[Question]: Getting `ERROR_USER_UNAUTHORIZED` when credentials look fine

OmarBazaraa commented 1 year ago

Task name

AzureRmWebAppDeployment

Task version

4

Environment type (Please select at least one enviroment where you face this issue)

[ ] Self-Hosted
[X] Microsoft Hosted
[ ] VMSS Pool
[ ] Container

Azure DevOps Server type

Azure DevOps Server (Please specify exact version in the textbox below)

Azure DevOps Server Version (if applicable)

No response

Operation system

Windows

Question

From April 28th, our Azure DevOps release pipeline that uses AzureRmWebAppDeployment@4 task started to fail with the following logs:

Starting: Deploy my-app WebJob
==============================================================================
Task         : Azure App Service deploy
Description  : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby
Version      : 4.221.103
Author       : Microsoft Corporation
Help         : https://aka.ms/azureappservicetroubleshooting
==============================================================================
Got service connection details for Azure App Service:'my-app'
Trying to update App Service Application settings. Data: null
App Service Application settings are already present.
"C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe" -verb:sync -source:IisApp='D:\a\1\MyBuild\MyDrop\WebJobs' -dest:iisApp='my-app',ComputerName='https://my-app.scm.azurewebsites.net:443/msdeploy.axd?site=my-app',UserName='$my-app',Password='***',AuthType='Basic' -retryAttempts:6 -retryInterval:10000 -enableRule:DoNotDeleteRule -userAgent:VSTS_19422243-19b9-4d85-9ca6-bc961861d287_build_15758_0
Info: Using ID 'e74a0342-28dc-4c30-be59-8d36317fc610' for connections to the remote server.
"C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe" -verb:sync -source:IisApp='D:\a\1\MyBuild\MyDrop\WebJobs' -dest:iisApp='my-app',ComputerName='https://my-app.scm.azurewebsites.net:443/msdeploy.axd?site=my-app',UserName='$my-app',Password='***',AuthType='Basic' -retryAttempts:6 -retryInterval:10000 -enableRule:DoNotDeleteRule -userAgent:VSTS_19422243-19b9-4d85-9ca6-bc961861d287_build_15758_0
Info: Using ID 'e27a5642-3f66-437e-bd33-53018e2d212e' for connections to the remote server.
"C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe" -verb:sync -source:IisApp='D:\a\1\MyBuild\MyDrop\WebJobs' -dest:iisApp='my-app',ComputerName='https://my-app.scm.azurewebsites.net:443/msdeploy.axd?site=my-app',UserName='$my-app',Password='***',AuthType='Basic' -retryAttempts:6 -retryInterval:10000 -enableRule:DoNotDeleteRule -userAgent:VSTS_19422243-19b9-4d85-9ca6-bc961861d287_build_15758_0
Info: Using ID 'f0223506-e3ad-413e-8e4f-224d662ca740' for connections to the remote server.
##[error]Error: Error Code: ERROR_USER_UNAUTHORIZED
More Information: Connected to the remote computer ("my-app.scm.azurewebsites.net") using the Web Management Service, but could not authorize. Make sure that you are using the correct user name and password, that the site you are connecting to exists, and that the credentials represent a user who has permissions to access the site.  Learn more at: https://go.microsoft.com/fwlink/?LinkId=221672#ERROR_USER_UNAUTHORIZED.
Error: The remote server returned an error: (401) Unauthorized.
Error count: 1.

Successfully added release annotation to the Application Insight : my-app-insights
Successfully updated deployment History at https://my-app.scm.azurewebsites.net/api/deployments/360152671682702576887
App Service Application URL: http://my-app.azurewebsites.net
Finishing: Deploy my-app WebJob

And this is the task definition that has been working for over 2 years already:

# Using the task name 'AzureRmWebAppDeployment' causes internal conflicts.
# It's recommended to use the id instead https://developercommunity.visualstudio.com/solutions/310937/view.html.
- task: 497D490F-EEA7-4F2B-AB94-48D9C1ACDCB1@4
  displayName: 'Deploy my-app WebJob'
  inputs:
    ConnectionType: 'AzureRM'
    azureSubscription: 'My-Central-Connection'
    appType: 'webApp'
    WebAppName: 'my-app'
    deployToSlotOrASE: false
    ResourceGroupName: 'my-rg'
    SlotName: 'production'
    packageForLinux: '$(myWebJobPath)'
    enableCustomDeployment: true
    takeAppOfflineFlag: false
    excludeFilesFromAppDataFlag: false
    appSettings: '$(myAppSettings)'

I have checked the Azure DevOps service connection My-Central-Connection and it is still active (none of its secrets has expired).

Can you please assist on what should be done to fix the issue? Our pipeline is blocked for a week now.

Thanks

OmarBazaraa commented 1 year ago

Using AzureWebApp instead of AzureRmWebAppDeployment fixed the problem for me.

v-jasric commented 1 year ago

I'm experiencing this problem too. I deploy to a virtual directory, and I see AzureWebApp has a parameter to accept a custom deployment directory but it's not available in the GUI. Is there a way to set this parameter with a GUI release pipeline?

workaround: I'm able to rename my packages as .war to get the custom deployment folder to show in the GUI. I used to use /api but need to do ../api since it tries to put it in a webapps folder when deployed.

ckhatri commented 1 year ago

+1 same issue.

https://github.com/microsoft/azure-pipelines-tasks/issues/10181

Found some help here

mahmoud-hatem commented 8 months ago

I was getting similar error, but my pipeline was a classic not yaml. After trying different solutions, these were the steps that resolved my issue:

Be part of organization admins in security tab for the service connection
Make dummy changes in the description and save.
verify connection -> it worked after the change, not before.
changed deployment type to Zip Deploy.

microsoft / azure-pipelines-tasks