Mixlib :: ShellOut - Impersonating Windows Fails

Question

I have a TeamCity project that builds a binary file, uploads a cookbook to Chef Server, and removes the node remotely using a Windows PowerShell session.

$s = New-PSSession -ComputerName $nd -Credential $cred $result = Invoke-Command -Session $s -ScriptBlock { Cd c:\chef chef-client --once -L client.%build.number%.log return $LastExitCode } Remove-PSSession $s 

Everything works fine until ...
I need to execute multiple binaries under different credentials:

 shell = Mixlib::ShellOut.new(cmd, :user => username, :domain => domain, :password => password) shell.run_command shell.error! 

Then I get the following error:

 [2015-08-06T14:17:13+02:00] DEBUG: Re-raising exception: Errno::NOERROR - idm_is3cli[configure_clients_and_scopes] (idm::is3cli line 30) had an error: Errno::NOERROR: No error - CreateProcessAsUserW (You must hold the 'Replace a process level token' permission) C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout/windows/core_ext.rb:310:in `create' C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout/windows.rb:86:in `run_command' C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout.rb:259:in `run_command' c:/chef/cache/cookbooks/idm/providers/is3cli.rb:23:in `block in class_from_file' C:/opscode/chef/embedded/apps/chef/lib/chef/provider/lwrp_base.rb:160:in `instance_eval' C:/opscode/chef/embedded/apps/chef/lib/chef/provider/lwrp_base.rb:160:in `block in action' C:/opscode/chef/embedded/apps/chef/lib/chef/provider.rb:144:in `run_action' C:/opscode/chef/embedded/apps/chef/lib/chef/resource.rb:586:in `run_action' C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:49:in `run_action' C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `block (2 levels) in converge' C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `each' C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `block in converge' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/resource_list.rb:83:in `block in execute_each_resource' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:116:in `call' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:116:in `call_iterator_block' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:85:in `step' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:104:in `iterate' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:55:in `each_with_index' C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/resource_list.rb:81:in `execute_each_resource' C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:80:in `converge' C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:654:in `block in converge' C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:649:in `catch' C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:649:in `converge' C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:688:in `converge_and_save' C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:269:in `run' C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:252:in `run_with_graceful_exit_option' C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:229:in `block in run_chef_client' C:/opscode/chef/embedded/apps/chef/lib/chef/local_mode.rb:39:in `with_server_connectivity' C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:212:in `run_chef_client' C:/opscode/chef/embedded/apps/chef/lib/chef/application/client.rb:375:in `run_application' C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:60:in `run' C:/opscode/chef/embedded/apps/chef/bin/chef-client:26:in `<top (required)>' C:/opscode/chef/bin/chef-client:65:in `load' C:/opscode/chef/bin/chef-client:65:in `<main>' 

Any ideas? Thanks.

Answer 1

It looks like you need to update the group policy on this computer to give this account the opportunity to replace the process level token:

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which user accounts can initiate the process to replace the default token associated with the running subprocess. This user right is defined in the default domain controller group policy object (GPO) and in the local security policy of workstations and servers.

By default, only LocalSystem accounts are available for this privilege.

According to the MSDN documentation of privilege constants, this is equivalent to the SE_ASSIGNPRIMARYTOKEN_NAME / SeAssignPrimaryTokenPrivilege . The Carbon PowerShell module has a Grant-Privilege function that you can use to grant this privilege from the console. (Disclosure: I am the owner / owner of Carbon.)