|
271 | 271 | }.to raise_error(Puppet::Error, /Cannot enable #{name}/) |
272 | 272 | end |
273 | 273 | end |
| 274 | + |
| 275 | + describe "when managing logon credentials" do |
| 276 | + before do |
| 277 | + allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return(computer_name) |
| 278 | + allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(principal) |
| 279 | + allow(Puppet::Util::Windows::Service).to receive(:set_startup_configuration).and_return(nil) |
| 280 | + end |
| 281 | + |
| 282 | + let(:computer_name) { 'myPC' } |
| 283 | + |
| 284 | + describe "#logonaccount=" do |
| 285 | + before do |
| 286 | + allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true) |
| 287 | + resource[:logonaccount] = user_input |
| 288 | + provider.logonaccount_insync?(user_input) |
| 289 | + end |
| 290 | + |
| 291 | + let(:user_input) { principal.account } |
| 292 | + let(:principal) do |
| 293 | + Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, computer_name, :SidTypeUser) |
| 294 | + end |
| 295 | + |
| 296 | + context "when given user is 'myUser'" do |
| 297 | + it "should fail when the `Log On As A Service` right is missing from given user" do |
| 298 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("") |
| 299 | + expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" is missing the 'Log On As A Service' right./) |
| 300 | + end |
| 301 | + |
| 302 | + it "should fail when the `Log On As A Service` right is set to denied for given user" do |
| 303 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeDenyServiceLogonRight") |
| 304 | + expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" has the 'Log On As A Service' right set to denied./) |
| 305 | + end |
| 306 | + |
| 307 | + it "should not fail when given user has the `Log On As A Service` right" do |
| 308 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight") |
| 309 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 310 | + end |
| 311 | + |
| 312 | + ['myUser', 'myPC\\myUser', ".\\myUser", "MYPC\\mYuseR"].each do |user_input_variant| |
| 313 | + let(:user_input) { user_input_variant } |
| 314 | + |
| 315 | + it "should succesfully munge #{user_input_variant} to '.\\myUser'" do |
| 316 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight") |
| 317 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 318 | + expect(resource[:logonaccount]).to eq(".\\myUser") |
| 319 | + end |
| 320 | + end |
| 321 | + end |
| 322 | + |
| 323 | + context "when given user is a system account" do |
| 324 | + before do |
| 325 | + allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true) |
| 326 | + end |
| 327 | + |
| 328 | + let(:user_input) { principal.account } |
| 329 | + let(:principal) do |
| 330 | + Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser) |
| 331 | + end |
| 332 | + |
| 333 | + it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do |
| 334 | + expect(Puppet::Util::Windows::User).not_to receive(:get_rights) |
| 335 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 336 | + end |
| 337 | + |
| 338 | + ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input_variant| |
| 339 | + let(:user_input) { user_input_variant } |
| 340 | + |
| 341 | + it "should succesfully munge #{user_input_variant} to 'LocalSystem'" do |
| 342 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 343 | + expect(resource[:logonaccount]).to eq('LocalSystem') |
| 344 | + end |
| 345 | + end |
| 346 | + end |
| 347 | + |
| 348 | + context "when domain is different from computer name" do |
| 349 | + before do |
| 350 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return("SeServiceLogonRight") |
| 351 | + end |
| 352 | + |
| 353 | + context "when given user is from AD" do |
| 354 | + let(:user_input) { 'myRemoteUser' } |
| 355 | + let(:principal) do |
| 356 | + Puppet::Util::Windows::SID::Principal.new("myRemoteUser", nil, nil, "AD", :SidTypeUser) |
| 357 | + end |
| 358 | + |
| 359 | + it "should not raise any error" do |
| 360 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 361 | + end |
| 362 | + |
| 363 | + it "should succesfully be munged" do |
| 364 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 365 | + expect(resource[:logonaccount]).to eq('AD\myRemoteUser') |
| 366 | + end |
| 367 | + end |
| 368 | + |
| 369 | + context "when given user is LocalService" do |
| 370 | + let(:user_input) { 'LocalService' } |
| 371 | + let(:principal) do |
| 372 | + Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup) |
| 373 | + end |
| 374 | + |
| 375 | + it "should succesfully munge well known user" do |
| 376 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 377 | + expect(resource[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE') |
| 378 | + end |
| 379 | + end |
| 380 | + |
| 381 | + context "when given user is in SID form" do |
| 382 | + let(:user_input) { 'S-1-5-20' } |
| 383 | + let(:principal) do |
| 384 | + Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser) |
| 385 | + end |
| 386 | + |
| 387 | + it "should succesfully munge" do |
| 388 | + expect { provider.logonaccount=(user_input) }.not_to raise_error |
| 389 | + expect(resource[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE') |
| 390 | + end |
| 391 | + end |
| 392 | + |
| 393 | + context "when given user is actually a group" do |
| 394 | + let(:principal) do |
| 395 | + Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias) |
| 396 | + end |
| 397 | + let(:user_input) { 'Administrators' } |
| 398 | + |
| 399 | + it "should fail when sid type is not user or well known user" do |
| 400 | + expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /"BUILTIN\\#{user_input}" is not a valid account/) |
| 401 | + end |
| 402 | + end |
| 403 | + end |
| 404 | + end |
| 405 | + |
| 406 | + describe "#logonpassword=" do |
| 407 | + before do |
| 408 | + allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight') |
| 409 | + resource[:logonaccount] = account |
| 410 | + resource[:logonpassword] = user_input |
| 411 | + provider.logonaccount_insync?(account) |
| 412 | + end |
| 413 | + |
| 414 | + let(:account) { 'LocalSystem' } |
| 415 | + |
| 416 | + describe "when given logonaccount is a predefined_local_account" do |
| 417 | + let(:user_input) { 'pass' } |
| 418 | + let(:principal) { nil } |
| 419 | + |
| 420 | + it "should pass validation when given account is 'LocalSystem'" do |
| 421 | + allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true) |
| 422 | + allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(true) |
| 423 | + |
| 424 | + expect(Puppet::Util::Windows::User).not_to receive(:password_is?) |
| 425 | + expect { provider.logonpassword=(user_input) }.not_to raise_error |
| 426 | + end |
| 427 | + |
| 428 | + ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account| |
| 429 | + describe "when given account is #{predefined_local_account}" do |
| 430 | + let(:account) { 'predefined_local_account' } |
| 431 | + let(:principal) do |
| 432 | + Puppet::Util::Windows::SID::Principal.new(account, nil, nil, "NT AUTHORITY", :SidTypeUser) |
| 433 | + end |
| 434 | + |
| 435 | + it "should pass validation" do |
| 436 | + allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.account).and_return(false) |
| 437 | + allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.domain_account).and_return(false) |
| 438 | + expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(principal.domain_account).and_return(true).twice |
| 439 | + |
| 440 | + expect(Puppet::Util::Windows::User).not_to receive(:password_is?) |
| 441 | + expect { provider.logonpassword=(user_input) }.not_to raise_error |
| 442 | + end |
| 443 | + end |
| 444 | + end |
| 445 | + end |
| 446 | + |
| 447 | + describe "when given logonaccount is not a predefined local account" do |
| 448 | + before do |
| 449 | + allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(".\\#{principal.account}").and_return(false) |
| 450 | + allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with(".\\#{principal.account}").and_return(false) |
| 451 | + end |
| 452 | + |
| 453 | + let(:account) { 'myUser' } |
| 454 | + let(:principal) do |
| 455 | + Puppet::Util::Windows::SID::Principal.new(account, nil, nil, computer_name, :SidTypeUser) |
| 456 | + end |
| 457 | + |
| 458 | + describe "when password is proven correct" do |
| 459 | + let(:user_input) { 'myPass' } |
| 460 | + it "should pass validation" do |
| 461 | + allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true) |
| 462 | + expect { provider.logonpassword=(user_input) }.not_to raise_error |
| 463 | + end |
| 464 | + end |
| 465 | + |
| 466 | + describe "when password is not proven correct" do |
| 467 | + let(:user_input) { 'myWrongPass' } |
| 468 | + it "should not pass validation" do |
| 469 | + allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false) |
| 470 | + expect { provider.logonpassword=(user_input) }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/) |
| 471 | + end |
| 472 | + end |
| 473 | + end |
| 474 | + end |
| 475 | + end |
274 | 476 | end |
0 commit comments