Trouble with Poetry + Azure Devops + credentials

[venaturum]

I have been using Poetry to manage projects hosted on Azure Devops for a year now.

In pyproject.toml I have the following entry

[[tool.poetry.source]]
name = "azure"
url = "https://mycompany.pkgs.visualstudio.com/_packaging/my_pypi/pypi/simple/"
secondary=true

and I run the following commands in a terminal to setup the credentials with a PAT generated by Azure

poetry config repositories.azure https://mycompany.pkgs.visualstudio.com/_packaging/my_pypi/pypi/simple/
poetry config http-basic.azure myusername 6dsg44g4r5qk_big_long_PAT_zhw3tfdsgsgscuizx4a

and I see entries populated in Windows Credential Manager when I do this.

This has worked fine up until a couple of days ago when my PAT expired. When running poetry update or poetry install I get a "401 not authorised" error.

I deleted the credentials in Windows Credential Manager and tried running the above commands with a new PAT but it did not help.

I eventually found a fix by using the same PAT but specifying a different, but equivalent, address in Azure (Azure DevOps maintains dual base urls serving the same content):

https://pkgs.dev.azure.com/mycompany/_packaging/my_pypi/pypi/simple/

in both the pyproject.toml and the credential commands.

Note that I can use pip install ..... --index-url=https://mycompany.pkgs.visualstudio.com/_packaging/my_pypi/pypi/simple/ and that works ok, with credentials handled by artifacts-keyring so it's not a case of the old address being invalid.

There are a couple of problems with this solution:

1. it will require the rest of my team to adopt my url changes in the toml file, and redo their credentials for it
2. it seems like a workaround, rather than a true solution, and I fear a year from now when the new PAT expires we'll run into the same problem again with the new address.

Does anybody have any ideas what might be going on. Is poetry or keyring caching credentials under the hood and my attempts to overwrite it (which show up in Windows Credential Manager) are not flowing through to poetry?

[venaturum]

There's code in ~\.poetry\lib\poetry\repositories\legacy_repositories.py in the LegacyRepository constructor:
username, password = self._authenticator.get_credentials_for_url(self._url)

I edited the py file to print these values to screen. With the new azure address it prints out my username and PAT token. With the old azure address the password is None....

[RoCCoCo13]

I have the same issue, and I am getting crazy looking for a solution. Did you find something different from the already commented workaround?

Thanks!

[venaturum]

Not sure, but I remember discovering that poetry stores credential info against the base url, not the full url. This would be problematic if you were a consultant working for two different companies using Azure and the two base URLs are the same. My advice is to find the file where poetry stores the credential config info and see if it is what you expect. I can't remember what's it's called but have a poke around the folders where poetry stores config info.

[RoCCoCo13]

Many thanks @venaturum.

I found this problem like 2 months ago, I left it as "impossible" and found a workaround installing the dependencies of our private packages by pip, but is not ideal...

I have some more time now, so I will try again, if I can find a solution for it, I will also post it here in case it can help someone in the future.

[squirrel532]

Try #6799

[jbhf]

What worked for me - TLDR: delete pypoetry/ directory and all its contents under ~/.config/pypoetry/

I'm not sure if this will help anyone else, but after going through about 20 of these articles and trying various "solutions" I ended up locating, and blowing away my entire pypoetry located at ~/.config/pypoetry which in the end fixed my issue. I'm not certain why, but it would explain why so many of the other steps like re initializing my .venv didn't work.