{"id":3691,"date":"2011-09-15T13:33:14","date_gmt":"2011-09-15T13:33:14","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/bharry\/2011\/09\/15\/configuring-a-build-server-against-your-shiny-new-hosted-tfs-account\/"},"modified":"2024-06-03T13:00:01","modified_gmt":"2024-06-03T20:00:01","slug":"configuring-a-build-server-against-your-shiny-new-hosted-tfs-account","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/bharry\/configuring-a-build-server-against-your-shiny-new-hosted-tfs-account\/","title":{"rendered":"Configuring a build server against your shiny new hosted TFS account"},"content":{"rendered":"

Now that you have a Team Foundation Service account, some of you are going to be interested in setting up a build machine to work with it.\u00a0 Richard Hundhausen did a very nice video<\/a> to walk you through this process but I\u2019m going to recap it because there\u2019s a few additional things I want to explain.\u00a0 If you watch his video, it\u2019s higher fidelity than this post but you might get some additional understanding here.<\/p>\n

First let\u2019s talk about options.\u00a0 You can install and configure a build machine to run against your Team Foundation Service account.\u00a0 You will have to use a TFS 11 build agent.\u00a0 The TFS build agent is part of the TFS install and is available to MSDN subscribers on the download site and will be available to everyone tomorrow (Friday 9\/16) at this url: http:\/\/go.microsoft.com\/fwlink\/?LinkId=225714<\/a><\/p>\n

You can install the build server on any machine you use \u2013 a workgroup machine at home, a domain machine at work, an Azure VM Role, an Amazon VM, whatever you like.\u00a0 TFS doesn\u2019t really care.\u00a0 The machine just has to have connectivity to the internet to get to tfspreview.com.<\/p>\n

Run the TFS installer on the machine you want to install the build controller\/agent on and you\u2019ll accept the license, copy the bits on to the machine, etc and then get an install screen like this.\u00a0 Since you are just installing a build server, you don\u2019t want to choose any of the Team Foundation Application Server wizard.\u00a0 You just want the Configure Team Foundation Build Service.\u00a0 Click on \u201cConfigure Team Foundation Build Service\u201d and then click the Start Wizard button at the bottom.<\/p>\n

\"Image<\/a><\/p>\n

You\u2019ll see a welcome page, click Next and see this.\u00a0 If this isn\u2019t what you see, try canceling and make sure you had the right wizard selected.\u00a0 This wants you to identify your team project collection\/account on the hosted service.\u00a0 You can\u2019t type here so just click the Browse button.<\/p>\n

\"Image<\/a><\/p>\n

\"Image<\/a><\/p>\n

And you\u2019ll see this.\u00a0 I\u2019ve not connected to a server from this machine before so there\u2019s no server for me to pick from.\u00a0 I click the Servers\u2026 button.<\/p>\n

\"Image<\/a><\/p>\n

And get the list of available servers \u2013 see there aren\u2019t any.\u00a0 I told you \"Image<\/a>\u00a0 So click the Add button.<\/p>\n

\"Image<\/a><\/p>\n

You can type the full url in the top line if you want but here, I\u2019m using the dialog controls.\u00a0 \u201cminka\u201d (that\u2019s actually the\nname of my farm \"Image<\/a>) is the name of the account so I give a name of minka.tfspreview.com.\u00a0 Then I click the https button (you have to use https to connect to the server for this).\u00a0 The url in the preview field is what I could have put in the top edit field if I had wanted to.<\/p>\n

\"Image<\/a><\/p>\n

Now I click OK and I go back to the previous window and close that and I see this.\u00a0 For our TFS Service, the team project collection is always called DefaultCollection and you can only have one.\u00a0 In the on premises product you can have more than one and name them whatever you want.\u00a0 Select DefaultCollection and click Connect.<\/p>\n

\"Image<\/a><\/p>\n

At this point you are connected and the url will be filled in the wizard page above.\u00a0 Click next on that wizard page and you\u2019ll go to the Build Services page.\u00a0 This allows you to configure how many agent you want running.\u00a0 The default is 1 per core but I don\u2019t really need to build 8 things in parallel on my little machine at home so I changed it to 2 and clicked Next.<\/p>\n

\"Image<\/a><\/p>\n

That takes me to the Settings page which controls how the build service runs on my local machine.\u00a0 Remember the build service itself runs on the machine I\u2019m installing it on and it needs some identity to run as.\u00a0 It\u2019s going to connect to my hosted account with a different identity but more about that in a minute.\u00a0 I created an account on my local machine called \u201cBuild\u201d.\u00a0 I could have called it anything I want or used the account I was logged in as.\u00a0 If I had been on a domain, I could have used Network Service but I\u2019m at home so I\u2019m just using a local machine account.\u00a0 BTW, while I was playing with this, I discovered that we don\u2019t support accounts with no password right now.\u00a0 That\u2019s a bug and we\u2019ll fix it.\u00a0 I\u2019m logged in to my 11 year old\u2019s account at home and he doesn\u2019t have a password \"Image<\/a>\u00a0 That\u2019s the only reason I went and created a new account just for the build service.<\/p>\n

The last thing you do is specify what port on your local machine you want the build service to use.\u00a0 This isn\u2019t the port on the hosted service but rather the one on your local machine.\u00a0 The default works for most people.<\/p>\n

Then there\u2019s that bit in the middle about authenticating with the hosted service and the Windows Credential Manager.\u00a0 Let\u2019s finish the wizard and then I\u2019ll talk about that.<\/p>\n

\"Image<\/a><\/p>\n

Click Next and you can review your choices and click Verify.\u00a0 Everything should Verify fine and you can click Configure.<\/p>\n

\"Image<\/a><\/p>\n

When configuration is done you\u2019ll get a completion screen that looks like this.\u00a0 You can now finish out the wizard and it will launch you into the TFS admin console.<\/p>\n

\"Image<\/a><\/p>\n

Click on the Build Configuration node on the left and see that you controller and agents are up and running and all is happy.\u00a0 You can close the admin console, go into VS, start creating build definitions and running builds.<\/p>\n

\"Image<\/a><\/p>\n

Now what about those funny credentials.\u00a0 There\u2019s up to 4 sets of credentials at play here:<\/p>\n

    \n
  1. What you are logged into the local machine you are installing as.\u00a0 As long as you have sufficient permissions to install that\u2019s all that really matters.<\/li>\n
  2. The account you configure the local build service to run as.\u00a0 That\u2019s what you entered into the wizard.\u00a0 I used a local account called \u201cBuild\u201d.\u00a0 Many people just use the account they are logged in as or, if they are on a domain \u2013 Network Service.<\/li>\n
  3. The Live ID that you log into your Team Foundation Service account with.\u00a0 It only plays a part here in that you have to authenticate with the service using that Live ID when you in the connect dialog sequence above.\u00a0 If the system hasn\u2019t saved those credentials you\u2019ll get a Live ID web page to log in.\u00a0 This makes sure that you have permission to configure a build machine against your account.\u00a0 You wouldn\u2019t want random people creating build machines against your account would you?<\/li>\n
  4. The service identity that the build agent uses to connect to your Team Foundation Service account \u2013 we sometimes refer to this as the \u201cProject Collection Identity\u201d.\u00a0 This is the bit of magic that the text in the above dialog is about.<\/li>\n<\/ol>\n

    Let me expound on #4\u2026\u00a0 The build service, running on your local machine, needs to talk to your hosted account.\u00a0 To do that it needs to authenticate (login).\u00a0 Unfortunately, it can\u2019t use your Live ID because Live ID doesn\u2019t support automated services authenticating.\u00a0 Fortunately, we use Windows Azure Access Control Services (aka ACS) to handle authentication and ACS supports something called service identities that are explicitly designed for this kind of scenario.\u00a0 The build setup wizard you\u2019ve just run uses the Live ID authentication you did when you connected to create a service identity for you and generates a random password.\u00a0 It then puts that password in the Windows Credential Manager for your local build service account.<\/p>\n

    When I look in my Windows Credential Manager for my local \u201cBuild\u201d account, I see:<\/p>\n

    \"Image<\/a><\/p>\n

    Note it\u2019s got my url https:\/\/minka.tfspreview.com\/defaultcollection<\/a> and an auto generated user name (the name of your ACS service account on the hosted service) \u2013 \u201cAccount Service (minka)\u201d.\u00a0 And it\u2019s got my auto-generated password.\u00a0 Please, please, please don\u2019t change it.\u00a0 That will only change your local copy (not the one on hosted TFS) and your build service won\u2019t work.\u00a0 Since you don\u2019t know what the auto-generated password is, you can\u2019t set it back.\u00a0 That means you are hosed.\u00a0 the only thing you can do is unconfigure the build service and reconfigure it from scratch.<\/p>\n

    Let\u2019s look at this in the admin console:\u00a0 If I click the \u201cProperties\u201d link on the build configuration page, I get a dialog like this.\u00a0 I need to click the \u201cstop to make changes\u201d link which stops the local build service while you make configuration changes.<\/p>\n

    \"Image<\/a><\/p>\n

    OK, now my local build service is stopped.\u00a0 Notice the two tabs at the bottom.\u00a0 The visible tab, \u201cServi\nce Identity\u201d is actually the account that your local build service runs as on your local machine.\u00a0 My computer is KIDS-PC and the account is Build.\u00a0 I can change that and save the changes and all will be well.<\/p>\n

    \"Image<\/a><\/p>\n

    The other tab, \u201cProject Collection Identity\u201d is what account the build service uses to talk with the server (in this case my hosted TFS account).\u00a0 For our hosted TFS service, I have to use an ACS Service Identity and I can\u2019t change it or the password (at least right now).\u00a0 We have not built any feature of the service to change either the ACS service account or its password.<\/p>\n

    \"Image<\/a><\/p>\n

    OK, that\u2019s some long gory details about exactly how it works.\u00a0 Most people need never know or care.\u00a0 Run through the wizard and it just \u201cdoes the right thing\u201d for you.\u00a0 But just in case you ever need to understand what is going on, now you do.<\/p>\n

    Have fun!<\/p>\n

    Brian<\/p>\n","protected":false},"excerpt":{"rendered":"

    Now that you have a Team Foundation Service account, some of you are going to be interested in setting up a build machine to work with it.\u00a0 Richard Hundhausen did a very nice video to walk you through this process but I\u2019m going to recap it because there\u2019s a few additional things I want to […]<\/p>\n","protected":false},"author":244,"featured_media":14617,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[5],"class_list":["post-3691","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-tfs"],"acf":[],"blog_post_summary":"

    Now that you have a Team Foundation Service account, some of you are going to be interested in setting up a build machine to work with it.\u00a0 Richard Hundhausen did a very nice video to walk you through this process but I\u2019m going to recap it because there\u2019s a few additional things I want to […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts\/3691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/users\/244"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/comments?post=3691"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts\/3691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/media\/14617"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/media?parent=3691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/categories?post=3691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/tags?post=3691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}