Repository: ansible/ansible

Issue:
win_owner adsisearcher doesn't work remotely
_From @Vye on September 15, 2016 22:41_

<!--- Verify first that your issue/request is not already reported in GitHub -->
##### ISSUE TYPE

<!--- Pick one below and delete the rest: -->
- Bug Report
##### COMPONENT NAME

<!--- Name of the plugin/module/task -->

win_owner
##### ANSIBLE VERSION

<!--- Paste verbatim output from “ansible --version” between quotes below -->

```
ansible 2.1.1.0
```
##### CONFIGURATION

<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

N/A
##### OS / ENVIRONMENT

<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
-->

Windows 2012
##### SUMMARY

<!--- Explain the problem briefly -->

adsisearch doesn't seem to work remotely. I'm not a Windows expert so I can't explain why this is but it may make sense to try a different method of retrieving the SID?
##### STEPS TO REPRODUCE

<!---
For bugs, show exactly how to reproduce the problem.
For new features, show how the feature would be used.
-->

<!--- Paste example playbooks or commands between quotes below -->

```
- win_owner:
  path: "{{ app_dir }}"
  user: user@domain.com
```

To reproduce outside of ansible, execute the following commands remotely. They will work executed locally over remote desktop.

``` powershell
Invoke-Command -Computer <hostname> {
    $Searcher = [adsisearcher]""
    $Searcher.Filter = "userPrincipalName=user@domain.com"
    $Searcher.FindOne()
}
Exception calling "FindOne" with "0" argument(s): "An operations error occurred.
"
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException
```

This may not be the right way, but this worked for me:

```
     Else
     {
         #Search by samaccountname
         $objUser = New-Object System.Security.Principal.NTAccount($accountName.Split('@')[1], $accountName.Split('@')[0])
         return $objUser.Translate([System.Security.Principal.SecurityIdentifier]).Value
```

<!--- You can also paste gist.github.com links for larger files -->
##### EXPECTED RESULTS

<!--- What did you expect to happen when running the steps above? -->

Expected to set ownership of the directory to user@domain.com.
##### ACTUAL RESULTS

<!--- What actually happened? If possible run with high verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->

```
An exception occurred during task execution. The full traceback is:
At C:\Users\user\AppData\Local\Temp\ansible-tmp-1473973366.48-112492909054822\win_owner.ps1:296 char:9
+         $result = $Searcher.FindOne()
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fatal: [host.domain.com]: FAILED! => {"changed": false, "failed": true, "invocation": {"module_name": "win_owner"}, "msg": "Exception calling \"FindOne\" with \"0\" argument(s): \"An operations error occurred.\r\n\""}
```


_Copied from original issue: ansible/ansible-modules-extras#2933_


Discussion:
_From @ansibot on September 15, 2016 23:6_

@Vye we are unable to validate that "win_open" is an existing ansible module.

We are expecting a component name that matches something that can be found in:
- http://docs.ansible.com/ansible/list_of_all_modules.html

Please revise the component name in the description.
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)

<!--- boilerplate: issue_invalid_module --->

_From @jhawkesworth on September 16, 2016 7:16_

I fixed the module name in the bug report.

_From @jhawkesworth on September 16, 2016 7:29_

Not tried this myself but a couple of suggestions

Might need DOMAIN\user syntax instead of user@domain

Also you might need to use kerberos auth delegation as this is presumably accessing a second-hop resource (AD) from the target windows machine.  auth delegation is fairly new so not documented yet - see https://groups.google.com/forum/#!topic/ansible-project/vEl-mrvFkrY - its dead easy to set up if you already have kerberos working.

Hope this helps,

_From @ansibot on September 16, 2016 7:42_

Maintainer unknown ping @gregdek @resmo @robynbergeron.
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)

<!--- boilerplate: issue_module_no_maintainer --->

_From @jctanner on September 16, 2016 12:51_

bot_broken

Did you resolve this? I'm having the same problem on Windows Server 2012, R2. It worked fine for me on Windows 7.
I should also add that other commands work, it's just win_owner that's giving me trouble so far.
_From @ansibot on December 7, 2016 14:7_

This repository has been locked. All new issues and pull requests should be filed in https://github.com/ansible/ansible

Please read through the <a href="http://docs.ansible.com/ansible/dev_guide/repomerge.html#move-issues-and-prs-to-new-repo">repomerge</a> page in the dev guide. The guide contains links to tools which automatically move your issue or pull request to the ansible/ansible repo.

<!-- boilerplate: repomerge -->
cc @h0nIg
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
!bot_broken
Same problem with win_acl. Solved with:
_ansible_winrm_kerberos_delegation: yes_

Thanks to @jswetzen   previous comments.
cc @jborean93
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->

Resolving patch:
diff --git a/lib/ansible/modules/windows/win_acl.py b/lib/ansible/modules/windows/win_acl.py
--- a/lib/ansible/modules/windows/win_acl.py
+++ b/lib/ansible/modules/windows/win_acl.py
@@ -1,27 +1,8 @@
 #!/usr/bin/python
-# -*- coding: utf-8 -*-
-
 # Copyright 2015, Phil Schwartz <schwartzmx@gmail.com>
 # Copyright 2015, Trond Hindenes
 # Copyright 2015, Hans-Joachim Kliemeck <git@kliemeck.de>
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-
-# this is a windows documentation stub.  actual code lives in the .ps1
-# file of the same name
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
 ANSIBLE_METADATA = {'metadata_version': '1.1',
                     'status': ['preview'],
diff --git a/lib/ansible/modules/windows/win_owner.py b/lib/ansible/modules/windows/win_owner.py
--- a/lib/ansible/modules/windows/win_owner.py
+++ b/lib/ansible/modules/windows/win_owner.py
@@ -1,25 +1,6 @@
 #!/usr/bin/python
-# -*- coding: utf-8 -*-
-
 # Copyright 2015, Hans-Joachim Kliemeck <git@kliemeck.de>
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-
-# this is a windows documentation stub.  actual code lives in the .ps1
-# file of the same name
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
 ANSIBLE_METADATA = {'metadata_version': '1.1',
                     'status': ['preview'],
diff --git a/lib/ansible/modules/windows/win_share.py b/lib/ansible/modules/windows/win_share.py
--- a/lib/ansible/modules/windows/win_share.py
+++ b/lib/ansible/modules/windows/win_share.py
@@ -1,25 +1,6 @@
 #!/usr/bin/python
-# -*- coding: utf-8 -*-
-
 # Copyright 2015, Hans-Joachim Kliemeck <git@kliemeck.de>
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-
-# this is a windows documentation stub.  actual code lives in the .ps1
-# file of the same name
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
 ANSIBLE_METADATA = {'metadata_version': '1.1',
                     'status': ['preview'],


Test patch:
diff --git a/test/integration/targets/win_owner/tasks/main.yml b/test/integration/targets/win_owner/tasks/main.yml
--- a/test/integration/targets/win_owner/tasks/main.yml
+++ b/test/integration/targets/win_owner/tasks/main.yml
@@ -45,7 +45,7 @@
     path: "{{test_win_owner_path}}"
     user: invalid-user
   register: invalid_user
-  failed_when: invalid_user.msg != 'invalid-user is not a valid user or group on the host machine or domain'
+  failed_when: invalid_user.msg is not search("account_name invalid-user is not a valid account, cannot get SID.*")
 
 - name: set owner defaults check
   win_owner: