Cannot determine the SID for the user while browsing BAM Portal

  • Article

Recently I came across this very well known issue while browsing to BAM Portal and after lot of troubleshooting it turned out to be an issue with the way BAM Mgmt Service do the authentication.

In our case we were able to browse the BAM Portal but BAM Portal was not able to consume out of the box BAM Mgmt Web Service. And we were getting following entry in the event viewer:

Event Type: Error
Event Source: Bam Web Service
Event Category: None
Event ID: 12033
Date: 20/06/2009
Time: 13:56:00
User: N/A
Computer: MyComputer
Description:
Referenced database 'BAMPrimaryImport' on server 'MyComputer' is not accessible. The error is:
System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.BizTalk.Bam.WebServices.AsyncResult.End(AsyncResult asyncResult)
at Microsoft.BizTalk.Bam.WebServices.Management.GetViewSummaryAsyncResult.End(IAsyncResult result)
at Microsoft.BizTalk.Bam.WebServices.Management.BamManagementService.GetViewSummaryForCurrentUser()

We enabled BAM traces. It contains following information:

06/20/2009 13:57:00 Microsoft.BizTalk.Bam.WebServices.Management.GetViewSummaryAsyncResult CompleteGetViewSummary Error Exception thrown
Source:
Microsoft.BizTalk.Bam.WebServices
Error messages:
Object reference not set to an instance of an object.
Call stack:
at Microsoft.BizTalk.Bam.WebServices.TraceHelper.ThrowHelperSoapException(XmlQualifiedName faultCode, Exception exception, Int32 eventId, String message)
at Microsoft.BizTalk.Bam.WebServices.SecurityHelper.CompareUsernames(String user1, String user2)
at Microsoft.BizTalk.Bam.WebServices.Management.GetViewSummaryAsyncResult.ReadCurrentUsersViews(SqlDataReader sqlReader, Boolean isDbo)
at Microsoft.BizTalk.Bam.WebServices.Management.GetViewSummaryAsyncResult.GetViewSummaryForDatabase()
at Microsoft.BizTalk.Bam.WebServices.Management.GetViewSummaryAsyncResult.CompleteGetViewSummary()

I came across this blog by Tiho, so we cross checked following points:

  1. BAMPrimaryImportDB is running under a domain account.
  2. SQL Server is running under Windows Authentication.
  3. We were able to browse the BAM Mgmt Web Service directly and we can invoke the Web Methods without any issue.

Later, while looking at the list of users who has access to the view, we found that there is a user who no longer exist in the Active Directory, but has still access to the view. Once we removed that user from the access list of the view, everything started working properly!!! So we wonder how a user who is not even present in Active Directory can cause such a issue.

We took a dive in the code and found that when you browse to BAM portal, you will see the list of views for which you have the access. The job of filtering the views based on authorization is done by the BAM Mgmt WS. In order to do the authorization BAM will take a list of all the users/groups who has access to the view and then tries to compare it with the current user. The catch here is the way comparison is happening. It is not a a string comparison. We translate the username/group to its security identifiers (SID) and then do the comparison. And in our case it was failing when the username to SID conversion was happening, as the user was not present in AD.

Unfortunately, the behaviour is same in BizTalk 2009. Product team is working on this and we should see a fix soon.