
Single Sign-On Support for the HTTP Adapter
You can configure Enterprise Single Sign-On (SSO) for use with the HTTP receive location or send port by using BizTalk Explorer. This topic describes how SSO works with the HTTP adapter.
Single Sign-On Support for the HTTP Receive Location
When an HTTP request is received by Microsoft Internet Information Services (IIS) from a Web client, IIS authenticates the user. The Internet Server Application Programming Interface (ISAPI) extension impersonates the Microsoft Windows user and then calls the SSO credential store to obtain an encrypted ticket. This ticket is stored as the SSOTicket property in the context of the message.
In the pass-through scenario, the BizTalk Messaging Engine directs the message to the MessageBox database. When the adapter receives the message from the MessageBox database, the HTTP adapter calls the ISSOTicket.RedeemTicket Method with the encrypted ticket along with the application name to retrieve the back-end credentials from the SSO store. The HTTP adapter then uses the external credentials to connect to the back-end system and process the request. For more information about the affiliate applications, see SSO Affiliate Applications.
In the scenario where an orchestration invokes the adapter, the BizTalk Messaging Engine sends this message to the MessageBox database. The orchestration should ensure that both the SSOTicket context property and the Microsoft.BizTalk.XLANGs.BTXEngine.OriginatorSID context property of the message that contains the ticket are maintained. When the adapter receives this message from the MessageBox database, the adapter calls RedeemTicket with the encrypted ticket to retrieve the back-end credentials from the SSO store. The user designing the schedule should specifically copy this property to the message.
Single Sign-On Support for the HTTP Send Adapters
If SSO is enabled, when an HTTP send port receives a message with the Secure property, it calls the SSO server to validate and redeem the ticket for an affiliate application. The administration application, affiliate administrators, or SSO administrators for the affiliate application can call SSO to redeem a ticket. SSO then decrypts the ticket and obtains the back-end credentials. The pass-through and orchestration scenario are the same as for the HTTP send port.
By default, SSO is disabled for the HTTP send port. For more information about enabling SSO for the HTTP send port, see Configuring an HTTP Send Port.
Note |
|---|
|
You can only use Single Sign-On with basic and digest authentication.
|
To correctly implement Single Sign On support for the HTTP receive and send adapter the following conditions must be met:
-
The same user account must be specified in the following places:
-
The application pool identity (IIS 6.0 and IIS 7.0) or hosting COM+ application identity (IIS 5.1) for the IIS virtual directory that is monitored by the HTTP receive adapter. For more information about configuring IIS for HTTP receive locations, see How to Configure IIS for an HTTP Receive Location.
-
The logon credentials used for the isolated host instance that the HTTP adapter is running in. For information about how to configure the logon credentials for a host instance, see How to Modify Host Instance Properties.
-
The isolated host that the HTTP adapter is using must be configured as Authentication Trusted. For information about how to configure a host as Authentication Trusted, see How to Modify Host Properties.