PowerShellGet 2.1.4: Credential Providers | Authentication is STILL BROKEN #619
Description
I don't know why #133 was closed when this is still so COMPLETELY BROKEN
We cannot work with repositories that require credentials unless we ...
... pass credentials
... with every,
... single
... call.
That's not how any of this is supposed to work.
For example, following the docs for the Azure Artifacts CredProvider, and the blog post from earlier this month we should be able to install the credential provider:
iwr https://raw.githubusercontent.com/microsoft/artifacts-credprovider/master/helpers/installcredprovider.ps1 -out ~\Downloads\installcredprovider.ps1
~\Downloads\installcredprovider.ps1 -AddNetfxSet something like this:
$ENV:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS = @'
{
"endpointCredentials": [{
"endpoint":"https://poshcode.pkgs.visualstudio.com/_packaging/PowerShell/nuget/v2",
"username":"Jaykul",
"password":"thisshouldbeareaallylongpattokenstringyougetfromtheweb"
}]}
'@Register the feed:
Register-PSRepository -Name Test -Source https://poshcode.pkgs.visualstudio.com/_packaging/PowerShell/nuget/v2And get a list of modules:
Find-Module * -Repository TestBut what actually happens is that with no error I get no results.
But if I try it with nuget:
nuget sources add -Name Test -Source https://poshcode.pkgs.visualstudio.com/_packaging/PowerShell/nuget/v2
nuget list -source TestIt works fine, and I get a list of modules...
YOU'RE DOING IT WRONG
The problem is that PowerShellGet isn't looking up the credentials against the feed address.
Instead, it's looking up (or rather, relying on nuget to) the credentials against the final url with all the parameters in it. So we can make the Find-Module command work if we change the stored endpoint to this:
$ENV:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS = @'
{
"endpointCredentials": [{
"endpoint":"https://poshcode.pkgs.visualstudio.com/_packaging/PowerShell/nuget/v2/FindPackagesById()?id='*'&$skip={0}&$top={1}",
"username":"Jaykul",
"password":"thisshouldbeareaallylongpattokenstringyougetfromtheweb"
}]}
'@And then re-run:
Find-Module * -Repository TestBut this is because I've hard-coded the token to a particular search.
Of course the result is that when we don't use the environment variable (i.e. Remove-Item ENV:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS) and do a Find-Module we get a "devicelogin" from the credential provider, but the credentials are cached for that specific URL, so if we Find-Module for any other specific module, or try anything else (like Install-Module), they will fail to find the cached credentials, and require going through the "devicelogin" again...
The worst part is that each time we go through the device login, you're creating a new PAT token that you'll never re-use...
Please, fix it again.