[Bug] PAT fails to login via AzureDevOps Windows build/release agent

Describe the bug Unable to login via AzureDevOps build/release agent (Hosted VS2017). Piping the PAT or using environment variables to store the PAT to use with “az devops login” command results in invalid PAT and failed authentication.

To Reproduce Azure Cli Version: azure-cli (2.0.59)

Azure-Devops extension version: azure-devops (0.3.0)

Steps to reproduce the behavior:

1. In a AzureDevOps release definition define an environment variable AZURE_DEVOPS_EXT_PAT and set it to the PAT with correct permissions.

2. Run a powershell task with the following commands:

az extension add --name azure-devops
echo $env:AZURE_DEVOPS_EXT_PAT | az devops login --debug --organization=https://dev.azure.com/myOrg

Expected behavior Expected to authenticate as PAT user.

Screenshots

Debug logs 2019-03-13T19:23:24.0029894Z DEBUG: azext_devops.vstsCompressed.vss_client : Response content: b’{“$id”:“1”,“innerException”:null,“message”:“TF400813: The user '' is not authorized to access this resource.”,“typeName”:“Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server”,“typeKey”:“UnauthorizedRequestException”,“errorCode”:0,“eventId”:3000}’ 2019-03-13T19:23:24.0032861Z DEBUG: msrest.exceptions : TF400813: The user ‘’ is not authorized to access this resource. 2019-03-13T19:23:24.0048439Z DEBUG: TF400813: The user ‘’ is not authorized to access this resource. 2019-03-13T19:23:24.0049169Z Traceback (most recent call last): 2019-03-13T19:23:24.0049751Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\dev\team\credentials.py”, line 33, in credential_set 2019-03-13T19:23:24.0050293Z connection_data = location_client.get_connection_data() 2019-03-13T19:23:24.0050811Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\location\v4_1\location_client.py”, line 46, in get_connection_data 2019-03-13T19:23:24.0052164Z query_parameters=query_parameters) 2019-03-13T19:23:24.0052460Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 72, in _send 2019-03-13T19:23:24.0052882Z query_parameters=query_parameters) 2019-03-13T19:23:24.0053511Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 111, in _create_request_message 2019-03-13T19:23:24.0053927Z location = self._get_resource_location(location_id) 2019-03-13T19:23:24.0054077Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 141, in _get_resource_location 2019-03-13T19:23:24.0054276Z VssClient._locations_cache[self.config.base_url] = self._get_resource_locations(all_host_types=False) 2019-03-13T19:23:24.0054473Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 177, in _get_resource_locations 2019-03-13T19:23:24.0054668Z response = self._send_request(request, headers=headers) 2019-03-13T19:23:24.0054806Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 64, in _send_request 2019-03-13T19:23:24.0054987Z self._handle_error(request, response) 2019-03-13T19:23:24.0055149Z File “C:\Users\VssAdministrator.azure\cliextensions\azure-devops\azext_devops\vstsCompressed\vss_client.py”, line 239, in _handle_error 2019-03-13T19:23:24.0055314Z raise VstsServiceError(wrapped_exception) 2019-03-13T19:23:24.0055467Z azext_devops.vstsCompressed.exceptions.VstsServiceError: TF400813: The user ‘’ is not authorized to access this resource. 2019-03-13T19:23:24.0055624Z DEBUG: handling generic error 2019-03-13T19:23:24.0160384Z ERROR: Failed to authenticate using the supplied token.

Additional context The evaluation of $env:AZURE_DEVOPS_EXT_PAT -eq “my_pat_value” was “True”. I have also used the PAT on my local machine and validated the PAT works.

I have also tried all the other methods outlined in your login to azure devops guide. As outlined

[atbagga]

@hshui Thank you for reporting the issue.

When you setup the environment variable AZURE_DEVOPS_EXT_PAT with the correct PAT token, login command is not required. So in your case if you skip the login command you should be able to directly run the commands and they will try to use the PAT from environment for authentication. e.g. This script will run without explicit login.

az extension add --name azure-devops
az devops project list --org https://dev.azure.com/myorg

I will try to debug the reported issue, but hopefully the above should unblock you. Keep the thread posted if that works.

[atbagga]

@atbagga has this been resolved, I just ran across the same issue. What is the workaround?

I am no longer maintainer on this project.

Since this was a more generic issue in Azure Powershell task I think we need to track and follow up there if it got fixed there.