saltstack / saltstack/salt

[BUG] Domain groups can't be added as members of local groups in Windows

Open
#67,086 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
As per title, a domain group can't be added as a member of a local group - in spite of the documentation appearing to support this.

Setup
Salt-master v.3007.1 on Linux Slackware 64
Salt-minion v.3007.1 on Windows 10 Pro 64bit
Salt minion machine is joined to Samba AD domain

(Please provide relevant configs and/or SLS files (be sure to remove sensitive info. There is no general set-up of Salt.)

Please be as specific as possible and give set-up details.

  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • VM running on a cloud service, please be explicit and add details
  • container (Kubernetes, Docker, containerd, etc. please specify)
  • or a combination, please be explicit
  • jails if it is FreeBSD
  • classic packaging
  • onedir packaging
  • used bootstrap to install

Steps to Reproduce the behavior
I used the simple state file below as per instructions at the bottom of the page at this link (https://docs.saltproject.io/en/latest/ref/states/all/salt.states.group.html):

Administrators:
  group.present:
    - addusers:
      - MYDOMAIN\testgroup

The "testgroup" group already exists in the domain. I can successfully add a domain user to the local Administrators, using the state file above. I can also add a local group to the local Administrators group. But attempting to add any domain group to the local Administrators group results in the following message:

$ salt "my_minion_name" state.sls add_domain_group_to_local_administrators
my_minon_name:
----------
          ID: Administrators
    Function: group.present
      Result: False
     Comment: The following group attributes are set to be changed:
              addusers: ['my_minion_name\\mydomain\\testgroup']
              Some changes could not be applied
     Started: 18:06:06.070874
    Duration: 390.612 ms
     Changes:   
              ----------
              Failed:
                  ----------
                  addusers:
                      - my_minion_name\mydomain\testgroup

Summary for my_minion
------------
Succeeded: 0 (changed=1)
Failed:    1
------------
Total states run:     1
Total run time: 390.612 ms

(Include debug logs if possible and relevant)

Expected behavior
The domain group should be added as member of local Administrators group. It seems domain groups don't get recognised by the group.members module - but instead it attempts to interpret them as a local group by prepending the minion machine hostname - or something along these lines.

Versions Report

Salt Version: Salt: 3007.1

Python Version:
Python: 3.9.5 (default, May 4 2021, 18:07:24)

Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: 2.9.0.post0
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.1.4
libgit2: Not Installed
looseversion: 1.3.0
M2Crypto: 0.37.1
Mako: 1.1.4
msgpack: 1.1.0
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 20.9
pycparser: Not Installed
pycrypto: Not Installed
pycryptodome: Not Installed
pygit2: Not Installed
python-gnupg: Not Installed
PyYAML: 6.0.2
PyZMQ: 26.2.0
relenv: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 6.4.2
ZMQ: 4.3.5

Salt Package Information:
Package Type: Not Installed

System Versions:
dist: slackware 14.2 current
locale: utf-8
machine: x86_64
release: 5.10.41
system: Linux
version: Slackware 14.2 current

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the salt.states.group documentation and the group.present entry point, then reproduce the addusers example on a Windows minion joined to the Samba AD domain. Check how the domain-group name is interpreted when adding it to the local Administrators group. Done means the domain group is added successfully and the state reports success without prepending the minion hostname.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops, infrastructure, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.