Getting data from CRM (by proxy) from WCF service throws error

Question

The situation: I'm working on Dynamics CRM 2016 Online. I'm calling a plugin on statechange of an entity. In this plugin, I call an external WCF service (which is hosted in Azure). The code I use for this is:

private void AddToIndex(EntityReference canRef)
        {
            ChannelFactory<ServiceReference1.IIndexing> factory = GetFactory();
            var channel = factory.CreateChannel();
            channel.IndexOneCandidate(canRef.Id);
            factory.Close();
        }

        private ChannelFactory<ServiceReference1.IIndexing> GetFactory()
        {
            BasicHttpBinding myBinding = new BasicHttpBinding();
            myBinding.Name = "BasicHttpBinding_IndexingService";
            myBinding.Security.Mode = BasicHttpSecurityMode.None;
            myBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
            myBinding.Security.Transport.ProxyCredentialType = HttpProxyCredentialType.None;
            myBinding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.UserName;

            EndpointAddress endPointAddress = new EndpointAddress("http://<correcturl>/indexing.svc");
            ChannelFactory<ServiceReference1.IIndexing> factory = new ChannelFactory<ServiceReference1.IIndexing>(myBinding, endPointAddress);
            return factory;
        }

I have included the Reference.cs file that was created by the svutil.

In this service, I need to get data out of CRM to use it to commit data to yet another (external) service. I do this by creating a service proxy:

IOrganizationService service = new OrganizationService("<orgname>");

For this I use a connectionstring which is in my web.config of the service.

Now for the weird part: Everything works fine when I perform the setstate action in the live production environment. However, I have received tickets of my who got the following error:

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Body>
        <s:Fault>
            <faultcode>s:Client</faultcode>
            <faultstring xml:lang="en-US">Unexpected exception from plug-in (Execute): Plugin.Candidate.UpdateIndexOnStateChange: System.Security.SecurityException: Request for the permission of type 'System.Data.SqlClient.SqlClientPermission, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.</faultstring>
            <detail>
                <OrganizationServiceFault xmlns="http://schemas.microsoft.com/xrm/2011/Contracts" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                    <ErrorCode>-2147220956</ErrorCode>
                    <ErrorDetails xmlns:a="http://schemas.datacontract.org/2004/07/System.Collections.Generic"/>
                    <Message>Unexpected exception from plug-in (Execute): Plugin.Candidate.UpdateIndexOnStateChange: System.Security.SecurityException: Request for the permission of type 'System.Data.SqlClient.SqlClientPermission, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.</Message>
                    <Timestamp>2016-11-07T08:52:50.0726198Z</Timestamp>
                    <InnerFault i:nil="true"/>
                    <TraceText>
    [Plugin.Candidate: Plugin.Candidate.UpdateIndexOnStateChange]
    [2b70fb94-1d9c-e611-8107-5065f38a3b11: Plugin.Candidate.UpdateIndexOnStateChange: SetStateDynamicEntity of candidate]

                    </TraceText>
                </OrganizationServiceFault>
            </detail>
        </s:Fault>
    </s:Body>
</s:Envelope>

I'm puzzelled, because I use a user with exactly the same rights & roles in CRM to perform this action, however, my client using this same role gets this error. What's even more annoying: I'm not able to reproduce this error, since everything works fine at my end. Anyone know what could be going on?

Answer 1

Looks like your exception is in the Plugin.Candidate.UpdateIndexOnStateChange plugin, on the SetStateDynamicEntity of candidate. Whatever that plugin is doing, requires database rights that it doesn't have.

Request for the permission of type 'System.Data.SqlClient.SqlClientPermission, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

If the plugin is running under as the calling user, this would explain why it would work for some people, and not others.