s4:libnet: Allow simulating AS‐REQ flags combination for keytab export

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c
index 77c48f6cc9f28b523feb138f8445e4214ea7e0db..fbe94068f58629893c6ace5aea1fe5804ddd7dac 100644 (file)
--- a/source4/libnet/libnet_export_keytab.c
+++ b/source4/libnet/libnet_export_keytab.c
@@ -410,7 +410,7 @@ NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, s
                }
        }
 
-       sdb_flags = SDB_F_ADMIN_DATA;
+       sdb_flags = r->in.as_for_AS_REQ ? SDB_F_FOR_AS_REQ : SDB_F_ADMIN_DATA;
 
        status = sdb_kt_copy(mem_ctx,
                             smb_krb5_context,

diff --git a/source4/libnet/libnet_export_keytab.h b/source4/libnet/libnet_export_keytab.h
index 706e88c2e20bc5fa449c090dd33dba73fb289521..a5536856c975b80555025bbcc7058f4b1337a816 100644 (file)
--- a/source4/libnet/libnet_export_keytab.h
+++ b/source4/libnet/libnet_export_keytab.h
@@ -26,6 +26,7 @@ struct libnet_export_keytab {
                struct ldb_context *samdb;
                bool keep_stale_entries;
                bool only_current_keys;
+               bool as_for_AS_REQ;
        } in;
        struct {
                const char *error_string;

diff --git a/source4/libnet/py_net_dckeytab.c b/source4/libnet/py_net_dckeytab.c
index 7de4793b99fe508e364b5083f1f114948e2e3732..d3770e1ec5a93de8034556f3aeee1df4e57aaf2e 100644 (file)
--- a/source4/libnet/py_net_dckeytab.c
+++ b/source4/libnet/py_net_dckeytab.c
@@ -39,6 +39,7 @@ static PyObject *py_net_export_keytab(py_net_Object *self, PyObject *args, PyObj
                                  "principal",
                                  "keep_stale_entries",
                                  "only_current_keys",
+                                 "as_for_AS_REQ",
                                  NULL };
        NTSTATUS status;
        /*
@@ -47,18 +48,21 @@ static PyObject *py_net_export_keytab(py_net_Object *self, PyObject *args, PyObj
         */
        int keep_stale_entries = false;
        int only_current_keys = false;
+       int as_for_AS_REQ = false;
 
-       if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|Ozpp:export_keytab", discard_const_p(char *, kwnames),
+       if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|Ozppp:export_keytab", discard_const_p(char *, kwnames),
                                         &r.in.keytab_name,
                                         &py_samdb,
                                         &r.in.principal,
                                         &keep_stale_entries,
-                                        &only_current_keys)) {
+                                        &only_current_keys,
+                                        &as_for_AS_REQ)) {
                return NULL;
        }
 
        r.in.keep_stale_entries = keep_stale_entries;
        r.in.only_current_keys = only_current_keys;
+       r.in.as_for_AS_REQ = as_for_AS_REQ;
 
        if (py_samdb == NULL) {
                r.in.samdb = NULL;
@@ -90,8 +94,13 @@ static PyObject *py_net_export_keytab(py_net_Object *self, PyObject *args, PyObj
 
 static const char py_net_export_keytab_doc[] =
        "export_keytab(keytab, samdb=None, principal=None, "
-       "keep_stale_entries=False, only_current_keys=False)\n\n"
-       "Export the DC keytab to a keytab file.";
+       "keep_stale_entries=False, only_current_keys=False, "
+       "as_for_AS_REQ=False)\n\n"
+       "Export the DC keytab to a keytab file.\n\n"
+       "Pass as_for_AS_REQ=True to simulate the combination of flags normally "
+       "utilized for an AS‐REQ. Samba’s testsuite uses this to verify which "
+       "keys the KDC would see — some combination of previous and current "
+       "keys — for a Group Managed Service Account performing an AS‐REQ.";
 
 static PyMethodDef export_keytab_method_table[] = {
        {"export_keytab", PY_DISCARD_FUNC_SIG(PyCFunction,