Configurable Pipeline Runner: Unable to get System Access Token

[danbyrne-tal]

Hi,
I'm trying to use this Azure Devops pipeline task, and when I use it, it throws the following error. I'm not sure why it is so, or what permissions or changes I need to make to allow it to use the SystemAccessToken ...?

2021-10-25T01:24:25.7176135Z ############### Starting task execution ###############
2021-10-25T01:24:25.7193855Z INFO: Setting AZURE_DEVOPS_EXT_PAT
2021-10-25T01:24:25.7222937Z ##[error]Unable to get System Access Token
2021-10-25T01:24:25.7254247Z Error: Unable to get System Access Token
2021-10-25T01:24:25.7254890Z at SdkPipelineRunner.setAccessToken (D:\a_tasks\RunPipelines_d64d9bd6-11d8-461d-8517-56f86cbd9ed6\2.4.2\services\sdkPipelineRunner.js:46:27)
2021-10-25T01:24:25.7271567Z at new SdkPipelineRunner (D:\a_tasks\RunPipelines_d64d9bd6-11d8-461d-8517-56f86cbd9ed6\2.4.2\services\sdkPipelineRunner.js:40:14)
2021-10-25T01:24:25.7272406Z at new RunPipelines (D:\a_tasks\RunPipelines_d64d9bd6-11d8-461d-8517-56f86cbd9ed6\2.4.2\index.js:20:31)
2021-10-25T01:24:25.7273066Z at main (D:\a_tasks\RunPipelines_d64d9bd6-11d8-461d-8517-56f86cbd9ed6\2.4.2\index.js:195:26)
2021-10-25T01:24:25.7273719Z at Object. (D:\a_tasks\RunPipelines_d64d9bd6-11d8-461d-8517-56f86cbd9ed6\2.4.2\index.js:199:5)
2021-10-25T01:24:25.7276531Z at Module._compile (internal/modules/cjs/loader.js:778:30)
2021-10-25T01:24:25.7277083Z at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
2021-10-25T01:24:25.7277501Z at Module.load (internal/modules/cjs/loader.js:653:32)
2021-10-25T01:24:25.7286497Z at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
2021-10-25T01:24:25.7290481Z at Function.Module._load (internal/modules/cjs/loader.js:585:3)

[pweiss-mri]

Is there any update on this? I'm having the same issue.

[DariuszPorowski]

@BSamodien PTAL

[hattan]

@pweiss-mri and @danbyrne-tal Can you provide more context into your pipeline setup? It looks like you are using a windows agent, Are you running a Microsoft hosted agent or self hosted agent?

Also this seems to be a security issue with the ability to read the System Access Token.

[BSamodien]

@pweiss-mri we are unable to reproduce the exception that you are experiencing. could you please share more details surrounding your execution context.

[pweiss-mri]

I'm using ubuntu-latest for a Microsoft hosted agent. In my stack trace for the error the only difference is the start of the file paths. D:\a_tasks\ is replaced by /home/vsts/work/_tasks/ since I'm using linux rather than windows.

I have a very basic release pipeline as a POC for this extension. It has a trigger which connects to a single stage. The stage has 1 task, this one. I'm attempting to trigger a separate CI yaml based pipeline. I've waited for the trigger to start the job on it's own and also manually created a release and deployed my single stage.

The documentation in this repo doesn't cover what sort of access this extension needs via the service connection and PAT. I created a very limited PAT that only has access to the Build scope with Read and Execute access. I also tested a full access PAT and got the same result.

That's all the context I can think of. If there's something else you need to know I'll be happy to help.

[hattan]

Thanks, @pweiss-mri . Will attempt to replicate with the information given. I did try it with an ubuntu hosted agent and simple pipeline and it worked. I will try a multi-stage pipeline and follow up on this thread asap.

It does sound like a permissions issue as the build service isn't able to retrieve that PAT. You can also try running the pipeline with diagnostics enabled to get more insight

[pweiss-mri]

I think I found the issue for my setup. @danbyrne-tal if you're still interested you might want to give this a try.

In the Agent Job settings of my deployment stage I needed to go to the Additional options section and check the "Allow scripts to access the OAuth token" checkbox. That got me to the next error message which was more helpful. I had to adjust my input parameters and grant my service user some explicit permissions on the pipeline.

@BSamodien it might be worth updating the documentation in this repo to include this.