ADManagedServiceAccount: add SamAccountName parameter #659

gaelicWizard · 2021-05-22T22:41:48Z

Pull Request (PR) description

Adds optional parameter SamAccountName to ADManagedServiceAccount resource to allow setting this property separately. This requires that ServiceAccountName be specified using something other than the SamAccountName, e.g. SID, DN, UPN, &c.

This Pull Request (PR) fixes the following issues

See ADUser, ADGroup: Specify samAccountName separately #655
Fixes ADManagedServiceAccount: Add support for setting the SAM account name and (common) name separately #644

Task list

Added an entry to the change log under the Unreleased section of the
file CHANGELOG.md. Entry should say what was changed and how that
affects users (if applicable), and reference the issue being resolved
(if applicable).
Resource documentation added/updated in README.md.
Resource parameter descriptions added/updated in README.md, schema.mof
and comment-based help.
Comment-based help added/updated.
Localization strings added/updated in all localization files as appropriate.
Examples appropriately added/updated.
Unit tests added/updated. See DSC Community Testing Guidelines.
Integration tests added/updated (where possible). See DSC Community Testing Guidelines.
New/changed code adheres to DSC Community Style Guidelines.

This change is

codecov · 2021-05-22T22:56:48Z

Codecov Report

Merging #659 (10e97ed) into main (9346a1d) will increase coverage by 0%.
The diff coverage is 100%.

@@         Coverage Diff         @@
##           main   #659   +/-   ##
===================================
  Coverage    98%    98%           
===================================
  Files        25     25           
  Lines      3408   3411    +3     
===================================
+ Hits       3340   3343    +3     
  Misses       68     68

Antiohne · 2021-05-23T08:40:59Z

I have tested this change and it doesn't solve issue #644. The ServiceName is still mapping to the samAccountName according the error message I got.

This is my test scenario:

Configuration ADManagedServiceAccount_CreateManagedServiceAccount_Config
{
    Import-DscResource -Module ActiveDirectoryDsc -ModuleVersion 6.2.0

    Node localhost
    {
        ADManagedServiceAccount 'ExampleStandaloneMSA'
        {
            Ensure = 'Present'
            ServiceAccountName = 'MyMoreFancyServiceLongName01'
            SamAccountName = 'Service01'
            AccountType = 'Standalone'
        }
    }
}

And this is the error message I got:

VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' =
SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' =
root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer dc01 with user sid .
VERBOSE: [dc01]: LCM:  [ Start  Set      ]
VERBOSE: [dc01]: LCM:  [ Start  Resource ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]: LCM:  [ Start  Test     ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Retrieving Account
'MyMoreFancyServiceLongName01'. (MSA0006)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'MyMoreFancyServiceLongName01' was not found. (MSA0005)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'MyMoreFancyServiceLongName01' does not exist but should. (MSA0011)
VERBOSE: [dc01]: LCM:  [ End    Test     ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]  in 0.3950 seconds.
VERBOSE: [dc01]: LCM:  [ Start  Set      ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Retrieving Account
'MyMoreFancyServiceLongName01'. (MSA0006)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'MyMoreFancyServiceLongName01' was not found. (MSA0005)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Adding Standalone Account
'MyMoreFancyServiceLongName01' to 'CN=Managed Service Accounts,DC=....l'. (MSA0001)
VERBOSE: [dc01]: LCM:  [ End    Set      ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]  in 0.3600 seconds.
PowerShell DSC resource MSFT_ADManagedServiceAccount  failed to execute Set-TargetResource functionality with error
message: System.InvalidOperationException: Error adding Standalone Account 'MyMoreFancyServiceLongName01' to
'CN=Managed Service Accounts,...'. (MSA0012) ---> System.ArgumentException: The service
account has a samAccountName attribute of 'MyMoreFancyServiceLongName01' which is too long; the samAccountName
attribute must not be longer than 15 characters.
   at Microsoft.ActiveDirectory.Management.Commands.ADComputerUtil.ToDirectoryServiceAccountSamAccountName(String
extendedAttribute, String[] directoryAttributes, ADPropertyValueCollection extendedData, ADEntity directoryObj,
CmdletSessionInfo cmdletSessionInfo)
   at Microsoft.ActiveDirectory.Management.Commands.AttributeConverterEntry.InvokeToDirectoryConverter(ADPropertyValueC
ollection extendedData, ADEntity directoryObj, CmdletSessionInfo cmdletSessionInfo)
   at Microsoft.ActiveDirectory.Management.Commands.ADFactory`1.UpdateFromParameters(ADParameterSet parameters,
Hashtable custPropsToAdd, Hashtable custPropsToReplace, Hashtable custPropsToRemove, String[] custPropsToClear,
ADObject directoryObj)
   at Microsoft.ActiveDirectory.Management.Commands.ADNewCmdletBase`3.ADNewCmdletBaseProcessCSRoutine()
   at Microsoft.ActiveDirectory.Management.CmdletSubroutinePipeline.Invoke()
   at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.ProcessRecord()
   --- End of inner exception stack trace ---
    + CategoryInfo          : InvalidOperation: (:) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

VERBOSE: [dc01]: LCM:  [ End    Set      ]
The SendConfigurationApply function did not succeed.
    + CategoryInfo          : NotSpecified: (root/Microsoft/...gurationManager:String) [], CimException
    + FullyQualifiedErrorId : MI RESULT 1
    + PSComputerName        : localhost

VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 2.324 seconds

When I test the change with this DSC:

Configuration ADManagedServiceAccount_CreateManagedServiceAccount_Config
{
    Import-DscResource -Module ActiveDirectoryDsc -ModuleVersion 6.2.0

    Node localhost
    {
        ADManagedServiceAccount 'ExampleStandaloneMSA'
        {
            Ensure = 'Present'
            ServiceAccountName = 'Service01'
            SamAccountName = 'SamService01'
            AccountType = 'Standalone'
        }
    }
}

The result is:

VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' =
SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' =
root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer dc01 with user sid .
VERBOSE: [dc01]: LCM:  [ Start  Set      ]
VERBOSE: [dc01]: LCM:  [ Start  Resource ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]: LCM:  [ Start  Test     ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Retrieving Account
'Service01'. (MSA0006)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'Service01' was not found. (MSA0005)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'Service01' does not exist but should. (MSA0011)
VERBOSE: [dc01]: LCM:  [ End    Test     ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]  in 0.3950 seconds.
VERBOSE: [dc01]: LCM:  [ Start  Set      ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Retrieving Account
'Service01'. (MSA0006)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Standalone Account
'Service01' was not found. (MSA0005)
VERBOSE: [dc01]:                            [[ADManagedServiceAccount]ExampleStandaloneMSA] Adding Standalone Account
'Service01' to 'CN=Managed Service Accounts,...'. (MSA0001)
VERBOSE: [dc01]: LCM:  [ End    Set      ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]  in 0.4900 seconds.
VERBOSE: [dc01]: LCM:  [ End    Resource ]  [[ADManagedServiceAccount]ExampleStandaloneMSA]
VERBOSE: [dc01]: LCM:  [ End    Set      ]
VERBOSE: [dc01]: LCM:  [ End    Set      ]    in  1.3590 seconds.
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 2.215 seconds

When looking to the attributes of the created Managed Service account the values are as following:

cn:               Service01
distinguishedNam: CN=Service01,CN=Managed Service Accounts,...
name:             Service01
sAMAccountName:   Service01$

In summary, the definition of the SamAccountName property has no effect.

Antiohne · 2021-05-23T09:03:23Z

source/DSCResources/MSFT_ADManagedServiceAccount/MSFT_ADManagedServiceAccount.psm1

-    Specifies the Security Account Manager (SAM) account name of the managed service account (ldapDisplayName
-    'sAMAccountName'). To be compatible with older operating systems, create a SAM account name that is 20 characters
-    or less. Once created, the user's SamAccountName and CN cannot be changed.
+        Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP Display Name (ldapDisplayName) of this property is 'name'. Once created, the account's Name cannot be changed. Once created, the user's SamAccountName and CN cannot be changed.


Add line breaks around 120 characters

Antiohne · 2021-05-23T09:03:34Z

source/DSCResources/MSFT_ADManagedServiceAccount/MSFT_ADManagedServiceAccount.psm1

-        Specifies the Security Account Manager (SAM) account name of the managed service account (ldapDisplayName
-        'sAMAccountName'). To be compatible with older operating systems, create a SAM account name that is 20
-        characters or less. Once created, the user's SamAccountName and CN cannot be changed.
+        Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP Display Name (ldapDisplayName) of this property is 'name'. Once created, the account's Name cannot be changed. Once created, the user's SamAccountName and CN cannot be changed.


Add line breaks around 120 characters

Antiohne · 2021-05-23T09:03:44Z

source/DSCResources/MSFT_ADManagedServiceAccount/MSFT_ADManagedServiceAccount.psm1

-        Specifies the Security Account Manager (SAM) account name of the managed service account (ldapDisplayName
-        'sAMAccountName'). To be compatible with older operating systems, create a SAM account name that is 20
-        characters or less. Once created, the user's SamAccountName and CN cannot be changed.
+        Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP Display Name (ldapDisplayName) of this property is 'name'. Once created, the account's Name cannot be changed. Once created, the user's SamAccountName and CN cannot be changed.


Add line breaks around 120 characters

gaelicWizard · 2021-05-26T22:42:53Z

@Antiohne, thank you for testing this! I haven't been testing with an account created by DSC (my use case is an account created by an external installer invoked by xPackage). It's a bit of a giant gaping hole that I need to work out..

Thanks,
JP2

X-Guardian

Reviewable status: 0 of 4 files reviewed, 4 unresolved discussions (waiting on @gaelicWizard)

a discussion (no related file):
This PR needs integration tests.

Have you tested this change through the full lifecycle of an ADManagedServiceAccount object and this additional property? i.e. addition, modification and deletion of an ADManagedServiceAccount with and without this property, and addition, modification and deletion of this property. This must be a non-breaking change to current usage of this resource.

stale · 2021-07-19T08:01:45Z

Labeling this pull request (PR) as abandoned since it has gone 14 days or more since the last update. An abandoned PR can be continued by another contributor. The abandoned label will be removed if work on this PR is taken up again.

gaelicWizard added 3 commits May 22, 2021 18:35

ADManagedServiceAccount: Add SamAccountName property

6c1bf44

ADManagedServiceAccount: Test SamAccountName parameter

27b82bc

Add SamAccountName property to ADManagedServiceAccount

10e97ed

Antiohne reviewed May 23, 2021

View reviewed changes

johlju added the needs review The pull request needs a code review. label May 27, 2021

X-Guardian requested changes Jul 4, 2021

View reviewed changes

X-Guardian added waiting for code fix A review left open comments, and the pull request is waiting for changes to be pushed by the author. and removed needs review The pull request needs a code review. labels Jul 4, 2021

stale bot added the abandoned The pull request has been abandoned. label Jul 19, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ADManagedServiceAccount: add SamAccountName parameter #659

ADManagedServiceAccount: add SamAccountName parameter #659

gaelicWizard commented May 22, 2021 •

edited by X-Guardian

codecov bot commented May 22, 2021

Antiohne commented May 23, 2021 •

edited

Antiohne May 23, 2021

Antiohne May 23, 2021

Antiohne May 23, 2021

gaelicWizard commented May 26, 2021

X-Guardian left a comment

stale bot commented Jul 19, 2021

ADManagedServiceAccount: add SamAccountName parameter #659

Are you sure you want to change the base?

ADManagedServiceAccount: add SamAccountName parameter #659

Conversation

gaelicWizard commented May 22, 2021 • edited by X-Guardian

Pull Request (PR) description

This Pull Request (PR) fixes the following issues

Task list

codecov bot commented May 22, 2021

Codecov Report

Antiohne commented May 23, 2021 • edited

Antiohne May 23, 2021

Choose a reason for hiding this comment

Antiohne May 23, 2021

Choose a reason for hiding this comment

Antiohne May 23, 2021

Choose a reason for hiding this comment

gaelicWizard commented May 26, 2021

X-Guardian left a comment

Choose a reason for hiding this comment

stale bot commented Jul 19, 2021

gaelicWizard commented May 22, 2021 •

edited by X-Guardian

Antiohne commented May 23, 2021 •

edited