SqlLogin: Added and amended integration tests for logins of 'SqlLogin…

…' type (#1652)

- SqlLogin
  - Added functionality to throw exception if an update to the `LoginMustChangePassword`
    value on an existing SQL Login is attempted. This functionality is not supported
    by referenced, SQL Server Management Object (SMO), libraries and cannot be
    supported directly by this module.
  - Added integration tests to ensure that an added (or updated) `SqlLogin` can
    connect into a SQL instance once added (or updated).
  - Added integration tests to ensure that the default database connected to by
    a `SqlLogin` is the same as specified in the resource's `DefaultDatabase`
    property/parameter.
  - Reversed order in which `PasswordExpirationEnabled` and `PasswordPolicyEnforced`
    are updated within `SqlLogin` resource. `PasswordPolicyEnforced` is now updated
    first.
  - Added integration tests to assert `LoginPasswordExpirationEnabled`,
    `LoginPasswordPolicyEnforced` and `LoginMustChangePassword` properties/parameters
    are applied and updated correctly. Similar integration tests also added to ensure
    the password of the `SqlLogin` is updated if the password within the `SqlCredential`
    value/object is changed (issue #361, issue #1032, and issue #1050).
  - Updated `SqlLogin`, integration tests to make use of amended `Wait-ForIdleLcm`,
    helper function, `-Clear` switch usage to remove intermittent, integration
    test failures (issue #1634).

CHANGELOG.md

@@ -5,6 +5,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- SqlLogin
+ - Added functionality to throw exception if an update to the `LoginMustChangePassword`
+ value on an existing SQL Login is attempted. This functionality is not supported
+ by referenced, SQL Server Management Object (SMO), libraries and cannot be
+ supported directly by this module.
+ - Added integration tests to ensure that an added (or updated) `SqlLogin` can
+ connect into a SQL instance once added (or updated).
+ - Added integration tests to ensure that the default database connected to by
+ a `SqlLogin` is the same as specified in the resource's `DefaultDatabase`
+ property/parameter.
+ - Reversed order in which `PasswordExpirationEnabled` and `PasswordPolicyEnforced`
+ are updated within `SqlLogin` resource. `PasswordPolicyEnforced` is now updated
+ first.
+
+### Fixed
+
+- SqlLogin
+ - Added integration tests to assert `LoginPasswordExpirationEnabled`,
+ `LoginPasswordPolicyEnforced` and `LoginMustChangePassword` properties/parameters
+ are applied and updated correctly. Similar integration tests also added to ensure
+ the password of the `SqlLogin` is updated if the password within the `SqlCredential`
+ value/object is changed ([issue #361](https://github.com/dsccommunity/SqlServerDsc/issues/361),
+ [issue #1032](https://github.com/dsccommunity/SqlServerDsc/issues/1032) and
+ [issue #1050](https://github.com/dsccommunity/SqlServerDsc/issues/1050)).
+ - Updated `SqlLogin`, integration tests to make use of amended `Wait-ForIdleLcm`,
+ helper function, `-Clear` switch usage to remove intermittent, integration
+ test failures ([issue #1634](https://github.com/dsccommunity/SqlServerDsc/issues/1634)).
+
 ## [15.0.1] - 2021-01-09
 
 ### Changed

source/DSCResources/DSC_SqlLogin/DSC_SqlLogin.psm1

@@ -107,7 +107,7 @@ function Get-TargetResource
  The credential containing the password for a SQL Login. Only applies if the login type is SqlLogin.
 
  .PARAMETER LoginMustChangePassword
- Specifies if the login is required to have its password change on the next login. Only applies to SQL Logins. Default is $true.
+ Specifies if the login is required to have its password change on the next login. Only applies to SQL Logins. Does not update pre-existing SQL Logins. Default is $true.
 
  .PARAMETER LoginPasswordExpirationEnabled
  Specifies if the login password is required to expire in accordance to the operating system security policy. Only applies to SQL Logins. Default is $true.
@@ -194,23 +194,27 @@ function Set-TargetResource
 
  if ( $login.LoginType -eq 'SqlLogin' )
  {
- if ( $login.PasswordExpirationEnabled -ne $LoginPasswordExpirationEnabled )
+ # There is no way to update 'MustChangePassword' on existing login so must explicitly throw exception to avoid this functionality being assumed
+ if ( $login.MustChangePassword -ne $LoginMustChangePassword )
  {
- Write-Verbose -Message (
- $script:localizedData.SetPasswordExpirationEnabled -f $LoginPasswordExpirationEnabled, $Name, $ServerName, $InstanceName
- )
-
- $login.PasswordExpirationEnabled = $LoginPasswordExpirationEnabled
- Update-SQLServerLogin -Login $login
+ $errorMessage = $script:localizedData.MustChangePasswordCannotBeChanged
+ New-InvalidOperationException -Message $errorMessage
  }
 
- if ( $login.PasswordPolicyEnforced -ne $LoginPasswordPolicyEnforced )
+ # `PasswordPolicyEnforced and `PasswordExpirationEnabled` must be updated together (if one or both are not in the desired state)
+ if ( $login.PasswordPolicyEnforced -ne $LoginPasswordPolicyEnforced -or
+ $login.PasswordExpirationEnabled -ne $LoginPasswordExpirationEnabled )
  {
  Write-Verbose -Message (
  $script:localizedData.SetPasswordPolicyEnforced -f $LoginPasswordPolicyEnforced, $Name, $ServerName, $InstanceName
  )
+ Write-Verbose -Message (
+ $script:localizedData.SetPasswordExpirationEnabled -f $LoginPasswordExpirationEnabled, $Name, $ServerName, $InstanceName
+ )
 
  $login.PasswordPolicyEnforced = $LoginPasswordPolicyEnforced
+ $login.PasswordExpirationEnabled = $LoginPasswordExpirationEnabled
+
  Update-SQLServerLogin -Login $login
  }
 

source/DSCResources/DSC_SqlLogin/DSC_SqlLogin.schema.mof

@@ -9,7 +9,7 @@ class DSC_SqlLogin : OMI_BaseResource
  Values{"WindowsUser","WindowsGroup","SqlLogin","Certificate","AsymmetricKey","ExternalUser","ExternalGroup"}] String LoginType;
  [Write, Description("The hostname of the _SQL Server_ to be configured. Default value is the current computer name.")] String ServerName;
  [Write, EmbeddedInstance("MSFT_Credential"), Description("Specifies the password as a `[PSCredential]` object. Only applies to _SQL Logins_.")] String LoginCredential;
- [Write, Description("Specifies if the login is required to have its password change on the next login. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginMustChangePassword;
+ [Write, Description("Specifies if the login is required to have its password change on the next login. Only applies to _SQL Logins_. Default value is `$true`. This cannot be updated on a pre-existing _SQL Login_ and any attempt to do this will throw an exception.")] Boolean LoginMustChangePassword;
  [Write, Description("Specifies if the login password is required to expire in accordance to the operating system security policy. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginPasswordExpirationEnabled;
  [Write, Description("Specifies if the login password is required to conform to the password policy specified in the system security policy. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginPasswordPolicyEnforced;
  [Write, Description("Specifies if the login is disabled. Default value is `$false`.")] Boolean Disabled;

source/DSCResources/DSC_SqlLogin/README.md

@@ -7,9 +7,17 @@ for a SQL Server instance.
 
 * Target machine must be running Windows Server 2012 or later.
 * Target machine must be running SQL Server Database Engine 2012 or later.
-* When the `LoginType` `'SqlLogin'` is used, then the login authentication
+* When the `LoginType` of `'SqlLogin'` is used, then the login authentication
  mode must have been set to `Mixed` or `Normal`. If set to `Integrated`
  and error will be thrown.
+* The `LoginMustChangePassword` property/parameter is only valid on a `SqlLogin`
+ where the `LoginType` property/parameter is set to `'SqlLogin'`.
+* The `LoginMustChangePassword` property/parameter can **not** be used to change
+ this setting on a pre-existing `SqlLogin` - This property/parameter can only
+ be used when creating a new `SqlLogin` and where subsequent updates will
+ not be applied or, alternatively, when the desired state will not change (for example,
+ where `LoginMustChangePassword` is initially set to `$false` and will always
+ be set to `$false`).
 
 ## Known issues
 

source/DSCResources/DSC_SqlLogin/en-US/DSC_SqlLogin.strings.psd1

@@ -33,4 +33,5 @@ ConvertFrom-StringData @'
  DropLoginFailed = Removal of the login '{0}' failed.
  SetPasswordValidationFailed = Setting the password failed for the login '{0}' because of password validation error.
  SetPasswordFailed = Setting the password failed for the login '{0}'.
+ MustChangePasswordCannotBeChanged = The '(Login)MustChangePassword' parameter cannot be updated on a login that is already present.
 '@