Windows_ad_join resource was broken for cross domain authentication
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 8.2k
- Forks
- 2.5k
- Avg merge
- 4d 5h
- Merged PRs (30d)
- 23
Description
Description
If the "domain_user" 's domain differs from the the domain it is joining this resource will fail. Before #7906 you could pass the domain\user. Now the command expects user and appends the domain to the powershell command.
This is an issue for larger companies with multiple domains.
Chef Version
Chef_version >= 14.8.12
Platform Version
Windows
Replication Case
For domain_user pass a user "domain"\user with a differing "domain" then the domain the machine is joining.
Example
windows_ad_join <domain_A> do
domain_password join_pass
domain_user domain_B\maier
ou_path join_oupath
reboot :delayed
sensitive false
end
Client Output
Failed to join the domain <OUR_DOMAIN>: Add-Computer : Computer '<hostname>' failed to join domain '<OUR_DOMAIN>' from its
current workgroup 'WORKGROUP' with following error message: The user name or password is
incorrect.
At line:1 char:181
+ ... com",$pswd);Add-Computer -DomainName <OUR_DOMAIN> -Cred ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (<hostname>:String) [Add-Computer], InvalidOpera
tionException
+ FullyQualifiedErrorId : FailToJoinDomainFromWorkgroup,Microsoft.PowerShell.Commands.AddComp
uterCommand
Stacktrace
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/resource/windows_ad_join.rb:80:in `block (2 levels) in <class:WindowsAdJoin>'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/mixin/why_run.rb:51:in `add_action'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/provider.rb:227:in `converge_by'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/resource/windows_ad_join.rb:74:in `block in <class:WindowsAdJoin>'
(eval):2:in `block in action_join'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/provider.rb:236:in `instance_eval'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/provider.rb:236:in `compile_and_converge_action'
(eval):2:in `action_join'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/provider.rb:182:in `run_action'
C:/opscode/chef/embedded/lib/ruby/gems/2.5.0/gems/chef-14.10.9-universal-mingw32/lib/chef/resource.rb:578:in `run_action'
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with chef/resource/windows_ad_join.rb around lines 74-80, where the join action builds the PowerShell Add-Computer command. Reproduce the case with domain_user set to a qualified user from a different domain, then verify that the explicitly qualified account is preserved while joining the target domain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell, ruby
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100