azure-devops extension does not honor az login on azure-cli version 2.30.0

Cadacious commented 2 years ago

This is autogenerated. Please review and update as needed.

Describe the bug

Starting with version 2.30.0 of Azure CLI, the azure-devops extension produces the below error for all calls.

In versions previous to this, including 2.29.2, running az login was enough to allow authentication to Azure DevOps as an authorized account.

Command Name az devops security group list Extension Name: azure-devops. Version: 0.21.0.

Errors:

Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials.  Please see https://aka.ms/azure-devops-cli-auth for more information.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

run az login and login as an account authorized for Azure DevOps
az devops security group list --org {} --project {}

Expected Behavior

az devops commands use authentication information provided from az login command.

Environment Summary

Windows-10-10.0.22000-SP0
Python 3.8.9
Installer: MSI

azure-cli 2.30.0

Extensions:
azure-devops 0.21.0

Additional Context

This occurs for all az devops commands and not just the one listed.

dalemyers commented 2 years ago

We are seeing this as well. Totally breaks this extension for us.

WaitingForGuacamole commented 2 years ago

Confirmed. It was working for me, but not a co-worker who had just installed it. AZ CLI informed me that I was an update behind, so I upgraded. AZ DevOps CLI no longer honors az login. Workaround is to generate a PAT and use az devops login

johnterickson commented 2 years ago

Here's my --debug log:

Looks like it throws here: https://github.com/Azure/azure-devops-cli-extension/blob/0436ad302bb7d852d8c8f0a667b1a674198075e3/azure-devops/azext_devops/dev/common/services.py#L157

which has not changed in years...

PS C:\Users\jerick> az devops security group list --org https://dev.azure.com/mseng --project AzureDevOps --verbose --debug
cli.knack.cli: Command arguments: ['devops', 'security', 'group', 'list', '--org', 'https://dev.azure.com/mseng', '--project', 'AzureDevOps', '--verbose', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x03E450B8>, <function OutputProducer.on_global_arguments at 0x03FB1F10>, <function CLIQuery.on_global_arguments at 0x03FD7B20>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'devops': ['azext_devops']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: Total (0)                 0.000         0         0
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: azure-devops              0.352        60       191  C:\Users\jerick\.azure\cliextensions\azure-devops
cli.azure.cli.core: Total (1)                 0.352        60       191
cli.azure.cli.core: Loaded 60 groups, 191 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : devops security group list
cli.azure.cli.core: Command table: devops security group list
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x0435EF10>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\jerick\.azure\commands\2021-11-05.07-01-19.devops_security_group_list.1828.log'.
az_command_data_logger: command args: devops security group list --org {} --project {} --verbose --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x043A6658>, <function register_global_query_examples_argument.<locals>.register_query_examples at 0x04612D18>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x04612D60>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x04612DF0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x03FB1F58>, <function CLIQuery.handle_query_parameter at 0x03FD7B68>, <function register_global_query_examples_argument.<locals>.handle_example_parameter at 0x043A66E8>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x04612DA8>, <function DevCommandsLoader.post_parse_args at 0x04769B68>]
az_command_data_logger: extension name: azure-devops
az_command_data_logger: extension version: 0.21.0
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli:https://dev.azure.com/mseng
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli: default
cli.azure.cli.core: Current cloud config:
AzureCloud
cli.azext_devops.dev.common.services: trying to get token (temp) for tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 and user jerick@microsoft.com
cli.azext_devops.dev.common.services: not able to get token from az login
cli.azext_devops.dev.common.services: 'Profile' object has no attribute 'get_access_token_for_resource'
Traceback (most recent call last):
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 157, in get_token_from_az_login
    auth_token = profile.get_access_token_for_resource(user, tenant, '499b84ac-1321-427f-aa17-267ca6975798')
AttributeError: 'Profile' object has no attribute 'get_access_token_for_resource'
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli:https://dev.azure.com/mseng
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli: default
cli.azext_devops.dev.common.exception_handler: handling generic error
cli.azure.cli.core.util: azure.cli.core.util.handle_exception is called with an exception:
cli.azure.cli.core.util: Traceback (most recent call last):
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 231, in invoke
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 657, in execute
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 720, in _run_jobs_serially
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 712, in _run_job
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\common\exception_handler.py", line 31, in azure_devops_exception_handler
    reraise(*sys.exc_info())
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\six.py", line 703, in reraise
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 691, in _run_job
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 328, in __call__
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\team\security_group.py", line 43, in list_groups
    client = get_graph_client(organization)
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 227, in get_graph_client
    connection = get_connection(organization)
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 43, in get_connection
    credentials = _get_credentials(organization)
  File "C:\Users\jerick\.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 81, in _get_credentials
    raise get_authentication_error('Before you can run Azure DevOps commands, you need to run the login command'
knack.util.CLIError: Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials.  Please see https://aka.ms/azure-devops-cli-auth for more information.

johnterickson commented 2 years ago

Looks like @jiasli removed this in https://github.com/Azure/azure-cli/pull/19853 which breaks this

jiasli commented 2 years ago

get_access_token_for_resource is for ADAL. Please switch to get_raw_token or get_login_credentials for MSAL credential.

ericob commented 2 years ago

This should be fixed with #1226

krokofant commented 2 years ago

Seems to work with the latest extension version.

az extension update --name azure-devops

Cadacious commented 2 years ago

This is indeed working with the latest version of Azure CLI and azure-devops extension.

Azure / azure-devops-cli-extension