dotnet tool restore interactive doesn't prompt for DeviceFlow since .NET 6 SDK

[tompazourek]

Describe the bug

If I use .NET 5 SDK, and call dotnet tool restore --interactive, I get presented with the DeviceFlow authentication flow from NuGet's MicrosoftCredentialProvider plugin (https://github.com/microsoft/artifacts-credprovider).

I get something like this:

[CredentialProvider]DeviceFlow: https://XXX.pkgs.visualstudio.com/_packaging/XXX/nuget/v3/index.json
[CredentialProvider]ATTENTION: User interaction required.

**********************************************************************

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXX to authenticate.

**********************************************************************

However, if I need the same thing in .NET 6 SDK (using 6.0.100), the output is silent, I don't receive any prompt on the output.

I found a workaround to add --verbosity minimal in the command parameters. But without this, it seems that the default verbosity is quiet which doesn't include the interactive auth flow prompt.

In .NET 5, the verbosity switch didn't have any effect for dotnet tool restore, I even created issue #16535. but in .NET 6, suddenly, the verbosity is working. It's just that the default verbosity is too quiet and is missing the important prompts.

To Reproduce

• ensure that the tool packages to be restored aren't in NuGet cache
• ensure that you use feed that needs MicrosoftCredentialProvider auth (https://github.com/microsoft/artifacts-credprovider), I'm using Azure DevOps Artifacts
• ensure you don't have any MicrosoftCredentialProvider token already in cache
• call dotnet tool restore --interactive
• expected: prompt for device login
• actual: no output, program keeps running and waiting for the auth

Further technical details

.NET SDK (reflecting any global.json):
 Version:   6.0.100
 Commit:    9e8b04bbff

[ThisWholeDev]

I have started having this issue as well but i am not sure how this has just started, i have had dotnet 6 installed for awhile now and have not had issues.

dotnet tool update -g toolname --interactive

C:\Program Files\dotnet\sdk\6.0.100\NuGet.targets(130,5): error :     [CredentialProvider]Device flow authentication failed. User was presented with device flow, but didn't react within 90 seconds. [C:\Users\username\AppData\Local\Temp\ti1axl1b.0ja\restore.csproj]
C:\Program Files\dotnet\sdk\6.0.100\NuGet.targets(130,5): error : Unable to load the service index for source <Azure Devops Artifact package feed>. [C:\Users\username\AppData\Local\Temp\ti1axl1b.0ja\restore.csproj]
C:\Program Files\dotnet\sdk\6.0.100\NuGet.targets(130,5): error :   Response status code does not indicate success: 401 (Unauthorized). [C:\Users\username\AppData\Local\Temp\ti1axl1b.0ja\restore.csproj]
Tool 'toolname' failed to update due to the following:
The tool package could not be restored.
Tool 'toolname' failed to install. This failure may have been caused by:

* You are attempting to install a preview release and did not use the --version option to specify the version.
* A package by this name was found, but it was not a .NET tool.
* The required NuGet feed cannot be accessed, perhaps because of an Internet connection problem.
* You mistyped the name of the tool.

For more reasons, including package naming enforcement, visit https://aka.ms/failure-installing-tool

[tompazourek]

@ThisWholeDev Maybe the NuGets you were restoring before were already in the NuGet cache. Or maybe the session token was already present in the CredentialProvider storage (see https://github.com/microsoft/artifacts-credprovider#session-token-cache-locations). It has an expiration time, so it only does the auth flow from time to time, not always.

But yeah, your output looks like something I'm getting too.

[cervesus]

I've had the same issue. As a workaround use the -v diag parameter, at least this worked for me

[tompazourek]

I've had the same issue. As a workaround use the -v diag parameter, at least this worked for me

Actually, our workaround was similar, even --verbosity minimal worked.

It's as if the default verbosity is quiet, which is too quiet.

[chris-atk]

I'm getting the same issue, thanks @tompazourek for the workaround.

[gallivantor]

Any plans to fix this? My team is also getting this problem since upgrading to .NET 6, the --verbosity minimal works as a workaround, but it's a bad dev experience that causes devs to waste time wondering what's going on before finding this workaround

[derodriguezat]

Just to confirm that the workaround worked for me. Here's what I used:
dotnet tool install -g try-convert --interactive --verbosity minimal

[lsolano]

Same issue here, used @cervesus workaround dotnet tool restore -v n --interactive.

---

Details:

1. donet sdk version: 6.0.101
2. OS: Pop!_OS 22.04 LTS (Ubuntu 22.04)
3. Arch.: Intel-64
4. Package source is a private nuget feed from Azure DevOps ( https://pkgs.dev.azure.com/XXXX/nuget/v3/index.json )

[igorrecioh]

Same issue here when trying to gather a NuGet from a private feed. I can confirm that using following command skips the issue:

dotnet tool update -g <nuget_name> --interactive --verbosity minimal

[carlin-q-scott]

I did not have this issue until I upgraded from dotnet SDK 6.0.301 to 6.0.302 as a part of the Visual Studio 17.2.6 update. The workaround worked for me, thank you.

I do have the nuget CLI installed on it's own. So maybe dotnet CLI was using that one, v6.2.0.146, but when I upgraded my dotnet SDK, it reverted back to the packaged nuget CLI, which is v6.2.1.7.

[ViRuSTriNiTy]

Same here, total confusion as it is the first time for me that a dotnet command just does do nothing, please fix this.

[DanielTheCoder]

Same issue reported here #24220

[blueboxes]

I think I can see in the code why this happens.

This bug fix was added #10024 to ensure that it sets verbosity minimal (much like the example above).

sdk/src/Cli/dotnet/commands/dotnet-tool/install/ProjectRestorer.cs

Line 85 in a30e465

defaultVerbosity = "minimal";

however, where the commands are registered, this is set and then overwritten when the verbosity is registered on the next line. Maybe swapping the lines over would work?

  command.AddOption(ToolCommandRestorePassThroughOptions.InteractiveRestoreOption);
  command.AddOption(VerbosityOption);

sdk/src/Cli/dotnet/commands/dotnet-tool/restore/ToolRestoreCommandParser.cs

Line 41 in 2c98ff1

command.AddOption(VerbosityOption);

This is the same in the Restore and Update

[WhitWaldo]

I've experienced this as well on .NET 7.

Running dotnet tool install -g Microsoft.dotnet-interactive in a cmd prompt yields this error, reflecting a package source I have to an Azure DevOps artifacts feed:

Determining projects to restore...
C:\Program Files\dotnet\sdk\7.0.102\NuGet.targets(132,5): warning : The plugin credential provider could not acquire cr
edentials. Authentication may require manual action. Consider re-running the command with --interactive for dotnet, /
p:NuGetInteractive="true" for MSBuild or removing the -NonInteractive switch for NuGet [C:\Users\whit_\AppData\Local
Temp\2f906456-9768-478a-9646-8be22db8893f\restore.csproj]
C:\Users\xyz123\AppData\Local\Temp\2f906456-9768-478a-9646-8be22db8893f\restore.csproj : error NU1301: Unable to load th
e service index for source https://pkgs.dev.azure.com/xyx/123/_packaging/abc/nuget/v3/index.json.
Failed to restore C:\Users\xyz123\AppData\Local\Temp\2f906456-9768-478a-9646-8be22db8893f\restore.csproj (in 8.27 sec)
.
The tool package could not be restored.
Tool 'microsoft.dotnet-interactive' failed to install. This failure may have been caused by:

• You are attempting to install a preview release and did not use the --version option to specify the version.
• A package by this name was found, but it was not a .NET tool.
• The required NuGet feed cannot be accessed, perhaps because of an Internet connection problem.
• You mistyped the name of the tool.

For more reasons, including package naming enforcement, visit https://aka.ms/failure-installing-tool

Re-running it with dotnet tool install -g Microsoft.dotnet-interactive --verbosity minimal --interactive prompted me to visit https://microsoft.com/devicelogin and provide a code, which after logging in successfully completed the restore and installed the tool (and I later got an email that a personal access token has been issued on my behalf for the vso.drop_write scope.

I'm pretty sure something like this is the basis for the issue I'm having with using .NET interactive notebooks in VS Code in that I cannot install the NuGet packages because it cannot authenticate to my private Artifact feeds.

[blueboxes]

#22987 (comment)

The bot closed this however any thoughts on my comment which points to what I believe is the issue in the code that is in this code base?

[aortiz-msft]

@baronfel - This looks like a regression in .NET 6 and higher. Would it be possible for someone to take a look?

[jruizx]

I am experiencing the same issue. So bizarre

[baronfel]

@JL03-Yue can you please take a look at this and see if we can get it fixed? We'll likely want to consider servicing this one, so I'd take a look at the 6.0 codebase first and let any fix flow forward.

[tengl]

I got this error on Dotnet 7.0.400 in Linux (Pop!_OS) with private NuGet feeds.
Changed back to Dotnet 6.0.413 (with global.json) where it used to work, but still same issue.

It worked (in 7.0.400) when adding --verbosity minimal to the command line.

[brandonh-msft]

this is impacting installation experience of a tool i'm trying to ship now.

[cermakp]

Hi, do you have ETA when it will be fixed?

[jamesdooleymsft]

Still broken in 7.0.404, and still requires --verbosity minimal in order for the --interactive flag to display the interactive DeviceFlow auth request

[cermakp]

Any updates?

[xakep139]

This is completely broken on .NET 8 SDK:

> dotnet --version
8.0.101
> dotnet tool restore --interactive --verbosity minimal
[NuGet Manager] [Warning] The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive="true" for MSBuild or removing the -NonInteractive switch for `NuGet`
Unhandled exception: NuGet.Protocol.Core.Types.FatalProtocolException: Unable to load the service index for source https://[...].pkgs.visualstudio.com/[...]/_packaging/[...]/nuget/v3/index.json.
 ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 401 (Unauthorized).
   at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()

@joperezr @tarekgh @RussKie folks do you happen to know the right folks to tag here?

[RussKie]

AFAIK, dotnet tool restore --interactive --verbosity minimal is working, though in your case there's something else is going on in the NuGet itself. It might be a different problem deserving a separate issue.

@dotnet/nuget-team any thoughts?

[aortiz-msft]

This is the repository for NuGet issues: https://github.com/NuGet/Home/issues/new/choose

[xakep139]

@RussKie, so, the issue has gone after updating Credential Provider plugins via the iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx" command.

[p10tyr]

After installing that latest credential provider (and clearing all my NuGets locally)
I run Cake Build which tries to reach out to devops private registry because its in the global nuget config.. and now just loops endlessy..

Out project still needs VSBuild to run as it has some left over framework so running it like msbuild -t:restore -p:NonInteractive=false it allegedly gets a bearer token but fails to load from the index

When I navigate to that URL in the browser. it loads, so the URL is correct and my browser is authenticated to access the feed.

[mdpopescu]

I can confirm that this is still not working with .NET 8 at the end of March:

S:\Renfield\CloudSync>dotnet restore --interactive --verbosity minimal
  Determining projects to restore...
S:\Renfield\CloudSync\CloudSync.SharepointAdapter\CloudSync.SharepointAdapter.csproj : error NU1301: Unable to load the
 service index for source https://nuget.telerik.com/v3/index.json. [S:\Renfield\CloudSync\CloudSync.sln]
S:\Renfield\CloudSync\CloudSync\CloudSync.csproj : error NU1301: Unable to load the service index for source https://nu
get.telerik.com/v3/index.json. [S:\Renfield\CloudSync\CloudSync.sln]

I have installed the latest credential provider with the iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx" command. And, of course, building from within Visual Studio has absolutely no problem -- but the same error happens when trying to PUBLISH from within VS. (Which is extremely annoying.)

[kartheekp-ms]

@mdpopescu - Regarding #22987 (comment), the iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx" script is meant for private Azure Artifacts feeds. In your case, it looks like we are using a Telerik feed (https://nuget.telerik.com/v3/index.json). There is some guidance on how to connect to a private Telerik feed here.

[srikcgaa2]

What I observe is that after doing a "dotnet restore --interactive --verbosity minimal", it shows up "https://microsoft.com/devicelogin" along with authentication code using which I am able to restore the NuGet packages from the private feed successfully. After this when I do "dotnet tool restore --configfile NuGet.config --interactive --verbosity diagnostic", I am seeing that out of multiple tools mentioned in "dotnet-tools.json" file, one of the tool did get restored correctly but after that it failed to restore rest of the tools and shows the "Response code does not indicate success: 401" error

[aortiz-msft]

@srikcgaa2 - Are you using a "public upstream source" in Azure DevOps/Azure Artifacts by any chance? See https://learn.microsoft.com/en-us/azure/devops/artifacts/how-to/public-feeds-upstream-sources?view=azure-devops&tabs=nuget#q-im-trying-to-restore-my-packages-but-i-keep-getting-a-401-unauthorized-error