Authenticate Azure Pipelines Powershell task against Azure DevOps Rest API

Question

Requirements

My requirement is that for my Azure devops release pipeline I want to tag a specific commit with an annotated tag which contains the build number and the date (which is auto-set on an annotated tag).

Proposed solution

My solution to this is to use a the Azure Powershell pipeline task, the one shown here:

The task (ignore what's in the script box right now) will use the Azure Subscription that I have set in order to authenticate towards the Azure DevOps REST API. I have successfully been able to perform the task I want using a personal access token (PAT) but this is not stable long-term for a whole team and I want to use our Azure Subscription.

The problem

My problem is that I'm not sure how to use the authentication of the Azure Subscription correctly. I seem to get some data using Get-AzureRmContext (see current code below) and then I found a GitHub issue which seems to do sort of the same thing. The code gets some kind of OAuth token but using the code below, Azure still returns to me that I need to sign in, so I assume it's not the correct token. I don't understand how things hatch into each other.

Note that my subscription should have all the permissions it needs to do what I want.

Code so far:

Function Get-AccessToken($tenantId) {
    $cache = [Microsoft.IdentityModel.Clients.ActiveDirectory.TokenCache]::DefaultShared
    $cacheItem = $cache.ReadItems() | Where-Object { $_.TenantId -eq $tenantId } | Select-Object -First 1
    return $cacheItem.AccessToken
}

$context = Get-AzureRmContext
$uri = "https://dev.azure.com/<my_org>/<my_area>/_apis/git/repositories/<project_sha>/annotatedtags?api-version=5.0-preview.1"
$token = Get-AccessToken $context.tenantID

$body = @"
{
    "taggedObject": {
        "objectId": "$(BUILD.SOURCEVERSION)"
    },
    "name": "D-$(Build.BuildNumber)",
    "message": "dummy"
}
"@
$header = @{"Authorization" = "Bearer" + $token}

Invoke-RestMethod -Uri $uri -Method Post -ContentType "application/json" -Body $body -Headers $header

Any help is greatly appreciated!

i was under the impression you dont need to auth to ADO from inside the job? — 4c74356b41
– 4c74356b41, Commented Feb 15, 2019 at 14:23
@4c74356b41 You don't? If I don't specify any authorization header then I get a sign-in html page in response — Jokab
– Jokab, Commented Feb 15, 2019 at 14:24
Possible duplicate of VSTS - allow Scripts to Access OAuth Token in Release Management — Jokab
– Jokab, Commented Feb 15, 2019 at 14:41

Shamrai Aleksander · Accepted Answer · 2019-02-17 13:37:00Z

3

There is the example for the build tasks: Use a PowerShell script to customize your build pipeline

You have to enable access to token (option Allow Scripts to Access OAuth Token)

Then use it in your script. Script from the example:

$url = "$($env:SYSTEM_TEAMFOUNDATIONCOLLECTIONURI)$env:SYSTEM_TEAMPROJECTID/_apis/build/definitions/$($env:SYSTEM_DEFINITIONID)?api-version=5.0"

Write-Host "URL: $url" $pipeline = Invoke-RestMethod -Uri $url -Headers @{ Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN" }

Write-Host "Pipeline = $($pipeline | ConvertTo-Json -Depth 100)"

answered Feb 17, 2019 at 13:37

Shamrai Aleksander

16.6k4 gold badges27 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Authenticate Azure Pipelines Powershell task against Azure DevOps Rest API

Requirements

Proposed solution

The problem

Code so far:

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

Requirements

Proposed solution

The problem

Code so far:

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related