none
Project 2010 Server permission settings

    Question

  • I am running a Project 2010 Server (with Sharepoint 2010) implementation that I've been working on for a few days now.  I'm logged into my Project Web App as the Administrator Account specified when I created the PWA.  I wanted to add a user to access the PWA and manage projects.  Sharepoint is set to synchronize with our Active Directory so I see all our users and groups.  When I go to SITE ACTIONS --> SITE PERMISSIONS and give the user FULL ACCESS, they log in and get ACCESS DENIED.  I cannot figure out why this does this.  IN all my other sharepoint sites (that aren't Project Web Apps) this works perfectly and everyone can access that has access.

    I noticed in the PWA Default page, there is a link for SERVER SETTINGS and under that is more Security settings as well as a way to sync Groups with Active Directory.  

    So my question is where exactly do I set permissions in my Project Web App?  Is it under SITE ACTIONS --> SITE PERMISSIONS or is it under SERVER SETTINGS / SECURITY in the site?  Are Project Web Apps handled differently than regular SharePoint sites?


    Thanks!

    Friday, July 15, 2011 11:01 PM

Answers

  • Adding your PM to Project server would happen in PWA | Server Settings | manage users.

    There you can add them manually.

    You can also link a project Server group to an AD group if you like.

     

    YES, project server security is NOT handled the same as your normal SP sites.

     

     


    --- Brian Kennemer Web: http://www.deltabahn.com Blog: http://www.projectified.com
    Friday, July 15, 2011 11:25 PM
    Moderator

All replies

  • Adding your PM to Project server would happen in PWA | Server Settings | manage users.

    There you can add them manually.

    You can also link a project Server group to an AD group if you like.

     

    YES, project server security is NOT handled the same as your normal SP sites.

     

     


    --- Brian Kennemer Web: http://www.deltabahn.com Blog: http://www.projectified.com
    Friday, July 15, 2011 11:25 PM
    Moderator
  • I see.  I was reading and kind of assumed after posting this that security is different here in PWA.  Instead of adding each user, I think I will just add the group from AD.  Thanks I'm looking into this now.
    Friday, July 15, 2011 11:27 PM
  • Kenny --

    To add to Brian's excellent answer, the best way to handle Project Server 2010 security for users is to add users to the default PWA groups.  For example, you should add any user who is managing enterprise projects to the Project Managers group.  For users who have high-level oversight of all projects in the Project Server system, but do not manage projects or people, add them to the Executives group.  For people who server only on project teams, and do not manage projects or people, add them to the Team Members group.  DO NOT both with attempting to add Categories to your user accounts, as this is absolutely NOT necessary, and do not set any permissions in the Global Permissions section for your users, as this is not needed either. When you add a user to a PWA Group, this automatically gives the user access to the Categories and Global Permissions specified in the PWA Groups to which you add them.

    Hope this little extra helps.


    Dale A. Howard [MVP]
    VP of Educational Services
    msProjectExperts
    http://www.msprojectexperts.com
    http://www.projectserverexperts.com
    "We write the books on Project Server"

    Friday, July 15, 2011 11:31 PM
    Moderator
  • NP. Security is pretty different in EPM vs. SP. Let us know if you need a hand. It can get a bit confusing when you first start
    --- Brian Kennemer Web: http://www.deltabahn.com Blog: http://www.projectified.com
    Friday, July 15, 2011 11:34 PM
    Moderator
  • Yes it is confusing.  I think I've got a grasp on it now however:  I am a member of the Domain Admins group in our Active Directory.  I added this Domain Admins group to sync with the Administrators group in PWA (under Site Settings --> Manage Groups).  Now when I click Active Directory Sync Options and force a Sync, it always says "Partial Fail" under the Last Sync column of the groups...

    I have no clue why.  AD Sync is working fine in sharepoint.  And the funny thing is at first I accidentally added the Domain Computers to the Administrators group (instead of Domain Admins) and it sync'd just fine, but of course my Domain Admins group didn't have access.  I have no clue where to look at logs or see if something is set incorrectly in PWA where AD is concerned.

     

    Thanks! You have already given me an abundance of knowledge on the PWA side of Share Point.

    Friday, July 15, 2011 11:42 PM
  • Weird, something must be up with my Domain Admins group in AD.  I just realized I have a SharePoint Admins group in AD as well that I could have used, when I selected it for the PWA Administrators group it sync'd just fine.
    Friday, July 15, 2011 11:45 PM
  • the sharepoint ULS logs will have something that might give more detail. you can filter them to see the project server related items.

     

    I thought I read somewhere along the way about issues synching the DA group. Try synching a different group and see what happens.


    --- Brian Kennemer Web: http://www.deltabahn.com Blog: http://www.projectified.com
    Friday, July 15, 2011 11:46 PM
    Moderator
  • I thought I read somewhere along the way about issues synching the DA group. Try synching a different group and see what happens.
    I think that was the issue.  See my reply above.  Thanks!!
    Friday, July 15, 2011 11:47 PM
  • These are all excellent answers, I know I've had issues synching with built in groups in the past, so any comments would be welcome.  In terms of security, you might want to browse this blog...  http://www.applepark.co.uk/project-server-security-explained/ 

     


    Ben Howard [MVP] blog | web
    Monday, July 18, 2011 9:49 AM
    Moderator