| Our puppetlabs-acl module lists changes with the users under APPLICATION PACKAGE AUTHORITY as a known limitation as follows:
When referring to accounts in the APPLICATION PACKAGE AUTHORITY, use either their SID values or their unqualified names. The Windows API has well documented bugs preventing the fully qualified account names from being used.
- S-1-15-2-1 or ALL APPLICATION PACKAGES, but not APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES. This account may only be referenced on Windows 2012R2 (kernel 6.3) or newer.
- S-1-15-2-2 or ALL RESTRICTED APPLICATION PACKAGES, but not APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES. This account may only be referenced on Windows 2016 (kernel 10.0) or newer.
Using above advice, the following manifest works and is idempotent :
acl \{ 'C:\\My Folder': |
permissions => [ |
\{ |
identity => 'ALL RESTRICTED APPLICATION PACKAGES', rights => ['read','write','execute']} |
], |
\}
|
But when trying to add other permissions (new ones), the following error occurs:
*Error: Failed to apply catalog: undefined method `bytesize' for nil:NilClass
C:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/api_types.rb:25:in `from_string_to_wide_string'*
Example:
acl \{ 'C:\\My Folder': |
permissions => [ |
\{ |
identity => 'Administrators', rights => ['read','write','execute']} |
], |
\}
|
This limitation is brought by puppet implementation of https://github.com/puppetlabs/puppet/blob/main/lib/puppet/util/windows/principal.rb#L47 which takes the username as it is. A special filtering for usernames starting with *APPLICATION PACKAGE AUTHORITY
*would solve this issue. |
