Personal Access Token not working

[ndoerrich]

When using PAT in configuration.json, a login dialog (AAD) appears.
I planned on using the migration tool in an Azure Devops Pipeline, but this is not possible if graphical user login is required.
To my understanding, providing a Personal Access Token should prevent login dialogues from appearing.
When login information is entered, the migration tool works as intended. If the dialog is canceled, the following exception is thrown:

Unhandled Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access https://****/. ---> System.AggregateException: One or more errors occurred. ---> System.AggregateException: One or more errors occurred. ---> System.Threading.Tasks.TaskCanceledException: A task was canceled.
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
   at System.Threading.Tasks.Task`1.get_Result()
   at Microsoft.VisualStudio.Services.Client.Controls.VssFederatedCredentialPrompt.<Microsoft.VisualStudio.Services.Common.IVssCredentialPrompt.GetTokenAsync>b__23_0(Task`1 t)
   at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2.InnerInvoke()
   at System.Threading.Tasks.Task.Execute()
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
   at System.Threading.Tasks.Task`1.get_Result()
   at Microsoft.VisualStudio.Services.Common.IssuedTokenProvider.GetTokenOperation.<GetTokenAsync>d__21.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Common.IssuedTokenProvider.<GetTokenAsync>d__34.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequest()
   --- End of inner exception stack trace ---
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequest()
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestChannel.Request(TfsMessage message, TimeSpan timeout)
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpClientBase.Invoke(TfsClientOperation operation, Object[] parameters, TimeSpan timeout, Object[]& outputs)
   at Microsoft.TeamFoundation.Framework.Client.LocationWebService.Connect(Int32 connectOptions, Int32 lastChangeId, Int32 features)
   at Microsoft.TeamFoundation.Framework.Client.FrameworkServerDataProvider.Connect(ConnectOptions connectOptions)
   at Microsoft.TeamFoundation.Client.TfsConnection.EnsureProviderConnected()
   at VstsSyncMigrator.Engine.TeamProjectContext.Connect() in D:\a\1\s\src\VstsSyncMigrator.Core\Execution\ComponentContext\TeamProjectContext.cs:line 70
   at VstsSyncMigrator.Engine.TeamProjectContext.get_Collection() in D:\a\1\s\src\VstsSyncMigrator.Core\Execution\ComponentContext\TeamProjectContext.cs:line 22
   at VstsSyncMigrator.Engine.WorkItemMigrationContext..ctor(MigrationEngine me, WorkItemMigrationConfig config) in D:\a\1\s\src\VstsSyncMigrator.Core\Execution\MigrationContext\WorkItemMigrationContext.cs:line 46
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes, StackCrawlMark& stackMark)
   at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   at System.Activator.CreateInstance(Type type, Object[] args)
   at VstsSyncMigrator.Engine.MigrationEngine.ProcessConfiguration(EngineConfiguration config) in D:\a\1\s\src\VstsSyncMigrator.Core\MigrationEngine.cs:line 87
   at VstsSyncMigrator.Engine.MigrationEngine..ctor(EngineConfiguration config) in D:\a\1\s\src\VstsSyncMigrator.Core\MigrationEngine.cs:line 33
   at VstsSyncMigrator.ConsoleApp.Program.RunExecuteAndReturnExitCode(RunOptions opts) in D:\a\1\s\src\VstsSyncMigrator.Console\Program.cs:line 211
   at VstsSyncMigrator.ConsoleApp.Program.<>c.<Main>b__5_1(RunOptions opts) in D:\a\1\s\src\VstsSyncMigrator.Console\Program.cs:line 131
   at CommandLine.ParserResultExtensions.MapResult[T1,T2,T3,TResult](ParserResult`1 result, Func`2 parsedFunc1, Func`2 parsedFunc2, Func`2 parsedFunc3, Func`2 notParsedFunc)
   at VstsSyncMigrator.ConsoleApp.Program.Main(String[] args) in D:\a\1\s\src\VstsSyncMigrator.Console\Program.cs:line 129

Source and Target look like that in configuration.json:

"Source": {
    "Collection": "https://dev.azure.com/organization1/",
    "Project": "origin",
    "ReflectedWorkItemIDFieldName": "ReflectedWorkItemId",
    "AllowCrossProjectLinking": false,
    "PersonalAccessToken": "***"
  },
  "Target": {
    "Collection": "https://dev.azure.com/organization1/",
    "Project": "target",
    "ReflectedWorkItemIDFieldName": "ReflectedWorkItemId",
    "AllowCrossProjectLinking": false,
    "PersonalAccessToken": "***"
  },

[MrHinsh]

This tool required UI integration. PAT tokens are only supported for images.

[ndoerrich]

Thank you for your quick response and the clarification.
That answers the question and i will close the issue.

[sheldonhull]

I also incorrectly thought that by passing in the password on the CLI I was passing in the token. Not sure what "images" means.

Is there any environment variable or other way I can pass in the personal access token through my azure devops agent, without having to do the UI login? I also wanted to make this runnable by my azure devops agent on premise to allow long-running tasks for projects without being logged in on RDP.

It is possible to enhance the tool with the parameter for sourceToken and targetToken so I can run: migration.exe --config migration-full.json --sourceToken foobar -targetToken foobar2 ?

[f2calv]

For PAT access to work I believe you should change AuthenticationMode from Prompt to AccessToken then there is no longer an interactive prompt... however I can't find it documented on what are the minimum PAT scopes required to use the tool. @MrHinsh is there some documentation on the correct PAT scopes required that I have missed?

"Source": {
    "$type": "TfsTeamProjectConfig",
    "Collection": "https://dev.azure.com/??????/",
    "Project": "??????",
    "ReflectedWorkItemIDFieldName": "Custom.ReflectedWorkItemId",
    "AuthenticationMode": "AccessToken",//<----change from Prompt to AccessToken
    "AllowCrossProjectLinking": false,
    "PersonalAccessToken": "???????....",
    "LanguageMaps": {
      "AreaPath": "Area",
      "IterationPath": "Iteration"
    }
  }

[MrHinsh]

I always assumed that having "Full Access" for the Rules-Override was required.

However, I have seen migrations work with "Read, write, & manage" for Work Items selected.

[MrHinsh]

@f2calv it is more likely that the documentation is missing :(

[kkorada]

is there any update on this ? I am looking for some required scopes for migration

[MrHinsh]

@kkorada Im not sure what you are asking about! @f2calv answered this one.

Ill move it over to Discussions.