# NuGet private registry authorization fails with "Access denied" error

**URL:** <https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126>\
**Category:** Build Environment\
**Created:** [October 29, 2019, 9:42pm UTC](https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126 "2019-10-29T21:42:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kujenga](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/kujenga/32/15656_2.png) [@kujenga](https://discuss.circleci.com/u/kujenga)\
**Post date:** [October 29, 2019, 9:42pm UTC](https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126/1 "2019-10-29T21:42:42Z")

</div>

I am trying to setup a Windows build with access to the GitHub Package Registry, specifically for NuGet packages. When you attempt to authorize the registry as documented [1] and pasted in here, an `Access denied.` error occurs…

```
nuget sources Add -Name "GPR" \
     -Source "https://nuget.pkg.github.com/OWNER/index.json" \
     -UserName USERNAME -Password TOKEN

```

Running this with the `-Verbosity detailed` flag yields the error:

```
Access is denied.
System.Security.Cryptography.CryptographicException: Access is denied.

   at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
   at NuGet.Configuration.EncryptionUtility.EncryptString(String value)
   at NuGet.Configuration.PackageSourceCredential.FromUserInput(String source, String username, String password, Boolean storePasswordInClearText, String validAuthenticationTypesText)
   at NuGet.CommandLine.SourcesCommand.AddNewSource()
   at NuGet.CommandLine.Command.ExecuteCommandAsync()
   at NuGet.CommandLine.Command.Execute()
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)

```

I was able to work around this by adding the `-StorePasswordInClearText` flag, which avoids this codepath, but am confused as to why I need to do that in the first place.

Is there some configuration available to me that allows the use of these cryptographic functions in the CircleCI environment?

[1] [https://help.github.com/en/github/managing-packages-with-github-package-registry/configuring-nuget-for-use-with-github-package-registry#authenticating-to-github-package-registry](https://help.github.com/en/github/managing-packages-with-github-package-registry/configuring-nuget-for-use-with-github-package-registry#authenticating-to-github-package-registry)

---

<div class="post-metadata">

**Author:** ![levlaz](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/levlaz/32/36978_2.png) [@levlaz](https://discuss.circleci.com/u/levlaz)\
**Post date:** [October 31, 2019, 4:54am UTC](https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126/2 "2019-10-31T04:54:27Z")

</div>

> [@kujenga](#):
>
> System.Security.Cryptography.CryptographicException: Access is denied.

I think this falls into a general category of things that you cannot do because there is no concept of `sudo` in `powershell` or `cmd.exe`. I’ve been struggling myself with this type of issue.

I am curious if anyone has any suggestions for a good way to replicate `sudo` in a windows world.

---

<div class="post-metadata">

**Author:** ![0x1d](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/0x1d/32/23700_2.png) [@0x1d](https://discuss.circleci.com/u/0x1d)\
**Post date:** [October 1, 2020, 1:08pm UTC](https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126/3 "2020-10-01T13:08:38Z")

</div>

Is there any workaround for this kind of sudo/windows agent issue? I’m facing the same problem, the same exception is thrown by some Redgate DB deployment PowerShell cmdlets I wanna use.

---

<div class="post-metadata">

**Author:** ![HB117](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hb117/32/25775_2.png) [@HB117](https://discuss.circleci.com/u/HB117)\
**Post date:** [October 10, 2020, 11:04am UTC](https://discuss.circleci.com/t/nuget-private-registry-authorization-fails-with-access-denied-error/33126/4 "2020-10-10T11:04:57Z")

</div>

An ugly workaround is to use the `-StorePasswordInClearText` flag when adding the source.