CODEWITHSUNDEEP
azure-devopsdeployment
Filipa
Filipa

Reputation: 61

I want to use a System.AccessToken to a rest api call to deploy one release

In Azure Pipeline Releases, I have one task "Azure PowerShell". 207908-image.png

This script will do a deployment of another release. In my code, I use a System.AutenticantionToken: "$AzureDevOpsToken = $env:SYSTEM_ACCESSTOKEN" and my headers for a call rest API is:

$basicAuthValue = "Bearer $AzureDevOpsToken"
$headers = @{
Authorization = $basicAuthValue
}

When I ran this code :

    $deploymentBody = @{
    status = "inProgress"
    } | ConvertTo-Json
    $urlDeployment = "https://vsrm.dev.azure.com/$Organization/$ProjectName/_apis/Release/releases/$ReleaseId/environments/$EnvironmentId`?api-version=5.1-preview.6"
    $deployment = Invoke-WebRequest -Uri $urlDeployment -Method Patch -ContentType "application/json" -Headers $header -UseBasicParsing -Body $deploymentBody

I received an error: 2022-06-01T14:53:15.4901741Z {"$id":"1","customProperties":{"Descriptor":null,"IdentityDisplayName":null,"Token":null,"RequestedPermissions":0,"NamespaceId":"00000000-0000-0000-0000-000000000000"},"innerException":null,"message":"VS402904: Access denied: User e3b793c5-a512-44b7-a704-878e8adb62e9 does not have manage deployments permission. Contact your release manager.","typeName":"Microsoft.VisualStudio.Services.Security.AccessCheckException, Microsoft.VisualStudio.Services.WebApi","typeKey":"AccessCheckException","errorCode":0,"eventId":3000}

This happened when I use a System.AccessToken.

But when I use a Personal Access Token it goes well. But I don't want to use it because I need to put the password in plain sight in the pipeline. So I want to use a System.AccessToken.

In my pipeline, on the agent pool, I have this check: "Allow scripts to access the OAuth token"

Can you help me?

Upvotes: 5

Views: 5585

Answers (2)

Kevin Lu-MSFT
Kevin Lu-MSFT

Reputation: 35504

VS402904: Access denied: User e3b793c5-a512-44b7-a704-878e8adb62e9 does not have manage deployments permission.

Based on the error message, it means that the service account has no access to manage the deployment.

The variable: $(system.accesstoken) will create a token based on the permissions of the service account: {Project Name} Build Service ({Org Name}).

Refer to this doc: Scoped build identities

To solve this issue, you need to navigate to Piplines -> Release -> Security and grant the Manage Deployments permission to the service account: {Project Name} Build Service ({Org Name}).

For example:

enter image description here

Upvotes: 3

GeralexGR
GeralexGR

Reputation: 3592

You do not have to use the password plaintext for the personal access token. You can set a variable lets call it PAT on your pipeline with the value as a secret and then inject this variable on your powershell script.

enter image description here

 $connectionToken="$(PAT)"
 $base64AuthInfo= [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(":$($connectionToken)"))

Then you have to use as a header

-Headers @{authorization = "Basic $base64AuthInfo"}

Upvotes: 0

Related Questions