System.Security.Principal.Windows outerloop tests fail if run as non-admin

[stephentoub]

    Discovering: System.Security.Principal.Windows.Tests (method display = ClassAndMethod, method display options = None)
    Discovered:  System.Security.Principal.Windows.Tests (found 30 test cases)
    Starting:    System.Security.Principal.Windows.Tests (parallel test collections = on, max threads = 12)
      WindowsIdentityImpersonatedTests.RunImpersonated_NameResolution [FAIL]
        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

      WindowsIdentityImpersonatedTests.RunImpersonatedAsync_TaskAndTaskOfT [FAIL]
        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
      WindowsIdentityImpersonatedTests.RunImpersonatedAsync_NameResolution [FAIL]
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

      WellKnownSidTypeTests.CanCreateSecurityIdentifierFromWellKnownSidType_Netcoreapp [SKIP]
        Condition(s) not met: "AccountIsDomainJoined"
      WellKnownSidTypeTests.CanCreateSecurityIdentifierFromWellKnownSidType [SKIP]
        Condition(s) not met: "AccountIsDomainJoined"
    Finished:    System.Security.Principal.Windows.Tests
  === TEST EXECUTION SUMMARY ===
     System.Security.Principal.Windows.Tests  Total: 32, Errors: 0, Failed: 3, Skipped: 2, Time: 0.479s
  ----- end Thu 08/26/2021 15:16:56.86 ----- exit code 1 ----------------------------------------------------------

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

    Discovering: System.Security.Principal.Windows.Tests (method display = ClassAndMethod, method display options = None)
    Discovered:  System.Security.Principal.Windows.Tests (found 30 test cases)
    Starting:    System.Security.Principal.Windows.Tests (parallel test collections = on, max threads = 12)
      WindowsIdentityImpersonatedTests.RunImpersonated_NameResolution [FAIL]
        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

      WindowsIdentityImpersonatedTests.RunImpersonatedAsync_TaskAndTaskOfT [FAIL]
        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

        System.AggregateException : One or more errors occurred. (Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu) (The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture)
        ---- System.Exception : Failed to get SafeAccessTokenHandle for test account CorFxTstWiIde01kiu
      WindowsIdentityImpersonatedTests.RunImpersonatedAsync_NameResolution [FAIL]
        -------- System.ComponentModel.Win32Exception : The user name or password is incorrect.
        ---- The following constructor parameters did not have matching fixture data: WindowsIdentityFixture windowsIdentityFixture
        Stack Trace:

          ----- Inner Stack Trace #1 (System.Exception) -----
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(171,0): at WindowsTestAccount.CreateUser()
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(125,0): at WindowsTestAccount..ctor(String userName)
          D:\repos\runtime\src\libraries\System.Security.Principal.Windows\tests\WindowsIdentityImpersonatedTests.netcoreapp.cs(106,0): at WindowsIdentityFixture..ctor()
          ----- Inner Stack Trace -----

          ----- Inner Stack Trace #2 (Xunit.Sdk.TestClassException) -----

      WellKnownSidTypeTests.CanCreateSecurityIdentifierFromWellKnownSidType_Netcoreapp [SKIP]
        Condition(s) not met: "AccountIsDomainJoined"
      WellKnownSidTypeTests.CanCreateSecurityIdentifierFromWellKnownSidType [SKIP]
        Condition(s) not met: "AccountIsDomainJoined"
    Finished:    System.Security.Principal.Windows.Tests
  === TEST EXECUTION SUMMARY ===
     System.Security.Principal.Windows.Tests  Total: 32, Errors: 0, Failed: 3, Skipped: 2, Time: 0.479s
  ----- end Thu 08/26/2021 15:16:56.86 ----- exit code 1 ----------------------------------------------------------

Author:	stephentoub
Assignees:	-
Labels:	area-System.Security, test bug
Milestone:	7.0.0

[ryank425]

All of those corresponds exceptions goes to

if (!LogonUser(_userName, ".", testAccountPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, out _accountTokenHandle))
{
    _accountTokenHandle = null;
    throw new Exception($"Failed to get SafeAccessTokenHandle for test account {_userName}", new Win32Exception());
}

And LogonUser ... calls the following function

BOOL LogonUserA(
  LPCSTR  lpszUsername,
  LPCSTR  lpszDomain,
  LPCSTR  lpszPassword,
  DWORD   dwLogonType,
  DWORD   dwLogonProvider,
  PHANDLE phToken
);

https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-logonusera

The account specified by lpszUsername, must have the necessary account rights. For example, to log on a user with the LOGON32_LOGON_INTERACTIVE flag, the user (or a group to which the user belongs) must have the SE_INTERACTIVE_LOGON_NAME account right. For a list of the account rights that affect the various logon operations, see Account Rights Constants.

So, SeInteractiveLogonRight is required.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/allow-log-on-locally

My guess is that the user account that the test is running doesn't have this right.
It might be due to the Best Practices listed on the doc

1. Restrict this user right to legitimate users who must log on to the console of the device.
2. If you selectively remove default groups, you can limit the abilities of users who are assigned to specific administrative roles in your organization.

[danmoseley]

@krwq I think we have no protection against tests that require admin, right? as test runs are all run elevated.

[vcsjones]

Sometimes we guard tests with PlatformDetection.IsWindowsAndElevated (we do this in CNG tests, at least). Perhaps that would be a suitable solution for these outer loop tests.

[vcsjones]

It looks like this got fixed by #62559. The failing tests are now conditioned on PlatformDetection.CanRunImpersonatedTests which checks to see if we're elevated.

Given that I think this can be closed.