WSSSERVICE needs : Make requests on behalf of others

Question

I have a TFS 2010 was working fine and can access portals and display reports. All of a sudden, when I go to a portal I receive several messages, I strated to see the the folloing error message in several places

Access Denied: TFSDEV\WSSSERVICE needs the following permission(s) to perform this action: Make requests on behalf of others

For product backlog, work items list.......... Of course I checked the account, it has the mentioned permissions.

In the event viewer, I have the following error:

Detailed Message: TF30059: Fatal error while initializing web service

Web Request Details
    Url: http://tfsdemo:8080/tfs/_tfs_resources/Services/v3.0/LocationService.asmx/TeamFoundation/Administration/v3.0/LocationService.asmx [method: POST]
    User Agent

 

The only thing that has been changed is I recently added the Web deploy version tool in order to be able to deploy during a build.

 

Thanks for your help

 

Answer 1

Hi Eliassal, 

 

Thanks for your post.

 

The TFSDEV\WSSSERVICE account is your TFS 2010 Service Account? Please make sure that this TFSDEV\WSSSERVICE account has the Make request on behalf of others permission. In fact, you should ensure that the SharePoint Web Application Services and Team Foundation Service Accounts groups have the Make request on behalf of others permission(configure these groups’ permission in TFS Admin Console). For more information about Make request on behalf of others permission, please refer to: http://msdn.microsoft.com/en-us/library/ms252587.aspx.     

 

 If the TFSDEV\WSSSERVICE account already has that required permission when you occurred this issue, try connect to your Team Project using TFS Web Access, everything works fine in Web Access?     

 

If misunderstood anything, please describe your question in more detail and we will be able to provide the better responses.

---

John Qiao [MSFT]
MSDN Community Support | Feedback to us

Answer 2

Thanks, TFSDEV\WSSSERVICE is in the [Team Foundation]\Sharepoint Web application services group, Make request on behalf of others  is checked, also he is in the TFSDEV\TFS administrators group as well. Yes I can connect to TFS web but in this interface we don't have progress reports if I am not mistaken. I am a little bitsure that it is not a question of permissions as it was working very fine earlier.

Answer 3

John any news or feedback, I a stuck

Answer 4

Hi eliassal,

Please check the collection permission settings:

http://blogs.msdn.com/b/taylaf/archive/2009/12/04/introducing-tfs-impersonation.aspx

Thanks & Regards,

Jian-Wei Yu [MSFT]

Microsoft Online Community Support

 

--------------------------------------------------------------------------------

Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

 

Answer 5

Jian, correct I applied the tfssecurity for amin group and my dashboard is working. I have WSSSERVICE and TFSSericve accounts who should run the TFS services for me, does this mean I should do the same thing for those account  because whatt we see visually is not correct for them as well.Also, on another VM, where I test TFS in a distributed mode inside a domain (TFS, sql.....), whenever I display the sharepoint dashboard, I don't get this error but have 4 silverlight blue circles  turns and turns forever and reports are never displayed, should it be another security issue somewhere

Answer 6

Hi eliassal,

WSSService is for Windows SharePoint Services and TFSService is for TFS. The following articles discuss more information about the accounts in TFS and how configure thees permssions.

http://msdn.microsoft.com/zh-cn/library/dd578625.aspx

http://msdn.microsoft.com/zh-cn/site/dd631919

Thanks & Regards,

Jian-Wei Yu [MSFT]

Microsoft Online Community Support

 

--------------------------------------------------------------------------------

Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

 

Answer 7

Sorry I can not read chinese

Answer 8

Hi eliassal,

I am sorry. Please change the zh-cn in url to en-us, and the correct urls are:

http://msdn.microsoft.com/en-us/library/dd578625.aspx

http://msdn.microsoft.com/en-us/site/dd631919

Thanks & Regards,

Jian-Wei Yu [MSFT]

Microsoft Online Community Support

 

--------------------------------------------------------------------------------

Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Answer 9

I am experiencing the same issue, unfortunately when I give the "Team Foundation Service Accounts" grp access to "Make request on behalf of others", my whole tfs web dashboard becomes unavailable... weird huh? Any ideas? I am using the TFS service account for both TFS and my report service, is that going to be a major problem? Is that the problem?

---

May the Force be with you young Jedi...

Console.WriteLine("-Warren");

Please Help your Helper(s) =)
If you find someone's post helpful please click the green "up arrow" to the left and vote!
Did someone's post Answer your question? Mark it as the Answer!
It's Greatly Appreciated =)

Answer 10

All is well now, I had to reapply the TFS service account once making these changes.

---

May the Force be with you young Jedi...

Console.WriteLine("-Warren");

Please Help your Helper(s) =)
If you find someone's post helpful please click the green "up arrow" to the left and vote!
Did someone's post Answer your question? Mark it as the Answer!
It's Greatly Appreciated =)