安全地从ARM模板

Question

根据https://docs.microsoft.com/en-gb/azure/virtual-machines/windows/extensions-dsc-template，用于从ARM模板传递凭证提供给DSC扩展最新方法是通过将整个凭证部，如图所示的protectedSettings的configurationArguments内传递凭证到DSC扩展如下：

"properties": { 
    "publisher": "Microsoft.Powershell", 
    "type": "DSC", 
    "typeHandlerVersion": "2.24", 
    "autoUpgradeMinorVersion": true, 
    "settings": { 
     "wmfVersion": "latest", 
     "configuration": { 
      "url": "[concat(parameters('_artifactsLocation'), '/', variables('artifactsProjectFolder'), '/', variables('dscArchiveFolder'), '/', variables('dscSitecoreInstallArchiveFileName'))]", 
      "script": "[variables('dscSitecoreInstallScriptName')]", 
      "function": "SitecoreInstall" 
     }, 
     "configurationArguments": { 
      "nodeName": "[parameters('CMCD VMName')]", 
      "sitecorePackageUrl": "[concat(parameters('sitecorePackageLocation'), '/', parameters('sitecoreRelease'), '/', parameters('sitecorePackageFilename'))]", 
      "sitecorePackageUrlSasToken": "[parameters('sitecorePackageLocationSasToken')]", 
      "sitecoreLicense": "[concat(parameters('sitecorePackageLocation'), '/', parameters('sitecoreLicenseFilename'))]", 
      "domainName": "[parameters('domainName')]", 
      "joinOU": "[parameters('domainOrgUnit')]" 
     }, 
     "configurationData": { 
      "url": "[concat(parameters('_artifactsLocation'), '/', variables('artifactsProjectFolder'), '/', variables('dscArchiveFolder'), '/', variables('dscSitecoreInstallConfigurationName'))]" 
     } 
    }, 
    "protectedSettings": { 
     "configurationUrlSasToken": "[parameters('_artifactsLocationSasToken')]", 
     "configurationDataUrlSasToken": "[parameters('_artifactsLocationSasToken')]", 
     "configurationArguments": { 
      "domainJoinCredential": { 
       "userName": "[parameters('domainJoinUsername')]", 
       "password": "[parameters('domainJoinPassword')]" 
      } 
     } 
    } 
} 

Azure DSC应该为我处理protectedSettings的加密/解密。这确实出现了工作，因为我可以看到protectedSettings在VM设置文件中被加密的，但操作最终失败：

VM has reported a failure when processing extension 'dsc-sitecore-de 
v-install'. Error message: "The DSC Extension received an incorrect input: Comp 
ilation errors occurred while processing configuration 'SitecoreInstall'. Pleas 
e review the errors reported in error stream and modify your configuration code 
appropriately. System.InvalidOperationException error processing property 'Cre 
dential' OF TYPE 'xComputer': Converting and storing encrypted passwords as pla 
in text is not recommended. For more information on securing credentials in MOF 
file, please refer to MSDN blog: http://go.microsoft.com/fwlink/?LinkId=393729 
At C:\Packages\Plugins\Microsoft.Powershell.DSC\2.24.0.0\DSCWork\dsc-sitecore-d 
ev-install.0\dsc-sitecore-dev-install.ps1:103 char:3 
+ xComputer Converting and storing encrypted passwords as plain text is not r 
ecommended. For more information on securing credentials in MOF file, please re 
fer to MSDN blog: http://go.microsoft.com/fwlink/?LinkId=393729 Cannot find pat 
h 'HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC' because it does not exist. Cannot 
find path 'HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC' because it does not exis 
t. 

Another common error is to specify parameters of type PSCredential without an e 
xplicit type. Please be sure to use a typed parameter in DSC Configuration, for 
example: 

    configuration Example { 
     param([PSCredential] $UserAccount) 
     ... 
    }. 
Please correct the input and retry executing the extension.". 

，我可以把它的唯一途径是增加PsDscAllowPlainTextPassword = $true我的配置数据，但我认为我使用的是protectedSettings部分避免使用纯文本密码...

我做错了什么，还是仅仅是我的理解是错误的？

Answer 1

，你仍然需要使用PsDSCAllowPlainTextPassword = $true是documented

这里的事实是引述部分：

然而，目前你必须告诉PowerShell的DSC它是好的，为以纯输出凭据因为PowerShell DSC不知道Azure Automation会在通过编译作业生成整个MOF文件后对其进行加密。

基于上述情况，似乎是操作问题的顺序。 MOF生成并且被加密。这样做的

Answer 2

有道：

"settings": { 
    "configuration": { 
     "url": "xxx", 
     "script": "xxx", 
     "function": "xx" 
    }, 
    "configurationArguments": { 
     "param1": xxx, 
     "param2": xxx 
     etc... 
    } 
}, 
"protectedSettings": { 
    "configurationArguments": { 
     "NameOfTheCredentialsParameter": { 
      "userName": "USERNAME", 
      "password": "PASSWORD!1" 
     } 
    } 
} 

这样就不需要PsDSCAllowPlainTextPassword = $true

然后你就可以用

Configuration MyConf 
param (
    [PSCredential] $NameOfTheCredentialsParameter 
) 

一个收到你的配置参数使用它您的资源

Registry DoNotOpenServerManagerAtLogon { 
    Ensure = "Present" 
    Key = "HKEY_CURRENT_USER\SOFTWARE\Microsoft\ServerManager" 
    ValueName = "DoNotOpenServerManagerAtLogon" 
    ValueData = 1 
    ValueType = REG_DWORD" 
    PsDscRunAsCredential = $NameOfTheCredentialsParameter 
}