(401) Unauthorized Error While Running KUDU zipdeploy from VSTS

[joshidp]

Hi There,

I am using VSTS Azure Powershell task to deploy my AspNetCore zip package. Below is the REST call

$kuduApiUrl = "https://$webAppName.scm.azurewebsites.net/api/zipdeploy"

where $webAppName is my app service name

Invoke-RestMethod -Uri $kuduApiUrl -Headers @{Authorization = ("Basic {0}" -f $kuduApiAuthorisationToken) } -Method POST -InFile $ZipPackageFile -ContentType "multipart/form-data"

All input data are valid but still, I am getting 401 UnAuthorised error.

Please suggest what could be the reason?

Let me know if you need more info.

[davidebbo]

Likely explanation is that your kuduApiAuthorisationToken is not valid. So you're hitting auth issue that is not specifically related to VSTS nor to zipdeploy. Any attempt to access scm site with that token would likely fail.

[joshidp]

Hi David,

Thanks for the response.

I am using below code snippets for generating token and it is generating the token perfectly. So still I am not sure what could be the reason for 401

function Get-PublishingProfileCredentials($resourceGroupName, $webAppName) {

    $resourceType = "Microsoft.Web/sites/config"
    $resourceName = "$webAppName/publishingcredentials"

    $publishingCredentials = Invoke-AzureRmResourceAction -ResourceGroupName $resourceGroupName -ResourceType $resourceType -ResourceName $resourceName -Action list -Force

   	return $publishingCredentials
}

function Get-KuduApiAuthorisationHeaderValue($resourceGroupName, $webAppName) {

    Write-Host "Generating access token for web app $webAppName in $resourceGroupName Resource Group"

    $publishingCredentials = Get-PublishingProfileCredentials $resourceGroupName $webAppName

    Write-Host "publishingCredentials"
    Write-Host $publishingCredentials.Properties.PublishingUserName
    Write-Host $publishingCredentials.Properties.PublishingPassword

    return [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $publishingCredentials.Properties.PublishingUserName, $publishingCredentials.Properties.PublishingPassword)))
}

[davidebbo]

As a test, try going to https://$webAppName.scm.azurewebsites.net/basicauth (in a clean Incognito windows), and check that the username & password that you are getting are working when you type them manually in the browser.

[joshidp]

Tried and it's working fine.

[davidebbo]

Then next step is to use F12 tools to see exactly what header is being sent in the working case, and compare it to what you send in your non-working case. You can also try to base64 decode each, and see what you end up with. There must be some difference at some level.

[joshidp]

base64 tokens generated in VSTS release step and in-browser header are exactly matching

[davidebbo]

And what happens if you use the same PowerShell logic locally? If it repros there, at least you'll have eliminated VSTS from the equation.

[joshidp]

in the local same script works fine. No issues in local.

Also, in VSTS if I hardcode all the variable it works there too. But with variables, it doesn't work. Even though the variables have the correct values.

[davidebbo]

I can't explain that, but I think at this point it's best to look at this as a VSTS issue rather than a Kudu issue. You can try opening issue on https://github.com/Microsoft/vsts-tasks.