Cannot register a build agent in VSTS

8
votes

I am trying to register a build agent with VSTS by following the instructions here. I created a PAT token in my Security settings and used it to register the agent. I used the following PS command to register the agent:

PS>.\config.cmd --url 'https://[account].visualstudio.com/' --auth 'PAT' --token '[Token]' --pool '[Pool Name]' --agent '[Agent Name]'

I get the following information on the output:

>> Connect:

Connecting to server ...

>> Register Agent:

Scanning for tool capabilities.
Connecting to the server.
Successfully added the agent
Testing agent connection.

But it then gets stuck on this step and never completes. When I look at the agent pool in VSTS I see the new agent, but it's state is 'Offline'.

I looked in the _diag folder and checked the latest log. There is an error there:

[2017-07-11 12:32:10Z WARN VisualStudioServices] Authentication failed with status code 401.
Date: Tue, 11 Jul 2017 12:32:10 GMT
P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT"
Server: Microsoft-IIS/10.0
WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/b8f712c7-d223-4cfb-b165-6267fc789086, Basic realm="https://tfsprodweu2.app.visualstudio.com/", TFS-Federated
X-TFS-ProcessId: f4c5d148-0e01-488f-ab27-69c753e38911
Strict-Transport-Security: max-age=31536000; includeSubDomains
ActivityId: b85558aa-d41a-4763-a311-f2498ddb2dc0
X-TFS-Session: 8242b35d-d5e9-4242-8f52-b7c1f14c451c
X-VSS-E2EID: 6494b165-d486-4064-a5fd-92ae7f201867
X-FRAME-OPTIONS: SAMEORIGIN
X-TFS-FedAuthRealm: https://tfsprodweu2.app.visualstudio.com/
X-TFS-FedAuthIssuer: https://rr-ffes.visualstudio.com/
X-VSS-ResourceTenant: b8f712c7-d223-4cfb-b165-6267fc789086
X-TFS-SoapException: %3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%3Csoap%3AEnvelope%20xmlns%3Asoap%3D%22http%3A%2F%2Fwww.w3.org%2F2003%2F05%2Fsoap-envelope%22%3E%3Csoap%3ABody%3E%3Csoap%3AFault%3E%3Csoap%3ACode%3E%3Csoap%3AValue%3Esoap%3AReceiver%3C%2Fsoap%3AValue%3E%3Csoap%3ASubcode%3E%3Csoap%3AValue%3EUnauthorizedRequestException%3C%2Fsoap%3AValue%3E%3C%2Fsoap%3ASubcode%3E%3C%2Fsoap%3ACode%3E%3Csoap%3AReason%3E%3Csoap%3AText%20xml%3Alang%3D%22en%22%3ETF400813%3A%20Resource%20not%20available%20for%20anonymous%20access.%20Client%20authentication%20required.%3C%2Fsoap%3AText%3E%3C%2Fsoap%3AReason%3E%3C%2Fsoap%3AFault%3E%3C%2Fsoap%3ABody%3E%3C%2Fsoap%3AEnvelope%3E
X-TFS-ServiceError: TF400813%3A%20Resource%20not%20available%20for%20anonymous%20access.%20Client%20authentication%20required.
X-VSS-S2STargetService: 00000002-0000-8888-8000-000000000000/visualstudio.com
X-TFS-FedAuthRedirect: https://app.vssps.visualstudio.com/_signin?realm=rr-ffes.visualstudio.com&reply_to=https%3A%2F%2Frr-ffes.visualstudio.com%2F_apis%2FconnectionData%3FconnectOptions%3D1%26lastChangeId%3D-1%26lastChangeId64%3D-1&redirect=1&context=eyJodCI6MiwiaGlkIjoiNDEzNzE0YzItZWQ2OS00MWRkLWJmMTItNzc0ZTI1ZGEzOTdmIiwicXMiOnt9LCJyciI6IiIsInZoIjoiIiwiY3YiOiIiLCJjcyI6IiJ90#ctx=eyJTaWduSW5Db29raWVEb21haW5zIjpbImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSJdfQ2
X-Powered-By: ASP.NET
X-Content-Type-Options: nosniff

I am sure I correctly entered the PAT access token, so what is the problem?

3
azure-devopsazure-pipelines

3 Answers

4
votes

I found the answer. The authentication failure was a red herring. The actual problem is that it was waiting for user input, but powershell was not writing out the question and waiting for the answer. Here is the line in the log file:

[2017-07-11 14:03:20Z INFO Terminal] WRITE: Enter work folder (press enter for _work) > 
[2017-07-11 14:03:20Z INFO Terminal] READ LINE

In order to get round this problem, I made sure I specified all the required arguments and used --unattended to ensure it wasn't going to ask me anything else. In the end it was like this:

PS>.\config.cmd --url $url --auth 'PAT' --token $patKey --pool $poolId --agent $serverId --work '_work' --runasservice --unattended
1
votes

To fix the issue, I had to go to Administrative Tools > Services, and change the VSTS Agent service account from Network service to Local system.

The service was then able to start and work as expected.

0
votes

I just want to share our story we had the same Exception but my log was different.

[2017-12-04 11:20:37Z WARN VisualStudioServices] Authentication failed with status code 401.

And after struggling around we figured out that the ApplicationPools that running the TFS should have administration level to be able to access Certificate Management