After successfully migrating from TFS 2008 to 2010 (see my
previous post), I've faced the challenge of having to set up security. We're very small team of developers, so I was looking for the least-laborious way. So here it is:
1) Create domain users (i'll work with Dev1, Dev2, etc.). Create domain group "Company Developers" and put all the Dev1-n users in it.
2) In TFS Administration Console select "Application Tier".
a) Click "Group Membership". Then "New" to create new group - I named it "Developers". Then click "Properties", select "Windows User or Group", click "Add..." and enter the "Company Developers" domain group & close.
b)Back to "Application Tier". Now click "Administer Security", select the newly created "Developers" and in the list below check last 2 items - "Use full Web Access features" and "View instance-level information".
This step ensures that users from the Company Developers group can connect to the TFS server and see the list of collections.
3) Now one level down, still in TFS Admin Console, select "Team Project Collections" on left. In the detail select the "DefaultCollection" (or whatever collection you created).
a) Click "Group Membership" again and again create "Developers" TFS group (you actually may want to create multiple groups at this level, depending on your requirements). Then click "Properties..." and add either "Company Developers" domain group or individual Dev1, etc... if you work with multiple groups.
b) Click "Administer Security" and on the list below select whatever rights you want to assign (I recommend checking out how the TFS default groups are set to get an idea).
Ok, at this point, we've actually given rights to the users to access the "DefaultCollection". Still can't see any projects, but we're getting close.
4) Now open Visual Studio and in "Team Explorer" connect to the server (if you don't have that on the server, install Team Explorer from the TFS dvd). Once connected (providing you're logged in as administrator), you'll see all the projects in collection. Unfortunately, you DO HAVE TO set rights individually for each project.
So, select project, right-click and "Team Project Settings" -> "Security". There add TFS group "Developers" and set the rights below. If you created multiple groups in 3a, this is where you can use them, to distinguish who has access to what.
That's it. It's very basic, but this way you don't open your TFS too much and still have the flexibility to start being more granual in future should you require so.