We've heavily migrated off API Token usage in favour of OIDC via Octopus Deploy service accounts - unfortunately the sore exception to this is our Azure DevOps <=> Octopus Deploy service connections due to lack of OIDC support.
In lieu of the OctoTFS extension supporting this natively, we have been using an in-house token-exchange procedure to work around it (though this requires an Azure service connection to "borrow" for identity token issuance, which can then be traded for an Octopus Deploy access token).
For anyone else using Azure DevOps + Azure, you're more than welcome to our implementation in the GH Gist below:
Internally we use this manual token-exchanger template for Terraform runs, package-pushing, release creation and various other automation we script directly against the Octopus Deploy REST API - but I'd love to swap back to our original automation implementation using the Octopus*@* Azure Pipelines native tasks as these were vastly simpler for our engineering folks to work with.
As a dual-stack GitHub/Azure DevOps enterprise we absolutely love the OIDC integration available in the GitHub Actions extension from Octopus Deploy, but it would be awesome to see this functionality make its way across to the Azure DevOps side for those of us stuck with it.
We've heavily migrated off API Token usage in favour of OIDC via Octopus Deploy service accounts - unfortunately the sore exception to this is our Azure DevOps <=> Octopus Deploy service connections due to lack of OIDC support.
In lieu of the
OctoTFSextension supporting this natively, we have been using an in-house token-exchange procedure to work around it (though this requires an Azure service connection to "borrow" for identity token issuance, which can then be traded for an Octopus Deploy access token).For anyone else using Azure DevOps + Azure, you're more than welcome to our implementation in the GH Gist below:
Internally we use this manual token-exchanger template for Terraform runs, package-pushing, release creation and various other automation we script directly against the Octopus Deploy REST API - but I'd love to swap back to our original automation implementation using the
Octopus*@*Azure Pipelines native tasks as these were vastly simpler for our engineering folks to work with.As a dual-stack GitHub/Azure DevOps enterprise we absolutely love the OIDC integration available in the GitHub Actions extension from Octopus Deploy, but it would be awesome to see this functionality make its way across to the Azure DevOps side for those of us stuck with it.