Well after some initial struggles with locked channels (never resolved this, just built a new VPC!!) I have both the AIF tutorial and some PoCs working.
Just to clarify that in a previous post I mentioned the latest issue of BizTalk HotRod which has an article on the adapter. While most of the configuration is the same, it’s important to note that the article uses Dynamics AX 4.0, not 2009.
A particular challenge I recently had to overcome was regarding security on the send port. I had setup and tested the AIF tutorials using a Proxy User (providing an AX user account/password right in the send port). This worked great. However, once I wanted to enable another document service (namely LedgerPurchaseInvoiceService) and follow an identical approach (correctly assigning a Data Policy, verifying my endpoints) I continued to get errors in the event log indicating permission was denied. I was using the administrator account as both the BC service account and the gateway user. I looked at a few other reports of similar issues but couldn’t get it working.
Some colleagues had mentioned that security configuration with AIF can be a challenge, and particularly that using anything other than the Host User configuration can sometimes just not work. I remain convinced that it should work, I’m just not doing something right. However I didn’t have a lot of time to debug it and/or open a PSS ticket, so I proceeded to change the send port to use the identity of the Host User (ensuring the service account was a user in DAX with the right permissions) and it worked.
I am still concerned about the cause of issue with the Proxy User configuration, but the reality is that it likely makes more sense to use the host instance account for authentication regardless as it simplifies deployment (no password to maintain) and you can keep whatever degree of account isolation you need (one account for all Host Instances, or one per endpoint/service).
No comments:
Post a Comment