Missing params in properties hash when calling get method on ADDomainController.

[joeypiccola]

Describe the Bug

DSC resource addomaincontroller fails with the following error.

Error: dsc_addomaincontroller: Could not find mandatory property Credential. Add this property and try again.

The resource is being used as follows.

# https://github.com/dsccommunity/ActiveDirectoryDsc/wiki/ADDomainController
dsc_addomaincontroller { 'dc_promo':
  dsc_databasepath                  => $database_path,
  dsc_domainname                    => $win_domain,
  dsc_installdns                    => $install_dns,
  dsc_isglobalcatalog               => $is_global_catalog,
  dsc_logpath                       => $log_path,
  dsc_safemodeadministratorpassword => {
    'user'     => 'not_used',
    'password' => Sensitive($ad_safemode_password),
  },
  dsc_sitename                      => $site_name
  dsc_sysvolpath                    => $sysvol_path,
  dsc_credential                    => {
    'user'     => $ad_promo_user,
    'password' => Sensitive($ad_promo_password),
  },
}

When debugging this via Troubleshooting Puppetized DSC Module we can see $InvokeParams does not contain the required parameters\properties (e.g. credential) needed to execute the method get.

$InvokeParams = @{
  Name = 'ADDomainController'; 
  Method = 'get'; 
  Property = @{
    domainname = 'contoso.corp'
  }; 
  ModuleName = @{
    ModuleName = 'C:/ProgramData/PuppetLabs/puppet/cache/lib/puppet_x/activedirectorydsc/dsc_resources/ActiveDirectoryDsc/ActiveDirectoryDsc.psd1'; 
    RequiredVersion = '6.0.1'
  }
}

In looking more at what parameters are expected on the DSC resource ADDomainController when performing the method get, we can see both credential and safemodeadministratorpassword are required.

https://github.com/dsccommunity/ActiveDirectoryDsc/blob/9346a1d153515d5a4852375575bdddc917ea030e/source/DSCResources/MSFT_ADDomainController/MSFT_ADDomainController.psm1#L37-L54

Expected Behavior

I'd expect both credential and safemodeadministratorpassword be included in the Property hash of $InvokeParams.

Steps to Reproduce

Using the modules below and the dsc_addomaincontroller resource above this issue can be reproduced.

Environment

This is with Puppet Enterprise v219.7.0 using the following modules.

mod 'dsc-activedirectorydsc', '6.0.1-0-2'
mod 'puppetlabs-pwshlib', '0.7.3'

Additional Context

When running --debug to view $InvokeParams I do notice there are two sets (the first containing the expected credential and safemodeadministratorpassword parameters and the second does not. I am not sure why this is.

$cd1f7dbb_d9c4_4919_b74f_4da3b2ec2e86 = New-PSCredential -User not_used -Password '#<Sensitive [value redacted]>'
$2f6f9ecc_74c8_4aa0_9cab_1ae9beffc658 = New-PSCredential -User contoso.corp\promo -Password '#<Sensitive [value redacted]>'

$InvokeParams = @{
    Name = 'ADDomainController'; 
    Method = 'get'; 
    Property = @{
        domainname = 'contoso.corp'; 
        safemodeadministratorpassword = $cd1f7dbb_d9c4_4919_b74f_4da3b2ec2e86; 
        credential = $2f6f9ecc_74c8_4aa0_9cab_1ae9beffc658
    }; 
    ModuleName = @{
        ModuleName = 'C:/ProgramData/PuppetLabs/puppet/cache/lib/puppet_x/activedirectorydsc/dsc_resources/ActiveDirectoryDsc/ActiveDirectoryDsc.psd1'; 
        RequiredVersion = '6.0.1'
    }
}
[0;36mDebug: dsc_addomaincontroller: raw data received: {"SysvolPath"=>nil, "InstallDns"=>false, "IsGlobalCatalog"=>false, "ResourceId"=>nil, "ReadOnlyReplica"=>false, "PsDscRunAsCredential"=>nil, "Credential"=>{"Password"=>nil, "UserName"=>nil}, "ConfigurationName"=>nil, "Ensure"=>"False", "SourceInfo"=>nil, "DependsOn"=>nil, "AllowPasswordReplicationAccountName"=>nil, "SiteName"=>nil, "FlexibleSingleMasterOperationRole"=>nil, "InstallationMediaPath"=>nil, "ModuleVersion"=>"6.0.1", "ModuleName"=>"C:/ProgramData/PuppetLabs/puppet/cache/lib/puppet_x/activedirectorydsc/dsc_resources/ActiveDirectoryDsc/ActiveDirectoryDsc.psd1", "SafemodeAdministratorPassword"=>{"UserName"=>nil, "Password"=>nil, "cim_instance_type"=>"MSFT_Credential"}, "DatabasePath"=>nil, "DomainName"=>"contoso.corp", "DenyPasswordReplicationAccountName"=>nil, "LogPath"=>nil}�[0m
[0;36mDebug: dsc_addomaincontroller: Returned to Puppet as {:dsc_sysvolpath=>nil, :dsc_installdns=>false, :dsc_isglobalcatalog=>false, :dsc_readonlyreplica=>false, :dsc_ensure=>"False", :dsc_allowpasswordreplicationaccountname=>nil, :dsc_sitename=>nil, :dsc_flexiblesinglemasteroperationrole=>nil, :dsc_installationmediapath=>nil, :dsc_databasepath=>nil, :dsc_domainname=>"contoso.corp", :dsc_denypasswordreplicationaccountname=>nil, :dsc_logpath=>nil, :name=>"dc_promo"}�[0m
[0;36mDebug: dsc_addomaincontroller: Canonicalized Resources: [{:dsc_sysvolpath=>"c:\\sysvol", :dsc_installdns=>true, :dsc_isglobalcatalog=>true, :dsc_sitename=>"DEFAULT", :dsc_databasepath=>"c:\\ntds", :dsc_domainname=>"contoso.corp", :dsc_logpath=>"c:\\ntds", :name=>"dc_promo", :dsc_safemodeadministratorpassword=>{"user"=>"not_used", "password"=>#<Sensitive [value redacted]>}, :dsc_credential=>{"user"=>"contoso.corp\\promo", "password"=>#<Sensitive [value redacted]>}}]�[0m

$InvokeParams = @{
    Name = 'ADDomainController'; 
    Method = 'get'; 
    Property = @{
        domainname = 'contoso.corp'
    }; 
    ModuleName = @{
        ModuleName = 'C:/ProgramData/PuppetLabs/puppet/cache/lib/puppet_x/activedirectorydsc/dsc_resources/ActiveDirectoryDsc/ActiveDirectoryDsc.psd1'; 
        RequiredVersion = '6.0.1'
    }
}
[0;36mDebug: dsc_addomaincontroller: raw data received: {"rebootrequired"=>false, "indesiredstate"=>false, "errormessage"=>"Could not find mandatory property Credential. Add this property and try again."}�[0m
[0;36mDebug: dsc_addomaincontroller: Canonicalized Resources: [{:dsc_sysvolpath=>nil, :dsc_installdns=>false, :dsc_isglobalcatalog=>false, :dsc_readonlyreplica=>false, :dsc_ensure=>"False", :dsc_allowpasswordreplicationaccountname=>nil, :dsc_sitename=>nil, :dsc_flexiblesinglemasteroperationrole=>nil, :dsc_installationmediapath=>nil, :dsc_databasepath=>nil, :dsc_domainname=>"contoso.corp", :dsc_denypasswordreplicationaccountname=>nil, :dsc_logpath=>nil, :name=>"dc_promo"}]�[0m
[0;36mDebug: Current State: {:dsc_sysvolpath=>nil, :dsc_installdns=>false, :dsc_isglobalcatalog=>false, :dsc_readonlyreplica=>false, :dsc_ensure=>"False", :dsc_allowpasswordreplicationaccountname=>nil, :dsc_sitename=>nil, :dsc_flexiblesinglemasteroperationrole=>nil, :dsc_installationmediapath=>nil, :dsc_databasepath=>nil, :dsc_domainname=>"contoso.corp", :dsc_denypasswordreplicationaccountname=>nil, :dsc_logpath=>nil, :name=>"dc_promo"}�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_isglobalcatalog: dsc_isglobalcatalog changed false to 'true' (corrective)�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_sysvolpath: dsc_sysvolpath changed  to 'c:\sysvol' (corrective)�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_sitename: dsc_sitename changed  to 'DEFAULT' (corrective)�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_installdns: dsc_installdns changed false to 'true' (corrective)�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_databasepath: dsc_databasepath changed  to 'c:\ntds' (corrective)�[0m
[mNotice: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]/dsc_logpath: dsc_logpath changed  to 'c:\ntds' (corrective)�[0m
[0;36mDebug: dsc_addomaincontroller: Canonicalized Resources: [{:name=>"dc_promo", :dsc_domainname=>"contoso.corp", :dsc_isglobalcatalog=>true, :dsc_sysvolpath=>"c:\\sysvol", :dsc_sitename=>"DEFAULT", :dsc_installdns=>true, :dsc_databasepath=>"c:\\ntds", :dsc_logpath=>"c:\\ntds", :dsc_credential=>{"user"=>"contoso.corp\\promo", "password"=>#<Sensitive [value redacted]>}, :dsc_safemodeadministratorpassword=>{"user"=>"not_used", "password"=>#<Sensitive [value redacted]>}}]�[0m
[0;36mDebug: Target State: {:name=>"dc_promo", :dsc_domainname=>"contoso.corp", :dsc_isglobalcatalog=>true, :dsc_sysvolpath=>"c:\\sysvol", :dsc_sitename=>"DEFAULT", :dsc_installdns=>true, :dsc_databasepath=>"c:\\ntds", :dsc_logpath=>"c:\\ntds", :dsc_credential=>{"user"=>"contoso.corp\\promo", "password"=>#<Sensitive [value redacted]>}, :dsc_safemodeadministratorpassword=>{"user"=>"not_used", "password"=>#<Sensitive [value redacted]>}}�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: /Stage[main]/Domaincontroller_win::Promote/Dsc_addomaincontroller[dc_promo]: The container Class[Domaincontroller_win::Promote] will propagate my refresh event�[0m
[0;36mDebug: Class[Domaincontroller_win::Promote]: The container Stage[main] will propagate my refresh event�[0m

[michaeltlombardi]

@joeypiccola Aha, I see right away where things have gone wrong (I think). The Credential property is both a Parameter - passable, but not readable back from the system - and required for get. We should be able to update the logic for invoke_get_method to be able to pull in the appropriate parameters. I'm starting to test that now.

[michaeltlombardi]

Fix released in puppetlabs-pwshlib 0.7.4