Problems Configuring BizTalk 2010

I had two problems configuring BizTalk 2010 in a distributed environment I thought I would share.  The first was a problem on assigning the SSO Administrators group.  Since I was using a distributed environment I had to replace the local group name with the domain group name.  When I did so I got the warning icon with the detail.

Failed to add the user 'Domain\btsadmin' to the domain group 'Domain\SSO Administrators'

Now this user was already in the group and I was logged on as a Domain Admin so the message could not be correct.

There are blogs that say you need to re-register SSOSQL.DLL that is located in C:\Program Files\Common Files\Enterprise Single Sign-On   (and also in the sub-directory  \Win32) but I had done that.  The answer was: delete the existing entry and manually type in the account name -DON'T click on the ellpises (...). Stupid error I know, but that fixes it.

The second problem arose when configuring BAM.  I had installed the pre-requisites including SQLServer2005_NS_x64.MSI as well as installing SQL Server 2008 R2 Integration Services locally which is a requirement.  But I got the following error when applying the configuration

Could not load file or assembly 'Microsoft.SqlServer.Instapi, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. The system cannot find the file specified.

Sure enough, this DLL was not in the GAC, although the 10.0 one was there.
Turns out you need to install the correct versions of the MSIs - I had somehow managed to download the wrong ones.  They correct ones are:

sqlncli_x64.msi                                            6430KB
SQLServer2005_NS_x64.msi                     3337KB
SQLServer2005_XMO_x64.msi               15066KB
sqlxml.msi 06                                             12683KB

They can be downloaded from here

Aftr that, the configuration went smoothly

There is a problem communicating with the Microsoft Dynamics CRM Server

I was trying to configure the CRM Client for Outlook by adding an organization and I ran into this error.

Now I had just deployed my customizations and I was able to access CRM using IE from the same client and could see all my customizations.  I didn't get any errors when importing or publishing the customizations. 

What I tried was to create a brand new organization with no customizations and I was able to add that organization to the Outlook client without problems.  So the issue was that there was something in the customizations that was causing an error only in the Outlook client.  After several days of effort we tracked it down to a site map customization. 

We had added a custom section under Workplace that had some links to a particular view of the Account entity.  BAD IDEA.  That won't work in the Outlook client. After removing the link I was able to connect to my organization without this error. 

Some things you find out the hard way.

Consume a WCF service that uses Federated Security

This post is not about Active Directory Federated Security, but it is about using a custom Security Token Service (STS) to create a token.   I needed to connect to a third party web service that used Federated Security. Now they supported ADFS but I only needed to access using a single account and I really didn't want to set up ADFS just for that.  But I could use a custom STS service to create the token and avoid all the infrastruture overhead of ADFS.

Setup begins with the third party sending me the url to their STS and a copy of the public key certificate they will use to sign their token. I also need to have the url to their web service I want to call.

I'll say right away I'm no expert on this. There are examples in the Windows Identity SDK and that is a good starting point. The way it would work is my client application (a  Windows Service) would call a local STS and pass it a username and password.  My STS would check the credentials and if OK issue a token. Now the token is signed and encrypted by my X509 certificate so I have to get one of those to begin with.  I need to install my X509 certificate in the Personal  store of  the computer I run the code on.
Start MMC, add the Certficate add-in and select the Local Computer. Navigate to the Personal node, and Certificates, right click and import my X509 certificate.  Since I am running my Windows Service under the Network Service account I need to assign permissions.  On the Certificate, right click, select All Tasks then Manage Private key. On the Security tab, add   Network Service and give it full permissions. I can also add the thrid party's certificate here too - it is imported into the Personal Certificate store in the same way but since they gave me the public key, I don't need to bother with the permissions step (its not available anyway).

I also need to send the public key of my certificate to the third party.  Right click on the certificate, select Export and choose the option to export the public key only. 

Now the token issued by my STS contains a claim, in my case it is simply the role of Reader.  I then pass my token to the third party's STS. These guys will want to check the token is from me and they use the certificate I sent them to do so.  They check the claim, and if all is well issue me a token from their STS. 

I suppose I should validate their token with the certificate they sent me, but I'm not going to bother as I'm going to send it straight back to them when I call their web service. 
When I look at the WSDL of their STS service I can see it is different from a typical WCF service because it has a section at the bottom which looks like this.

<identity xmlns="http://schemas.xmlsoap.org/ws/2006/02/addressingidentity">
<keyinfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<x509data>
<x509certificate>MIIE8zCCA9ugAwIBAgILAQAAAAABLl3i0lAwDQYwSQY2ZNWvOf2k</x509certificate> <x509data>
</keyinfo>
</identity>

The trick is to find a way to send my token to their WCF web service. Add a Service Reference to their WCF web service in the usual way. My example uses MyWS.Service with the url of http://company.co.uk/service.svc.  Note that when I setup the binding to this WCF service I have to include a reference to the issuer of the token (the url to their STS). I also needed to include a reference to the DNS identity.  You can usually assume the DNS Identity from the Subject name on the third party certificate so if that is CN=company.co.uk then the DNS Identity will be company.co.uk.

// add constants for their STS service and DNS identity
public const string ServiceAddress = "http://company.co.uk/service.svc";

public const string DNSIdentity = "company.co.uk";
public const string STSAddress = "http://security.company.co.uk/security.svc";


 public void RetrieveData(SecurityToken smToken)
{
   // Instantiate the ChannelFactory as usual.
   //Be sure to set the DNS Identity on the Endpoint

   EndpointAddress endpointAddress = new EndpointAddress(new Uri(ServiceAddress), new DnsEndpointIdentity(DNSIdentity), new AddressHeaderCollection());

   ChannelFactory clientFactory = new ChannelFactory(GetServiceBinding(ServiceAddress), endpointAddress);
   clientFactory.Credentials.SupportInteractive = false;

   // Make sure to call this prior to using the
   //CreateChannelWith...()
   // extension methods on the channel factory that the Windows
   //Identity Foundation provides.
   clientFactory.ConfigureChannelFactory();
   ICommunicationObject channel = null;

   bool succeeded = false;

   try
   { // create an instance of the Pension Service client

      MyWS.Service client = clientFactory.CreateChannelWithIssuedToken(smToken);
      channel = (ICommunicationObject)client;
      // Now its plain sailing
      // I can call the method on the WCF service
      // in may case GetData returns an array of objects
      MyWS.MyObject[] psArray = client.GetData();
      // TO DO something with psArray
      channel.Close();
      succeeded = true;
   }

   catch (CommunicationException e)
   {  // TO DO log error
      channel.Abort();
   }
   catch (TimeoutException)
   {  // TO DO log error
      channel.Abort();
   }
   finally
   {
       if (!succeeded && channel != null)
       {
          channel.Abort();
       }
    }
   return ;
}


public Binding GetServiceBinding(string uri)
{
   // Use the standard WS2007FederationHttpBinding
   WS2007FederationHttpBinding binding = new WS2007FederationHttpBinding();
   binding.Security.Message.IssuerAddress = new EndpointAddress(STSAddress);
   binding.Security.Message.IssuerBinding = GetSMSecurityTokenServiceBinding(STSAddress);
   binding.Security.Message.IssuerMetadataAddress = new EndpointAddress(STSAddress + "/mex");
   return binding;
} 

Good luck. In terms of difficulty on a scale of 1-10 this is a twelve. I wish you success.

Attach to Process is Greyed Out in Visual Studio

If you Google "Attach to Process is greyed out" as I have, all the responses will tell you to make sure you check the boxes "Show processs from all users" and "Show processs in all sessions".

What if you do that and it's still greyed out?

Answer: Use a different approach. Add the line
System.Diagnostics.Debugger.Launch();
to your code and it will launch the dialog box which allows you to connect to a new Visual Studio session or an existing one.

Once you do so, the debugger will stop at the line you just added and allow you to step through the code.

Tip: If you are using a timer in your windows service then disable the timer before you call the debugger. That way you stop the timer from kicking you back to the start every time it fires.

For example:
timer1.Dispose();
System.Diagnostics.Debugger.Launch();

Installing a Windows Service

There was a time when you could just create a new project in Visual Studio as a Windows Service and you could install it using the installutil command.

Somewhere along the way that changed so now you have to add a Project Installer class to the Windows Service.

So lets assume you've created your windows service and changed the name from Service1 to say MyService. Microsoft explain the steps for adding an installer and I repeat them here.

1. In Solution Explorer, access Design view for the service for which you want to add an installation component.

2. Click the background of the designer to select the service itself, rather than any of its contents.

3. With the designer in focus, right-click, and then click Add Installer.

4. A new class, ProjectInstaller, and two installation components, ServiceProcessInstaller and ServiceInstaller, are added to your project, and property values for the service are copied to the components.

5. Click the ServiceInstaller component and verify that the value of the ServiceName property is set to the same value as the ServiceName property on the service itself. In my example you would have to change Service1 to MyService.

6. Change the StartType to Manual, Automatic or Disabled.

7. Click on the ServiceProcesInstaller and set the User property to Local serice, Network Service, System or User.

That's it. Open the Visual Studio command prompt using "Run as Administrator", chage to the directory where your EXE file is and run

installutil MyWindowsService.exe

You might be interested in my next post about debugging a Windows Service. Frankly I find debugging Windows Services a pain, so I tend to write and test my code as a Console Application, and then I convert it to a Windows Service when its all working.

Moving CRM Attachments to SharePoint

CRM 2011 allows you to store documents in SharePoint and view them from within CRM.  Someone called Maria left me a comment asking if you could move attachments from CRM to SharePoint. My previous blogs about creating SharePoint document locations from CRM were actually prerequisites for doing exactly this.  I wanted to take a CRM attachment and move it to SharePoint. In my case it was an attachment on a letter activity as the result of a mailmerge. To be accurate it is an attachment on an annotation (or note) on a letter activity. I needed to move the attachment to SharePoint and then leave a link to the document on the letter activity.  To achieve this we created a plugin on the PreCreate action of an annotation. Then in the execute method of the plugin you can instantiate the annotation entity

if (null != context && null != context.InputParameters) {       if (context.InputParameters.Contains("Target") &&           context.InputParameters["Target"] is Entity)      {            // Obtain the target entity from the input parmameters.           Entity entity = (Entity)context.InputParameters["Target"];      } }

Once you have the annotation then you can get the contents of the attachment as a byte array.

// Retrieve the base64Encoding document body // and convert it to byte base64encoding // see below for the DecodeFrom64 function     byte[] documentBody = DecodeFrom64(entity.Attributes["documentbody"].ToString());     // get the filename    System.IO.FileInfo annotationFileInfo = new System.IO.FileInfo(fileName);

To remove the attachment you need to use this code

entity.Attributes["documentbody"] = null; entity.Attributes["filename"] = null; entity.Attributes["filesize"] = null;

The helper method for decoding the attachment to a byte array

internal static byte[] DecodeFrom64(string encodedData) {      byte[] encodedDataAsBytes = System.Convert.FromBase64String(encodedData);      return encodedDataAsBytes; }

To upload the document to SharePoint you should use the CopyIntoItems method of the Copy web service located at http://sharepointurl/_vti_bin/Copy.asmx. But before you do, you need to replace any illegal characters in the filename - in our case we replaced an illegal character with a hyphen.

internal static string ReplaceSpecialCharacters(string input) {    Regex r = new Regex("(?:[^a-z0-9 ]|(?<=['\"])s)", RegexOptions.IgnoreCase |                         RegexOptions.CultureInvariant | RegexOptions.Compiled);    return r.Replace(input, "-"); }

I may have posted this code too late to help Maria, but I hope someone else finds it useful.

Same blog, different theme

I've grown bored of the theme that I use for the blog and somebody posted a comment about changing the theme so I've done so.

I hope this makes the blogs easier to read.