Commerce Server Blog

Build world class ecommerce applications using Microsoft Commerce Server
  •  
  • Home
  • Advertise
  • Copyright Policy
  • Disclaimer
  • About

Staging Deployment – Security Considerations

ravikanth | August 30, 2010

In last two articles, we have seen what is commerce server staging and how it works. Check below links for more details.

http://microsoftblog.co.in/commerceserver/introduction-to-commerce-server-staging-2/

http://microsoftblog.co.in/commerceserver/how-commerce-server-staging-works/

In this article, we will see what are the security (access privileges ) consideration we should consider to staging service accounts. Microsoft CS team has provided some recommendations on this. I have seen in couple of implementations, the entire stating is executed on the service account which has admin privileges, which is not recommended. Here are the set of privileges a staging Service account should have.


Database


SQL Server Roles

MSCS_Admin

admin_reader_role

MSCS_CatalogScratch

db_datareader, db_datawriter, db_ddladmin

<site>_Marketing

db_ddladmin, mktg_staging_role

<site>_MarketingLists

db_datareader

<site>_ProductCatalog

ctlg_CatalogWriterRole, db_datareader, db_datawriter, db_ddladmin, db_securityadmin, Inventory_ReaderRole, Inventory_WriterRole

Here are the set of privileges, AD groups (css administrators and css operators accounts) should have -


Database


SQL Server Roles

MSCS_Admin

db_datareader

MSCS_CatalogScratch

db_datareader, db_datawriter, db_ddladmin

<site>_ProductCatalog

ctlg_CatalogReaderRole, Inventory_ReaderRole

Note: Since staging doesn’t do any operations on <site>_transactions, there is no need of giving access to staging service account to this database.

To make developer life easier, I have created SQL scripts which provides proper access to the service accounts.

/*

Replace ‘MSCS_Admin’ with your admin DB.

Replace ‘MSCS_CatalogScratch’ with your catalog scratch DB.

Replace ‘StarterSite_ProductCatalog’ with your catalog db.

Replace ‘StarterSite_Profiles’ with your profile db.

Replace ‘StarterSite_TransactionConfig’ with your transaction config db.

Replace ‘StarterSite_Marketing’ with your marketing db.

Replace ‘StarterSite_Marketing_Lists’ with your marketing config db.

Replace ‘DOMAIN_NAME\stagingsvc’ with staging service account.

Replace ‘DOMAIN_NAME\stagingadmin’ with staging admin account.

Replace ‘DOMAIN_NAME\stagingoperator’ with staging operator account.

*/

PRINT ‘———– UPDATING ADMIN DB ————————–’

USE [MSCS_Admin]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

CREATE USER [DOMAIN_NAME\stagingadmin] FOR LOGIN [DOMAIN_NAME\stagingadmin] WITH DEFAULT_SCHEMA=[dbo]

CREATE USER [DOMAIN_NAME\stagingoperator] FOR LOGIN [DOMAIN_NAME\stagingoperator] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘admin_reader_role’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_datareader’ , [DOMAIN_NAME\stagingadmin]

EXEC sp_addrolemember ‘db_datareader’ , [DOMAIN_NAME\stagingoperator]

PRINT ‘———– UPDATING COMMERCE SCRATCH ————————–’

USE MSCS_CatalogScratch

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘db_datareader’, [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_datawriter’, [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_ddladmin’, [DOMAIN_NAME\stagingsvc]

CREATE USER [DOMAIN_NAME\stagingadmin] FOR LOGIN [DOMAIN_NAME\stagingadmin] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘db_ddladmin’ , [DOMAIN_NAME\stagingadmin]

EXEC sp_addrolemember ‘db_datareader’, [DOMAIN_NAME\stagingadmin]

EXEC sp_addrolemember ‘db_datawriter’, [DOMAIN_NAME\stagingadmin]

CREATE USER [DOMAIN_NAME\stagingoperator] FOR LOGIN [DOMAIN_NAME\stagingoperator] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘db_ddladmin’ , [DOMAIN_NAME\stagingoperator]

EXEC sp_addrolemember ‘db_datareader’, [DOMAIN_NAME\stagingoperator]

EXEC sp_addrolemember ‘db_datawriter’, [DOMAIN_NAME\stagingoperator]

PRINT ‘———– UPDATING CATALOG DB ————————–’

USE [StarterSite_ProductCatalog]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘ctlg_CatalogWriterRole’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_datareader’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_datawriter’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_ddladmin’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘db_securityadmin’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘Inventory_ReaderRole’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘Inventory_WriterRole’ , [DOMAIN_NAME\stagingsvc]

CREATE USER [DOMAIN_NAME\stagingadmin] FOR LOGIN [DOMAIN_NAME\stagingadmin] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘ctlg_catalogReaderRole’ , [DOMAIN_NAME\stagingadmin]

EXEC sp_addrolemember ‘Inventory_ReaderRole’ , [DOMAIN_NAME\stagingadmin]

CREATE USER [DOMAIN_NAME\stagingoperator] FOR LOGIN [DOMAIN_NAME\stagingoperator] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘ctlg_catalogReaderRole’ , [DOMAIN_NAME\stagingoperator]

EXEC sp_addrolemember ‘Inventory_ReaderRole’ , [DOMAIN_NAME\stagingoperator]

PRINT ‘———– UPDATING MARKETING DB ————————–’

USE [StarterSite_Marketing]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘db_ddladmin’ , [DOMAIN_NAME\stagingsvc]

EXEC sp_addrolemember ‘mktg_staging_role’ , [DOMAIN_NAME\stagingsvc]

PRINT ‘———– UPDATING MARKETING CONFIG DB ————————–’

USE [StarterSite_Marketing_Lists]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘db_datareader’ , [DOMAIN_NAME\stagingsvc]

PRINT ‘———– UPDATING PROFILES DB ————————–’

USE [StarterSite_Profiles]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘Profile_Schema_Manager’ , [DOMAIN_NAME\stagingsvc]

PRINT ‘———– UPDATING ORDER CONFIG DB ————————–’

USE [StarterSite_TransactionConfig]

CREATE USER [DOMAIN_NAME\stagingsvc] FOR LOGIN [DOMAIN_NAME\stagingsvc] WITH DEFAULT_SCHEMA=[dbo]

EXEC sp_addrolemember ‘Orders_Management’ , [DOMAIN_NAME\stagingsvc]

Comments
No Comments »
Categories
Commerce Server 2009, commerce server 2007
Tags
staging
Comments rss Comments rss
Trackback Trackback

Pipeline Editor displays registered custom pipeline components as unknown in 64 Bit version.

ravikanth | August 26, 2010

If you are using commerce server 2007/2009 on 64 bit machine and used pipeline component registration wizard to register pipeline components and if we try to open 64 bit pipeline editor, you may not see your component rather you will see "<<unknown>>” message. This issue occurs because Pipereg.exe cannot recognize 64-bit architecture. To resolve this issue, follow below steps.

  • Use the 64-bit version of the Assembly Registration tool (Regasm.exe) to prepare the custom pipeline components for registration(C:\Windows\Microsoft.NET\Framework64\v2.0.50727). So, open Open a command prompt, Change default installation folder for the .NET Framework and run below command.
    regasm MyAssemblyComp.dll /tlb:MyAssemblyComp.tlb 
  • Use Pipereg.exe to register the type library file that you created in above step. Make sure that you select the Export registration data option to export the registry information to a .reg file. 
  • At a command prompt, run the .reg file that you created above or run the .reg file directly from Windows Explorer.

If you check, the custom pipeline components appear correctly in the 64-bit version of Pipeline Editor. 

Optional: If you still have the issue then you can use Microsoft regcleaner tool to clean the unnecessary registry entries from the system and perform above steps again. Warning Serious problems might occur if you opt this method and you reinstall the operating system. No one (including Microsoft) cannot guarantee that these problems can be solved. So, modify the registry at your own risk.

Comments
No Comments »
Categories
Troubleshoot
Comments rss Comments rss
Trackback Trackback

How commerce server staging works

ravikanth | August 25, 2010

In the previous post, I explains the core CS staging concepts and if you have not yet viewed , click below link for more detail.
http://microsoftblog.co.in/commerceserver/how-commerce-server-staging-works/

In this article, we will learn how staging works. When you install commerce server staging (Note: staging is part of CS enterprise version), a service named “Commerce Server Staging” is installed and you can see it in services MMC. When ever we start a staging project, the replication (during transit, CS encrypts data using SHA algorithm) will happen under this account credentials. So, make sure you don’t run this service under network or local account instead run it under domain account. Apart from the service, three groups are created on the server and each group has it’s own significance.

  • CSS_SG: commerce server staging service group have operator access to all projects. So, the service account under which the staging service runs is to be part of this group.
  • CSS_Operators: commerce server operator group have operator access to manage projects.
  • CSS_Administrators: commerce server administrators group have administrative access.

The below table explains security permissions between the groups.

Task CSS_Operators CSS_Administrators
Add/remove/change projects and routes NO YES
Add/remove users from the projects NO YES
Add/remove servers NO YES
Change server properties NO YES
Start/stop/roll back staging projects YES YES
View project/route properties YES YES
Start/Stop staging service YES YES

The users can able to access projects and routes in Staging MMC only if they are part of CSS_Operators or CSS_Administrators and make sure proper access to databases. I will explain more about sql security in my upcoming articles.

The below diagram explains how stage data is moved from source CSS server to destination CSS server.

How Commerce server works.

  • The staging operation starts when the user trigger project execution. Project execution can be done manually either through staging MMC or staging command line utility (CSS.EXE) or the execution process can be scheduled to run on a particular time/date.
  • Based on the project name, CSS process loads information from configuration settings and initiates the process.
  • Based on the destination settings, the source CSS informs all destination CSS systems about the execution so that they are aware and do the necessary imports.
  • Based on setting, the data is extracted from commerce server or web folder or IIS.
  • Once extract is done, the extracted data is moved to destination folders. Here Staging encryptions data using SHA algorithm so that the data transferred happens securely.
  • Once the files are copied to the destination folder, the destination CSS loads the configuration and start importing data.
Comments
No Comments »
Categories
Commerce Server 2009, commerce server 2007
Tags
commerce server staging
Comments rss Comments rss
Trackback Trackback

Steps to extend payments in Commerce Server 2009

ravikanth | August 24, 2010

I have seen couple of post in MSDN forums asking help to extend payment methods in commerce server. In CS2007, the process is simple but in CS2009 and if you are using SharePoint extensibility kit then the process is much more complex but can be easily achievable. Note that current extensibility kit only supports credit card payment type and to make cheque payment work, we have to do changes in the respective

The basic steps for this are:

  • Create the underlying SQL Server data store to store “Cheque” details (preferable create in XXX_transaction table). This involves creating the tables in the data store.
  • Create Cheque class with the list of properties to hold Cheque information.
  • Configure the assembly information (where Cheque class exist) in Web config.
  • Configure the Fields information in Order Mapping xml file.
  • Configure the Fields information in Order Pipeline.
  • Execute OrderMapping tool, which creates required stored procedures (as output file) based on the configuration files (order mapping, web.config and order pipeline) . Execute the generated stored procedures in data store (in XXX_transaction table).
  • Create Cheque class which extends entity class. This class is used by CS2009 Foundation classes .
  • Create Translators and PaymentResponseBuilders (Operation Sequence Component)
  • Create further mappings for Commerce Entities in the MetadataDefinitions.xml file
  • Modify ChannelConfiguration file and create entries for newly created Translators and Responsebuilders.
  • Modify the extensibility code (Create C# helper classes etc…) wherever required. Note that current extensibility kit only supports credit card payment type and to make cheque payment work, we have to do changes in the respective files which I didn’t mention here.
  • Above steps helps us to store cheque values in database and the process of creating business process is same in commerce server 2007 and 2009.
    • Create a new pipeline component named “ChequePayment” and implement your business process.
    • Open customer and order manager and create a new payment type – “Cheque”.

Hope this high level approach gave birds view of what to do and if you need in depth knowledge, feel free to contact me. Similarly I have blogged the steps involved in line item.

http://microsoftblog.co.in/commerceserver/steps-involved-in-extended-commerce-server-2009-systems/

Comments
No Comments »
Categories
Commerce Server 2009
Tags
Payments
Comments rss Comments rss
Trackback Trackback

Introduction to Commerce Server Staging

ravikanth | August 23, 2010

Commerce server staging (in short CSS), helps us to transfer and update business data and web site content from one environment to another environment.  In the nutshell, CSS provides following functionality.

  • Remotely administer servers and projects.
  • Replicate web site content or business data over LAN and through firewalls (TCP port 507).
  • You can deploy content or data manually or on pre-determined schedule.
  • Replicate IIS metadata
  • Configure scripts and/or batch files to run before or after content or data is replicated.

Few things to make note of:

  • Business data includes catalog schema and data, Marketing data, site terms, order configuration.
  • You can’t stage/ replicate profile schema, profile data, inventory schema, order data, direct mailer job, lists and confirguration.
  • All business data types supported by CSS can refresh site cache.
  • Web Content, includes HTML, images, ASP.NET pages, commerce server pipelines and other files, IIS metadata.
  • IIS meta data includes information about the files in the website and its configuration.
  • Make sure TCP port 507 is open in order staging site work.
  • Roll back feature is applicable to web content deployment only.

The below diagram explains how staging works. In CSS, we have three types of servers.

  • Source staging server – this is the server from where the content & data is deployed.
  • End point server – this is the server to which the content & data is deployed.
  • Way point server – this server is used to relay the content & data from source staging server to end point server.

In the below diagram demonstrates how the data is moved from one environment to another environment. The CSS service can be installed on dedicated box or on all environment servers.

commerce server staging topology

In order to understand CSS, you have to learn two concepts – one is project and another one route. A CSS project defines the properties of a CSS deployment and it takes few key properties like, name, type (content deployment or business data deployment) and project source (path where the data is staged). Some of the points we have to remember while creating a project.

  • A project needs to be created in each CSS server involved in staging. (The above diagram, we are using single CSS server for all deployments).
  • Project name should be same for all CSS servers (this will not accept special characters including space) and the properties may differ from one project to other.
  • Project properties tells the purpose of staging.
  • Project type must be same for the same projects across CSS servers. For example, if the project at source staging server is “web deployment” then the end point server project type should be the same.

A route in CSS signifies a path by which the data is moved from source to destination. A route will hold few properties such as route name, local directory to store the data and the destination server. As CSS project, route is also required to have few mandatory settings in order to work and they are

  • A route needs to be created in each CSS server involved in staging.
  • Route name should be same for all CSS servers .

Note: Defining a route is not compulsory for a given deployment. In majority of the deployments, I have seen, we have created CSS projects without routes. This is applicable if the source server can’t access the destination server directly.

In coming posts, I will try to explain how commerce server staging works, command line tools and how can we write scripts to make the deployment easier.

Comments
No Comments »
Categories
Commerce Server 2009, commerce server 2007
Tags
commerce server staging
Comments rss Comments rss
Trackback Trackback

« Previous Entries

Sign up for Newsletter


Categories

Quiz

  • Catalog Quiz for Beginners
  • Profile Quiz for Beginners
  • Quiz 1 for Advance Users
  • Quiz for Beginners

Recent Posts

  • Staging Deployment – Security Considerations
  • Pipeline Editor displays registered custom pipeline components as unknown in 64 Bit version.
  • How commerce server staging works
  • Steps to extend payments in Commerce Server 2009
  • Introduction to Commerce Server Staging
  • Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information
  • Commerce server staging throws Remote authorization failed to server. Ensure the service has access to this server.
  • Updated Commerce Server 2009 template pack for SharePoint 2007 released
  • RCXml2Resx.exe tool stops working
  • Commerce Server Profile Importer Tool

Archives

  • August 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • November 2009
  • October 2009
  • September 2009
  • August 2009
  • July 2009
  • June 2009
  • May 2009
  • April 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008

Tags

add discounts add images to profile Advantages of commerce server approve discounts authentication auto login process automatic user creation basket Brand Management business tools campaign management Catalog catalog import Category commerce server commerce server 2007 commerce server manager Commerce Server SP2 commerce server staging discounts ecommerce Estimation Installation inventory Kanth Koppala marketing system migration error Mojave operation components operation sequence Order subsystem Product profile profile subsystem property metadata purchase order quick checkout Ravi Ravi Kanth site cache refresh starter site tools transactions error Variant
(c) 2009 Commerce Server Blog. All rights Reserved. Articles cannot be reproduced without permission from the author.Write to me at kanth@ravikanth.net if you have any comments, questions, suggestions about this site or would like to send us a tip
About Us | Terms of Use | Disclaimer | Advertise .