Hello,
I am currently running TFS 2008 and am writing a web application that connects to TFS and lists the Team Projects. If I use explicit impersonation in the code, I can connect to TFS, but the list of team projects that is returned is not restricted.
In other words, ALL team projects are returned, not just the ones that the user is authorized to see. If I do not use explicit impersonation in the code, I can't connect at all and get an application event telling me that NetworkService (the app
pool identiy account) is not authorized to connect to the tfs server's service.
I am using the TFS 2008 SDK's version of the TFS DLLs (not the 2010 version). But it seems like it should work!
My web application is located on the TFS application tier server. This was necessary in order to eliminate the double-hop issue. (I did not want to set up Kerberos authentication on my TFS server and or to change the authentication
method of the TFS web application because I was afraid that issues would arise that would be difficult to solve.)
Note: I can see the user login in the security log in the event view on the tfs application server. This proves that impersonation is working.
Here is my code. Could someone please tell me what is wrong with it?
protected bool ConnectToTFS(string tfsServer, IPrincipal user)
{
WindowsIdentity id = (WindowsIdentity)user.Identity;
WindowsImpersonationContext impersonateContext;
impersonateContext = id.Impersonate();
WindowsIdentity newid = WindowsIdentity.GetCurrent();
string name = newid.Name;
try
{
tfs = TeamFoundationServerFactory.GetServer(tfsServer);
workItemStore = (WorkItemStore)tfs.GetService(typeof(WorkItemStore));
return true;
}
catch (Exception e)
{
throw new Exception(e.Message + "\r\n" + "Could not connect to TFS server " + tfsServer + " as " + name);
return false;
}
finally
{
impersonateContext.Undo();
}
}
public List<string> GetTeamProjectNames(string tfsServer, IPrincipal user)
{
List<string> teamProjects = new List<string>();
if (this.ConnectToTFS(tfsServer, user))
{
foreach (Project teamproj in workItemStore.Projects)
{
teamProjects.Add(teamproj.Name);
}
}
return teamProjects;
}(My web.config uses Windows Authentication and impersonate is set to true.)
<authentication mode="Windows" />
<identity impersonate="true"/>
Moderator: If nobody can answer this, could you let me know which team I should request when submitting an MSDN support incident? I must get past this. Have spent a ridiculous amount of time trying to solve it.
Thanks,
Sophia Bunce