-
Notifications
You must be signed in to change notification settings - Fork 300
Description
Summary
I think that there can be identity resolution mismatches when using Azure CLI or environment-based authentication with Azure DevOps, where the authenticated user's identity doesn't properly resolve in the Azure DevOps system due to stale caching. See #413
Issue
I believe the underlying problem is that Azure DevOps's identity system can cache user mappings, and when using programmatic authentication (CLI or environment credentials), the cached identity might not match the token's actual identity. This causes:
- API calls to fail with 401/403 errors
- Operations to be attributed to the wrong user
- Confusion about which user context is active
Fix
I propose updates to src/auth.ts to azcli authentication so that it will ONLY use AzureCliCredential to avoid stale cached credentials and to add X-VSS-ForceMsaPassThrough: true header to src/index.ts to force MSA (Microsoft Account) pass-through to ensure correct identity resolution which will prevent Azure DevOps from using stale cached identity mappings