BizTalk resolving SSO error "Unable to redeem ticket, no ticket exists in the message" - single-sign-on

Question

I am using Oracle adapter from the BizTalk Adapter Pack (WCF based for BTS 2006 R2). In the configuration of the "solicit-response" send ports, I have used Oracle's username and password to connect to the database.
Now I would like to change that and use the SSO. So far I have created the Affiliate application and mapped the BTS Host Instance "user id" to the Oracle database user details.
When I run the application I am constantly getting the error: "Unable to redeem ticket, no ticket exists in the message".
reading through the BTS documentation I found the following at "ms-help://MS.BTS.2006/BTS06CoreDocs/html/c7bf755c-c37d-4b19-9817-a7f42e1e9656.htm":
In scenarios where an orchestration invokes the send adapter, the BizTalk Messaging Engine sends the message to the MessageBox database. The orchestration should ensure that both the SSOTicket context property and the Microsoft.BizTalk.XLANGs.BTXEngine.OriginatorSID context property of the message that contains the ticket are maintained. When the adapter receives this message from the MessageBox database, the adapter calls the RedeemTicket method with the encrypted ticket to retrieve the back-end credentials from the SSO store. The user designing the orchestration should specifically copy this property to the message.
But I receive a message through SQL integrated connection, that doesn't have the SSO Ticket.
Please help to resolve this issue?

Answer 1

You can add an SSO ticket in a custom pipeline component on the send port. The following code works for me:
public IBaseMessage Execute(IPipelineContext pContext, IBaseMessage pInMsg)
{
ISSOTicket ssoTicket = new ISSOTicket();
pInMsg.Context.Write("SSOTicket", "http://schemas.microsoft.com/BizTalk/2003/system-properties", ssoTicket.IssueTicket(0));
return pInMsg;
}
This will generate a ticket for the Biztalk host instance service account, so your Oracle affiliate application mapping should work as you expect.

Answer 2

You might need to "Allow tickets" to the System properties in SSO Administrator. Without that it will not work even if you allow tickets to the Affiliate Application.