(EBZ304) Administering, Deploying, and Securing BizTalk Server 2004 Michael Woods Sr. Technical Product Manager eBusiness Server Group Peter Oehlert Software Design Engineer in Test eBusiness Server Group

Agenda Architecture Deploying and Scaling BizTalk Server Deploying BizTalk Applications Partner Management and Security

Architecture Message Agent MessageBox Transport Handler End Point Manager Protocol Pipeline Host OrchestrationOrchestration Host OrchestrationOrchestration Transport Handler End Point Manager Protocol Pipeline Inbound Outbound TrackingDB Config DB DB

Deploying and Scaling BizTalk Server

Scaling Out Isolate and add Messages Boxes to optimize message throughput Dedicate Host Instances for adapters Separate Tracking from Application Hosts Add Application servers dynamically as needed

Host B AR1 AR2 AR3 Host Definition Host A AP1 AP2 AP3 Host D Front-End Adapter Host C LOB Adapter Scale Invariant Scale Variant Process Isolation

Adding Host Instances Host B AR1 AR2 AR3 Host Definition Server1 Host Instances AR1 AR2 AR3 Server2 AR1 AR2 AR3 Server3 AR1 AR2 AR3 Server4 AR1 AR2 AR3

Single Host with DB Server

Task Dedicated Servers

BizTalk Administrator MMC Snap-in for Administering BizTalk Scaling Creates new message boxes Defines Hosts and enlists applications Enrolls new Servers as Host Instances Operations Start / Stop Orchestrations Enable / Disable Receive Locations

Scaling and Administering BizTalk Server demo demo

Scaling Wrap-up BizTalk will scale with your business Task specific scaling optimizes your investment Isolation provides application security

Deploying Applications

BizTalk Artifacts Developer produces Orchestrations Pipelines Schemas Maps Rules Use abstractions for physical locations Built into assemblies for deployment

Deploying Applications Get the bits on the box Deploy assemblies Configure the environment Map the developer logical to the real world environment Configure Relationships Partners, Roles

BizTalk Explorer Defines the deployment topology Integrated with Visual Studio UI for defining physical environment Maps logical Orchestration ports to physical locations Maps applications to Hosts

Deployment Wizard GACs and registers assemblies Export config created by Explorer Modify to stage from test to production Import on production server Import capability to batch config XML based script Configure entire solution with one file Add and configure new partners

One-Click Deployment with BizTalk Installer BizTalk specific VS Setup project Custom Action DLL tailored to BizTalk Auto-packages BizTalk project output Point-n-click to add your projects Updates MSI package with every build Imports configuration scripts Extensible All standard setup capabilities Include your assemblies Write your own custom actions

Application Deployment demo demo

Application Deployment Wrapup Map your physical topology into your application using BizTalk Explorer Simplify staging from dev to test to production using BTSInstaller See SDK/Utilities

Security Role Based Security Hosts and Security Partner Security Scenarios PKI Infrastructure Authentication, Resolution, Authorization

Role based security All tools and runtime work against SQL Roles Message Boxes Configuration Database Tracking Database … Specify Windows Group for each DB during setup BizTalk Server Administrators (default) Isolate user by specifying a different group for each database Message Box (runtime and operations) Configuration Database (config only) Tracking Database (historical data)

Hosts and Security Run each host in its own security account Isolates each host from seeing outside data Ability to trust or not trust hosts to identify partners Process isolation to prevent untrusted code from impacting other applications

Partner Security Scenario B2B Partners Validate only partner gets message Validate your partner sent message EAI Partners Keep track of identity Use in Business Process Automation Who are your partners? What are they sending you?

Public Key Infrastructure Reqs S/MIME 3 used to send, S/MIME 2 & 3 used for receive Signature Keys: RSA and DSS Signature Hash: SHA-1 and MD5 Key Exchange: Diffie-Helman Encryption: DES, 3DES, and RC2 Uses global Address Book certificate store for public keys MY Certificate Store for private keys (one for each host principle) Signing Cert stored by BTS

Partner Authentication Adapter attempts to authenticate sender if supported Will send along Sender SID if possible If digitally signed, pipeline will attempt to resolve party with signature Can validate cert authority trust chain Thumbprint of signing cert included w/ message

Partner Resolution Pipeline uses SSID and signature to resolve partner Will pass as Party ID into Message Box Unidentified partners will be rejected if Authentication Required; or assigned guest Party ID Hosts must be Authentication Trust(ed) or the SSID is set to the HSID and PID is set to Guest Pipeline host must be Authentication Trusted

Partner Authorization Encrypting message with a public key insures only partner w/ the private key can access it. Receive Authorization ensures that each host process must have private key to subscribe to an encrypted message

Host 3 (SvcAcct3) Host 2 (SvcAcct2) Host 1 (SvcAcct1) Authentication Trust DecryptParseResolveParty MessageBox SerializeSignEncrypt TransportTransport Barrier prohibiting Message SID/PartyId from Un-trusted Hosts Authentication Required Rejects messages with no PartyId No Guest Messages

Security Wrapup & Reminders Grant minimal privileges to users Don’t grant operations rights to everyone! Identify your partners and encrypt your data Even internal apps need to strongly identify who they are talking to Isolate unknown code for both quality and security reasons

More BizTalk Server 2004 Sessions EBZ302 Orchestration EBZ303 Human Workflow Services EBZ304 Admin, Deploy, and Secure EBZ306 Advanced Orchestration EBZ327 InfoPath & BizTalk Server EBZ329 XML Tools EBZ330 EAI End-to-End Sample EBZ342 Rules Engine EBZ343 Business Activity Monitoring

Community Resources BizTalk Server 2002 Newsgroups BizTalk Server 2004 Beta Newsgroups User Groups: Sites of Interest

Ask The Experts Get Your Questions Answered We will be at the booth: directly after this session various other times during the week If you: miss Mike at the booth, want to set a time to meet, or just want to keep in touch… :^)

evaluations evaluations

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.