EntSSO configuration in clustered environment

Question

Hi All
I am trying to use SSO Applications to store credentials and use it on Send / Receive ports. It worked fine on the development machine which is a standalone box. But while moving it to a higher clustered environment, I am facing some issues. 
BTS_Service is a BT service account which is added to both BTS_SSO_Admins and BTS_SSO_Affiliate_Admins
BTS_SSO_Service is an SSO Service account which is running the ENTSSO service and its also added to BTS_SSO_Admins and BTS_SSO_Affiliate_Admins
Logged in using BTS_Service account
Using SSO Administration - Created SSO Application as individual, allow tickets true.
Using SSO Client Utility - Added credentials to the SSO Application 
Now logged back in using the normal user credentials
Ticketing component and pipeline is already deployed (tested in standalone - working fine)
On a WCF Send port, used the Ticketing Send pipeline, and on credentials tab, selected the SSO Application created in Step 2. 
while running, I get the below error
There was a failure executing the send pipeline: "BizTalk_Server_Project1.SendPipelineSSOTicketRetriver, XXX.Pipeline.SSOTicketRetriever, Version=1.0.0.0, Culture=neutral, PublicKeyToken=sf343fs3t34daf8" Source: "SSO Ticket Retriever"
Send Port: "XXXRequestResponse_WCFCustom" URI: "http://XXXXXXXXXXXXXX/XXXXXXXXXXXXXXX" Reason: Access denied.
I have referred to Richard Seroter's post .
http://blogs.msdn.com/b/richardbpi/archive/2005/08/09/building-and-executing-a-biztalk-single-sign-on-scenario.aspx
Another big difference i see is that when in my development machine, i have windows accounts setup in BizTalk configuration under Enterprise SSO tab as below. while in the Clustered environment where I am facing the issue, windows accounts are not added. 
Could that be the issue?
mayur macwan

Answer 1

Hi Mayur,
Since you are working in cluster environment might be the SSO admin is configured in this clustered node. Also, check whether this cluster node contains SSO admin group. If yes, add your credential into this group. Since SSO denied access is popping up I
believe you first try to add your credential in BizTalk SSO group (might be present in different cluster group).
Thanks