Home: Regression in .NET SDK 500: 'dotnet tool install' fails with 401 (Unauthorized) when there is a private feed in NuGet.config

[livarcocc]

_From @hrumhurum on November 17, 2018 1:29_

Steps to reproduce

1. Ensure .NET SDK 2.1.500 is installed
2. Ensure there is a private feed in NuGet.config that requires authentication
3. dotnet tool install -g Contoso.FooBar

Expected behavior

Tool 'contoso.foobar' (version '1.2.3') was successfully installed.

Actual behavior

C:Program Filesdotnetsdk2.1.500NuGet.targets(114,5): error : Failed to retrieve information about 'contoso.foobar' from remote source 'https://rd.contoso.com:12345/nuget/feed/FindPackagesById()?id='contoso.foobar'&semVerLevel=2.0.0'. [C:UsersTesterAppDataLocalTemph2vj5tjo.mmyrestore.csproj]
C:Program Filesdotnetsdk2.1.500NuGet.targets(114,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:UsersTesterAppDataLocalTemph2vj5tjo.mmyrestore.csproj]
The tool package could not be restored.

Environment data

dotnet --info output:

.NET Core SDK (reflecting any global.json):
Version: 2.1.500
Commit: b68b931422

Runtime Environment:
OS Name: Windows
OS Version: 6.3.9600
OS Platform: Windows
RID: win81-x64
Base Path: C:Program Filesdotnetsdk2.1.500

Host (useful for support):
Version: 2.1.6
Commit: 3f4f8eebd8

.NET Core SDKs installed:
1.0.4 [C:Program Filesdotnetsdk]
1.1.0 [C:Program Filesdotnetsdk]
2.0.0 [C:Program Filesdotnetsdk]
2.1.102 [C:Program Filesdotnetsdk]
2.1.201 [C:Program Filesdotnetsdk]
2.1.202 [C:Program Filesdotnetsdk]
2.1.500 [C:Program Filesdotnetsdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.6 [C:Program FilesdotnetsharedMicrosoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.6 [C:Program FilesdotnetsharedMicrosoft.AspNetCore.App]
Microsoft.NETCore.App 1.0.5 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 1.1.2 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 2.0.0 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 2.0.6 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 2.0.7 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 2.0.9 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]
Microsoft.NETCore.App 2.1.6 [C:Program FilesdotnetsharedMicrosoft.NETCore.App]

Notes

The issue is not present in .NET Core SDK 2.1.400, e.g. it goes away when .NET Core SDK 2.1.500 is uninstalled, and reappears when SDK 2.1.500 is installed again.

Here is the sample NuGet.config from C:\Users\Tester\Application Data\NuGet folder:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="Microsoft Visual Studio Offline Packages" value="C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\" />
    <add key="Contoso R&amp;D" value="https://rd.contoso.com:12345/nuget/feed" />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
  <packageRestore>
    <add key="enabled" value="True" />
    <add key="automatic" value="True" />
  </packageRestore>
  <bindingRedirects>
    <add key="skip" value="False" />
  </bindingRedirects>
  <packageManagement>
    <add key="format" value="0" />
    <add key="disabled" value="False" />
  </packageManagement>
  <packageSourceCredentials>
    <Contoso_x0020_R_x0026_D>
      <add key="Username" value="tester" />
      <add key="Password" value="..." />
    </Contoso_x0020_R_x0026_D>
  </packageSourceCredentials>
</configuration>

_Copied from original issue: dotnet/cli#10356_

[livarcocc]

Does it work if you just run dotnet restore on a project? Could you try that and let us know what happens.

Alternatively, if this is a VSTS feed, can you run dotnet restore --interactive to authorize the feed and then try to tool install?

[livarcocc]

_From @hrumhurum on November 17, 2018 10:6_

dotnet restore results in a similar error:

Restoring packages for C:TempReproContosoConsumerContosoConsumerContosoConsumer.csproj...
Retrying 'FindPackagesByIdAsyncCore' for source 'https://rd.contoso.com:12345/nuget/feed/FindPackagesById()?id='contoso.foobar'&semVerLevel=2.0.0'.
Response status code does not indicate success: 401 (Unauthorized).
C:Program Filesdotnetsdk2.1.500NuGet.targets(114,5): error : Failed to retrieve information about 'Contoso.FooBar' from remote source 'https://rd.contoso.com:12345/nuget/feed/FindPackagesById()?id='contoso.foobar'&semVerLevel=2.0.0'. [C:TempReproContosoConsumerContosoConsumer.sln]
C:Program Filesdotnetsdk2.1.500NuGet.targets(114,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:TempReproContosoConsumerContosoConsumer.sln]

https://rd.contoso.com:12345/nuget/feed is not a VSTS feed. It's a NuGet.Server proxied behind an IIS with HTTP basic/digest authentication turned on.

Trying to run dotnet restore --interactive does not make any difference.

[livarcocc]

_From @hrumhurum on November 17, 2018 10:40_

A small ready-to-use reproduction sample that shows the error with an existing authenticated MyGet feed:

NuGetAuthRepro.zip

The repro is real and self-sufficient. Just launch the Run.bat file.

It does not work with .NET SDK 2.1.500.
It does work with .NET SDK 2.1.400.

P.S. You may need to invoke dotnet nuget locals http-cache --clear to remove cached HTTP responses when switching from .NET SDK 2.1.400 to .NET SDK 2.1.500 in order to reproduce the issue again, as the auth error may not manifest itself under .NET SDK 2.1.500 when some requests were cached by .NET SDK 2.1.400.

[PatoBeltran]

This seems to be the same issue from https://github.com/NuGet/Home/issues/7517. @hrumhurum can you try not using spaces in the source name and see if that fixes it? Note that the credentials element should match the source name so you might have to edit that one as well...

[hrumhurum]

@PatoBeltran Removing spaces from the source name does not affect the outcome. The issue still persists.

[PatoBeltran]

Try updating the nuget.config to something like:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="Microsoft Visual Studio Offline Packages" value="C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\" />
    <add key="Contoso" value="https://rd.contoso.com:12345/nuget/feed" />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
  <packageRestore>
    <add key="enabled" value="True" />
    <add key="automatic" value="True" />
  </packageRestore>
  <bindingRedirects>
    <add key="skip" value="False" />
  </bindingRedirects>
  <packageManagement>
    <add key="format" value="0" />
    <add key="disabled" value="False" />
  </packageManagement>
  <packageSourceCredentials>
    <Contoso>
      <add key="Username" value="tester" />
      <add key="Password" value="..." />
    </Contoso>
  </packageSourceCredentials>
</configuration>

[Matt-J-Hosking]

This seems to be the same issue from #7517. @hrumhurum can you try not using spaces in the source name and see if that fixes it? Note that the credentials element should match the source name so you might have to edit that one as well...

I was having this issue and removing the space from the source name did fix it. It seemed that using a clear text password kind of fixed it (still failed for custom packages output folder), but no space in the name and it works well now.

[hrumhurum]

@PatoBeltran I followed with the template you have provided. In that case, it does work fine.

The pitfall is this: not only the space character causes the issue, but any other special character like '&' does.

Please find enclosed a ready to use reproduction sample that shows both ' ' and '&' characters causing the problem:
NuGetAuthRepro2.zip

[nkolev92]

@hrumhurum Your repro solution confirms that the issue is duplicate of https://github.com/NuGet/Home/issues/7517.

With that I mean, the fix for #7517 will cover all special characters.

Please follow that one for updates.

[ruijarimba]

I was having this issue as well when trying to use the dotnet restore task on Azure DevOps, using a private build agent. My %appdata%\NuGet\nuget.config looks like this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="MyFeed" value="https://xxxxxxxxxx.pkgs.visualstudio.com/_packaging/xxxxxxxxxx/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <MyFeed>
      <add key="Username" value="LocalBuildAgent" />
      <add key="ClearTextPassword" value="xxxxxxxxxxx" />
    </MyFeed>
  </packageSourceCredentials>
</configuration>

I added the Microsoft Visual Studio Offline Packages package source and everything seems to work fine now.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="Microsoft Visual Studio Offline Packages" value="C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\" />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="MyFeed" value="https://xxxxxxxxxx.pkgs.visualstudio.com/_packaging/xxxxxxxxxx/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <MyFeed>
      <add key="Username" value="LocalBuildAgent" />
      <add key="ClearTextPassword" value="xxxxxxxxxxx" />
    </MyFeed>
  </packageSourceCredentials>
</configuration>

Please note that I didn't remove the .NET SDK 2.1.500 from the build agent.

[bitbonk]

We use the .NET Core SDK 2.2.102 (via the ".NET Core Tool Installer" TFS build task) and .NET restore still fails with the same error. Our private feed has dot in its name like "Foo.Bar".
Is the fix already in the SDK? If yes it doesn't seem to be fixed. If not, when will the fix hit the SDK?

[andrelvahter]

I was having this issue as well when trying to use the dotnet restore task on Azure DevOps, using a private build agent. My %appdata%\NuGet\nuget.config looks like this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="MyFeed" value="https://xxxxxxxxxx.pkgs.visualstudio.com/_packaging/xxxxxxxxxx/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <MyFeed>
      <add key="Username" value="LocalBuildAgent" />
      <add key="ClearTextPassword" value="xxxxxxxxxxx" />
    </MyFeed>
  </packageSourceCredentials>
</configuration>

I added the Microsoft Visual Studio Offline Packages package source and everything seems to work fine now.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="Microsoft Visual Studio Offline Packages" value="C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\" />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="MyFeed" value="https://xxxxxxxxxx.pkgs.visualstudio.com/_packaging/xxxxxxxxxx/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <MyFeed>
      <add key="Username" value="LocalBuildAgent" />
      <add key="ClearTextPassword" value="xxxxxxxxxxx" />
    </MyFeed>
  </packageSourceCredentials>
</configuration>

Please note that I didn't remove the .NET SDK 2.1.500 from the build agent.

In the end what worked for me was

1. Adding add key="Microsoft Visual Studio Offline Packages" value="C:Program Files (x86)Microsoft SDKsNuGetPackages" to NuGet config
2. Start using newest .NET SDK 2.1.504 , seems 500 -> 503 may have this problem.