In dsc_xservice while specifying the runsAsAccount thorough dsc_credentials getting warning about dsc_builtinaccount.

[ShubhamKumar977]

Problem description

When I pass invoke a dsc_xservice resource using below puppet code

**dsc_xservice { $service_item:
  dsc_name            => $service_setting[dsc_name],
  dsc_desktopinteract => $service_setting[dsc_desktopinteract],
  dsc_state           => $service_setting[dsc_state],
  dsc_startuptype     => $service_setting[dsc_startuptype],
  dsc_credential => {
    'user'     => "${root_domain}\\${service_setting[dsc_credential][user]}",
    'password' => Sensitive($service_user_pw),
  },
}**

I get an warning like below
**Provider returned data that does not match the Type Schema for dsc_xservice[SetSqlServerAgentServiceUser]

Value type mismatch:

• dsc_builtinaccount: smartplantcloud\KMT03-DBS-001-SQLAGT (expects an undef value or a match for Enum['LocalService', 'LocalSystem', 'NetworkService', 'localservice', 'localsystem', 'networkservice'], got 'smartplantcloud\KMT03-DBS-001-SQLAGT')**
  And the resource is always showing up as a corrective change from running to ignored, this was working with the module puppetlabs-dsc

Verbose logs

N/A

DSC configuration

dsc_xservice { $service_item:
      dsc_name            => $service_setting[dsc_name],
      dsc_desktopinteract => $service_setting[dsc_desktopinteract],
      dsc_state           => $service_setting[dsc_state],
      dsc_startuptype     => $service_setting[dsc_startuptype],
      dsc_credential => {
        'user'     => "${root_domain}\\${service_setting[dsc_credential][user]}",
        'password' => Sensitive($service_user_pw),
      },
    }

Suggested solution

N/A

Operating system the target node is running

N/A

PowerShell version and build the target node is running

N/A

xPSDesiredStateConfiguration version

9.1.0-0-4

[ShubhamKumar977]

@johlju, @Indhukrishna, @KarolKaczmarek after mentioning validation_mode as 'resource' we are able to prevent the resource from registering as a corrective change but still not able to resolve the warning issue. Could I get some help here.

[johlju]

Not sure there is an issue with the resource, are you sure the error is coming from the resource? Suggest you debug the resource to see where in the code the error is thrown.

[BarnumD]

I'm experiencing same issue with 9.1.0-0-8, where I have a custom domain account running the service and get dsc_builtinaccount: the_account_name@domain.org (expects an undef value or a match for Enum['LocalService', 'LocalSystem', 'NetworkService', 'localservice', 'localsystem', 'networkservice'], got 'the_account_name@domain.org')
I'm not specifying dsc_credential, but have the custom domain account setup as the run-as manually.

[johlju]

This must be an issue in Puppet - it seems to return an error for the parameter BuiltInAccount in both cases above, and I'm guessing neither of you have added that parameter? So guessing the problem is in the Puppet's translation of "Puppet configuration" to the code running the resource.

I think this is an external issue that we can't resolve in this repo. Please comment if you find an actual issue with the resource's code.

[webalexeu]

This must be an issue in Puppet - it seems to return an error for the parameter BuiltInAccount in both cases above, and I'm guessing neither of you have added that parameter? So guessing the problem is in the Puppet's translation of "Puppet configuration" to the code running the resource.

I think this is an external issue that we can't resolve in this repo. Please comment if you find an actual issue with the resource's code.

We have the same issue on our side

After debugging, the issue is that the get resource return this object

ConfigurationName          :
DependsOn                  :
ModuleName                 : C:/ProgramData/PuppetLabs/puppet/cache/lib/puppet_x/xpsdesiredstateconfiguration/dsc_resources/xPSDesiredStateConfiguration/xPSDesiredStateConfiguration.psd1
ModuleVersion              : 9.2.1
PsDscRunAsCredential       :
ResourceId                 :
SourceInfo                 :
BuiltInAccount             : contoso.com\gmsa_account_name$
Credential                 :
Dependencies               : {}
Description                : Service description
DesktopInteract            : False
DisplayName                : simple_service
Ensure                     : Present
GroupManagedServiceAccount :
Name                       : simple_service
Path                       : C:\Program Files\simple_service\simple_service.exe
StartupTimeout             :
StartupType                : Automatic
State                      : Stopped
TerminateTimeout           :
PSComputerName             : localhost

as the return of BuiltInAccount is not matching the schema
https://github.com/dsccommunity/xPSDesiredStateConfiguration/blob/877adfa7fd3ae7da9c151206d99b5d5c92030ecc/source/DSCResources/DSC_xServiceResource/DSC_xServiceResource.schema.mof#L10C1-L11C1
puppet is trowing an error because puppet is enforcing the schema ValueMap defined

@johlju I'm looking to provide a PR to move forward on this topic
What will be the best solution for you?

• Changing the schema defintion?
• Fixing the Get-TargetResource to populated GroupManagedServiceAccount field instead of BuiltInAccount? (my preferred option)

Thank you for your support

[johlju]

I agree that if the service account is an (g)MSA the property GroupManagedServiceAccount should be set instead of setting the property BuiltInAccount. 🤔

Labelling this as a bug. Happy to see a PR for this.

[webalexeu]

Hello @johlju ,

When time, could you have a look at the PR #776 proposed to fix this issue ?

Thanks

[SamLatshaw15]

I was getting a warning before (~5 months ago), but now it's causing puppet to throw an error with this setup. Version 9.1.0-0-9

dsc_xservice { "Configuring service 'Service Name' to login as 'GMSA Username$'":
  dsc_name                       => 'Service Name',
  dsc_state                      => 'ignore',
  dsc_ensure                     => 'present',
  validation_mode                => 'resource',
  dsc_groupmanagedserviceaccount => 'GMSA Username$',
}

It also throws this whenever a non-GMSA account is set. So, it isn't able to update what user is running a service after it's already set.

Looks like the merge is almost there and appreciate the help.