Title: Biztalk
SFTP Adaptor Configuration:
Author: Toraj
Khavari
Date: January
29, 2015 – Version 1.0.2529.01
Objective: The Microsoft Biztalk out of the box supports Secure File Transfer Protocol (SFTP). The SFTP adapter is a great technology to communicate information across corporate
firewall securely via internet. An introduction to Biztalk SFTP configuration
is my objective.
Article Body: In this article we explore how to configure
Biztalk SFTP for external partner inbound and outbound ports. Let us start with
some basic principles and standards.
-
When
you are designing Biztalk communication with external servers and services,
minimize A-dec’s (company) risk with a few fundamental best practices.
o
Empower
A-dec BizTalk adaptors to Get and Post information. Minimize, or better limit,
external companies putting information inside A-dec firewalls.
o
Use
Biztalk SFTP anywhere possible. The need for SSL and A-dec firewall compromise will
reduce by using SFTP.
o
Keep
A-dec Security coordinators and Support Services, in the loop for any external FTP.
o
If
the A-dec external partners select FTP protocol with Secure File Transfer Protocol Server, consider utilizing encryption and decryption technologies and protect
the information at source.
o
A-dec
has a rich set of encryption and decryption assemblies. If the posted
information is sensitive, in addition to using SFTP, use the encryption and
decryption technologies.
-
An
A-dec external partner inbound port is an A-dec post (e.g., EDI 850 Purchase
Order (PO) to a vendor).
-
An
A-dec external partner outbound port is an A-dec get (e.g., EDI 856, Advance
Shipping Notice (ASN) from a vendor, EDI 810 Invoice from a vendor).
-
A-dec
may select to communicate using SFTP. The partners have the freedom to
communicate using other protocols (e.g., FTP). The partners’ decision has no
effect on A-dec’s choice and vice versa.
In
my case, I have multiple vendors, W&H Dentalwerk® and East Side Plating®
(ESP). Each vendor partner has its own dedicated Inbound and Outbound port in
the Management File Transfer (MFT)
Server. The A-dec Biztalk SFTP adaptor securely communicates with the MFT
server without any Firewall compromise or custom SSL setup. In this article, we
will focus on W&H Dentalwerk, Also Known As (AKA), WH, WandH and W&H.
To have a comprehensive end to end testing, WHReceived and WHSend ports are
created in the A-dec Biztalk Server. The following diagram will describe the top-level
architecture, pictorially.
The
A-dec PO to W&H Partner can place in the WHRecived and Biztalk will map,
orchestrate, and post it in the WHInbound. The W&H ASN and Invoice can be
placed in WHOutbound. Thereafter, Biztalk will get the source file, map,
orchestrate, and place it in WHSend.
Hints:
-
I
have selected File adaptors for WHRecived and WHSend for simplicity. You can
select any Biztalk adaptors to meet you requirements, such as, WCF*, MSMQ,
POP3, SMTP, SQL etc. The adaptors can support Dynamics AX Application Interface
Framework (AIF), SharePoint Services, Databases, and the list goes on.
-
To
properly configure and test the SFTP adaptor, prepare as follows:
o
Have
access to a tested MFT server. Have appropriate user account and password.
o
Install
and setup your favorite file transfer and browser. In my case, I am using
FileZilla and Putty.
o
Have
a set of tested and ready Biztalk Schema and MAP for Inbound and Outbound
Orchestrations.
o
Have
a few inbound and outbound data source files.
o
MFT
Servers come in different operating systems, Windows, UNIX, and Linux. Biztalk
SFTP syntax and semantics will accommodate them. The MFT operating system will
have minimal impact on the SFTP configuration.
o
Do
not surprise your security czar, if you are going outside A-dec. Let them know
what you are doing.
Biztalk SFTP Configuration:
Let
us start with information orchestration between WHReceived and WHInbound. The
A-dec Posts W&H PO.
1- Start
the Microsoft Biztalk Admin tool.
2- Create a
Static One-Way Send Port > Select SFTP Adaptor Type > Press the
Configuration Button > Complete the SFTP Transport Properties > Select
Apply > OK > Select the appropriate Send handler and Send Pipeline >
Apply > OK.
The
standard SFTP is a very secure communication. However, if you insists to have
your own SSH Host Key, set the AcceptAnySSHServerHostKey to False, generate a
SSH Key Finger Print between MFT server and SFTP adaptor, and copy the key in
the SSHServerHostKeyFingerPrint.
It
is a good practice to use the MFT Server Domain Name System (DNS) instead of IP
Address. It will provide a layer of separation and fits in the Service Oriented
Architecture (SOA) model, nicely.
3- Setup
the Biztalk Filter for the Send Port. You can use any of the Filters’ Property
to meet your requirements. For now, I just point it to the receive port name.
Select Apply and OK.
4- Create
the One-Way WHInternalReceive Port. 1- Select Receive Ports > 2- New > 3-
One-way Receive Port > 4- General Tab Name is WHInternalReceive > 5-
Select Receive Locations > 6- New > 7- General Tab Name is WHInternalReceiveLocation
> 8- Select File Adaptor > 9- Select Configure button > 10- Configure
the File Transport Properties > 11- Select the desired Receive handler and
pipeline > 12- Apply and OK.
5- At this
point the receive port requires a map to orchestrate the information. Navigate
to the Inbound Maps for the Receive Port and select the Biztalk deployed Source
Document, MAP, and Target Document.
If
you do not see your maps, check the deployment script and your Biztalk solution
Maps in the Applications folder in the Biztalk Admin tool.
At
this point, we have all the needed connections to meet the WHReceived and WHInbound
orchestration. Start the WHSFTPRaceSpaceInbound and WHInternalReceiveLocation.
Hints:
-
The
WHSFTPRaceSpaceInbound URI must have “//” (two “/”) between the MFT server name
and the partner folder path.
-
The
WHInternalReceiveLocation URI must point to A-dec internal server.
-
The
WHSFTPRaceSpaceInbound and WHInternalReceiveLocation
status must be green.
Let
us start with the information orchestration between WHOutbound and WHSend. The
W&H Posts A-dec’s ASN and Invoice in the WHOutbound port. Thereafter,
Biztalk gets the information and orchestrates it to the WHSend port. There are
some similarities between the WHOutbound and WHSend orchestration and WHReceived
and WHInbound. Therefore, I omit the duplicated instructions.
1- Create a
new EDIWHSFTPRaceSpaceReceive Receive Port using Biztalk SFTP adaptor.
There
no maps required.
2- Create a
new Send Port, EDIWHSend, and configure it.
3- Utilize
the Send Port’s filter to identify the partner. The Partners information
configured in the Biztalk Admin tool’s Parties services.
At
this point, you can start the EDIWHSFTPRaceSpaceReceive and EDIWHSend ports.
The
entire Biztalk configuration is completed. Henceforth, utilize FileZilla post
information and watch for Biztalk orchestration result set.
Lessons Learned:
Although
I have imbedded a lot of my lessons learned in the above instructions, let me
share with you a few more.
-
If
you run into “Microsoft.BizTalk.Adapter.SftpInvoker.SftpException: Open SFTP
connection error.” before changing the AcceptAnySSHServerHostKey to False, and
entering SSH Server Host key, I recommend the following.
o
Use
your favorite FTP tool, FileZilla or Putty, try to copy file between source and
destination folders. During this process, any security violation will become
apparent.
o
The
issue usually is Read, Write, and Execute credential. After credential changes,
the Biztalk 2013 SFTP adaptor works fine.
-
Biztalk
Event log and Suspended query are great resources. Use them.
-
Biztalk
Suspended query does not capture all the security and SFTP errors. Use the
Biztalk Event log.
Have
fun with Biztalk. It has come a long way. A few years ago, we had to add code
to handle SFTP. Now the Biztalk 2013 version bundles enhanced SFTP adaptors in
the standard install.
Cheers,
Toraj
References:
Special
thanks to James Ward and his assistance during this assessment, his
continuing support, and dedication.
|
