Last weekend I was participating in the DR activity for my client. The experience was as amazing as alwasy :-). From the very first day when the plan for all this DR thing started, don't know why, but I had a feeling that what my client is planning to do will definitely work but there would definitely some problem with the SSO thing for BizTalk. And yes, that happened !!
Plan was: backup the running BizTalk Server box as a virtual server. Restore the database backups to new virtual sql servers. This was done without a flaw.
The problem came in when the servers were turned on, in the order of SQL boxes first, then the BizTalk box. BizTalk host instances were unable to start or stop. It everytime errored saying something related to encryption/decryption and "unable to retrieve master secret". The latter was the actual problem. Yes, the master secret for BizTalk had corrupted or one would rather say "it wasn't there at all". I am still not aware why, but may be because the SQL Server boxes were not restored as existing servers' virtaul image as was the case with BizTalk box.
I resolved the problem by installing the ENTSSO Tools/Services on the SQL Server box, which was actually the ONE (master secret server). Installation is never a tough job with Micrsoft products but what amazed me was configuring BizTalk ENTSSO. I was a bit confused at this point of time. Should we be creating a new SSO Master Secret or Join the existing one? Giving a peice of load to my brain, I realised, JOINing to the existing group would work since I already had the SSO database hosted (this was also restored using the existing backups). But me still fighting with the contradicting statements going on within me, thought of why not restore the whole config from where the backups have been restored ??
This was the hit !! It worked !! I simply imported the BizTalk configuration of the environment into DR, which backed my statement of JOINing the SQL box to existing SSO group.
Next was nothing but restoring the master secret file which we had already backed up earlier safely :) using ssoconfig -restoreconfig
