puppet 4.3.0 → 4.4.0

data/lib/puppet/util/windows/security.rb

@@ -41,7 +41,7 @@
 #   must be running with elevated privileges.
 # * A file/dir can be deleted by anyone with the DELETE access right
 #   OR by anyone that has the FILE_DELETE_CHILD access right for the
-#   parent. See http://support.microsoft.com/kb/238018. But on Unix,
+#   parent. See https://support.microsoft.com/kb/238018. But on Unix,
 #   the user must have write access to the file/dir AND execute access
 #   to all of the parent path components.
 # * Many access control entries are inherited from parent directories,
@@ -65,8 +65,6 @@ require 'puppet/util/windows'
 require 'pathname'
 require 'ffi'
 
-require 'win32/security'
-
 module Puppet::Util::Windows::Security
   include Puppet::Util::Windows::String
 
@@ -199,9 +197,9 @@ module Puppet::Util::Windows::Security
   def get_mode(path)
     return unless supports_acl?(path)
 
-    well_known_world_sid = Win32::Security::SID::Everyone
-    well_known_nobody_sid = Win32::Security::SID::Nobody
-    well_known_system_sid = Win32::Security::SID::LocalSystem
+    well_known_world_sid = Puppet::Util::Windows::SID::Everyone
+    well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
+    well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     mode = S_ISYSTEM_MISSING
 
@@ -278,9 +276,9 @@ module Puppet::Util::Windows::Security
   # that they do not have read and write access to.
   def set_mode(mode, path, protected = true)
     sd = get_security_descriptor(path)
-    well_known_world_sid = Win32::Security::SID::Everyone
-    well_known_nobody_sid = Win32::Security::SID::Nobody
-    well_known_system_sid = Win32::Security::SID::LocalSystem
+    well_known_world_sid = Puppet::Util::Windows::SID::Everyone
+    well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
+    well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     owner_allow = FILE::STANDARD_RIGHTS_ALL  |
       FILE::FILE_READ_ATTRIBUTES |
@@ -361,12 +359,12 @@ module Puppet::Util::Windows::Security
     inherit_only = Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
     if isdir
       inherit = inherit_only | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
-      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow, inherit)
-      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow, inherit)
 
       inherit = inherit_only | Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
-      dacl.allow(Win32::Security::SID::CreatorOwner, owner_allow & ~FILE::FILE_EXECUTE, inherit)
-      dacl.allow(Win32::Security::SID::CreatorGroup, group_allow & ~FILE::FILE_EXECUTE, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow & ~FILE::FILE_EXECUTE, inherit)
+      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow & ~FILE::FILE_EXECUTE, inherit)
     end
 
     new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)
@@ -579,7 +577,7 @@ module Puppet::Util::Windows::Security
   end
 
   def get_max_generic_acl_size(ace_count)
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
     # To calculate the initial size of an ACL, add the following together, and then align the result to the nearest DWORD:
     # * Size of the ACL structure.
     # * Size of each ACE structure that the ACL is to contain minus the SidStart member (DWORD) of the ACE.
@@ -643,7 +641,7 @@ module Puppet::Util::Windows::Security
 
   ffi_convention :stdcall
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
   # HANDLE WINAPI CreateFile(
   #   _In_      LPCTSTR lpFileName,
   #   _In_      DWORD dwDesiredAccess,
@@ -657,7 +655,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :CreateFileW,
     [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
   # BOOL WINAPI GetVolumeInformation(
   #   _In_opt_   LPCTSTR lpRootPathName,
   #   _Out_opt_  LPTSTR lpVolumeNameBuffer,
@@ -672,7 +670,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetVolumeInformationW,
     [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
   # BOOL WINAPI AddAccessAllowedAceEx(
   #   _Inout_  PACL pAcl,
   #   _In_     DWORD dwAceRevision,
@@ -684,7 +682,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :AddAccessAllowedAceEx,
     [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
   # BOOL WINAPI AddAccessDeniedAceEx(
   #   _Inout_  PACL pAcl,
   #   _In_     DWORD dwAceRevision,
@@ -696,7 +694,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :AddAccessDeniedAceEx,
     [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
   # typedef struct _ACL {
   #   BYTE AclRevision;
   #   BYTE Sbz1;
@@ -712,9 +710,9 @@ module Puppet::Util::Windows::Security
            :Sbz2, :word
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374912(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374912(v=vs.85).aspx
   # ACE types
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374919(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374919(v=vs.85).aspx
   # typedef struct _ACE_HEADER {
   #   BYTE AceType;
   #   BYTE AceFlags;
@@ -726,17 +724,17 @@ module Puppet::Util::Windows::Security
            :AceSize,  :word
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
   # ACCESS_MASK
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374847(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374847(v=vs.85).aspx
   # typedef struct _ACCESS_ALLOWED_ACE {
   #   ACE_HEADER  Header;
   #   ACCESS_MASK Mask;
   #   DWORD       SidStart;
   # } ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
   #
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa374879(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374879(v=vs.85).aspx
   # typedef struct _ACCESS_DENIED_ACE {
   #   ACE_HEADER  Header;
   #   ACCESS_MASK Mask;
@@ -751,12 +749,12 @@ module Puppet::Util::Windows::Security
            :SidStart, :dword
   end
 
-  # http://stackoverflow.com/a/1792930
+  # https://stackoverflow.com/a/1792930
   MAXIMUM_SID_BYTES_LENGTH = 68
   MAXIMUM_GENERIC_ACE_SIZE = GENERIC_ACCESS_ACE.offset_of(:SidStart) +
     MAXIMUM_SID_BYTES_LENGTH
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
   # BOOL WINAPI GetAce(
   #   _In_   PACL pAcl,
   #   _In_   DWORD dwAceIndex,
@@ -766,7 +764,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetAce,
     [:pointer, :dword, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
   # BOOL WINAPI AdjustTokenPrivileges(
   #   _In_       HANDLE TokenHandle,
   #   _In_       BOOL DisableAllPrivileges,
@@ -779,9 +777,9 @@ module Puppet::Util::Windows::Security
   attach_function_private :AdjustTokenPrivileges,
     [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446647(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446647(v=vs.85).aspx
   # typedef WORD SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;
   # BOOL WINAPI GetSecurityDescriptorControl(
   #   _In_   PSECURITY_DESCRIPTOR pSecurityDescriptor,
@@ -792,7 +790,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetSecurityDescriptorControl,
     [:pointer, :lpword, :lpdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
   # BOOL WINAPI InitializeAcl(
   #   _Out_  PACL pAcl,
   #   _In_   DWORD nAclLength,
@@ -802,7 +800,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :InitializeAcl,
     [:pointer, :dword, :dword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
   # BOOL WINAPI IsValidAcl(
   #   _In_  PACL pAcl
   # );
@@ -810,7 +808,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :IsValidAcl,
     [:pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
   SE_OBJECT_TYPE = enum(
     :SE_UNKNOWN_OBJECT_TYPE, 0,
     :SE_FILE_OBJECT,
@@ -827,7 +825,7 @@ module Puppet::Util::Windows::Security
     :SE_REGISTRY_WOW64_32KEY
   )
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446654(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446654(v=vs.85).aspx
   # DWORD WINAPI GetSecurityInfo(
   #   _In_       HANDLE handle,
   #   _In_       SE_OBJECT_TYPE ObjectType,
@@ -842,7 +840,7 @@ module Puppet::Util::Windows::Security
   attach_function_private :GetSecurityInfo,
     [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
   # DWORD WINAPI SetSecurityInfo(
   #   _In_      HANDLE handle,
   #   _In_      SE_OBJECT_TYPE ObjectType,

data/lib/puppet/util/windows/security_descriptor.rb

@@ -5,7 +5,7 @@
 # flags, DACL, and SACL. The SACL is not currently supported, though it has the
 # same layout as a DACL.
 #
-# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa379563(v=vs.85).aspx
+# @see https://msdn.microsoft.com/en-us/library/windows/desktop/aa379563(v=vs.85).aspx
 # @api private
 class Puppet::Util::Windows::SecurityDescriptor
   require 'puppet/util/windows/security'

data/lib/puppet/util/windows/sid.rb

@@ -9,6 +9,44 @@ module Puppet::Util::Windows
     ERROR_NONE_MAPPED           = 1332
     ERROR_INVALID_SID_STRUCTURE = 1337
 
+    # Well Known SIDs
+    Null                        = 'S-1-0'
+    Nobody                      = 'S-1-0-0'
+    World                       = 'S-1-1'
+    Everyone                    = 'S-1-1-0'
+    Local                       = 'S-1-2'
+    Creator                     = 'S-1-3'
+    CreatorOwner                = 'S-1-3-0'
+    CreatorGroup                = 'S-1-3-1'
+    CreatorOwnerServer          = 'S-1-3-2'
+    CreatorGroupServer          = 'S-1-3-3'
+    NonUnique                   = 'S-1-4'
+    Nt                          = 'S-1-5'
+    Dialup                      = 'S-1-5-1'
+    Network                     = 'S-1-5-2'
+    Batch                       = 'S-1-5-3'
+    Interactive                 = 'S-1-5-4'
+    Service                     = 'S-1-5-6'
+    Anonymous                   = 'S-1-5-7'
+    Proxy                       = 'S-1-5-8'
+    EnterpriseDomainControllers = 'S-1-5-9'
+    PrincipalSelf               = 'S-1-5-10'
+    AuthenticatedUsers          = 'S-1-5-11'
+    RestrictedCode              = 'S-1-5-12'
+    TerminalServerUsers         = 'S-1-5-13'
+    LocalSystem                 = 'S-1-5-18'
+    NtLocal                     = 'S-1-5-19'
+    NtNetwork                   = 'S-1-5-20'
+    BuiltinAdministrators       = 'S-1-5-32-544'
+    BuiltinUsers                = 'S-1-5-32-545'
+    Guests                      = 'S-1-5-32-546'
+    PowerUsers                  = 'S-1-5-32-547'
+    AccountOperators            = 'S-1-5-32-548'
+    ServerOperators             = 'S-1-5-32-549'
+    PrintOperators              = 'S-1-5-32-550'
+    BackupOperators             = 'S-1-5-32-551'
+    Replicators                 = 'S-1-5-32-552'
+
     # Convert an account name, e.g. 'Administrators' into a SID string,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
@@ -16,7 +54,7 @@ module Puppet::Util::Windows
     def name_to_sid(name)
       sid = name_to_sid_object(name)
 
-      sid ? sid.to_s : nil
+      sid ? sid.sid : nil
     end
     module_function :name_to_sid
 
@@ -24,14 +62,22 @@ module Puppet::Util::Windows
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
+    # This method returns a SID::Principal with the account, domain, SID, etc
     def name_to_sid_object(name)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
-      # if it's in SID string form, convert to user
-      parsed_sid = Win32::Security::SID.string_to_sid(name) rescue nil
+      # if name is a SID string, convert it to raw bytes for use with lookup_account_sid
+      raw_sid_bytes = nil
+      begin
+        string_to_sid_ptr(name) do |sid_ptr|
+          valid = ! sid_ptr.nil? && ! sid_ptr.null?
+          raw_sid_bytes = sid_ptr.read_array_of_uchar(get_length_sid(sid_ptr))
+        end
+      rescue
+      end
 
-      parsed_sid ? Win32::Security::SID.new(parsed_sid) : Win32::Security::SID.new(name)
+      raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
     rescue
       nil
     end
@@ -41,12 +87,13 @@ module Puppet::Util::Windows
     # e.g. [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] is the representation for
     # S-1-5-18, the local 'SYSTEM' account.
     # Raises an Error for nil or non-array input.
+    # This method returns a SID::Principal with the account, domain, SID, etc
     def octet_string_to_sid_object(bytes)
       if !bytes || !bytes.respond_to?('pack') || bytes.empty?
         raise Puppet::Util::Windows::Error.new("Octet string must be an array of bytes")
       end
 
-      Win32::Security::SID.new(bytes.pack('C*'))
+      Principal.lookup_account_sid(bytes)
     end
     module_function :octet_string_to_sid_object
 
@@ -54,24 +101,29 @@ module Puppet::Util::Windows
     # e.g. 'BUILTIN\Administrators'. Returns nil if an account
     # for that SID does not exist.
     def sid_to_name(value)
-      sid = Win32::Security::SID.new(Win32::Security::SID.string_to_sid(value))
 
-      if sid.domain and sid.domain.length > 0
-        "#{sid.domain}\\#{sid.account}"
-      else
-        sid.account
+      sid_bytes = []
+      begin
+        string_to_sid_ptr(value) do |ptr|
+          valid = ! ptr.nil? && ! ptr.null?
+          sid_bytes = ptr.read_array_of_uchar(get_length_sid(ptr))
+        end
+      rescue Puppet::Util::Windows::Error => e
+        raise if e.code != ERROR_INVALID_SID_STRUCTURE
       end
+
+      Principal.lookup_account_sid(sid_bytes).domain_account
     rescue
       nil
     end
     module_function :sid_to_name
 
-    # http://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
+    # https://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
     MAXIMUM_SID_STRING_LENGTH = 184
 
     # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
     def sid_ptr_to_string(psid)
-      if ! psid.instance_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
+      if ! psid.kind_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new("Invalid SID")
       end
 
@@ -131,9 +183,19 @@ module Puppet::Util::Windows
     end
     module_function :valid_sid?
 
+    def get_length_sid(sid_ptr)
+      # MSDN states IsValidSid should be called on pointer first
+      if ! sid_ptr.kind_of?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
+        raise Puppet::Util::Windows::Error.new("Invalid SID")
+      end
+
+      GetLengthSid(sid_ptr)
+    end
+    module_function :get_length_sid
+
     ffi_convention :stdcall
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
     # BOOL WINAPI IsValidSid(
     #   _In_  PSID pSid
     # );
@@ -141,7 +203,7 @@ module Puppet::Util::Windows
     attach_function_private :IsValidSid,
       [:pointer], :win32_bool
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376399(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376399(v=vs.85).aspx
     # BOOL ConvertSidToStringSid(
     #   _In_   PSID Sid,
     #   _Out_  LPTSTR *StringSid
@@ -150,7 +212,7 @@ module Puppet::Util::Windows
     attach_function_private :ConvertSidToStringSidW,
       [:pointer, :pointer], :win32_bool
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376402(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376402(v=vs.85).aspx
     # BOOL WINAPI ConvertStringSidToSid(
     #   _In_   LPCTSTR StringSid,
     #   _Out_  PSID *Sid
@@ -158,5 +220,12 @@ module Puppet::Util::Windows
     ffi_lib :advapi32
     attach_function_private :ConvertStringSidToSidW,
       [:lpcwstr, :pointer], :win32_bool
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446642(v=vs.85).aspx
+    # DWORD WINAPI GetLengthSid(
+    #   _In_ PSID pSid
+    # );
+    ffi_lib :advapi32
+    attach_function_private :GetLengthSid, [:pointer], :dword
   end
 end

data/lib/puppet/util/windows/taskscheduler.rb

@@ -84,7 +84,7 @@ module Win32
     SCHED_S_TASK_HAS_NOT_RUN              = 0x00041303
     SCHED_S_TASK_NOT_SCHEDULED            = 0x00041305
     # HRESULT error codes
-    # http://blogs.msdn.com/b/eldar/archive/2007/04/03/a-lot-of-hresult-codes.aspx
+    # https://blogs.msdn.com/b/eldar/archive/2007/04/03/a-lot-of-hresult-codes.aspx
     # in Ruby, an 0x8XXXXXXX style HRESULT can be resolved to 2s complement
     # by using "0x8XXXXXXX".to_i(16) - - 0x100000000
     SCHED_E_ACCOUNT_INFORMATION_NOT_SET   = -2147216625 # 0x8004130F
@@ -1002,7 +1002,7 @@ module Win32
 
       public
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381811(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381811(v=vs.85).aspx
       ITaskScheduler = com::Interface[com::IUnknown,
         FFI::WIN32::GUID['148BD527-A2AB-11CE-B11F-00AA00530503'],
 
@@ -1025,7 +1025,7 @@ module Win32
       TaskScheduler = com::Factory[ITaskScheduler,
         FFI::WIN32::GUID['148BD52A-A2AB-11CE-B11F-00AA00530503']]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa380706(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa380706(v=vs.85).aspx
       IEnumWorkItems = com::Interface[com::IUnknown,
         FFI::WIN32::GUID['148BD528-A2AB-11CE-B11F-00AA00530503'],
 
@@ -1039,7 +1039,7 @@ module Win32
 
       EnumWorkItems = com::Instance[IEnumWorkItems]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381216(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381216(v=vs.85).aspx
       IScheduledWorkItem = com::Interface[com::IUnknown,
         FFI::WIN32::GUID['a6b952f0-a4b1-11d0-997d-00aa006887ec'],
 
@@ -1091,7 +1091,7 @@ module Win32
         GetAccountInformation: [[:pointer], :hresult]
       ]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381311(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381311(v=vs.85).aspx
       ITask = com::Interface[IScheduledWorkItem,
         FFI::WIN32::GUID['148BD524-A2AB-11CE-B11F-00AA00530503'],
 
@@ -1117,14 +1117,14 @@ module Win32
 
       Task = com::Instance[ITask]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/ms688695(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms688695(v=vs.85).aspx
       IPersist = com::Interface[com::IUnknown,
         FFI::WIN32::GUID['0000010c-0000-0000-c000-000000000046'],
         # CLSID *
         GetClassID: [[:pointer], :hresult]
       ]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/ms687223(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms687223(v=vs.85).aspx
       IPersistFile = com::Interface[IPersist,
         FFI::WIN32::GUID['0000010b-0000-0000-C000-000000000046'],
 
@@ -1138,7 +1138,7 @@ module Win32
 
       PersistFile = com::Instance[IPersistFile]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381864(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381864(v=vs.85).aspx
       ITaskTrigger = com::Interface[com::IUnknown,
         FFI::WIN32::GUID['148BD52B-A2AB-11CE-B11F-00AA00530503'],
 
@@ -1149,7 +1149,7 @@ module Win32
 
       TaskTrigger = com::Instance[ITaskTrigger]
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa383620(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa383620(v=vs.85).aspx
       # The TASK_TRIGGER_TYPE field of the TASK_TRIGGER structure determines
       # which member of the TRIGGER_TYPE_UNION field to use.
       TASK_TRIGGER_TYPE = enum(
@@ -1163,31 +1163,31 @@ module Win32
         :TASK_EVENT_TRIGGER_AT_LOGON, 7         # Ignore the Type field
       )
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446857(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446857(v=vs.85).aspx
       class DAILY < FFI::Struct
         layout :DaysInterval, :word
       end
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa384014(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa384014(v=vs.85).aspx
       class WEEKLY < FFI::Struct
         layout :WeeksInterval, :word,
                :rgfDaysOfTheWeek, :word
       end
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381918(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381918(v=vs.85).aspx
       class MONTHLYDATE < FFI::Struct
         layout :rgfDays, :dword,
                :rgfMonths, :word
       end
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa381918(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa381918(v=vs.85).aspx
       class MONTHLYDOW < FFI::Struct
         layout :wWhichWeek, :word,
                :rgfDaysOfTheWeek, :word,
                :rgfMonths, :word
       end
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa384002(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa384002(v=vs.85).aspx
       class TRIGGER_TYPE_UNION < FFI::Union
         layout :Daily, DAILY,
                :Weekly, WEEKLY,
@@ -1195,7 +1195,7 @@ module Win32
                :MonthlyDOW, MONTHLYDOW
       end
 
-      # http://msdn.microsoft.com/en-us/library/windows/desktop/aa383618(v=vs.85).aspx
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa383618(v=vs.85).aspx
       class TASK_TRIGGER < FFI::Struct
         layout :cbTriggerSize, :word,            # Structure size.
                :Reserved1, :word,                # Reserved. Must be zero.

data/lib/puppet/util/windows/user.rb

@@ -19,7 +19,7 @@ module Puppet::Util::Windows::User
   module_function :admin?
 
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
   SECURITY_MAX_SID_SIZE = 68
 
   def check_token_membership
@@ -43,7 +43,7 @@ module Puppet::Util::Windows::User
         end
 
         # Is administrators SID enabled in calling thread's access token?
-        is_admin = ismember_pointer.read_win32_bool != FFI::WIN32_FALSE
+        is_admin = ismember_pointer.read_win32_bool
       end
     end
 
@@ -106,7 +106,7 @@ module Puppet::Util::Windows::User
 
   ffi_convention :stdcall
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
   # BOOL LogonUser(
   #   _In_      LPTSTR lpszUsername,
   #   _In_opt_  LPTSTR lpszDomain,
@@ -119,7 +119,7 @@ module Puppet::Util::Windows::User
   attach_function_private :LogonUserW,
     [:lpwstr, :lpwstr, :lpwstr, :dword, :dword, :phandle], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/bb773378(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb773378(v=vs.85).aspx
   # typedef struct _PROFILEINFO {
   #   DWORD  dwSize;
   #   DWORD  dwFlags;
@@ -143,7 +143,7 @@ module Puppet::Util::Windows::User
            :hProfile, :handle
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/bb762281(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb762281(v=vs.85).aspx
   # BOOL WINAPI LoadUserProfile(
   #   _In_     HANDLE hToken,
   #   _Inout_  LPPROFILEINFO lpProfileInfo
@@ -152,7 +152,7 @@ module Puppet::Util::Windows::User
   attach_function_private :LoadUserProfileW,
     [:handle, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/bb762282(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb762282(v=vs.85).aspx
   # BOOL WINAPI UnloadUserProfile(
   #   _In_  HANDLE hToken,
   #   _In_  HANDLE hProfile
@@ -161,7 +161,7 @@ module Puppet::Util::Windows::User
   attach_function_private :UnloadUserProfile,
     [:handle, :handle], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376389(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376389(v=vs.85).aspx
   # BOOL WINAPI CheckTokenMembership(
   #   _In_opt_  HANDLE TokenHandle,
   #   _In_      PSID SidToCheck,
@@ -171,7 +171,7 @@ module Puppet::Util::Windows::User
   attach_function_private :CheckTokenMembership,
     [:handle, :pointer, :pbool], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379650(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379650(v=vs.85).aspx
   WELL_KNOWN_SID_TYPE = enum(
     :WinNullSid                                   , 0,
     :WinWorldSid                                  , 1,
@@ -270,7 +270,7 @@ module Puppet::Util::Windows::User
     :WinCapabilityRemovableStorageSid             , 94
   )
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446585(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446585(v=vs.85).aspx
   # BOOL WINAPI CreateWellKnownSid(
   #   _In_       WELL_KNOWN_SID_TYPE WellKnownSidType,
   #   _In_opt_   PSID DomainSid,
@@ -281,7 +281,7 @@ module Puppet::Util::Windows::User
   attach_function_private :CreateWellKnownSid,
     [WELL_KNOWN_SID_TYPE, :pointer, :pointer, :lpdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
   # BOOL WINAPI IsValidSid(
   #   _In_  PSID pSid
   # );

data/lib/puppet/util/windows.rb

@@ -6,6 +6,9 @@ module Puppet::Util::Windows
   end
   module Registry
   end
+  module SID
+    class Principal; end
+  end
 
   if Puppet::Util::Platform.windows?
     # these reference platform specific gems
@@ -14,6 +17,7 @@ module Puppet::Util::Windows
     require 'puppet/util/windows/error'
     require 'puppet/util/windows/com'
     require 'puppet/util/windows/sid'
+    require 'puppet/util/windows/principal'
     require 'puppet/util/windows/file'
     require 'puppet/util/windows/security'
     require 'puppet/util/windows/user'