How to authenticate at https://tfspreview.com (MXcrosoft-hosted TFS) using a Java command line application?

Question

I am trying to access the https://tfspreview.com SOAP interface from my command line Java application. Unlike on-premises TFS, Live ID is used in this case, which results in a communication failure with the 302 redirection to their authentication service. I have no idea how to proceed with authentication.

Any pointers?

Answer 1

<tl; dr>

You can use Basic authentication to provide a carefree Team Foundation Service experience. Also, if you are not using the TFS SDK for Java , this may help you.

</ tl; dr>

Generally speaking, there are three types of credentials that you can use for authentication, and defines the mechanism that you use for authentication:

• Live identifier. As you noted, this requires logging into Windows Live with a web browser and using the resulting OAuth tokens for authentication.

• An optional password associated with your Live ID, which exists for basic authentication. Instructions for setting up this additional mapping are available in the August 27 announcement of this feature .

• Service account. In addition to the user list (indicated by the Live ID), your Team Foundation Service account also has a special user account that is used for functions such as build automation, etc. There is one service account for each Team Foundation Service account, and as the name implies, this is an administrator account.

Let's look at each option:

Live ID : Authentication with Live ID using OAuth will be difficult for your command line application. What Visual Studio does here is open Internet Explorer for tfspreview.com , which ultimately prompts you to enter your Live ID credentials. At this point, various OAuth cookies will be installed in your web browser. Because Visual Studio and Internet Explorer use the same basic HTTP connection mechanism, it can use the same cookies. With the Java command line client, you don’t have that luxury (unless you write it exclusively for Windows and want to write JNI to invoke the HTTP system library).

So what are your options? I suppose it's possible that you could follow the redirect you were given - at that point you will end up with a login page where you could GET your credentials and ultimately get an OAuth cookie from you which can then be used for authentication. But I suspect that this is probably not the way you want to go down. I strongly suspect that you need a useful dose of JavaScript to log in.

Basic authentication : This requires an additional step in the configuration, but they are simple and obvious. There is no reason not to use them.

Service Accounts : However, without a web browser, you can provide a WRAP token with your service credentials. You can view the service credentials for your account using the very useful TFS Service Credential Viewer . With the username and password of the service account, you can create a WRAP cookie for authentication. But at the moment, you are authenticating as a service account, not one of your user accounts.

If you do not want to contact WRAP tokens yourself, you can also use the Team Foundation Server SDK for Java to create a connection. Just pass your credentials as UsernamePasswordCredentials when creating TFSTeamProjectCollection . Even if you do not want to use the API methods for the server, you can get raw HTTPClient from this connection, and it will have all the necessary configuration settings. Interaction with the SDK will also be beneficial if we add new authentication mechanisms to the Team Foundation Service in the future, as the SDK API should not change much.