1

Seeing an error with the Sitecore CLI 4.1.1 when pushing items in an Azure DevOps release pipeline:

You are not authorized to perform the task you are attempting. You may need to be assigned additional permissions.

Troubleshooting completed:

  1. Confirmed that the Non-interactive user is configured in Sitecore Identity
  2. The Non-interactive account password matches the password being passed by the pipeline
  3. Confirmed that requiresUniqueEmail is false for the SQL membership provider in the web.config
  4. This was working consistently until an externalUserBuilder was added to ensure human-readable usernames are created with external users. Removing this configuration and re-deploying does not fix the issue.

Additional Context:

  • Sitecore 10.2 XM
  • Active Directory authentication is enabled on the Identity Server
3
  • 1
    We have also faced the same issue. But it worked when we removed the externalUserBuilder custom configuration. Can you once run the script on the server instead of the Azure DevOps pipeline and also double check custom configurations related to User Builder has been removed completely. Good Luck ! Mar 25, 2022 at 5:18
  • Thanks @GayathriSriram. I wanted to keep my external user builder and still use SCS. Appreciate a +1 if the solution below applies to you too. Mar 25, 2022 at 17:11
  • Tried in our application too and it worked. Cheers !! Mar 26, 2022 at 9:12

1 Answer 1

2

The Sitecore CLI command that was failing was:

dotnet sitecore ser pkg install -n dev -f "C:\deploy\content.itempackage"

When I attempted to install the package from my local Sitecore CLI, I was able to reproduce the error and after some additional investigation, the External User Builder was in fact the culprit.

Here's what the External User Builder config looked like:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
      <federatedAuthentication>
          <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
              <mapEntry name="all sites" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
                  <sites hint="list">
                      <site>regexp:.*</site>
                  </sites>
                  <externalUserBuilder type="Feature.Authentication.UserBuilders.ActiveDirectoryUserBuilder, Feature.Authentication" resolve="true">
                      <IsPersistentUser>true</IsPersistentUser>
                  </externalUserBuilder>
              </mapEntry>
          </identityProvidersPerSites>
      </federatedAuthentication>
  </sitecore>
</configuration>

If you look at the <sites> element you can see that there's a regular expression that applies this builder to all of the Sitecore sites: shell, login, admin, service, modules_shell, modules_website, website, etc.

This is too heavy-handed, so I updated my configuration to only apply to the admin site:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
      <federatedAuthentication>
          <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
              <mapEntry name="admin site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
                  <sites hint="list">
                      <site>admin</site>
                  </sites>
                  <externalUserBuilder type="Feature.Authentication.UserBuilders.ActiveDirectoryUserBuilder, Feature.Authentication" resolve="true">
                      <IsPersistentUser>true</IsPersistentUser>
                  </externalUserBuilder>
              </mapEntry>
          </identityProvidersPerSites>
      </federatedAuthentication>
  </sitecore>
</configuration>

This allowed me to continue using my external user builder appropriately and install my Sitecore Content Serialization package successfully across all environments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.