TFS構建代理引發「未授權」異常

Question

我們已將TFS 2013服務器升級到TFS 2015，並且正在設置新的構建代理。

在此之前，我們進行了一次試運行，並在我們對現有TFS數據庫進行了最終轉換之前，讓所有的工作合理地完成。構建代理工作得很好。

令我們驚訝的是，我們的構建代理不再合作升級後。創建一個簡單的構建定義並將其分配給默認隊列會導致在10-15秒後引發錯誤。

我們嘗試重新部署構建代理，玩弄權限和用戶，但無濟於事。

我們所得到的是這樣的_diag \日誌：

11:18:09.699993 JobManager.StartJob(job.JobId = a9702f31-2dff-4057-8253-a32ebc106f32) 
11:18:09.699993 JobInfo.ctor 
11:18:09.699993 JobInfo.ctor - leave 
11:18:09.699993 JobManager.StartJob - calling JobWriter.StartJob 
11:18:09.699993 JobWriter.StartJob - enter 
11:18:09.699993 JobWriter.StartJob - (SKIPPING)first renew 
11:18:09.715619 JobWriter.StartJob - start continual renewing 
11:18:09.715619 AuthorizationType : OAuth 
11:18:09.731245 --------------------------------------------------------------------------- 
11:18:09.731245 Microsoft.VisualStudio.Services.WebApi.VssServiceResponseException: Unauthorized 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.HandleResponse(HttpResponseMessage response) 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__79.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__76`1.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.<GetConnectionDataAsync>d__6.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.Client.VssServerDataProvider.<ConnectAsync>d__39.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.TeamFoundation.DistributedTask.Agent.Common.ConnectionHelper.GetConnection(Uri serverUri, VssCredentials credentials) 
11:18:09.731245 at Microsoft.TeamFoundation.DistributedTask.Agent.JobWriter.StartJob() 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.HandleResponse(HttpResponseMessage response) 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__79.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__76`1.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.<GetConnectionDataAsync>d__6.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.VisualStudio.Services.Client.VssServerDataProvider.<ConnectAsync>d__39.MoveNext() 
11:18:09.731245 --- End of stack trace from previous location where exception was thrown --- 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) 
11:18:09.731245 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) 
11:18:09.731245 at Microsoft.TeamFoundation.DistributedTask.Agent.Common.ConnectionHelper.GetConnection(Uri serverUri, VssCredentials credentials) 
11:18:09.731245 at Microsoft.TeamFoundation.DistributedTask.Agent.JobWriter.StartJob() 
11:18:09.731245 --------------------------------------------------------------------------- 

運行交互或作爲服務沒什麼區別。我已經將構建代理的服務用戶列爲「代理池服務帳戶」角色的成員。

我相信這是有問題的請求：

GET https://tfs:8443/tfs/DefaultCollection/_apis/connectionData?connectOptions=IncludeServices&lastChangeId=-1&lastChangeId64=-1 HTTP/1.1 
User-Agent: VSServices/14.102.25423.0 (VsoAgent.exe) VsoAgent.exe/1.95.3 
Accept-Language: en-US, nb-NO 
X-TFS-FedAuthRedirect: Suppress 
X-TFS-Session: 7a2e6368-a564-4231-bbd6-xxxxxxxxxx 
X-VSS-Agent: VSS: b5d9c453-017f-407c-ac00-b479d0d0e8ed 
Authorization: [huge bytesequence] 
Host: tfs:8443 
Accept-Encoding: gzip 

這是用401我自己的管理用戶的回報卻是能夠加載此URI就好了。

我自己的管理員用戶是我設置代理時使用的用戶。我也嘗試從這個用戶交互式啓動vsoagent.exe ...但沒有去。在行之間進行閱讀（並查看一些角色），有一位用戶將運行代理的計算機的名稱刪除。我想這個用戶是最初創建的，並且是實際使用的用戶。我如何才能控制這種情況？

編輯：如果我從沒有包括在「代理池服務帳戶」的池的列表中的用戶身份運行vsoagent.exe交互，那麼代理商立即犯錯了與Access denied. admrunem needs Listen permissions for pool Regular to perform the action. For more information, contact the Team Foundation Server administrator.。在列表中添加admrunem讓我進一步瞭解了一點，即我試圖診斷的錯誤消息（「未授權」異常）。注意：此時它使用NTLM授權，然後致命的呼叫似乎切換到OAUTH。

Answer 1

1. 確保運行代理的帳戶位於「代理池服務帳戶」角色中。

2. 確保在集合中設置了隊列（https://your-tfs-server:8080/tfs/your-collection/_admin/_AgentQueue）。如果不是 - 選擇「新隊列..」並選擇現有隊列。

3. 請確保您完全按照this article部署Windows構建代理。
4. 嘗試更改作爲構建代理服務帳戶組成員的域帳戶並且屬於「代理池服務帳戶」角色，以查看代理是否可以工作。

Answer 2

檢查是否在Team Foundation Server IIS網站上啓用了「Windows身份驗證」。這解決了我們的問題。