opscode/mixlib-shellout — pull request #9 by moserke (2013-01-09 01:15:39+00:00)
Title: Add User Impersonation

Added the ability to, on shell_out, switch to a different user before creating the process. There are three scenarios covered:

1) Chef is run as a local user. This calls the CreateProcessWithLogonW Win32 API function
2) Chef is run as local service, the case where chef is installed as a service or as a scheduled task. This calls the LogonUser and CreateProcessAsUser Win32 API functions. These functions require a special OS permission of "Replace a process level token" which local service has by default. CreateProcessWithLogonW can not be used as this does not work cross version.
3) Chef is run remotely (vagrant, winrm, psexec, etc). There is a monkey patch switch to pass called "remote_call" that will force the use of API functions in the second scenario, but requires that the use set the "Replace a process level token" permission on the account that is remotely calling chef. This is because using CreateProcessWithLogonW is causing a permissions error on the windows station and desktop access. There should be a feature enhancement down the road to fix this.

The monkey patch is a bit annoying, but after spending some time digging in to setting the permissions on the windows station and desktop, this is a VERY non-trivial thing to do and it is a limited use case.