6

Right now my NuGet restore fails since the project build user doesn't have contributor access to the package feed.

/usr/share/dotnet/sdk/3.0.100/NuGet.targets(123,5): error : Unable to load the service index for source pkgs.dev.azure.com[..]index.json. /usr/share/dotnet/sdk/3.0.100/NuGet.targets(123,5): error : Response status code does not indicate success: 403 (Forbidden - User 'xxxxxxx' lacks permission to complete this action. You need to have 'ReadPackages'.

The solution is to change the build authorization scope from current project to project collection. This seems very doable as seen here:

https://learn.microsoft.com/en-us/azure/devops/pipelines/build/options?view=azure-devops

But where, in DevOps' myriad menus, can this scope be set?

HenrikMöller
  • 115
  • 1
  • 6
  • A suspiciously similar setting do exist in the organization settings page, under Pipelines/Settings as a toggle named "Limit job authorization scope to current project". However, it is turned off by default which means pipelines should have access to all the projects in the organization. – idursun Oct 31 '19 at 14:57
  • @HenrikMöller Do you try others' solution?Do they work? – Hugh Lin Nov 05 '19 at 01:26
  • @HughLin-MSFT Sorry for the delay, but no. See Elven Spellmaker's comment below. – HenrikMöller Dec 06 '19 at 11:57

4 Answers4

8

EDIT 2023: The Artifacts UI in DevOps has changed since this answer and this answer is no longer valid. See J-M's answer on a similar question: https://stackoverflow.com/a/73136309/5358731

There was a workaround for this 403 error posted a few hours ago: https://developercommunity.visualstudio.com/content/problem/795493/403-error-during-nuget-restore.html

In short, this seems to affect new projects connecting to a private feed. Here's the suggested work around:

  1. Click "Artifacts" in the project with the failing build

enter image description here

  1. Select the feed you were trying to consume in your build and click the cog in the top right corner

enter image description here

  1. Click "Feed Settings"

enter image description here

  1. Go to the Permissions tab

enter image description here

  1. Click the 3 dots [...] that appeared to the right of the tab

enter image description here

  1. Click "Allow project-scoped builds"

enter image description here

This adds the relevant user permissions that the error the OP posted was complaining about. Hopefully Microsoft will make a proper fix for this soon.

Full credit to Tim Lynch from the developer community page.

Mark
  • 1,115
  • 1
  • 7
  • 13
  • This doesn't appear to work for us, unfortunately. We flipped the switch mentioned here https://stackoverflow.com/a/58646507/2604915 and this seemed to work for us... Until this morning, where it no longer works again. I'm awaiting a screensharing session with Microsoft to see if we can glean anything from this. – Elven Spellmaker Nov 15 '19 at 10:04
  • Worked for me. Was consistently receiving a 403 error. Upon flipping the switch worked. However, prior to all, please follow the instructions outlined under Option 2 which I performed: https://www.paraesthesia.com/archive/2019/02/07/using-azure-devops-artifacts-nuget-feeds-in-pipelines/ – user3051574 Apr 18 '20 at 15:23
6

All answers are valid but it depends.

Take into account that only Contributor and Owner roles are allowed to push packages read the docs here.

Then also remember Scoped build identities .

Azure DevOps uses two built-in identities to execute pipelines.

  • A collection-scoped identity, which has access to all projects in the collection (or organization for Azure DevOps Services)
  • A project-scoped identity, which has access to a single project

...

By default, the collection-scoped identity is used, unless the Limit job authorization scope to current project is set in Project Settings > Settings.

With this in mind follow the next steps:

  1. You need to check which identity is being used for your pipelines:

enter image description here

For me is project-scoped identity

  1. Add/Check the Feed Permissions as it may apply (I'll leave a description below the image)

enter image description here

  • No. 1 If the identity is collection-scoped
  • No. 2 If the identity is project-scoped
  • No. 3 Give your contributors the least privilege principle if it applies. (For me its ok to leave them read the feed, and the pipeline or me are the only ones allowed to push packages)

Remember again you need to use Owner or Contributor roles.

David Noreña
  • 3,951
  • 1
  • 28
  • 43
  • In Azure DevOps Server no choice for Limit job authorization scope to current project. Any idea to apply your way ? – arslanaybars Apr 28 '20 at 12:33
  • @arslanaybars please update my anwser, so you can reach more people with your solution if you want – David Noreña May 23 '20 at 00:59
  • Thank you for highlighting this. I wasn't aware of collection-scoped vs. project-scoped. My project was using collection-scoped (as it accesses templates in another project), so I added permissions for `Project Collection Build Service ({OrgName})` to the Artifact Feed and it worked! – Josh Wright Jan 05 '23 at 15:48
2

Go to your feed settings:

enter image description here

In the Permissions tab verify that have at least reader permissions to "Project Collection Build Service (username)":

enter image description here

Shayki Abramczyk
  • 36,824
  • 16
  • 89
  • 114
2

It appears under Organization and Project Settings. Find Pipelines/Settings and there is a toggle option named Limit job authorization scope to current project.

idursun
  • 6,261
  • 1
  • 37
  • 51