From f569dfe16ef8ac0d6556360863dbf1d3b2814143 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 10 Mar 2025 19:08:31 +0100 Subject: [PATCH] python:tests/krb5: allow create_account_opts() to take selective_auth_allowed_sid This will add a GUID_DRS_ALLOWED_TO_AUTHENTICATE ace with CONTROL_ACCESS to the created account. Signed-off-by: Stefan Metzmacher Reviewed-by: Ralph Boehme --- python/samba/tests/krb5/kdc_base_test.py | 27 ++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py index d7515e7293f..fac9dedbe07 100644 --- a/python/samba/tests/krb5/kdc_base_test.py +++ b/python/samba/tests/krb5/kdc_base_test.py @@ -2519,6 +2519,7 @@ class KDCBaseTest(TestCaseInTempDir, RawKerberosTest): 'delegation_to_spn': None, 'delegation_from_dn': None, 'trusted_to_auth_for_delegation': False, + 'selective_auth_allowed_sid': None, 'fast_support': False, 'claims_support': False, 'compound_id_support': False, @@ -2578,6 +2579,7 @@ class KDCBaseTest(TestCaseInTempDir, RawKerberosTest): delegation_to_spn, delegation_from_dn, trusted_to_auth_for_delegation, + selective_auth_allowed_sid, fast_support, claims_support, compound_id_support, @@ -2597,6 +2599,7 @@ class KDCBaseTest(TestCaseInTempDir, RawKerberosTest): self.assertIsNone(delegation_to_spn) self.assertIsNone(delegation_from_dn) self.assertFalse(trusted_to_auth_for_delegation) + self.assertIsNone(selective_auth_allowed_sid) else: self.assertFalse(not_delegated) @@ -2662,6 +2665,30 @@ class KDCBaseTest(TestCaseInTempDir, RawKerberosTest): if assigned_silo is not None: details['msDS-AssignedAuthNPolicySilo'] = assigned_silo + if selective_auth_allowed_sid is not None: + if account_type is self.AccountType.GROUP_MANAGED_SERVICE: + oclass = "msDS-GroupManagedServiceAccount" + elif account_type is self.AccountType.MANAGED_SERVICE: + oclass = "msDS-ManagedServiceAccount" + else: # COMPUTER, SERVER, RODC + oclass = "computer" + schema_dn = samdb.get_schema_basedn() + domain_sid = samdb.get_domain_sid() + domain_sid = security.dom_sid(domain_sid) + res = samdb.search(base=schema_dn, scope=ldb.SCOPE_ONELEVEL, + expression="(lDAPDisplayName=%s)" % oclass, + attrs=["defaultSecurityDescriptor"]) + self.assertEqual(len(res), 1) + self.assertIn("defaultSecurityDescriptor", res[0]) + self.assertEqual(len(res[0]["defaultSecurityDescriptor"]), 1) + sd = str(res[0]["defaultSecurityDescriptor"][0]) + sd += "(OA;;CR;%s;;%s)" % ( + security.GUID_DRS_ALLOWED_TO_AUTHENTICATE, + selective_auth_allowed_sid) + + sd = security.descriptor.from_sddl(sd, domain_sid) + details['nTSecurityDescriptor'] = ndr_pack(sd) + if logon_hours is not None: details['logonHours'] = logon_hours -- 2.47.3