Accessing Team System via the Internet
If you want to
provide remote access to Team System over the internet, you may be in for a surprise:
Microsoft only officially supports remote access to Team Sysem through VPN!That's kind of a bummer. Rob Caron
elaborates:
Team Foundation client applications, such as Team Explorer, access Team Foundation Server functionality through a collection of Web services hosted on Internet Information Services (IIS) 6.0. The initial RTM release of Team Foundation Server only supports Integrated Windows Authentication, which allows clients to use their Windows credentials to access this functionality.
Integrated Windows Authentication [previously known as NTLM] is an ideal choice for most deployment scenarios in a corporate environment, but it is not an optimal choice in Internet scenarios due to limitations resulting from proxy servers, firewalls, and trusted connections. For this reason, we originally planned to support Basic and Digest authentication as well.
Unfortunately, we were not able to complete this implementation in time to ship with the initial RTM release of Team Foundation Server. We are continuing to work on adding this support in the near future, which should be available sometime soon after the release of Team Foundation Server. However, this means that Team Foundation Server does not immediately support some scenarios, such as accessing Team Foundation Server through a proxy that does not maintain a connection between the client and server.
Team Foundation Server is driven through a collection of web services, which you can plainly see if you browse IIS on the web tier:
This is all standard IIS 6 stuff, which means you can expose these web services securely through
HTTPS and SSL. Right click the website and select Properties, then visit the Directory Security tab. It's right there under the Secure communications group:
But there's a catch:
some proxies don't properly pass NTLM/IWA credentials, so even though users may be able to get to these web services via HTTPS and SSL, they may not be able to successfully authenticate. It all depends what kind of proxies they're passing through on the way to your site.
There's a
walkthrough on setting up SSL for Team Foundation Server on the
Configuration and Management of Team Foundation Server Quickstart page, but clicking on that link results in, err..
well, nothing. Yet. I'm sure eventually there will be an article of the high quality we typically expect from MSDN in the spot of that.. placeholder text.
In the meantime, I found Ognjen Bajic's Word-to-HTML transcribed walkthrough,
Enabling Team Foundation Server SSL. I think it's a bit more complex than it needs to be, but it's definitely a good starting point for those of us interested in
exposing VSTS through the internet without VPN.