Mixing
VSTS: Moving packages between organizations using the REST API
In our Azure DevOps implementation, we have the need to move packages between package management Feeds that live in different organizations. Our current implementation uses 2 Personal Access Tokens (PATs), one with read access to the source organizations' Feeds and the second with write access to the destination organizations' Feeds. This solution works for our current needs, but because of the maintenance required around using PATs, we are exploring alternative implementations.
One avenue that we are currently looking at is using using the SYSTEM_ACCESSTOKEN as described at https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/powershell?view=vsts#oauth, among other places. We're using this token in other pipelines that operate within the same organization and it works as expected. In some cases we've had to add the "Project Collection Build Service ({org-name})" user to the appropriate security groups to access the functionality needed.
The pipeline that performs the move lives in the destination organization. I'm assuming that if we use the SYSTEM_ACCESSTOKEN in our powershell, then it will run under the credentials of the "Project Collection Build Service ({destination-org-name})", in which case it likely won't have access to the Feeds in the source organization. Is this a correct assumption? If so, is there some way to get the OAuth Token for the source organization somehow?
If there is not a way to get the OAuth Token for the source organization, is there some other way that we can move packages between Feeds that live in other organizations? Is our current implementation the only way to accomplish this?
azure-devops asked Jan 2 at 21:11
fepivfepiv
312414
add a comment |
In our Azure DevOps implementation, we have the need to move packages between package management Feeds that live in different organizations. Our current implementation uses 2 Personal Access Tokens (PATs), one with read access to the source organizations' Feeds and the second with write access to the destination organizations' Feeds. This solution works for our current needs, but because of the maintenance required around using PATs, we are exploring alternative implementations.
One avenue that we are currently looking at is using using the SYSTEM_ACCESSTOKEN as described at https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/powershell?view=vsts#oauth, among other places. We're using this token in other pipelines that operate within the same organization and it works as expected. In some cases we've had to add the "Project Collection Build Service ({org-name})" user to the appropriate security groups to access the functionality needed.
The pipeline that performs the move lives in the destination organization. I'm assuming that if we use the SYSTEM_ACCESSTOKEN in our powershell, then it will run under the credentials of the "Project Collection Build Service ({destination-org-name})", in which case it likely won't have access to the Feeds in the source organization. Is this a correct assumption? If so, is there some way to get the OAuth Token for the source organization somehow?
If there is not a way to get the OAuth Token for the source organization, is there some other way that we can move packages between Feeds that live in other organizations? Is our current implementation the only way to accomplish this?
azure-devops asked Jan 2 at 21:11
fepivfepiv
312414
add a comment |
In our Azure DevOps implementation, we have the need to move packages between package management Feeds that live in different organizations. Our current implementation uses 2 Personal Access Tokens (PATs), one with read access to the source organizations' Feeds and the second with write access to the destination organizations' Feeds. This solution works for our current needs, but because of the maintenance required around using PATs, we are exploring alternative implementations.
One avenue that we are currently looking at is using using the SYSTEM_ACCESSTOKEN as described at https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/powershell?view=vsts#oauth, among other places. We're using this token in other pipelines that operate within the same organization and it works as expected. In some cases we've had to add the "Project Collection Build Service ({org-name})" user to the appropriate security groups to access the functionality needed.
The pipeline that performs the move lives in the destination organization. I'm assuming that if we use the SYSTEM_ACCESSTOKEN in our powershell, then it will run under the credentials of the "Project Collection Build Service ({destination-org-name})", in which case it likely won't have access to the Feeds in the source organization. Is this a correct assumption? If so, is there some way to get the OAuth Token for the source organization somehow?
If there is not a way to get the OAuth Token for the source organization, is there some other way that we can move packages between Feeds that live in other organizations? Is our current implementation the only way to accomplish this?
azure-devops asked Jan 2 at 21:11
fepivfepiv
312414
In our Azure DevOps implementation, we have the need to move packages between package management Feeds that live in different organizations. Our current implementation uses 2 Personal Access Tokens (PATs), one with read access to the source organizations' Feeds and the second with write access to the destination organizations' Feeds. This solution works for our current needs, but because of the maintenance required around using PATs, we are exploring alternative implementations.
One avenue that we are currently looking at is using using the SYSTEM_ACCESSTOKEN as described at https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/powershell?view=vsts#oauth, among other places. We're using this token in other pipelines that operate within the same organization and it works as expected. In some cases we've had to add the "Project Collection Build Service ({org-name})" user to the appropriate security groups to access the functionality needed.
The pipeline that performs the move lives in the destination organization. I'm assuming that if we use the SYSTEM_ACCESSTOKEN in our powershell, then it will run under the credentials of the "Project Collection Build Service ({destination-org-name})", in which case it likely won't have access to the Feeds in the source organization. Is this a correct assumption? If so, is there some way to get the OAuth Token for the source organization somehow?
If there is not a way to get the OAuth Token for the source organization, is there some other way that we can move packages between Feeds that live in other organizations? Is our current implementation the only way to accomplish this?
azure-devops azure-devops asked Jan 2 at 21:11
fepivfepiv
312414
asked Jan 2 at 21:11
fepivfepiv
312414
asked Jan 2 at 21:11
fepivfepiv
312414
asked Jan 2 at 21:11
fepivfepiv
312414
asked Jan 2 at 21:11
fepivfepiv
312414
312414
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
After some testing, my assumption turned out to be correct; the OAuth token from one organization does not have access to the other organization. There also doesn't seem to be a way to get to OAuth token for the other organization, which is not surprising since that would be a huge security hole!
I don't believe there is any other way to accomplish what we need other than to use PATs. Hopefully someone else will find this useful.
answered Jan 4 at 19:06
fepivfepiv
312414
add a comment |
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54013247%2fvsts-moving-packages-between-organizations-using-the-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
After some testing, my assumption turned out to be correct; the OAuth token from one organization does not have access to the other organization. There also doesn't seem to be a way to get to OAuth token for the other organization, which is not surprising since that would be a huge security hole!
I don't believe there is any other way to accomplish what we need other than to use PATs. Hopefully someone else will find this useful.
answered Jan 4 at 19:06
fepivfepiv
312414
add a comment |
After some testing, my assumption turned out to be correct; the OAuth token from one organization does not have access to the other organization. There also doesn't seem to be a way to get to OAuth token for the other organization, which is not surprising since that would be a huge security hole!
I don't believe there is any other way to accomplish what we need other than to use PATs. Hopefully someone else will find this useful.
answered Jan 4 at 19:06
fepivfepiv
312414
add a comment |
After some testing, my assumption turned out to be correct; the OAuth token from one organization does not have access to the other organization. There also doesn't seem to be a way to get to OAuth token for the other organization, which is not surprising since that would be a huge security hole!
I don't believe there is any other way to accomplish what we need other than to use PATs. Hopefully someone else will find this useful.
answered Jan 4 at 19:06
fepivfepiv
312414
After some testing, my assumption turned out to be correct; the OAuth token from one organization does not have access to the other organization. There also doesn't seem to be a way to get to OAuth token for the other organization, which is not surprising since that would be a huge security hole!
I don't believe there is any other way to accomplish what we need other than to use PATs. Hopefully someone else will find this useful.
answered Jan 4 at 19:06
fepivfepiv
312414
answered Jan 4 at 19:06
fepivfepiv
312414
answered Jan 4 at 19:06
fepivfepiv
312414
answered Jan 4 at 19:06
fepivfepiv
312414
312414
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54013247%2fvsts-moving-packages-between-organizations-using-the-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
