I am using invoke rest api task in pipeline
I have saved Azure DevOps Pat token in variable with name system.AccessToken
Its giving error unauthorized
I also tried converting PAT token to base64 and then saving in variable. Its still showing same error.
What value do I need to provide for system.AccessToken ?
You do not need to add PAT token to your variables. System.AccessToken is a special variable that carries the security token used by the running build.
In addition, you are using Invoke Rest API task in an agentless job, so you also don't need to set "allow scripts to access the OAuth token" option.
Here is my sample and it works well:
1.Create service connection:
2.Configuration of Invoke REST API task:
Related
Based on the doc (https://learn.microsoft.com/en-us/rest/api/azure/devops/tokens/pats/update?view=azure-devops-rest-7.1&tabs=HTTP) provided by MS, i'm trying to update my Token expiration date through the api. I made a sample request using a full access token to authenticate and passing the authorizationId of the token i want to update in the body:
My sample request using Postman
And it keeps returning Error 403, I've checked my organization policies and tried by adding or removing parameters from body but it din't work.
I've also made another request to get the list of tokens on my organization with the same token authorization and api version and that went well.
According to your screenshot you are using the Basic Auth with PAT.
Please note that you must authenticate with an Azure AD token to use this API instead of a PAT token. In order to call the API directly, you need to provide an Azure AD access token as a Bearer token in Authorization header of your request. Please see Manage personal access tokens (PATs) using REST API and Q: Can I use basic auth with all Azure DevOps REST APIs? for details.
You can follow below steps to get the AAD Bearer token:
Install the Azure Az PowerShell module.
Login with a user account which has the permission in your DevOps org (Owner or PCA) with command Connect-AzAccount
1.) Alternately login from the cloud shell with command Connect-AzAccount -UseDeviceAuthentication, you will see the following message:
2.) Then copy the url https://microsoft.com/devicelogin and open in a new tap, enter the code IVR7VRWJQ to authenticate.
3.) Login with the Azure DevOps organization owner or other PCA account. After successful login you will see the account info, then follow below steps to get the Bearer Token.
Get the Bearer token:
$token = (Get-AzAccessToken -ResourceUrl "499b84ac-1321-427f-aa17-267ca6975798").Token
$token
Copy and use the token in script or Postman to update the PAT.
I need to add Azure DevOps repos to azure databricks repo by using databricks API at this link. I am using a service principal credentials for this. The service principal is already added as admin user to databricks. With my service principal I can get the list of repos and even delete them. But when I want to add a repo to a folder, it raises the following error:
{
"error_code": "PERMISSION_DENIED",
"message": "Missing Git provider credentials. Go to User Settings > Git Integration to add your personal access token."
}
I am not using my own credentials to use a PAT token, instead I am getting a bearer token by sending request to https://login.microsoftonline.com/directory-id/oauth2/token and use it to authenticate. This works for get repos, delete repos and get repos/repo-id. Just for creating a repo (adding repo by using post method to /repos) it is failing.
If I still use a PAT instead of bearer token, I get the following error:
{
"error_code": "PERMISSION_DENIED",
"message": "Azure Active Directory credentials missing. Ensure you are either logged in with your Azure
Active Directory account or have setup an Azure DevOps personal access token (PAT) in User Settings > Git Integration.
If you are not using a PAT and are using Azure DevOps with the Repos API, you must use an AAD access token. See https://learn.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/app-aad-token for steps to acquire an AAD access token."
}
I am using postman to construct the requests. To generate the error I am getting I am using the following:
method: post
url-endpoint: https://adb-databricksid.azuredatabricks.net/api/2.0/repos
body:
url: azure-devops-repo
provider: azureDevOpsServices
path: /Repos/folder-name/testrepo
header:
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbG... (Construct it by appending bearer token to key wor "Bearer")
X-Databricks-Azure-SP-Management-Token: management token (get it like bearer token by using resource https://management.core.windows.net/)
X-Databricks-Azure-Workspace-Resource-Id: /subscriptions/azure-subscription-id/resourceGroups/resourcegroup-name/providers/Microsoft.Databricks/workspaces/workspace-name
Here the screen shot of the postman:
Please note that I have used exactly same method of authentication for even creating clusters and jobs and deleting repos. Just for adding and updating repos it is failing. I'd like to know how I can resolve the error PERMISSION_DENIED mentioned above.
To make service principal working with Databricks Repos you need following:
Create an Azure DevOps personal access token (PAT) for it - Azure DevOps Git repositories don't support service principals authentication via AAD tokens (see documentation). (The service connection for SP that you configured is used for connection to other Azure services, not to the DevOps itself).
That PAT needs to be put into Databricks workspace using Git Credentials API - it should be done when configuring first time or when token is expired. When using this API you need to use AAD token of the service principal. (btw, it could be done via Terraform as well)
After it's done, you can use Databricks Repos APIs or databricks-cli to perform operations with Repos - create/update/delete them. (see previous answer on updating the repo)
Have you setup the git credentials using this endpoint before creating the repo through the API ?
https://docs.databricks.com/dev-tools/api/latest/gitcredentials.html#section/Authentication
If you do not setup this first, you can get the error when trying to create a repo.
Listing & deleting a repo only require a valid authentication to Databricks (Bearer token or PAT) and doesn't require valid git credentials.
When trying to create a repo, you need authorizations on the target repository that is on Azure Devops in your case.
So you need to call the git-credentials endpoint (it's the same syntax on AWS and Azure) to create it.
Once your git credentials up-to-date, the creation of the repo should work as intended.
I want to run pipelines from a powershell script, and I want to do that in a secured way.
Today my powershell code runs the pipelines with System access token ( I'm talking about System.AccessToken ) by calling the REST API for Azure DevOps; I see that the URL of the API is the same as the public one.
What would happen if someone listening to the traffic discovers the System Access Token value in the request? I would like to find a way to avoid public traffic, we are avoiding PAT (Personal Access Token).
What are the risks of calling pipelines from powershell in the same azure devops server with System Access Token and a public URI of the API?
The System.AccessToken (job access token) is a security token that is dynamically generated by Azure Pipelines for each job at run time.
This means that the token is generated when the job is started up and revoked when the job is completed. And each time when you run the pipeline job, it will generated a new token for use.
The valid period of a System.AccessToken is not long-term. And our Azure DevOps also have taken the effective measures to prevent the token from being leaked when used in the pipeline.
So, you can use the System.AccessToken in your pipeline with confidence.
For more details, you can see this document.
Context
I use a PowerShell Script with an Azure PowerShell task (Task version 4.* preview) to trigger the most recent release of a certain release pipeline. After retrieving the id of the last release as well as the id of the related environment via
GET https://vsrm.dev.azure.com/$azureDevOpsOrganizationName/$azureDevOpsProjectName/_apis/release/deployments?queryOrder=descending&`$top=1&definitionId=$azureDevOpsReleasePipelineId&definitionEnvironmentId=$azureDevOpsReleaseEnvironmentId&api-version=5.0
I want to make a PATCH REST Call to trigger the related release via
PATCH https://vsrm.dev.azure.com/$azureDevOpsOrganizationName/$azureDevOpsProjectName/_apis/Release/releases/$lastDeploymentId/environments/$($lastDeploymentEnvironmentId)?api-version=5.0-preview.6
with the following body
$triggerMostRecentReleaseBody = #{
comment = 'some comment'
status = 2
scheduledDeploymentTime = $null
}
$triggerMostRecentReleaseBodyJSON = $triggerMostRecentReleaseBody | ConvertTo-Json
To be able to make these REST Calls I enabled the OAuth token for being available in the pipeline:
and retrieve the token via $env:SYSTEM_ACCESSTOKEN in the PowerShell script.
The Issue
The GET request works perfectly fine but when executing the PATCH Call it returns the error
(403) Forbidden
So the question is how to enable the OAuth token to make these kind of REST Calls?
The issue is that the permissions related to the OAuth token are not sufficient by default to make the PATCH Call.
To grant the necessary permissions add the Project Collection Build Service (xxx) user to the Project Administrators group:
I'm trying to use the TFVC API from a build task without using Personal Access Token.
I've read that if I'll use the Client SDK it should authenticate automatically but I'm failing to get it working.
Another alternative I'm considering is to run tf.exe but it requires authentication as well.
Basically I would like to get the changesets for a certain build using my Build Task with minimum info from the user (hence I don't want Personal Access Token or Username/Password).
Is that doable?
You should be able to authenticate with an OAuth token. It's populated in the build variable $(System.AccessToken) or the environment variable SYSTEM_ACCESSTOKEN.
You provide it to the REST API with the header Authorization set to Bearer [token], where [token] is the OAuth token value.
If you queue a build with TFVC repository and then check the logs for "Get Sources" step, you will find how to use TF.exe to get source during the build.And then you can copy the command and use it in a CommandLine/PowerShell task like following:
Make sure that "Allow Scripts to access token" option is enabled.