SharePoint (and Project Server) Shenanigans

This post will detail the errors seen when trying to add or edit items in a Project Site / Project Workspace in Project Server when adding users manually to a Project Site when they don’t have the correct permission in Project Server. For the purpose of this guide I will base this on Project Server 2010 but the same applies for Project Server 2007.

A bit on the background information to start with so that it makes it clear later on in the post why you see these errors. Project Server has its own permission model that works differently to the SharePoint permission model. Users are added to Project Server via the PWA > Server Settings > Manage Users interface and not the SharePoint Site Actions > Site Permissions interface. This is because users will be added to the PWA site based on their Project Server permissions, to an extent the same can be said for the Project Sites. Although Project Sites appear and function the same as a normal SharePoint site, certain lists / document libraries work very differently to standard SharePoint lists / libraries. The Project Documents library, Risks list and Issues list link back to Project Server so therefore when editing / adding items, firstly the SharePoint permissions will be checked, then the Project Server permissions will be checked. If the user doesn’t have the correct permissions in Project Server, then they will see errors, even if they have full control on the Project Site. Each error is shown below.

In this example I have added a user directly to the Project Site, the user has Full Control of this Project Site, also this user does not have any access to PWA.

Project Documents:

When adding a document to the Project Documents library the user will see this error pop up once they click OK to add the document:

When they click, “Go back to Site” they will see that document has still been uploaded:

The error is thrown when the Project Server permissions are validated. The error below can be seen in the SharePoint ULS logs:

System.Web.Services.Protocols.SoapException: ProjectServerError(s) LastError=GeneralSecurityAccessDenied Instructions: Pass this into PSClientError constructore to access all error information    at Microsoft.Office.Project.Server.WebServiceProxy.Security.CheckUserProjectPermission(Guid projectUid, Guid categoryPermissionUid)     at Microsoft.Office.Project.PWA.CustomFieldWebControls.CustomPWALinkField.OnLoad(EventArgs e) 

As you can see from the error above, it fails when checking the Custom PWA Link field as this is used to link the Document back to a task in the Project. As this user doesn’t have access to Project Server the error is thrown.

Risks and Issues lists:

Users will not be able to create an item on the risks or issues list if they do not have the correct permissions in Project Server, they will see the error below when clicking New Item:

The error below can be seen in the SharePoint ULS logs:

System.Web.Services.Protocols.SoapException: ProjectServerError(s) LastError=GeneralSecurityAccessDenied Instructions: Pass this into PSClientError constructore to access all error information    at Microsoft.Office.Project.Server.WebServiceProxy.Security.CheckUserProjectPermission(Guid projectUid, Guid categoryPermissionUid)     at Microsoft.Office.Project.PWA.CustomFieldWebControls.CustomPWALinkField.OnLoad(EventArgs e)    

As a minimum, users will need permission in Project Server to use these lists, I would also recommend that you let Project Server control the users permissions to the Project Sites. To do this check the box “…automatically synchronize Project Web App users with Project Sites when they are created…”, on the PWA > Server Settings > Project Site Provisioning Settings page.

This will synch the users to the Project Site when the Project is published, it will add users to the Project Sites based on their Project Server permissions and therefore less of an administration overhead. The permission the users get on the Project Site can be seen below:

• Project managers who have published a project or who have Save Project permissions on a project are added to the Project Managers (Microsoft Project Server) site group.
• Team members with assignments in a project are added to the Team members (Microsoft Project Server) site group.
• Other Project Server users who have View Project Site permission on a project are added to the Readers (Microsoft Project Server) site group.

Hopefully that explains why you see these errors on the Project Sites.