Repository: ansible/ansible

Issue:
winrm/connector issue with 2.0.1-rc1
Hey,

my playbook fails with 2.0.1-rc1 but succeeds with 2.0.0.2. authentication is done via plain username. it seems that ansible tries to execute the stuff locally and not via winrm

```

---
- hosts: node

  gather_facts: false
  any_errors_fatal: true

  vars:
    categories:
      - Application
      - Connectors
      - CriticalUpdates
      - DefinitionUpdates
      - DeveloperKits
      - FeaturePacks
      - Guidance
      - SecurityUpdates
      - ServicePacks
      - Tools
      - UpdateRollups
      - Updates

  tasks:
    - win_updates: state=searched category_names={{ categories }}
      register: updates
```

```
<node> EXEC /bin/sh -c 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAoAE4AZQB3AC0ASQB0AGUAbQAgAC0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABlAG4AdgA6AHQAZQBtAHAAIAAtAE4AYQBtAGUAIAAiAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANAA1ADQAMwAxADMAMQA4ADMALgA2ADMALQAyADEAMQAxADYAMQA0ADUANQA3ADMANQA3ADAANwAiACkALgBGAHUAbABsAE4AYQBtAGUAIAB8ACAAVwByAGkAdABlAC0ASABvAHMAdAAgAC0AUwBlAHAAYQByAGEAdABvAHIAIAAnACcAOwA='
fatal: [node]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the remote directory. Consider changing the remote temp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAoAE4AZQB3AC0ASQB0AGUAbQAgAC0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABlAG4AdgA6AHQAZQBtAHAAIAAtAE4AYQBtAGUAIAAiAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANAA1ADQAMwAxADMAMQA4ADMALgA2ADMALQAyADEAMQAxADYAMQA0ADUANQA3ADMANQA3ADAANwAiACkALgBGAHUAbABsAE4AYQBtAGUAIAB8ACAAVwByAGkAdABlAC0ASABvAHMAdAAgAC0AUwBlAHAAYQByAGEAdABvAHIAIAAnACcAOwA=, exited with result 1", "unreachable": true}
```



Discussion:
This sounds very similar to https://github.com/ansible/ansible/issues/14085

@h0nIg could you run with -vvvvvv and 
export ANSIBLE_DEBUG=1

Also please can you advise which windows version are you targeting? what OS and version, and python version you have on your ansible controller machine too.  

Python 2.7.6
Ubuntu 14.04
Win 2012 R2

relevant output:

```
 17535 1454329562.31312: _low_level_execute_command(): executing: /bin/sh -c 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand

..............

<node123> WINRM STDERR #< CLIXML
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><S S="Error">/bin/sh : Die Benennung "/bin/sh" wurde nicht als Name eines Cmdlet,
```

that means, that ansible tries to execute a command via winrm, but the command is prefixed with /bin/sh and therefore not available on a windows system

Ok that is clearly wrong then.  

I am guessing here ... but I wonder if you need to update your ansible.cfg so it is compatible with 2.0.1.  
Please can you check?

as already said, its working with 2.0.0.2. according to dpkg/apt-get there is no config change between 2.0.0.2 and 2.0.1. but if i'm wrong, please let me know

When I execute win_pìng, as below, the bug is still there:
`$ ansible -i host all -m win_ping -vvvvvv
wintel.local | UNREACHABLE! => {
    "changed": false,
    "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the remote directory. Consider changing the remote temp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQAL.., exited with result 1",
    "unreachable": true
}`

When I executed the raw module, all went fine:
`$ ansible -i host all -m raw -a date
wintel.local | SUCCESS | rc=0 >>
martes, 02 de febrero de 2016 16:07:07`

Authentication is done via plain username (winrm HTTP + no kerberos).
Relevant output.
`<snip>
 51562 1454424761.87863: _low_level_execute_command(): starting
 51562 1454424761.87876: _low_level_execute_command(): executing: /bin/sh -c 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAH...'
<wintel.local> ESTABLISH WINRM CONNECTION FOR USER: Administrator on PORT 5985 TO wintel.local
<wintel.local> WINRM CONNECT: transport=plaintext endpoint=http://wintel.local:5985/wsman
<wintel.local> EXEC /bin/sh -c 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAH...'
<wintel.local> WINRM OPEN SHELL: 6BD01056-398C-408D-91D6-3E94D3B87038
<wintel.local> WINRM EXEC 'PowerShell' ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Unrestricted', '-EncodedCommand', 'LwBiAG...']
<wintel.local> WINRM RESULT u'<Response code 1, out "", err "\ufeff#< CLIXML\r\n<Objs ">'
<wintel.local> WINRM STDOUT
<wintel.local> WINRM STDERR #< CLIXML
</snip>`

Environment:
RHEL 6.6
Python 2.6.6
`$ ansible --version
 51584 1454424947.69794: starting run
ansible 2.1.0 (devel 6105c8c77c) last updated 2016/02/02 15:48:23 (GMT +200)
  lib/ansible/modules/core: (detached HEAD 93d02189f6) last updated 2016/02/01 18:29:25 (GMT +200)
  lib/ansible/modules/extras: (detached HEAD fff5ae6994) last updated 2016/02/01 18:29:40 (GMT +200)
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o override`

See the discussion on the devel group here: https://groups.google.com/forum/#!topic/ansible-devel/xyLygKdc1dM

jhawkesworth: is that the right thread? Looks unrelated...

This is definitely a bug- there were some last minute (non-Windows-related) changes around shell stuff that didn't get tested on Windows before RC1 was cut. We should be able to have a fix in for RC2.

erm well the thread goes a bit off topic, just wanted to link to cchurch's comment that's all.


Resolving patch:
diff --git a/lib/ansible/plugins/action/__init__.py b/lib/ansible/plugins/action/__init__.py
--- a/lib/ansible/plugins/action/__init__.py
+++ b/lib/ansible/plugins/action/__init__.py
@@ -505,7 +505,7 @@ def _low_level_execute_command(self, cmd, sudoable=True, in_data=None, executabl
             replacement strategy (python3 could use surrogateescape)
         '''
 
-        if executable is not None:
+        if executable is not None and self._connection.allow_executable:
             cmd = executable + ' -c ' + pipes.quote(cmd)
 
         display.debug("_low_level_execute_command(): starting")
diff --git a/lib/ansible/plugins/connection/__init__.py b/lib/ansible/plugins/connection/__init__.py
--- a/lib/ansible/plugins/connection/__init__.py
+++ b/lib/ansible/plugins/connection/__init__.py
@@ -60,6 +60,7 @@ class ConnectionBase(with_metaclass(ABCMeta, object)):
     # as discovered by the specified file extension.  An empty string as the
     # language means any language.
     module_implementation_preferences = ('',)
+    allow_executable = True
 
     def __init__(self, play_context, new_stdin, *args, **kwargs):
         # All these hasattrs allow subclasses to override these parameters
diff --git a/lib/ansible/plugins/connection/winrm.py b/lib/ansible/plugins/connection/winrm.py
--- a/lib/ansible/plugins/connection/winrm.py
+++ b/lib/ansible/plugins/connection/winrm.py
@@ -63,6 +63,7 @@ class Connection(ConnectionBase):
 
     module_implementation_preferences = ('.ps1', '')
     become_methods = []
+    allow_executable = False
 
     def __init__(self,  *args, **kwargs):
 


Test patch: