Using the Azure Artifacts Credential Provider with Azure Artifacts feed results in 401 (Not Authorized) error

[deadlydog]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.

Steps to reproduce

1. Install the Azure Artifacts Credential Provider.
2. Setup the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable using a valid Azure DevOps PAT.
3. Register the private Azure DevOps feed using Register-PSResourceRepository -Name <RepoName> -Uri <FeedUrl> -Trusted
4. Use Install-PSResource or Find-PSResource to find a module in the private feed. It returns back a 401 (Not Authorized) error.

Details

It seems that Install-PSResource and Find-PSResource still do not work properly with Azure Artifacts and the Azure Artifacts Credential Provider in Microsoft.PowerShell.PSResourceGet v1.0.3; they result in a 401 (Not Authorized) error.

The Install-Module and Find-Module commands work properly though when registered with the same repository URI, so I know that the Azure Artifacts Credential Provider is setup properly.

The Azure Artifacts Credential Provider has been installed with the following command as per the docs:

iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx

And a VSS_NUGET_EXTERNAL_FEED_ENDPOINTS system environment variable added using a valid Azure DevOps Personal Access Token, as per the docs.

Tangentially related

What's worse is it seems that the latest prerelease version 3.0.23 of PowerShellGet has broken the Install-Module and Find-Module commands completely, and previous prerelease versions have been delisted; see PowerShell/PowerShellGet#58. Luckily I still have PowerShellGet v3.0.12 installed so the commands still work on my local machine, but new servers that I'm setting up are not able to connect to our Azure Artifacts feed without the -Credential parameter.

I created the AzureArtifactsPowerShellModuleHelper module a while back to help solve this issue, but found that sometimes even with that module PowerShellGet 2.2.5 still couldn't access the feed and we'd need to use the prerelease v3 version. With v3.0.23 broken though, and older v3 versions delisted and thus can't be installed, there's not much we can do when v2.2.5 has issues. I was hoping that PSResourceGet would eliminate the need for using the AzureArtifactsPowerShellModuleHelper module and PowerShellGet.

Expected behavior

The Install-PSResource and Find-PSResource cmdlets should automatically use the Azure Artifacts Credential Provider to provide credentials to connect to the private Azure DevOps Artifacts feed.

Find-PSResource $MyPrivateModule -Repository $MyPrivateAzureArtifactsFeed

Should be able to find the module.

Actual behavior

Find-PSResource $MyPrivateModule -Repository $MyPrivateAzureArtifactsFeed

Find-PSResource: 'Response status code does not indicate success: 401 (Unauthorized).' Re-run the command with -Credential.

Error details

PS> Get-Error

Exception             :
    Type       : Microsoft.PowerShell.PSResourceGet.UtilClasses.UnauthorizedException
    TargetSite :
        Name          : MoveNext
        DeclaringType : Microsoft.PowerShell.PSResourceGet.Cmdlets.V2ServerAPICalls+<SendV2RequestAsync>d__38, Microsoft.PowerShell.PSResourceGet, Version=1.0.3.0, Culture=neutral, PublicKeyToken=null
        MemberType    : Method
        Module        : Microsoft.PowerShell.PSResourceGet.dll
    Message    : 'Response status code does not indicate success: 401 (Unauthorized).' Re-run the command with -Credential.
    Source     : Microsoft.PowerShell.PSResourceGet
    HResult    : -2146233088
    StackTrace :
   at Microsoft.PowerShell.PSResourceGet.Cmdlets.V2ServerAPICalls.SendV2RequestAsync(HttpRequestMessage message, HttpClient s_client)
   at Microsoft.PowerShell.PSResourceGet.Cmdlets.V2ServerAPICalls.HttpRequestCall(String requestUrlV2, ErrorRecord& errRecord)
TargetObject          : Microsoft.PowerShell.PSResourceGet.Cmdlets.V2ServerAPICalls
CategoryInfo          : InvalidResult: (Microsoft.PowerShel…ts.V2ServerAPICalls:V2ServerAPICalls) [Find-PSResource], UnauthorizedException
FullyQualifiedErrorId : UnauthorizedRequest,Microsoft.PowerShell.PSResourceGet.Cmdlets.FindPSResource
InvocationInfo        :
    MyCommand        : Find-PSResource
    ScriptLineNumber : 1
    OffsetInLine     : 1
    HistoryId        : 7
    Line             : Find-PSResource <REDACTED>.ServerConfiguration -Repository AzureArtifacts-<REDACTED>
    Statement        : Find-PSResource <REDACTED>.ServerConfiguration -Repository AzureArtifacts-<REDACTED>
    PositionMessage  : At line:1 char:1
                       + Find-PSResource <REDACTED>.ServerConfiguration -Repository AzureAr …
                       + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    InvocationName   : Find-PSResource
    CommandOrigin    : Internal
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo :

Environment data

PS> Get-Module Microsoft.PowerShell.PSResourceGet; $PSVersionTable

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Binary     1.0.3                 Microsoft.PowerShell.PSResourceGet  {Find-PSResource, Get-InstalledPSResource, Get-PSResourceRepository, Get-PSScriptFileInfo…}

Key   : PSVersion
Value : 7.4.1
Name  : PSVersion


Key   : PSEdition
Value : Core
Name  : PSEdition


Key   : GitCommitId
Value : 7.4.1
Name  : GitCommitId


Key   : OS
Value : Microsoft Windows 10.0.19045
Name  : OS


Key   : Platform
Value : Win32NT
Name  : Platform


Key   : PSCompatibleVersions
Value : {1.0, 2.0, 3.0, 4.0…}
Name  : PSCompatibleVersions


Key   : PSRemotingProtocolVersion
Value : 2.3
Name  : PSRemotingProtocolVersion


Key   : SerializationVersion
Value : 1.1.0.1
Name  : SerializationVersion


Key   : WSManStackVersion
Value : 3.0
Name  : WSManStackVersion

Visuals

Here's a screenshot showing the issue, and that it works properly with PowerShellGet, but not PSResourceGet. If you need any other information for troubleshooting let me know; I'm happy to provide anything that can help get this issue resolved.

[SESEric]

Any news on the progress of this fix? I am too facing this issue and makes myserver automations complicated.

[SESEric]

@alerickson @SydneyhSmith any chance to see you pull request get in master? This would simplify our process so much if we no longer have to provide credentials every time we want to update our modules

[alerickson]

Hi @SESEric, hoping to get it in within the next 2 weeks-- it's been stuck in limbo because of some compliance issues re integrating tests.