securitytfsbuildvnext

TFS vNext Build: GetSources task does not get files from folder with restricted access


we are currently migrating from XAML build to vNext (TFS2017). The "normal" builds work fine, but the build for our LicenseManager does not work. The folder containing the LicenseManager source code can only be accessed from certain users. So I configured one vNext build agent, where the build service runs on an account that has access to the source code (like we did with the xaml build). I used Capabilities and Demands to force the LicenseManager build on that agent.

But the GetSources task does not download the source code of the LicenseManager. These are the commands that the GetSources task uses:

tf vc workspace /new /location:local /permission:Public ws_1_12 /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /unmap /workspace:ws_1_12 $/ /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /map /workspace:ws_1_12 $/TPA/BuildVNext/1.7 D:\b\a1\_w\1\s\TPA\BuildVNext\1.7 /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /map /workspace:ws_1_12 $/TPA/LicenseMgr/dev/main D:\b\a1\_w\1\s\TPA\LicenseMgr\dev\main /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/internal/BuildHelper/1.6 D:\b\a1\_w\1\s\TPA\DevTools\internal\BuildHelper\1.6 /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/internal/ReferenceManager/1.9 D:\b\a1\_w\1\s\TPA\DevTools\internal\ReferenceManager\1.9 /collection:http://tfs:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/external/MsBuild/ExtensionPack/4.0.9 D:\b\a1\_w\1\s\TPA\DevTools\external\MsBuild\ExtensionPack\4.0.9 /collection:http://tfs.:8080/tfs/DefaultCollection/ /loginType:OAuth /login:.,******** /noprompt
tf vc get /version:178702 /recursive /overwrite D:\b\a1\_w\1\s /loginType:OAuth /login:.,******** /noprompt

All folder except 'LicenseMgr\dev\main' (which is the one with restricted access) get downloaded. But when I open VisualStudio, select the workspace that was created during the build, and select "Get Latest", it does download the code without any problems.

Any help appreciated!

Best Regards Bernd

edit: I have added a simple batch script to the d: drive of the build computer and run that script after the GetSources task was done. This did download all the sources!!!

This is the script:

tf vc workspace /new /location:local /permission:Public %BUILD_REPOSITORY_TFVC_WORKSPACE% /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /unmap /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/ /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /map /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/TPA/BuildVNext/1.7 D:\b\a1\_w\1\s\TPA\BuildVNext\1.7 /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /map /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/TPA/DevTools/internal/BuildHelper/1.6 %BUILD_SOURCESDIRECTORY%\TPA\DevTools\internal\BuildHelper\1.6 /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /map /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/TPA/DevTools/internal/ReferenceManager/1.9 %BUILD_SOURCESDIRECTORY%\TPA\DevTools\internal\ReferenceManager\1.9 /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /map /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/TPA/DevTools/external/MsBuild/ExtensionPack/4.0.9 %BUILD_SOURCESDIRECTORY%\TPA\DevTools\external\MsBuild\ExtensionPack\4.0.9 /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc workfold /map /workspace:%BUILD_REPOSITORY_TFVC_WORKSPACE% $/TPA/LicenseMgr/dev/main %BUILD_SOURCESDIRECTORY%\TPA\LicenseMgr\dev\main /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt
tf vc get /version:%BUILD_SOURCEVERSION% /recursive /overwrite %BUILD_SOURCESDIRECTORY% /noprompt

As I said, this did download all the sources, but have a look at the error messages, especially the account information of the workspace:

D:\b\a1\_w\1\s>tf vc workspace /new /location:local /permission:Public ws_1_12 /collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
The path D:\b\a1\_w\1\s\TPA\BuildVNext\1.7 is already mapped in workspace ws_1_12;Build\beb2741f-e779-4a6f-a20e-033796fec5b7.

D:\b\a1\_w\1\s>tf vc workfold /unmap /workspace:ws_1_12 $/ /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection//noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc workfold /map /workspace:ws_1_12 $/TPA/BuildVNext/1.7 D:\b\a1\_w\1\s\TPA\BuildVNext\1.7 /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/internal/BuildHelper/1.6 D:\b\a1\_w\1\s\TPA\DevTools\internal\BuildHelper\1.6 /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/internal/ReferenceManager/1.9 D:\b\a1\_w\1\s\TPA\DevTools\internal\ReferenceManager\1.9 /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc workfold /map /workspace:ws_1_12 $/TPA/DevTools/external/MsBuild/ExtensionPack/4.0.9 D:\b\a1\_w\1\s\TPA\DevTools\external\MsBuild\ExtensionPack\4.0.9 /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc workfold /map /workspace:ws_1_12 $/TPA/LicenseMgr/dev/main D:\b\a1\_w\1\s\TPA\LicenseMgr\dev\main /collection:/collection:http://tfs.net:8080/tfs/DefaultCollection/ /noprompt 
TF14061: The workspace ws_1_12;Build_LicenseMgr does not exist.

D:\b\a1\_w\1\s>tf vc get /version:178749 /recursive /overwrite D:\b\a1\_w\1\s /noprompt 
D:\b\a1\_w\1\s\TPA\LicenseMgr\dev:
Getting main

edit2: To make my build work I just need on single line in the batch script:

tf vc get /version:%BUILD_SOURCEVERSION% /recursive /overwrite %BUILD_SOURCESDIRECTORY% /noprompt

So the /loginType:OAuth in the original GetSources task is causing the problem for me. The same command without the /loginType does work!


Solution

  • Finally found the root cause of the problem: In XAML builds the account that is configured to run the build service is also used to create the workspace and get the sources. In vNext builds the "Project Collection Build Service" is used to create the workspace and get the sources. The "Project Collection Build Service" account did not have access to the LicenseManager source code.

    After giving the "Project Collection Build Service" account access rights to the LicenseManager source code, everything is working as it should :)