Provider does not seem to work with latest SDK docker image about artifacts-credprovider HOT 16 CLOSED

So, it turns out that the problem is this:

NuGet/Home#7223

The workaround is to ensure that the container in question has a non-default locale (such as en_US.UTF-8) available and in use, after which the provider kicks into gear.

from artifacts-credprovider.

For the complete workaround,
here the code to install a specific locale on a debian based image (like microsoft/dotnet-sdk) :

RUN apt-get update && apt-get install -y locales
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && dpkg-reconfigure --frontend=noninteractive locales && update-locale LANG=en_US.UTF-8
ENV LANG en_US.UTF-8

from artifacts-credprovider.

It’s an Azure Artifacts feed, so I’d expect it to not be misconfigured, because there’s not that much to configure. 🙂

from artifacts-credprovider.

Where is your Nuget feed hosted? I've had success running this with 2.1.402 in Linux against Azure Artifacts, but the plugin does some discovery on the feed to try and work out how it should authenticate. I have failed to run the plugin on our internally hosted TFS server, which I believe could be because it's misconfigured. You can see the discovery I'm talking about in IAuthUtil (https://github.com/Microsoft/artifacts-credprovider/blob/master/CredentialProvider.Microsoft/CredentialProviders/Vsts/IAuthUtil.cs).

Some way to get diagnostic logging would be helpful.

from artifacts-credprovider.

It works for me, so perhaps that may help you narrow down your troubleshooting. My configuration is Ubuntu 18.04, 2.1.402, running on a desktop so not running as root. My installation process was manually copying the netcore directory to ~/.nuget/plugins so that ~/.nuget/plugins/netcore/CredentialProvider.Microsoft exists and contains the DLLs. Running dotnet restore --interactive with a correctly set up NuGet.Config prompts me to do an oauth dance with the provided code, then running dotnet restore afterwards restores my packages as expected.

Note that I did NOT use the install scripts, and I have not set any additional environment variables.

Hope this helps.

from artifacts-credprovider.

I'm forced to conclude that there seems to be something about running dotnet in a Docker container that prevents this from working. I successfully got it to run in an Ubuntu 18.04 VM, then a Debian Stretch VM... and then failed to get it working in the dotnet:2.1-sdk Docker image. I then tried a standard Debian Stretch image, where I manually installed everything, and it didn't work there, either.

from artifacts-credprovider.

Not strictly related, but as an FYI, we do have work planned (not yet scheduled - hopefully sometime in Q4) to get the Credential Provider shipped in the SDK Docker containers by default, so you don't have to manually install them.

from artifacts-credprovider.

@alexmullans do you have an issue tracking that so we can know when it's available?

from artifacts-credprovider.

@ducas only on an internal backlog, sorry :(. It's getting close to the top of the stack; I'm hoping we get to it either this sprint or next (so, 3-6 weeks).

from artifacts-credprovider.

Thanks @alexmullans.

So just to clarify, at the moment I need my Dockerfile to look like this -

FROM microsoft/dotnet:2.1-sdk AS dotnet-builder
ARG FEED_URL
ARG PAT

RUN apt-get update && apt-get install -y locales
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && dpkg-reconfigure --frontend=noninteractive locales && update-locale LANG=en_US.UTF-8
ENV LANG en_US.UTF-8

RUN wget -qO- https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash

WORKDIR /app

COPY ./ .

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS {\"endpointCredentials\": [{\"endpoint\":\"${FEED_URL}\", \"username\":\"build\", \"password\":\"${PAT}\"}]}

RUN dotnet restore --source $FEED_URL
WORKDIR /app/src/WebApi
RUN dotnet publish -c Release -o out

FROM microsoft/dotnet:2.1-runtime AS runtime
WORKDIR /app
COPY --from=dotnet-builder /app/src/WebApi/out .
ENTRYPOINT ["dotnet", "WebApi.dll"]

Once this the provider is rolled into the SDK image I should be able to reduce my Dockerfile to this:

FROM microsoft/dotnet:2.1-sdk AS dotnet-builder
ARG FEED_URL
ARG PAT

WORKDIR /app
COPY ./ .

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS {\"endpointCredentials\": [{\"endpoint\":\"${FEED_URL}\", \"username\":\"build\", \"password\":\"${PAT}\"}]}

RUN dotnet restore --source $FEED_URL
WORKDIR /app/src/WebApi
RUN dotnet publish -c Release -o out

FROM microsoft/dotnet:2.1-runtime AS runtime
WORKDIR /app
COPY --from=dotnet-builder /app/src/WebApi/out .
ENTRYPOINT ["dotnet", "WebApi.dll"]

Is this correct?

from artifacts-credprovider.

That looks right but I don't have a Docker instance stood up to verify. Did this work?

I've also asked the team to produce a sample (which I suspect will look basically like this) when we pick up some additional Credential Provider work in the next sprint or two. Thanks for trailblazing.

from artifacts-credprovider.

Thanks @alexmullans.

So just to clarify, at the moment I need my Dockerfile to look like this -

FROM microsoft/dotnet:2.1-sdk AS dotnet-builder
ARG FEED_URL
ARG PAT

RUN apt-get update && apt-get install -y locales
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && dpkg-reconfigure --frontend=noninteractive locales && update-locale LANG=en_US.UTF-8
ENV LANG en_US.UTF-8

RUN wget -qO- https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash

WORKDIR /app

COPY ./ .

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS {\"endpointCredentials\": [{\"endpoint\":\"${FEED_URL}\", \"username\":\"build\", \"password\":\"${PAT}\"}]}

RUN dotnet restore --source $FEED_URL
WORKDIR /app/src/WebApi
RUN dotnet publish -c Release -o out

FROM microsoft/dotnet:2.1-runtime AS runtime
WORKDIR /app
COPY --from=dotnet-builder /app/src/WebApi/out .
ENTRYPOINT ["dotnet", "WebApi.dll"]

Once this the provider is rolled into the SDK image I should be able to reduce my Dockerfile to this:

FROM microsoft/dotnet:2.1-sdk AS dotnet-builder
ARG FEED_URL
ARG PAT

WORKDIR /app
COPY ./ .

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS {\"endpointCredentials\": [{\"endpoint\":\"${FEED_URL}\", \"username\":\"build\", \"password\":\"${PAT}\"}]}

RUN dotnet restore --source $FEED_URL
WORKDIR /app/src/WebApi
RUN dotnet publish -c Release -o out

FROM microsoft/dotnet:2.1-runtime AS runtime
WORKDIR /app
COPY --from=dotnet-builder /app/src/WebApi/out .
ENTRYPOINT ["dotnet", "WebApi.dll"]

Is this correct?

Does #1 actually works for you at the moment?
I'm struggling with this still.
I still get 401 error.

Are you using the v2 or v3 Azure Artifacts link?

from artifacts-credprovider.

I've got a working setup, with two differences: First, I use:

ENV LC_ALL=en_US.UTF-8

Second, I pass the entire VSS_NUGET_EXTERNAL_FEED_ENDPOINTS string as a build argument. I'm guessing the LC_ALL bit is the important one.

For diagnosing, I recommend you take the last intermediate container ID before the failing restore step from the docker build output, then:

docker run -it --rm <id here> bash

to enter a shell at that stage. There, you can first use set to check whether or not your environment variables actually match what you're expecting. If they do, you can then try to manually run dotnet restore. Note: if the problem is with credentials, you should see error output from the credential provider. If you don't see any output from the credential provider and the restore still fails, it's likely because your locale is incorrect, and the provider invocation fails altogether.

from artifacts-credprovider.

from artifacts-credprovider.

@ducas hopefully, yes. It's number 5 on our backlog right now, and the top few things are looking like they'll finish in the next week or two. Sorry for the delay. I'll have the engineers check in on this thread as we work on the Docker image and better docs for this scenario.

from artifacts-credprovider.

@alexmullans thanks!

from artifacts-credprovider.