Setting up codespaces with private Devops Artifacts repo

[lukaferlez]

I'm unsuccessfully trying to setup my codespaces to use a private artifacts repo hosted on Azure Devops.

• The base image for the devcontainer used is mcr.microsoft.com/devcontainers/dotnet:1-8.0
• I've added the ghcr.io/microsoft/codespace-features/artifacts-helper:latest to the features list of the devcontainer.

Assuming my understanding is correct this should install the Azure Devops Codespaces Authentication extension and the Azure Artifacts Credential Provider nuget credentials plugin which should enable us to fetch the nuget packages.

This is installed as expected and the ~/azure-auth-helper get-access-token will returns a token as expected, the dotnet restore still fails with

warning : [CredentialProvider]Warning: Cannot persist Microsoft authentication token cache securely!

Verbose output will show

[CredentialProvider]Handling 'Request' 'GetAuthenticationCredentials'. Time elapsed in ms: 0 - Payload: {"Uri":"https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json","IsRetry":false,"IsNonInteractive":true,"CanShowDialog":false}
[CredentialProvider]Creating a progress reporter with interval: 00:00:02
[CredentialProvider]Handling auth request, Uri: https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json, IsRetry: False, IsNonInteractive: True, CanShowDialog: False
[CredentialProvider]URI: https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsBuildTaskServiceEndpointCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet with external endpoint credentials. Appropriate environment variable needs to be set.
[CredentialProvider]Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTaskServiceEndpoint.VstsBuildTaskServiceEndpointCredentialProvider, cannot provide credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsBuildTaskCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet. Appropriate environment variables must be set.
[CredentialProvider]Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTask.VstsBuildTaskCredentialProvider, cannot provide credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsCredentialProvider - Matched well-known Azure DevOps Service hostname: pkgs.dev.azure.com
[CredentialProvider]Using NuGetCredentialProvider.CredentialProviders.Vsts.VstsCredentialProvider to try to get credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json.
[CredentialProvider]IsRetry: False
[CredentialProvider]Could not find cached SessionToken for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]Found AAD Authority from 401 headers: https://login.windows.net/xxx
[CredentialProvider]VstsCredentialProvider - Using Entra authority: https://login.windows.net/xxx
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Service Principal'
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Managed Identity'
[CredentialProvider]VstsCredentialProvider - Attempting to acquire bearer token using provider 'MSAL Silent'
[CredentialProvider]MSAL Log (Always): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] [Internal cache] Clearing user token cache accessor.
[CredentialProvider]MSAL Log (Always): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] [Internal cache] Total number of cache partitions found while getting refresh tokens: 0
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] [Region discovery] Not using a regional authority.
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] Found 0 cache accounts and 0 broker accounts
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] Returning 0 accounts
[CredentialProvider]VstsCredentialProvider - Bearer token provider 'MSAL Silent' didn't acquire a token
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Interactive'
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Device Code'
[CredentialProvider]VstsCredentialProvider - Could not obtain credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]Unable to acquire credentials.
[CredentialProvider]Sending response: 'Request' 'GetAuthenticationCredentials'. Time elapsed in ms: 2
[CredentialProvider]Time elapsed in milliseconds after sending response 'Request' 'GetAuthenticationCredentials': 2

In addition to this it will also complain about this

[CredentialProvider]Microsoft.Identity.Client.Extensions.Msal.MsalCachePersistenceException: Persistence check failed. Inspect inner exception for details
---> System.DllNotFoundException: Unable to load shared library 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/libsecret-1.so.0: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/libsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
at Microsoft.Identity.Client.Extensions.Msal.Libsecret.secret_schema_new(String name, Int32 flags, String attribute1, Int32 attribute1Type, String attribute2, Int32 attribute2Type, IntPtr end)
at Microsoft.Identity.Client.Extensions.Msal.LinuxKeyringAccessor.GetLibsecretSchema()
at Microsoft.Identity.Client.Extensions.Msal.LinuxKeyringAccessor.Write(Byte[] data)
at Microsoft.Identity.Client.Extensions.Msal.Storage.VerifyPersistence()
--- End of inner exception stack trace ---
at Microsoft.Identity.Client.Extensions.Msal.Storage.VerifyPersistence()
at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.VerifyPersistence()
at Microsoft.Artifacts.Authentication.MsalCache.GetMsalCacheHelperAsync(String cacheLocation, ILogger logger) in D:\a_work\1\s\src\Authentication\MsalCache.cs:line 52

I can't figure what is missing to get this working, any help would be appreciated.

[markphip]

Something to note is that this all depends on a hack where shell aliases are installed so that the dotnet command is aliased to a bash script that gets the token, sets up the right environment variables for the Artifacts Cred Provider and then runs the real dotnet command. So this only works if that alias is in effect and does its job. If the dotnet command is run directly, none of this happens.

It has to be done this way because the tokens are very short lived. Otherwise we would just globally get a token and stuff it in the environment.