New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

xAdcsCertificationAuthority DSC resource does not throw error when fails because of wrong domain admin creds #3

Closed
amitsara opened this Issue Oct 30, 2015 · 2 comments

Comments

Projects
None yet
3 participants
@amitsara

amitsara commented Oct 30, 2015

Specify wrong domain admin creds in the following configuration. Resource will show error in verbose messages and configuration will continue.
It becomes very hard for the user investigate the issue if error is not thrown. He has to read all the verbose message to find what went wrong.

xADCSCertificationAuthority ConfigCA
{
Ensure = 'Present'
Credential = $DomainAdminCredential
CAType = 'EnterpriseSubordinateCA'
CACommonName = $Node.CACommonName
CADistinguishedNameSuffix = $Node.CADistinguishedNameSuffix
OverwriteExistingCAinDS = $True
OutputCertRequestFile = "c:\windows\system32\certsrv\certenroll$($Node.NodeName).req"
DependsOn = '[Script]InstallRootCACert'
}

Verbose output with wrong creds
VERBOSE: [SA-SUBCA]: [[Script]InstallRootCACert] Performing the operation "Set-TargetResource" on target "Executing the SetScript with the user supplied credential".
VERBOSE: [SA-SUBCA]: [[Script]InstallRootCACert] Registering the Root CA Certificate C:\Windows\System32\CertSrv\CertEnroll\SS-ROOTCA_PKI.CONTOSO.COM RootCA.crt in DS...
VERBOSE: [SA-SUBCA]: [[Script]InstallRootCACert] Registering the Root CA CRL C:\Windows\System32\CertSrv\CertEnroll\PKI.CONTOSO.COM RootCA.crl in DS...
VERBOSE: [SA-SUBCA]: [[Script]InstallRootCACert] Installing the Root CA Certificate C:\Windows\System32\CertSrv\CertEnroll\SS-ROOTCA_PKI.CONTOSO.COM RootCA.crt...
VERBOSE: [SA-SUBCA]: [[Script]InstallRootCACert] Installing the Root CA CRL C:\Windows\System32\CertSrv\CertEnroll\PKI.CONTOSO.COM RootCA.crl...
VERBOSE: [SA-SUBCA]: LCM: [ End Set ] [[Script]InstallRootCACert] in 1.5470 seconds.
VERBOSE: [SA-SUBCA]: LCM: [ End Resource ] [[Script]InstallRootCACert]
VERBOSE: [SA-SUBCA]: LCM: [ Start Resource ] [[xAdcsCertificationAuthority]ConfigCA]
VERBOSE: [SA-SUBCA]: LCM: [ Start Test ] [[xAdcsCertificationAuthority]ConfigCA]
VERBOSE: [SA-SUBCA]: [[xAdcsCertificationAuthority]ConfigCA] Calling InitializeDefaults method on the setup object.
VERBOSE: [SA-SUBCA]: [[xAdcsCertificationAuthority]ConfigCA] Certification Authority will be installed with a new key.
VERBOSE: [SA-SUBCA]: [[xAdcsCertificationAuthority]ConfigCA] Setting the AllowAdministratorInteraction property to False.
VERBOSE: [SA-SUBCA]: [[xAdcsCertificationAuthority]ConfigCA] Setting the CAType property to EnterpriseSubordinateCA.
VERBOSE: [SA-SUBCA]: [[xAdcsCertificationAuthority]ConfigCA] Active Directory Certificate Services setup failed with the following error: A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322
ERROR_DS_RANGE_CONSTRAINT)
VERBOSE: [SA-SUBCA]: LCM: [ End Test ] [[xAdcsCertificationAuthority]ConfigCA] in 1.1140 seconds.
VERBOSE: [SA-SUBCA]: LCM: [ Skip Set ] [[xAdcsCertificationAuthority]ConfigCA]
VERBOSE: [SA-SUBCA]: LCM: [ End Resource ] [[xAdcsCertificationAuthority]ConfigCA]
VERBOSE: [SA-SUBCA]: LCM: [ Start Resource ] [[xAdcsWebEnrollment]ConfigWebEnrollment]
VERBOSE: [SA-SUBCA]: LCM: [ Start Test ] [[xAdcsWebEnrollment]ConfigWebEnrollment]
VERBOSE: [SA-SUBCA]: [[xAdcsWebEnrollment]ConfigWebEnrollment] Calling InitializeDefaults method on the setup object.
VERBOSE: [SA-SUBCA]: LCM: [ End Test ] [[xAdcsWebEnrollment]ConfigWebEnrollment] in 0.2330 seconds.
VERBOSE: [SA-SUBCA]: LCM: [ Start Set ] [[xAdcsWebEnrollment]ConfigWebEnrollment]
VERBOSE: [SA-SUBCA]: [[xAdcsWebEnrollment]ConfigWebEnrollment] Calling InitializeDefaults method on the setup object.

Expected:
Resource should throw terminating error, so that user will know what happened.

@PlagueHO

This comment has been minimized.

Show comment
Hide comment
@PlagueHO

PlagueHO Nov 2, 2015

Collaborator

This can be resolved fairly easily with a minor code change:

    switch ($Ensure) {
        'Present' {
                (Install-AdcsCertificationAuthority @ADCSParams -Force).ErrorString
        }
        'Absent' {
                (Uninstall-AdcsCertificationAuthority -Force).ErrorString
        }
    }

To something like:

    $ErrorMessage = ''
    switch ($Ensure) {
        'Present' {
                $ErrorMessage = (Install-AdcsCertificationAuthority @ADCSParams -Force).ErrorString
                $errorId = 'ErrorInstallingADCSCA'
        }
        'Absent' {
                $ErrorMessage = (Uninstall-AdcsCertificationAuthority -Force).ErrorString
                $errorId = 'ErrorUninstallingADCSCA'
        }
    }
    if ($ErrorMessage) {
        $errorCategory = [System.Management.Automation.ErrorCategory]::DeviceError
        $exception = New-Object -TypeName System.InvalidOperationException `
            -ArgumentList $errorMessage
        $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord `
            -ArgumentList $exception, $errorId, $errorCategory, $null

        $PSCmdlet.ThrowTerminatingError($errorRecord)
      }

I'm happy to submit a PR for this, but I've had another PR for this resource sitting waiting for a couple of months.

[aside]This resource could use a little more love and attention as it has no logging support, no localization and no unit tests. :) I also would love it if there was an ADCS resource that could configure the ADCS default properties - at the moment I do this with the Script resource which is not ideal.[/aside]

Collaborator

PlagueHO commented Nov 2, 2015

This can be resolved fairly easily with a minor code change:

    switch ($Ensure) {
        'Present' {
                (Install-AdcsCertificationAuthority @ADCSParams -Force).ErrorString
        }
        'Absent' {
                (Uninstall-AdcsCertificationAuthority -Force).ErrorString
        }
    }

To something like:

    $ErrorMessage = ''
    switch ($Ensure) {
        'Present' {
                $ErrorMessage = (Install-AdcsCertificationAuthority @ADCSParams -Force).ErrorString
                $errorId = 'ErrorInstallingADCSCA'
        }
        'Absent' {
                $ErrorMessage = (Uninstall-AdcsCertificationAuthority -Force).ErrorString
                $errorId = 'ErrorUninstallingADCSCA'
        }
    }
    if ($ErrorMessage) {
        $errorCategory = [System.Management.Automation.ErrorCategory]::DeviceError
        $exception = New-Object -TypeName System.InvalidOperationException `
            -ArgumentList $errorMessage
        $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord `
            -ArgumentList $exception, $errorId, $errorCategory, $null

        $PSCmdlet.ThrowTerminatingError($errorRecord)
      }

I'm happy to submit a PR for this, but I've had another PR for this resource sitting waiting for a couple of months.

[aside]This resource could use a little more love and attention as it has no logging support, no localization and no unit tests. :) I also would love it if there was an ADCS resource that could configure the ADCS default properties - at the moment I do this with the Script resource which is not ideal.[/aside]

@PlagueHO

This comment has been minimized.

Show comment
Hide comment
@PlagueHO

PlagueHO Nov 15, 2017

Collaborator

Completed in #34

Collaborator

PlagueHO commented Nov 15, 2017

Completed in #34

@PlagueHO PlagueHO closed this Nov 15, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment