Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Shouldn't xService SET the credential whenever it SETs? #766

Open
Jaykul opened this issue Feb 2, 2024 · 1 comment
Open

Shouldn't xService SET the credential whenever it SETs? #766

Jaykul opened this issue Feb 2, 2024 · 1 comment
Labels
enhancement The issue is an enhancement request. help wanted The issue is up for grabs for anyone in the community.

Comments

@Jaykul
Copy link

Jaykul commented Feb 2, 2024

Problem description

I can't find a way to rotate service credentials using xService

Suggested solution

It seems to me that the logic for credentials in xService should follow the pattern in xScheduledTask: if the credential is provided, set the credential. Presumably the Set only runs when Test fails, so it wouldn't result in restarting the service over and over or anything like that...

Alternatively, the resource needs to cache a hash for the username + password and update them if the hash changes. People can't change the username of their credential every time they want to change the password!

Operating system the target node is running

Windows Server 2019

PowerShell version and build the target node is running

PS 5.1

xPSDesiredStateConfiguration version

Name                         Version
----                         -------
xPSDesiredStateConfiguration 9.1.0
xPSDesiredStateConfiguration 5.1.0.0
@johlju johlju added enhancement The issue is an enhancement request. help wanted The issue is up for grabs for anyone in the community. labels Feb 10, 2024
@PlagueHO
Copy link
Member

I think we might have to use the alternate approach because I think (and need to confirm this) the Test for the Credential property, will just look at the username. Therefore, if we just allowed Set to fire whenever Credential is configured then I presume Set will run every execution - which even if it doesn't restart the service will report that the resource is never in state. Apologies if I'm misunderstanding.

I think ScheduledTask works that way too (just compares the username and if that is different, changes the password) - again, I could be wrong (a while since I've worked on those).

Hashing the password would work I think - @johlju - have you seen us use a similar approach elsewhere? How do you manage this sort of thing in SQLServerDsc?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement The issue is an enhancement request. help wanted The issue is up for grabs for anyone in the community.
Projects
None yet
Development

No branches or pull requests

3 participants