Can't Authorize YAML Build Task to Use Service Connection about azure-pipelines-yaml HOT 32 CLOSED

I've the same issue here as well. I've altered my YAML files by dividing two region based servers into two deployments instead of one and now it complains about this.
Encountered error(s) while parsing pipeline YAML: Job job_deploy_server: Step input azureSubscription references service connection $(ServicePrincipalRegion) which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.

Adding a variable doesn't do the trick like this work-around, and retricting permission on the pipeline and giving it back the permission didn't solve it either.

Also, the authorize button appears, but doesn't do anything other then give a message that it gave the authorization, which it didn't.

from azure-pipelines-yaml.

By the way, it's easy to miss the button that allows you to authorize! Clicking this can fix the issue

This doesn't work. When you rerun any failed jobs or run the pipeline again, the same error message (and the same button) appears. It says that all resources have been authorised after clicking, but the error message is still there.

from azure-pipelines-yaml.

I Just went through all of the work arounds as well with no luck.

• Why have an "authorize resource" button if it doesn't work?
• Also is there a "yaml" sandbox where I can work through connection issues like this without having to re invoke the entire pipeline?

from azure-pipelines-yaml.

I agree with @FaCoffee1984 ... I created a fresh pipeline for xamarin and facing the same issue. In my case - I am referring a secure file for signing. I get the error notification. I click the button authorize resources. I get the notification that resources were authorized. if we queue the build again - same issue occurs again ... how to proceed ?

from azure-pipelines-yaml.

By the way, it's easy to miss the button that allows you to authorize! Clicking this can fix the issue

from azure-pipelines-yaml.

I am still running into the same issue. Did anyone find a possible solution to this, that hasn't already been mentioned, because they did not work for me?

from azure-pipelines-yaml.

1. Check whether the service endpoint from the error message shows up in the list of service endpoints (under project settings -> Pipelines -> service connections).
2. Check whether you are a member of the user role on that service connection.

from azure-pipelines-yaml.

@damnedOperator If you are using group variables, could you try this? It has fooled me more than once:

• In DevOps, go to Pipelines
• Hover over the three dots on the right hand side of your pipeline and click Edit
• Hover over the three dots in the top-right corner, next to Variables and Run, and click Triggers
• Click on Variables, which is to the left of Triggers
• Click on Variable Groups and then, in the middle of the screen, click on Link variable group
• Choose the relevant variable group which includes your Service Connection and select Link at the bottom
• Re-run your pipeline and it should work

from azure-pipelines-yaml.

Any movement on this?

I've just tried adding this task to my build.yml and i'm getting an error in by PR Build Unable to queue Build

Job Job: Step input azureSubscription references service connection My Subscription which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.

- task: AzureResourceGroupDeployment@2
  displayName: 'Validate ARM Template'
  inputs:
    azureSubscription: 'My Subscription'
    resourceGroupName: 'dev'
    location: 'West Europe'
    csmFile: 'src/Arm/azuredeploy.json'
    csmParametersFile: 'src/Arm/azuredeploy.parameters.json'
    deploymentMode: Validation

from azure-pipelines-yaml.

The "Authorize" Button did nothing to me. After queuing the same error appeared...
The pipeline is not valid. Job Job_1: Step input azureSubscriptionEndpoint references service connection ... which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.
Where do I update the subscription endpoint in the Build pipeline?

from azure-pipelines-yaml.

Hello @TingluoHuang

I can't solve my problem
microsoft/azure-pipelines-agent#1809 (comment)

Thanks

from azure-pipelines-yaml.

@CesarRN can you share your AzurePipeline(VSTS) account name or the pipeline definition url that facing the problem? i can try check our telemetry see what error i can find.

from azure-pipelines-yaml.

@vijayma ?

from azure-pipelines-yaml.

I came across the same issue and posted in stackoverflow - assuming that this is an intended behaviour or a bug that won't fix easily - is there a chance to extend the troubleshooting section here https://aka.ms/yamlauthz - this is the shortcut which appears in the error message - so that people using build pipelines have a chance to fix it - e.g. by adding or changing variables ?

from azure-pipelines-yaml.

Is there any way to authorize and serverEndpoint for a FtpUpload@1 in a JobTemplate? I cannot get this to work with all the known workarounds.

from azure-pipelines-yaml.

Any update?

from azure-pipelines-yaml.

pls read https://stackoverflow.com/questions/53401927/vsts-anybody-managed-to-use-secure-file-in-azure-pipelines-yml/53488887 and follow incorporated link if more background info is required - it is now working for me (using ssh/scp)

from azure-pipelines-yaml.

Still waiting on an update on this.

Updating/adding variables is no longer a viable option as it is very hit and miss.

from azure-pipelines-yaml.

You now have an option in the service connection/variable group/secure file management experience to "authorize all pipelines". If you select that option, then you won't see this error any more.

If you do not want to authorize all pipelines, then we are rolling out another fix for this now/next week. The build that failed will have a banner giving you an option to fix it right there by authorizing the pipeline (and then start another build).

from azure-pipelines-yaml.

I had a same issue. Yaml pipeline reference an environment. After clean up of service connections I have deleted service connection related to the environment. Than the error during the pipeline was confusing. I had to recreated the environment, which was referenced by Yaml pipeline and it solved the issue.

from azure-pipelines-yaml.

I just ran into this issue and fixed it by doing this work-around, which says to edit the pipeline in classic view. I simply set my agent to clean the source before building and saved.

@vijayma I have authorized the service connection for all pipelines, but I still had this issue, so I'm not sure that fixed the problem.

from azure-pipelines-yaml.

I've also run into this issue. Unfortunately the work arounds mentioned didn't work. I had to recreate a new pipeline using the Docker Registry template and let the wizard to generate the service connection and the yaml. After that I've edited the yaml to suit my old one and I also was able to move it in a subfolder.
Probably is worth mentioning that my setup involves a template for building containers in a subfolder and pipeline in the repo's root which uses the templates.

from azure-pipelines-yaml.

Try change the service connection name to the sub name and try again. It worked for me.

from azure-pipelines-yaml.

There should be an option to configure the Pipeline to the new or different Service Connection.
Scenario: I delete an existing Service Connection used by Pipeline. Created a new Service Connection with a different name. But the Pipeline is still referring to old name of the Service Connection object.

As mentioned by @HollyGram9307 , creating the new Service Connection with the old name is a workaround. May not be a suitable workaround for all cases.

from azure-pipelines-yaml.

Like other people here, the "Authorize resources" button didn't work in my case. Nevertheless, the workaround that fixed it for me was editing the service connection and reverting changes:

1. Edit Service connection: change name (copy the old name) and uncheck "Grant Access permission to all pipelines"
2. Click on "Verify and save"
3. Edit Service connection: revert name (paste old name) and check "Grant access permission to all pipelines"
4. Click on "Verify and save"

There must be a bug somewhere that when someone clicks "Grant access permission to all pipelines" it only grants it to the existing pipelines at that point in time.

from azure-pipelines-yaml.

Note: anyone having this issue in the future, I noticed by trial and error that the cause of this famous unauthorized error in android pipelines is the "AndroidSigning@3" task. For some reason, when you reference a secure file in this task, be it as an absolute path to the secure file or as a variable, the pipeline throws the "Unauthorized" error shown in @chalcrow 's picture above.

What I did was to use jarsigner instead of using this task. Jarsigner can be used to sign both apks and aab.

This is how I use jar signer to sign aabs in my yaml file.

- task: CmdLine@2 displayName: 'Signing and aligning AAB file(s) **/*.aab' inputs: script: 'jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 -keystore $(keystore.secureFilePath) -storepass $(KeystorePassword) -keypass $(KeystorePassword) /Users/runner/work/1/s/Platforms/MobileApp.Android/obj/Release/android/bin/mobileapp.aab $(KeyAlias)'

from azure-pipelines-yaml.

By the way, it's easy to miss the button that allows you to authorize! Clicking this can fix the issue

This doesn't work. When you rerun any failed jobs or run the pipeline again, the same error message (and the same button) appears. It says that all resources have been authorised after clicking, but the error message is still there.

Same here.
The subscription exists in service connections, it has all pipeline permissions, yet this authorization error still happens and the authorize resources button does absolutely nothing.

I figured out Microsoft wants us to suffer and that's the reason.
And a way of fixing their issie is not using their platform.

from azure-pipelines-yaml.

By the way, it's easy to miss the button that allows you to authorize! Clicking this can fix the issue

I was using my subscription Id on the yaml, changing to the same name to the service connection just worked, go figure!, Thanks for the post, I was in a real sucking pickle and crazy loop

from azure-pipelines-yaml.

Like other people here, the "Authorize resources" button didn't work in my case. Nevertheless, the workaround that fixed it for me was editing the service connection and reverting changes:

1. Edit Service connection: change name (copy the old name) and uncheck "Grant Access permission to all pipelines"
2. Click on "Verify and save"
3. Edit Service connection: revert name (paste old name) and check "Grant access permission to all pipelines"
4. Click on "Verify and save"

Editing the service connection and just modifying the description fixed the issue for me.
("Grant Access permission to all pipelines" is unchecked in my case.)

from azure-pipelines-yaml.

None of the workarounds or proposed solutions work for me. Referencing a service connection through YAML templating. The name resolution works correctly, but it can't find the SC from the pipeline - authorizations are all set correctly.

from azure-pipelines-yaml.

@damnedOperator If you are using group variables, could you try this? It has fooled me more than once:
In DevOps, go to Pipelines
Hover over the three dots on the right hand side of your pipeline and click Edit
Hover over the three dots in the top-right corner, next to Variables and Run, and click Triggers
Click on Variables, which is to the left of Triggers
Click on Variable Groups and then, in the middle of the screen, click on Link variable group
Choose the relevant variable group which includes your Service Connection and select Link at the bottom
Re-run your pipeline and it should work

We use the Service connections from the Project Properties so this is of no use to us - but deleting the SC and recreating it seemed to work.

from azure-pipelines-yaml.

Microsoft should've changed the naming scheme for task.inputs.azureSubscription.

Example:

steps:
- task: AzureCLI@2
  inputs:
    azureSubscription: <SERVICE_CONNECTION_NAME> # Note: azureSubscription != subscriptionName or subscriptionId
    scriptType: bash
    scriptLocation: inlineScript
    workingDirectory: src
    inlineScript: |
      set -ex
      echo "Listing resource groups..."
      az group list
  displayName: 'List resource groups'

Azure docs highlights the following: azureSubscription: # string. Alias: connectedServiceNameARM. Required. Azure Resource Manager connection.

They connectedServiceNameARM alias can be used instead of azureSubscription. Not sure why they just didn't name it serviceConnectionName. Either way, to solve this The service connection does not exist or has not been authorized for use ensure you use the service connection name instead of your subscriptionName or subscriptionID.

Personally, to make things clearer, I'd go with connectedServiceName rather than azureSubscription:

steps:
- task: AzureCLI@2
  inputs:
    connectedServiceNameARM: <SERVICE_CONNECTION_NAME> # Note: azureSubscription != subscriptionName or subscriptionId
    scriptType: bash
    scriptLocation: inlineScript
    workingDirectory: src
    inlineScript: |
      set -ex
      echo "Listing resource groups..."
      az group list
  displayName: 'List resource groups'

from azure-pipelines-yaml.