CRM Portal User must have the role System Administrator for regular portal users to login about xrm-portals-community-edition

[JasonCare]

That was it! Thank you so much I was banging my head against this one for a while.

[amervitz]

It could be that the service account's (what you refer to as the CRM portal user) custom security role doesn't have the privilege to read contacts that belong to other business units than the one the service account belongs to. To fix this you could try granting the custom security role the global access level privilege on the contact entity. The global access privilege is documented at Security roles and privileges.

[JasonCare]

Hi thanks for replying. I thought about that too. I tried a few things like leaving the service account at the root and having the service account own the portal user records. The copied role that the service account uses has full access to contacts too.

Taking an exact copy of the system admin role and changing nothing other than changing the name of the role stops contacts from being able to log in.

[amervitz]

I've remembered there is also a field security profile called Local Identity Credentials which restricts access to authentication related fields on the contact entity. The service account would definitely need to be added to the users list of this field security profile when creating a custom security role in order for portal authentication to work properly.

[JasonCare]

I'll give this a try!
Thanks!