Documentation request: Adding the credential provider for a VSTS / Azure DevOps agent

[buck-mbeer]

Hi there,

I'm attempting to set up our on-premise build agents to use the Credential Provider when restoring packages from our private Azure Artifacts feed. However it's not entirely clear from the documentation how you install the Credential Provider NuGet plugin in a way that the Network Service which runs the VSTS / Azure DevOps Agent service can use it.

Would much appreciate if you can update the docs with this info, as the Credential Provider seems like the perfect solution for this kind of environment.

[satbai]

Are you using the NuGet restore task to restore packages? Which on-premise version of Azure DevOps are you using? If you are using the latest, Azure DevOps Server 2019.0.1, with the nuget task, there is already a version of the new cred provider installed. It's just not enabled by default yet for on-premise. If this is your case, let me know and I'll tell you the steps how to enable it. By the way the next update that's coming up, Azure DevOps Server 2019.1, will automatically use this cred provider when using the NuGet task and the nuget version used is 4.8 or greater.

[buck-mbeer]

I would imagine it's 2019.0.1, yes - the Software Version on the Admin Console About screen states

17.143.28621.4 (AzureDevOps2019)

The task we're using to Restore is this one: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/package/nuget?view=azure-devops-2019

I currently have it working by having created a local user on the machine, installed the cred provider for that user and by running the Agent service as that user. But it'd be great if we could get it working for the default Agent setup.

[satbai]

Great! The NuGet task version that you're using has the cred provider already installed but not used by default. You can use the cred provider by using NuGet version 4.8 or greater and setting the following build variables: NuGet_ForceEnableCredentialProviderV2 to "true" and NuGet.ForceEnableCredentialProvider to "false".

[satbai]

Did this work? Can I close the issue?

[buck-mbeer]

Apologies for the delay Satu, I need to set up a new build agent machine to test this with. I would recommend adding the info you provided here to the ReadMe for anyone else who needs it before 2019.1 is released, and then the ticket can be closed.

[satbai]

The newest version of the cred provider is on by default in Azure DevOps Server 2019 Update 1 RC1 https://docs.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019u1?view=azure-devops#summary-of-whats-new-in-azure-devops-server-2019-update-1-rc1

[buck-mbeer]

@satbai I still need to test this for the new environment that we're (slowly) migrating towards - but in the meanwhile this question has come up again for our legacy environment running on TFS 2017. I'd like to install the credential provider on our on-premise build agents for the 2017 instance, but still the only option that it looks like I have is to create a local user account, install the credential provider on that account and change the user for the VSTS agent service. Is that correct?

[satbai]

Unfortunately, the NuGetCommandV2 pipeline tasks in TFS 2017 don't know about this cred provider yet - the cred provider was released about a year ago. So even if you install this on the build machine, the tasks are not set up to use it so it won't work as expected.

[satbai]

Now that this cred provider is enabled by default with the NuGetCommandV2 pipeline tasks in Azure DevOps Server 2019 Update 1 I'm going to close this issue. I'm choosing not to add the environment variable workaround to the readme because it's only going to work with versions after Azure DevOps Server 2019.0.1 and before Azure DevOps Server 2019 Update 1. This information isn't useful for most users of this cred provider.

But here's a summary:
TFS and Azure DevOps Server versions before 2019.0.1:

• NuGet tasks will be able to authenticate but won't use this cred provider - it'll use the old way of authenticating.

Azure DevOps Server 2019.0.1 forward and versions before Azure DevOps Server 2019 Update 1:

• NuGet task has the cred provider installed but not enabled for the NuGet tasks, which means it'll use the old way of authenticating. If this Artifacts Cred Provider is needed instead, it can be enabled by setting the build variables NuGet_ForceEnableCredentialProviderV2 to "true" and NuGet.ForceEnableCredentialProvider to "false".

Azure DevOps Server 2019 Update 1 (and the NuGet tasks in hosted Azure DevOps):

• NuGet tasks default to this cred provider as long as NuGet version 4.8 or greater is used.