Repository navigation
Sync-DbaLoginPassword - Output the Failed row of a login that could not be synced - #10804
Conversation
…ot be synced The Failed row came after Stop-Function -Continue, which goes on with the next login, so it was never written: a failure only showed as a warning, although the help promises one row per login whether it succeeded or failed. The row is now written before Stop-Function. A password hash that could not be read skipped the login with a warning and no row as well; it now goes through the same failure path. (do Sync-DbaLoginPassword) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
potatoqualitee
left a comment
potatoqualitee
left a comment
There was a problem hiding this comment.
Reviewed at b7561c7caf2f2930afe9a75f35a1d06d3da93da8. No material defect found.
The failed result is now emitted before Stop-Function -Continue transfers control to the next login. Reviewed the complete patch, source/hash/flow-control helpers, tests, description, discussions, and CI. Warning mode retains later logins/destinations; EnableException still throws; success, filtering, and ShouldProcess behavior remain coherent.
The new regression uses a real SQL DDL trigger to reject the targeted login change and checks the Failed result, error, warning, and exception behavior. The exact-head MULTI job ran and passed Sync-DbaLoginPassword.Tests.ps1. All 20 executed head checks passed and one Windows check was skipped. SQL integration tests were not rerun locally.
|
thank you kindly |
Found while working #10772 and #10803.
Problem
When
Sync-DbaLoginPasswordcannot set the password of a login, it writes a warning and no output row. The help promises "one object per login password synchronized, whether successful or failed".The
Failedrow was there, but afterStop-Function -Continue. Without-EnableException,-Continuegoes on with the next login right away, so the row was never written. A caller that checksStatussees nothing for the login that failed.A password hash that could not be read from the source had the same result: a warning,
continue, and no row.Reproduced in the lab before #10803: a login with
CHECK_POLICYon fails with error 33020 inSet-DbaLogin -PasswordHash, andSync-DbaLoginPasswordreturned nothing for it.Change
Failedrow is written beforeStop-Function. The warning and the-EnableExceptionbehaviour stay as they were.try, so it takes the same path and gets itsFailedrow as well.Tests
New context "Reports a login whose password could not be synced" (
InstanceMulti1toInstanceMulti2, like the rest of the file). A server DDL trigger on the destination, limited to the test login, refuses itsALTER LOGIN, so the failure does not depend on #10803 or on the password policy of the login. It is dropped inAfterAll.-EnableException: one row withStatusFailed, the trigger's error inNotes, and the warning.-EnableException: the command throws, as before.Lab, Windows PowerShell 5.1:
Sync-DbaLoginPassword.ps1ofdevelopment: the new row test fails with "Expected 'dbatoolsci_syncpwdfail_...', but got $null".🤖 Generated with Claude Code