.NET SDK 2.1.500 Auth problem with NuGet Source with space in its name (401 Unauthorized during build restore step)

[livarcocc]

From @Allann on November 20, 2018 1:46

I raised this issue in the community forum https://developercommunity.visualstudio.com/content/problem/386555/401-unauthorized-1.html but might have been the wrong place. Delete this if not required.

Steps to reproduce

Install SDK 2.1.500 on build machine (or use the .Net Core Tools Installer step)
Queue a build
Fails the restore step

Expected behavior

Successful build

Actual behavior

Receive the following build error:

2018-11-19T22:30:07.7941715Z C:\agent_work_tool\dncs\2.1.500\x64\sdk\2.1.500\NuGet.targets(114,5): error : Unable to load the service index for source https://jbsaustralia.pkgs.visualstudio.com/_packaging/34b4571c-020a-41d1-bc1d-9d0d009ca82c/nuget/v3/index.json. [C:\agent_work\9\s\tests\Core.ExceptionTranslationTests\Core.ExceptionTranslationTests.csproj] 2018-11-19T22:30:07.7942009Z C:\agent_work_tool\dncs\2.1.500\x64\sdk\2.1.500\NuGet.targets(114,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:\agent_work\9\s\tests\Core.ExceptionTranslationTests\Core.ExceptionTranslationTests.csproj] 2018-11-19T22:30:07.9077997Z ##[error]Error: C:\agent_work_tool\dncs\2.1.500\x64\dotnet.exe failed with return code: 1 2018-11-19T22:30:07.9087019Z ##[error]Packages failed to restore

Environment data

dotnet --info output:

.NET Core SDK (reflecting any global.json):
 Version:   2.1.500
 Commit:    b68b931422

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.14393
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.1.500\

Host (useful for support):
  Version: 2.1.6
  Commit:  3f4f8eebd8

.NET Core SDKs installed:
  1.1.10 [C:\Program Files\dotnet\sdk]
  1.1.11 [C:\Program Files\dotnet\sdk]
  2.1.202 [C:\Program Files\dotnet\sdk]
  2.1.302 [C:\Program Files\dotnet\sdk]
  2.1.400 [C:\Program Files\dotnet\sdk]
  2.1.401 [C:\Program Files\dotnet\sdk]
  2.1.402 [C:\Program Files\dotnet\sdk]
  2.1.403 [C:\Program Files\dotnet\sdk]
  2.1.500 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 1.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 1.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 1.1.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 1.1.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

I confirmed the SDK was the cause by removing it via the Add Remove Programs and reverting back to 2.1.403. Successfully builds using 2.1.403. Created a brand new Windows 10 machine, only added 2.1.403 and then installed the latest agent. Ran a build, success, changed the tool installer step to use 2.1.500, and the same build failed. Changing back to 403 again passed.

Copied from original issue: dotnet/cli#10365

[jmeijrink]

We have the same issue. I was running dotnet restore with version 2.1.402 and it was working fine. After installing dotnet core 2.1.500 dotnet restore started giving 401 errors on our private nuget feed (JFrog Artifactory) that requires authentication.

After adding a global.json to the folder that specified the previous version, the nuget packages could be restored successfully again.

[nkolev92]

@jmeijrink, @Allann

Do you know if your build tasks are using configs or the credential provider?

Potentially related to #7524

[Allann]

Build task points to the local package feed within Azure DevOps.

We don't use nuget.config in our solutions, instead forcing everyone to use our "Framework" feed.

[jmeijrink]

The feed credentials are stored in Nuget.config, if that is not what you mean, then please tell me what to check. Never heard of the credential provider before. I'm running dotnet restore from the command line.

[nkolev92]

@jmeijrink In 2.1.400 of the SDK, NuGet support for a cross platform credential provider.
https://github.com/Microsoft/artifacts-credprovider

Have either of you reproduced this issue locally?

Also is it consistently reproduce on your CI and on all build agents?

We have had similar reports but we haven't been able to get a consistent repro on our end.

[nkolev92]

We think it could be related to
NuGet/NuGet.Client#2538 and
#7517

[nkolev92]

@jmeijrink @Allann
Do either of you have any spaces in your source name?

[jmeijrink]

Yes, and I can confirm that removing the space solved the issue for me.

[Allann]

locally works fine, the build server fails constantly. I will double check in the morning but since the step uses the feed in the combo box as shown in the image above, I don't think a space is included. Not sure what the step does internally.

[rdeveen]

The temporary generated NuGet.config in c:\build\Agent_work\1\NuGet\tempNuGet_1074.config contains the packageSources and the packageSourceCredential like this:

<?xml version="1.0"?>
<configuration>
  <packageSources>
    <add key="NuGetOrg" value="https://api.nuget.org/v3/index.json"/>
    <add key="79a13a5f-5f77-41ac-a5cb-920a82a97696" value="https://mycompany.pkgs.visualstudio.com/_packaging/79a13a5f-5f77-41ac-a5cb-920a82a97696/nuget/v3/index.json"/>
  </packageSources>
  <packageSourceCredentials>
    <_x0037_9a13a5f-5f77-41ac-a5cb-920a82a97696>
      <add key="Username" value="VssSessionToken"/>
      <add key="ClearTextPassword" value="eyJ0eXAiOiJKV1QiLCJhxxxxxxSOMELONGKEY"/>
    </_x0037_9a13a5f-5f77-41ac-a5cb-920a82a97696>
  </packageSourceCredentials>
</configuration>

The first character of the GUID "7" has been changed to "x0037" . So i think NuGet can't get the correct packageSourceCredentials and thus can not autorize to the NuGet server.

I have copied the temporary NuGet.config file to c:\Users<username>.nuget\NuGet.Config and changed the content to this and the build works!

<?xml version="1.0"?>
<configuration>
  <packageSources>
    <add key="NuGetOrg" value="https://api.nuget.org/v3/index.json"/>
    <add key="My-Packages" value="https://mycompany.pkgs.visualstudio.com/_packaging/79a13a5f-5f77-41ac-a5cb-920a82a97696/nuget/v3/index.json"/>
  </packageSources>
  <packageSourceCredentials>
    <My-Packages>
      <add key="Username" value="VssSessionToken"/>
      <add key="ClearTextPassword" value="eyJ0eXAiOiJKV1QiLCJhxxxxxxSOMELONGKEY"/>
    </My-Packages>
  </packageSourceCredentials>
</configuration>

[nkolev92]

Thanks all for you help in diagnosing this.
We will be fixing it in a patch release.

Please track #7517 for when that happens.