I wrote this article more as a reminder to myself on the process I need to go through to make a web application written in ASP.NET (MVC) that uses the TFS API to actually work. I have done this several times now but keep on forgetting some of the key information. Some of the errors you may get if you haven’t set this up correctly are.

Error HRESULT E_FAIL has been returned from a call to a COM component.

Microsoft.TeamFoundation.WorkItemTracking.Client.DataStore.DataStoreNative

There are two things you need to set correctly and they are your Web.Config and IIS.

Web.Config
The first port of call is to setup the following in your web.config. Basically we are saying we want to use Windows authentication in our app and to turn on impersonation.

 1 <system.web>
 2  <authentication mode="Windows" />
 3   <identity impersonate="true" />
 4   
 5   <authorization> 
 6   <deny users="?" />
 7 </authorization>
 8 </system.web>
 9   .
10   .
11   .
12  <system.webServer>
13      <validation validateIntegratedModeConfiguration="false"/>
14  .
15  .
16  </system.webServer>
17  

IIS Settings
The rest of the settings are dealt with in IIS.

Authentication
In IIS click on your website and then select Authentication from the Features menu. Set these to the following (as per the image). Basically ASP.NET Impersonation, Windows Authentication are set to enabled. Anonymous should be set to Disabled.

App Pool Settings
Go to advanced settings on your App Pool, one thing you may need to set here is “Enable 32-Bit Applications” if you are working with the TFS Client API (this can be found under (General))

Scroll down to Process Model and find an identity section. This for a newly created app is usually set under the App Pool Identity account. This needs to be set to either a domain account that has access on the box or I have seen the local system and local service accounts also work here. However I believe this is only the case if you have set TFS to run under one of these as a service. In my case I have used an AD account that has access to the box. The next important step here is to set “Load User Profile” to true. Setting this appears to be critical especially when working with the WorkItem Tracking Client. I believe it needs to create a cache on disk when it does this. Not setting the Load User Profile may prevent it from doing this.