TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Team Foundation Server Authentication Methods

15 posts · Dec 2005 – Sep 2017

What this trail covers

This thread tracks the evolution of Team Foundation Server (TFS) and Azure DevOps Server authentication methods and client interactions. It includes updates on local workspaces for improved offline experience, default workspace settings, and the integration of the Feedback client via URI schemes for Windows 8 applications and ASP.NET. The focus is on enabling seamless interaction with TFS/Azure DevOps from various application contexts. This post specifically addresses updating licensing and enabling Kerberos authentication by default in TFS 2017, moving away from explicit NTLM selection to comply with security best practices and the Security Development Lifecycle (SDL). The Negotiate provider is now used by default, falling back to NTLM if Kerberos is not available, aiming to improve security without impacting existing deployments.

All Microsoft trails
  1. Visual Studio Team Services Encryption at RestThis post details the adoption of Azure SQL Database Transparent Data Encryption (TDE) and Azure Storage Service Encryption (SSE) for data at rest in Visual Studio Team Services (VSTS). TDE encrypts data in SQL databases (work items, version control metadata, build metadata), while SSE encrypts data in Azure Storage blobs (attachments, version control files, build logs). Remaining work includes encrypting secondary data storage on VM disks (caches, index files, build/release data) using Azure Disk Encryption (ADE) where possible, and migrating PaaS VMs to IaaS VMs. Encryption for Azure Storage Tables (package management, cloud load testing metadata) is also planned.
  2. Team Foundation Server 2017 and Kerberos AuthenticationTFS 2017 updates the default security support provider for Windows Authentication from NTLM to Negotiate. This change aligns with SDL recommendations to prioritize Kerberos over NTLM due to NTLM vulnerabilities. The Negotiate provider attempts Kerberos first and falls back to NTLM. This change aims to enhance security by enabling Kerberos for machine accounts without user intervention, while ensuring compatibility for existing deployments. The explicit selection of security support providers has been removed to simplify configuration.
  3. How to connect to TF Service without a prompt for LiveID credentialsThis post explains how to connect to Team Foundation Service without being prompted for LiveID credentials by enabling and using 'alternate credentials'. This is particularly useful for applications or web services that need to connect programmatically.
  4. Set Local Workspaces as Default when Upgrading to TFS 2012Details the post-upgrade steps for administrators to set local workspaces as the default for Team Foundation Server 2012 team project collections. This ensures developers receive notifications to convert their existing server workspaces to local ones, enabling them to leverage the new local workspace functionality which improves offline experience and removes the read-only bit for unchecked-out version control items.
  5. Getting Started with PreEmptive Analytics for Team Foundation ServerThis post details the practical steps and configuration required to integrate PreEmptive Analytics for Team Foundation Server (PA for TFS) into an application development workflow. It outlines the installation process, the use of specific attributes for application instrumentation (ApplicationAttribute, BusinessAttribute, SetupAttribute, TeardownAttribute, ExceptionTrackAttribute), the role of Dotfuscator in building instrumented executables, and the configuration of the Aggregator to link application data to TFS Team Projects. It also highlights the creation of Incident work items in TFS for actionable issue tracking.
  7. Enable Remote Audio Capture to when Testing or Providing Feedback on Remote MachinesThis post details how to enable remote audio capture for feedback and testing sessions on remote machines by configuring audio redirection settings and enabling "record from this computer" in Remote Desktop Connection. It also covers setting a default microphone on the local computer.
  8. Launching the Feedback client from a Windows 8 application using Team Foundation Server PreviewThis post introduces the use of the `mfbclientS` URI scheme for launching the Feedback client from Windows 8 applications, contrasting it with the `mfbclient` URI for on-premise TFS instances. It provides specific code examples using `Windows.System.Launcher.LaunchUriAsync` for Windows 8, `Page.ClientScript.RegisterStartupScript` for ASP.NET, and `Process.Start` for Windows Forms, demonstrating how to launch the feedback client with parameters like server address, collection, team project, and feedback request item IDs.
  9. Creating Team Foundation Server 2012 Lab Management Standard Environments and getting error “Verify that the machines are accessible using the user name and password provided”Details a specific troubleshooting step for setting up Team Foundation Server 2012 Lab Management standard environments, focusing on resolving the "Verify that the machines are accessible using the user name and password provided" error when using non-domain-joined machines. The solution involves disabling "Remote User Access Control" by modifying the `LocalAccountTokenFilterPolicy` registry entry to `1`.
  10. After upgrading to TFS 2012: Updating licensing and enabling async checkout for server workspacesThis post highlights two post-upgrade configurations for TFS 2012: updating licensing information and enabling asynchronous checkout for server workspaces. It references a previous post on upgrading team project settings and provides guidance on how to perform these specific tweaks to leverage new features.
  11. Using Microsoft Visual Studio 11 Beta Feedback Client tool with Windows 8 Metro Style applicationsThis post details the integration of the Visual Studio 11 Beta Feedback Client tool with Windows 8 Metro Style applications. It explains that for these applications, the Feedback Client is expected to be connected via a remote session using Remote Desktop Connection (MSTSC.exe) or the simulator integrated into Visual Studio 11 Beta. It provides links to MSDN documentation for running Windows 8 Metro style applications, using the Feedback client, and an overview of new testing features in Visual Studio 11.
  12. Team Foundation Service December UpdateThis post announces a significant update to the hosted Team Foundation Service, introducing new functionality beyond bug fixes. Key changes include a complete redesign of the top-level navigation in the web UI to improve clarity and reduce clicks, richer homepages with visualizations of project status (team capacity, burndown) and "Team Favorites" (work item queries, build definitions, source control folders), and a simplified web UI for single-team projects by collapsing team project and team pages. Performance improvements are highlighted, particularly for Agile project management features, with response times for some pages dropping by 75%. Email notifications are introduced with basic and advanced UI for managing subscriptions. Forecast lines are added to the product backlog to project iteration boundaries based on team velocity and backlog item estimates. Taskboard editing is enhanced with in-tile editing for "assigned to" and "remaining work" fields.
  13. Installing the Advanced Configuration of TFS 11 from the BUILD Conference in AnaheimThis post details the advanced configuration option for TFS 11, focusing on the installation process. It covers prerequisites such as SQL Server and Reporting Services, and the integration with SharePoint Foundation 2010. The post walks through the installer steps, highlighting configuration choices for service accounts, website settings, reporting services, analysis services, and SharePoint farm administration. It also references existing guides for SQL Server and SharePoint installation for TFS 2010, noting that the steps remain the same for TFS 11.
  14. VS ALM Library Updates on MSDN for June 2010This post details updates to the ALM Library for TFS 2010, including manual configuration of MOSS 2010 for TFS 2010 dashboards with a screencast, new content for Team Explorer Everywhere (TEE) covering workspace, log files, cache, automation via tf command-line, and installation. It also updates Agile Process Guidance for 'Unplanned Work', overhauls the 'Creating and Customizing Reports' topic with more context and BI tool references, and adds/updates several topics related to testing, including load test troubleshooting, managed references for TestManagement.Client, command-line test execution, automated test runs from test plans, and the test attachment cleaner tool. Prerequisites for code coverage and unit testing (Visual Studio Ultimate/Premium) are clarified. Links to lab-related videos are added for virtual environment and lab usage. Team Foundation SDK content is updated with VB samples and new version control API samples for adding, editing, branching, and deleting. Finally, the TFS and Project Server Integration Feature Pack documentation is updated with a topic on verifying the synchronization process and XML elements for work item type definitions, emphasizing Classic Mode Authentication for SharePoint web applications.
  15. VS ALM Library Updates on MSDN for May 2011This post updates the documentation for Team Explorer Everywhere, specifically focusing on command-line authentication scenarios and connection profiles. It details how to authenticate to the version-control server using domain or workgroup credentials, the use of the `login` option, and the `TF_AUTO_SAVE_CREDENTIALS` environment variable for saving credentials. It also introduces the concept of connection profiles for managing different sets of credentials. Additionally, it provides updated content on configuring Microsoft Office SharePoint Server (MOSS) 2010 with TFS 2010, including troubleshooting common issues with the MOSS Configuration Tool, and clarifies the permissions required for TFS installation on SQL Server and for TFS service accounts.
  16. Sample Code: Connect to Team Foundation ServerProvides C# code examples for programmatically connecting to Team Foundation Server, listing team project collections and team projects, and accessing various TFS services through TfsConfigurationServer and TfsTeamProjectCollection classes.
  17. Walkthrough: Setting up Team Foundation Server to Require HTTPS and Secure Sockets Layer (SSL)This post details the process of configuring Team Foundation Server to require HTTPS and SSL for secure communication. It outlines the steps for obtaining and installing an SSL certificate, configuring IIS to use the certificate, and updating TFS to leverage the secure connection. The goal is to enhance the security of data in transit between clients and the TFS server.
  18. Walkthrough: Setting up Team Foundation Server with Secure Sockets Layer (SSL) and an ISAPI FilterThis post details the configuration of Team Foundation Server (TFS) to use Secure Sockets Layer (SSL) for secure communication, along with the integration of an ISAPI filter. It provides a walkthrough for setting up SSL with IIS and TFS, including obtaining and installing an SSL certificate, configuring IIS to use SSL, and setting up the ISAPI filter for enhanced security. The documentation is finalized and available on MSDN.
  19. Answer to an e-mail comment on Move TFS from one Domain to anotherThis post addresses a specific issue encountered when moving TFS from one domain to another: SQL Server database ownership problems due to invalid domain accounts. It references an existing blog post for general steps and highlights the `TfsAdminUtil ChangeAccount` utility as the solution for correcting database ownership.
  20. Trusts and Forests Considerations for Team Foundation ServerThis post details the trust relationship requirements between Team Foundation Server components (clients, application-tier server, proxy, data-tier server, build) and Active Directory domains/forests. It outlines supported Active Directory modes and functional levels, and specifies the minimal trust relationships required for secure and stable operation, including one-way trusts between domains for user and service account authentication. It also covers considerations for cross-forest trusts and security best practices for domain environments.
  21. Team Foundation Server Security ConceptsThis post details Team Foundation Server security concepts, breaking them down into topology, authentication, and authorization. It explains the importance of understanding network protocols, ports, and services, and how to deploy TFS in Active Directory domains or workgroups. It emphasizes the difference between authentication and authorization, and the security implications of using Windows integrated authentication versus SQL Server Authentication. The post also outlines required services on application-tier and data-tier servers.