BizTalk Server Single Sign On – Get mapped credential by code

This is my second post about using single sign on in Biztalk Server.
In this post i will show how to access mapped credentials by code.

First create a new affiliate application and a credential mapping as i show in the last post.

1. Create a new class library project called “Test.SSO”
2. Add a reference to the assembly “Microsoft.BizTalk.Interop.SSOClient.dll”, located in “C:\Program Files\Common Files\Enterprise Single Sign-On”
3. Add the following code in a new class called SSOManager

   using System;
   using System.Collections;
   using System.Collections.Specialized;
   using Microsoft.BizTalk.SSOClient.Interop;
   namespace Test.SSO
   {
        public static class SSOManager
        {
             /// <summary>
             /// Get external application credentials.
             /// </summary>
             /// <param name="ticket">Credential ticket generated by biztalk receive port.</param>
             /// <param name="appName">Application name to get external credentials.</param>
             /// <param name="userAccount">User account to get external credentials.</param>
             /// <returns>ArrayList with mapped credentials.</returns>
             public static ArrayList GetExternalApplicationCredentials(string ticket, string appName, string userAccount)
             {
                  ISSOTicket ssoTicket = new ISSOTicket();
                  string externalUsername;
                  string[] credentials = ssoTicket.RedeemTicket(appName, userAccount, ticket, SSOFlag.SSO_WINDOWS_TO_EXTERNAL, out externalUsername);
   
                  if (credentials == null || credentials.Length == 0 || String.IsNullOrWhiteSpace(externalUsername))
                  {
                       return null;
                  }
   
                  ArrayList credentialsList = new ArrayList();
                  credentialsList.Add(externalUsername);
                  credentialsList.AddRange(credentials);
                  return credentialsList;
             }
        }
   }
   

4. Create a new Orchestration called SSOOrch
5. Include a reference to the previous created class library
6. Publish a new wcf service  using “WCF Service Publishing Wizard” and publish it at basic auth (http://msdn.microsoft.com/en-us/library/bb226564.aspx)
7. Set the Orchestration receive location to receive messages from the service created
8. Configure the receive location security área like the following image, but checking “Use Single-On” option.
   
9. Create na Orchestration variable called ssoMapping as ArrayList
10. Add a new expression shape in the orchestration
11. Add the following code in the previous expression Shape (TestApp is the name of the affiliate application previously created)
    ssoMapping = Test.SSO.SSOManager.GetExternalApplicationMapping(SSOOrch(BTS.SSOTicket), “TestApp”, SSOOrch(BTS.WindowsUser));
12. Complete the orchestration by setting a send shape to file system.
13. Deploy the orchestration and set the regular configurations, but very important – set an host instance with an account that belongs to a SSO application administration group
    
14. Invoke the previously created wcf service with an account that you have set in the SSO mapping.
15. If you debug the orchestration, you will get in the ssoMapping ArrayList 4 parameters with the data you have set in “User Id”, “MappedUser”, “”MappedPassword” and “MappedDomain” as you see in the next image.
    

Hope this example will help you to easily use SSO in BizTalk Server.
Happy coding.