tigase / tc-agent-auto-auth

TeamCity Agent Automatic Authorization

TeamCity Agent Automatic Authorization

Team City server plugin to automatically authorize agents connecting to TeamCity server and de-authorize agents disconnecting from the server.

It is intended for cloud TeamCity/Agents deployments where Agents can be created on demand by load balancer and destroyed when they are no longer needed. This can happen many times a day. In such a case manual authorization every time agent connects to the server is not a feasible solution.

The implementation is based on the existing plugin Agent Auto Authroize with modification to make it safe to use for publicly available TeamCity servers.

To prevent malicious authorization, the plugin uses a property with a secret value to verify the agent before it is authorized. Therefore, you have to configure both the agent, and the server to allow the plugin to recognize valid agents and handle authorization.

• AGENT_KEY must be set on the TeamCity server as Java property
• agentKey must be set on the Agent as agent's property to the secret value matching AGENT_KEY on the server.

Installation

1. Upload agent-auto-auth.zip to your TeamCity plugin directory. (If you're doing this through the UI, you can find it at https://your-teamcity/admin/admin.html?item=plugins)
2. Set the AGENT_KEY as JVM Option in Standard TeamCity Startup Scripts to some secret value. For example this can be done by setting environment variable: TEAMCITY_SERVER_OPTS=-DAGENT_KEY=some-secret-token. Or you can just pass -DAGENT_KEY=some-secret-token to Java command starting up TeamCity server. If you use docker, you can use -e TEAMCITY_SERVER_OPTS="-DAGENT_KEY=some-secret-token"
3. Restart your TeamCity server
4. Add the following to your agent properties (located at $agentDir/conf/buildAgent.properties): agentKey=some-secret-token where the some-secret-token matches the AGENT_KEY Java property on the server. If you use docker, you can use -e AGENT_KEY="some-secret-token"
5. Start your build agent
6. Note that as soon as it's registered, it will also be authorized.

Lastest Build

agent-auto-auth.zip

tc-agent-auto-auth's Issues

agent-auto-authorization (AutoAuthorize.zip) to be automated

Hi Team,
I am using AWS ECS for the TeamCity setup with 3 TC agents and 1 TC server.
Installed the plugin "agent-auto-auth" and "Agent Auto Authorize" plugins to automatically authorize the agents but it looks like it is working only when the ECS tasks are down and then agents goes to disconnected and connected again.
But if I refresh the agent server and a new agent task is brought up, it doesn't automatically gets authorized and connected.
Is there any way we can automate this part?
Tried putting "auto_authorize=true" in \context\TeamCity\buildAgent\conf\buildAgent.properties from https://github.com/JetBrains/teamcity-docker-images
but it didn't work.
Can you please advise where can I use the "auto_authorize=true" while creating image?