Allow Powershell provisioner to use service accounts

Fixes #6104
This commit is contained in:
Matt Dainty 2018-11-08 11:48:27 +00:00
parent 732b08e68a
commit 3b519acebc
3 changed files with 22 additions and 8 deletions

View File

@ -19,11 +19,11 @@ $log = [System.Environment]::ExpandEnvironmentVariables("{{.LogFile}}")
$s = New-Object -ComObject "Schedule.Service" $s = New-Object -ComObject "Schedule.Service"
$s.Connect() $s.Connect()
$t = $s.NewTask($null) $t = $s.NewTask($null)
$t.XmlText = @' $xml = [xml]@'
<?xml version="1.0" encoding="UTF-16"?> <?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo> <RegistrationInfo>
<Description>{{.TaskDescription}}</Description> <Description>{{.TaskDescription}}</Description>
</RegistrationInfo> </RegistrationInfo>
<Principals> <Principals>
<Principal id="Author"> <Principal id="Author">
@ -59,9 +59,20 @@ $t.XmlText = @'
</Actions> </Actions>
</Task> </Task>
'@ '@
$logon_type = 1
$password = "{{.Password}}"
if ($password.Length -eq 0) {
$logon_type = 5
$password = $null
$ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
$ns.AddNamespace("ns", $xml.DocumentElement.NamespaceURI)
$node = $xml.SelectSingleNode("/ns:Task/ns:Principals/ns:Principal/ns:LogonType", $ns)
$node.ParentNode.RemoveChild($node) | Out-Null
}
$t.XmlText = $xml.OuterXml
if (Test-Path variable:global:ProgressPreference){$ProgressPreference="SilentlyContinue"} if (Test-Path variable:global:ProgressPreference){$ProgressPreference="SilentlyContinue"}
$f = $s.GetFolder("\") $f = $s.GetFolder("\")
$f.RegisterTaskDefinition($name, $t, 6, "{{.User}}", "{{.Password}}", 1, $null) | Out-Null $f.RegisterTaskDefinition($name, $t, 6, "{{.User}}", $password, $logon_type, $null) | Out-Null
$t = $f.GetTask("\$name") $t = $f.GetTask("\$name")
$t.Run($null) | Out-Null $t.Run($null) | Out-Null
$timeout = 10 $timeout = 10

View File

@ -190,11 +190,6 @@ func (p *Provisioner) Prepare(raws ...interface{}) error {
errors.New("Only one of script or scripts can be specified.")) errors.New("Only one of script or scripts can be specified."))
} }
if p.config.ElevatedUser != "" && p.config.ElevatedPassword == "" {
errs = packer.MultiErrorAppend(errs,
errors.New("Must supply an 'elevated_password' if 'elevated_user' provided"))
}
if p.config.ElevatedUser == "" && p.config.ElevatedPassword != "" { if p.config.ElevatedUser == "" && p.config.ElevatedPassword != "" {
errs = packer.MultiErrorAppend(errs, errs = packer.MultiErrorAppend(errs,
errors.New("Must supply an 'elevated_user' if 'elevated_password' provided")) errors.New("Must supply an 'elevated_user' if 'elevated_password' provided"))

View File

@ -120,6 +120,14 @@ Optional parameters:
"elevated_password": "{{.WinRMPassword}}", "elevated_password": "{{.WinRMPassword}}",
``` ```
If you specify an empty `elevated_password` value then the PowerShell
script is run as a service account. For example:
``` json
"elevated_user": "SYSTEM",
"elevated_password": "",
```
- `remote_path` (string) - The path where the PowerShell script will be - `remote_path` (string) - The path where the PowerShell script will be
uploaded to within the target build machine. This defaults to uploaded to within the target build machine. This defaults to
`C:/Windows/Temp/script-UUID.ps1` where UUID is replaced with a dynamically `C:/Windows/Temp/script-UUID.ps1` where UUID is replaced with a dynamically