While setting the Octopus deploy widget some users are not seeing the widget information, they only see the “Loading…” status.
I looked at and added permissions in both Octopus and TFS side and still the users are having issues.
In IE and in chrome I’m seeing a {“count”:1,“value”:{“Message”:“The requested resource does not support http method ‘GET’.”}} any ideas on why this is happening?
Hi,
Thanks for reaching out!
When you setup the Octopus Extension in TFS, you register it with a URL and an APIKey (see screenshot). That API key is the one that TFS will use for all the API calls, included the one that builds that dashboard.
So the user that you should be granting permissions in Octopus should be the one that owns that APIKey that you are using in TFS.
Let me know if that makes sense to you.
Best Regards,
Dalmiro
Hi Dalmiro,
Yes, in this case the account that I’m using is a service account which has access to both Octopus and the project. The problem in this case is that only certain users are having this issue. I’m lost as to what else I need to check since just for kicks I added additional permissions just to see if that what is missing but that is not the case. Any ideas on what else I can look into?
Hi Quads,
Usually when the extension fails to load there would be some errors that will get logged to the console which would give us a better idea of what is happening. Do you have multiple octopus connections setup for the given project perhaps?
I recently experienced similar issues when testing the widgets and made some fixes which haven’t been published yet. These fixes may address the issues you are seeing, so it will be good if we can get those published so you can try again as well.
Regards,
Shaun
Hi Shaun, I would be happy to give you more information if I can get the location of where the logs are stored.
The error:
In IE and in chrome I’m seeing a {“count”:1,“value”:{“Message”:“The requested resource does not support http method ‘GET’.”}} any ideas on why this is happening?
is when I try to use the developer tools in IE and Chrome. As for connections yes I do we have two instances of Octopus which in this case uses the same API Key would this be the issue? Would removing one connection will resolve the issue? Note that even though I have 2 connections I only use 1 in this test.
Hi Quads,
Yes, the extension did not deal with multiple connections very well. I just published a new version of the extension which contains some fixes which address some of the issues I found (2.0.135). It would be great if you could give that a try and see if it fixes the problem for you.
The {“count”:1,“value”:{“Message”:“The requested resource does not support http method ‘GET’.”}} message doesn’t seem familiar so there may still be an issue here. The error does seem to suggest that the endpoint being queried may be invalid. Unfortunately, any errors in the VSTS widgets aren’t stored anywhere so the chrome developer tools would be our best bet here. There may be more information in the network tab which may give us an indication of which endpoint it’s trying to query and what the response was.
Regards,
Shaun
Hi Shaun,
Cool, let me download the latest code. As for Chrome where would be the location where I can give you the logs that you seek?
Hi Shaun,
About multiple connections, are you referring to the number of service endpoint that is being setup?
Anyway, if this is the case in the project that I’m having issues with I only have one service endpoint configured and the version I’m now using is Octopus Deploy Integration V2.0.135.
Shaun,
Please find the document containing the error message I’m now getting in IE only which mimics what our other users are getting. I’m using the latest version of the extension.
Hi Quads,
That is correct I was referring to having multiple service connection endpoints configured. The widget previously would have failed if either one of the connections was not working.
The logs you provided seem to suggest that the loading of the widgets themselves is failing due to permissions, which is a bit strange considering the behavior is different between chrome and internet explorer, is that correct? I tried to reproduce this myself using internet explorer 11 as well and couldn’t get the same behavior unless I removed the user’s permissions.
Could I also confirm whether you have added the the users to the User role of the Service endpoint as well please? The dashboard widgets require users to have access to those endpoints in order to be able to use them.
Regards,
Shaun
Hi Shaun,
Yes, the user has been added, actually the user is a service account (the one set to display the endpoint).
Per your comment “The dashboard widgets require users to have access to those endpoints in order to be able to use them.” Does this mean even though the widget is using a service account that the actual user (TFS user) needs to be part of the user role? I would assume that if this is the case a view role will suffice. Please advice.
Hi Quads,
I believe it does mean the users in this case. The widgets uses the current user context to get the service endpoint detail. If those users have been added to the “User” role as you suggested, it should allow the widgets to work.
I think this does raise an interesting question about the use of those endpoints from the widgets when the user isn’t a project collaborator such as a stakeholder. I can’t think of any issue of allowing those users to use the service endpoint as they shouldn’t really be able to queue/define builds. It does add some overhead in making sure those users can also view the widgets, so may be nice to be able to configure it once for all users with a separate access token.
I have created an issue here to investigate this. Would this solve this particular issue for you?
Regards,
Shaun
Hi Shaun,
Yes if someone can investigate that would be great. From the users standpoint, I think it would be ideal if the TFS administrator (like myself) to set the endpoint using a service account that has access to both TFS and Octopus just once and have the extension use the same endpoint this way I do not need to instruct the users on how to setup an endpoint and also it will lessen the impact on the Octopus administrator to add all users in a view role (let’s say if the company has 5K or more users) .
As for adding users view roles in Octopus (I’m not an administrator) will the admin be able to add AD groups? I think in prior versions you can’t I could be wrong here.
Thank you again for your help.
Hi Quads,
The widgets wouldn’t be able to impersonate the service account, so the only alternative is to use a personal access token created by the service account in TFS as suggested in the issue. This could have some security implications, which is why we would need to investigate this. If we do end up making this change, you may need to have two Octopus service endpoints to make that somewhat viable. That would be one for the tasks and one for the widgets with read-only access on the Octopus side.
Is it possible to add a group to the user endpoint in TFS? The group could represent everyone you believe should have access to these endpoints instead, possibly domain users if that is what you want? I think that could possibly work in the same way as you are describing.
On the Octopus side, the Octopus admin should be able to configure which AD groups are part of which teams, however, you won’t have to configure that for each user if your intention is for those users to only view things on the VSTS dashboard via the widgets. The API key you have setup for the service endpoint would be the account used to connect to Octopus.
Regards,
Shaun
Hi Shaun,
In regards to the account, yes I’m using an Access Token created within Octopus and in my screenshot that is what is being used. However, a selected number of users are having issues of just seeing “Loading” in the widget this is in using either IE or Chrome. In my case in just so happen that after I uploaded the new version that my IE starts acting up and starts showing “Loading”. My expectation is that if I’m using a service account in both TFS and Octopus that the widget will display for all users but I guess that is where I’m totally confuse on how the widget interacts with the TFS (on-premise) dashboard.
Hi Quads, I apologize if I haven’t made that clear.
The widgets run in the user’s browser as just plain javascript so it can only access TFS as the current user accessing the page unless the widgets allowed you to use a different personal access token such as one from the service account.
You will will need to add all users to the service endpoint users group in order for them to make use of the service endpoint. The important thing to note here, is that the API key you have defined for the service endpoint will be used to access your Octopus instance regardless of the user attempting to use it.
Regards,
Shaun
Hi Shaun,
Thank you that works as soon as I added the AD group in the Service Point Roles in TFS they are able to successfully see the widget, however it only works in Chrome on our end not sure why it is not showing properly in IE maybe some permission issue.
Also not sure if this is a widget issue or TFS but when I add the Endpoint\Creators in the role instead of the AD group for some reason the users cannot see it. The Endpoint Creators group does not see to work as well as adding individual AD groups.
Thank you again for your help.
Hi Quads, good to hear that solved it for you.
Is there a chance that I can get some screenshots of what you are seeing when using IE? There may also be related errors logged to the console which could be useful. Could you also let me know what version of IE you are seeing the problem with, please? 
The group related issue would definitely be a TFS issue and not something we would have any control over so may be worthwhile to follow up with Microsoft regarding that.
Regards,
Shaun
Hi Shaun,
The screenshot is the same as the original screenshot above, in IE everyone is seeing just “Loading…” in the widget. In Chrome everyone can now see the widget properly after I add the AD group in the Endpoint Role.
As for the IE version we are using V11.0.9600.19035 and the error is “Access is denied”, I hope this helps.
Additional info…
I searched the error and I found this link https://docs.microsoft.com/en-us/scripting/javascript/misc/access-is-denied.
To correct this error
•Investigate whether the API you’re trying to call supports JSONP or CORS, which are two approaches that safely allow cross-origin scripting.
•If you’re trying to call a REST API, refactor this call to your server-side code, then expose a new REST endpoint for your client-side scripts.
For additional information, look for online documentation related to the Same Origin Policy, JSONP, and CORS.
