Support PowerShell Remoting in remote-exec and file provisioners

[masert]

Hi all,

facing a lot of probleme with provisionning on windows instances by WinRM (vsphere provider and windows instances connected to a domain)

Is it possible to add powershell connection type to terraform connection

Powershell is opensource since August 2016 and is available on major linux distributions

It will solve Kerberberos connection problem with windows instances (part of a domain)

Thanks a lot

[apparentlymart]

Hi @masert! Thanks for this feature request.

Just to make sure I understand properly, are you talking about PowerShell Remoting? It looks like that works in terms of WS-Management, like WinRM, but expects PowerShell commands instead.

[masert]

Hi yes, it means i need powershell to configure windows instances in domain. (WinRM is not able to do it, right?) it seems opensource powershell (on linux) is not able to use kerberos protocol to connect with Domain Account on windows instance Have you any other solution except to use terraform under windows wilth local exec of powershell? Thanks a lot! Best regards 2018-04-16 21:04 GMT+02:00 Martin Atkins <notifications@github.com>:

…

Hi @masert <https://github.com/masert>! Thanks for this feature request. Just to make sure I understand properly, are you talking about PowerShell Remoting <https://docs.microsoft.com/en-us/powershell/scripting/core-powershell/running-remote-commands?view=powershell-6#windows-powershell-remoting>? It looks like that works in terms of WS-Management <https://en.wikipedia.org/wiki/WS-Management>, like WinRM, but expects PowerShell commands instead. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17859 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AYuR1VfKnEKF6XLsXUNf-F0_Vf8vPN5uks5tpOsugaJpZM4TTtHS> .

-- marc.sert@gmail.com

[justdan96]

You may want to see here:
#17829 (comment)

[masert]

Hi as i said before we need kerberos protocol. NTLM is not able to help us to connect to domain account on windows instance. Besy regards. Le mar. 17 avr. 2018 à 18:09, Dan <notifications@github.com> a écrit :

…

You may want to see here: #17829 (comment) <#17829 (comment)> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17859 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AYuR1TcjXoGGiA2_hCw2lmujgxmwPHaLks5tphOogaJpZM4TTtHS> .

[justdan96]

Actually you can. Terraform uses the Azure/go-ntlmssp library for NTLM authentication. I put together a pull request for that repo to add domain authentication support and it is now in the master branch. It is currently not supported in Terraform as the Azure/go-ntlmssp dependency needs to be updated to the latest version.

[justdan96]

Here is the relevant pull request for Terraform to add the functionality: #17887

[masert]

thanks a lot to support my request. Best regards 2018-04-18 11:53 GMT+02:00 Dan <notifications@github.com>:

…

Here is the relevant pull request for Terraform to add the functionality: #17887 <#17887> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17859 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AYuR1ZTdbwmvVzYeOtVyk8UMGMYXCgxoks5tpw0OgaJpZM4TTtHS> .

-- marc.sert@gmail.com

[frezbo]

Any progress here, support for NTLM has be merged as per #17748

[lmayorga1980]

👍

[surajchandegave]

When can we expect this feature to be available?

[mildwonkey]

If this is a feature you are interested in, please react to the original issue comment with 👍, which we can and do report on during prioritization.

[masert2]

👍
actually we use local provisionner to launch local powershell remote command on windows TF instance.
Not the best way, and we are obliged to split between Linux and Windows env (to use the best usable tool on each side).

[apparentlymart]

Commenting with a +1 or 👍 doesn't help because we can't query by it, so it just makes noise for those following the issue. If you react to the original comment on this issue (not this comment) then we can use it as an input for prioritization, and it won't create such notification noise. Thanks!