vsts-npm-auth works but ado-npm-auth does not

[edumserrano]

Describe the bug
The docs say that the difference between vsts-npm-auth and ado-npm-auth is that:

• vsts-npm-auth is Windows only and uses MSAL authentication.
• ado-npm-auth is cross-platform and uses the node-azureauth library, to wrap the azureauth-cli, which itself is a cross platform MSAL wrapper.

Given the above I would expect I could swap the vsts-npm-auth package with the ado-npm-auth package without any issue. However, I can authenticate using vsts-npm-auth but with ado-npm-auth I get:

Sorry, but we’re having trouble signing you in.

AADSTS50020: User account 'user-account' from identity provider 'https://sts.windows.net/9274ee3f-9425-4109-a27f-9fb15c10675d/' does not exist in tenant 'Microsoft' and cannot access the application '872cd9fa-d31f-45e0-9eab-6e460a02d1f1'(Visual Studio - Legacy) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

To Reproduce
Steps to reproduce the behavior:

1. Execute npm exec ado-npm-auth

Expected behavior
I expected authentication with the Azure DevOps registry to work.

Additional context
This might be an issue with my organizations AAD setup. But even if that's the case, perhaps the documentation needs to be updated to reflect further requirements since the vsts-npm-auth works for my org but this one does not.

[johnnyreilly]

I believe this is similar to the issue I reported here: #50 (comment)

The error message in my case was:

Failed to get Ado Pat from npx AzureAuth: TF909091: Guest users are not permitted to access this organization as per organization policy. For more information, please contact your organization administrator.

I couldn't get past this problem and ended up spinning up my own project to resolve this. If you bump on the same issues as me then you might find it helpful as well. You can find it here:

https://github.com/johnnyreilly/azdo-npm-auth

and there's an intro blog post here: https://johnnyreilly.com/introducing-azdo-npm-auth

[edumserrano]

@johnnyreilly Thank you for your suggestion but your package also doesn't work for me. When running:

npx -y --registry https://registry.npmjs.org azdo-npm-auth

I get:

◇  ✅ Passed parsing project .npmrc.
│
│     Loading .npmrc at: Z:\repos\<...>\.npmrc
│     Parsed:
- scope:
- organization: <...>
- urlWithoutRegistryAtStart: //pkgs.dev.azure.com/<...>/npm/registry/
- urlWithoutRegistryAtEnd: //pkgs.dev.azure.com/<...>/npm/
│
●  🎬 Starting creating Personal Access Token.
│
◇  ❌ Error creating Personal Access Token.
│
│     Creating Azure CLI Token
│
■  Error: Please run 'az login' from a command prompt to authenticate before using this credential.
└  Operation failed. Exiting - maybe another time? 👋

│
└  📦🔑 Thanks for using azdo-npm-auth 1.4.0! 📦🔑

Perhaps it's because my company's Azure DevOps org does not meet the prerequisites for your package. Right now, the reason why doesn't matter as I don't want to diverge from the issue reported which is that I can authenticate with the vsts-npm-auth package and I cannot with the ado-npm-auth.

[edumserrano]

@johnnyreilly I don't know if before the az CLI didn't show me this warning or maybe I didn't notice but today I tried to run az login and got:

Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136

Retrieving tenants and subscriptions for the selection...
The following tenants don't contain accessible subscriptions. Use az login --allow-no-subscriptions to have tenant level access.
< some guid > < company identifier >
No subscriptions found for < work org email >.

If I then run az login --allow-no-subscriptions I only have one option which under Subscription name shows as N/A(tenant level account) . Once I select that subscription, I can run npx azdo-npm-auth and it works as expected.

[edumserrano]

I'd like to also reiterate that:

• without any login using the az CLI the vsts-npm-auth just works.
• using az login or az login --allow-no-subscriptions, the azdo-npm-auth works

But I cannot get this ado-npm-auth package to work for my organization. With or without doing az login --allow-no-subscriptions. After setting $env:npm_config_registry="https://registry.npmjs.org" and then running npm exec ado-npm-auth I now get:

Selected user account does not exist in tenant 'Microsoft' and cannot access the application '872cd9fa-d31f-45e0-9eab-6e460a02d1f1' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.

• Is there some kind of prerequisites that must be met before using this package?
• Should I even need to use the az login before running npm exec ado-npm-auth ?
• Is there any way I can provide more information so you can help root cause this issue?

[aolszowka]

Sadly we're in the same boat here (same error message), we ended up going back to vsts-npm-auth which works for us as all of our Developers are Windows based.

[johnnyreilly]

@aolszowka I'd be interested to know if azdo-npm-auth works for you?

@edumserrano thanks for sharing the tip below:

az login --allow-no-subscriptions

I'll see if I can add it to the docs!

[aolszowka]

@johnnyreilly No, as mentioned above: ado-npm-auth does not work, we had to go back to using vsts-npm-auth sadly.

EDIT: I realized I misread your question based on the context of this thread and I apologize! To play it back: you have created a new project that attempts to work around/fix the issue and released that as open source. Thank you for that. However unfortunately we work in environments where we can only used the "blessed" Microsoft tools :(

Again so sorry for misreading, that wasn't cool of me!