Sitecore CLI 4.1.1 - You are not authorized to perform the task you are attempting

Question

Seeing an error with the Sitecore CLI 4.1.1 when pushing items in an Azure DevOps release pipeline:

You are not authorized to perform the task you are attempting. You may need to be assigned additional permissions.

Troubleshooting completed:

1. Confirmed that the Non-interactive user is configured in Sitecore Identity
2. The Non-interactive account password matches the password being passed by the pipeline
3. Confirmed that requiresUniqueEmail is false for the SQL membership provider in the web.config
4. This was working consistently until an externalUserBuilder was added to ensure human-readable usernames are created with external users. Removing this configuration and re-deploying does not fix the issue.

Additional Context:

• Sitecore 10.2 XM
• Active Directory authentication is enabled on the Identity Server

Answer 1

The Sitecore CLI command that was failing was:

dotnet sitecore ser pkg install -n dev -f "C:\deploy\content.itempackage"

When I attempted to install the package from my local Sitecore CLI, I was able to reproduce the error and after some additional investigation, the External User Builder was in fact the culprit.

Here's what the External User Builder config looked like:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
      <federatedAuthentication>
          <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
              <mapEntry name="all sites" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
                  <sites hint="list">
                      <site>regexp:.*</site>
                  </sites>
                  <externalUserBuilder type="Feature.Authentication.UserBuilders.ActiveDirectoryUserBuilder, Feature.Authentication" resolve="true">
                      <IsPersistentUser>true</IsPersistentUser>
                  </externalUserBuilder>
              </mapEntry>
          </identityProvidersPerSites>
      </federatedAuthentication>
  </sitecore>
</configuration>

If you look at the <sites> element you can see that there's a regular expression that applies this builder to all of the Sitecore sites: shell, login, admin, service, modules_shell, modules_website, website, etc.

This is too heavy-handed, so I updated my configuration to only apply to the admin site:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
      <federatedAuthentication>
          <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
              <mapEntry name="admin site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
                  <sites hint="list">
                      <site>admin</site>
                  </sites>
                  <externalUserBuilder type="Feature.Authentication.UserBuilders.ActiveDirectoryUserBuilder, Feature.Authentication" resolve="true">
                      <IsPersistentUser>true</IsPersistentUser>
                  </externalUserBuilder>
              </mapEntry>
          </identityProvidersPerSites>
      </federatedAuthentication>
  </sitecore>
</configuration>

This allowed me to continue using my external user builder appropriately and install my Sitecore Content Serialization package successfully across all environments.