Skip to content

[BUG]: GSSAPI operation failed with error - An unsupported mechanism was requested. NTLM authentication requires the GSSAPI plugin 'gss-ntlmssp #5140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
2 of 4 tasks
arp-mbender opened this issue Mar 7, 2025 · 2 comments
Open
2 of 4 tasks

[BUG]: GSSAPI operation failed with error - An unsupported mechanism was requested. NTLM authentication requires the GSSAPI plugin 'gss-ntlmssp #5140

arp-mbender opened this issue Mar 7, 2025 · 2 comments
Labels
Area: Agent bug triage

Comments

@arp-mbender
Copy link

What happened?

I'm attempting to create a Docker Swarm set of Linux agents for our on-prem DevOps Server instance. PAT authentication works fine, but PATs expire and since we're treating this as internal infrastructure I'd like to make use of the NEGOTIATE option when registering an agent.

To that end the following code is used:

  ./config.sh --unattended \
    --agent "${AZP_AGENT_NAME:-$(hostname)}" \
    --url "$AZP_URL" \
    --auth NEGOTIATE \
    --userName "$USER" \
    --password $(cat "/run/secrets/$AZP_USER_PASSWORD") \
    --pool "${AZP_POOL:-Default}" \
    --work "${AZP_WORK:-_work}" \
    --replace \
    --acceptTeeEula & wait $!

This results in the following error:

>> Connect:

Error reported in diagnostic logs. Please examine the log for more details.
    - /azp/_diag/Agent_20250307-104057-utc.log
GSSAPI operation failed with error - Unspecified GSS failure.  Minor code may provide more information (Crypto routine failure).

Versions

Agent version 3.238.0 using FROM ubuntu:22.04 as the basis of the docker image

Environment type (Please select at least one enviroment where you face this issue)

  • Self-Hosted
  • Microsoft Hosted
  • VMSS Pool
  • Container

Azure DevOps Server type

Azure DevOps Server (Please specify exact version in the textbox below)

Azure DevOps Server Version (if applicable)

Azure DevOps Server 2022.2 (AzureDevopsServer_20250224.1)

Operation system

Ubuntu 22.04

Version controll system

No response

Relevant log output

root@91b0a2263540:/azp# cat /azp/_diag/Agent_20250307-104057-utc.log
[2025-03-07 10:40:57Z INFO AgentProcess] Agent package linux-x64.
[2025-03-07 10:40:57Z INFO AgentProcess] Running on Linux (X64).
[2025-03-07 10:40:57Z INFO AgentProcess] RuntimeInformation: Linux 6.8.0-54-generic #56-Ubuntu SMP PREEMPT_DYNAMIC Sat Feb  8 00:37:57 UTC 2025.
[2025-03-07 10:40:57Z INFO AgentProcess] Version: 3.238.0
[2025-03-07 10:40:57Z INFO AgentProcess] Commit: da4a9e997b7f4c8939ef934a21070524b5ec664c
[2025-03-07 10:40:57Z INFO AgentProcess] Culture: 
[2025-03-07 10:40:57Z INFO AgentProcess] UI Culture: 
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO AgentProcess] Validating directory permissions for: '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Setting up value for origin: Configure.Password
[2025-03-07 10:40:57Z INFO HostContext] Setting up value for origin: Configure.ProxyPassword
[2025-03-07 10:40:57Z INFO HostContext] Value is empty.
[2025-03-07 10:40:57Z INFO HostContext] Setting up value for origin: Configure.SslClientCert
[2025-03-07 10:40:57Z INFO HostContext] Value is empty.
[2025-03-07 10:40:57Z INFO HostContext] Setting up value for origin: Configure.Token
[2025-03-07 10:40:57Z INFO HostContext] Value is empty.
[2025-03-07 10:40:57Z INFO HostContext] Setting up value for origin: Configure.WindowsLogonPassword
[2025-03-07 10:40:57Z INFO HostContext] Value is empty.
[2025-03-07 10:40:57Z INFO CommandSettings] Configure {
  "AcceptTeeEula": true,
  "AddDeploymentGroupTags": false,
  "AddEnvironmentVirtualMachineResourceTags": false,
  "AddMachineGroupTags": false,
  "AlwaysExtractTask": false,
  "Agent": "91b0a2263540",
  "CollectionName": null,
  "DeploymentGroup": false,
  "DeploymentGroupName": null,
  "DeploymentGroupTags": null,
  "DeploymentPool": false,
  "DeploymentPoolName": null,
  "EnableServiceSidTypeUnrestricted": false,
  "EnvironmentVMResource": false,
  "EnvironmentName": null,
  "EnvironmentVMResourceTags": null,
  "GitUseSChannel": false,
  "DisableLogUploads": false,
  "MachineGroup": false,
  "MachineGroupName": null,
  "MachineGroupTags": null,
  "MonitorSocketAddress": null,
  "NotificationPipeName": null,
  "NotificationSocketAddress": null,
  "NoRestart": false,
  "OverwriteAutoLogon": false,
  "Pool": "Linux",
  "ProjectName": null,
  "ProxyPassword": null,
  "ProxyUserName": null,
  "ProxyUrl": null,
  "Replace": true,
  "RunAsAutoLogon": false,
  "RunAsService": false,
  "RunOnce": false,
  "PreventServiceStart": false,
  "SslCACert": null,
  "SslClientCert": null,
  "SslClientCertArchive": null,
  "SslClientCertKey": null,
  "SslClientCertPassword": null,
  "SslSkipCertValidation": false,
  "Url": "REDACTED",
  "WindowsLogonAccount": null,
  "WindowsLogonPassword": null,
  "Work": "_work",
  "Auth": "NEGOTIATE",
  "LaunchBrowser": false,
  "Password": "***",
  "Token": null,
  "Unattended": true,
  "UserName": "REDACTED",
  "ClientId": null,
  "TenantId": null,
  "ClientSecret": null,
  "Help": false,
  "Version": false
}
[2025-03-07 10:40:57Z INFO AgentProcess] Arguments parsed
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Proxy': '/azp/.proxy'
[2025-03-07 10:40:57Z INFO VstsAgentWebProxy] No proxy setting found.
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Certificates': '/azp/.certificates'
[2025-03-07 10:40:57Z INFO AgentCertificateManager] No certificate setting found.
[2025-03-07 10:40:57Z INFO Agent] ExecuteCommand
[2025-03-07 10:40:57Z INFO ConfigurationStore] currentAssemblyLocation: /azp/bin/Agent.Listener.dll
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO ConfigurationStore] binPath: /azp/bin
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO ConfigurationStore] RootFolder: /azp
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Agent': '/azp/.agent'
[2025-03-07 10:40:57Z INFO ConfigurationStore] ConfigFilePath: /azp/.agent
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Credentials': '/azp/.credentials'
[2025-03-07 10:40:57Z INFO ConfigurationStore] CredFilePath: /azp/.credentials
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Service': '/azp/.service'
[2025-03-07 10:40:57Z INFO ConfigurationStore] ServiceConfigFilePath: /azp/.service
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Autologon': '/azp/.autologon'
[2025-03-07 10:40:57Z INFO ConfigurationStore] AutoLogonSettingsFilePath: /azp/.autologon
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'Options': '/azp/.options'
[2025-03-07 10:40:57Z INFO ConfigurationStore] RuntimeOptionsFilePath: /azp/.options
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO HostContext] Well known config file 'SetupInfo': '/azp/.setup_info'
[2025-03-07 10:40:57Z INFO ConfigurationStore] SetupInfoFilePath: /azp/.setup_info
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
  ___                      ______ _            _ _
 / _ \                     | ___ (_)          | (_)
/ /_\ \_____   _ _ __ ___  | |_/ /_ _ __   ___| |_ _ __   ___  ___
|  _  |_  / | | | '__/ _ \ |  __/| | '_ \ / _ \ | | '_ \ / _ \/ __|
| | | |/ /| |_| | | |  __/ | |   | | |_) |  __/ | | | | |  __/\__ \
\_| |_/___|\__,_|_|  \___| \_|   |_| .__/ \___|_|_|_| |_|\___||___/
                                   | |
        agent v3.238.0             |_|          (commit da4a9e9)

[2025-03-07 10:40:57Z INFO ConfigurationManager] ConfigureAsync
[2025-03-07 10:40:57Z INFO ConfigurationStore] IsConfigured()
[2025-03-07 10:40:57Z INFO ConfigurationStore] IsConfigured: False
[2025-03-07 10:40:57Z INFO ConfigurationManager] Is configured: False
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'sslskipcertvalidation': 'False'
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: >> End User License Agreements:
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Bin': '/azp/bin'
[2025-03-07 10:40:57Z INFO HostContext] Well known directory 'Root': '/azp'
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: Building sources from a TFVC repository requires accepting the Team Explorer Everywhere End User License Agreement. This step is not required for building sources from Git repositories.

A copy of the Team Explorer Everywhere license agreement can be found at:
  /azp/license.html
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'acceptteeeula': 'True'
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'deploymentgroup': 'False'
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'deploymentpool': 'False'
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'environment': 'False'
[2025-03-07 10:40:57Z INFO ExtensionManager] Getting extensions for interface: 'Microsoft.VisualStudio.Services.Agent.Listener.Configuration.IConfigurationProvider'
[2025-03-07 10:40:57Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Listener.Configuration.BuildReleasesAgentConfigProvider, Agent.Listener
[2025-03-07 10:40:57Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Listener.Configuration.DeploymentGroupAgentConfigProvider, Agent.Listener
[2025-03-07 10:40:57Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Listener.Configuration.SharedDeploymentAgentConfigProvider, Agent.Listener
[2025-03-07 10:40:57Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Listener.Configuration.EnvironmentVMResourceConfigProvider, Agent.Listener
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: >> Connect:
[2025-03-07 10:40:57Z INFO Terminal] WRITE LINE: 
[2025-03-07 10:40:57Z INFO CommandSettings] Arg 'url': 'REDACTED'
[2025-03-07 10:40:57Z INFO ConfigurationManager] GetCredentialProvider
[2025-03-07 10:40:57Z INFO CommandSettings] Arg 'auth': 'NEGOTIATE'
[2025-03-07 10:40:57Z INFO ConfigurationManager] Creating credential for auth: NEGOTIATE
[2025-03-07 10:40:57Z INFO CredentialManager] GetCredentialProvider
[2025-03-07 10:40:57Z INFO CredentialManager] Creating type NEGOTIATE
[2025-03-07 10:40:57Z INFO CredentialManager] Creating credential type: NEGOTIATE
[2025-03-07 10:40:57Z INFO PersonalAccessToken] EnsureCredential
[2025-03-07 10:40:57Z INFO CommandSettings] Arg 'username': 'tfs_agent@arp.local'
[2025-03-07 10:40:57Z INFO CommandSettings] Arg 'password': '***'
[2025-03-07 10:40:57Z INFO ConfigurationManager] cred retrieved
[2025-03-07 10:40:57Z INFO CommandSettings] Flag 'sslskipcertvalidation': 'False'
[2025-03-07 10:40:57Z INFO NegotiateCredential] GetVssCredentials
[2025-03-07 10:40:57Z INFO NegotiateCredential] User name retrieved.
[2025-03-07 10:40:57Z INFO NegotiateCredential] Password retrieved.
[2025-03-07 10:40:57Z INFO NegotiateCredential] URL retrieved: REDACTED
[2025-03-07 10:40:57Z INFO VisualStudioServices] Starting operation Location.GetConnectionData
[2025-03-07 10:40:58Z WARN VisualStudioServices] Authentication failed with status code 401.
X-TFS-ProcessId: 2c46923e-dc8d-4716-948d-64c800005b36
Strict-Transport-Security: max-age=0
ActivityId: bb13589b-e6b6-4c37-8056-706ba3815076
X-TFS-Session: caf2d2cc-d366-4089-994f-c573cdfde1ed
X-VSS-E2EID: d6386a0f-43f1-408a-a941-dbc7cceb934d
X-VSS-SenderDeploymentId: d332e7d9-0cfd-47f3-95f9-043e6f3e66ff
X-TFS-SoapException: %3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%3Csoap%3AEnvelope%20xmlns%3Asoap%3D%22http%3A%2F%2Fwww.w3.org%2F2003%2F05%2Fsoap-envelope%22%3E%3Csoap%3ABody%3E%3Csoap%3AFault%3E%3Csoap%3ACode%3E%3Csoap%3AValue%3Esoap%3AReceiver%3C%2Fsoap%3AValue%3E%3Csoap%3ASubcode%3E%3Csoap%3AValue%3EUnauthorizedRequestException%3C%2Fsoap%3AValue%3E%3C%2Fsoap%3ASubcode%3E%3C%2Fsoap%3ACode%3E%3Csoap%3AReason%3E%3Csoap%3AText%20xml%3Alang%3D%22en%22%3ETF400813%3A%20Resource%20not%20available%20for%20anonymous%20access.%20Client%20authentication%20required.%3C%2Fsoap%3AText%3E%3C%2Fsoap%3AReason%3E%3C%2Fsoap%3AFault%3E%3C%2Fsoap%3ABody%3E%3C%2Fsoap%3AEnvelope%3E
X-TFS-ServiceError: TF400813%3A%20Resource%20not%20available%20for%20anonymous%20access.%20Client%20authentication%20required.
WWW-Authenticate: Bearer, Basic realm="https://devops.arpideas.pl/", Negotiate, NTLM
X-Powered-By: ASP.NET
P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT"
Lfs-Authenticate: NTLM
X-Content-Type-Options: nosniff
Date: Fri, 07 Mar 2025 10:40:57 GMT

[2025-03-07 10:40:58Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
[2025-03-07 10:40:58Z INFO LocationServer] Unable to connect to https://devops.arpideas.pl/arp.
[2025-03-07 10:40:58Z ERR  LocationServer] System.ComponentModel.Win32Exception (0x80090020): GSSAPI operation failed with error - Unspecified GSS failure.  Minor code may provide more information (Crypto routine failure).
   at System.Net.Security.NegotiateStreamPal.AcquireCredentialsHandle(String package, Boolean isServer, NetworkCredential credential)
   at System.Net.NTAuthentication.Initialize(Boolean isServer, String package, NetworkCredential credential, String spn, ContextFlagsPal requestedContextFlags, ChannelBinding channelBinding)
   at System.Net.Http.AuthenticationHelper.SendWithNtAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean isProxyAuth, HttpConnection connection, HttpConnectionPool connectionPool, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.AuthenticationHelper.SendWithAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean preAuthenticate, Boolean isProxyAuth, Boolean doRequestAuth, HttpConnectionPool pool, CancellationToken cancellationToken)
   at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync(HttpRequestMessage message, HttpCompletionOption completionOption, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync[T](HttpRequestMessage message, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.GetConnectionDataAsync(ConnectOptions connectOptions, Int64 lastChangeId, CancellationToken cancellationToken, Object userState)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.GetConnectionDataAsync(ConnectOptions connectOptions, Int32 lastChangeId, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.ConnectAsync(ConnectOptions connectOptions, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Agent.LocationServer.ConnectAsync(VssConnection jobConnection) in /mnt/vss/_work/1/s/src/Microsoft.VisualStudio.Services.Agent/LocationServer.cs:line 36
[2025-03-07 10:40:58Z INFO CommandSettings] Flag 'unattended': 'True'
[2025-03-07 10:40:58Z ERR  Agent] System.ComponentModel.Win32Exception (0x80090020): GSSAPI operation failed with error - Unspecified GSS failure.  Minor code may provide more information (Crypto routine failure).
   at System.Net.Security.NegotiateStreamPal.AcquireCredentialsHandle(String package, Boolean isServer, NetworkCredential credential)
   at System.Net.NTAuthentication.Initialize(Boolean isServer, String package, NetworkCredential credential, String spn, ContextFlagsPal requestedContextFlags, ChannelBinding channelBinding)
   at System.Net.Http.AuthenticationHelper.SendWithNtAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean isProxyAuth, HttpConnection connection, HttpConnectionPool connectionPool, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.AuthenticationHelper.SendWithAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean preAuthenticate, Boolean isProxyAuth, Boolean doRequestAuth, HttpConnectionPool pool, CancellationToken cancellationToken)
   at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync(HttpRequestMessage message, HttpCompletionOption completionOption, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync[T](HttpRequestMessage message, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.GetConnectionDataAsync(ConnectOptions connectOptions, Int64 lastChangeId, CancellationToken cancellationToken, Object userState)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.GetConnectionDataAsync(ConnectOptions connectOptions, Int32 lastChangeId, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.ConnectAsync(ConnectOptions connectOptions, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Agent.LocationServer.ConnectAsync(VssConnection jobConnection) in /mnt/vss/_work/1/s/src/Microsoft.VisualStudio.Services.Agent/LocationServer.cs:line 36
   at Microsoft.VisualStudio.Services.Agent.Util.ServerUtil.GetConnectionData(String serverUrl, VssCredentials credentials, ILocationServer locationServer, Boolean skipServerCertificateValidation) in /mnt/vss/_work/1/s/src/Microsoft.VisualStudio.Services.Agent/Util/ServerUtil.cs:line 94
   at Microsoft.VisualStudio.Services.Agent.Util.ServerUtil.DetermineDeploymentType(String serverUrl, VssCredentials credentials, ILocationServer locationServer, Boolean skipServerCertificateValidation) in /mnt/vss/_work/1/s/src/Microsoft.VisualStudio.Services.Agent/Util/ServerUtil.cs:line 85
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.checkIsHostedServer(IConfigurationProvider agentProvider, AgentSettings agentSettings, ICredentialProvider credProvider, Boolean skipServerCertificateValidation) in /mnt/vss/_work/1/s/src/Agent.Listener/Configuration/ConfigurationManager.cs:line 877
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.ConfigureAsync(CommandSettings command) in /mnt/vss/_work/1/s/src/Agent.Listener/Configuration/ConfigurationManager.cs:line 162
   at Microsoft.VisualStudio.Services.Agent.Listener.Agent.ExecuteCommand(CommandSettings command) in /mnt/vss/_work/1/s/src/Agent.Listener/Agent.cs:line 103
[2025-03-07 10:40:58Z ERR  Terminal] WRITE ERROR: GSSAPI operation failed with error - Unspecified GSS failure.  Minor code may provide more information (Crypto routine failure).
@arp-mbender arp-mbender added the bug label Mar 7, 2025
@arp-mbender
Copy link
Author

This is clearly the same issue as described in #4235, however that was marked as stale and closed and the provided workaround / solution cannot be used in a docker container.

@arp-mbender
Copy link
Author

I've also tried to use the latest version of the agent (from DevOps Services), which is v4.251.0. This one seems to completely fail with NTLM authentication...

root@51576e94ee53:/azp# ./config.sh 

  ___                      ______ _            _ _
 / _ \                     | ___ (_)          | (_)
/ /_\ \_____   _ _ __ ___  | |_/ /_ _ __   ___| |_ _ __   ___  ___
|  _  |_  / | | | '__/ _ \ |  __/| | '_ \ / _ \ | | '_ \ / _ \/ __|
| | | |/ /| |_| | | |  __/ | |   | | |_) |  __/ | | | | |  __/\__ \
\_| |_/___|\__,_|_|  \___| \_|   |_| .__/ \___|_|_|_| |_|\___||___/
                                   | |
        agent v4.251.0             |_|          (commit 69c6517)


>> End User License Agreements:

Building sources from a TFVC repository requires accepting the Team Explorer Everywhere End User License Agreement. This step is not required for building sources from Git repositories.

A copy of the Team Explorer Everywhere license agreement can be found at:
  /azp/license.html

Enter (Y/N) Accept the Team Explorer Everywhere license agreement now? (press enter for N) > 

>> Connect:

Enter server URL > REDACTED
Enter authentication type (press enter for PAT) > NEGOTIATE
Enter user name > REDACTED
Enter password > ************
Error reported in diagnostic logs. Please examine the log for more details.
    - /azp/_diag/Agent_20250307-110247-utc.log
TF400813: Resource not available for anonymous access. Client authentication required.
Failed to connect.  Try again or ctrl-c to quit
Enter server URL >

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Area: Agent bug triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@arp-mbender