{"record":{"id":"463c33a31a2cdec6","repo":"puppetlabs/puppet","slug":"password-must-be-specified-if-with-logon-is-used","errorCode":null,"errorMessage":"password must be specified if with_logon is used","messagePattern":"password must be specified if with_logon is used","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/monkey_patches/process.rb","lineNumber":373,"sourceCode":"      startinfo[:lpTitle]         = si_hash[:title] if si_hash[:title]\n      startinfo[:dwX]             = si_hash[:x] if si_hash[:x]\n      startinfo[:dwY]             = si_hash[:y] if si_hash[:y]\n      startinfo[:dwXSize]         = si_hash[:x_size] if si_hash[:x_size]\n      startinfo[:dwYSize]         = si_hash[:y_size] if si_hash[:y_size]\n      startinfo[:dwXCountChars]   = si_hash[:x_count_chars] if si_hash[:x_count_chars]\n      startinfo[:dwYCountChars]   = si_hash[:y_count_chars] if si_hash[:y_count_chars]\n      startinfo[:dwFillAttribute] = si_hash[:fill_attribute] if si_hash[:fill_attribute]\n      startinfo[:dwFlags]         = si_hash[:startf_flags] if si_hash[:startf_flags]\n      startinfo[:wShowWindow]     = si_hash[:sw_flags] if si_hash[:sw_flags]\n      startinfo[:cbReserved2]     = 0\n      startinfo[:hStdInput]       = si_hash[:stdin] if si_hash[:stdin]\n      startinfo[:hStdOutput]      = si_hash[:stdout] if si_hash[:stdout]\n      startinfo[:hStdError]       = si_hash[:stderr] if si_hash[:stderr]\n      startinfo\n    end\n\n    def create_process_with_logon\n      raise ArgumentError, 'password must be specified if with_logon is used' unless password\n\n      hash[:creation_flags] |= CREATE_UNICODE_ENVIRONMENT\n\n      bool = CreateProcessWithLogonW(\n        logon,                  # User\n        domain,                 # Domain\n        password,               # Password\n        LOGON_WITH_PROFILE,     # Logon flags\n        app,                    # App name\n        cmd,                    # Command line\n        hash[:creation_flags],  # Creation flags\n        env,                    # Environment\n        cwd,                    # Working directory\n        startinfo,              # Startup Info\n        procinfo                # Process Info\n      )\n\n      raise SystemCallError.new('CreateProcessWithLogonW', FFI.errno) unless bool","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/monkey_patches/process.rb#L355-L391","documentation":"When Process.create is given :with_logon, it routes through CreateProcessWithLogonW, which requires credentials; create_process_with_logon raises ArgumentError('password must be specified if with_logon is used') unless :password is set. The check happens before the Win32 logon call, so no authentication attempt has been made and no Windows error code applies.","triggerScenarios":"Process.create(command_line: 'batch.cmd', with_logon: 'svc_user') without :password; supplying :password => '' (empty string counts as present) vs nil; config where the password key is dropped by symbolization or YAML parsing of an empty value into nil.","commonSituations":"Running resources as a service account where the password comes from a secret store that returned nil; templates writing :with_logon but omitting :password on some branches; JWT/ENV-based credential loaders whose variable name casing mismatches (:Password vs :password is fine after to_s.to_sym, but 'pass' is not).","solutions":["Supply :password whenever :with_logon is set (pair it with :domain for non-local accounts)","Validate secrets before the call: raise unless opts[:password] && !opts[:password].empty?","Drop :with_logon entirely when inheriting the caller's credentials is acceptable","Log which option was missing (never the credential value) to speed diagnosis"],"exampleFix":"// before\nProcess.create(command_line: 'backup.cmd', with_logon: 'svc_backup')  # no password\n\n// after\nProcess.create(command_line: 'backup.cmd',\n               with_logon: 'svc_backup', domain: 'CORP',\n               password: fetch_secret('svc_backup'))","handlingStrategy":"validation","validationCode":"if args[:with_logon]\n  raise ArgumentError, 'password is required with with_logon' if args[:password].nil? || args[:password].empty?\nend\nProcess.create(args)","typeGuard":null,"tryCatchPattern":"begin\n  info = Process.create(args)\nrescue ArgumentError => e\n  raise unless e.message.include?('password must be specified')\n  raise 'with_logon requires credentials - fetch the secret before spawning'\nend","preventionTips":["Always send :with_logon, :domain, and :password as a triple","Resolve secrets before the call and fail loudly on nil - never default to empty","Drop :with_logon when inheriting the caller's identity is acceptable"],"tags":["windows","process","argumenterror","credentials","runas","puppet"],"backgroundTag":"missing-required-parameter","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}