与 TFS 2015 的交互（本地）

Question

我正在为特定 TFS 集合创建一个包含所有 TFS 项目、用户及其关联的 TFS 组的导出文件。 （使用 ITeamProjectCollectionService、IIdentityManagementService）

我注意到我还收到了禁用的 AD 用户。如何从该列表中过滤禁用的 AD 用户？我无法直接访问 AD 环境。 Microsoft.TeamFoundation.Server.Identity 不包含此属性。

        Uri configurationServerUri = new Uri(environmentConfig.Uri);
        TfsConfigurationServer configurationServer = TfsConfigurationServerFactory.GetConfigurationServer(configurationServerUri);
        var tpcService = configurationServer.GetService<ITeamProjectCollectionService>();
        foreach (TeamProjectCollection tpc in tpcService.GetCollections())
        {
            var tfsProjectCollection = new TfsTeamProjectCollection(new Uri(environmentConfig.Uri + "/" + tpc.Name), environmentCredential);

            var vcs = tfsProjectCollection.GetService<VersionControlServer>();
            var sec = tfsProjectCollection.GetService<IGroupSecurityService>();

            var teamProjects = vcs.GetAllTeamProjects(false);
            foreach (var teamProject in teamProjects)
            {
                var appGroups = sec.ListApplicationGroups(teamProject.ArtifactUri.AbsoluteUri);

                foreach (var group in appGroups)
                {
                    Identity[] groupMembers = sec.ReadIdentities(SearchFactor.Sid, new string[] { group.Sid }, QueryMembership.Expanded);
                    foreach (Identity member in groupMembers)
                    {
                        if (member.Members != null)
                        {
                            foreach (string memberSid in member.Members)
                            {
                                Identity memberInfo = sec.ReadIdentity(SearchFactor.Sid, memberSid, QueryMembership.Expanded);
                                if (memberInfo.Type != IdentityType.WindowsUser)
                                    continue;

                                result.Add(new TfsPermission { Collection = tfsProjectCollection.Name, TeamProject = teamProject.Name,
                                    User = memberInfo.AccountName, Domain = memberInfo.Domain, Group = group.DisplayName });
                            }
                        }
                    }
                }
            }
        }

最好的问候， 延斯

Answer 1

您可以使用memberInfo.Domain == "DomainName"来判断此账号是否为AD账号。通常，如果一个身份是添加到 TFS 中的 windows 帐户，它的memberInfo.Domain 属性等于服务器名称而不是域名。

foreach (string memberSid in member.Members)
{
      Identity memberInfo = sec.ReadIdentity(SearchFactor.Sid, memberSid, QueryMembership.Expanded);
      if (memberInfo.Type == IdentityType.WindowsUser && memberInfo.Domain == "DomainName")
      {
                                result.Add(new TfsPermission
                                {
                                    Collection = tfsProjectCollection.Name,
                                    TeamProject = teamProject.Name,
                                    User = memberInfo.AccountName,
                                    Domain = memberInfo.Domain,
                                    Group = group.DisplayName
                                });
       }
}

然后检查这些帐户是否在 AD 中被禁用，就像 Starain 说的那样，使用 TFS API 无法做到这一点。但是您可以使用下面的这种方法可以帮助您检查上面的每个帐户是否在 AD 中被禁用：find if user account is enabled or disabled in AD

const string accountName = "name"; // The accountName of AD user
var principalContext = new PrincipalContext(ContextType.Domain, "domainNameHere", "AdminUser", "AdminPass");
var userPrincipal = UserPrincipal.FindByIdentity(principalContext, accountName);

if (userPrincipal != null)
{
    var dirEntry = userPrincipal.GetUnderlyingObject() as DirectoryEntry;
    var status = IsAccountDisabled(dirEntry);

}

//Jugde if it is disabled in AD
public static bool IsAccountDisabled(DirectoryEntry user)
{
        const string uac = "userAccountControl";
        if (user.NativeGuid == null) return false;

        if (user.Properties[uac] != null && user.Properties[uac].Value != null)
        {
            var userFlags = (UserFlags)user.Properties[uac].Value;
            return userFlags.Contains(UserFlags.AccountDisabled);
        }

        return false;
}

但是，memberInfo.Type 只能区分身份是用户帐户还是 TFS 组。众所周知，当您设置某人的权限时，您会选择添加一个帐户或一个 TFS 组。