TFS 2017 - NuGet Publisher step during a build fails with 401 Unauthorized

Question

I have a build definition that includes steps to package and publish a NuGet package to an internal feed. That internal feed resides on the same TFS server.

This is on prem
TFS 2017 15.105.25910.0
Permissions for the feed are:
OWNERS:
- [My account]
- [Collection]\Project Collection Administrators
Contributors
- Project Collection Build Service(TEAM FOUNDATION)
Readers
- [Collection]\Project Collection Valid Users

The NuGet package step works fine, but the NuGet publish step fails with the following error:

Unable to load the service index for source https://[server]/[collection]/_packaging/Feed/nuget/v3/index.json. 
Response status code does not indicate success: 401 (Unauthorized).

I put in a Powershell script early in the build definition to determine the exact account being used during the build process, and it indicated Project Collection Build Service (TEAM FOUNDATION), which has permission to contribute to the feed.

Here are the contents of the Nuget.Config file at C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\NuGet>

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <disabledPackageSources>
    <add key="Microsoft Visual Studio Offline Packages" value="true" />
  </disabledPackageSources>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
</configuration>

What other information would be useful to help me diagnose with issue?

Under the Security tab for my collection, and then under TFS groups, in the group Security Service Group I have listed the following members:[TEAM FOUNDATION], Build\{guid}, Build {Different Guid}. It seems like instead of a Guid it should resolve to the username? Is something perhaps broken here? — Dbloom

PatrickLu-MSFT PatrickLu-MSFT · Accepted Answer · 2017-07-21T09:48:26

Check if the default access level was set to “Stakeholder” in your TFS server.

If so, manually add the TFS Service account/ Project Collection Build Service explicitly to the Advanced group and try to run the build again. For more details please refer this similar issue: TFS 2017 NuGet publisher task fails with 401 - Unauthorized exception

TFS 2017 - NuGet Publisher step during a build fails with 401 Unauthorized

2 Answers