尝试在Windows 10上配置TFS代理时出错

我有一个自托管TFS，我正在尝试在Windows 10计算机上为其配置代理。我运行配置脚本。我输入TFS实例的URL，然后选择默认的身份验证类型。脚本尝试连接，但返回错误消息：TFS资源不可用于匿名访问。需要客户端身份验证

我可以通过web浏览器访问我在脚本中输入的URL，这样我就知道机器可以访问它。当脚本试图连接到URL时，我使用fiddler监控流量。Fiddler显示了脚本试图连接到的URL http://{mydomain}/_api/connectionData？connectOptions=1&lastChangeId=-1&lastChangeId64=-1。单击它时，URL将在浏览器中打开。当我输入我的凭据时，我会得到一个JSON响应，而当脚本试图访问该URL时，我不会得到这个响应。根据fiddler的说法，脚本的请求返回一个错误页面。与我试图通过浏览器访问fiddler中的URL不同，脚本从不要求我提供凭据

我确实检查了承载TFS URL的IIS网站的身份验证配置。它启用了匿名访问，启用了windows身份验证，以NTLM作为提供程序，并禁用了其他方法。我确实尝试将协商添加为windows身份验证提供程序，但这并没有解决问题

对于如何克服这个问题，我感到不知所措。如有任何指示、参考、潜在解决方案等，将不胜感激。谢谢

以下是TFS为配置代理提供的批处理文件的代码：

@echo off

rem ********************************************************************************
rem Unblock specific files.
rem ********************************************************************************
setlocal
if defined VERBOSE_ARG (
  set VERBOSE_ARG='Continue'
) else (
  set VERBOSE_ARG='SilentlyContinue'
)

rem Unblock the following types of files:
rem 1) The files in the root of the layout folder. E.g. .cmd files.
rem
rem 2) The PowerShell scripts delivered with the agent. E.g. capability scan scripts under "bin\"
rem and legacy handler scripts under "externals\vstshost\".
rem
rem 3) The DLLs potentially loaded from a PowerShell script (e.g. DLLs in Agent.ServerOMDirectory).
rem Otherwise, Add-Type may result in the following error:
rem   Add-Type : Could not load file or assembly 'file:///[...].dll' or one of its dependencies.
rem   Operation is not supported.
rem Reproduced on Windows 8 in PowerShell 4. Changing the execution policy did not appear to make
rem a difference. The error reproduced even with the execution policy set to Bypass. It may be a
rem a policy setting.
powershell.exe -NoLogo -Sta -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command "$VerbosePreference = %VERBOSE_ARG% ; Get-ChildItem -LiteralPath '%~dp0' | ForEach-Object { Write-Verbose ('Unblock: {0}' -f $_.FullName) ; $_ } | Unblock-File | Out-Null ; Get-ChildItem -Recurse -LiteralPath '%~dp0bin', '%~dp0externals' | Where-Object { $_ -match '\.(ps1|psd1|psm1)$' } | ForEach-Object { Write-Verbose ('Unblock: {0}' -f $_.FullName) ; $_ } | Unblock-File | Out-Null ; Get-ChildItem -LiteralPath '%~dp0externals\vstsom', '%~dp0externals\vstshost' | Where-Object { $_ -match '\.(dll|exe)$' } | ForEach-Object { Write-Verbose ('Unblock: {0}' -f $_.FullName) ; $_ } | Unblock-File | Out-Null"

if "%~1" equ "remove" (
    rem ********************************************************************************
    rem Unconfigure the agent.
    rem ********************************************************************************
    "%~dp0bin\Agent.Listener.exe" %*
) else (
    rem ********************************************************************************
    rem Configure the agent.
    rem ********************************************************************************
    "%~dp0bin\Agent.Listener.exe" configure %*
)

来自代理的控制台输出：

>> Connect:

Enter server URL > http://{mydomain}/
Enter authentication type (press enter for Integrated) >
Connecting to server ...
TF400813: Resource not available for anonymous access. Client authentication required.
Failed to connect.  Try again or ctrl-c to quit
Enter server URL > http://{mydomain}/
Enter authentication type (press enter for Integrated) > Negotiate
Enter user name > {myUserName}
Enter password > {myPassword}
Connecting to server ...
TF400813: Resource not available for anonymous access. Client authentication required.
Failed to connect.  Try again or ctrl-c to quit
Enter server URL >

日志文件中的堆栈跟踪：

[2020-04-13 16:18:39Z ERR  Terminal] Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: TF400813: Resource not available for anonymous access. Client authentication required.
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.<SendAsync>d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.<SendAsync>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.HttpClient.<FinishSendAsync>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__45.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__42`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.<GetConnectionDataAsync>d__6.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.<ConnectAsync>d__41.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.AgentServer.<ConnectAsync>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.BuildReleasesAgentConfigProvider.<TestConnectionAsync>d__14.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.<ConfigureAsync>d__7.MoveNext()

---

我在部署代理的内部部署TFS中进行了尝试，发现默认身份验证类型是集成的，请尝试改用协商：

---

为了解决这个问题，我进入了我的TFS。打开IIS。转到承载TFS门户的web应用程序。单击验证。已打开Windows身份验证的提供程序。我将协商添加到列表中，并将其移到NTLM之前。我重置了应用程序所在的网站。如果协商不在NTLM之前，则任何到我的服务器URL的连接都将被视为我自动取消了身份验证提示

---

我回到了我想要配置代理的机器。我以管理员身份运行了配置脚本。我输入了服务器URL。我告诉配置脚本使用协商作为身份验证类型。我输入了我的证件。联系成功了。流程的其余部分按其应有的方式进行。

您如何尝试进行身份验证？错误消息告诉您没有提供有效凭据，正在尝试匿名身份验证。这不是TFS的配置问题，而是如何安装代理的问题。您需要提供其他详细信息。@DanielMann我已将代码附加到TFS提供的脚本中，如果需要的话helps@user1062440您使用的是哪个版本的TFS？配置代理时默认的身份验证类型是什么？在下载代理后运行config.cmd时，是否可以共享输出？我尝试使用协商，但得到了相同的错误。我从日志文件中添加了控制台输出和堆栈跟踪。另外，我正在使用TFS 2017。我发现如果您的TFS使用NTLM身份验证类型，协商将不起作用。您可以在TFS管理控制台中对此进行检查。但默认集成应该是可行的。似乎存储了一些旧凭据，这些凭据扰乱了特定计算机上的TFS构建代理配置。如果你在另一台客户机上尝试，结果如何？请尝试清除浏览器历史记录和缓存，清除TFS缓存%LOCALAPPDATA%\Microsoft\Team Foundation\7.0\cache，注销VS实例中的所有TFS/DevOp，然后重新启动计算机。此博客可能会给您一些帮助：很高兴看到您解决了问题。请一旦你可以，这可以有益于其他社区成员阅读此线程。