BizTalk SSO Ticket error "Validation of the ticket failed. The sender name must match that of the ticket issuer."

1
votes

I have a BizTalk messaging-only interchange that uses the legacy HTTP adapter running in an isolated host on the receive end, which routes directly to a send port using the WCF-OracleDB adapter. The Send port is configured to retrieve credentials from SSO. The HTTP adapter is configured to use SSO and issues an SSO ticket in the context of the isolated host user.

When the send port activates, it logs the following message to the event log and stops:

Validation of the ticket failed. The sender name must match that of the ticket issuer.
 Application Name: (affiliate application name)
 Ticket Issued By: (in-process account name)
 Sender Name: (isolated host account name)

The affiliate configuration is correct according to all the documentation I can find:

  • Both accounts are in the domain group specified as the affiliate's Application Users property
  • Both accounts have mappings in the affiliate to the desired external credential. I've tried a user-based affiliate, which won't allow more than one mapping to the same external credential, with both accounts as the host credential one at a time, and a group-based affiliate, with both accounts with a mapping to the same external credential simultaneously.

I have found this documentation, that suggests that in order to use SSO tickets, the hosts must be trusted: https://msdn.microsoft.com/en-us/library/bb899011.aspx

I have done this, which makes no difference.

I have also unchecked the 'validate tickets' option in the SSO Administration console for this affiliate, which also makes no difference.

What do I have to do to make this work?

1
biztalk

1 Answers

0
votes

The issue is that the user that is stamped on the message is that of the receive port (the Isolated Host User), but you are issuing the SSO Ticket on your Send Port, which will then issue the ticket to the In Process Host users.

What you need to do is to issue the SSO Ticket in the Receive Location so that the Ticket matches the user. If both your Receive Location & Send Port are on the same host you can issue the SSO Ticket in your Send Port.

No you do not need to mark your Host as trusted. You only need to do this if you want to pass the credentials of the caller from the Receive Location through to the Send Port (in which case you can tick it in the receive location (if available) to issue a SSO to that user in the Port).