How can I set SB-Messaging adapter credentials securely?

Question

I am developing a solution which involves reading messages from an Azure service bus queue using the BizTalk SB-Messaging adapter. I am using the BizTalk Deployment Framework to deploy the application without user input.

Some adapters have an option to acquire credentials for external systems using the Single Sign-On database (option 'Use SSO'). The SB-Messaging adapter doesn't have this feature, and requires that either ACS (Access Control Service) or SAS (Shared Access Secret) credentials for the service (in this case a queue) are entered in the UI. BTDF can also set them by entering them in the binding file (there is an attribute on those particular properties vt="[number]" which causes them to be ignored unless overriden, presumably to discourage the developer from storing credentials in cleartext.

How can I set the service bus credentials without them being kept in cleartext? For this scenario I consider any data written to disk or kept in source control to be cleartext, which means creating a bindings file containing these credentials is not acceptable.

I would ideally like this to just work, in the same way as the adapters which do support SSO. Is this possible?

(As an aside, anyone who knows why Microsoft apparently didn't bother to implement this would be welcome to air their views)

Answer 1

I'm pretty sure the SB-Messaging uses SSO but keep in mind, there are two different patterns that Adapters use.

Some, such as the WCF wrappers, use the Credentials feature of SSO to store just the username/password combination. Others, such as the FTP's, store their entire config, including credentials, in SSO. SB-Messaging would follow this pattern.

If you have a 'don't store the password' rule, then you'll have to tread SB-Messaging like FTP. The Admin doing the deployment will have to enter the target specific credentials post-deploy. This is pretty common and really isn't a gap in any of the tools.

Another alternative is to create a custom MSBuild target for BTFD that modifies the binding file before Deploy. The custom task can read the credentials from SSO.

Answer 2

Yes the majority of the Adapters support SSO Affiliate applications or Use Single Sign-On for User Name credentials, however none of them support SSO Affiliate for ACS, SAS or for Proxy settings (see table below)

It seems the ones that don't support SSO Affiliate settings for the User Name credential are either the very old adapters, and strangely enough the newest ones.

Not having the SSO Affiliate settings for ACS, SAS or Proxy settings would look to be something they just didn't think about doing.

So to answer your question. No, it does not look to be possible to use SSO Affiliate with this adapter as you don't even have the option of adding a custom behavior as you can do with the WCF adapters, which is how we implemented a oAuth behavior to use SSO Affiliates to get the credentials & secrets for a WCF-WebHttp to Salesforce.

See also BizTalk Server 2013 R2: Adapters without Single Sign-On Capability and BizTalk Server 2013 R2: Adapters without Single Sign-On Capability on Technet

Use Single Sign-On or SSO Affiliate (BizTalk 2013R2)

+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| Adapter             | Receive |             |       |       |               | Send        |       |       |               |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
|                     | Use     | SSO         | ACS/  | Proxy | Endpoint      | SSO         | ACS/  | Proxy | Endpoint      |
|                     |   SSO   |   Affiliate |   SAS |       |   Behaviour   |   Affiliate |   SAS |       |   Behaviour   |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| File                | No      | No          | -     | -     | -             | No          | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| FTP                 | No      | Yes         | -     | No    | -             | Yes         | -     | No    | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| HTTP                | Yes     | -           | -     | -     | -             | Yes         | -     | No    | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| MQSeries            | No      | -           | -     | -     | -             | Yes         | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| MSMQ                | No      | No          | -     | -     | -             | No          | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| POP3                | No      | No          | -     | -     | -             | -           | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| SB-Messaging        | No      | -           | No    | -     | -             | -           | No    | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| SFTP                | No      | No          | -     | No    | -             | No          | -     | No    | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| SMTP                | -       | -           | -     | -     | -             | No          | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| SOAP                | Yes     | -           | -     | -     | -             | Yes         | -     | No    | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| SQL                 | No      | No          | -     | -     | -             | No          | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-BasicHttp       | Yes     | -           | -     | -     | in WCF-Custom | Yes         | No    | No    | in WCF-Custom |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-BasicHttpRelay  | No      | -           | No    | -     | No            | Yes         | No    | No    | No            |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-Custom          | Yes     | Yes         | -     | -     | Yes           | Yes         | No    | No    | Yes           |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-CustomIsolated  | Yes     | Yes         | -     | -     | -             | -           | -     | -     | -             |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-NetMsmq         | -       | -           | -     | -     | in WCF-Custom | Yes         | -     | -     | in WCF-Custom |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-NetNamedPipe    | Yes     | -           | -     | -     | in WCF-Custom | -           | -     | -     | in WCF-Custom |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-NetTcp          | Yes     | -           | -     | -     | in WCF-Custom | Yes         | -     | -     | in WCF-Custom |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-NetTcpRelay     | No      | -           | No    | -     | -             | Yes         | No    | -     | No            |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-OracleDB        | Yes     | Yes         | -     | -     | Yes           | Yes         | -     | No    | Yes           |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-OracleEBS       | Yes     | Yes         | -     | -     | Yes           | Yes         | -     | No    | Yes           |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-SQL             | Yes     | Yes         | -     | -     | Yes           | Yes         | -     | No    | Yes           |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-WebHttp         | Yes     | -           | -     | -     | Yes           | Yes         | No    | No    | Yes           |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| WCF-WSHttp          | Yes     | -           | -     | -     | in WCF-Custom | Yes         | No    | No    | in WCF-Custom |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+
| Windows             | No      | No          | -     | -     | -             | No          | -     | -     | -             |
|   Sharepoint Server |         |             |       |       |               |             |       |       |               |
+---------------------+---------+-------------+-------+-------+---------------+-------------+-------+-------+---------------+