Permissions Bug with Beta 3 and Active Directory Groups?

Permissions Bug with Beta 3 and Active Directory Groups?

• John Lawrence MSFT

  Dan,

  We would like to add our vote to this fix for 50+ developers.  While no longer a blocking issue due to the workarounds identified here, this is also the cause of many of our problems previously discussed at http://forums.microsoft.com/MSDN/ShowPost.aspx PostID=171407&SiteID=1&mode=1

  Thank you.

  
  

• AlexYe

  Thanks. These are great repro steps.
  I'll make sure that a product bug gets filed and we'll investigate this.
  
  In the meantime (given that I'm not an AD expert), can you indicate how important it is for your organization for TFS to support Primary Groups   How and why are they typically used
  
  Thanks, 
  
  

• TareyWolf

  Not quite.  Use the following modification of your steps:
  
  1) You have a Windows 2003 AD Security group, called ADGroup, with N windows identity accounts - Yes
  2) In some of the N windows accounts, change the Primary Group in Active Directory Users and Computers on the "Members Of" tab so that the Primary Group is ADGroup.  On the remainder of the accounts, let the Primary Group be Domain Users or something else.  This step is very important.
  3) You added ADGroup (via the Team Foundation Server Settings->Group Membership...) by adding the Windows Identity ADGroup to a Team Foundation Application Group (such as Team Foundation Administrators). - Yes, I used Contributors group for a specific project, however.
  4) Click on properties for Team Foundation Administrators (project Contributors in my case), and does the ADGroup appear -- Here what happens is ADGroup appears, but if you use the Properties button to display its members, the accounts that are set to ADGroup as the Primary Group will not show but the ones that are set to another group will appear.  Consequently, the permissions for the missing accounts are not what is desired.

  
  

• tennisguy

  If you add the new security group to (say) the TFS contributors group, then you should be able to open this security group and should see all the members of the group, and hence those users should be granted the permissions that are granted to the TFS contributors.
  
  
  

• Sérgio Brito

  This bug has been fixed for RTM and the December CTP.  Please note that the December CTP is NOT part of the go live license, and should NOT be used for production.  There is no upgrade path from Beta 3/Beta 3 Refresh to the December CTP, and there will be no upgrade path from the December CTP to RTM.

  --Matt Hoover

  Visual Studio Team Foundation SDE

  
  

• Anil15

  Great - thanks!
  
  

• wurriedbunny

  Are you saying that in V1 you cannot see the members of a primary group that is added as a TFS application group   Even though you cannot see them, do they still have the respective rights (I don't think they do)   Are you saying to create another group that is not the primary group to basically mirror the primary group, and add that group into TFS
  
  Thanks.

  
  

• Evertone

  With the current implementation in V1 primary groups' memberships cannot be viewed.
  Have you tried adding the users who are in a primary group to a domain security group and included this security group into TFS application groups
  
  Thanks,

  
  
  

• Jonathan Kotthoff

  So that I can understand this issue, can you just verify:
  1) You have a Windows 2003 AD Security group, called ADGroup, with N windows identity accounts
  2) You added ADGroup (via the Team Foundation Server Settings->Group Membership...) by adding the Windows Identity ADGroup to a Team Foundation Application Group (such as Team Foundation Administrators).
  3) Click on properties for Team Foundation Administrators, and does the ADGroup appear Can you see the individual members of ADgroup by selecting it and clicking properties

  
  
  

• yaron nahari

  Yes - precisely.
  Can you create a mirror of the primary group and add that group to TFS
  
  

• Jeff Dion

  We're evaluating this right now, and we'll let you know whether this fix makes it into RTM.
  
  

• reesthil

  That's basically what I've already done.  Is this going to be fixed for RTM

  
  

• PhillipM

  If you run anything with Unix servers that use SMB applications such as samba it becomes very important so that you can synchronize the Unix groups with the Windows groups.  I think it also has impact on Macintosh clients but I'm not familiar with this operation.
  
  The user is always a member of a primary group and if the wrong group is selected, even if you're not using Unix or Mac systems, he will experience this problem with permissions.  It may be quite difficult for the end user to determine what the root cause of the problem is.
  

• casaubon

  I have basically done that.  That's how I discovered this in the first place.  But my question still is just because the membership is not viewable, are the permissions actually set
  
• Permissions Bug with Beta 3 and Active Directory Groups?