azure-devopsnugetazure-pipelinesazure-artifacts

Reputation: 15654

Azure DevOps: User lacks permission to complete this action. You need to have 'AddPackage'

I get an error:

User XXX lacks permission to complete this action. You need to have 'AddPackage'

when trying to push a nuget package to Azure DevOps artifacts. I am the administrator This is the stage:

  - stage:
    displayName: 'Release'
    condition: succeeded()
    jobs:
      - job: 'Publish'
        displayName: 'Publish nuGet Package'
        steps:
          - download: current
            artifact: $(PIPELINE_ARTIFACT_NAME)
            displayName: 'Download pipeline artifact'
          - script: ls $(PATH_PIPELINE_ARTIFACT_NAME)
            displayName: 'Display contents of downloaded articacts path'
          - task: NuGetAuthenticate@0
            displayName: 'Authenticate in NuGet feed'
          - script: dotnet nuget push $(PATH_PIPELINE_ARTIFACT_NAME)/**/*.nupkg --source $(NUGET_FEED) --api-key $(NUGET_API_KEY)
            displayName: 'Uploads nuGet packages'

And the exact error:

error: Response status code does not indicate success: 403 (Forbidden - User '4a2eb786-540d-4690-a12b-013aec2c86e5' lacks permission to complete this action. You need to have 'AddPackage'. (DevOps Activity ID: XXXXXXX-6DF9-4A98-8A4E-42C556C6FC56)).
##[error]Bash exited with code '1'.
Finishing: Uploads nuGet packages

The git repo is in GitHub. Not sure who is considered to be the user but I don't know which other permissions to modify

Upvotes: 152

Answers (16)

MIHOW

Reputation: 411

I wanted to use organization scoped feed, and I was trying to push to it from my project.

Accepted solution was not working for me - changing Role for the Project Collection Build Service was not enough.

Turns out, there's a Build Service user for a Project scope. It can be checked under Organization settings -> Permissions -> Users tab.

So I had to manually add that user to my Organization scoped feed in the Permissions list and give it Feed Publisher (Contributor) role.

Upvotes: 1

Jason Washo

Reputation: 615

Here's what got this to work for me in June 2024. I believe some of the previous answers are out of date.

Pipelines (in the Azure DevOps sidebar) > go to three dots on top right of Pipelines screen > Manage Security > Copy the user under 'Users' to clipboard. My case is: ProjectNameHere Build Service (OrgNameHere)
Artifacts (in the Azure DevOps sidebar) > Feed Settings (gear icon top right screen) > Permissions tab > add user from Step 1 as a Contributor.

Upvotes: 8

BDarley

Reputation: 1275

If the error consists of a GUID representing the user as in the below error

Response status code does not indicate success: 403 (Forbidden - User 'a112123-5123-4123-b28e-b02484411234' lacks permission to complete this action. You need to have 'AddPackage'. (DevOps Activity ID: 70E74793-BC13-44CB-945E-7066E80622F5)).

To identify by name what user the error is referring to... Use endpoint, where {your org name} is the orgname listed in your Azure Devops Url

https://vssps.dev.azure.com/{your org name}/_apis/graph/users

By listing the name you can be reassured you have the correct identifier to add to the feeds permissions.

Upvotes: 5

Chuck D

Reputation: 1819

On the feed view, it's over here (as of 11/2023):

Upvotes: 3

Tanguy Touzard

Reputation: 135

Just an extra information when using "Project Name" Build Service (Organization), even of the search does not return any result, the save button becomes enabled if the name is correct

Upvotes: 1

teamdever

Reputation: 372

Just a note - make sure you put your Build Service as Contributor. I had mine as Collaborator which is a completely different role and I didn't notice the difference since they just appear very similar.

Upvotes: 7

GeralexGR

Reputation: 3582

I had the exact problem. Under Feed Settings -> Permissions I could locate the Project Collection Build Service (Organization) with the Contributor permissions but did not work. As a solution I removed that and added "Project Name" Build Service (Organization). This is the build service for the project on which I have created the pipeline specifically.

Upvotes: 5

Kayes

Reputation: 1096

See ArkadiuszKozie-6872's answer here: https://learn.microsoft.com/en-us/answers/questions/723164/granting-read-privileges-to-azure-artifact-feed.html

Had to grant Contributor to Project Collection Build Service (<YOUR-ORG-NAME>) too, which fixed it for me.

Upvotes: 15

Duck Ling

Reputation: 2130

My solution was slightly different. New pipelines default to "Current Project" under Pipeline > Edit > Options > Build job > Buld job authorization scope.... this needed changing to "Project collection", which solved the problem:

Upvotes: 16

j-m

Reputation: 1554

A few things have changed in at least the Azure Devops web interface as of 2022-07. Although the fundamentals appear unchanged, the ... button talked about earlier is gone. Below are the steps I figured at the time of writing. Extracted from a bit of a whinging blog post, which has more details and context.

Create a new feed, setting the scope to the project:

By default, the permission list created for the new feed is as below. Note that the organisation_name Build Service (project_name) user or group has the role Collaborator by default. This may be the key stumbling block users trip over.

You cannot change the role; you have to remove the organisation_name Build Service (project_name) user or group and add it again with the Contributor role.

Upvotes: 26

Gabriel Anderson

Reputation: 1391

For those who are completely lost like me, the page mentioned by @diegosasw is in the Artifacts menu, not in the Task or in the Pipeline:

Upvotes: 52

Xavier John

Reputation: 9447

Steps:

Click on Artifacts on the left side.
Select your feed from the drop down (usually selected by default)
Click the Feed Setting gear on the top right corner.
Click Permissions
Click Add Users/groups and search for {your org} Build Service and add as Contributor.

Upvotes: 95

Pancat

Reputation: 31

If you still got the error, you could try to add the Team as Contributor as well.

Hope it works.

[project_name][project_name] Team - Contributor

project_name Build Service(Org_name) - Contributor

Upvotes: 3

atGuz

Reputation: 101

the correct answer is, at the artifact settings page (you can access following the explanation above) you need to add contributor permission to the user with the name pattern [project_name] Build Service. For example, if your project name is "IoT" you need to find the user "IoT Build Service" at the Add user/groups in the permission tab as shown above and assign the contributor permission.

Upvotes: 9

Martin H

Reputation: 437

Great find! Allowing project-scoped builds in the ... menu worked for me.

But in order to be able to push the package from Azure Pipelines to the Azure Artifacts feed at all, I had to add the same feed as Target feed under the dotnet restore step before dotnet build and finally dotnet push. https://learn.microsoft.com/en-us/azure/devops/artifacts/nuget/dotnet-exe?view=azure-devops

Upvotes: 11

diegosasw

Reputation: 15654

It seems I fixed by adding to the feed's permission settings the Build Service as Contributor.

It's a bit confusing tbh but it's now working fine.

Upvotes: 188

Azure DevOps: User lacks permission to complete this action. You need to have &#39;AddPackage&#39;

Answers (16)

Related Questions

Azure DevOps: User lacks permission to complete this action. You need to have 'AddPackage'