Adding a work item to TFS 2010 from ASP.NET app fails due to permissions

I'm working on an ASP.NET webforms app that will serve as a simple intake form to create work items in TFS 2010.

The app works correctly when I run it locally in debug mode--the submission completes开发者_如何学JAVA and the work item is created.

When I publish the form to our dev server, it yellow screens and throws the following error:

[SecurityException: TF50309: The following account does not have sufficient permissions to complete the operation: DOMAINNAME\SERVERNAME$. The following permissions are needed to perform this operation: View collection-level information.]

In my code, I'm attempting to access TFS using a service account, and from what I can tell the service account is being used correctly when I run in debug mode.

Here's what my C# looks like:

string tfsServerUrl = "http://servername:8080/tfs";
string tfsProject = "Web Team Projects";
NetworkCredential tfsCredential = new NetworkCredential("ServiceAccountName", "password", "DOMAIN");
TeamFoundationServer tfs = new TeamFoundationServer(tfsServerUrl, tfsCredential);
tfs.Authenticate();
WorkItemStore workItemStore = new WorkItemStore(tfsServerUrl);

If I set a breakpoint at the tfs.Authenticate() line, the server object shows the service account name as the current user and IsAuthenticated = true.

The line in the exception that mentions SERVERNAME$ is what's stumping me. It's seems like IIS is deciding to try to access TFS with the app pool identity instead of the credentials that I'm explicitly supplying.

Our dev server is a Server 2008 box running IIS 7.

Any suggestions?

The TeamFoundationServer class is obselete. Have you tried using the TfsTeamProjectCollection (TFS 2008) or TfsConfigurationServer (2010) class instead?

string tfsServerUrl = "http://servername:8080/tfs";
System.Net.NetworkCredential tfsCredential = new System.Net.NetworkCredential("ServiceAccountName", "password", "DOMAIN");
TfsConfigurationServer tfs =  new TfsConfigurationServer(new Uri(tfsServerUrl), tfsCredential);
tfs.Authenticate(); // You should be able to omit this
WorkItemStore workItemStore = (WorkItemStore)tfs.GetService(typeof(WorkItemStore));