Connecting BCS External Content Type to database outside your domain

If you want to connect your External Content Type to a database outside your domain, and maybe also outside your control, you will need to set up Secure Store impersonation, as you can't use your Windows identity in this case. Note that SharePoint 2010 Server is required to run the Secure Store Service which is needed.

Sridhar's blog has a nice description of how to set this up:
Setting up BCS with Secure Store Application impersonation

If you now find that you need to upgrade your SharePoint installation from Foundation to Server, here is a good walkthrough from Microsoft:
Upgrade from SharePoint Foundation 2010 to SharePoint Server 2010

Creating BCS External Content Type Association in SPD - primary/foreign key limitation

While experimenting with External Content Types and Associations between them  using database tables in SharePoint Designer 2010, I encountered a problem where SPD was giving me the following error message:

The related identifier customerID is mapped to field customerID which is already marked as an identifier of this external content type.

Well, ok, so what is the problem with that? Can I not use a field that is already an indetifier/primary key in the child table as a foreign key also?
After some searching I found a nice blog post which helped answer this:
Tooling Associations in SharePoint Designer 2010
As it turns out, the answer is "no, it can't", this is not supported in SPD.

What should we do then?
We'll have to adjust the BDC Model XML by hand, or set up a simple Web service for our database which circumvents the second Primary Key requirement.

Microsoft also has an article on this:
Association Element in MethodInstances (BDCMetadata Schema)