ADManagedServiceAccount: Optionally accept an array of SPNs and also support for TrustedForDelegation

[rismoney]

Problem description

Assuming a very large number of Managed Service Account management, it is not performant to manage their SPNs and TrustedForDelegation setting independently.

There already is a separate resource for Service Principal Names, but it would be very helpful to add the ability to set the SPN attribute for the AD Managed Service Account via the MSFT_ADManagedServiceAccount directly. Also the AD User supports TrustedForDelegation.

Verbose logs

n/a

DSC configuration

n/a

Suggested solution

        ADManagedServiceAccount 'ExampleStandaloneMSA'
        {
            Ensure             = 'Present'
            ServiceAccountName = 'Service01'
            AccountType        = 'Standalone'
           **ServicePrincipalNames = @('MSSQLSvc/sqlalias.contoso.com:1433','MSSQLSvc/hostname.contoso.com:1433')
           TrustedForDelegation = $true**
        }

Operating system the target node is running

Win2022

PowerShell version and build the target node is running

5.x Win2022

ActiveDirectoryDsc version

ActiveDirectoryDsc 6.2.0

[stale]

This issue has been automatically marked as stale because it has not had activity from the community in the last 30 days. It will be closed if no further activity occurs within 10 days. If the issue is labelled with any of the work labels (e.g bug, enhancement, documentation, or tests) then the issue will not auto-close.

[johlju]

What would the consequence be if we remove ADServicePrincipalName altogether in favor of this suggestion? I think that would be the goal if we should go with this change.

I guess ADManagedServiceAccount need the properties:

• ServicePrincipalNameToAdd - will add specified SPNs without affecting any existing
• ServicePrincipalNameToRemove - will remove SPNs without affecting any non-specifed that is also set
• ServicePrincipalName - will forcibly set exactly those specified, removing any other that is set.

[rismoney]

ADServicePrincipalName can apply to any type of account, so I am not sure you'd want to remove it [or deprecate it for existing users] if it already works and is in use.

I don't have the bandwidth to code up/testthe changes, but would love it the functionality you describe could be implemented by someone...