powershell - Mixlib::ShellOut - Windows 模拟失败

Question

我有一个 TeamCity 项目，它构建二进制文件，将 Recipe 上传到 Chef Server 并使用 Windows PowerShell session 远程聚合节点。

$s = New-PSSession -ComputerName $nd -Credential $cred
$result = Invoke-Command -Session $s -ScriptBlock { 
    Cd c:\chef
    chef-client --once -L client.%build.number%.log
    return $LastExitCode
} 
Remove-PSSession $s

一切正常，直到...
我需要在不同的凭据下执行一些二进制文件:

shell = Mixlib::ShellOut.new(cmd, :user => username,
    :domain => domain, :password => password)
shell.run_command
shell.error!

然后我收到以下错误:

[2015-08-06T14:17:13+02:00] DEBUG: Re-raising exception: Errno::NOERROR - idm_is3cli[configure_clients_and_scopes] (idm::is3cli line 30) had an error: Errno::NOERROR: No error - CreateProcessAsUserW (You must hold the 'Replace a process level token' permission)
C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout/windows/core_ext.rb:310:in `create'
    C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout/windows.rb:86:in `run_command'
    C:/opscode/chef/embedded/lib/ruby/gems/2.0.0/gems/mixlib-shellout-2.1.0-universal-mingw32/lib/mixlib/shellout.rb:259:in `run_command'
    c:/chef/cache/cookbooks/idm/providers/is3cli.rb:23:in `block in class_from_file'
    C:/opscode/chef/embedded/apps/chef/lib/chef/provider/lwrp_base.rb:160:in `instance_eval'
    C:/opscode/chef/embedded/apps/chef/lib/chef/provider/lwrp_base.rb:160:in `block in action'
    C:/opscode/chef/embedded/apps/chef/lib/chef/provider.rb:144:in `run_action'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource.rb:586:in `run_action'
    C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:49:in `run_action'
    C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `block (2 levels) in converge'
    C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `each'
    C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:81:in `block in converge'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/resource_list.rb:83:in `block in execute_each_resource'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:116:in `call'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:116:in `call_iterator_block'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:85:in `step'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:104:in `iterate'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/stepable_iterator.rb:55:in `each_with_index'
    C:/opscode/chef/embedded/apps/chef/lib/chef/resource_collection/resource_list.rb:81:in `execute_each_resource'
    C:/opscode/chef/embedded/apps/chef/lib/chef/runner.rb:80:in `converge'
    C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:654:in `block in converge'
    C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:649:in `catch'
    C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:649:in `converge'
    C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:688:in `converge_and_save'
    C:/opscode/chef/embedded/apps/chef/lib/chef/client.rb:269:in `run'
    C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:252:in `run_with_graceful_exit_option'
    C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:229:in `block in run_chef_client'
    C:/opscode/chef/embedded/apps/chef/lib/chef/local_mode.rb:39:in `with_server_connectivity'
    C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:212:in `run_chef_client'
    C:/opscode/chef/embedded/apps/chef/lib/chef/application/client.rb:375:in `run_application'
    C:/opscode/chef/embedded/apps/chef/lib/chef/application.rb:60:in `run'
    C:/opscode/chef/embedded/apps/chef/bin/chef-client:26:in `<top (required)>'
    C:/opscode/chef/bin/chef-client:65:in `load'
    C:/opscode/chef/bin/chef-client:65:in `<main>'

有任何想法吗？谢谢。

Answer 1

Looks like you have to update Group Policy on that machine to give that account the ability to replace a process level token:

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which user accounts can initiate a process to replace the default token associated with a launched subprocess. This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only LocalSystem accounts have this privilege.

According to the MSDN documentation on privilege constants , 这相当于 SE_ASSIGNPRIMARYTOKEN_NAME/ SeAssignPrimaryTokenPrivilege特权。 Carbon PowerShell 模块有一个 Grant-Privilege您可以使用该函数从控制台授予此权限。 (披露:我是 Carbon 的所有者/维护者。)