Find-PSResource fails with 401 against GitLab using registered resource repository with SecretManagement integration

[robinmalik]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.

Steps to reproduce

Hi,

Attempting to follow Example 4 of the documentation to integrate with our self-hosted GitLab instance (using a project based deploy token with read package permissions) fails with: Find-PSResource: 'Response status code does not indicate success: 401 (Unauthorized).' Re-run the command with -Credential. Debug information shows the secret is being read from the store successfully.

The tokens and permissions are fine (as this works using the equivalent dotnet nuget add source and dotnet package search commands).

I've tested this on a couple of Windows 11 machines, using:

• PowerShell 7.5.1
• Microsoft.PowerShell.SecretStore 1.0.6
• Microsoft.PowerShell.SecretManagement 1.1.2
• Microsoft.PowerShell.PSResourceGet 1.1.1.

I can get this working by registering the resource repository without any credential information, constructing a credential object and passing this to Find-PSResource but I was hoping to avoid this (I'm trying to provide a 'path of least resistance' method for users across the department to access shared modules).

Expected behavior

$vaultname = "GitLabTest"
Register-SecretVault -Name $vaultname -ModuleName Microsoft.PowerShell.SecretStore

$username = "ReadOnlySharedPSModules"
$password = "SOME-!lonG-password-H3rE0"
Set-Secret -Name $username -Secret $password -Vault $vaultname

$registerPSResourceRepositorySplat = @{
  Name = "SharedPSModules"
  Uri = 'https://myserver.domain.com/api/v4/projects/98/packages/nuget/index.json'
  Trusted = $true
  Priority = 51
  CredentialInfo = [Microsoft.PowerShell.PSResourceGet.UtilClasses.PSCredentialInfo]::new(
    $vaultname, $username)
}
Register-PSResourceRepository @registerPSResourceRepositorySplat

Find-PSResource -Repository "SharedPSModules" -Name LULogger

Name     Version Prerelease Repository      Description
----     ------- ---------- ----------      -----------
LULogger 1.0.5              SharedPSModules A PowerShell Logging Module

Actual behavior

Find-PSResource -Repository "SharedPSModules" -Name LULogger -Verbose -Debug
DEBUG: In FindPSResource::ProcessResourceNameParameterSet()
DEBUG: Filtering package name(s) on wildcards
DEBUG: In FindHelper::FindByResourceName()
DEBUG: Parameters passed in >>> Name: 'LULogger'; ResourceType: 'None'; VersionRange: ''; NuGetVersion: ''; VersionType: 'NoVersion'; Version: ''; Prerelease: 'False'; Tag: ''; Repository: 'SharedPSModules'; IncludeDependencies 'False'
VERBOSE: credential successfully read from vault and set for repository: SharedPSModules
DEBUG: Searching through repository 'SharedPSModules'
DEBUG: In FindHelper::SearchByNames()
DEBUG: No version specified, package name is specified
DEBUG: In V3ServerAPICalls::FindName()
DEBUG: In V3ServerAPICalls::FindNameHelper()
DEBUG: In V3ServerAPICalls::GetVersionedPackageEntriesFromRegistrationsResource()
DEBUG: In V3ServerAPICalls::GetResourcesFromServiceIndex()
DEBUG: In V3ServerAPICalls::HttpRequestCall()
DEBUG: Request url is 'https://myserver.domain.com/api/v4/projects/98/packages/nuget/index.json'
DEBUG: In V3ServerAPICalls::FindRegistrationsBaseUrl()
DEBUG: In V3ServerAPICalls::GetVersionedResponsesFromRegistrationsResource()
DEBUG: In V3ServerAPICalls::HttpRequestCall()
DEBUG: Request url is 'https://myserver.domain.com/api/v4/projects/98/packages/nuget/metadata/lulogger/index.json'
Find-PSResource: 'Response status code does not indicate success: 401 (Unauthorized).' Re-run the command with -Credential.

Error details

Exception             : 
    Type       : Microsoft.PowerShell.PSResourceGet.UtilClasses.UnauthorizedException
    TargetSite : 
        Name          : MoveNext
        DeclaringType : [Microsoft.PowerShell.PSResourceGet.Cmdlets.V3ServerAPICalls+<SendV3RequestAsync>d__72]
        MemberType    : Method
        Module        : Microsoft.PowerShell.PSResourceGet.dll
    Message    : 'Response status code does not indicate success: 401 (Unauthorized).' Re-run the command with -Credential.
    Source     : Microsoft.PowerShell.PSResourceGet
    HResult    : -2146233088
    StackTrace : 
   at Microsoft.PowerShell.PSResourceGet.Cmdlets.V3ServerAPICalls.SendV3RequestAsync(HttpRequestMessage message, HttpClient s_client) in C:\__w\1\s\PSResourceGet\src\code\V3ServerAPICalls.cs:line 1668
   at Microsoft.PowerShell.PSResourceGet.Cmdlets.V3ServerAPICalls.HttpRequestCall(String requestUrlV3, ErrorRecord& errRecord) in C:\__w\1\s\PSResourceGet\src\code\V3ServerAPICalls.cs:line 1565
TargetObject          : Microsoft.PowerShell.PSResourceGet.Cmdlets.V3ServerAPICalls
CategoryInfo          : InvalidResult: (Microsoft.PowerShel…ts.V3ServerAPICalls:V3ServerAPICalls) [Find-PSResource], UnauthorizedException
FullyQualifiedErrorId : UnauthorizedRequest,Microsoft.PowerShell.PSResourceGet.Cmdlets.FindPSResource
InvocationInfo        : 
    MyCommand        : Find-PSResource
    ScriptLineNumber : 1
    OffsetInLine     : 1
    HistoryId        : 19
    Line             : Find-PSResource -Repository "SharedPSModules" -Name LULogger -Verbose -Debug
    Statement        : Find-PSResource -Repository "SharedPSModules" -Name LULogger -Verbose -Debug
    PositionMessage  : At line:1 char:1
                       + Find-PSResource -Repository "SharedPSModules" -Name LULogger -Verbose …
                       + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    InvocationName   : Find-PSResource
    CommandOrigin    : Internal
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : 
      0
      1

Environment data

Name                           Value
----                           -----
PSVersion                      7.5.1
PSEdition                      Core
GitCommitId                    7.5.1
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

No response

[robinmalik]

I figured it out. Set-Secret needs to be passed a credential object to -Secret rather than a string:

Set-Secret -Name $username -Secret $CredentialObject

I can see the docs say "The format of the secret must match the requirements of the repository." but we could perhaps save some users time troubleshooting with a bit more clarification / examples there? I'll see if I can fork and raise a PR.