microsoft.ad.group does not support adding group members from another forest

[cobbr]

SUMMARY

microsoft.ad.group does not support adding group members from another forest. If ForestA has a bidirectional forest trust with ForestB, I should be able to add a user from ForestB to a group in ForestA.

This is related to a previous issue: #56

This issue fixed the issue for domain trusts with two domains in the same forest. However, the solution is not working for a forest trust between two domains in separate forests.

The reason for this, the code currently uses the server attribute for each member to resolve the full distinguishedName and then adds the member via dn with Set-AdGroup -Add @{member="<distinguished_name>"}, but that does not work for forest trusts. Instead something like this would work:

$user = Get-ADUser "user_in_forest_b" -Server "forest_b" -Credential $forest_b_cred;
Add-ADGroupMember -Identify GroupInForestA -Members @(,$user) -Credential $forest_a_cred

ISSUE TYPE

• Bug Report

COMPONENT NAME

microsoft.ad.group

ANSIBLE VERSION

ansible [core 2.16.14]

COLLECTION VERSION

Collection   Version
------------ -------
microsoft.ad 1.9.2 

OS / ENVIRONMENT

Both domain controllers are running Windows Server 2016

STEPS TO REPRODUCE

- name: Add user to AD group
  microsoft.ad.group:
    identity: GroupInForestA
    name: GroupInForestA
    domain_server: forest_a
    members:
      add:
      # Will lookup on default DC
      - user1
      # Will lookup on forest_b
      - name: user_in_forest_b
        server: forest_b

EXPECTED RESULTS

The user_in_forest_b should be a member of the GroupInForestA

ACTUAL RESULTS

Errors out with "The specified account does not exist"

[briantist]

One work around is if you know the SID of the foreign (forest B) object. This will work because in the target domain (forest A), a Foreign Security Principal object is created with the same SID as the principal in forest B, and this is the real object that gets added to the group. If you know the SID, this will work without even needing credentials in forest B or making any requests to it.

But this require the FPO to already exist. If you already know the SID you could probably create it with microsoft.ad.object though this isn't something I've tried.

If you don't know the SID yet, you may be able to use microsoft.ad.object_info to look it up in forest B, then create it in forest A, and finally reference it in the group membership call in forest A.

Not saying this is a solution ultimately but it is a potential workaround.

[cobbr]

Hey @briantist , I appreciate the suggestion, I'm looking for something that would create the Foreign Security Principal (FSP) as well as add the foreign user to the group. I haven't tested, but your suggestion certainly could work as a workaround, something like this works the same (without the need to explicitly create the FSP):

$user = Get-ADUser "user_in_forest_b" -Server "forest_b" -Credential $forest_b_cred;
Add-ADGroupMember -Identify GroupInForestA -Members @(,$user) -Credential $forest_a_cred

[jarrah31]

I also have this exact problem where I'm trying to add a group from forest_b into a group in forest_a, but I get the following error:
Set-ADGroup failed: The specified account does not exist
I'm trying to migrate an existing playbook from community.windows.win_domain_group_membership which worked fine for years adding groups from forest_b to forest_a, but I just can't make it work with the replacement microsoft.ad.group.
In case it helps, the module options I'm using are:

- name: Create AD groups
  hosts: windows

tasks:
  - name: Create AD group and add members
    microsoft.ad.group:
      name: forest_a_group
      state: present
      scope: domainlocal
      path: forest_a_group_ou_path
      members:
        add:
        - name: forest_b_group (DN or sAMAccountName)
          server: forest_b_domain_name

I'm using WinRM from a Rocky 9 server. I have a simple setup with the /etc/ansible/hosts file looking like this:

all:
  children:
    windows:
      hosts:
        forest_a_windows_srv_not_DC.domain.com
      vars:
        ansible_connection: winrm
        ansible_winrm_transport: kerberos
        ansible_kerberos_delegation: yes
        ansible_port: 5985
        ansible_domain: forest_a_domain_name

[jarrah31]

I managed to find a workaround for this by looking at the powershell source code for the discontinued community.windows.win_domain_group_membership (which as mentioned above was working ok).

What that does is find the forest_b_group_name member in the forest_b domain using the following:

$securePassword = ConvertTo-SecureString 'forest_a_user_password' -AsPlainText -Force

$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'user@forest_a_domain.fqdn.com', $securePassword

$groupMember = Get-ADObject -Filter "SamAccountName -eq 'forest_b_group_name'" -Properties objectSid, sAMAccountName -Server forest_b_domain_name -Credential $credential

It then adds the forest_b group name to the forest_a group:

$ADGroup = GetADGroup -Identity 'forest_a_group_name' -Server 'forest_a_domain.fqdn.com' -Credential $credential

Add-ADPrincipalGroupMembership -Identity $groupMember -MemberOf $ADGroup -Server 'forest_b_domain_name' -Credential $credential

I then have a larger script wrapped around the core logic above that is called by the Ansible module ansible.windows.win_powershell

To clarify, I did try the module using below which results in The specified account does not exist.

tasks:
  - name: Create AD group and add members
    microsoft.ad.group:
      name: forest_a_group_name
      domain_username: 'user@forest_a_domain.fqdn.com'
      domain_password: forest_a_user_password
      state: present
      scope: domainlocal
      path: forest_a_group_ou_path
      members:
        add:
        - name: forest_b_group_name
          server: forest_b_domain_name

Hope this helps, both to apply a fix and anyone else with the same problem.