Azure DevOps pipeline - authentication failure when trying to connect to private npm registry

Question

I am trying to use a npm package from a private repository hosted in a different Azure DevOps organisation. I am getting the following error on npm install step:

npm ERR! code E401
npm ERR! Unable to authenticate, need: Bearer authorization_uri=https://login.windows.net/2dfb2f0b-4d21-4268-9559-72926144c918, Basic realm="https://pkgsprodcus1.pkgs.visualstudio.com/", TFS-Federated

My project .npmrc file looks like this:

@{scope}:registry=https://pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/
always-auth=true
strict-ssl=false

I have followed the documentation on setting up the PAT token with Packaging Read & Write permission

I have tried connecting by setting up a service connection which did not work.

I have also tried to by adding the credentials to the project .npmrc file and that does not work either.

.npmrc file with creds:

@{scope}:registry=https://pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/
always-auth=true
strict-ssl=false

//pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/:username=ANYTHING-BUT-EMPTY
//pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/:_password=BASE64-ENCODED-PAT
//pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/:email={EMAIL}
/pkgs.dev.azure.com/{ORG}/{PROJECT}/_packaging/{FEED}/npm/registry/:always-auth=true

I have regenerated the PAT numerous times with different scopes but none worked. (I am generating the PAT from User Settings -> Security in Azure DevOps)

I am able to connect to the feed from my local machine using the vsts-npm-auth package.

Leo Liu-MSFT Leo Liu-MSFT · Accepted Answer · 2020-04-03T06:57:21

Azure DevOps pipeline - authentication failure when trying to connect to private npm registry

According to the document Set up your client's npmrc, we need set the .npmrc containing the credentials in $home for Linux or Mac systems or $env.HOME for win systems in development machine instead of setting it in your the project .npmrc file.

On your development machine, you will also have a .npmrc in $home for Linux or Mac systems or $env.HOME for win systems. This .npmrc should contain credentials for all of the registries that you need to connect to. The NPM client will look at your project's .npmrc, discover the registry, and fetch matching credentials from $home/.npmrc or $env.HOME/.npmrc. Credential acquisition will be discussed in the next section.

And:

You should have a project specific .npmrc containing only your feed's registry information that you discovered from the "Connect to Feed" dialog. There should be no credentials in this file and the file itself is usually adjacent to your project's package.json.

Besides, if you want use the hosted agent, you could use the npm Authenticate task to certification.

Hope this helps.

Azure DevOps pipeline - authentication failure when trying to connect to private npm registry

1 Answers