Chapter 4: Setting Up Security

Overview

Security. It seems like no matter which way you turn in the IT world today, you run into that word. And for good reason. As our world becomes more and more connected, security becomes even more important. Team Foundation Server was built with security in mind, with the idea that the server be easy to secure yet also easy to manage.

To really understand how to secure Team Foundation Server, you need to look at three different categories. First, you need to examine the environment in which the Team Foundation Servers are deployed. Next, you need to look at how users to Team Foundation Server are authenticated. Finally, you need to understand how users are authorized to perform specific actions using Team Foundation Server. Most of this chapter covers authorization, but let's touch on the other two points briefly.

In your environment, you want to make sure that your clients can talk to the Team Foundation Server application tier, that the Team Foundation Server application tier can talk to the database tier, and that any unauthorized connections are not allowed. As mentioned in Chapter 2, several different ports need to be maintained to allow the different pieces of Team Foundation Server to communicate effectively. As well, be advised the database tier server(s) and the application tier server(s) must be on the same network segment, and cannot be separated by firewalls. You can also use HTTPS and Secure Socket Layer (SSL) to use the Team Foundation Server Web services, as opposed to using the default HTTP connections. This provides one more layer of protection for your system.

You should be aware though, that HTTPS and SSL provide point-to-point security between the client tier and the application tier only. Any data located on the client tier, application tier, or data tier is still readable by anyone with access to the machine, such as administrators. Team Foundation Server does not use any sort of data encryption. So, if you are working with any kind of security sensitive data, you might require some sort of additional measure, such as an application to sit between Team Foundation Server and the client tier, which could encrypt the information.

Windows integrated authentication is used in several different places to ensure valid accounts are being used:

• Between Team System clients and the Team Foundation Server application tier

• Between the Team Foundation Server application and data tiers

User and groups that are being authenticated can be members of an Active Directory domain, or members or a workgroup tied to the servers. Integrated authentication provides the best secure method of authenticating your users, as opposed to basic clear text authentication, which sends the password unencrypted in the communication.

Important

Integrated authentication is also referred to as strong authentication.

The rest of this chapter covers how users are authorized to perform specific actions in Team Foundation Server. You will learn about the security model used by Team Foundation Server, and how to modify each aspect of that model, using both a graphical user interface (GUI) and the command-line tools. We cover some of the security access problems that are commonly encountered, and finish the chapter with a look at some best security practices concerning Team Foundation Server.