Configuring Microsoft Distributed Transaction Coordinator

What is the Microsoft Distributed Transaction Coordinator?

The Microsoft Distributed Transaction Coordinator (MS DTC) is a service available in all operating systems supported by UNIFYBroker. This service permits the coordination of atomic transactions across multiple servers. It is disabled by default.

Why should UNIFYBroker be configured to use it?

UNIFYBroker is capable of using the Microsoft .NET TransactionScope object in order to define atomic data transactions. Having the transactions permits UNIFYBroker to ensure a transaction is successful with all data connections before allowing it to be committed, for connected systems that subscribe to the Microsoft Distributed Transaction Coordinator. Since Microsoft .NET Framework v2.0, Microsoft have recommended the use of this object for transaction management. The object can transparently elevate a transaction to the MS DTC server.

How is it configured?

Each server that is involved in UNIFYBroker data transactions must have MS DTC enabled. In cases where UNIFYBroker's database is stored on a SQL Server instance on the same server as UNIFYBroker, that means MS DTC is only required on that machine, and there are no communication issues. When SQL Server is on another server, or in a cluster, then MS DTC must be enabled on both the UNIFYBroker server and the SQL Server server or cluster, and that the appropriate firewall rules must be in place.

Enabling MS DTC in UNIFYBroker

MS DTC is disabled by default. To enable, edit the Unify.Framework.Data.DataEnginePlugInKey.extensibility.config.xml file to add the enableTransactions attribute to the dataConnection element so that it looks like the following:

<dataConnection name="sql" repository="Unify.IdentityBroker" connectionString="...removed..." enableTransactions="true"/>

Enabling MS DTC in Windows

In order to enable MS DTC, you must be able to create a desktop session on the target server(s) as a local administrator.

Open the Local Services control panel snap-in and locate Distributed Transaction Coordinator as shown in the screenshot below.

If the service is not started, start it now. It may be prudent to make the service start automatically to ensure it is available if the server needs to be restarted.

Configuring MS DTC

1. Open the Component Services snap-in.
   To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.
2. Expand the console tree to locate the DTC (for example, Local DTC) for which you want to enable Network MS DTC Access.
3. On the Action menu, click Properties.
4. Click the Security tab and make the following changes:
   • In Security Settings, select the Network DTC Access check box.
   • In Transaction Manager Communication, select the Allow Inbound and Allow Outbound check boxes.
5. Click OK.
6. Restart the machine.
7. Repeat the steps above for all machines involved.

Configuring a firewall for MS DTC

Due to the large number of firewalls on the market, it will not be attempted to provide a guide on how to configure each of them to to allow MS DTC. If using Windows Server firewall, add the pre-determined exception for Distributed Transaction Coordinator on each server. Refer to the official TechNet topic Enable Firewall Exceptions for MS DTC for more information.

Security

As with any service, there are vulnerabilities. TechNet provides a guide on Configuring Security for Distributed Transactions and Enable Network Access Securely for MS DTC. There are no recommended settings for security as this will be determined by enterprise policy.

Troubleshooting

Microsoft provides two tools for troubleshooting MS DTC issues: DTCPing and DTCTester. Troubleshooting MS DTC firewall issues can be found on TechNet.