CODEWITHSUNDEEP
azure-devops
C.H.
C.H.

Reputation: 55

Build agent authentication with Azure AD user

We have changed from TFS 2017 to Azure DevOps Services. In TFS we have used the AD to authenticate the users. For Azure DevOps Services we use a Azure AD. So I wanted to configure a self-hosted build agent on a on-premise machine. I tried it with PAT authentication and it works like expected. Just to see if it works i tried the other authentication types:

--auth <type> - authentication type. Valid values are:

pat (Personal access token) --> works
negotiate (Kerberos or NTLM) --> not working because of Azure AD authentication
alt (Basic authentication) --> ?
integrated (Windows default credentials) --> not working because of Azure AD authentication

I tried to authenticate with user name (email) and password of the user which i used to successfully authenticate with PAT. But everytime i get the message that the user is not authorized to access the server.

Could it be that it is not possible to authenticate a build agent with a user of Azure DevOps Services with his user name and password instead of PAT?

I had the same problem when I tried to authenticate with Azure DevOps Service via API. But there I could use VssAadCredential instead of VssBasicCredential.

Is there something like that for the build agent configuration or am I doing something wrong?

Upvotes: 2

Views: 11192

Answers (2)

Mohamed
Mohamed

Reputation: 61

When registering the agent, and by using authentication type = Negotiate, the agent should use user name & password instead of PAT.

enter image description here

Upvotes: 6

jessehouwing
jessehouwing

Reputation: 114641

You can only connect an Azure Devops agent to Azure DevOps (cloud) using PAT or Alternate Credentials (git username+pass).

You cannot use Azure Active Directory to connect the agent.

On-premise does allow NTLM/kerberos authentication.

It may be useful to know that the PAT is only used to register the agent. During registration the agent negotiates its own credentials and encryption keys.

You can revoke the PAT after connecting the agent and your agent will remain connected without issues.

More details on the auth design of the Azure Pipelines Agent:

Upvotes: 4

Related Questions