Authentication error, while connecting to TFS from VSTS-agent installed Linux-RedHat machine

[sahithreddyk]

Hello,
Am getting authentication error, while accessing TFS URL
As of now,

1. Copied and extracted VSTS agent (vsts-agent-rhel.7.2-x64-2.109.1.tar.gz)
2. Installed pre-requisite (libunwind-1.1-3.el6.x86_64.rpm)
   After executing, .\config.sh
   asking below details,
   Enter server URL > http://:8080/tfs/
   Enter authentication type (press enter for Negotiate) > (pressed enter to negotiate)
   Enter user name > xxxxxxxxxx
   Enter password > ********
   Connecting to server ...
   VS30063: You are not authorized to access http://:8080.
   Failed to connect. Try again or ctrl-c to quit
   Even I tried with changing basic authentication to enable and windows authentication to disabled for Team foundation services, but still am getting error (am the collection administrator, i do have complete access rights).

We are using domain account credentials for username

Can someone advise me on this

Thanks in advance

[TingluoHuang]

@sahithreddyk you should not disable windows authentication when you use negotiate. what kind of credential do you use, a domain account?

[TingluoHuang]

@sahithreddyk are you able to access your TFS in browser from the redhat machine using the same credential?

[Finnegan353]

Also, would you be able to use a PAT Taken as a temporary workaround?

[Finnegan353]

Question is still open but i would just like to add that PAT token give an error of:
Enter a valid value for authentication type.
Enter authentication type (press enter for Negotiate) > PAT
Enter personal access token > ****************************************************
Connecting to server ...
Basic authentication requires a secure connection to the server.
Failed to connect.

[TingluoHuang]

@Finnegan353 PAT require your TFS server is using SSL.

[TingluoHuang]

@sahithreddyk
In your IIS, try add Negotiate as an auth provider to the TFS app.

[sahithreddyk]

@TingluoHuang,
I tried with above changes on both IIS and TeamFoundationServices, but still am facing same error.

Does PAT works to overcome this authentication error?

Thanks in advance

[TingluoHuang]

@sahithreddyk It might help, but we still need to figure out where is the problem.
are you able to collect http trace from your tfs server machine use Fiddler? we need to understand whether your agent machine not send out auth header at all or it send out an auth header, but the identity the auth for doesn't have permission.

[TingluoHuang]

@sahithreddyk PAT require HTTPS/SSL.

http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/MonitorRemoteMachine
https://www.visualstudio.com/en-us/docs/build/admin/agents/v2-windows#run-the-agent-behind-a-web-proxy

check the first link to enable fiddler to capture remote connection traffic.
check the second link to configure your agent to use the Fiddler as a proxy between your agent and your TFS server.

[sahithreddyk]

@TingluoHuang
http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/MonitorRemoteMachine
We don't have UI on the Linux machine, the above link specifying that we need to "set the proxy settings to the machine name of the Fiddler server at port 8888."

We are using TFS 2015.3 version.

Thanks in advance

[TingluoHuang]

@sahithreddyk don't do that step, use the second link to configure your agent to talk through the Fiddler proxy.

[TingluoHuang]

@sahithreddyk doesn't matter, the proxy configure is pure agent side. BTW, are you using Redhat 7.2?

[sahithreddyk]

We are using RedHat 7 only.

Am deleting some of comments due to privacy

Thanks

[TingluoHuang]

@sahithreddyk is there any change you can setup a redhat 7.2 and take a try? the reason is dotnet core is built for 7.2, i am not sure whether 7 will work or not.

[sahithreddyk]

@TingluoHuang Can you please cnofirm, Is PAT applicable for only HTTPS with SSL? and not for HTTP?

[TingluoHuang]

@sahithreddyk yes, you have to use https in order to use PAT.

[sahithreddyk]

@TingluoHuang
As of now, am done with

1. Set Remote Machine Proxy Settings

Start Fiddler on Fiddler server (the machine that will capture the traffic).

Click Tools > Fiddler Options. Ensure Allow remote clients to connect is checked.

I copied "copy browser proxy configuration URL" to the browser,

Result: **// Autogenerated file; do not edit. Rewritten on attach and detach of Fiddler.

// Get the URL to this file from Fiddler by clicking Tools > Fiddler Options > Connections > Copy Browser Proxy Configuration URL.

function FindProxyForURL(url, host){
return 'PROXY ...:8888';**
2. From https://www.visualstudio.com/en-us/docs/build/admin/agents/v2-windows#run-the-agent-behind-a-web-proxy, created a proxy file, do i need use http://PROXY ...:8888 as http://name-of-your-proxy-server:8888

or Do I need to use my TFS url and replace 8080 port with 8888?

Please confirm

Thanks

[TingluoHuang]

@sahithreddyk what's your Fiddler machine IP? in your agent's .proxy, set http://your fiddler machine ip:8888/

[sahithreddyk]

when I click "Copy Browser Proxy Configuration URL" and paste it on web browser and the result is
// Autogenerated file; do not edit. Rewritten on attach and detach of Fiddler.

// Get the URL to this file from Fiddler by clicking Tools > Fiddler Options > Connections > Copy Browser Proxy Configuration URL.

function FindProxyForURL(url, host){
return 'PROXY 119.0.0.1:8888';
}

Can I use http://119.0.0.1:8888 as name of proxy server URL

Thanks in advance

[TingluoHuang]

@sahithreddyk yes.

[sahithreddyk]

@TingluoHuang
Still am getting same error,

FYI, I installed Fiddler on my local machine and not on the Application tier (where TFS installed) and

also on TFS installed server, for IIS and TFS services, I enabled "Negotiate" authentication.

Is there anything I need to look on Fiddler ?

Thanks in advance

[TingluoHuang]

@sahithreddyk is there any http trace shows in your Fiddler?

[sahithreddyk]

@TingluoHuang
To be clear, when I ran ./config.sh on Linux machine, its not showing any http traces on Fiddler (which installed on local machine) and if I open same TFS url, I can able to see some http tracings but I dint find any errors.

comes to TFS url, am just using server URL and not using any specific collection URL

Thanks in advance

[TingluoHuang]

@sahithreddyk the purpose of using Fiddler is to collect the http trace from your agent to your TFS server, so we can figure out what's going wrong.
Assume your have 3 machines.
a: the machine your agent at.
b: the machine you installed Fiddler
c: the machine you installed TFS

So, you configure the Fiddler on machine B to allow remote connection, right? have you change your windows firewall rule to allow all inbond connection?

in machine A, create the .proxy file before configure the agent, and set it to use Fiddler proxy in machine B. have you try run curl http://119.0.0.1:8888 from machine A?

[sahithreddyk]

@TingluoHuang

a: the machine your agent at (RedHat 7 Linux machine)
b: the machine you installed Fiddler (local windows machine)
c: the machine you installed TFS (TFS 2015.3 installed windows machine)
yes, I have created a folder with name of "Myagent" and I installed libunwind-1.1-3.el6.x86_64.rpm
and vsts-agent-rhel.7.2-x64-2.109.1.tar.gz on same folder and I created a file with a name of Out-File.proxy and copied http://119.0.0.1:8888 ans saved it.

getting error, $ curl http://119.0.0.1:8888
curl: (7) Failed connect to 119.0.0.1:8888; Connection refused
what are the specific changes i need to do in firewall and on which machine I have to do?

Thanks in advance

[TingluoHuang]

create a new rule that allow all inbound traffic on machine B

[EdiWang]

I face the same issue with Windows agent, running on same machine as TFS server is on.

My TFS have to use http on public internet because https has problems for us. Now I want to set up a CI build, and found I am not able to config the agent via http.

No matter which auth type I choose, I get:
"Basic authentication requires a secure connection to the server."

My repository is using Git, not TFVC, so it seems I can't set up a XAML build either. It's now a dead end...

[ericsciple]

@EdiWang can you open a separate issue? this is a long thread and i'm not sure the current state of it. also have you tried Integrated?

[TingluoHuang]

try use curl hit you TFS AT directly from your Redhat box.
curl -v http://:8080/tfs/_apis/distributedtask/pools --ntlm -u domain\user1:
make sure CURL works on that box, since the dotnet core just use libcurl on Non-Windows platform. you may want to try update libcurl and curl to latest version.

[TingluoHuang]

close as non-active issue, reopen if needed.

[sahithreddyk]

Sorry for the delay, we had issues with CURL, then we have updated to latest version and issue was resolved few days back.
Thank you for the Suport

Ragards,
Sam