Run-TestsInBCContainer Running 401 (Unauthorized).

[ejwoerlee]

Describe the issue
When running the DevOps pipeline calling Run-TestsInBCContainer in an action step,
I now get an error: CommunicationError : Response status code does not indicate success: 401 (Unauthorized).
credentials are 100% correct, nothing changed in pipeline or sandbox environment.

ran fine 2 days ago.

File-only container:

$ArtifactUrl = Get-BcArtifactUrl -type Sandbox -country "NL" -version 24.5.23489.23968 -select Closest

New-BcContainer `
        -accept_eula `
        -containerName $ContainerName `
        -artifactUrl $ArtifactUrl `
        -filesOnly `
        -additionalParameters  @(    
            "--env ClientServicesTimeout=900000",  # 15 minutes in milliseconds"        
            "--volume ""$WorkspaceFolder\Test\output:C:\apps"""
        )
    

Scripts used to create container and cause the issue

Run-TestsInBCContainer `
        -bcAuthContext $bcAuthContext `
        -containerName $ContainerName `
        -companyName $CompanyName `
        -culture 'nl-NL' `
        -environment $environmentName `
        -credential $cred `
        -detailed  `
        -XUnitResultFileName $xunitResultsFile `
        -testSuite $TestSuiteName `
        -testCodeunitRange '*' `
        -AzureDevOps "error"

Full output of scripts

==============================================================================
Task         : PowerShell
Description  : Run a PowerShell script on Linux, macOS, or Windows
Version      : 2.247.1
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/powershell
==============================================================================
Generating script.
Formatted command: . 'C:\Agents\_work\2\s\Base\build\scripts\Run-UnitTests.ps1' -WorkspaceFolder C:\Agents\_work\2\s -ConfigurationName "EJW - BC SAAS" -ContainerName BcFilesOnly -CompanyName "ABCD" -TestSuiteName "ARINTEST"
========================== Starting Command Output ===========================
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'C:\Agents\_work\_temp\d0db6f59-a237-4fe3-a9b3-4aa84281c636.ps1'"
**BcContainerHelper version 6.0.29-preview1272**
WinRM service is not running, will not try to use WinRM sessions
BC.HelperFunctions emits usage statistics telemetry to Microsoft
Running on Windows, PowerShell 5.1.22621.4249
Attempting authentication to https://api.businesscentral.dynamics.com/user_impersonation offline_access using refresh token...
**Authenticated using refresh token as user XYZ (***)**
Authenticated to common, using tenant id ***
Running unit tests in SAAS Sandbox 
Using Container
Connecting to https://msweuweuas4568-zaha55c.appservices.weu.businesscentral.dynamics.com/cs?tenant=msweua5608t41084715&company=ABCD
CommunicationError : Response status code does not indicate success: 401 (Unauthorized).
at <ScriptBlock>, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 93
at AwaitState, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 222
at OpenSession, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 200
at Initialize, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 61
at ClientContext, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 20
at New-ClientContext, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\PsTestFunctions.ps1: line 53
at <ScriptBlock>, C:\ProgramData\BcContainerHelper\aa4b4983-2ff5-491a-8742-bbea6304c952.ps1: line 100
at <ScriptBlock>, C:\ProgramData\BcContainerHelper\aa4b4983-2ff5-491a-8742-bbea6304c952.ps1: line 43
at <ScriptBlock>, <No file>: line 1
at AwaitState, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 234
at OpenSession, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 200
at Initialize, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 61
at ClientContext, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\ClientContext.ps1: line 20
at New-ClientContext, C:\ProgramData\BcContainerHelper\Extensions\BcFilesOnly\PsTestTool\PsTestFunctions.ps1: line 53
at <ScriptBlock>, C:\ProgramData\BcContainerHelper\aa4b4983-2ff5-491a-8742-bbea6304c952.ps1: line 100
at <ScriptBlock>, C:\ProgramData\BcContainerHelper\aa4b4983-2ff5-491a-8742-bbea6304c952.ps1: line 43
at <ScriptBlock>, <No file>: line 1
ClientSession State is Uninitialized (Wait time 10 seconds)

Container Free Physical Memory: 36.8Gb
Disk C: Free 125Gb from 127Gb

Services in container BcFilesOnly:
- No services found

+                 throw $_.Exception.Message
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (ClientSession S...ime 10 seconds):String) [], RuntimeException
    + FullyQualifiedErrorId : ClientSession State is Uninitialized (Wait time 10 seconds)
...

Screenshots

Additional context

• does it happen all the time?
  Yes all the time

• did it use to work?
  Yes, 2dfay ago it ran fine..

[similar-issues-ai]

We've found some similar issues:

• Running tests fails with 401 when running on a BC25 sandbox container with AAD authentication #3697 , similarity score: 83%

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

[ejwoerlee]

container log:

2024-12-06 18:10:46 Using artifactUrl https://bcartifacts-exdbf9fwegejdqak.b02.azurefd.net/sandbox/24.5.23489.24156/nl
2024-12-06 18:10:46 Using installer from C:\Run\240
2024-12-06 18:10:46 Installing Business Central: multitenant=True, installOnly=False, filesOnly=True, includeTestToolkit=False, includeTestLibrariesOnly=False, includeTestFrameworkOnly=False, includePerformanceToolkit=False, appArtifactPath=c:\dl\sandbox\24.5.23489.24156\nl, platformArtifactPath=c:\dl\sandbox\24.5.23489.24156\platform, databasePath=c:\dl\sandbox\24.5.23489.24156\nl\BusinessCentral-NL.bak, licenseFilePath=c:\dl\sandbox\24.5.23489.24156\nl\Cronus.bclicense, rebootContainer=True
2024-12-06 18:10:46 Installing from artifacts
2024-12-06 18:10:46 Copying Service Tier Files
2024-12-06 18:10:46 c:\dl\sandbox\24.5.23489.24156\platform\ServiceTier\Program Files
2024-12-06 18:10:47 c:\dl\sandbox\24.5.23489.24156\platform\ServiceTier\System64Folder
2024-12-06 18:10:47 Copying Web Client Files
2024-12-06 18:10:47 c:\dl\sandbox\24.5.23489.24156\platform\WebClient\Microsoft Dynamics NAV
2024-12-06 18:10:48 Copying ModernDev Files
2024-12-06 18:10:48 c:\dl\sandbox\24.5.23489.24156\platform
2024-12-06 18:10:48 c:\dl\sandbox\24.5.23489.24156\platform\ModernDev\program files\Microsoft Dynamics NAV
2024-12-06 18:10:49 Copying additional files
2024-12-06 18:10:49 Copying ConfigurationPackages
2024-12-06 18:10:49 C:\dl\sandbox\24.5.23489.24156\nl\ConfigurationPackages
2024-12-06 18:10:49 Copying Test Assemblies
2024-12-06 18:10:49 C:\dl\sandbox\24.5.23489.24156\platform\Test Assemblies
2024-12-06 18:10:49 Copying Extensions
2024-12-06 18:10:49 C:\dl\sandbox\24.5.23489.24156\nl\Extensions
2024-12-06 18:10:49 Copying Applications
2024-12-06 18:10:49 C:\dl\sandbox\24.5.23489.24156\platform\Applications
2024-12-06 18:10:49 Copying Applications.NL
2024-12-06 18:10:49 C:\dl\sandbox\24.5.23489.24156\nl\Applications.NL
2024-12-06 18:10:49 Copying dependencies
2024-12-06 18:10:49 Importing PowerShell Modules
2024-12-06 18:10:50 Skipping restore of Cronus database
2024-12-06 18:10:50 Modifying Business Central Service Tier Config File for Docker
2024-12-06 18:10:50 Installing SIP crypto provider: 'C:\Windows\System32\NavSip.dll'
2024-12-06 18:10:50 Installation took 4 seconds
2024-12-06 18:10:50 Installation complete
2024-12-06 18:10:50 Ready for connections!

[freddydk]

So, it looks like the authentication works fine:

Authenticated using refresh token as user XYZ (***)
Authenticated to common, using tenant id ***
Running unit tests in SAAS Sandbox 

But the user you are authenticated as doesn't have access to the environment in which you are running the tests:

Connecting to https://msweuweuas4568-zaha55c.appservices.weu.businesscentral.dynamics.com/cs?tenant=msweua5608t41084715&company=ABCD
CommunicationError : Response status code does not indicate success: 401 (Unauthorized).

[ejwoerlee]

Can access environment with the same user (as the refresh token), accessing AL test tool and run tests fine.
Nothing changed in the pipeline. I guess it has something to do wiht BC that was updated from 24.5 to 25.0?
Maybe something changed in the authentication of https://msweuweuas4568-zaha55c.appservices.weu.businesscentral.dynamics.com?

[freddydk]

Maybe something changed in the authentication of https://msweuweuas4568-zaha55c.appservices.weu.businesscentral.dynamics.com?

That is the end-url of your environment - that should be fine.

Have you tried using an older BcContainerHelper version (not that anything should be changed there)

[ejwoerlee]

yes, I have tried it also with version 6.0.28 that has the same effect: CommunicationError : Response status code does not indicate success: 401 (Unauthorized). The user I'm trying to connect with using the RefreshToken has SuperUser rights in BC
I did see another issue with the same problem: #3697 But this is not excalty the same situation (no aad auth)

[freddydk]

How did you create the refreshtoken?

[ejwoerlee]

$bcauthContext = New-BcAuthContext -includeDeviceLogin
Write-Host $bcauthContext.RefreshToken
Login with the same credentials as logging locally into the Sandbox.

Saved $bcauthContext.RefreshTokento keyvaoult, and re-used it in the pipeline

Do I need have to have access rights to the Admin Center APIs? (didn't need that before)

$authContext = New-BcAuthContext -includeDeviceLogin
Get-BcEnvironments -bcAuthContext $authContext -environment "MySandBox"
Also gives: The remote server returned an error: (403) Forbidden.

[freddydk]

I don't think you need that for running tests

[ejwoerlee]

Ok, that's what I thought.. I didn't need this before either.
Vague.. no idea what should have changed, something in the Business Central api that calls my end-url of my environment?

[ejwoerlee]

Hi, do you have any other suggestions that I can try? I'm still getting the same error.

[freddydk]

Did you try to give your user access to the admin center API (just to see whether this is the problem)?

[ejwoerlee]

@freddydk
Yes, I tried that today. This had no effect, the same exception in ClientContext.
Also checked it by running (for example):

$authContext = New-BcAuthContext -includeDeviceLogin
Get-BcEnvironments -bcAuthContext $authContext -environment "development-xyz"