Project Sever security is applied to SharePoint sites when a user’s permissions are modified. The user being modified is taken off all the projects sites and then added back on with the new/modified permissions. When a Security Group or Category is modified then all the users in that security object will be re-evaluated for Project site permissions. In Project Server 2007 the application first takes all the users in the security object off all workspaces and then adds them back on. With Project Server 2010 and 2013 one user at a time is taken off and added back to the site. As the number of users and workspaces increases so does the time for the job to complete.
In Project Server 2013 this option is only available when in Project Server Permissions Mode.
The SQL server may time out when attempting to add users to workspaces. When reviewing a SQL Profiler trace you see Exception 1222 Severity 16 State 18 when the stored procedure MSP_Resource_ReadUserSummariesActive is executed. This is a timeout error.
At the same time SharePoint Server has a limit of 5000 security objects per web application. Project SErver Admins should use SharePoint best practives to avoid such limitation. The following document link has more information on SharePoint limits: http://technet.microsoft.com/en-us/library/cc262787.aspx
In order to improve the performance the recommendation is to use the Project Server Security to control the number of projects/site a user has access to by setting up Resource Breakdown Structure for users in conjunction with the security category filters to limit which projects users can see. Controlling the number of projects a user can see in turn determines which workspaces the user can access. By using the Project Server Security model users will get added to SharePoint groups instead of added individually, to mitigate the chance of hitting the SharePoint limit of 5000 security objects per web application.
Best practices for managing a large number of resources in Project Server 2010 can be found here http://technet.microsoft.com/en-us/library/hh670402(v=office.14).aspx
Additonally the WSSSync job can be turned off so that a PWA Admin can choose when to synchronize user permissions.
To turn off the feature to sync Project Site (2010 & 2013) or Workspaces (2007).
For Project Server 2007: Go to Server Settings, click Project Workspace Provisioning Settings. In the section Workspace Permissions, clear the box to "Check to automatically synchronize PWA users...".
For Project Server 2010: Go to Server Settings, click Project Site Provisioning Settings. In the section Project Site Permissions, clear the box to "Check to automatically synchronixe PWA users...".
For Project Server 2013: Go to Server Settings, under Operation Policies, click on Manage User Sync Settings. Uncheck the Enable Projects Site Sync and click Save. Note: In Project Server 2013 this option is only available when in Project Server Permissions Mode.
When this box is unchecked, PWA users will never be synced.
Article ID: 2578280 - Last Review: 03/07/2016 06:53:00 - Revision: 4.0