The user account that is configured as the logon account for
the BizTalk Server Host service must be a member of the EDI Subsystem Users
group. If the user account that is configured as the logon account for the
BizTalk Server Host service is not a member of the EDI Subsystem Users group,
the EDI transmitter cannot connect to the EDI subsystem. The EDI transmitter
cannot connect because of insufficient permissions. Therefore, the Error event
in the event log states that there is a transmission failure.
If the
EDI Subsystem Users group is a local domain group or a global domain group,
verify that the user who configured the EDI adapter is a member of the EDI
Subsystem Users group. Additionally, verify that the user account that is
configured as the logon account for the BizTalk Server Host service is also a
member of the EDI Subsystem Users group.
If the user account that is
configured as the logon account for the BizTalk Base EDI service is a local
account, you must use a local account to log on to the computer that is running
BizTalk Server. If the user account that is configured as the logon account for
the BizTalk Base EDI service is a domain account, you can use a local account
or a domain account to log on to the computer that is running BizTalk Server.
However, the local account or the domain account must be a member of the EDI
Subsystems Users group.
The EDI subsystem performs authentication
checks during incoming connection attempts. For example, the group membership
is not checked when the EDI subsystem transmits a message to the EDI adapter.
Therefore, message processing works as expected when the BizTalk Base EDI
service and the BizTalk Server Host service use the same logon credentials.
However, the EDI subsystem uses the
sock_AuthenticateToClient method to check the group membership if the BizTalk Base EDI
adapter transmits a message to the EDI subsystem.
The EDI subsystem
does the following tasks when the EDI subsystem checks for the correct
permissions:
- The EDI subsystem checks the local groups for the BizTalk
Base EDI service logon account. The EDI subsystem also checks the local groups
on the local computer for the correct group membership.
Note If the service logon account is not in a local group, the EDI
subsystem checks the domain group membership. - The EDI subsystem lists the following items:
- The user name and the domain name of the user who is
logged on
- The other domain names
- The name of the logon server
- The EDI subsystem checks that the service logon accounts
are members of the following groups:
- The BizTalk Application Users group
- The BizTalk Isolated Host Users group
- The EDI Subsystem Users group
- The EDI subsystem checks the logon credentials for the
BizTalk Base EDI service and for the BizTalk Server Host service.
To obtain the information that you need to troubleshoot this
issue, you can enable the EDI Kernel Trace and the EDI Sub-process Trace. To
enable tracing and to troubleshoot this issue, follow these steps:
- Stop the BizTalk Base EDI service.
- Click Start, click Run,
type Edibtsmmc.msc, and then click
OK.
- Expand Microsoft BizTalk Server 2004 Base EDI
adapter, and then click Parameters.
- In the right pane, right-click the server that you want,
click Properties, and then click
No.
- On the Trace tab, click to select the
following check boxes:
- Trace kernel processes
- Translate
- Database
- Network
Note You must click to select the Trace kernel
processes check box. - On the Trace tab, note the path and the
file name in the Trace file box, and then click
OK.
- Start the BizTalk Base EDI service, and then reproduce the
issue.
- Review the Tetrace.log file. By default, the Tetrace.log
file is in the \Documents and Settings\All Users\Application
Data\Microsoft\BizTalk Server 2004\EDI\Subsystem\Logs folder.
Note The information in the Tetrace.log file is stored in the Esp.ini
file. The BizTalk Server Base EDI Administration console extracts the
information from the Esp.ini file. Then, the BizTalk Server Base EDI
Administration console stores the information in the Tetrace.log
file.
The following trace of an EDI document transmission indicates
that the transmission was successful:
X 3: Tue Aug 30 11:43:37.492 sock_AuthenticateToClient: : Start
X 3: Tue Aug 30 11:43:37.492 sock_AuthenticateToClient: Starting session #1
X 3: Tue Aug 30 11:43:37.648 sock_AuthenticateToClient: Received token from client: 58 bytes
X 3: Tue Aug 30 11:43:37.648 sock_AuthenticateToClient: Starting session #2
X 3: Tue Aug 30 11:43:37.648 sock_AuthenticateToClient: Received token from client: 72 bytes
X 3: Tue Aug 30 11:43:37.648 _IsUserMemberOfEdiSubsystemGroup: Check Local Groups of user [<domain>\<username>]
X 3: Tue Aug 30 11:43:37.773 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\<username>]] is a member of local group [BizTalk Application Users].
X 3: Tue Aug 30 11:43:37.773 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\<username>]] is a member of local group [BizTalk Isolated Host Users].
X 3: Tue Aug 30 11:43:37.773 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\<username>]] is a member of local group [EDI Subsystem Users]. This is the Edi Subsystem Group, so the user is authorized to connect!
X 3: Tue Aug 30 11:43:37.773 sock_AuthenticateToClient: Authentication was successful! Clientname=<domain>\<username>]
X 3: Tue Aug 30 11:43:37.773 sock_AuthenticateToClient: Successful
The following trace of an EDI document transmission indicates that
the transmission was unsuccessful:
X 3: Fri Aug 19 09:51:54.847 sock_AuthenticateToClient: : Start
X 3: Fri Aug 19 09:51:54.847 sock_AuthenticateToClient: Starting session #1
X 3: Fri Aug 19 09:51:54.847 sock_AuthenticateToClient: Received token from client: 52 bytes
X 3: Fri Aug 19 09:51:54.847 sock_AuthenticateToClient: Starting session #2
X 3: Fri Aug 19 09:51:54.863 sock_AuthenticateToClient: Received token from client: 72 bytes
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: Check Local Groups of user [<domain>\BTS SERVICE AACT]
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: EDI Subsystem group [<domain>\BizTalk Base EDI Users] is not a local group. Skipping check on local groups!
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: User info -> User Name = [BizTalk EDI Admin]
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: User info -> Logon Domain = [<domain>]
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: User info -> Other Domains = []
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: User info -> Logon Server = [<domaincontroller>]
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: Determined LOGONSERVER from network: [<domaincontroller>]
X 3: Fri Aug 19 09:51:54.863 _IsUserMemberOfEdiSubsystemGroup: Check Domain Global Groups of user [<domain>\BTS SERVICE AACT] on logon server [<domaincontroller>]
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is a member of Domain Global Group [Domain Users]
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is a member of Domain Global Group [Service Accounts]
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is a member of Domain Global Group [BizTalk Application Users]
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is a member of Domain Global Group [EDI Subsystem Users]
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is not a member of Domain Global EDI Subsystem User Group
X 3: Fri Aug 19 09:51:54.894 _IsUserMemberOfEdiSubsystemGroup: Check Domain Local Groups on server [<domaincontroller>]
X 3: Fri Aug 19 09:51:54.910 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is a member of Domain Local Group [Users].
X 3: Fri Aug 19 09:51:54.910 _IsUserMemberOfEdiSubsystemGroup: User [<domain>\BTS SERVICE AACT] is not a member of Domain Local EDI Subsystem User Group [<domain>\BizTalk Base EDI Users]
X 3: Fri Aug 19 09:51:54.910 sock_AuthenticateToClient: User <domain>\BTS SERVICE AACT is not a member of <domain>\BizTalk Base EDI Users
X 3: Fri Aug 19 09:51:54.910 sock_AuthenticateToClient: Failed
The service account is "<domain>\BTS SERVICE AACT"
The logged on user is "BizTalk EDI Admin"