Hi @dm-sidelnikov_5266,

I see the email, thanks for sending this over! Please give me some time to review and I'll let you know what I find.

@pieter-mertens_0372, your issue may be related. Although both products are owned by Microsoft, they still differ in their implementation. Does this happen for all packages or just a specific subset?

Thanks,
Dan

Hi @kichikawa_2913,

Glad to hear it is working now. I know the NuGet client does a lot of caching on it's side, so it is very possible that resetting the credentials for Visual Studio forced a reset of that, but I'm not positive. Either way, I'm happy it is working for you now! Please let us know if you find any other issues with it.

Thanks,
Dan

Hi @kichikawa_2913,

For managing the AD Credentials, that will be fixed in ProGet 6.0.11. Unfortunately, that was not caught in time for the release, but it is fixed in a current development branch.

So I just want to make sure I understand the current state.

• You have updated the AD Credentials to use a user that can query groups.
• When you test the permission in ProGet it shows view/download.
• When one of those users logs into the ProGet UI, they can view and download the packages fine.
• When they try to view and download from Visual Studio, it does not work.

Can you confirm that is correct?

When the user is using visual studio, are they logging in with their domain username and password? Or are they using an API key (username api the key as their password)? Can you try resetting the credentials used for visual studio? We have a walk through on how in our troubleshooting section of the how to add a repository to Visual Studio How To.

Thanks,
Dan

Hi @Russell-Kahler_4399,

If you open InedoHub you should see logs for the failed upgrade. Can you please look in there and tell us what database scripts failed to run?

Thanks,
Dan

Hi @mcascone,

Can you go to your Profile settings and tell me what your Homepage is set to?

Thanks,
Dan

Hi @mcascone,

Thanks for bringing this to our attention. It seems to default to support for me. Does it default as empty or Off Topic for you?

Thanks,
Dan

Hi @kichikawa_2913,

I would agree that does not look like a ProGet error. Please let us know what you find.

Thanks,
Dan

Hi @kichikawa_2913,

Do you happen to have multiple groups with the same name in different OUs? Your log output looks like it found the group, but then the search for the users is not returning any users. If you look at the last line of the debug statement you sent, it shows the group name and OUs it is using when searching. That starts at memberOf=CN=<Group_Name>,OU=.

Thanks,
Dan

Hi @dm-sidelnikov_5266,

This is most likely related to either something missing in the package's metadata or a feature missing in the Azure DevOps NuGet API. We have found that Azure DevOps can be a little loose when it comes to the NuGet API spec.

The easiest way for us to solve this would be to share access to your Azure DevOps registry, we can debug this and get a fix out pretty quickly for it. If that will not work for you, could you run Fiddler on your ProGet server and record the connector requests and send us the exported saz file to review? You can email these too us via support@inedo.com with a subject of "[QA-786] Azure DevOps Null Reference" and we can review it from there.

Thanks,
Dan

Also, I just reviewed the email you sent about the view effective privilege's and it looks like something is not linking up correctly for your users group. Would you be able to run the our AD Test tool 1.13.1 from a windows computer and see if your users show up when searching for members in that group? You will see a tab in that tool called "Get Group's Users". It will allow you to verify we are pulling those users back in that group.

Thanks,
Dan

Hi @kichikawa_2913,

When you are on the "Domains / User Directories" tab, you should see a link at the top that says "revert to single-directory mode". Steve is requesting that you click that link and see if the problems with the groups still exists.

Thanks,
Dan

Hi @marc-ledent_9164,

BuildMaster requires SQL Server to run and cannot be replaced with PostgreSQL. But, you can use BuildMaster to manage the change scripts for a PostgreSQL database. You will just need to install the PostgreSQL extension and create a PostgreSQL database connection. You can learn more by reviewing our CI/CD for Databases documentation.

Please let us know if you have any other questions!

Thanks,
Dan

Hi @kichikawa_2913,

Could you try two things for me?

1. Temporarily disable the Built-In directory and see if it works?
2. Re-enable Built-In and login with the user name in the format of "user@domail.local"?

Thanks,
Dan

Hi @kichikawa_2913,

I think I see what is happening. You currently have both the Built-in and the LDAD user directory enabled. I'm guessing you have users added to the Built-In directory with the same username and it is favoring them. Since those are not in the LDAP group, it is not accepting the permissions. Since you are currently only using the LDAP user directory, I would suggest disabling the Built-In directory.

The other options would be to remove those users from the built-in directory or add groups to the Built-In with the same name as the LDAP groups and give those groups permissions.

Thanks,
Dan

Hi @kichikawa_2913,

Thanks for sending that over. Could you also screenshot the "Domains / User Directories" tab and send that over? Your permissions look correct, I'm wondering if there is another setting that might be conflicting.

Thanks,
Dan

Hi @kichikawa_2913,

Thanks for checking that for me. Based on the fact that you cannot view/download the packages via the UI, this sounds like a permissions configuration issue. Is it possible to share a screen shot of your permissions configuration? You can send it to support@inedo.com with the subject of [QA-785] Permissions Configuration if you do not feel comfortable posting on the forums. This will give us a better idea of things to check for (we would also not post any AD group names directly in the forums either).

One last thing, can you confirm the version of ProGet you are using and the version of the InedoCore extension you have installed?

Thanks,
DAn

Hi @kichikawa_2913,

I believe Steve is suggesting for each user to create a personal API key and then use that to authenticate their NuGet feed. That would allow you to use api as the username and api key as the password. As for where this would be setup, you would create the personal API key in ProGet and use that in the NuGet config.

Just a couple of other questions.

• Are users downloading packages using Visual Studio or the NuGet cli?
  • Visual Studio will actually use the Credential Manager and you would have to change the credentials in there.
  • The NuGet.config is typically better used for the NuGet CLI
• Can the user log in to ProGet's UI and view/download the packages in the feed from the UI?
  • This would indicate that the permissions are configured correctly in ProGet.

Thanks,
Dan

Hi @kichikawa_2913,

Good catch! It looks like this is missing from our documentation. I'll work to get it updated this week!

Thanks,
Dan

Hi @kichikawa_2913,

Thank you for following up with us and letting us know it is working now. Also, thanks for clarifying the Docker network setup for me. This is related to how we changed the service messenger in ProGet v6.

I took a deeper look into the code and when setting the endpoint via the "change" link, it will override the configuration's shared value. Once that has been set, it will use the configuration associated with that node instead.

Based on your screenshot, it looks like it was using tcp://*:6001 as the shared configuration (even though you said not to), but failed to connect because it was trying to balance amongst the other nodes. If you were using a Docker network, this most likely would have worked because the individual nodes could have listened on 6001 as well.

After reviewing these changes, you would have to change the service messenger address on each service node in order to apply the configuration you are looking to use (which is what you did above).

Hopefully this gave a bit more context to this change.

Thanks,
Dan

Hi @kichikawa_2913,

I think the main issue here is that the Service.MessengerEndpoint configuration value is a shared configuration across all nodes in your cluster. Can you try setting that value to tcp://*:6001 and then restart all of your containers?

Also, just a couple of questions:

1. Are your Docker containers running on the same docker network?
2. Do you have High Availability enabled?

Thanks,
Dan