Using the Extension Outside the US about app-store-vsts-extension

[benwalpole]

Potentially the Apple ID we were using was in a strange state. I've created a brand new ID and although I had to set security questions when the ID was set fastlane wasn't challenged during the release and was able to sign in to iTunes.

Thanks for your help, I think we might have solved it.

[lkillgore]

Hi @benwalpole, please see this comment (it appears to have been added after you opened this issue).

To clarify: there are two issues. The Hosted macOS pool, and the app extension w/ 2FA.

1. 'Can you use the app extension outside the US?' Yes.
2. 'Can you use the app extension + 2FA outside the US?' Yes. (w/ self-hosted agents)
3. 'Can you use the app extension + 2FA + Hosted macOS outside the US?' It depends. The fastlane session is region specific, and it has to be the same region the Hosted macOS pool is in. We have recently added Europe. This should work for you in the UK now.

[benwalpole]

Thanks @lkillgore.

Is there anyway to tell what region your agent is in? Is it just based on the region for your account?

[davidstaheli]

Hi @benwalpole, can you tell me the name of your VSTS account? The region of the agent is based on that. Or you can email me at dastahel at microsoft dot com.

[benwalpole]

Thanks @davidstaheli I've managed to confirm that our accounts region is West Europe.

[benwalpole]

I'm still seeing the same issue where the releases freeze waiting for the 2FA.

I've set-up a fast lane session and an app specific password, I'm finding it really confusing how the extension is supposed to be configured to use these.

[lkillgore]

Does it work for you on a local agent?

Alternatively, if you run the fastline command from your developer box with the username / password / fastlane session on your dev box, does it work? (If you look for '[command]' in your build logs, you should see the command line. It will likely look something like this: fastlane pilot upload -u ******** -i /Users/zzz/agent.coreclr.109/_work/7/a/myproject.ipa -a com.microsoft.mgtest.xcode7ObjectiveC --skip_submission true --skip_waiting_for_build_processing true). After setting these two environment variables: 'FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD' and 'FASTLANE_SESSION'.

[benwalpole]

We're trying to avoid using local agents, the nature of our network means we would likely face other issues with trying this.

I can see the command being run:

[command]fastlane pilot upload -u *** -i /Users/vsts/agent/2.133.3/work/r1/a/Path/To/App/App/ipa -q <Organisation Number> -r <Organisation Name> -a my.app --skip_submission true``--skip_waiting_for_build_processing true --verbose

Its after this that the agent is then prompted to supply 2FA.

[lkillgore]

What happens when you run that command on your developer box (you may need to install fastlane see this link) replacing the path to the ipa you built on your developer box?

[benwalpole]

It appears to work fine when I run the command on my Mac in the UK.

I can see the line Loading session from '/Users/<user name>/.fastlane/spaceship/<Apple ID>/cookie'

Whereas on VSTS prior to being challenged for 2FA all I can see is Loading session from environment variable

[lkillgore]

Yeah, that change looks suspicious to me too.

Try renaming the cookie on your Mac and export (if you haven't already) the two environment variables I mentioned above:
export FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD=...
export FASTLANE_SESSION=...

If it asks for 2FA, there's (probably) something wrong with the fastlane session.

[benwalpole]

Hmmm....when I rename the cookie then it fastlane switches to using the environment variable but everything seems to work.

I see Loading session from environment variable but then I progress onto the upload.

It seems like either:

• I don't have the extension configured properly.
• The environment variables aren't being injected properly
• The session isn't valid in VSTS

[lkillgore]

Yes. My guess is option 3. My guess is it's still a region issue. Could you let me know what your visualstudio.com account is so I can see how it's being routed? (lukillgo is my work email address (at microsoft) if you'd prefer to email it)

[lkillgore]

Currently, the best option is to follow fastlane’s suggestion here: https://docs.fastlane.tools/best-practices/continuous-integration/#separate-apple-id-for-ci.

[benwalpole]

So we already are using a separate Apple ID for this but it will still be a European based ID. Are we saying for this to work we should create a US based ID or migrate the existing ID to be US based?

[benwalpole]

Actually I'm not sure creating a US based Apple ID would help as then I would need to generate the Fastlane Session in the US?

[lkillgore]

From the document: 'create a separate Apple ID that doesn't have 2-factor auth enabled'. They recommend the Apple ID having restricted permissions except for uploading the ipa to iTunes.

So, you wouldn't need a fastlane session (which has the region) because you're not using 2FA for releasing.

[benwalpole]

Ah sorry I misunderstood that bit.

Unfortunately we did start off with that set-up but we had a problem where the agent was challenged to answer security questions: #89

The fix for that was to enable 2FA which brought us round to needing a fastlane session.

[lkillgore]

Hi @benwalpole, I think I see why all of us are confused.

I'm looking at this issue fastlane/fastlane#12515. The stacktrace that's shown there goes here: https://github.com/fastlane/fastlane/blob/1a79353a6d918eddca61274e97962a5f2770210e/spaceship/lib/spaceship/two_step_client.rb#L45, which is part of two step verification. (I should note here that there is a difference between two step verification and two factor authentication).

On your Apple App Store release account, turn off both two step verification and two factor authentication. (Use a really long, nasty, randomly generated password for the account for security.) Please let me know if that works. I'd like to preserve some of this knowledge in our documentation, so others don't have to go through this.

[benwalpole]

I can disable two factor but I don't think its possible anymore to have an Apple ID that doesn't have security questions.

[lkillgore]

You can have the security questions, but it shouldn't ask for the answers when fastlane connects to iTunes. I just verified that it doesn't ask me for the questions me with 2FA disabled on a macOS hosted agent.

I did see this: https://support.apple.com/en-us/HT204915, which says 'The older two-step verification feature continues to work separately for users who are already enrolled.' I can't find a way to turn on two-step verification anymore. It makes me think that they are trying to deprecate the feature. Might your 'release account' have had two-step verification turned on at some point?

[lkillgore]

Glad to hear it! And, sorry this took so long to resolve. I'll update some of our documentation to make some of this clearer. Thanks!