Question: What's the correct form to set up a maven webapp project? 

It should be able to:

* Run with the eclipse embedded tomcat (available in the servers tab).
This way I can run/debug the application like a regular webapp.
* Run with the maven plugin tomcat7. So far I can only run the run-war
goal, couldnt make the "run" goal work =/

I have followed some tutorials, but couldnt make all these things to work properly. 
When I follow the [MkYong](http://www.mkyong.com/maven/how-do-use-maven-to-create-a-dynamic-web-project-in-eclipse/) suggestion, I can run with the embedded tomcat, but the project dependencies are changed to classpath variables. This is not a good consequence at all, since the project loses the ability to dynamically set the dependencies.

I use Eclipse Juno (I'd rather wait Kepler for a couple of months to check it is really stable), m2e and m2e-wtp plugins, and have 2 kinds of projects: one is based in JSF (the front-end) and another in Apache CXF (the back-end). I hope these two can be hot deployed (when a resource changes, embedded tomcat automatically publishes it) in development environment to improve productivity.

Answer: 
The [Xrm Tool Box](http://xrmtoolbox.codeplex.com/) has an access checker that would help in this situation.

The way security works in CRM when querying data is that you do get an exception if the user attempts to perform a select on an entity that they have no read rights at all for. But, if the use has rights to view only records that they own, they'll get an empty result set if they attempt to query records they don't own. I'm guessing that's what's going on here, is that they're attempting to query data that the have read rights for, but not at the Organization level, or whatever the exact level that they need.
From DavidJennaway at <http://social.microsoft.com/Forums/en-US/55c22571-0187-4a64-9cc1-94954fa8bdf7/how-to-find-which-security-permission-is-preventing-a-user-from-doing-something>

Enable [tracing](http://support.microsoft.com/kb/907490?wa=wsignin1.0 "tracing") and the trace log will indicate the privilegeid and systemuserid - you can then lookup the privilegeid in the privilege entity.

Be aware that the trace log will record all instances where a user doesn't have permission - this includes the scenario where CRM checks if a user has any permission on an entity to decide if the entity should be shown in the UI