FIX: Users cannot log on to external applications for a long time after an outage causes the ENTSSO service to lose a connection to the SSO credential database (904701)


The information in this article applies to:

  • Microsoft Host Integration Server 2004
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

Consider the following scenario. In Microsoft Host Integration Server, an outage causes the Enterprise Single Sign-On (ENTSSO) service to lose a connection to the Single Sign-On (SSO) credential database. In this scenario, users cannot log on to external applications for a long time. For example, users cannot log on to IBM Mainframe or IBM iSeries applications.

These logon failures continue even after the outage ends and the SSO credential database is available again. Users may not be able to log on to external applications for a few minutes up to 30 minutes.

When the ENTSSO service cannot connect to the SSO credential database for 5 minutes, the following events are logged to the event log:Event ID: 10515
Source: ENTSSO
Description: Lost contact with the SSO database. Check that the SSO database is available. Event ID: 10590
Source: ENTSSO
Description: Enterprise Single Sign-On is going offline When the ENTSSO service detects that the SSO credential database is online, the following event is logged to the event log:Event ID: 10590
Source: ENTSSO
Description: Enterprise Single Sign-On is back online

CAUSE

This problem occurs because a computer that is running Microsoft SQL Server hosts the SSO credential database. The ENTSSO service uses the OLE DB Provider for SQL Server (SQLOLEDB) to connect to the computer that is running SQL Server. By default, Microsoft Data Access Components (MDAC) adds the OLE DB connections that the ENTSSO service uses to a connection pool. The delay that is mentioned in the "Symptoms" section occurs because of how OLE DB connections are handled in the connection pool after a SQL Server outage occurs.

RESOLUTION

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Host Integration Server 2004 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version    Size     File name
   ------------------------------------------------------------
   03-Oct-2005  16:45  4.0.129.0   34,304  Entsso.exe
   03-Oct-2005  16:45  4.0.129.0   71,168  Infocache.dll
   03-Oct-2005  16:45  4.0.129.0   68,096  Ssolookup.dll    
   03-Oct-2005  16:45  4.0.129.0   81,408  Ssolookupserver.dll
   03-Oct-2005  16:45  4.0.129.0   60,928  Ssomappingserver.dll
   03-Oct-2005  16:46  4.0.129.0  116,224  Ssopsserver.dll
   16-Jun-2005  22:53              28,188  Ssox4.sql
Note Because of file dependencies, the most recent fix that contains these files may also contain additional files.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

This hotfix updates the ENTSSO service to let you disable OLE DB connection pooling. If you disable connection pooling, the problem that is mentioned in the "Symptoms" section does not occur. Instead, the ENTSSO service can detect that the SSO credential database is available within 30 seconds of the database becoming available. The actual time that it takes for the ENTSSO service to reconnect may vary depending on the following conditions:
  • When the last ENTSSO poll occurred
  • The underlying errors that may occur when the database is unavailable
The ENTSSO service polls the SSO credential database every 30 seconds.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To disable connection pooling, follow these steps to add the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ENTSSO\RunTime\DisableConnectionPooling registry value:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ENTSSO

  3. Right-click ENTSSO, point to New, and then click Key.
  4. Type Runtime, and then press ENTER.
  5. Right-click Runtime, point to New, and then click DWORD Value.
  6. Type DisableConnectionPooling, and then press ENTER.
  7. Double-click DisableConnectionPooling, type 1 in the Value box, and then click OK.
  8. Quit Registry Editor.
  9. Stop and then restart the ENTSSO service.
If the DisableConnectionPooling registry value does not exist or is set to 0, connection pooling will be enabled.

Connection pooling improves performance because creating new connections to a database is time-consuming. Therefore, do not disable connection pooling for the ENTSSO service unless you experience the problem that is mentioned in the "Symptoms" section. If you do not experience the SQL Server outages that cause this problem, you should enable connection pooling.

If you must disable connection pooling and if the external applications that the users access are Host Integration Server 2004 applications, you can reduce the performance effect of the change by applying the update that is described in the following Microsoft Knowledge Base article:

905399 Host Integration Server 2004 applications that are configured to use the ENTSSO service do not use the credential cache for SSO lookup requests

Additionally, Microsoft Knowledge Base article 904702 describes a software update that lets you configure a retry interval for the ENTSSO service. You can set this interval for scenarios in which the computer that is running SQL Server and hosting the SSO credential database goes offline. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

904702 Applications that use Enterprise Single Sign-On cannot log on to remote applications if the ENTSSO service cannot communicate with the SSO credential database for 5 or more minutes

Modification Type:MinorLast Reviewed:7/25/2006
Keywords:kbHotfixServer kbQFE kbHIS2004 kbfix kbbug kbpubtypekc KB904701 kbAudDeveloper kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.