Jira (PUP-10899) Retrieve SID for users under 'APPLICATION PACKAGE AUTHORITY'

[Luchian Nemes (Jira)]

Title: Message Title

Luchian Nemes created an issue   Puppet / PUP-10899 Retrieve SID for users under 'APPLICATION PACKAGE AUTHORITY' Issue Type: Task Assignee: Luchian Nemes Created: 2021/02/11 7:32 AM Priority: Normal Reporter: Luchian Nemes Our puppetlabs-acl module lists changes with the users under APPLICATION PACKAGE AUTHORITY as a known limitation as follows:  When referring to accounts in the APPLICATION PACKAGE AUTHORITY, use either their SID values or their unqualified names. The Windows API has well documented bugs preventing the fully qualified account names from being used. S-1-15-2-1 or ALL APPLICATION PACKAGES, but not APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES. This account may only be referenced on Windows 2012R2 (kernel 6.3) or newer. S-1-15-2-2 or ALL RESTRICTED APPLICATION PACKAGES, but not APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES. This account may only be referenced on Windows 2016 (kernel 10.0) or newer. Using above advice, the following manifest works and is idempotent : acl \{ 'C:\\My Folder': permissions => [ \{ identity => 'ALL RESTRICTED APPLICATION PACKAGES', rights => ['read','write','execute']} ], \} But when trying to add other permissions (new ones), the following error occurs: *Error: Failed to apply catalog: undefined method `bytesize' for nil:NilClass C:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/api_types.rb:25:in `from_string_to_wide_string'* Example: acl \{ 'C:\\My Folder': permissions => [ \{ identity => 'Administrators', rights => ['read','write','execute']} ], \} This limitation is brought by puppet implementation of https://github.com/puppetlabs/puppet/blob/main/lib/puppet/util/windows/principal.rb#L47 which takes the username as it is. A special filtering for usernames starting with *APPLICATION PACKAGE AUTHORITY *would solve this issue. Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.387120.1613057573000.139687.1613057580156%40Atlassian.JIRA.