{"record":{"id":"6cec7d930861b4c4","repo":"puppetlabs/puppet","slug":"passwords-cannot-include","errorCode":null,"errorMessage":"Passwords cannot include ':'","messagePattern":"Passwords cannot include ':'","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/service.rb","lineNumber":153,"sourceCode":"        event\n      end\n    end\n\n    newproperty(:logonaccount, :required_features => :manages_logon_credentials) do\n      desc \"Specify an account for service logon\"\n\n      def insync?(current)\n        return provider.logonaccount_insync?(current) if provider.respond_to?(:logonaccount_insync?)\n\n        super(current)\n      end\n    end\n\n    newparam(:logonpassword, :required_features => :manages_logon_credentials) do\n      desc \"Specify a password for service logon. Default value is an empty string (when logonaccount is specified).\"\n\n      validate do |value|\n        raise ArgumentError, _(\"Passwords cannot include ':'\") if value.is_a?(String) && value.include?(\":\")\n      end\n\n      sensitive true\n      defaultto { @resource[:logonaccount] ? \"\" : nil }\n    end\n\n    newproperty(:flags, :required_features => :flaggable) do\n      desc \"Specify a string of flags to pass to the startup script.\"\n    end\n\n    newparam(:binary) do\n      desc \"The path to the daemon.  This is only used for\n        systems that do not support init scripts.  This binary will be\n        used to start the service if no `start` parameter is\n        provided.\"\n    end\n\n    newparam(:hasstatus) do","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/service.rb#L135-L171","documentation":"On Windows services whose provider supports `manages_logon_credentials`, the `logonpassword` parameter validates that the password string contains no ':' (lib/puppet/type/service.rb:153), raising ArgumentError. The colon is a reserved separator in Puppet's logon-credential plumbing (account/password are round-tripped through colon-delimited handling), so such passwords are rejected up front. The value is marked sensitive so it is redacted in reports.","triggerScenarios":"`service { 'svc': logonaccount => 'DOMAIN\\\\user', logonpassword => 'pa:ssword' }` on Windows; any programmatically generated password whose alphabet includes ':'.","commonSituations":"Random-password generators that include full punctuation; secrets pulled from Vault/Hiera that happen to contain colons; machines migrated from other CM tools that allowed ':' in service passwords.","solutions":["Change the service account password to one without ':' (regenerate from your secret store with a ':'-free alphabet)","Restrict the generator's character set for service logon passwords","If the password cannot change, use a gMSA / managed account and drop logonpassword"],"exampleFix":"# before\nservice { 'mysvc':\n  ensure        => running,\n  logonaccount  => '.\\\\svc_user',\n  logonpassword => 'p@ss:w0rd',\n}\n\n# after\nservice { 'mysvc':\n  ensure        => running,\n  logonaccount  => '.\\\\svc_user',\n  logonpassword => 'p@ssw0rd',\n}","handlingStrategy":"validation","validationCode":"# profile guard\nif $logonpassword =~ /:/ {\n  fail('service logon passwords must not contain a colon')\n}","typeGuard":"def valid_logonpassword?(pw)\n  pw.is_a?(String) && !pw.include?(':')\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:service).new(\n    name: 'mysvc', logonaccount: '.\\\\svc_user', logonpassword: 'p@ss:w0rd'\n  )\nrescue ArgumentError => e\n  raise unless e.message.include?(\"Passwords cannot include ':'\")\n  # regenerate the secret without ':' — do not log the value\nend","preventionTips":["Exclude ':' from generated service-account passwords","Keep the parameter marked sensitive in wrappers (no logging)","Note logonaccount is mandatory alongside logonpassword"],"tags":["puppet","windows","service","password","validation"],"backgroundTag":"invalid-password-characters","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}