Build Job got error: VS30063: You are not authorized to access

[culyzhao]

On-Premises TFS2015, All configurations were done following the instructions.
Agent started normally.

[tfsagent@sishr00621 vsts]$ ./run.sh
Scanning for tool capabilities.
Connecting to the server.
2016-12-19 01:59:40Z: Listening for Jobs

but if a build job was sent to this agent, it failed.

2016-12-19 02:00:36Z: Running job: Build
2016-12-19 02:00:38Z: Job Build completed with result: Failed
2016-12-19 02:06:19Z: Running job: Build
2016-12-19 02:06:21Z: Job Build completed with result: Failed
2016-12-19 02:06:50Z: Running job: Build
2016-12-19 02:06:52Z: Job Build completed with result: Failed
2016-12-19 02:22:40Z: Running job: Build
2016-12-19 02:22:42Z: Job Build completed with result: Failed

logs

[2016-12-19 02:22:41Z INFO Worker] Listening for cancel message from the channel.
[2016-12-19 02:22:41Z INFO Worker] Waiting for the job to complete or for a cancel message from the channel.
[2016-12-19 02:22:42Z INFO Worker] Job completed.
[2016-12-19 02:22:42Z ERR Program] Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: VS30063: You are not authorized to access http://tfs2015.mysite:8080.
at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.d__3.MoveNext()

I check the http tracing

Starting capture on eno1 interface
2016-12-19 10:06:50 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 200 OK
2016-12-19 10:06:50 10.203.24.82 10.203.98.3 > PATCH tfs2015.mysite:8080 /tfs/_apis/distributedtask/pools/6/jobrequests/3498?lockToken=00000000-0000-0000-0000-000000000000 HTTP/1.1 - -
2016-12-19 10:06:50 10.203.24.82 10.203.98.3 > DELETE tfs2015.mysite:8080 /tfs/_apis/distributedtask/pools/6/messages/3?sessionId=cd81b0b9-de05-4810-81e4-46e44e968552 HTTP/1.1 - -
2016-12-19 10:06:50 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 100 Continue
2016-12-19 10:06:50 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 204 No Content
2016-12-19 10:06:50 10.203.24.82 10.203.98.3 > GET tfs2015.mysite:8080 /tfs/_apis/distributedtask/pools/6/messages?sessionId=cd81b0b9-de05-4810-81e4-46e44e968552&lastMessageId=3 HTTP/1.1 - -
2016-12-19 10:06:50 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 200 OK
2016-12-19 10:06:52 10.203.24.82 10.203.98.3 > GET tfs2015.mysite:8080 /tfs/DefaultCollection/_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 HTTP/1.1 - -
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 401 Unauthorized
2016-12-19 10:06:52 10.203.24.82 10.203.98.3 > GET tfs2015.mysite:8080 /tfs/DefaultCollection/_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 HTTP/1.1 - -
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 401 Unauthorized
2016-12-19 10:06:52 10.203.24.82 10.203.98.3 > GET tfs2015.mysite:8080 /tfs/DefaultCollection/_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 HTTP/1.1 - -
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 401 Unauthorized
2016-12-19 10:06:52 10.203.24.82 10.203.98.3 > GET tfs2015.mysite:8080 /tfs/DefaultCollection/_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 HTTP/1.1 - -
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 401 Unauthorized
2016-12-19 10:06:52 10.203.24.82 10.203.98.3 > PATCH tfs2015.mysite:8080 /tfs/_apis/distributedtask/pools/6/jobrequests/3498?lockToken=00000000-0000-0000-0000-000000000000 HTTP/1.1 - -
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 100 Continue
2016-12-19 10:06:52 10.203.98.3 10.203.24.82 < - - - HTTP/1.1 200 OK

Now I know the agent can't access /tfs/DefaultCollection/_apis/...,
but curl works very well using the same user and password, and I get a good JSON return.

[xxx _diag]# curl -i -u tfsagent:mypassword "http://tfs2015.mysite:8080/tfs/DefaultCollection/_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1"
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8; api-version=3.0-preview.1
Expires: -1
Server: Microsoft-IIS/8.5
X-TFS-ProcessId: bae5843f-c626-4092-8e69-19523ac8887c
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: OPTIONS,GET,POST,PATCH,PUT,DELETE
Access-Control-Expose-Headers: ActivityId,X-TFS-Session,X-MS-ContinuationToken
Access-Control-Allow-Headers: authorization
X-FRAME-OPTIONS: SAMEORIGIN
....

[culyzhao]

Sorry, I should post this issue to vsts-agent project, not here.