1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Commit Graph

4764 Commits

Author SHA1 Message Date
Jule Anger
055b4cd50f samba-tool: add "samba-tool user list --locked-only"
Signed-off-by: Jule Anger <janger@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-12 09:49:31 +00:00
Andrew Bartlett
d73c92a35d dsdb: Remove calls to ldb.set_opaque_integer()
This routine will shortly be removed, it is now replaced by an
improved ldb.set_opaque()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-05 02:54:36 +00:00
Andrew Bartlett
b42043897a python/samba/provision: Ensure KDS root key is usable as soon as provision is complete
We do this by setting the start time to being 10 hours 5min earlier
than now.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-05 02:54:36 +00:00
Andrew Bartlett
fb219d545b selftest: Assert that the provision KDS root key is already valid for use
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-05 02:54:36 +00:00
Douglas Bagnall
9b0330ea3f pytest:samba-tool domain kds root-key: test with normal user
It would be bad if samba-tool let ordinary users read root-key secrets.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar  4 03:20:46 UTC 2024 on atb-devel-224
2024-03-04 03:20:46 +00:00
Douglas Bagnall
ccfa16e2ec samba-tool: tidy up uncaught insufficient rights LdbError
It is likely that many sub-commands will produce a traceback when people
go `-H ldap://server -Ubob` when they needed to go `-UAdministrator`.

We can catch these and show only the core message.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-04 02:16:33 +00:00
Andrew Bartlett
757036cefe pyldb: Remove unused and broken Python access to LDB module API
These exposed the private LDB modules API to python, and was
untested and broken since LDB was made async internally as
it never called ldb_wait() on the result.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-03 22:33:35 +00:00
Rob van der Linde
cabe817f63 netcmd: models: Create ClaimType in the model layer instead
Having it inside a command isn't very re-usable.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar  1 05:52:53 UTC 2024 on atb-devel-224
2024-03-01 05:52:53 +00:00
Rob van der Linde
09aa259788 netcmd: models: ClaimType: move all dunder methods to the top for consistency
It's nice to consistently list the __str__ method first and all the dunder methods, then the static methods, then the rest.

At least for the models.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
2d7cbba23e netcmd: claims: tidy up, avoid setting enabled twice
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
0509844347 netcmd: models: rename lookup methods to find for consistency
There are a mixture of methods called either 'lookup' or 'find'.

This dates back to when they raised LookupError, but these now raise NotFound.

They should be all called 'find' for consistency.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
076bc6ee1d netcmd: models: Rename username to account_name for consistency
When creating the User model initially, "username" was the only field that was inconsistently named, it maps to "sAMAccountName".

It should really have been account "account_name".

There is also a field "account_type" and should be similarly named to "account_name".

Basically the naming of fields should always be consistent, breaking the rule for one field only was a mistake.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
e70b875139 netcmd: models: Add optional base_dn argument to Model.query method
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
d961aacdf2 netcmd: models: Add Person and OrganizationalPerson
Move only those fields over that we already had on User that actually belong on Person and OrganizationalPerson

There are more fields to add later.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
7a4dc03521 netcmd: models: Add a repr method to Query for help in the shell
This means in the shell you can just do User.query(samdb) without having to wrap it in list() all the time.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
3d36707908 netcmd: models: Rename method to Query._from_message for consistency
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
a1345442cc netcmd: models: Model.from_message should be internal
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
993b6da2db netcmd: silos: silo and auth policy commands use Query class better
Since the introduction of the Query class these can be written to be a lot clearer using models.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
9238afc16c netcmd: silos: silo and auth policy commands use print
This adds more consistency with newer code added after these commands.

But also print seems more flexible and requires no newline characters added constantly which ends up being a bit cleaner.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
983f04e1aa netcmd: models: move remove trustee code to the GMSA model
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
2456fa71bd netcmd: models: move add trustee code to the GMSA model
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
85ca9e7cba netcmd: tests: add tests for service-account commands
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
a7a35ae5e3 netcmd: gmsa: cli commands for managing group msa membership
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
7b1b7d130b netcmd: gmsa: base cli commands for group managed service accounts
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
14a4f642b4 python: models: Computer constructor automatically adds "$" to account name
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
87c8e578de selftest: aces: fix mutable default args in assemble_ace
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
1093f4b6b1 selftest: aces: use constant from samba.security
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
62e11cfa8a python: sd_utils: pep8 import sorting
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
0127ddd7e2 python: sd_utils: remove redundant brackets around simple assert statements
Ideally these should be exceptions not asserts

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
1afb6465b8 python: sd_utils: pep8 fix spacing around
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
63d9b27908 netcmd: properly show command name in show help
This comes up if a user ends up typing something wrong, and it incorrectly showed only part of the command under Usage:

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
120bf34c69 netcmd: add newline before epilog so there is a space between
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
982ebebfbe netcmd: models: model __json__ method should call as_dict instead
The comment about RelatedField is not really relevant so removed that part, RelatedField isn't used at this point.

The idea with RelatedField is that it fetches the object (vs DnField which just returns a Dn).

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
181764a5d6 netcmd: models: setting kwarg to None should use field default
This comes up when trying to create a GroupManagedServiceAccount and setting the value of managed_password_interval to None.

We still want it to pick up the field default of 30 in this case.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
ca973caa28 netcmd: models: Model.query adds optional polymorphic flag for returning specific class types
This defaults to False, query the User class returns only User instances.

    User.query(samdb)

When set to True, query the User class can return User, Computer, ManagedServiceAccount instances.

    User.query(samdb, polymorphic=True)

If polymorphic is False the same records are still returned but records will always be interpreted as the model that is being queried only, rather than a more specific model that matches that object class.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
ccce7e7c03 netcmd: models: ModelMeta needs to also set fields and meta if class is Model
This is needed for polymorphic query, if querying from the Base model, which was not previously a feature.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
5870035486 netcmd: models: move object_sid field from User to base Model
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
f54cfbea90 netcmd: models: bring Model class forward into module
This is important for polymorphic query support

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
f8b5f7f592 netcmd: models: ModelMeta no longer needs to inherit from ABCMeta
There are no more abstract methods since the previous commit, so ABCMeta is no longer needed.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
f90e09a285 netcmd: models: Model.get_object_class returns top instead of None
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
b3cc3ade43 netcmd: models: Query.first and Query.last should use count from instance
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
e41114ad5b netcmd: models: set the default for managed password interval on the model
This is to avoid having to provide a default in multiple places

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
611403d401 netcmd: models: move group msa membership default to constants
This means the constant can be imported and used by the tests

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
dccafff1b3 netcmd: shell: show Models subheading
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
14285db482 netcmd: models: make MODELS constant keyed by object class instead
This helps with polymorphic querying, mapping object class name to model class.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
1d0084673e netcmd: models: move MODELS constant to constants.py to avoid import loop
query.py and models.py otherwise cause an import loop, query.py needs to import MODELS

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
a547062352 netcmd: models: update docstring of Computer.find method
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
6834a1bdc9 netcmd: models: gmsa move find method to Computer model
The find method is the same as the find method from the User model, with the exception of adding "$".

This means it is actually logic that belongs in the parent class of GroupManagedServiceAccount, which is Computer.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
e1d61746c3 netcmd: models: gmsa GroupManagedServiceAccount inherits from Computer
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00
Rob van der Linde
1cd7cf6680 netcmd: models: gmsa move GroupManagedServiceAccount model to gmsa.py
It needs to inherit from the Computer model, the Computer model also inherits from User.

First, moving it to its own file from user.py to gmsa.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-01 04:45:36 +00:00