Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Josh Cooper assigned an issue to Ryan Gard Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Josh Cooper Status: Resolved Closed Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds commented on PUP-5271 Re: Windows user resource should not manage password unless specified These look like they will catch those scenarios. Sorry, I meant to comment last week when you asked. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Ryan Gard commented on PUP-5271
Re: Windows user resource should not manage password unless specified
Functional Review
Verified as fixed in build b628b07eb521caacc920f8b87749974d269a58bc. Ethan Brown Rob Reynolds Can you take a look at this FR to make sure I covered the right scenarios?
Environment
Agent OS: Windows 2012 R2 x64
Test Case 1
Install the Puppet Agent (x64) onto the Windows SUT.
Set the "Password must meet complexity requirements" policy to "Enabled" in the Local Group Policy Editor on the Windows SUT. (Computer Configuration->Windows Settings->Security Settings->Account Policies->Password Policy)
Set the "Minimum password length" policy to "0" in the Local Group Policy Editor on the Windows SUT. (Computer Configuration->Windows Settings->Security Settings->Account Policies->Password Policy)
Create a user without providing a password:
puppet apply -e "user {'bob': ensure=>present }"
Expect
The user should be created successfully without error.
Console Output
C:\test>puppet apply -e "user {'bob': ensure=>present }"
Notice: Compiled catalog for w2012r2.vm in environment production in 0.25 second
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Josh Cooper commented on PUP-5271
Re: Windows user resource should not manage password unless specified
This passed puppet#3.x, puppet-agent# {stable,master}
CI
Add Comment
This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4)
--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Josh Cooper assigned an issue to qa Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Josh Cooper Status: Ready for CI Test Assignee: qa Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds assigned an issue to Ryan Gard Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Assignee: qa Ryan Gard Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds commented on PUP-5271
Re: Windows user resource should not manage password unless specified
I don't think you are either. Earlier in the comments I already mentioned it was impossible to use managehome without also specifying a password:
Scoping - This is not going to solve the ability to managehome, because it requires a login and it is unavoidable to not have a password.
The following will continue to error and that is appropriate:
user {'bob_managehome':
ensure => present,
managehome => true,
}
Add Comment
This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4)
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds updated an issue
Puppet / PUP-5271
Windows user resource should not manage password unless specified
Change By:
Rob Reynolds
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements." -` This occurs regardless of password security policy. - This only occurs when password security policy has been applied for complexity and/or minimum length. h3. Reproduction:Create following users:{noformat}user {'bob': ensure => present, }user {'bob_pwd': ensure => present,password=> '@#SAFSawasf123',}user {'bob_managehome': ensure => present, managehome => true, }user {'bob_managehome_pwd': ensure => present,managehome => true, password=> '@#SAFSawasf123',}user {'bob_groups': ensure => present, groups => 'Users', }user {'bob_everything': ensure => present, managehome => true, groups => 'Users', }user {'bob_everything_pwd': ensure => present, password=> '@#SAFSawasf123', managehome => true, groups => 'Users', }{noformat}Run puppet agent, then:{noformat}C:\Users\Administrator>puppet resource useruser { 'bob_everything_pwd': ensure => 'present', groups => ['Users'], uid=> 'S-1-5-21-1953236517-242735908-2433092285-1042',}user { 'bob_managehome_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1045',}user { 'bob_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1041',}{noformat}h3. Fixed by:Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil.
Add Comment
This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4)
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Steve Barlow updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Steve Barlow Sprint: Windows 2015-10-21 , Windows 2015-11-04 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown commented on PUP-5271 Re: Windows user resource should not manage password unless specified Just as a quick follow-up. The larger point that I was making in my most recent comments, is that in my environment, I was always able to create users - this patch did not change the behavior. That environment has local security policy configured like: This patch appears to only address the situation where minimum password length is configured as something non-0 (about to verify this now) The full output of my runs demonstrating the patch didn't actual change whether or not users get created is at: https://gist.github.com/Iristyle/f8563c0261299c68ff32 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Attachment: ComplexityEnabled.png Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds commented on PUP-5271
Re: Windows user resource should not manage password unless specified
Ethan Brown thanks for that. Up until that point I was under the assumption that it did not matter what the security policy was set to. Now it's for sure that it only happens when the security policy for "Password must meet complexity requirements" is Enabled.
Let's be crystal clear that this has nothing to do with managehome. Manage home cannot be set without specifying a user with a password or an existing user that already has a password. Due to the confusion around this, I'm going to update the description.
Since this is a pretty normal scenario for most environments, it feels like we should address this.
Here's where we should concentrate:
user {'bob_nopwd':
ensure => present,
}
Here is what I'm noticing.
When password complexity is disabled:
the behavior is no different with or without the patch.
When password complexity is enabled:
without patch - user is not created.
with patch - user is created.
When minimum password is specified:
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Ethan Brown Attachment: Screen Shot 2015-10-21 at 9.03.43 AM.png Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for `Password must meet complexity requirements` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: When the Windows Password Policy `Minimum password length` is greater than 0, the password must always be specified. This is due to Windows validation for new user creation requiring a password for all new accounts, so it is not possible to leave password unspecified once that password policy is set.It is also important to note that when a user is specified with `managehome => true`, the password must always be specified if it is not an already existing user on the system.DOCS FOLKS NOTE: See the image on the ticket to see how "Windows Password Policy" is visualized. https://tickets.puppetlabs.com/secure/attachment/23882/Screen%20Shot%202015-10-21%20at%209.03.43%20AM.png Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for `Password must meet complexity requirements` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: When the Windows Password Policy `Minimum password length` is greater than 0, the password must always be specified. This is due to Windows validation for new user creation requiring a password for all new accounts, so it is not possible to leave password unspecified once that password policy is set.It is also important to note that when a user is specified with `managehome => true`, the password must always be specified if it is not an already existing user on the system.DOCS FOLKS NOTE: See the this image (also on the ticket ) to see how "Windows Password Policy" is visualized . : https://tickets.puppetlabs.com/secure/attachment/23882/Screen%20Shot%202015-10-21%20at%209.03.43%20AM.png Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds updated an issue
Puppet / PUP-5271
Windows user resource should not manage password unless specified
Change By:
Rob Reynolds
Release Notes Summary:
When you are attempting to create users without specifying the password and you have the Windows Password Policy for `"Password must meet complexityrequirements"` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: when the password policy `"Minimum password length"` is greater than0, the password must always be specified. This is due to how Windowsvalidates new user creation and it is not possible to leave passwordunspecified once that password policy is set.It's also important to note that when a user is specified with`managehome => true`, the password must always be specified if it is notan already existing user on the system.
Release Notes:
Bug Fix
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements."-`This occurs regardless of password security policy.- This only occurs when password security policy has been applied for complexity and/or minimum length.h3. Reproduction:Create following users:{noformat}user {'bob': ensure => present, }user {'bob_pwd': ensure => present,password=> '@#SAFSawasf123',}user {'bob_managehome': ensure => present, managehome => true, }user {'bob_managehome_pwd': ensure => present,managehome => true, password=> '@#SAFSawasf123',}user {'bob_groups': ensure => present, groups => 'Users', }user {'bob_everything': ensure => present, managehome => true, groups => 'Users', }user {'bob_everything_pwd': ensure => present, password=> '@#SAFSawasf123', managehome => true, groups => 'Users', }{noformat}Run puppet agent, then:{noformat}C:\Users\Administrator>puppet resource useruser { 'bob_everything_pwd': ensure => 'present', groups => ['Users'], uid=> 'S-1-5-21-1953236517-242735908-2433092285-1042',}user { 'bob_managehome_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1045',}user { 'bob_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1041',}{noformat}h3. Fixed by:Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds updated an issue
Puppet / PUP-5271
Windows user resource should not manage password unless specified
Change By:
Rob Reynolds
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements."-`This occurs regardless of password security policy.- This only occurs when password security policy has been applied for complexity and/or minimum length.h3. Reproduction:Create following users:{noformat}user {'bob': ensure => present, }user {'bob_pwd': ensure => present,password=> '@#SAFSawasf123',}user {'bob_managehome': ensure => present, managehome => true, }user {'bob_managehome_pwd': ensure => present,managehome => true, password=> '@#SAFSawasf123',}user {'bob_groups': ensure => present, groups => 'Users', }user {'bob_everything': ensure => present, managehome => true, groups => 'Users', }user {'bob_everything_pwd': ensure => present, password=> '@#SAFSawasf123', managehome => true, groups => 'Users', }{noformat}Run puppet agent, then:{noformat}C:\Users\Administrator>puppet resource useruser { 'bob_everything_pwd': ensure => 'present', groups => ['Users'], uid=> 'S-1-5-21-1953236517-242735908-2433092285-1042',}user { 'bob_managehome_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1045',}user { 'bob_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1041',}{noformat}h3. Fixed by:Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil. Any attempts to use {{managehome => true}} without specifying a password should validly fail. It is not possible to logon a user (to ensure the home directories are set) without a password that is set.
Add Comment
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds updated an issue
Puppet / PUP-5271
Windows user resource should not manage password unless specified
Change By:
Rob Reynolds
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements."-`This occurs regardless of password security policy.- This only occurs when password security policy has been applied for complexity and/or minimum length.h3. Reproduction:Create following users:{noformat}user {'bob': ensure => present, }user {'bob_pwd': ensure => present,password=> '@#SAFSawasf123',}user {'bob_managehome': ensure => present, managehome => true, }user {'bob_managehome_pwd': ensure => present,managehome => true, password=> '@#SAFSawasf123',}user {'bob_groups': ensure => present, groups => 'Users', }user {'bob_everything': ensure => present, managehome => true, groups => 'Users', }user {'bob_everything_pwd': ensure => present, password=> '@#SAFSawasf123', managehome => true, groups => 'Users', }{noformat}Run puppet agent, then:{noformat}C:\Users\Administrator>puppet resource useruser { 'bob_everything_pwd': ensure => 'present', groups => ['Users'], uid=> 'S-1-5-21-1953236517-242735908-2433092285-1042',}user { 'bob_managehome_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1045',}user { 'bob_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1041',}{noformat}h3. Fixed by:Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil. Any attempts to use {{managehome => true}} without specifying a password should validly fail. It is not possible to logon a user (to ensure the home directories are set) without a password that is set. This also cannot address when "Minimum password
Add Comment
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for `Password must meet complexity requirements` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: when When the password policy Windows Password Policy `Minimum password length` is greater than 0, the password must always be specified. This is due to how Windows validates validation for new user creation and requiring a password for all new accounts, so it is not possible to leave password unspecified once that password policy is set.It 's is also important to note that when a user is specified with `managehome => true`, the password must always be specified if it is not an already existing user on the system. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown commented on PUP-5271 Re: Windows user resource should not manage password unless specified Merged to master in https://github.com/puppetlabs/puppet/commit/b628b07eb521caacc920f8b87749974d269a58bc Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds updated an issue
Puppet / PUP-5271
Windows user resource should not manage password unless specified
Change By:
Rob Reynolds
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements."-`This occurs regardless of password security policy.- This only occurs when password security policy has been applied for complexity and/or minimum length.h3. Reproduction:Create following users:{noformat}user {'bob': ensure => present, }user {'bob_pwd': ensure => present,password=> '@#SAFSawasf123',}user {'bob_managehome': ensure => present, managehome => true, }user {'bob_managehome_pwd': ensure => present,managehome => true, password=> '@#SAFSawasf123',}user {'bob_groups': ensure => present, groups => 'Users', }user {'bob_everything': ensure => present, managehome => true, groups => 'Users', }user {'bob_everything_pwd': ensure => present, password=> '@#SAFSawasf123', managehome => true, groups => 'Users', }{noformat}Run puppet agent, then:{noformat}C:\Users\Administrator>puppet resource useruser { 'bob_everything_pwd': ensure => 'present', groups => ['Users'], uid=> 'S-1-5-21-1953236517-242735908-2433092285-1042',}user { 'bob_managehome_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1045',}user { 'bob_pwd': ensure => 'present', uid=> 'S-1-5-21-1953236517-242735908-2433092285-1041',}{noformat}h3. Fixed by:Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil. Any attempts to use {{managehome => true}} without specifying a password should validly fail. It is not possible to logon a user (to ensure the home directories are set) without a password that is set. This also cannot address when "Minimum password length" is greater than 0, as that is a validation built-in to Windows that requires a password for all new accounts.
Add Comment
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Ethan Brown Fix Version/s: PUP 4.2.3 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for `Password must meet complexity requirements` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: When the Windows Password Policy `Minimum password length` is greater than 0, the password must always be specified. This is due to Windows validation for new user creation requiring a password for all new accounts, so it is not possible to leave password unspecified once that password policy is set.It is also important to note that when a user is specified with `managehome => true`, the password must always be specified if it is not an already existing user on the system.DOCS FOLKS NOTE: See this image (also on the ticket) to see how "Windows Password Policy" is visualized: https://tickets.puppetlabs.com/secure/attachment/ 23882 23883 / Screen%20Shot%202015-10-21%20at%209 ComplexityEnabled . 03.43%20AM. png Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for ` " Password must meet complexityrequirements " ` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: when the password policy ` " Minimum password length " ` is greater than0, the password must always be specified. This is due to how Windowsvalidates new user creation and it is not possible to leave passwordunspecified once that password policy is set.It's also important to note that when a user is specified with`managehome => true`, the password must always be specified if it is notan already existing user on the system. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Release Notes Summary: When you are attempting to create users without specifying the password and you have the Windows Password Policy for `Password must meet complexity requirements` set to Enabled, it caused Puppet to fail to create the user. Now it works appropriately.NOTE: When the Windows Password Policy `Minimum password length` is greater than 0, the password must always be specified. This is due to Windows validation for new user creation requiring a password for all new accounts, so it is not possible to leave password unspecified once that password policy is set.It is also important to note that when a user is specified with `managehome => true`, the password must always be specified if it is not an already existing user on the system. DOCS FOLKS NOTE: See the image on the ticket to see how "Windows Password Policy" is visualized. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds commented on PUP-5271
Re: Windows user resource should not manage password unless specified
For the reviewer:
Create a manifest similar to this:
user {'bob':
ensure => present,
}
user {'bob_pwd':
ensure => present,
password=> '@#SAFSawasf123',
}
user {'bob_managehome':
ensure => present,
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown commented on PUP-5271 Re: Windows user resource should not manage password unless specified In my local testing, I'm always seeing the users created (but those with managehome => true and no password don't get a home directory). Prior to the proposed change I get: Error: Failed to logon user "bob_managehome": Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced. Error: /Stage[main]/Main/User[bob_managehome]/ensure: change from absent to present failed: Failed to logon user "bob_managehome": Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced. But after the code change, the message is a bit different, but there are still errors: Error: Failed to logon user "bob_managehome": The user's password must be changed before logging on the first time. Error: /Stage[main]/Main/User[bob_managehome]/ensure: change from absent to present failed: Failed to logon user "bob_managehome": The user's password must be changed before logging on the first time. And of course the managehome examples without passwords cause errors upon removal as well (with same error message before or after change): Error: Could not set
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown assigned an issue to Unassigned Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Ethan Brown Assignee: Ethan Brown Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds assigned an issue to Ethan Brown Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Assignee: Ethan Brown Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds assigned an issue to Rob Reynolds Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Assignee: Rob Reynolds Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ryan Gard updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Ryan Gard QA Risk Assessment: Medium QA Status: Reviewed QA Contact: Eric Thompson Ryan Gard Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds commented on PUP-5271 Re: Windows user resource should not manage password unless specified James Pogran that is correct, mentioned in comments above. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Fix Version/s: PUP 3.8.4 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Reid Vandewiele commented on PUP-5271
Re: Windows user resource should not manage password unless specified
Rob Reynolds Today we allow both of the following scenarios:
user { 'test_user_nil':
ensure => 'present',
}
Which should be equivalent to
user { 'test_user_nil':
ensure => 'present',
password => undef,
}
We should ensure that these scenarios continue to work, whatever changes we make.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Owen Rodabaugh updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Owen Rodabaugh CS Severity: 3 CS Business Value: 2 CS Frequency: 2 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds commented on PUP-5271
Re: Windows user resource should not manage password unless specified
Reid Vandewiele It's unclear if the following currently works:
user { 'test_user_nil':
ensure => 'present',
}
But this would fix the issue to ensure it works again.
Add Comment
This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4)
--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Steve Barlow updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Steve Barlow Sprint: Windows 2015-10- 07 21 Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title
Rob Reynolds commented on PUP-5271
Re: Windows user resource should not manage password unless specified
Ethan Brown I was asking more whether it as possible to undef a password with Puppet.
user { 'test_user_empty':
ensure => 'present',
password => '',
}
user { 'test_user_nil':
ensure => 'present',
password => undef,
}
If we allow that scenario, it's something we'd stop allowing if we make this change.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Ethan Brown commented on PUP-5271 Re: Windows user resource should not manage password unless specified I think blank passwords are not a very good idea, but our past decisions on these sorts of things favor "allowing a user to cause themselves potential harm" rather than to "enforce policy on users" Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Rob Reynolds Summary: Puppet on Windows user resource should not manage password unless specified Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Nathanael Cole updated an issue Puppet / PUP-5271 Windows user resource should not manage password unless specified Change By: Nathanael Cole CS Priority: Minor Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-5271) Windows user resource should not manage password unless specified
Title: Message Title Nathanael Cole commented on PUP-5271 Re: Windows user resource should not manage password unless specified Updated one of those fields, but the others are a bit... vague. I'm not entirely familiar with those priorities, as number systems tend to be confusing. In the 1-5 system, is 1 the most crucial, or is 5 the most crucial? Same with frequencies, etc. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
