没有权限通过运行Pipeline通过Azure DevOps REST API更新变量组 [英] Having no permission for updating Variable Group via Azure DevOps REST API from running Pipeline

问题描述

简而言之，我正在尝试从构建管道执行PowerShell脚本时更新变量组(增加内部版本号，但这部分并不那么重要).

那么，关于设置当前执行构建管道标识的权限的任何提示吗?

解决方案

OAuth访问令牌是使用" Project Collection Build Service(xxx)"帐户创建的，而不是您的帐户创建的.

因此，您只需要为变量组添加" Project Collection Build Service(xxx)"帐户作为 Administrator 角色.

In a nutshell, I am trying to update a Variable Group when executing a PowerShell script from a build Pipeline (increasing a build number, but this part is not so important).

As it suggested in this topic and Azure DevOps docs I use code similar to:

$url = "$($env:SYSTEM_TEAMFOUNDATIONCOLLECTIONURI)$env:SYSTEM_TEAMPROJECTID/_apis/build-release/definitions/$($env:SYSTEM_DEFINITIONID)?api-version=2.0"
Write-Host "URL: $url"
$pipeline = Invoke-RestMethod -Uri $url -Headers @{
    Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"
}
Write-Host "Pipeline = $($pipeline | ConvertTo-Json -Depth 1000)"

Everything works fine in general except one thing. I seem don't have some sort of permission to update this value receiving the following error message:

You do not have permissions to perform this operation on the variable group. A variable group Administrator should add you to the Administrator role.

However:

1. It's a bit weird as $env:SYSTEM_ACCESSTOKEN to me should actually belong to the process (the Pipeline executing process) which is invoked from inside Azure, so it also should have access to Variable Groups. (In any case, I am not aware of what's the Identity of the currently running Pipeline and where it's setup).

2. I can understand that the process is executed on one machine (actually, across different systems, so that's all complicated and doesn't mean the Pipeline executing Identity automatically has the access to Variable Group directly), but I can't find any documentation on how to setup all those access rights. (The articles on the links attached mention nothing about the access rights).

I've tried to add/setup any (possibly related) users/groups to the Group Variable Permissions (Security section of the Variable Group section), but still no luck with the REST API updates.

So, any hints on setting up the permissions for currently executing Identity of build Pipeline?

解决方案

The OAuth Access Token is created with "Project Collection Build Service(xxx)" account, but not your account.

So you just need to add "Project Collection Build Service(xxx)" account as Administrator role for the variable group.

这篇关于没有权限通过运行Pipeline通过Azure DevOps REST API更新变量组的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！