Even if you do not use the Enterprise Single Sign-On (SSO) functionality for mapping credentials and single sign-on, Enterprise SSO is a critical part of the overall Microsoft BizTalk Server infrastructure, because BizTalk Server uses SSO to help secure information for port configuration.
The port configuration data is encrypted and stored in the SSO database. Each BizTalk server has a SSO service (ENTSSO.exe) that is used for encrypting and decrypting the port configuration data. When an SSO service starts up, it retrieves the encryption key from the master secret server. This encryption key is called the master secret.
The master secret server is another SSO service that has an additional subservice that maintains and distributes the master secret. After a master secret is retrieved, the SSO service caches it. Every 60 seconds, the SSO service synchronizes the master secret with the master secret server. If the master secret server fails, and the SSO service detects the failure in one of its refresh intervals, the SSO service and all run-time operations that were running before the server failed, including decryption of credentials, continue successfully.
However, you cannot encrypt new credentials or port configuration data. Therefore, the BizTalk Server environment has a dependency on the availability of the master secret server.
Therefore, it is important that the Master Secret Server be highly available and that the SSO database is highly available.
Following these arguments, please, refer to the links below to have no problems:
How to Back Up the Master Secret:
BizTalk 2006 R2: http://msdn.microsoft.com/en-us/library/cc982773%28v=bts.10%29.aspx
BizTalk 2009: http://msdn.microsoft.com/en-us/library/aa559192%28v=bts.10%29.aspx
BizTalk 2010: http://msdn.microsoft.com/en-us/library/aa559192.aspx
How to Restore the Master Secret Server:
BizTalk 2006 R2: http://msdn.microsoft.com/en-us/library/cc296749%28v=bts.10%29.aspx
BizTalk 2009: http://msdn.microsoft.com/en-us/library/aa560589%28v=bts.10%29.aspx
BizTalk 2010: http://msdn.microsoft.com/en-us/library/aa560589.aspx
If you are running a high available infrastructure, the next important thing to do is to cluster the Master Secret Server:
How to Cluster the Master Secret Server:
BizTalk 2006 R2: http://technet.microsoft.com/en-us/library/aa561823%28BTS.20%29.aspx
BizTalk 2009: http://msdn.microsoft.com/en-us/library/dd897477%28v=bts.10%29.aspx
BizTalk 2010: http://msdn.microsoft.com/en-us/library/aa561823.aspx
The final question is, what about the password of the master secret?
Two recommendations, first of all, keep a backup of the master secret on a save place!! Leave a copy on removable media, in a NFS, on hard disk units of your farm servers... where ever you imagine!!
Make sure it’s safe!!
The second recommendation is about the password. Never write down the password, keep it in mind, shared with other members of your team or store it in an encrypted password manager, but never lose it!!! You will need it to restore the master secret server!!!!
