Azure DevOps - Grant pipeline permissions to access a git repository with REST API

0
votes

I've written a script utilizing the Azure DevOps REST API to create a project in an Azure DevOps Organization. The script also creates git repositories, build pipelines, and artifact feeds. All of these are created correctly. But, I am having one issue. When I try to run a pipeline, I get the following message:

This pipeline needs permission to access a resource before this run can continue

A button is provided to grant this permission. BUT, I would like this just work immediately after running the script. Furthermore, the build pipeline may be triggered by an automated process with no manual involvement in the future. I can't find anything in the Azure Documentation for the REST API regarding this specifically. I've also granted all permissions to the GIT repos to the build service. But, I still get the error. Can anyone help me or point me in the right direction?

Thanks

1
azure-devops

1 Answers

0
votes

You could use api Authorizedresources - Authorize Project Resources to authorize the resource:

PATCH https://dev.azure.com/{organization}/{project}/_apis/build/authorizedresources?api-version=6.0-preview.1

Body:

[{"authorized":true,"id":"$queueID","name":"$queueName","type":"queue"}]

There are a few things here:

  1. The “Grant access permissions to all pipelines” setting is per pool per project. But this is toggled via the linked UI or set at creation time in the project settings “add pool” UI.

  2. Pools, at the Organization (or Collection) level, have two settings on them which can be seen in the “Add New Pool” dialog at the Organization level. “Auto-provision this agent pool in all projects” will go ahead and add the pool to all existing projects, as well as when a new project is added in the future. “Grant access permission to all pipelines” sets the default state of the per project level setting above when adding this pool to projects.

The “Default” pool comes preset with “Auto-provision” set to true, and “Grant access…” set to false. So when creating a new project, it will have the “Default” pool available, and in the “Default” pool settings UI for that project “Grant access…” will be set to false until a user updates it.

To modify the “Grant access…” setting seen in the Project Settings Agent Pool UI linked above, you can use the API above, or go to Project settings -- Agent Pools, and toggled the permission as the screenshot below shows:

enter image description here

If you want to modify the Organization setting’s “Default” pool’s default value for “Grant access…” when adding the pool to new projects, you can do it with the following REST API:

PATCH https://dev.azure.com/{organization}/_apis/distributedtask/pools/{poolId}

Headers:

Accept: /;api-version=6.0-preview.1;excludeUrls=true

Content-Type: application/json

Body:

{“id”:“1”,“Properties”:{“System.AutoAuthorize”: “true”}}

Refer to case: https://developercommunity.visualstudio.com/content/problem/887182/new-pipeline-permissions-feature-causing-builds-to.html