puppetlabs/puppet · error · Puppet::Util::Windows::Error

Invalid SID

Error message

Invalid SID

What it means

Raised by Security.add_access_allowed_ace (lib/puppet/util/windows/security.rb:436) when the SID pointer produced by SID.string_to_sid_ptr fails IsValidSid — the sid argument converted to a pointer but is not structurally a SID: malformed S-D-S-I-R string (wrong revision/authority, truncated subauthority list), or garbage input that happened to convert.

Source

Thrown at lib/puppet/util/windows/security.rb:436

      perms_to_strip = ~(FILE::FILE_EXECUTE + FILE::WRITE_OWNER + FILE::WRITE_DAC)
      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow & perms_to_strip, inherit)
      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow & perms_to_strip, inherit)
    end

    new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)
    set_security_descriptor(path, new_sd)

    nil
  end

  ACL_REVISION = 2

  def add_access_allowed_ace(acl, mask, sid, inherit = nil)
    inherit ||= NO_INHERITANCE

    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|
      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Invalid SID")
      end

      if AddAccessAllowedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Failed to add access control entry")
      end
    end

    # ensure this method is void if it doesn't raise
    nil
  end

  def add_access_denied_ace(acl, mask, sid, inherit = nil)
    inherit ||= NO_INHERITANCE

    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|
      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Invalid SID")
      end

View on GitHub (pinned to e227c27540)

Solutions

1. Validate the shape first: /^S-1-(\d+-){1,14}\d+$/ catches most bad data cheaply.
2. Resolve account names at runtime via SID.name_to_principal(name).sid instead of hand-building SID strings.
3. For builtin accounts, use Puppet's well-known SID constants (Puppet::Util::Windows::SID::BuiltinAdministrators, ::BuiltinUsers, etc.).
4. Rescue and reject the ACE early with a log that includes the offending sid value.

Example fix

# before — typo'd/truncated SID
add_access_allowed_ace(acl, mask, 'S-1-5-32-54')

# after — resolve the account and use its SID string
sid = Puppet::Util::Windows::SID.name_to_principal('BUILTIN\Users')&.sid
add_access_allowed_ace(acl, mask, sid) if sid

SID_PATTERN = /^S-1-(?:\d+-){1,14}\d+$/.freeze
raise ArgumentError, "malformed SID: #{sid.inspect}" unless sid.is_a?(String) && sid.match?(SID_PATTERN)
add_access_allowed_ace(acl, mask, sid)

sid_string? = ->(s) { s.is_a?(String) && s.match?(/^S-1-(?:\d+-){1,14}\d+$/) }

When it happens

Trigger: Passing a truncated or typo'd SID string like 'S-1-5-32-54' (missing final RID) or 'S-1-5-32-545x'; SIDs assembled by string manipulation from unvalidated input; an empty or garbage string after an upstream resolution failure.

Common situations: Hardcoded SIDs in manifests or ACL templates with typos; SIDs copied from whoami output losing a component; SID columns imported from databases or CSVs with truncation.

Related errors

• Byte array for lookup_account_sid must not be nil and must b
• Octet string must be an array of bytes
• ads_object must be an IAdsUser or IAdsGroup instance
• Invalid SID
• Failed to convert string SID: %{string_sid}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/7104ed8680201656. Report an issue: GitHub.