There are some key things you need to know and do when Label permissions in TFS 2010 version control are limited to particular folders. The key thing you need to know is that you can control the scope of labels in TFS when they are created. The key thing you need to do is to create labels within a scope that is allowed by the permissions that have been granted.
Many TFS users only apply labels using the Apply Label menu item in Visual Studio Source. Well, by default the scope of any labels created is the team project, so the user must have Label permission allowed at the team project level. But, if a user is only granted Label permission on a folder within the team project an error like the following will be displayed when they attempt to place a label on that folder or any its subfolders.
TF14098: Access Denied: User %USER% needs Label permission(s) for $/TeamProject1
This error occurs because by default the scope of the label is created with team project scope which requires Label permission at the team project level. To avoid this error the user needs to create the label within a scope that compatible with where the Label permission is Allowed.
Unfortunately the Visual Studio 2010 Source Control Explorer UI doesn't expose any options to set the scope of a label when it is created, but the tf.exe command line tool does.
For an example we'll set Label and Read permissions to Allow for the user on the Product1 folder at the following path and not on the team project or any other folder.
$\TeamProject1\Customer1\Product1
Here's the command line equivalent of what the Source Control Explorer UI does when a new label is created on the "$\TeamProject1\Customer1\ Product1" folder:
tf label /server:http://ServerName:8080/tfs LabelName $\TeamProject1\Customer1\ Product1\Main /recursive
If the user runs that command it will result in the error mentioned earlier.
Here's a command line that will limit the scope of the label to the "$\TeamProject1\Customer1\ Product1" folder:
tf label /server:http://ServerName:8080/tfs LabelName@$\TeamProject1\Customer1\Product1 $\TeamProject1\Customer1\Product1 /recursive
Notice the LabelName@Scope argument. In this example we set the scope of the label to be the same as folder that is being labeled. This is compatible with the user's permissions so it works.
Information about the scope of labels in TFS is hard to find and that's too bad because label scope is necessary to understand in order to use TFS in many scenarios. Using label scope effectively provides power and flexibility. With the default scope at the team project level all label names must be unique within the team project. Good use of label scope allows you to use the same label names in different scopes.
Hopefully future versions of the Source Control Explorer UI will allow us to control label scope with Apply Label. Until then we can create scoped labels from the command line. The tf.exe documentation has the good information about labels in TFS.
Subscribe