Resources For IT Professionals
Page Details
  • First published by (6MVP, Microsoft Partne)
  • When: 21 Jan 2012 3:17 AM
  • Last revision by (cMVP, Microsoft Community Contributo)
  • When: 3 Sep 2013 2:57 PM
  • Revisions: 27
  • Comments: 25
Options

Revision #16

Wiki  >  TechNet Articles  >  BizTalk Server 2010: Enterprise SSO Survival Guide  >  Revision #16
BizTalk Server 2010: Enterprise SSO Survival Guide
You are currently reviewing an older revision of this page.
Go to current version

Table of Contents


Introduction

Enterprise Single Sign-On (ESSO) is an important component of BizTalk Server. ESSO is responsible for securely storing critical information such as secure configuration properties  for the BizTalk adapters. On each computer where BizTalk runtime is installed the ESSO is present. Typically ENTSSO is installed to: C:\Program Files\Common Files\Enterprise Single Sign-On. This article will provide you with the necessary information on ESSO, how to manage and troubleshoot it.

Managing Enterprise Single Sign-On

You can manage the ESSO using two command line tools:
  • SSOManage
  • SSOConfig

These tools can be found in the directory C:\Program Files\Common Files\Enterprise Single Sign-On.

SSOManage

SSOManage Commandline commands:

Command
 Description
 -setDB  set SQL Server and SSO database names
 -showDB  show the SQL Server and SSO database names
 -createDB  create SSO database
 -upgradeDB  upgrade SSO database
 -generateSecret  generate new SSO master secret
 -backupSecret  backup current SSO master secret
 -restoreSecret
 restore SSO master secret
 -auditLevel  set SSO server audit level
 -setSSL  set SSL encryption
 -replayFiles  set directory for replay files
 -syncAge  set maximum password age (for password sync)
 -remoteLookup
 allow remote lookup of credentials
 -discover  discover SSO servers
 -status  display SSO server status
 -allowPS  allow password sync (from PCNS or MIIS)
 -reportFilterErrors  report password filter errors (at runtime)
 -scp  Service Connection Points (SCP)

Audit Level

There are two audit level settings – the “positive” audit level, which controls audits of things that succeed, and the “negative” audit level, which controls audits of things that fail. The possible values for the audit levels are:

  • 0 = off
  • 1 = low
  • 2 = medium
  • 3 = high

SSOConfig

SSOConfig Commandline commands:

Configuration functions

Command
Description
 -server  set SSO server name (for current user)
 -serverall set SSO server name (for all users)
 -showserver show the SSO server name(s)

Administration functions

 Command Description
 -updatedb  update SSO database
 -enablesso  enable SSO
 -disablesso  disable SSO
 -tickets  control SSO ticket behavior
 -enable  enable SSO features
 -disable  disable SSO features
 -displaydb  display current SSO database settings

Application functions

 Command Description
 -listapps  list existing applications
 -displayapp  display application information
 -createapps  create new applications
 -deleteapp  delete an existing application
 -updateapps  update existing applications
 -enableapp  enable application
 -disableapp  disable application
 -purgecache  purge the credential cache for an application

Mapping functions

Command
Description
 -listmappings  list mappings for a user
 -createmappings  create mappings for users
 -deletemappings  delete mappings for users
 -enablemapping  enable a single mapping for a user
 -disablemapping  disable a single mapping for a user
 -deletemapping  delete a single mapping for a user
 -setcredentials  set external credentials for a user

Troubleshooting

There is a document that can aid you in troubleshooting BizTalk Server 2010 Setup and MSDN page Troubleshooting Enterprise Single Sign-On. For troubleshooting it is best to turn both audit levels to high:  ssoconfig –auditlevel 3 3.

In case your problem is reproducible, set both the audit levels to high, clear the event log, wait for 1 minute or restart the ENTSSO service (to make sure the ENTSSO service picks up the new audit levels), and try the repro scenario. Take a look in the event log after the reproduction of the problem.

See Also

Revert to this revision