Azure Unauthenticated user where no user is supposed to be recognized

Question

I'm using the Azure REST API to trigger a pipeline from 2 different function apps. In order to do that I'm using an HttpClient and sending a POST request with a Basic token (username:password) in the Authorization header like the documentation says, with an empty user:

client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",
Convert.ToBase64String(
    System.Text.ASCIIEncoding.ASCII.GetBytes(
        string.Format("{0}:{1}", "", token))));

From one of the function apps, using the same token/password works fine. However, from the second function app I get an error message:

{"$id":"1","innerException":null,"message":"TF400813: The user {some guid is shown here in the original message} is not authorized to access this resource.","typeName":"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server","typeKey":"UnauthorizedRequestException","errorCode":0,"eventId":3000}

So even that I'm not sending a user, I'm getting an error about a user not being authorized. I checked and the guid is not a client id of an identity related to the function app. I can't even find that guid at all when searching for it in Azure portal.

What could have caused this error if no user is sent to begin with?

Try to isolate the issue. Test to trigger the pipeline via Rest api with postman. And check if you still have the unauthorized error. — MoonHorse
– MoonHorse, Commented Apr 24 at 7:39
Then there is no permission issue with your token. It is related to your code or function app configuration. — MoonHorse
– MoonHorse, Commented Apr 24 at 21:47

bryanbcook · Accepted Answer · 2025-04-22 22:00:10Z

0

Although the API allows you to specify an empty username, a Personal Access Token is created by a user. Think of it as a private key that represents a set of permissions associated with a specific user.

The user id that appears in the error can be located using the az cli:

az devops user show --user <guid or email address>

Regarding your error message, you either don't have the appropriate scopes defined in the PAT, or the user of the PAT doesn't have permissions to perform the operation you're attempting to do programmatically.

edited Apr 22 at 22:00

answered Apr 22 at 21:33

bryanbcook

19.7k3 gold badges49 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

CodeMonkey Apr 23 at 7:02

Then how does it work for the other function app? Both function apps used to trigger a pipeline in the same Azure organization

bryanbcook Apr 23 at 11:56

Who created the PAT? How are their permissions different between the projects?

bryanbcook Apr 24 at 12:57

Were you able to locate the user using the az cli? Have you confirmed that this user has the permissions on the pipeline you’re attempting to queue?

CodeMonkey Apr 24 at 16:43

Sorry I didn't reply. No, the command didn't find anything. It's still a mystery as to where this user came from

bryanbcook Apr 24 at 17:57

If the GUID is all zeros 0000 -- the PAT is invalid. Otherwise, the user is the owner of the PAT. That's how PERSONAL Access Tokens work.

|

Collectives™ on Stack Overflow

Azure Unauthenticated user where no user is supposed to be recognized

1 Answer 1

10 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related