Octopack, Replace=true, 403 Forbidden and Warning "A deferred (wildcard) permission check was probably omitted"

I’ve configured OctoPack in my TFS Build to publish a WebApplication package to my Octupus Build-In Nuget Gallery.
It works great, but if I insert in the MSBuild Arguments the string “?replace=true” after the nuget feed url (I want to overwrite nuget package everytime build runs) in this way
/p:RunOctoPack=true /p:OctoPackPublishApiKey= /p:OctoPackPublishPackageToHttp=http://servername/octopus/nuget/packages?replace=true
build fails with error code 403 forbidded and in Octopus’s Diagnostic section this warning appears: “A deferred (wildcard) permission check was probably omitted” (User requesting http://servername/octopus/nuget/packages?replace=true/).
If I remove “?replace=true” in MSBuild Arguments, Octoups Deploy correctly run but I’ve to change version of package everytime.

Can you help me please?
Thanks in advance

Hi Carlo,

Thanks for reaching out. The role that allows you to replace/delete packages from the build in feed is BuiltInFeedAdminister. Is it possible that you are missing that one?

Best regards,

Hi Carlo - I forgot to ask you which version of Octopus are you running? the ?Replace flag was added in 3.2.4, so if you are running a version older than that, you won’t be able to use it.

Hi Dalmiro,
after insert “BuiltInFeedAdminister” in user role, replace=true is correctly working!
Thanks a lot!

PS: I’m using Octopus 3.2.24

This answer looks like what I need, however I am using Octopus 3.3.10 with “simplified” permissions. I don’t see a way to grant the more granular permissions listed here to solve the problem. How do I give a user the BuiltInFeedAdminister role on Octopus 3.3?

Hi @ binarytox1n,

Thanks for reaching out. Exactly what permission do you want to grant and you are not being able to?


Hi Dalmiro,
Nevermind, while searching for the list of roles to demonstrate my problem, I found how to access the more granular permissions list and define a custom role. Thanks!

Thank you, adding “BuiltInFeedAdminister” helps. But I would really encourage you to work on that error message. ““A deferred (wildcard) permission check was probably omitted”” is misleading at best.

A more informative error message would be quite helpful here :slight_smile: