Not able to use TFVC; Getting Forbidden (403)

[nishantkagrawal]

I am trying to use the extension version 1.116 for TFVC. I am getting, Failed Request: Forbidden (403) - Access Denied: Agrawal, Nishant K. needs the following permission(s) to perform this action: Edit instance-level information. The error appears in the bottom left corner when I hover on the text "Team" with a warning icon.

I have been succesfully using Visual Studio 2015 to perform TFS operations on the same repository. This repository is a local workspace with multiple code base in it.

Moreover I have other workspaces configured within my TFS. Some of them are server, some of them local.

Despite the error, I am able to see changes in the Source Control Pane. But I see changes for the entire project instead of the folder that I am currently in. And when I click on any of the change, it gives me the same error message.

I set the logging level to debug and here is the log:

2017-04-13T06:37:59.344Z - debug:  [17324] Looking for an External Context at D:\TFS\MyFolder\MyCode
2017-04-13T06:37:59.344Z - debug:  [17324] No External Context at D:\TFS\MyFolder\MyCode
2017-04-13T06:37:59.345Z - debug:  [17324] Looking for TFVC repository at D:\TFS\MyFolder\MyCode
2017-04-13T06:37:59.346Z - debug:  [17324] TFVC Creating Tfvc object with localPath='undefined'
2017-04-13T06:37:59.346Z - debug:  [17324] Using TFS proxy: undefined
2017-04-13T06:37:59.346Z - debug:  [17324] TFVC Retrieved from settings; localPath='C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\tf.exe'
2017-04-13T06:37:59.347Z - debug:  [17324] TFVC Repository created with repositoryRootFolder='D:\TFS\MyFolder\MyCode'
2017-04-13T06:37:59.347Z - debug:  [17324] TFVC Repository.CheckVersion
2017-04-13T06:37:59.348Z - debug:  [17324] TFVC: tf add -noprompt -?
2017-04-13T06:37:59.357Z - debug:  [17324] TFVC: spawned new process (duration: 8ms)
2017-04-13T06:37:59.365Z - debug:  [17324] TFVC: spawned new process (duration: 8ms)
2017-04-13T06:37:59.713Z - debug:  [17324] TFVC: add exit code: 0 (duration: 365ms)
2017-04-13T06:37:59.715Z - debug:  [17324] TFVC Repository.FindWorkspace with localPath='D:\TFS\MyFolder\MyCode'
2017-04-13T06:37:59.715Z - debug:  [17324] TFVC: tf workfold -noprompt ********
2017-04-13T06:37:59.723Z - debug:  [17324] TFVC: spawned new process (duration: 7ms)
2017-04-13T06:37:59.869Z - debug:  [17324] TFVC: workfold exit code: 0 (duration: 152ms)
2017-04-13T06:37:59.870Z - debug:  [17324] Found a TFVC repository for url: 'http://tfstta.mydomain:8080/tfs/defaultcollection' and team project: 'BlueMoonAUTax'.
2017-04-13T06:37:59.873Z - debug:  [17324] Parsing values from repositoryInfo as string url
2017-04-13T06:37:59.874Z - debug:  [17324] TFVC Creating Tfvc object with localPath='undefined'
2017-04-13T06:37:59.874Z - debug:  [17324] Using TFS proxy: undefined
2017-04-13T06:37:59.874Z - debug:  [17324] TFVC Retrieved from settings; localPath='C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\tf.exe'
2017-04-13T06:37:59.875Z - debug:  [17324] TFVC Repository created with repositoryRootFolder='D:\TFS\MyFolder\MyCode'
2017-04-13T06:37:59.875Z - debug:  [17324] No account-specific token or global token found.
2017-04-13T06:37:59.950Z - debug:  [17324] Started ApplicationInsights telemetry
2017-04-13T06:37:59.950Z - info:   [17324] Getting repository information with repositoryInfoClient
2017-04-13T06:37:59.950Z - debug:  [17324] RemoteUrl = http://tfstta.mydomain:8080/tfs/defaultcollection
2017-04-13T06:37:59.951Z - debug:  [17324] Getting repository information for a TFVC repository at http://tfstta.mydomain:8080/tfs/defaultcollection
2017-04-13T06:37:59.952Z - debug:  [17324] Parsing values from repositoryInfo as string url
2017-04-13T06:37:59.967Z - debug:  [17324] Validated the TFS TFVC repository. Collection name: 'defaultcollection', Url: 'http://tfstta.mydomain:8080/tfs/'
2017-04-13T06:37:59.967Z - debug:  [17324] Getting project collection...  url: 'http://tfstta.mydomain:8080/tfs/', and collection name: 'defaultcollection'
2017-04-13T06:38:03.196Z - error:  [17324] Failed Request: Forbidden(403) - Access Denied: Agrawal, Nishant K. (TR Technology & Ops) needs the following permission(s) to perform this action: Edit instance-level information Error: Error: Failed Request: Forbidden(403) - Access Denied: Agrawal, Nishant K. (TR Technology & Ops) needs the following permission(s) to perform this action: Edit instance-level information
2017-04-13T06:38:03.196Z - debug:  [17324] Error: Failed Request: Forbidden(403) - Access Denied: Agrawal, Nishant K. (TR Technology & Ops) needs the following permission(s) to perform this action: Edit instance-level information
2017-04-13T06:38:03.199Z - debug:  [17324] TFVC Repository.CheckVersion
2017-04-13T06:38:03.199Z - debug:  [17324] TFVC: tf add -noprompt -?
2017-04-13T06:38:03.205Z - debug:  [17324] TFVC: spawned new process (duration: 5ms)
2017-04-13T06:38:03.222Z - debug:  [17324] TFVC: add exit code: 0 (duration: 22ms)
2017-04-13T06:38:03.223Z - debug:  [17324] TFVC Repository.GetStatus
2017-04-13T06:38:03.223Z - debug:  [17324] TFVC: tf status -noprompt -format:detailed -recursive
2017-04-13T06:38:03.230Z - debug:  [17324] TFVC: spawned new process (duration: 6ms)

Edit : We are on TFS 2015 Update 3.

Please let me know if more information is needed.

[nickyoung23]

I am also getting the same issue. Same error message trying to perform any TFS operations using Visual Studio Code, performing the same operations in Visual Studio 2017 works fine.

TFS server in this case is 2017 Update 1 and the local workspace is a newly created one.

[joshjohanning]

Same issue. Does this extension only work when Basic Auth is turned on the TFS server?

[jeffyoung]

Hi everyone. Thanks for trying out the TFVC support!

Based on this error message fragment, needs the following permission(s) to perform this action: Edit instance-level information, that's a good indication that the issue is related to TFVC permissions. Based on the log file (thanks for providing it!), the extension was able to connect to another server endpoint to validate the collection Url that was parsed out of the workfold command. So the connection to the server is authenticating fine in this case.

The next thing the extension needs to do is get information about the project collection (including the collection name, id and url) and it's at that point we get this error. Once it gets the project collection information, the extension goes out and gets the team project information (including the team project id, name, description and url). All of this information is needed to make additional calls to the server to get back work items, builds, etc.

I'll need to take some time and figure out which call is failing and why (which permissions are necessary). Failing that, perhaps there's another way to get the same information.

@soccerjoshj07 No, you don't need to enable Basic Auth on the server.

[jvsca]

Same here TFS 2015 U3.

[frodesigns]

Also having this issue on a newly set-up TFS 2015 Update 3.

[jeffyoung]

I've looked into this issue, understand the problem and am working on the solution. Unfortunately, it isn't one of those "one line" fixes and I don't have a solid ETA at this point.

[jeffyoung]

Hi everyone.

I'm finishing up some changes that should address this issue but would appreciate it if you could give the attached VSIX a try? You need to uninstall 1.116.0 and then side-load this VSIX. After downloading the ZIP file, you'll need to rename it to team-0.116.0.vsix (I had to add the .zip suffix so I could attach it here). Then, after selecting the Extension viewlet, click the ... menu and choose Install from VSIX... and then select that VSIX file.

I'd appreciate any feedback (whether it works, doesn't, etc.). Thanks!

team-0.116.0.vsix.zip

[nishantkagrawal]

The error is now gone. I can see the Collection name in the status bar. But still all the changes are listed in the Source Control window instead of just showing the changes in the current folder.

[paumayr]

Hi @jeffyoung, I tried the vsix you attached and it now works for me. Now, I just can't check in because I need to provide a code reviewer ...

[nickyoung23]

Thanks @jeffyoung, the version you attached works for me. I can check out, edit and check in successfully now.

[nishantkagrawal]

@jeffyoung : Correction, The status bar shows me the incorrect project name. I am connected to multiple projects, it is picking up the first one.

[jeffyoung]

Thanks for all of the feedback on that private build. I just released 1.116.1 with the fix.

@nishantkagrawal I believe that issue is the same as #175 (basically, you've mapped multiple team projects into a single workspace and the extension looks just at the first one).

@paumayr I'd like to hear more about that issue (including what the experience is) when the checkin fails. If you would, I'd appreciate a new issue for it (so I can keep the investigation all in one spot).

[joshjohanning]

@jeffyoung Does TFS on-premises need to have Basic Auth turned on for this extension to work? I am having troubles logging in.

[jeffyoung]

@soccerjoshj07 No, you don't need to enable Basic Auth on the server.

Can you have a look at the other open auth issues and see if any of those apply? If so, it'd be great if I could get your logs to have a look (add them to the issue that applies). If not, please open a new issue and supply as much information as you can. Thanks!