summaryrefslogtreecommitdiffstats
path: root/source4/scripting/python/samba/netcmd/delegation.py
diff options
context:
space:
mode:
authorJelmer Vernooij <jelmer@samba.org>2012-12-28 15:37:14 +0100
committerAndrew Bartlett <abartlet@samba.org>2013-03-02 03:57:34 +0100
commit87afc3aee1ea593069322a49355dd8780d99e123 (patch)
tree8e1ea6678d93b53f21b34c4940b7d5a64e0f5020 /source4/scripting/python/samba/netcmd/delegation.py
parent80fce353e740c793619005ac102ab07fb5e7d280 (diff)
downloadsamba-87afc3aee1ea593069322a49355dd8780d99e123.tar.gz
samba-87afc3aee1ea593069322a49355dd8780d99e123.tar.xz
samba-87afc3aee1ea593069322a49355dd8780d99e123.zip
Move python modules from source4/scripting/python/ to python/.
Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Mar 2 03:57:34 CET 2013 on sn-devel-104
Diffstat (limited to 'source4/scripting/python/samba/netcmd/delegation.py')
-rw-r--r--source4/scripting/python/samba/netcmd/delegation.py263
1 files changed, 0 insertions, 263 deletions
diff --git a/source4/scripting/python/samba/netcmd/delegation.py b/source4/scripting/python/samba/netcmd/delegation.py
deleted file mode 100644
index 47dffb07d51..00000000000
--- a/source4/scripting/python/samba/netcmd/delegation.py
+++ /dev/null
@@ -1,263 +0,0 @@
-# delegation management
-#
-# Copyright Matthieu Patou mat@samba.org 2010
-# Copyright Stefan Metzmacher metze@samba.org 2011
-# Copyright Bjoern Baumbach bb@sernet.de 2011
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-
-import samba.getopt as options
-import ldb
-from samba import provision
-from samba import dsdb
-from samba.samdb import SamDB
-from samba.auth import system_session
-from samba.netcmd.common import _get_user_realm_domain
-from samba.netcmd import (
- Command,
- CommandError,
- SuperCommand,
- Option
- )
-
-
-class cmd_delegation_show(Command):
- """Show the delegation setting of an account."""
-
- synopsis = "%prog <accountname> [options]"
-
- takes_optiongroups = {
- "sambaopts": options.SambaOptions,
- "credopts": options.CredentialsOptions,
- "versionopts": options.VersionOptions,
- }
-
- takes_args = ["accountname"]
-
- def run(self, accountname, credopts=None, sambaopts=None, versionopts=None):
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
- paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
- sam = SamDB(paths.samdb, session_info=system_session(),
- credentials=creds, lp=lp)
- # TODO once I understand how, use the domain info to naildown
- # to the correct domain
- (cleanedaccount, realm, domain) = _get_user_realm_domain(accountname)
-
- res = sam.search(expression="sAMAccountName=%s" %
- ldb.binary_encode(cleanedaccount),
- scope=ldb.SCOPE_SUBTREE,
- attrs=["userAccountControl", "msDS-AllowedToDelegateTo"])
- if len(res) == 0:
- raise CommandError("Unable to find account name '%s'" % accountname)
- assert(len(res) == 1)
-
- uac = int(res[0].get("userAccountControl")[0])
- allowed = res[0].get("msDS-AllowedToDelegateTo")
-
- self.outf.write("Account-DN: %s\n" % str(res[0].dn))
- self.outf.write("UF_TRUSTED_FOR_DELEGATION: %s\n"
- % bool(uac & dsdb.UF_TRUSTED_FOR_DELEGATION))
- self.outf.write("UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s\n" %
- bool(uac & dsdb.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION))
-
- if allowed is not None:
- for a in allowed:
- self.outf.write("msDS-AllowedToDelegateTo: %s\n" % a)
-
-
-class cmd_delegation_for_any_service(Command):
- """Set/unset UF_TRUSTED_FOR_DELEGATION for an account."""
-
- synopsis = "%prog <accountname> [(on|off)] [options]"
-
- takes_optiongroups = {
- "sambaopts": options.SambaOptions,
- "credopts": options.CredentialsOptions,
- "versionopts": options.VersionOptions,
- }
-
- takes_args = ["accountname", "onoff"]
-
- def run(self, accountname, onoff, credopts=None, sambaopts=None,
- versionopts=None):
-
- on = False
- if onoff == "on":
- on = True
- elif onoff == "off":
- on = False
- else:
- raise CommandError("invalid argument: '%s' (choose from 'on', 'off')" % onoff)
-
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
- paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
- sam = SamDB(paths.samdb, session_info=system_session(),
- credentials=creds, lp=lp)
- # TODO once I understand how, use the domain info to naildown
- # to the correct domain
- (cleanedaccount, realm, domain) = _get_user_realm_domain(accountname)
-
- search_filter = "sAMAccountName=%s" % ldb.binary_encode(cleanedaccount)
- flag = dsdb.UF_TRUSTED_FOR_DELEGATION
- try:
- sam.toggle_userAccountFlags(search_filter, flag,
- flags_str="Trusted-for-Delegation",
- on=on, strict=True)
- except Exception, err:
- raise CommandError(err)
-
-
-class cmd_delegation_for_any_protocol(Command):
- """Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account."""
-
- synopsis = "%prog <accountname> [(on|off)] [options]"
-
- takes_optiongroups = {
- "sambaopts": options.SambaOptions,
- "credopts": options.CredentialsOptions,
- "versionopts": options.VersionOptions,
- }
-
- takes_args = ["accountname", "onoff"]
-
- def run(self, accountname, onoff, credopts=None, sambaopts=None,
- versionopts=None):
-
- on = False
- if onoff == "on":
- on = True
- elif onoff == "off":
- on = False
- else:
- raise CommandError("invalid argument: '%s' (choose from 'on', 'off')" % onoff)
-
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
- paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
- sam = SamDB(paths.samdb, session_info=system_session(),
- credentials=creds, lp=lp)
- # TODO once I understand how, use the domain info to naildown
- # to the correct domain
- (cleanedaccount, realm, domain) = _get_user_realm_domain(accountname)
-
- search_filter = "sAMAccountName=%s" % ldb.binary_encode(cleanedaccount)
- flag = dsdb.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
- try:
- sam.toggle_userAccountFlags(search_filter, flag,
- flags_str="Trusted-to-Authenticate-for-Delegation",
- on=on, strict=True)
- except Exception, err:
- raise CommandError(err)
-
-
-class cmd_delegation_add_service(Command):
- """Add a service principal as msDS-AllowedToDelegateTo."""
-
- synopsis = "%prog <accountname> <principal> [options]"
-
- takes_optiongroups = {
- "sambaopts": options.SambaOptions,
- "credopts": options.CredentialsOptions,
- "versionopts": options.VersionOptions,
- }
-
- takes_args = ["accountname", "principal"]
-
- def run(self, accountname, principal, credopts=None, sambaopts=None,
- versionopts=None):
-
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
- paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
- sam = SamDB(paths.samdb, session_info=system_session(),
- credentials=creds, lp=lp)
- # TODO once I understand how, use the domain info to naildown
- # to the correct domain
- (cleanedaccount, realm, domain) = _get_user_realm_domain(accountname)
-
- res = sam.search(expression="sAMAccountName=%s" %
- ldb.binary_encode(cleanedaccount),
- scope=ldb.SCOPE_SUBTREE,
- attrs=["msDS-AllowedToDelegateTo"])
- if len(res) == 0:
- raise CommandError("Unable to find account name '%s'" % accountname)
- assert(len(res) == 1)
-
- msg = ldb.Message()
- msg.dn = res[0].dn
- msg["msDS-AllowedToDelegateTo"] = ldb.MessageElement([principal],
- ldb.FLAG_MOD_ADD,
- "msDS-AllowedToDelegateTo")
- try:
- sam.modify(msg)
- except Exception, err:
- raise CommandError(err)
-
-
-class cmd_delegation_del_service(Command):
- """Delete a service principal as msDS-AllowedToDelegateTo."""
-
- synopsis = "%prog <accountname> <principal> [options]"
-
- takes_optiongroups = {
- "sambaopts": options.SambaOptions,
- "credopts": options.CredentialsOptions,
- "versionopts": options.VersionOptions,
- }
-
- takes_args = ["accountname", "principal"]
-
- def run(self, accountname, principal, credopts=None, sambaopts=None,
- versionopts=None):
-
- lp = sambaopts.get_loadparm()
- creds = credopts.get_credentials(lp)
- paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
- sam = SamDB(paths.samdb, session_info=system_session(),
- credentials=creds, lp=lp)
- # TODO once I understand how, use the domain info to naildown
- # to the correct domain
- (cleanedaccount, realm, domain) = _get_user_realm_domain(accountname)
-
- res = sam.search(expression="sAMAccountName=%s" %
- ldb.binary_encode(cleanedaccount),
- scope=ldb.SCOPE_SUBTREE,
- attrs=["msDS-AllowedToDelegateTo"])
- if len(res) == 0:
- raise CommandError("Unable to find account name '%s'" % accountname)
- assert(len(res) == 1)
-
- msg = ldb.Message()
- msg.dn = res[0].dn
- msg["msDS-AllowedToDelegateTo"] = ldb.MessageElement([principal],
- ldb.FLAG_MOD_DELETE,
- "msDS-AllowedToDelegateTo")
- try:
- sam.modify(msg)
- except Exception, err:
- raise CommandError(err)
-
-
-class cmd_delegation(SuperCommand):
- """Delegation management."""
-
- subcommands = {}
- subcommands["show"] = cmd_delegation_show()
- subcommands["for-any-service"] = cmd_delegation_for_any_service()
- subcommands["for-any-protocol"] = cmd_delegation_for_any_protocol()
- subcommands["add-service"] = cmd_delegation_add_service()
- subcommands["del-service"] = cmd_delegation_del_service()