SqlSetup: Does not allow null or empty password for MSA

[wasabii]

"The password supplied to the Desired State Configuration resource MSFT_xSQLServerSetup is not valid. The password cannot be null or empty.",

It should, for managed service accounts.

[johlju]

@wasabii Would you be so kind to post the configuration you are using? Without any sensitive information.

[wasabii]

I don't think it matters. I solved the problem by creating a PSCredential with a single space as a password. It's sort of hacky, but it works. Previously I was using New-Object PSCredential("username", $null). That's when I got the error. Now I'm making a SecureString with a single space for the second param.

[johlju]

This was discussed in Gitter, thanks @NReilingh! 🙂

@NReilingh was kind enough to provide the error message from LCM when passing an empty password into the credential object.

Using this compiles a configuration correctly.

$SqlProxyUserCredential = New-Object System.Management.Automation.PSCredential(
    $Node.SqlSetup.ProxyUserMSA,
    (New-Object System.Security.SecureString)
)

But applying the configuration it gives this error.

Job {E69E204B-B6C0-11E8-B215-00505697B552} : 
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected. 
HResult -2146233087 
StackTrack    at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
   at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
   at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
   at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

And @NReilingh concludes

So: it’s a MOF file that uses certificate encryption for credentials, but since I use some credentials with empty securestrings, in the MOF these look like Password = “”; instead of Password = “-----BEGIN CMS-----\nblahblahblah

[johlju]

To use a (g)MSA with the credential objects (that support (g)MSA), any password need to passed into credential objects, but the username will only be used.

https://github.com/PowerShell/SqlServerDsc/blob/80172377320659488f0b45595264c29da58ae448/DSCResources/MSFT_SqlSetup/MSFT_SqlSetup.psm1#L2271-L2277

Since we can not change how LCM or MOF works in this repository, the only other way of solving this is to make separate parameters for (g)MSA, like what was done in dsccommunity/xPSDesiredStateConfiguration#441 for the xService resource.
But for the SqlSetup resource I do not think that is the way to go, since that would mean we have to add many more parameters, with even more logic.

I relabel this as a community discussion since this needs more voices if we should do a (breaking) change.

[NReilingh]

I think on balance, if we can't get a change out of LCM/MOF, it's preferable to use the "bogus password" workaround than to reimplement as a separate parameter. We would then want to make sure that's consistent across this repository, and documented so people know what they need to do if they want to use MSAs.

At the same time, it would be good to reach consensus with other DSC Resources, and is it possible to raise some sort of issue with the team that owns the LCM? One could interpret this as a bug in the encryption/decryption mechanism or MOF format, since it's perfectly valid to create a PSCredential object with no password.

Edit: Here's a uservoice issue: https://windowsserver.uservoice.com/forums/301869-powershell/suggestions/13447689-dsc-should-allow-credentials-with-blank-passwords

[johlju]

I agree we should add this to the documentation. Labeling it as such.