使用Ansible向Windows主机添加ADO私有NuGet源时出现委派错误

问题场景 #

通过Ansible在Windows目标主机执行dotnet nuget add source添加Azure DevOps私有NuGet源时，抛出错误：

"stdout": "error: The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation."

对应的Ansible任务：

- name: Add private NuGet source
  win_shell: "dotnet nuget add source https://pkgs.dev.azure.com/XXXX/_packaging/GlobalPackageRegistry/nuget/v3/index.json -n GlobalPackageRegistry -u user_sa@XXXX.com -p {{ token }} --valid-authentication-types basic"
  when: ansible_facts['os_family'] == "Windows"

执行Playbook命令：

ansible-playbook -i agents.yml set_nuget.yml --extra-vars "token=ZZZZZZZZZXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

关键现象：同一用户在目标Windows主机本地直接执行该命令，可正常生成NuGet.Config文件。

原因分析 #

Ansible通过WinRM连接Windows时，默认使用网络登录会话（Kerberos/NTLM认证），这类会话的权限受限，无法完成dotnet nuget add source保存凭据时所需的本地安全存储访问操作；而本地交互登录的会话拥有完整的委派权限，因此命令可正常执行。

解决方案 #

方案1：替换为win_command执行命令 #

win_shell通过cmd.exe间接执行命令，可能引入额外的会话环境问题，改用win_command直接执行命令：

- name: Add private NuGet source
  win_command: dotnet nuget add source https://pkgs.dev.azure.com/XXXX/_packaging/GlobalPackageRegistry/nuget/v3/index.json -n GlobalPackageRegistry -u user_sa@XXXX.com -p {{ token }} --valid-authentication-types basic
  when: ansible_facts['os_family'] == "Windows"

方案2：调整WinRM会话权限 #

在目标Windows主机以管理员身份执行以下命令，开启会话委派支持：

# 配置WinRM服务端认证
winrm set winrm/config/service/auth @{Negotiate="true"}
# 配置WinRM客户端认证
winrm set winrm/config/client/auth @{Negotiate="true"}
# 重启WinRM服务
Restart-Service WinRM

方案3：直接生成NuGet.Config文件 #

绕过dotnet nuget add source命令，通过Ansible直接生成配置文件：

1. 创建模板文件NuGet.Config.j2：

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="GlobalPackageRegistry" value="https://pkgs.dev.azure.com/XXXX/_packaging/GlobalPackageRegistry/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <GlobalPackageRegistry>
      <add key="Username" value="user_sa@XXXX.com" />
      <add key="ClearTextPassword" value="{{ token }}" />
    </GlobalPackageRegistry>
  </packageSourceCredentials>
</configuration>

2. 添加Ansible任务：

- name: Generate NuGet.Config
  win_template:
    src: NuGet.Config.j2
    dest: C:\Users\{{ ansible_user }}\AppData\Roaming\NuGet\NuGet.Config
  when: ansible_facts['os_family'] == "Windows"

方案4：使用become以本地身份执行 #

若Ansible用户拥有管理员权限，可通过runas方式以本地身份执行命令：

- name: Add private NuGet source
  win_shell: "dotnet nuget add source https://pkgs.dev.azure.com/XXXX/_packaging/GlobalPackageRegistry/nuget/v3/index.json -n GlobalPackageRegistry -u user_sa@XXXX.com -p {{ token }} --valid-authentication-types basic"
  when: ansible_facts['os_family'] == "Windows"
  become: yes
  become_method: runas
  become_user: "{{ ansible_user }}"

内容的提问来源于stack exchange，提问作者PanzerRage