Access denied connecting to TFS server / (authenticating as [domain]\[username])

Question

Situation:

Eclipe 1.4.2

Microsoft Visual Studio TFS plugin 10.1.0

All is installed, whenever i want to connect to our tfs server at http://tfs.company.com:8181/tfs it every time returns: Access denied connecting to TFS server / (authenticating as [domain]\[username])

Foundation server is 2008, eclipse is running from my laptop, VS 2010 on my laptop connects without any problem. What can I do more to troubleshoot?

Receive the same error when running the TEE-CLC command line

Checked the TFS server and the laptops eventlog and nothing that indicates something is wrongly configured, any other pointers to check?

---

Need realtime FIM synchronization and advanced reporting? check out the new http://www.imsequencer.com that supports FIM 2010, Omada Identity Manager, SQL, File, AD or Powershell real time synchronization!

Answer 1

Is there anything int he Eclipse platorm log, or the Team Explorer log?

To View the logs...

1. Go to "Help > Team Explorer Support" in the Eclipse main menu.
2. Choose the "Platform Log" tab in the dialog.  Open the most recent log.
3. Choose "Team Explorer Logs".  Open the "in use" team explorer log (star in first column).

Thanks,
Rick

Answer 2

Unfortunately nothing is logged in the current logs for Team Explorer.

But we are some steps further.

When we access the url from inside our domain we receive the access denied message stated earlier, but when I am at home and access the same published url from over the internet (we have published the TFS server via the internet) it works without any problem.

So it has to do with authentication protocol somehow, when we connect internally we almost connect directly through the server, via the internet we connect via ISA, does it internally use NTLM or Kerberos and are both supported? do we need to change settings on the IIS site?

 

---

Need realtime FIM synchronization and advanced reporting? check out the new http://www.imsequencer.com that supports FIM 2010, Omada Identity Manager, SQL, File, AD or Powershell real time synchronization!

Answer 3

If you chose "use default credentials" in TEE, then TEE lets Windows do the authentication using the best method that can be negotiated with the server.  This can be Kerberos or NTLM, depending on client and server configuration, but TEE steps aside and has Windows choose the method and compute the authentication tokens.

If you entered a username, domain, and password in TEE (instead of using default credentials), then TEE will always use NTLM to authenticate to the server.

It's strange that it's working outside the corporate network, but not inside.  Is the client computer joined to a different domain than the TFS computer?

Answer 4

I have tried both option, providing username and password and use default credentials, both options did not work.

both inside and outside we connect to the url https://tfs.companyname.com:8181/tfs, when connecting from outside, it will be first ISA that is connected and the credentials will be forwarded (delegated) and this seems all to be OK.

When doing the same from inside TEE will directly connect to the TFS server and not via the ISA server (but still use the same url (https://tfs.companyname.com:8181/tfs) and it does not connect (i suspect is it trying to always do NTLM but the server refuses this) and yes both the client and the server belong to the same domain.

---

Need realtime FIM synchronization and advanced reporting? check out the new http://www.imsequencer.com that supports FIM 2010, Omada Identity Manager, SQL, File, AD or Powershell real time synchronization!