[BUG] regression with 3001: runas and onlyif do not work together

[flassman]

Description Using a cmd.run state with powershell commands fails if you use the runas and onlyif options together. It worked with 3000.2 but now fails with 3001

You get the following stacktrace:

 Comment: An exception occurred in this state: Traceback (most recent call last):
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 2118, in call
              ret.update(self._run_check(low))
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 890, in _run_check
              _ret = self._run_check_onlyif(low_data, cmd_opts)
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 950, in _run_check_onlyif
              entry, ignore_retcode=True, python_shell=True, **cmd_opts
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\modules\cmdmod.py", line 2316, in retcode
              **kwargs
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\modules\cmdmod.py", line 424, in _run
              return win_runas(cmd, runas, password, cwd)
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\utils\win_runas.py", line 207, in runas
              environment=env,
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\platform\win.py", line 1161, in CreateProcessWithTokenW
              raise exc
          OSError: The operation completed successfully.

Setup

powershell_onlyif:
  cmd.run:
    - name: 'whoami'
    - shell: powershell
    - runas: '{{ pillar['cluster']['username'] }}'
    - password: '{{ pillar['cluster']['password'] | trim }}'
    - onlyif: 'echo True'

Steps to Reproduce the behavior (Include debug logs if possible and relevant)

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Versions Report

salt --versions-report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

Salt Version:
           Salt: 3001

Dependency Versions:
           cffi: 1.12.2
       cherrypy: 17.4.1
       dateutil: 2.8.0
      docker-py: Not Installed
          gitdb: 2.0.5
      gitpython: Not Installed
         Jinja2: 2.10.1
        libgit2: Not Installed
       M2Crypto: Not Installed
           Mako: 1.0.7
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: 2.19
       pycrypto: Not Installed
   pycryptodome: 3.9.7
         pygit2: Not Installed
         Python: 3.7.4 (tags/v3.7.4:e09359112e, Jul  8 2019, 20:34:20) [MSC v.1916 64 bit (AMD64)]
   python-gnupg: 0.4.4
         PyYAML: 5.1.2
          PyZMQ: 18.0.1
          smmap: 2.0.5
        timelib: 0.2.4
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist:
         locale: cp1252
        machine: AMD64
        release: 2019Server
         system: Windows
        version: 2019Server 10.0.17763 SP0

Additional context Add any other context about the problem here.

[oeuftete]

ZD-5335.

[oeuftete]

This looks at least related to https://github.com/saltstack/salt/issues/54821. I am able to reproduce this on 3001 with Windows 2012 R2, although with a different error:

OSError: The system could not find the environment option that was entered.

The different error sounds a bit like what a commenter saw in https://github.com/saltstack/salt/issues/54821#issuecomment-536659857.

The workaround suggested in https://github.com/saltstack/salt/issues/54821#issuecomment-629622472 to add cmd.exe /c seems to work here, i.e.:

powershell_onlyif:
  cmd.run:
    - name: 'whoami'
    - shell: powershell
    - runas: '{{ pillar['cluster']['username'] }}'
    - password: '{{ pillar['cluster']['password'] | trim }}'
    - onlyif: 'cmd.exe /c echo True'

I have not tested on 3000 to confirm the failure in the onlyif as a regression.

[mchugh19]

PR #57825 may be related to this issue as well

[arizvisa]

Oh, hmm...curiouser and curiouser. I'm actually getting the same symptom but through a different code path over at #57840 and without the usage of onlyif..just runas.

I was originally thinking that it was introduced by commit 4a9c02078788701db26cf5c58ff82e2c030e8d43, but since salt.modules.cmd was working for y'all in 3000.2, I'll try tomorrow and see if PR #57825 resolves it, or bisect up to that tag at the very least.

[oeuftete]

ZD-5485

[oeuftete]

This could use a re-check to see if it is resolved in 3002.2. If #57825 was the fix, it should be.

[twangboy]

This appears to be fixed.