Skip to content

Conversation

@surajitshil-03
Copy link
Contributor

@surajitshil-03 surajitshil-03 commented Sep 10, 2025

Context

Fixing unauthorized access error while removing agent with the same PAT with which it has been configured
AB #5234


Description

When agents are configured using collection URLs (e.g., https://ado-server/Organization), the server returns a canonical URL which gets stored in the .agent file. During removal, the agent uses this stored canonical URL, but PAT tokens are scoped to the original collection URL used during token creation, causing "You are not authorized to access" errors.


Risk Assessment (Low / Medium / High)

Low


Unit Tests Added or Updated (Yes / No)

No


Additional Testing Performed

Yes manual testing is performed by setting up an on-prem ADO server and then trying to configure and remove the agent using the updated changes and it is working fine.


Change Behind Feature Flag (Yes / No)

No

  • Change is purely additive with zero impact on existing functionality
  • No behavioral changes when new parameter is not used

Tech Design / Approach

  • Reuse existing URL resolution patterns: Leveraged [Configure?.Url ?? Remove?.Url] statement
  • Override timing: URL override occurs before CheckIsHostedServer() to ensure all subsequent operations use correct URL
  • Prompt suppression: Added suppressPromptIfEmpty logic to prevent interactive prompts during removal operations

Trade-offs:

  • Alternative considered: Modifying stored .agent file - Rejected due to persistence complexity and potential side effects
  • Chosen approach: In-memory URL override - Selected for simplicity and surgical impact

Documentation Changes Required (Yes/No)

Yes - Documentation updates needed:

  • Command-line reference documentation to include new --url parameter for remove command

Logging Added/Updated (Yes/No)

Appropriate log statements added: ✅ Added Trace.Info() statement documenting URL override operation


Telemetry Added/Updated (Yes/No)

No

Rollback Scenario and Process (Yes/No)

NA


Dependency Impact Assessed and Regression Tested (Yes/No)

NA

@surajitshil-03
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@surajitshil-03
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@surajitshil-03
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants