Project Server Security Demystified and Explained in 5 Mintues

Understanding Project Server Security. One of the most common places I need to extra time on when training new Project Server Administrators is the Security section. Most people generally grasp the concept of users, groups and permissions but when we throw in Categories into the equation I am often faced with blank stares and confused looks. I always pull out my trusty slide, which I’m about to share, to help me get the concept across simply… well as simple as possible J

1.       Groups. They are containers which are associated to a set of ‘global permissions’. These permissions determine what the members of the group can and can’t do in Project Server and MS Project Professional.

2.       Then we introduce Users. Many users can be associated to one or more groups. Users also contain a list of all the configurable ‘global permissions’ seen at the group level. Generally best practice is to set global permissions on groups and add users to the group to avoid the need of setting permissions at an individual level. In saying that though there may be specific needs to do this but understand with security, the more granular the requirement, the more administrative overhead it will create.

3.       Then we have Categories. Categories only do three things. They determine what projects, resources and online views can be seen by the group/user.

4.       When a category is associated to a group, we get an additional set of properties which are known as the ‘Category Permissions’. Theses category permissions determine what the group can do to the projects, and resources associated to that particular category. One or more categories can be assigned to an individual group which means each category permission set can be unique to the group.

5.       As with ‘Global Permissions’ you can also assign one or more categories to an individual user.

6.       The security model can get quite complex very quickly if care is not taken in how the system is configured. Devil is in the detail so as a general rule, keep security as simple as possible. Where required use groups to determine access and avoid setting user specific permissions as this will complicate the environmental security. It is also worth mentioning that a ‘Deny’ value on a permission will always override an ‘Allow’ Permission. If both deny and allow are not ticked then the permission will not be granted to the group/user. Allow of course will allow the permission.

 

So there you have it. Project Server Security explained in 5 minutes. Hope this helps others understand the basic principles of Project Server security. It’s not as scary as it looks but the model is so flexible it can become difficult to diagnose if you don’t set things up correctly. Let me know if this was helpful.

Creating a Private Document Library in the Project Site

Project Server contains its very own Security model. The Project Site however actually leverages off the SharePoint security model as Project Server is a SharePoint application. Certain actions such as a Project Publish event for example trigger Project Server to interpret and assign permissions of the project team in the Project site based on their individual permission set under the Project Server model.

Out of the box Project site permissions are triggered by following actions

Read Access	By adding a named Enterprise Resource to the Project schedule and the schedule has been published. The means the user would be visible under the ‘Resource Sheet’ view.
Edit Access	A named Enterprise resource is assigned to one or more tasks in the schedule and the schedule has been published. Edit access allows the user to create and edit items in lists or libraries within the project site. If using Generic resources you will need to create a dummy task in the schedule with 0% unit assignments to trigger this process.
Designer Access	This is generally provided to the project manager as the owner of the project. It extends the edit access by allowing this user to perform design type changes such as adding or modifying list columns, views and certain list or library type settings.
Full Access	Administrator access which provides Full Access to the project site.

 

This generally handles the majority of security requirements however there are situations whereby your project site requires a bit more flexibility. For example the Project Manager may require a secured area to maintain Project sensitive documentation. To achieve this requirement we can utilise the SharePoint security model but there are some rules to abide by. The following process provides instructions on how private document library can be configured and secured in a project site. Please note the same concept can be applied to any SharePoint list or library within the Project Site.

1.      Navigate to the Project site.

2.      From the ‘Site Actions’ menu select ‘New Document Library’

3.      Complete the base details. Consider turning on version control as this is a nice SharePoint feature to utilise. Click ‘Create’ to create the private document library in the Project site.

4.      Under the library tab, click ‘Library Permissions’. By default the library will inherit permissions from its parent. Since we want to secure this area and make it unique, click the ‘Stop Inheriting Permissions’ button. Click OK to confirm the change.

5.      Tick all the users you would like to remove permissions from in this library and click the ‘Remove User Permissions’ button. Ensure you leave administrator accounts and most importantly, your own account. Click ‘OK’ to confirm the change.

6.      The trick with configuring unique project permissions is to ensure the user is not associated to any of the project server permission. They are easily identified by the ‘(Microsoft Project Server)’ suffix. Let’s say a new user is granted edit (Contribute) access to the new secured document library. If you left the permission suffixed with ‘(Microsoft Project Server)’, the next time project server triggers its site synchronisation job it will note the user is a member of a Project Server monitored permission, and if the matching Project Server permissions do not provide access to that area, the permissions will be reset or removed from that user accordingly.

7.      Edit an existing user from this library by selecting the corresponding check box and click the ‘Edit User Permissions’ button.

8.      In this example we will grant Amy ‘Contribute’ access to this private documents area so Amy can edit and modify any documents within this library. Ensure we use the SharePoint equivalent and NOT the permissions with the ‘(Microsoft Project Server)’ suffix. Leaving the Project Server permission could result in a loss of permissions the next time a project site permission synchronisation job is triggered. Click OK to apply the permission change.

9.      Unique project permissions have now been applied to the new ‘Private Documents’ library within the Project Site in a way which won’t be overwritten by the Project Server Security Model.

 

Using this same technique, unique permission can be applied to any list or library within the project site. Adversely you could create a ‘Public Documents’ library which provides a more general access area. Even pure SharePoint users (Non Project Server) can be granted access to such areas of the Project Site. It is also worth mentioning this example reveals how to secure an individual document library but unique permission could also be set at an individual item level within the library or list.

The following table provides a mapping between SharePoint permissions and Project Server monitored permission within the Project Site

SharePoint Permission	Project Server Monitored Permissions	Description
Read	Readers (Microsoft Project Server)	As the name suggests, provide read access to the project site. This access is generally triggered by adding a named Enterprise Resource to the Project schedule and the schedule has been published. The means the user would be visible under the ‘Resource Sheet’ view.
Contribute	Team Members (Microsoft Project Server)	Provides edit access to the project site. A named Enterprise resource is assigned to one or more tasks in the schedule and the schedule has been published. Edit access allows the user to create and edit items in lists or libraries within the project site. If using Generic resources you will need to create a dummy task in the schedule with 0% unit assignments to trigger this permission change.
Design	Project Managers (Microsoft Project Server)	This is generally provided to the project manager as the owner of the project. It extends the edit access by allowing this user to perform design type changes such as adding or modifying list columns, views and certain list or library type settings.
Full Control	Web Administrators (Microsoft Project Server)	Administrator access which provides Full Access to the project site.

 

Even AD groups can be added and granted permission in the same way as a single user.  It is also worth mentioning SharePoint groups can also be used to maintain project site permissions.

 

Microsoft Project 2010 SP and Cumulative Update Consolidated Links, Version Numbers and Fixes

1          Project Server Version Numbers

 

Update	Version Number	Download Link
Original 2010 Version	14.0.4751.1000
Service Pack 1	14.0.6023.1000	http://support.microsoft.com/kb/2460052
June 2011 CU	14.0.6106.5000	http://support.microsoft.com/kb/2536590
August 2011 CU	14.0.6109.5000	http://support.microsoft.com/kb/2584056
October 2011 CU	14.0.6112.5000	http://support.microsoft.com/kb/2596495
December 2011 CU	14.0.6114.5000	http://support.microsoft.com/kb/2597006
Feb 2012 CU	14.0.6117.5000	http://support.microsoft.com/kb/2597942
April 2012 CU	14.0.6120.5000	http://support.microsoft.com/kb/2598274

 

To locate your Project Professional 2010 version number

1.      Open MS Project

2.      Click File>Help>Additional Version and Copyright Information

3.      Note the version number at the top of the dialog box

 

2          Project Server Service Pack 1

Link to Cumulative Update: http://support.microsoft.com/kb/2460052

Issues that this service pack fixes

 

1	Project is very slow to respond when you sychronize with a SharePoint Tasks list.
2	Changes that you make to the Print Properties dialog settings do not take effect when you print the document.
3	When you add a task to the timeline and then cut that task and paste it in another location on the timeline, the task will no longer appear on the timeline. The only way to get it to appear on the timeline is to re-open the project plan.
4	Task information is not imported correctly from a tab-delimited file to a project file on the server.
5	After you set up a new baseline, the "Baseline Work" and "Work" values do not match.
6	Saving a file in the Project 2007 format can corrupt the file.
7	When you remove leveling, pinned tasks that have actuals are moved.
8	When Project checks to see whether an assignment is over allocated, the program incorrectly checks whether the resource is over allocated at any time during the span of the task. Because of this behavior, assignments may be falsely flagged as over allocated. After SP1, Project instead correctly checks to see whether the resource is over allocated at any time when there is work on the assignment.
9	Find and replace does not work for some Romanian characters.
10	Manually scheduled tasks cannot be edited in the time-phased grid.
11	The date format for the Traditional Chinese version of Project is incorrect.
12	You are editing a project plan that is stored on a remote computer when the remote computer becomes disconnected. You are prompted to save the file locally, and you click OK. If you cancel the save process, any future saves will cause a crash.
13	When you have more than one project open and connected to the server and you save a baselines in one of the plans, the timephased baseline data in the other plan is changed.
14	You cannot add an Active Directory resource to a project by using the Project Standard client.
15	Data corruption occurs for custom number fields.
16	When you format a project plan (for example, to change the font or to add cell formatting) and you apply one format, another format is sometimes removed.
17	The "Show Critical Path" ribbon check box does not work in the Korean version.
18	The "Merge XML" feature does not allow you to merge custom fields data into an active project plan.
19	Project does not refresh earned values (such as BCWS) when you click F9.
20	When a user makes an edit to a task in a project, another task's free slack property should change, but the change does not appear in the user interface next full recalculation.
21	The Project client crashes when you try to lasso items in Team Planner view.
22	The lag parameter for a task does not accept values.
23	When you add a custom field that includes a hierarchical lookup table to a Visual Report, only the lookup table values that are actually being used in the project plan appear in the report.
24	Scheduled tasks can not be synced between Project client and a SharePoint task list.
25	When you change the column width or the row height, applied formatting is lost.
26	"Existing Tasks" is missing from the Timeline shortcut menu.
27	User-defined filter questions do not work on custom fields that have lookup tables.
28	After the trial period for Project 2010 expires, users cannot save projects as version Project 2007 files.
29	A crash occurs when you insert a sub project into the master project, copy or cut one of the tasks from the master project, and then try to paste the task into the sub project.
30	Text fields are not visible for a project that is saved in Project 2007 format in Project 2010 and then opened in Project 2007.
31	When you save a project to an external format, such as Excel, CVS or TXT,  task GUID is not listed as an available "From: Microsoft Project Field"  field.
32	When the Team Planner view is opened, Project stops responding.
33	The GetServerProjectGuid method does not return a complete list of the GUIDs for all the projects on the server.
34	When you try to print or preview a custom report, the preview shows the current view instead of the report that you created.

3          Project 2010 hotfix package: June 28, 2011

Link to Cumulative Update: http://support.microsoft.com/kb/2536590

Issues that this hotfix package fixes

·  A Microsoft Project 2010 report enables you to select and print a specific data range. For example, you can print all tasks, resources, assignments or all time scaled dates. When you try to print a specific data range in a report in Project 2010, the whole data range is printed.

·  Project Professional 2010 may crash or suddenly disappear without any crash error message when you save a project plan to a Project server.

·  You cannot receive correct values for the % Complete field, and the Cumulative % Complete field by using the VBA code in Project 2010.

·  Project 2010 may stop responding (hang) when you use the Team Planner view.

·  Assume that you use Project Web Application to apply status updates to a task. When you open the task in Project 2010, the updates for the actual work are lost.

·  After you import a project plan in Project 2010 from a format such as TXT, CSV or Excel, all new baselines (baseline 1 to baseline 10) are duplicated as the default baseline for all tasks.

·  When you clear the baseline in a view, such as the Task Usage view, certain assignment baseline cost values are not cleared.

·  When you open a Project 2003 plan in Project 2010, the task outline collapsed or expanded state displays incorrectly. Additionally, the percentage complete status of the summary tasks also displays incorrectly.

·  Consider the following scenario:

o  You create a project plan that contains a task in Project 2010.

o  You configure a baseline for the project plan.

o  You click the Project Information command to change the project status date.

o  You change the date in the Reschedule uncompleted work to start after: list in the Update Project window.

o  You click the File tab, and then you select the Options option to change to a date format that does not include elements such as the year or the time.

In this scenario, the Gantt bar for the task's baseline draws in an incorrect place.

·  Assume that you view a task in a new Window, and then you edit the task name on task name field in Project 2010. When you reproduce these two steps for many times, the data in the task disappears. Additionally, Project 2010 may stop responding.

·  You add actual cost values to a resource assignment in a project. Then, you open the project in Project 2010. In this situation, Project 2010 crashes.

·  Consider the following scenario:

o  You add a new task into a project in Project 2010.

o  You receive a prompt to save and check in the project when you close the project.

o  You click OK on the prompt dialog box to save and check in the project.

o  You immediately close the prompt dialog box before the project is checked in.

o  You click Yes when another prompt dialog box pops out to prompt to check in the project.

In this scenario, the project is saved. However, it is not checked in.

·  You clear the Link to Project check box in the Insert Project dialog box when you try to insert tasks into a project in Project Professional 2010. Then, you open the project. In this situation, Project Professional 2010 crashes.

·  Assume that a SOAP error occurs in Project Professional 2010. When you view more information about the error in the error dialog box for a while, and then you click OK on the error dialog box, Project Professional 2010 crashes.

·  Assume that you type a Korean character as a task name in a project. When you want to change the task name to another Korean character that has the same initial consonant and middle consonant as the former Korean character, Project 2010 generates the final consonant as the former Korean character automatically. Additionally, you cannot change the final consonant.

Note A Korean character consists of three components, initial consonant, middle consonant and final consonant in Korean language.

·  The ProjectBeforeTaskChange event does not trigger in Project 2010 when you click the Mark On Track button in the ribbon.

·  Certain actual work and orphaned pending updates are missing in Project Professional 2010 when you select the Save for Sharing option for a project file from a Project server.

Note This issue occurs because the project file is saved locally with different GUIDs when you select the Save for Sharing option for the project file.

4          Project 2010 hotfix package: August 30, 2011

Link to Cumulative Update: http://support.microsoft.com/kb/2584056

Issue that this hotfix package fixes

·  When you restore projects from backups in Project 2010, the deliverables and dependencies are restored incorrectly.

·  Assume that you have a milestone that has a task link in its own project and a cross-project link from a different project. In this case, the cross-project link incorrectly schedules if the date format does not display the time.

·  When you create a visual report in a master project, Project 2010 crashes.

·  Assume that you clear the local cache after you change the task data. In this case, the custom flag field values are lost.

·  Assume that you click a resource after the Links Between Projects dialog box appears. In this case, Project 2010 crashes when you switch to the Resource Sheet view on a customer file.

·  Consider the following scenario:

o  You create a deliverable that has a finish date for a task in Project 2010.

o  You create another task.

o  You add a dependency for the two tasks. In this scenario, the dependency finish date that is shown in the Gantt chart differs from the finish date that is shown in the Dependency pane.

 

·  When you click the Reschedule uncompleted work to start after button, remaining work is not rescheduled if only a material resource is assigned to a task in Project 2010.

·  Project 2010 crashes when projects in a master project calculate contour information.

·  Task names and other demand-loaded properties are lost after you perform undo actions in Project 2010.

5          Project 2010 hotfix package: October 25, 2011

Link to Cumulative Update: http://support.microsoft.com/kb/2596495

Issues that this hotfix package fixes

·  When you change certain values in a project that contains many tasks in Project 2010, Project 2010 takes a long time to recalculate the project.

·  Consider the following scenarios:

o  You change the timephased work in a Project 2010 project.

o  You change the remaining work for a task or assignment in a Project 2010 project.

o  You enter a time value for the timephased work, and the time scale granularity is more than one day.

In these scenarios, the actual work is rescheduled unexpectedly. Additionally, you do not receive a message that notifies you that the project is out of sync with the Project server.

·  When you try to print an .mpp filedirectly from Windows Explorer, you receive the following error message:

An unexpected error occurred.

·  Project 2010 stops responding when you try to open a project that contains incorrect, manually scheduled task date values.

·  When you open a Network Diagram view in Project 2010, and you print or print preview a project, the fill color of the task boxes is the same as the border color of the task boxes. Therefore, the text inside the task boxes appears fuzzy or unreadable. This issue specifically occurs when you use a black-and-white printer to print preview a project or to print a project.

·  When the custom duration fields are defined in an Office Project 2007 project, you may be unable to open the project file in Project 2010.

·  When you try to update deliverables or dependencies in a project that contains more than 159 deliverables, the update process may fail.

6          Project 2010 hotfix package: December 13, 2011

Link to Cumulative Update: http://support.microsoft.com/kb/2597006

Issues that this hotfix package fixes

·  When you use VBA code to create a custom solution for a custom field in Project 2010, and then you change the value of the custom field in the Project Information dialog box, the ProjectBeforeTaskChange event is not raised as expected.

·  When you try to save a project in Project 2010, the save operation fails and you receive the following error message:

The following job failed to complete.

Job Type: Save

Error ID: 9000(0x2328)

Error Description:

The project could not be saved to the server. Please retry saving the project. If the problem persists, save the project as a MPP file and contact your system administrator.

Note To resolve this issue, apply this hotfix package on the Project client computer and the Project server.

·  Consider the following scenario. You select the Actual costs are always calculated by project option in a project and you manually enter the actual costs of a cost resource into the project. You save and close the project. Then, you open the project in Project 2010. In this situation, Project 2010 crashes.

·  Assume that the status updates for a project are accepted. When you open, save, and then publish the project plan for the project in Project 2010, not all the accepted actual overtime work values are displayed in the project plan.

·  When you change a custom field in a project and then publish the project in Project 2010, the graphical indicator for the custom field is not displayed in the Project Center.

7          Project 2010 hotfix package: February 28, 2012

Link to Cumulative Update: http://support.microsoft.com/kb/2597942

Issues that this hotfix package fixes

·  Assume that you open a project that contains Microsoft Visual Basic for Applications (VBA) code in Project 2010. When you use the Save As command to replace the existing file many times, the save process eventually fails. Additionally, the project is corrupted and cannot be opened.

·  You create an .mpp file that was saved from a Project server by using the Save for Sharing command. When you try to resave the .mpp file back to the Project server in Project 2010, the save process fails, and you receive the following error message:

Project Server was unable to find the specified resource. If the problem continues, contact your server administrator.

This issue occurs when the list separator character that is contained in resource names within the .mpp file on the client differs from the list separator character on the server.

·  When you open a project that contains a milestone task that has actual work but does not have an actual work contour, Project Professional 2010 crashes.

·  Consider the following scenario:

o  You have a subtask whose progress is set to incomplete.

o  The summary task of the sub task has a predecessor task.

o  You schedule the predecessor task to finish at a later date.

In this scenario, the remaining duration of the sub task is not split, and the remaining duration of the sub task is not pushed to begin after the predecessor task finishes.

·  When you open and edit a project that contains some cost resource assignments that have actual cost values in Project 2010, some resource assignments are not marked as completed. And if you set the assignments to complete and then save the project, the next time that you open the project, the assignments are incomplete. Additionally, the finish dates of the assignments are extended.

·  After you open and work on a project in Project 2010 for a while, the user interface does not draw correctly, and you may be unable to save the project.

·  Assume that a task that has resource assignments and actual work values is changed into a summary task in a Project 2010 project. In this situation, the actual work values in the summary task may differ from the actual work values that were in the original task. Or, the actual work values may be lost.

·  Consider the following scenario in Project 2010:

o  You change the Hours per day setting to a real number value (for example, you change the setting to 7.6). You also change the Work is entered in setting to Days on the Schedule tab under Options.

o  You assign a material resource to a task.

o  You type a value in the work field or in the actual work field (for example, you type 1 in the work field or in the actual work field) in Task Usage view.

In this scenario, the value in the work field or in the actual work field is incorrect (in the example, the value is displayed incorrectly as 1.09).

·  Project 2010 crashes when you save a project. This issue may occur when summary resource assignments are loaded.

8          Project 2010 hotfix package: April 24, 2012

Link to Cumulative Update: http://support.microsoft.com/kb/2598274

Issues that this hotfix package fixes

·  Assume that a certain Unit is incompatible with the upper Unit in the Timescale dialog box in Project 2010. When you try to change the Label drop-down list or the Align drop-down list, you receive the following warning message:

Tier size mismatch: An upper tier has less time per tick than one of the tiers below it.
Trying the following:
Change the value in the tier’s Units box.
Change the number of units you want displayed in the tier’s Count box.

Additionally, every time that you click the OK button or the Close button in the warning message, you receive the warning message again.

·  When Microsoft Visual Basic for Applications (VBA) code is executed from a ribbon button in Project 2010, the End statement does not work. Additionally, you receive the following error message:

Automation error

·  Assume that you have a milestone task that is in the Manually Scheduled task mode in a project plan in Project Professional 2010. If you set the duration of the milestone task to 0 days, and then define an actual start date and actual finish date, the milestone task is 100 percent complete. However, when you reopen the project plan, the manually scheduled milestone task is 99 percent complete. Additionally, when you open the project in Project Web App, the manually scheduled milestone task is also 99 percent complete.

·  When you try to scroll up and down in the Resource Usage view in Project 2010, the grid jumps to the active cell.

·  Assume that the Protected Actuals feature is enabled and a resource contains an assignment that is 100 percent completed in Project 2010. In this situation, you cannot transfer the Remaining Work part of other assignments in the resource to a different resource by using the Replace functionality in the Build Team dialog box.

·  When you try to open a project that contains some invalid lookup table values, Project 2010 crashes.

·  Assume that you include some milestone tasks in a summary task in Project Professional 2010. You assign some cost resources to the milestone tasks. You select the From subtasks into selected summary task(s) check box in the Set Baseline dialog box. In this situation, the value of the Baseline Cost field does not roll up to the summary task.

·  When you try to clear the Generate WBS code for new task check box in the WBS Code Definition in ProjectName dialog box, the check box remains selected.

·  Assume that you save a project that contains more than 255 resources as an .xml file in Project 2010. Then, you open the .xml file as a new project. In this situation, the resource notes contain corrupted data.

·  Assume that you open a project that has at least one baseline saved and that is in the Project 2007 format from a Project server. You do not have permission to save protected baselines. Then, you save the project in the Project 2010 format. In this situation, all data in the protected baselines in the project is lost.

·  Assume that you change a calendar on a project server. Then, you open a project that relies on the calendar. In this situation, Project 2010 crashes.