This post was originally published here

Many people are having doubts and reaching to me to provide some explanations on how to configure the SSO Application Configuration that I recently published and, consequently, they are facing some problems/issue on using the tool. So, I decided to write this post to properly document this tool and explain how you can easily start using it.

Where can I use this SSO Application Configuration tool?

The first thing that you need to be aware is that I release 3 different versions of this tool:

And the reason behind that is that each different version of BizTalk Server uses a particular version of Microsoft.EnterpriseSingleSignOn.Interop.dll – BizTalk Server 2016 will use 10.0.1000.0 version. So, each version of the tool will only work properly for that specific BizTalk Server version.

If you want to use the tool for example in BizTalk Server 2010, then you need to use Assembly Binding Redirection in the machine configuration file (Machine.config):

  • 32-bit: c:WindowsMicrosoft.NETFramework[version]configmachine.config
  • 64-bit: c:WindowsMicrosoft.NETFramework64[version]configmachine.config

Check for more information here.

What do I need to do to start using SSO Application Configuration tool?

When you download the SSO Application Configuration tool, by default it will not work in your environment because it has my personal configurations for my LAB machine.

To properly use this tool, you need to first configure your environment settings by:

  • Execute the SSO Application Configuration tool;
  • And then select the “Settings” option from the top menu option;
  • This will pop up the “SSO Application Configuration Setting” windows and there you need to configure:
    • AppAdminAcct: SSO Administrator Group – Administrators of the Enterprise Single Sign-On (SSO) service.
      • This is used to define the counts that have access to use this tool
    • ContactInfo: Internal field that is normally in the format of an email that is used internally in SSO tables for Application Configurations.
    • AppUserAcct: SSO Affiliate Administrators Group – Administrators of certain SSO affiliate applications.
      • This is used to describe the accounts that can access the configurations

SSO Application Configuration: Settings

The “AppAdminAcct” and “AppUserAcct” fields are easy to understand, they need to be the BizTalk Groups that you have created in your environment. Nevertheless, with this tool is not mandatory that the “AppUserAcct” has to be “SSO Affiliate Administrators Group”, you can for example change that for “BizTalk Application Users”.

However, the “ContactInfo” may raise some doubts. To demystify this value here are the rules for its definition:

  • If you don’t have any application configuration created in your environment: this field can be any value, that normally is defined in kind of “email format”, for example, “BizTalkAdmin@Sandro Pereira.com”.
  • If you already have application configuration created in your environment: created by other SSO Application or by MSFT SSO Application Configuration snap-in then you need to use the value that is already defined in your system.

I already have application configuration created in my environment, so, how can I properly configure the “ContactInfo” property?

The SSO Application Configuration tool is fully compatible with MSFT SSO Application Configuration snap-in. But to additional clarify this field, let me explain how MSFT snap-in works:

  • When you install the MSFT SSO Application configuration snap-in, during the installation process it will ask you for a company name, I set mine as “Sandro Pereira”.
  • Once you open the MSFT SSO Application configuration snap-in you will see that the tool will use it the company name that you defined in the installation process + “SSO Application Configuration” in the Application tree root

SSO Application Configuration: Rootname

  • Also, “behind doors” all the application that you create will use “BizTalkAdmin@” + company name + “.com” as the contact info, mine is “BizTalkAdmin@Sandro Pereira.com”.
    • You can validate this value in the BizTalk SSO Database in the table “SSOX_ApplicationInfo” using the following SQL query:
USE [SSODB]

GO

SELECT DISTINCT [ai_contact_info]
FROM [SSODB].[dbo].[SSOX_ApplicationInfo]
    • The result you get will be something like this:

SSO Application Configuration: SSODB ContactInfo values

      • someone@companyname.com and someone@microsoft.com are internally used by BizTalk (at least the last one) – please do not use that value or change these values.

So, to put my tool compatible with MSFT tool you need to go to “Settings” and property the contact info with that specific value, again in my case: “BizTalkAdmin@Sandro Pereira.com”.

Note: Additional you have and use different contact info values to be used in different context/teams and for them to have only access to a subset of all your Application Configurations. This is something that MSFT tool will not allow you to do.

Author: Sandro Pereira

Sandro Pereira lives in Portugal and works as a consultant at DevScope. In the past years, he has been working on implementing Integration scenarios both on-premises and cloud for various clients, each with different scenarios from a technical point of view, size, and criticality, using Microsoft Azure, Microsoft BizTalk Server and different technologies like AS2, EDI, RosettaNet, SAP, TIBCO etc. He is a regular blogger, international speaker, and technical reviewer of several BizTalk books all focused on Integration. He is also the author of the book “BizTalk Mapping Patterns & Best Practices”. He has been awarded MVP since 2011 for his contributions to the integration community. View all posts by Sandro Pereira