS 2.0 Management tool.
Expand the Service node and then click Certificates.
Right-click the token-signing certificate in the Certificates list and then click View Certificate…
On the Details tab of the Certificate form, copy the Thumbprint value and save it to a file. Remove the spaces between pairs of characters.
This is the value for the thumbprint that you will enter when you register your Service Bus namespace in AIF by using the Mobile Authentication Configuration form in Microsoft Dynamics AX 2012 R2.

Configure ACS

Use the following steps to configure the ACS with the parameters that relate to the relying party. This includes the identity provider and rule groups.

To Configure the ACS

Open your Windows Azure dashboard.
Click Service Bus and select the namespace that you want to configure, and then click Access key on the Action Pane.
In the form that opens, click the Open ACS Management Portal link.
On the Access Control Service page, click Identity providers.
Select WS-Federation identity provider (e.g. Microsoft AD FS 2.0) and then click Next.
In the Display name box, enter a name for your identity provider.
Enter the WS-Federation metadata for your server. You can use the file FederationMetadata.xml from your federation server, or you can enter the URL that points to the file if your Federation Service has an Internet-facing IP address.
The file FederationMetadata.xml is located at a URL that resembles the following:
- https://<FederationServiceComputerName>/FederationMetadata/2007-06/FederationMetadata.xml
Warning
Make sure to check the box Require URLs in metadata to use HTTPS (recommended).
Select the Service Bus box in the Used By section under Relying party applications.
Click the Service Bus link. Ensure that the value for the URL is valid for your application. In the Token format box, enter SWT.
Configure the Authentication Settings.
To configure Authentication Settings
1. Select the name of the identity provider that you created to use with the relying party.
2. Select the Default Rule Group for ServiceBus box to use the default rule group.
Configure the default rule group. You must configure the Send action to use the Windows account name for the input claim type.
To configure the default rule group
1. Click Rule Groups and then select the Default Rule Group for ServiceBus box.
2. View the predefined rules that have Access Control Service as the claim issuer value. Click each rule to view the values. These rules have owner as the Input claim value, and Listen, Manage, or Send as the Output claim value.
3. Delete the rules that have Output claim values of Manage and Send.
4. Select your identity provider name.
5. Under Input claim type, select the Select type option, and then select the following URI:
  Do not change the values in the Input claim value section.
6. In the Enter Type: box for Output claim type, enter net.windows.servicebus.action.
7. In the Enter value: box for Output claim value, enter Send.
8. Click Save.
If you are managing your AD FS server, update the relying party federation metadata.
To update the relying party federation metadata
1. Open the AD FS 2.0 Management tool and expand the AD FS 2.0Trust Relationships > node.
2. Select the Relying Party Trusts to display the list of Relying Party Trusts.
3. Right-click the relying party that you added and then click Update from Federation Metadata.

Enable Authentication

The Service Bus requires each on-premises service to be authenticated and authorized to “listen” on a particular address before establishing a new relay connection. Clients must also be authenticated and authorized before the Service Bus relays messages on their behalf. The Service Bus relies on ACS for authenticating clients.

Microsoft Dynamics AX services use a shared secret token provider to authenticate with the Service Bus. You provide the shared secret to AIF when you register your Service Bus namespace.

Dynamics Ax Connector For Mobile Applications Download

The following two types of client authentication are required:

Service Bus authentication - Clients are required to provide a send claim in order to be able to send messages to a service on the Service Bus. The ACS must trust the identity provider that is used by the client. You must set up and configure ACS with the parameters that relate to the relying party
Microsoft Dynamics AX authentication - When the Service Bus relays a message to the on-premises service, the caller identity is used to log on to Microsoft Dynamics AX. This caller identity is determined by calling a custom authentication component to parse the incoming message token and to provide a valid claims identity. The user specified by the claims identity must be a valid Microsoft Dynamics AX user.

Create a custom authentication component

A custom authentication component has two parts:

An X++ class that implements the AifAuthenticationManager interface and provides configuration information.
A .NET class that implements the System.ServiceModel.ServiceAuthenticationManager and the System.IdentityModel.Policy.IAuthorizationPolicy interface to provide runtime authentication.

Create the X++ class that implements the AifAuthenticationManagerInterface

The AifAuthenticationManagerInterface is used by the services framework to obtain information that is used to configure and deploy the custom authentication runtime component.

The following code shows the interface. The interface methods are described in comments.

Create the .NET authentication component

A .NET class that implements the following interfaces can perform custom authentication:

System.ServiceModel.ServiceAuthenticationManager
System.IdentityModel.Policy.IAuthorizationPolicy

The System.ServiceModel.ServiceAuthenticationManager interface contains the ReadOnlyCollection method that inspects the request message and headers, performs the custom authentication, and sets the authenticated principal on the message as a property.

The following code shows the signature of the ReadOnlyCollection method.

The System.IdentityModel.Policy.IAuthorizationPolicy interface contains the Evaluate method shown in the following example:

You implement the Evaluate method to set the authenticated principal and identity on the security context of the message.

Dynamics Ax 2012 R3 Download

The following example shows an implementation of the .NET authentication components.

Register the authentication component

Before an authentication component can be used, it must be registered with the Services framework. The registerAuthenticationManager and unregisterAuthenticationManager methods on the AifAuthenticationHelper class must be used to register and unregister the authentication component. You create an X++ job that calls these X++ methods to register and unregister the authentication components. When a component is registered, the .NET assembly is uploaded to the database so that it can be accessed by all AOS instances. You must grant read permission to the AOS service account to the file path that contains the component so that the file can be uploaded to the database.

For more information about the AOS service account, see the following topics:

The following code shows the signature for the registerAuthenticationManager method:

The method unregisterAuthenticationManager takes one parameter authenticationManagerClass that is the class ID of the X++ authentication manager class.

Create and configure encryption key containers

Encryption is used to protect confidential data in the web.config file. This requires al RSA encryption key container to be created and configured on all the computers involved in the message relay. For more information, see Walkthrough: Creating and Exporting an RSA Key Container.

You use the Internet Information Services (IIS) configuration utility aspnet_regiis.exe to manage the key containers. For more information, see ASP.NET IIS Registration Tool (aspnet_regiis.exe).

To create and configure encryption key containers

In a folder on the computer that is running IIS 7.5, use the following command to create an RSA key container called MyKey for export.
aspnet_regiis -pc 'MyKey' -exp
Type the following text at a command prompt to export the key container to an XML file that is named MyKey.xml.
aspnet_regiis -px 'MyKey' 'MyKey.xml' -pri
Import the key container into each computer that is participating in your cloud application scenario. This includes the computers that are running IIS and the computer where the AOS is running.
Use the following command on each computer to import the key container XML file that you exported.
Important
Be sure to delete the XML file from each computer after you have imported it. This is important to prevent unauthorized access to the key container.
aspnet_regiis -pi 'MyKey' 'MyKey.XML'
On each computer, grant the appropriate user access to the key container. The user you grant access to depends on the role of the computer.
- On the computer that is running IIS, you grant access to the AppPool identity (which is the same as the BC proxy user). For example, enter the following command to grant access to the AppPool domain user: aspnet_regiis –pa “MyKey” 'domainuser'.
- On the AOS computer, you grant access to the AOS account. This is either a domain account or the Network Service account. For example, enter the following command on the AOS computer to grant access to the Network Service account: aspnet_regiis –pa “MyKey” 'NT AUTHORITYNETWORK SERVICE'.

Register the Service Bus namespace with AIF and configure authentication parameters

To set up AIF to work with the Service Bus

Open the Microsoft Dynamics AX 2012 R2 client and then click System administration > Setup > Services and Application Integration Framework > Windows Azure Service Bus Configuration.
In the Windows Azure service namespace box, enter the namespace that you created.
In the Windows Azure service key issuer name box, enter the default issuer name. In the Windows Azure service key issuer secret box, enter the secret key. For more information, see the section “To obtain the security credentials for a service namespace” in the topic How To: Create or Modify a Service Bus Service Namespace.
In the Deployment web site box, enter the name of the IIS web site where the service is to be deployed.
In the Class name box, enter the name of the X++ authentication class that you created to provide configuration information. For more information about how to create authentication classes, see Create the X++ Authentication Class.
In the RSA Key Container Name box, enter the name for the RSA key container.
Click Configure to open the Mobile Authentication Configuration form and enter the trusted issuer name and the trusted issuer thumbprint for the X.509 certificate, and then click Close.

To publish the service by using the Service Bus adapter

Microsoft Dynamics Connectors

To publish your service and make it available on the Service Bus, create an enhanced integration port that uses the Service Bus adapter.