[BUG] regression with 3001: runas and onlyif do not work together

[flassman]

Description Using a cmd.run state with powershell commands fails if you use the runas and onlyif options together. It worked with 3000.2 but now fails with 3001

You get the following stacktrace:

 Comment: An exception occurred in this state: Traceback (most recent call last):
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 2118, in call
              ret.update(self._run_check(low))
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 890, in _run_check
              _ret = self._run_check_onlyif(low_data, cmd_opts)
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\state.py", line 950, in _run_check_onlyif
              entry, ignore_retcode=True, python_shell=True, **cmd_opts
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\modules\cmdmod.py", line 2316, in retcode
              **kwargs
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\modules\cmdmod.py", line 424, in _run
              return win_runas(cmd, runas, password, cwd)
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\utils\win_runas.py", line 207, in runas
              environment=env,
            File "c:\salt\bin\lib\site-packages\salt-3001-py3.7.egg\salt\platform\win.py", line 1161, in CreateProcessWithTokenW
              raise exc
          OSError: The operation completed successfully.

Setup

powershell_onlyif:
  cmd.run:
    - name: 'whoami'
    - shell: powershell
    - runas: '{{ pillar['cluster']['username'] }}'
    - password: '{{ pillar['cluster']['password'] | trim }}'
    - onlyif: 'echo True'

Steps to Reproduce the behavior (Include debug logs if possible and relevant)

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Versions Report

salt --versions-report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.) ``` Salt Version: Salt: 3001 Dependency Versions: cffi: 1.12.2 cherrypy: 17.4.1 dateutil: 2.8.0 docker-py: Not Installed gitdb: 2.0.5 gitpython: Not Installed Jinja2: 2.10.1 libgit2: Not Installed M2Crypto: Not Installed Mako: 1.0.7 msgpack-pure: Not Installed msgpack-python: 0.5.6 mysql-python: Not Installed pycparser: 2.19 pycrypto: Not Installed pycryptodome: 3.9.7 pygit2: Not Installed Python: 3.7.4 (tags/v3.7.4:e09359112e, Jul 8 2019, 20:34:20) [MSC v.1916 64 bit (AMD64)] python-gnupg: 0.4.4 PyYAML: 5.1.2 PyZMQ: 18.0.1 smmap: 2.0.5 timelib: 0.2.4 Tornado: 4.5.3 ZMQ: 4.3.1 System Versions: dist: locale: cp1252 machine: AMD64 release: 2019Server system: Windows version: 2019Server 10.0.17763 SP0 ```

Additional context Add any other context about the problem here.

[oeuftete]

ZD-5335.

[oeuftete]

This looks at least related to https://github.com/saltstack/salt/issues/54821. I am able to reproduce this on 3001 with Windows 2012 R2, although with a different error:

OSError: The system could not find the environment option that was entered.

The different error sounds a bit like what a commenter saw in https://github.com/saltstack/salt/issues/54821#issuecomment-536659857.

The workaround suggested in https://github.com/saltstack/salt/issues/54821#issuecomment-629622472 to add cmd.exe /c seems to work here, i.e.:

powershell_onlyif:
  cmd.run:
    - name: 'whoami'
    - shell: powershell
    - runas: '{{ pillar['cluster']['username'] }}'
    - password: '{{ pillar['cluster']['password'] | trim }}'
    - onlyif: 'cmd.exe /c echo True'

I have not tested on 3000 to confirm the failure in the onlyif as a regression.

[mchugh19]

PR #57825 may be related to this issue as well

[arizvisa]

Oh, hmm...curiouser and curiouser. I'm actually getting the same symptom but through a different code path over at #57840 and without the usage of onlyif..just runas.

I was originally thinking that it was introduced by commit 4a9c02078788701db26cf5c58ff82e2c030e8d43, but since salt.modules.cmd was working for y'all in 3000.2, I'll try tomorrow and see if PR #57825 resolves it, or bisect up to that tag at the very least.

[oeuftete]

ZD-5485

[oeuftete]

This could use a re-check to see if it is resolved in 3002.2. If #57825 was the fix, it should be.