Azure DevOps – Pipelines to intranet TFS 2018: SSL_ERROR_SYSCALL - azure

Question

I am setting up Azure Pipelines, I have few that get sources from GitHub and trying to setup pipelines to reach TFS on intranet for some time.
I started anew, I created a new PAT token in TFS with full access.
I created a new Service Connection of type: “Azure Repos/Team Foundation Server” using this URL: https://tfs.myCie.com/defaultcollection/MyProject and the PAT token from TFS above.
I created a new pipeline, selecting Other Git and using the new service connection. I didn’t know what to use as default branch as I don’t see any branches on TFS so I used master.
I used the empty job option and entered again the service connection name and the master branch. When I tried to select the YAML template, it wasn’t able to save it to a repo, should I have a different repo for Yaml files to TFS?
I paid attention that my .proxy file was filled and the .proxybypass file had the TFS server URL.
When I run the pipeline, early on the UI gives a timeout but after 6-7 minutes, I have logs that says:
Syncing repository: repository (ExternalGit)
##[debug]repository url=https://tfs.myCie.com/defaultcollection/myProject/
##[debug]targetPath=D:\Agent_work\19\s
git version 2.26.2.windows.1
git remote add origin https://tfs.myCie.com/defaultcollection/myProject/
##[debug]Finished process 6888 with exit code 0.
git config --get-all http.https://tfs. myCie.com/defaultcollection/myProject/.extraheader
If I test this .ExtraHeader URL, it either doesn’t exist or I don’t have access !
git config --get-all http.proxy
git remote set-url origin https://emptyusername:***#tfs. myCie.com/defaultcollection/myProject/
fatal: unable to access 'https://tfs.myCie.com/defaultcollection/myProject/': OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to tfs.oecd.org:443
Can it be a proxy error or a user access account ?
In the later case, what access rights would I need ?
What settings I should use when creating the PAT token in TFS ?
Thanks.

Answer 1

I am afraid you were using the wrong serve connection type.
Azure Repos/Team Foundation Server service connection is used in the repositories resources section in the yaml pipeline, which you can refer to the repositories in other organizations using a service connection. See this document for more informaiton.
resources:
repositories:
- repository: otherrepo
name: ProjectName/RepoName
endpoint: newTFSServiceConnection
steps:
- checkout: self
- checkout: otherrepo
If you want to set up a pipeline for a repos in another TFS server. You need to create a new Service Connection of type Other Git
And enter the tfs repo url and users name / password in the edit page.
Then you can select this Other git type Service connection when creating a pipeline.
If you cannot connect to your tfs repo via PAT. It might be because the IIS Basic Authentication is enabled on your windows machine, it prevents you from using personal access tokens (PATs) as an authentication mechanism. See here, You can try using basic anthentication method (username and password) instead
Please be noted that you need to run this pipeline on your self-hosted agent. As you are trying to connect to the repo on your tfs intranet server. Cloud Microsoft hosted agent cannot connect to your intranet tfs server. Unless it is can be accessed in the public network.