与TFS 2015的互动（内部部署）

Question

I am creating an export file with all TFS projects, users and their associated TFS Groups for a specific TFS Collection. (using ITeamProjectCollectionService, IIdentityManagementService)

I noticed I receive also the disabled AD-users. How can I filter the disabled AD-users out of this list? I have no direct access to the AD-environment. The Microsoft.TeamFoundation.Server.Identity does not contain this property.

        Uri configurationServerUri = new Uri(environmentConfig.Uri);
        TfsConfigurationServer configurationServer = TfsConfigurationServerFactory.GetConfigurationServer(configurationServerUri);
        var tpcService = configurationServer.GetService<ITeamProjectCollectionService>();
        foreach (TeamProjectCollection tpc in tpcService.GetCollections())
        {
            var tfsProjectCollection = new TfsTeamProjectCollection(new Uri(environmentConfig.Uri + "/" + tpc.Name), environmentCredential);

            var vcs = tfsProjectCollection.GetService<VersionControlServer>();
            var sec = tfsProjectCollection.GetService<IGroupSecurityService>();

            var teamProjects = vcs.GetAllTeamProjects(false);
            foreach (var teamProject in teamProjects)
            {
                var appGroups = sec.ListApplicationGroups(teamProject.ArtifactUri.AbsoluteUri);

                foreach (var group in appGroups)
                {
                    Identity[] groupMembers = sec.ReadIdentities(SearchFactor.Sid, new string[] { group.Sid }, QueryMembership.Expanded);
                    foreach (Identity member in groupMembers)
                    {
                        if (member.Members != null)
                        {
                            foreach (string memberSid in member.Members)
                            {
                                Identity memberInfo = sec.ReadIdentity(SearchFactor.Sid, memberSid, QueryMembership.Expanded);
                                if (memberInfo.Type != IdentityType.WindowsUser)
                                    continue;

                                result.Add(new TfsPermission { Collection = tfsProjectCollection.Name, TeamProject = teamProject.Name,
                                    User = memberInfo.AccountName, Domain = memberInfo.Domain, Group = group.DisplayName });
                            }
                        }
                    }
                }
            }
        }

Best regards, Jens

Answer 1

You could use memberInfo.Domain == "DomainName" to judge if this account is an AD account. Usually, if an identity is an windows account that added in TFS, it memberInfo.Domain property equals a server name not the domain name.

foreach (string memberSid in member.Members)
{
      Identity memberInfo = sec.ReadIdentity(SearchFactor.Sid, memberSid, QueryMembership.Expanded);
      if (memberInfo.Type == IdentityType.WindowsUser && memberInfo.Domain == "DomainName")
      {
                                result.Add(new TfsPermission
                                {
                                    Collection = tfsProjectCollection.Name,
                                    TeamProject = teamProject.Name,
                                    User = memberInfo.AccountName,
                                    Domain = memberInfo.Domain,
                                    Group = group.DisplayName
                                });
       }
}

Then to check if those account is disabled in AD, like Starain said, using TFS API couldn't do that. But you could use this method below could help you check each account you get above if it is disable in AD: find if user account is enabled or disabled in AD

const string accountName = "name"; // The accountName of AD user
var principalContext = new PrincipalContext(ContextType.Domain, "domainNameHere", "AdminUser", "AdminPass");
var userPrincipal = UserPrincipal.FindByIdentity(principalContext, accountName);

if (userPrincipal != null)
{
    var dirEntry = userPrincipal.GetUnderlyingObject() as DirectoryEntry;
    var status = IsAccountDisabled(dirEntry);

}

//Jugde if it is disabled in AD
public static bool IsAccountDisabled(DirectoryEntry user)
{
        const string uac = "userAccountControl";
        if (user.NativeGuid == null) return false;

        if (user.Properties[uac] != null && user.Properties[uac].Value != null)
        {
            var userFlags = (UserFlags)user.Properties[uac].Value;
            return userFlags.Contains(UserFlags.AccountDisabled);
        }

        return false;
}

However, the memberInfo.Type could only distinguish the Identity is an user account or a TFS group. As we all know, when you set the permissions of someone, you will choose to add an account or a TFS group.