Authentication Error on internal nuget-Feed

[chrisdecker1201]

Hi 😉,

I'm getting an authentication error (see below) and hope you can help me.

We use an "internal" Azure Artifact Feed for consuming our and other nuget-packages. To use this, you've to be authenticated, which is "normally" no issue inside a pipeline. Azrue DevOps use a CredentialProvider, which allows you to automatically get nuget packages from the "internal" feed.

PopulateResources: Loaded 1 package sources from nuget.config
    AddSourceRepo: adding new https://ourinternalfeed.com/nuget/v3/index.json
    Error loading NuGet API Resource from url: https://ourinternalfeed.com/nuget/v3/index.json
Unable to load the service index for source https://ourinternalfeed.com/nuget/v3/index.json.

ERROR: scan failed:  System.Exception: Error loading NuGet API Resource from url: https://ourinternalfeed.com/nuget/v3/index.json
 ---> System.AggregateException: One or more errors occurred. (Unable to load the service index for source https://ourinternalfeed.com/nuget/v3/index.json.)
 ---> NuGet.Protocol.Core.Types.FatalProtocolException: Unable to load the service index for source https://ourinternalfeed.com/nuget/v3/index.json.
 ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 401 (Unauthorized).
   at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
   at NuGet.Protocol.HttpSource.<>c__DisplayClass15_0`1.<<GetAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
[...skipping 3 lines...]
   at NuGet.Protocol.ServiceIndexResourceV3Provider.GetServiceIndexResourceV3(SourceRepository source, DateTime utcNow, ILogger log, CancellationToken token)
   --- End of inner exception stack trace ---
   at NuGet.Protocol.ServiceIndexResourceV3Provider.GetServiceIndexResourceV3(SourceRepository source, DateTime utcNow, ILogger log, CancellationToken token)
   at NuGet.Protocol.ServiceIndexResourceV3Provider.TryCreate(SourceRepository source, CancellationToken token)
   at NuGet.Protocol.Core.Types.SourceRepository.GetResourceAsync[T](CancellationToken token)
   at NugetInspector.NugetApi.AddSourceRepo(SourceRepository source_repo) in ./nuget-inspector/NugetApi.cs:line 365
   at NugetInspector.NugetApi.PopulateResources(List`1 providers, ISettings settings, Boolean with_nuget_org) in ./nuget-inspector/NugetApi.cs:line 330
   at NugetInspector.NugetApi..ctor(String nuget_config_path, String project_root_path, NuGetFramework project_framework, Boolean with_nuget_org) in ./nuget-inspector/NugetApi.cs:line 62
   at NugetInspector.Program.ExecuteInspector(Options options) in ./nuget-inspector/Program.cs:line 99

[sschuberth]

@MarcelBochtler @mnonnenmacher did you happen to test authentication with nuget-inspector in ORT context?

[MarcelBochtler]

@MarcelBochtler @mnonnenmacher did you happen to test authentication with nuget-inspector in ORT context?

Yes we tested this.
I created a file ~/.nuget/NuGet/NuGet.Config like this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSourceCredentials>
    <MyPrivatePackageSource>
        <add key="Username" value="myuser" />
        <add key="ClearTextPassword" value="..." />
    </MyPrivatePackageSource>
  </packageSourceCredentials>
</configuration>

Then nuget-inspector was able to use MyPrivatePackageSource.

It should also be possible to place such a file into your repository directly.
Unfortunately I don't have any experience using Azure DevOps' CredentialProvider, so I cannot help you with this.

[pombredanne]

@chrisdecker1201 Thanks for the report! The authentication should work using the standard .NET authentication way, meaning using a nuget.config as kindly pointed by @MarcelBochtler

At this stage we have not implemented specific support for Azure credential provider https://github.com/microsoft/artifacts-credprovider which is a plugin for the NuGet client

Now I do not have a way to test this as I do not have access to private feeds but it could be working since we reuse all the same libraries that NuGet uses internally.

I wonder if any of these can help https://github.com/dotnet/dotnet-docker/blob/main/documentation/scenarios/nuget-credentials.md#using-the-azure-artifact-credential-provider and https://learn.microsoft.com/en-us/azure/devops/artifacts/nuget/dotnet-setup?view=azure-devops

Some things that could help diagnose the issue:

1. on a clean/fresh manual checkout of your code, does a dotnet restore run OK?
2. on another clean/fresh checkout of your code, does a nuget-inspector command run alright?
3. on the checkout of 1. and after running dotnet restore, does a nuget-inspector command run alright?