mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
netcmd: gmsa: base cli commands for group managed service accounts
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
Rob van der Linde
Andrew Bartlett
parent
14a4f642b4
commit
7b1b7d130b
@ -82,6 +82,7 @@ class cmd_sambatool(SuperCommand):
|
||||
subcommands["user"] = None
|
||||
subcommands["ou"] = None
|
||||
subcommands["processes"] = None
|
||||
subcommands["service-account"] = None
|
||||
subcommands["visualize"] = None
|
||||
|
||||
|
||||
|
||||
41
python/samba/netcmd/service_account/__init__.py
Normal file
41
python/samba/netcmd/service_account/__init__.py
Normal file
@ -0,0 +1,41 @@
|
||||
# Unix SMB/CIFS implementation.
|
||||
#
|
||||
# Service account management.
|
||||
#
|
||||
# Copyright (C) Catalyst.Net Ltd. 2024
|
||||
#
|
||||
# Written by Rob van der Linde <rob@catalyst.net.nz>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from samba.netcmd import SuperCommand
|
||||
|
||||
from .service_account import (cmd_service_account_create,
|
||||
cmd_service_account_delete,
|
||||
cmd_service_account_list,
|
||||
cmd_service_account_modify,
|
||||
cmd_service_account_view)
|
||||
|
||||
|
||||
class cmd_service_account(SuperCommand):
|
||||
"""Service Account and Group Managed Service Account management."""
|
||||
|
||||
subcommands = {
|
||||
"create": cmd_service_account_create(),
|
||||
"delete": cmd_service_account_delete(),
|
||||
"list": cmd_service_account_list(),
|
||||
"view": cmd_service_account_view(),
|
||||
"modify": cmd_service_account_modify(),
|
||||
}
|
||||
219
python/samba/netcmd/service_account/service_account.py
Normal file
219
python/samba/netcmd/service_account/service_account.py
Normal file
@ -0,0 +1,219 @@
|
||||
# Unix SMB/CIFS implementation.
|
||||
#
|
||||
# Manage service accounts and group managed service accounts.
|
||||
#
|
||||
# Copyright (C) Catalyst.Net Ltd. 2024
|
||||
#
|
||||
# Written by Rob van der Linde <rob@catalyst.net.nz>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from samba.getopt import CredentialsOptions, HostOptions, Option, SambaOptions
|
||||
from samba.netcmd import Command, CommandError
|
||||
from samba.netcmd.domain.models import (AccountType, Computer, Group,
|
||||
GroupManagedServiceAccount,
|
||||
SupportedEncryptionTypes, User)
|
||||
from samba.netcmd.domain.models.exceptions import ModelError
|
||||
|
||||
|
||||
class cmd_service_account_list(Command):
|
||||
"""List service accounts."""
|
||||
|
||||
synopsis = "%prog -H <URL> [options]"
|
||||
|
||||
takes_optiongroups = {
|
||||
"sambaopts": SambaOptions,
|
||||
"credopts": CredentialsOptions,
|
||||
"hostopts": HostOptions,
|
||||
}
|
||||
|
||||
takes_options = [
|
||||
Option("--json", help="Output results in JSON format.",
|
||||
dest="output_format", action="store_const", const="json"),
|
||||
]
|
||||
|
||||
def run(self, hostopts=None, sambaopts=None, credopts=None,
|
||||
output_format=None):
|
||||
|
||||
ldb = self.ldb_connect(hostopts, sambaopts, credopts)
|
||||
|
||||
try:
|
||||
accounts = GroupManagedServiceAccount.query(ldb)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
if output_format == "json":
|
||||
self.print_json({account.username: account for account in accounts})
|
||||
else:
|
||||
for account in accounts:
|
||||
print(account.username, file=self.outf)
|
||||
|
||||
|
||||
class cmd_service_account_view(Command):
|
||||
"""View a service account on the domain."""
|
||||
|
||||
synopsis = "%prog -H <URL> [options]"
|
||||
|
||||
takes_optiongroups = {
|
||||
"sambaopts": SambaOptions,
|
||||
"credopts": CredentialsOptions,
|
||||
"hostopts": HostOptions,
|
||||
}
|
||||
|
||||
takes_options = [
|
||||
Option("--name",
|
||||
help="Name of managed service account (required).",
|
||||
dest="name", action="store", type=str, required=True),
|
||||
]
|
||||
|
||||
def run(self, hostopts=None, sambaopts=None, credopts=None, name=None):
|
||||
|
||||
ldb = self.ldb_connect(hostopts, sambaopts, credopts)
|
||||
|
||||
try:
|
||||
account = GroupManagedServiceAccount.find(ldb, name)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
if account is None:
|
||||
raise CommandError(f"Group managed service account {name} not found.")
|
||||
|
||||
self.print_json(account.as_dict())
|
||||
|
||||
|
||||
class cmd_service_account_create(Command):
|
||||
"""Create a new service account."""
|
||||
|
||||
synopsis = "%prog -H <URL> [options]"
|
||||
|
||||
takes_optiongroups = {
|
||||
"sambaopts": SambaOptions,
|
||||
"credopts": CredentialsOptions,
|
||||
"hostopts": HostOptions,
|
||||
}
|
||||
|
||||
takes_options = [
|
||||
Option("--name", help="Name of managed service account (required).",
|
||||
dest="name", action="store", type=str, required=True),
|
||||
Option("--dns-host-name", help="Name of DNS host (required).",
|
||||
dest="dns_host_name", action="store", type=str, required=True),
|
||||
Option("--managed-password-interval",
|
||||
help="Managed password refresh interval in days.",
|
||||
dest="managed_password_interval", action="store", type=int),
|
||||
]
|
||||
|
||||
def run(self, hostopts=None, sambaopts=None, credopts=None, name=None,
|
||||
dns_host_name=None, managed_password_interval=None):
|
||||
|
||||
ldb = self.ldb_connect(hostopts, sambaopts, credopts)
|
||||
|
||||
gmsa = GroupManagedServiceAccount(
|
||||
name=name,
|
||||
managed_password_interval=managed_password_interval,
|
||||
dns_host_name=dns_host_name,
|
||||
)
|
||||
|
||||
# Create group managed service account.
|
||||
try:
|
||||
gmsa.save(ldb)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
print(f"Created group managed service account: {name}", file=self.outf)
|
||||
|
||||
|
||||
class cmd_service_account_modify(Command):
|
||||
"""Modify a managed service account."""
|
||||
|
||||
synopsis = "%prog -H <URL> [options]"
|
||||
|
||||
takes_optiongroups = {
|
||||
"sambaopts": SambaOptions,
|
||||
"credopts": CredentialsOptions,
|
||||
"hostopts": HostOptions,
|
||||
}
|
||||
|
||||
takes_options = [
|
||||
Option("--name", help="Name of managed service account (required).",
|
||||
dest="name", action="store", type=str, required=True),
|
||||
Option("--dns-host-name", help="Update name of DNS host.",
|
||||
dest="dns_host_name", action="store", type=str),
|
||||
Option("--group-msa-membership",
|
||||
help="Update Group MSA Membership field directly (SDDL).",
|
||||
dest="group_msa_membership", action="store", type=str),
|
||||
]
|
||||
|
||||
def run(self, hostopts=None, sambaopts=None, credopts=None, name=None,
|
||||
dns_host_name=None, group_msa_membership=None):
|
||||
|
||||
ldb = self.ldb_connect(hostopts, sambaopts, credopts)
|
||||
|
||||
try:
|
||||
gmsa = GroupManagedServiceAccount.find(ldb, name)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
if gmsa is None:
|
||||
raise CommandError(f"Group managed service account {name} not found.")
|
||||
|
||||
if dns_host_name is not None:
|
||||
gmsa.dns_host_name = dns_host_name
|
||||
|
||||
if group_msa_membership is not None:
|
||||
gmsa.group_msa_membership = group_msa_membership
|
||||
|
||||
# Update group managed service account.
|
||||
try:
|
||||
gmsa.save(ldb)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
print(f"Modified group managed service account: {name}", file=self.outf)
|
||||
|
||||
|
||||
class cmd_service_account_delete(Command):
|
||||
"""Delete a managed service account."""
|
||||
|
||||
synopsis = "%prog -H <URL> [options]"
|
||||
|
||||
takes_optiongroups = {
|
||||
"sambaopts": SambaOptions,
|
||||
"credopts": CredentialsOptions,
|
||||
"hostopts": HostOptions,
|
||||
}
|
||||
|
||||
takes_options = [
|
||||
Option("--name", help="Name of managed service account (required).",
|
||||
dest="name", action="store", type=str, required=True),
|
||||
]
|
||||
|
||||
def run(self, hostopts=None, sambaopts=None, credopts=None, name=None):
|
||||
|
||||
ldb = self.ldb_connect(hostopts, sambaopts, credopts)
|
||||
|
||||
try:
|
||||
account = GroupManagedServiceAccount.find(ldb, name)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
if account is None:
|
||||
raise CommandError(f"Group managed service account {name} not found.")
|
||||
|
||||
try:
|
||||
account.delete(ldb)
|
||||
except ModelError as e:
|
||||
raise CommandError(e)
|
||||
|
||||
print(f"Deleted group managed service account: {name}", file=self.outf)
|
||||
Loading…
Reference in New Issue
Block a user