LCM account now requires full control, but the pre deployment script does not grant it

Open
#710 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
azure, powershell
Domain
authorization, cloud, infrastructure, security

Research direction

Start with HCI/AsHciADArtifactsPreCreationTool.psm1 at the referenced line, then inspect the Domain.psm1 script in the deployment package to trace how permissions are applied. Reproduce or review Azure Local deployment validation and confirm that the LCM can grant the CNO full control over the lcm account and OU.

Written by the indexing model from the issue text.

Description

We just recently started an Azure Local deployment and during validation, the LCM creates the CNO, but fails to apply the permissions granting the CNO full control over the lcm account. This happens as part of this script: C:\NugetStore\Microsoft.AS.Infra.Security.Domain.10.2604.0.42\content\Deployment\Domain.psm1

Unfortunately, the LCM doesn't have full control over the OU to be able to grant it to the CNO. The predeployment script only grants the lcm limited permissions: https://github.com/Azure/AzureStack-Tools/blob/8fd59ad7bb82b4bf485a05073d16d416e01c8593/HCI/AsHciADArtifactsPreCreationTool.psm1#L614

I'd offer a pull request, but the Contribution guidelines link doesn't work. Also, pull requests seem pretty stale.

Dominant language
PowerShell
Stars
260
Forks
283
Avg merge
2h 11m
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure/AzureStack-Tools

All issues in Azure/AzureStack-Tools

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.