Team Foundation Server : TFS

How to make TFS with a User domain over a 1-way external trust with Selective Authentication

Lakhminder — Wed, 16 Dec 2009 22:27:00 GMT

I had been working on making TFS work with users from an external forest over a 1-way outgoing trust configured with Selective Authentication & wanted to share the same across.

Goal:

Provide access to users from a UserDomain to a TFS Server in the TFSDomain & perform day-to-day tasks including Team Project Creation.

Detailed Scenario:

Domain1 (aka “TFSDomain”)

Domain Functional Level: Windows Server 2003 [Required for Selective Authentication]

Forest Functional Level: Windows Server 2003 [Required for Selective Authentication]

TFS Single Server (Windows Server 2008 + SQL 2008 + TFS 2008 SP1) as member server of the TFSDomain

Domain2 (aka ”UserDomain”)

Domain Functional Level: Windows Server 2003 [Required for Selective Authentication]

Forest Functional Level: Windows Server 2003 [Required for Selective Authentication]

TFSDomain has a one-way external outgoing trust with a User Domain. The authentication type for the trust is “Selective Authentication”(Instructions for configuring Selective Authentication are available here). Selective authentication gives us the capability to allow specific users\groups from the UserDomain to logon/access/authenticate with specific servers/machines in the TFSDomain.

To enable this setup, following implementations needS to be in place:

1. All users in UserDomain who need to access TFS will need to be granted the “Allow to Authenticate” right on the computer account of the TFS Server in the TFS Domain. You can do this by requesting your domain admin to perform the steps mentioned in http://technet.microsoft.com/en-us/library/cc738653(WS.10).aspx.

2. TFS Service account must be a user account from the user domain. Follow instructions in http://msdn.microsoft.com/en-us/library/bb552178.aspx for updating/changing the service account.
***The service account will need to come from the user domain for GSS sync to work because of the 1-way trust in place***

3. Optional: If you want users form TFS domain to access the TFS server as well, you would need to grant the “Allow to Authenticate” right to the TFS Service account(a user account form the user domain) to the computer account for the domain controller of the TFS domain as well.

A high level diagram of how this implementation would look like:

Reporting Services installation/configuration does not set the NTAuthenticationProviders

Lakhminder — Thu, 22 Oct 2009 23:12:00 GMT

I wanted to bring forward an issue(probably not the correct word) with RS 2005.

We typically do the following types of TFS installations, dual server & single server.

A typical dual server environment has the following setup: [All SQL Server versions are 2005 only]

Machine A(called as DT) will have SQL Engine & Analysis Services.

Machine B(called App Tier) will have RS, SharePoint & TFS.

A single server setup will have SQL, RS, SSAS, SharePoint & TFS running on the same box.

The point here is that TFS + RS + SharePoint will be on the same box as part of a typical TFS deployments & SQL & SSAS can be on same or diff box.

During TFS installations, RS is installed on the TFS box beforehand(as a pre-req) & SharePoint is installed(typically) as part of TFS installation. SharePoint extends the default web site & sets the “NtAutheticationProviders” to NTLM. After a successful installation of TFS the users create Team Projects. For each team project new reports are uploaded to the report server & a new site collection is created in SharePoint. Clients(machines which have Visual Studio Team Explorer installed) are able to browse reports & SharePoint project portals along with TFS components with no issues. The users can also browse reports directly in IE on their machines as well.

Now the real thing, with TFS 2008 we support multi-tiered deployments for TFS. One such deployment could involve machines as follows:

#1 Machine A hosts SQL & Analysis Services

#2 Machine B hosts an existing(not installed and configured during TFS installation) SharePoint farm.

#3 Machine C hosts Reports & TFS.

In this kind of a setup when we install TFS on machine# 3, SharePoint is not installed on TFS box(Machine #3). RS 2005 is installed on machine# 3 as pre-req before installing TFS but it is not configured. When a TFS admin will install TFS on machine #3, TFS installation will configure RS as part of its installation & will create Reports & ReportServer virtual directories under the default web site. Also TFS installation will set the NTAuthenticationProviders for the TFS web site explicitly to NTLM. It does not however configure/set the NtAuthenticationProviders to NTLM for the default web site, which is hosting the reports virtual directories.

As a result the NtAuthenticationProviders for the default web site will default to “Negotiate, NTLM”, which is the default for IIS for any web site for which the NtAuthenticationProviders is not set explicitly.

So the behavior that we get because of this is, on machine# 3, the TFS Application Tier box, Reports work in Team Explorer, IE, etc. However when you try to browse reports from a client box, through IE or VS, you will get a prompt for user credentials three times & then reports will not show up (it fails giving 401.1 error if you browsed reports in IE). Your Event Viewer->System Logs will show a Kerberos related error on the client box.

To resolve this issue either setup Reports to work with Kerberos Authentication. To do this follow this link http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/df979570-81f6-4586-83c6-676bb005b13e.mspx?mfr=true mentioned in http://msdn.microsoft.com/en-us/library/bb283249(SQL.90).aspx.

Or if you want NTLM as the preferred authentication provider, then use the following command on the AT box(kb215383):

1. Click Start , click Run , type cmd , and then press ENTER.

2. Locate the directory that contains the Adsutil.vbs file. By default, this directory is C:\Inetpub\Adminscripts.

3. Use the following command to enable the Negotiate process:

cscript adsutil.vbs set w3svc/WebSite/root/NTAuthenticationProviders "NTLM"

In this command, WebSite is a placeholder for the Web site ID number. The Web site ID number of the default Web site is typically 1.

Unable to upgrade from TFS 2005 to TFS 2008 when TFS 2005 is working with a SQL 2008 instance.

Lakhminder — Fri, 21 Aug 2009 17:32:00 GMT

Configuration: Unable to upgrade from TFS 2005 to TFS 2008 when TFS 2005 is working with a SQL 2008 instance.

The scenario is like this:

TFS 2005 was initially installed with a SQL Server 2005 default instance as the data store.

Post installation of TFS 2005 the customer upgrades SQL Server 2005 default instance to SQL Server 2008 default instance.

This causes TFS 2005 servicing to fail.

This also impacts TFS 2005 to TFS 2008 upgrades

Why is this unsupported: SQL Server 2008 is not a supported for DT configuration for TFS 2005.

Symptoms you might see:

Servicing for TFS 2005 fails.

TFS 2005 to TFS 2008 upgrade fails.

Remediation Options:

Upgrade TFS 2005 to TFS 2008 using a TFS 2008 + SP1 slipstreamed setup. Instructions to create a slipstreamed setup for TFS 2008 are available in TFS 2008 SP1 install guide: http://www.microsoft.com/downloads/details.aspx?FamilyID=FF12844F-398C-4FE9-8B0D-9E84181D9923&displaylang=en

For customer who want to rollback to SQL 2005 to remain in a serviceable TFS 2005 state:

The biggest challenge is SQL 2005 does not recognize the database backups taken from a SQL Server 2008 instance. In simple words we cannot restore a SQL Server 2008 database to a SQL Server 2005 instance. If the customer has recently upgraded their SQL from 2005 to 2008 & if they had taken database backups before a SQL 2005 to 2008 upgrade & they are willing to rollback to a previous database state, they can revert to SQL 2005 configuration as a data store. They can follow the instructions in the restoration based move also called hardware based move to do this task. (http://msdn.microsoft.com/en-us/library/ms404869(VS.80).aspx).

I would advice upgrade TFS 2005 to TFS 2008 instead of rolling back SQL 2008 to SQL 2005.

Unable to service TFS 2008/2005 instance running on a Domain Controller

Lakhminder — Fri, 21 Aug 2009 17:30:00 GMT

Configuration: Unable to service TFS 2008/2005 instance running on a Domain Controller

The scenario is like this:

Customer installs TFS 2005/TFS 2008 on a Window Server 2003/2008 member server or standalone server.

Customer make the member server a domain controller.

This does not impact the TFS functionality unless the customer wants to do servicing of TFS 2005/2008 or tries to upgrade TFS 2005 to TFS 2008.

Symptoms a customer might see:

The servicing of TFS 2005/2008 or upgrade of TFS 2005 to TFS 2008 will fail with TfsGssInit.exe errors.

Remediation Options:

Bring up a new Server 2003/Server 2008 member server box & install TFS 2005/2008 on it.

Follow instructions in the h/w based move article to move the TFS instance to the new box.

(http://msdn.microsoft.com/en-us/library/ms404869(VS.80).aspx)

(http://msdn.microsoft.com/en-us/library/ms404869.aspx )

Uninstall TFS 2005/TFS 2008 from the Domain Controller. (Instructions available in install guide)

TFS 2008 & Scripting the WSS 3.0 Configuration

Lakhminder — Tue, 07 Oct 2008 04:26:00 GMT

For any body who wants to script the Products & Technologies Wizard & the extending of default web site in IIS with WSS 3.0 the below script would be the answer.

Thanks Siva for the being the inspiration behind this. :)

Copy the below script in a text file & save it with a .bat extension. Run the .bat in a command prompt window to complete the operation. The PCW log would be created at the path c:\PCWPrimary.txt.

====================================================================

@echo off

Rem Set ServerName to the SQL Server Instance
Set ServerName=SQLBOXNAME

Rem Do not Change this
Set ConfigDBName=WSS_Config

Rem Set SetupAccount to the TFS Setup Account
Set SetupAccount=Domain\TFSSetup

Rem Set Serviceaccount to the TFS Service Account
Set ServiceAccount=Domain\TFSService

Rem Set ServicePassword to the password of the TFSService Account
Set ServicePassword=P@ssw0rd

Rem Do not change this
Set AdminDBName=WSS_AdminContent

Rem Set WSSDIRPATH to the bin folder in the install location of WSS 3.0
Set WSSDIRPATH="C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN"

Rem Set WSS Admin's email
Set AdminEmail=user@domain.com

Rem Do not Change this
Set ContentDBName=WSS_Content

@echo on

@Echo ---- Dumping the PCW log at c:\PCWPrimary.txt ----

@echo off

Pause

CLS

cd %WSSDIRPATH%

Cls

@echo on

Rem Run Psconfig to create config & admincontent dbs & to provision the Central Admin Site

psconfig -cmd configdb -create -server %ServerName% -database %ConfigDBName% -user %ServiceAccount% -password %ServicePassword% -admincontentdatabase %AdminDBName% -cmd helpcollections -installall -cmd secureresources -cmd installfeatures -cmd adminvs -provision -port 17012 -windowsauthprovider onlyusentlm -cmd applicationcontent -install > "c:\PCWPrimary.txt"

Rem Extend the default web site

STSADM.EXE -o extendvs -url http://%ServerName%:80 -ownerlogin %SetupAccount% -owneremail %AdminEmail% -exclusivelyusentlm -databaseserver %ServerName% -databasename %ContentDBName% -donotcreatesite -description "Default Web Site"

IISReset

Rem Create the root site collection

stsadm -o createsite -url http://%ServerName% -ownerlogin %SetupAccount% -owneremail %AdminEmail% -sitetemplate STS

@echo All Operations completed succesfully..

@echo Please check C:\PCWPrimary.txt for details..

================================================================================