SqlLogin: Added and amended integration tests for logins of 'SqlLogin' type (Fixes #361, #792, #1032, #1050, #1634)

CHANGELOG.md

@@ -9,6 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- SqlLogin
+ - Added functionality to throw exception if an update to the `LoginMustChangePassword`
+ value on an existing SQL Login is attempted. This functionality is not supported
+ by referenced, SQL Server Management Object (SMO), libraries and cannot be
+ supported directly by this module.
+ - Added integration tests to ensure that an added (or updated) `SqlLogin` can
+ connect into a SQL instance once added (or updated).
+ - Added integration tests to ensure that the default database connected to by
+ a `SqlLogin` is the same as specified in the resource's `DefaultDatabase`
+ property/parameter.
+
+### Fixed
+
+- SqlLogin
+ - Added integration tests to assert `LoginPasswordExpirationEnabled`,
+ `LoginPasswordPolicyEnforced` and `LoginMustChangePassword` properties/parameters
+ are applied and updated correctly. Similar integration tests also added to ensure
+ the password of the `SqlLogin` is updated if the password within the `SqlCredential`
+ value/object is changed ([issue #361](https://github.com/dsccommunity/SqlServerDsc/issues/361),
+ [issue #1032](https://github.com/dsccommunity/SqlServerDsc/issues/1032) and
+ [issue #1050](https://github.com/dsccommunity/SqlServerDsc/issues/1050)).
+ - Updated `SqlLogin`, integration tests to make use of amended `Wait-ForIdleLcm`,
+ helper function, `-Clear` switch usage to remove intermittent, integration
+ test failures ([issue #1634](https://github.com/dsccommunity/SqlServerDsc/issues/1634)).
+
+## [15.0.1] - 2021-01-09
+
+### Changed
+
 - SqlServerDsc
  - Renamed `master` branch to `main` ([issue #1660](https://github.com/dsccommunity/SqlServerDsc/issues/1660)).
  - The module manifest property `DscResourcesToExport` now updates automatically

source/DSCResources/DSC_SqlLogin/DSC_SqlLogin.psm1

@@ -107,7 +107,7 @@ function Get-TargetResource
  The credential containing the password for a SQL Login. Only applies if the login type is SqlLogin.
 
  .PARAMETER LoginMustChangePassword
- Specifies if the login is required to have its password change on the next login. Only applies to SQL Logins. Default is $true.
+ Specifies if the login is required to have its password change on the next login. Only applies to SQL Logins. Does not update pre-existing SQL Logins. Default is $true.
 
  .PARAMETER LoginPasswordExpirationEnabled
  Specifies if the login password is required to expire in accordance to the operating system security policy. Only applies to SQL Logins. Default is $true.
@@ -194,6 +194,13 @@ function Set-TargetResource
 
  if ( $login.LoginType -eq 'SqlLogin' )
  {
+ # There is no way to update 'MustChangePassword' on existing login so must explicitly throw exception to avoid this functionality being assumed
+ if ( $login.MustChangePassword -ne $LoginMustChangePassword )
+ {
+ $errorMessage = $script:localizedData.MustChangePasswordCannotBeChanged
+ New-InvalidOperationException -Message $errorMessage
+ }
+
  if ( $login.PasswordExpirationEnabled -ne $LoginPasswordExpirationEnabled )
  {
  Write-Verbose -Message (

source/DSCResources/DSC_SqlLogin/DSC_SqlLogin.schema.mof

@@ -9,7 +9,7 @@ class DSC_SqlLogin : OMI_BaseResource
  Values{"WindowsUser","WindowsGroup","SqlLogin","Certificate","AsymmetricKey","ExternalUser","ExternalGroup"}] String LoginType;
  [Write, Description("The hostname of the _SQL Server_ to be configured. Default value is the current computer name.")] String ServerName;
  [Write, EmbeddedInstance("MSFT_Credential"), Description("Specifies the password as a `[PSCredential]` object. Only applies to _SQL Logins_.")] String LoginCredential;
- [Write, Description("Specifies if the login is required to have its password change on the next login. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginMustChangePassword;
+ [Write, Description("Specifies if the login is required to have its password change on the next login. Only applies to _SQL Logins_. Default value is `$true`. This cannot be updated on a pre-existing _SQL Login_ and any attempt to do this will throw an exception.")] Boolean LoginMustChangePassword;
  [Write, Description("Specifies if the login password is required to expire in accordance to the operating system security policy. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginPasswordExpirationEnabled;
  [Write, Description("Specifies if the login password is required to conform to the password policy specified in the system security policy. Only applies to _SQL Logins_. Default value is `$true`.")] Boolean LoginPasswordPolicyEnforced;
  [Write, Description("Specifies if the login is disabled. Default value is `$false`.")] Boolean Disabled;

source/DSCResources/DSC_SqlLogin/README.md

@@ -7,9 +7,17 @@ for a SQL Server instance.
 
 * Target machine must be running Windows Server 2012 or later.
 * Target machine must be running SQL Server Database Engine 2012 or later.
-* When the `LoginType` `'SqlLogin'` is used, then the login authentication
+* When the `LoginType` of `'SqlLogin'` is used, then the login authentication
  mode must have been set to `Mixed` or `Normal`. If set to `Integrated`
  and error will be thrown.
+* The `LoginMustChangePassword` property/parameter is only valid on a `SqlLogin`
+ where the `LoginType` property/parameter is set to `'SqlLogin'`.
+* The `LoginMustChangePassword` property/parameter can **not** be used to change
+ this setting on a pre-existing `SqlLogin` - This property/parameter can only
+ be used when creating a new `SqlLogin` and where subsequent updates will
+ not be applied or, alternatively, when the desired state will not change (for example,
+ where `LoginMustChangePassword` is initially set to `$false` and will always
+ be set to `$false`).
 
 ## Known issues
 

source/DSCResources/DSC_SqlLogin/en-US/DSC_SqlLogin.strings.psd1

@@ -33,4 +33,5 @@ ConvertFrom-StringData @'
  DropLoginFailed = Removal of the login '{0}' failed.
  SetPasswordValidationFailed = Setting the password failed for the login '{0}' because of password validation error.
  SetPasswordFailed = Setting the password failed for the login '{0}'.
+ MustChangePasswordCannotBeChanged = The '(Login)MustChangePassword' parameter cannot be updated on a login that is already present.
 '@

tests/Integration/DSC_SqlLogin.Integration.Tests.ps1

@@ -66,7 +66,7 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_AddLoginDscUser1_Config"
 
@@ -117,7 +117,7 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_AddLoginDscUser2_Config"
 
@@ -169,7 +169,7 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_AddLoginDscUser3_Disabled_Config"
 
@@ -220,7 +220,7 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_AddLoginDscUser4_Config"
 
@@ -264,14 +264,199 @@ try
  $resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.DscUser4Name
  $resourceCurrentState.LoginType | Should -Be $ConfigurationData.AllNodes.DscUser4Type
  $resourceCurrentState.Disabled | Should -Be $false
+ $resourceCurrentState.LoginMustChangePassword | Should -Be $false
+ $resourceCurrentState.LoginPasswordExpirationEnabled | Should -Be $true
+ $resourceCurrentState.LoginPasswordPolicyEnforced | Should -Be $true
  }
 
  It 'Should return $true when Test-DscConfiguration is run' {
  Test-DscConfiguration -Verbose | Should -Be 'True'
  }
+
+ It 'Should allow SQL Server, login username and password to connect to SQL Instance (using SqlConnection.Open())' {
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $databaseName = $ConfigurationData.AllNodes.DefaultDbName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass1 # Original password
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;Database={4};' -f $serverName, $instanceName, $userName, $password, $databaseName
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+
+ {
+ $sqlConnection.Open()
+ $sqlConnection.Close()
+ } | Should -Not -Throw
+ }
+
+ It 'Should allow SQL Server, login username and password to connect to correct, SQL instance, default database' {
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass1 # Original password
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;' -f $serverName, $instanceName, $userName, $password # Note: Not providing a database name
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+ $sqlCommand = New-Object System.Data.SqlClient.SqlCommand('SELECT DB_NAME() as CurrentDatabaseName', $sqlConnection)
+
+ $sqlConnection.Open()
+ $sqlDataAdapter = New-Object System.Data.SqlClient.SqlDataAdapter $sqlCommand
+ $sqlDataSet = New-Object System.Data.DataSet
+ $sqlDataAdapter.Fill($sqlDataSet) | Out-Null
+ $sqlConnection.Close()
+
+ $sqlDataSet.Tables[0].Rows[0].CurrentDatabaseName | Should -Be $ConfigurationData.AllNodes.DefaultDbName
+ }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
+
+ $configurationName = "$($script:dscResourceName)_UpdateLoginDscUser4_Config"
+
+ Context ('When using configuration {0}' -f $configurationName) {
+ It 'Should compile and apply the MOF without throwing' {
+ {
+ $configurationParameters = @{
+ OutputPath = $TestDrive
+ # The variable $ConfigurationData was dot-sourced above.
+ ConfigurationData = $ConfigurationData
+ }
+
+ & $configurationName @configurationParameters
+
+ $startDscConfigurationParameters = @{
+ Path = $TestDrive
+ ComputerName = 'localhost'
+ Wait = $true
+ Verbose = $true
+ Force = $true
+ ErrorAction = 'Stop'
+ }
+
+ Start-DscConfiguration @startDscConfigurationParameters
+ } | Should -Not -Throw
+ }
+
+ It 'Should be able to call Get-DscConfiguration without throwing' {
+ {
+ $script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction Stop
+ } | Should -Not -Throw
+ }
+
+ It 'Should have set the resource and all the parameters should match' {
+ $resourceCurrentState = $script:currentConfiguration | Where-Object -FilterScript {
+ $_.ConfigurationName -eq $configurationName `
+ -and $_.ResourceId -eq $resourceId
+ }
+
+ $resourceCurrentState.Ensure | Should -Be 'Present'
+ $resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.DscUser4Name
+ $resourceCurrentState.LoginType | Should -Be $ConfigurationData.AllNodes.DscUser4Type
+ $resourceCurrentState.Disabled | Should -Be $false
+ $resourceCurrentState.LoginMustChangePassword | Should -Be $false # Left the same as this cannot be updated
+ $resourceCurrentState.LoginPasswordExpirationEnabled | Should -Be $false
+ $resourceCurrentState.LoginPasswordPolicyEnforced | Should -Be $false
+ }
+
+ It 'Should return $true when Test-DscConfiguration is run' {
+ Test-DscConfiguration -Verbose | Should -Be 'True'
+ }
+
+ It 'Should allow SQL Server, login username and (changed) password to connect to SQL Instance (using SqlConnection.Open())' {
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $databaseName = $ConfigurationData.AllNodes.DefaultDbName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass2 # Changed password
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;Database={4};' -f $serverName, $instanceName, $userName, $password, $databaseName
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+
+ {
+ $sqlConnection.Open()
+ $sqlConnection.Close()
+ } | Should -Not -Throw
+ }
+
+ It 'Should allow SQL Server, login username and (changed) password to connect to correct, SQL instance, default database' {
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass2 # Changed password
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;' -f $serverName, $instanceName, $userName, $password # Note: Not providing a database name
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+ $sqlCommand = New-Object System.Data.SqlClient.SqlCommand('SELECT DB_NAME() as CurrentDatabaseName', $sqlConnection)
+
+ $sqlConnection.Open()
+ $sqlDataAdapter = New-Object System.Data.SqlClient.SqlDataAdapter $sqlCommand
+ $sqlDataSet = New-Object System.Data.DataSet
+ $sqlDataAdapter.Fill($sqlDataSet) | Out-Null
+ $sqlConnection.Close()
+
+ $sqlDataSet.Tables[0].Rows[0].CurrentDatabaseName | Should -Be $ConfigurationData.AllNodes.DefaultDbName
+ }
+ }
+
+
+ Wait-ForIdleLcm -Clear
+
+ # Note that this configuration has already been run within these Integration tests but is
+ # executed once more to reset the password back to the original one provided.
+ $configurationName = "$($script:dscResourceName)_AddLoginDscUser4_Config"
+
+ Context ('When using configuration {0} (to update back to original password)' -f $configurationName) {
+ It 'Should re-compile and re-apply the MOF without throwing' {
+ {
+ $configurationParameters = @{
+ OutputPath = $TestDrive
+ # The variable $ConfigurationData was dot-sourced above.
+ ConfigurationData = $ConfigurationData
+ }
+
+ & $configurationName @configurationParameters
+
+ $startDscConfigurationParameters = @{
+ Path = $TestDrive
+ ComputerName = 'localhost'
+ Wait = $true
+ Verbose = $true
+ Force = $true
+ ErrorAction = 'Stop'
+ }
+
+ Start-DscConfiguration @startDscConfigurationParameters
+ } | Should -Not -Throw
+ }
+
+ It 'Should be able to call Get-DscConfiguration without throwing' {
+ {
+ $script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction Stop
+ } | Should -Not -Throw
+ }
+
+ It 'Should return $true when Test-DscConfiguration is run' {
+ Test-DscConfiguration -Verbose | Should -Be 'True'
+ }
+
+ It 'Should allow SQL Server, login username and password to connect to SQL Instance (using SqlConnection.Open())' {
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $databaseName = $ConfigurationData.AllNodes.DefaultDbName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass1 # Original password
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;Database={4};' -f $serverName, $instanceName, $userName, $password, $databaseName
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+
+ {
+ $sqlConnection.Open()
+ $sqlConnection.Close()
+ } | Should -Not -Throw
+ }
+ }
+
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_AddLoginDscSqlUsers1_Config"
 
@@ -322,7 +507,7 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_RemoveLoginDscUser3_Config"
 
@@ -372,11 +557,29 @@ try
  }
  }
 
- Wait-ForIdleLcm
+ Wait-ForIdleLcm -Clear
 
  $configurationName = "$($script:dscResourceName)_CleanupDependencies_Config"
 
  Context ('When using configuration {0}' -f $configurationName) {
+
+
+ # Close any existing connections into the database before it is dropped
+ $serverName = $ConfigurationData.AllNodes.ServerName
+ $instanceName = $ConfigurationData.AllNodes.InstanceName
+ $userName = $ConfigurationData.AllNodes.DscUser4Name
+ $password = $ConfigurationData.AllNodes.DscUser4Pass1 # Using original password
+ $defaultDbName = $ConfigurationData.AllNodes.DefaultDbName
+
+ $sqlConnectionString = 'Data Source={0}\{1};User ID={2};Password={3};Connect Timeout=5;Database=master;' -f $serverName, $instanceName, $userName, $password
+ $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+ $sqlStatement = "ALTER DATABASE [{0}] SET OFFLINE WITH ROLLBACK IMMEDIATE" -f $defaultDbName
+ $sqlCommand = New-Object System.Data.SqlClient.SqlCommand($sqlStatement, $sqlConnection)
+ $sqlConnection.Open()
+ $sqlCommand.ExecuteNonQuery()
+ $sqlConnection.Close()
+
+
  It 'Should compile and apply the MOF without throwing' {
  {
  $configurationParameters = @{