This post was originally published here
This week while configuring and optimizing a brand-new BizTalk Server 2016 environment we got the following error message while trying to configure register the WCF-SQL Adapter in the BizTalk Server Administration console:
Creation of Adapter WCF-SQL Configuration Store entries failed. Access denied. See the event log (on computer ‘SQL-SERVER’) for more details.
(sorry the picture quality, it was taken with my cell phone)
Despite I was a member of BizTalk Administration group, I didn’t have remote access to the SQL Server machine that was managed by another team so I couldn’t go there to check it out. Nevertheless, I reach that team (SQL and sysadmins) already with a possible solution that it turned out to be correct.
Cause
Many of the times these types of issues indicate or lead us to believe that there are problems associated with MSDTC. Or is not properly configured, Windows Firewall may be blocking DTC communications or in HA environment’s SSO is not clustered and may be offline.
All these possibilities should be investigated. However, if any of the points mentioned above were, for this particular case, a probable cause for this problem, it should have already manifested itself when the team pre-installed the environment and they did install the environment without encountering any problems.
The only difference between the installation and now my configuration was that these tasks were made by different users!
It is important to mention that, the user that is trying to registering an Adapter using the BizTalk Server Administration Console, need to have permissions to the SSO Database in order to register its properties so that he can store and retrieve the properties at design time and runtime.
And that is one of the reasons for why the “BizTalk Server Administrators” group should be a member of the “SSO Administrators” group.
BizTalk administrations are responsible for configuring all the components of BizTalk and many of them need to interact with SSO Database.
The people/team that was responsible to install BizTalk Server, they were members of BizTalk Server Administration, SSO Administration and some of them System Administrations and that was the reason why they didn’t get this problem or similar problems. The reason for the problem I faced was because:
- My user was a member of BizTalk Server Administrators and local admin only. But the BizTalk Server Administrators wasn’t member of SSO Administration group.
Solution
To solve this problem, you may have two options:
- Add my user to the SSO Administrators group.
- Not recommended because in my opinion is more difficult to manage user access rights if you add them to each individual group.
- Or add the “BizTalk Server Administrators” as a member of the “SSO Administrators” group.
After my user or the “BizTalk Server Administrators” group was added as a member of the “SSO Administrators” group, I was able to register the adapter.
Note: this problem can happen with any adapter you are trying to register.
