From: Rob van der Linde Date: Fri, 16 Feb 2024 01:46:48 +0000 (+1300) Subject: netcmd: gmsa: base cli commands for group managed service accounts X-Git-Tag: tdb-1.4.11~1562 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b1b7d130bc831613ce9880dce70602beff9b153;p=thirdparty%2Fsamba.git netcmd: gmsa: base cli commands for group managed service accounts Signed-off-by: Rob van der Linde Reviewed-by: Andrew Bartlett Reviewed-by: Douglas Bagnall --- diff --git a/python/samba/netcmd/main.py b/python/samba/netcmd/main.py index c1e89412bd4..cce1f291f34 100644 --- a/python/samba/netcmd/main.py +++ b/python/samba/netcmd/main.py @@ -82,6 +82,7 @@ class cmd_sambatool(SuperCommand): subcommands["user"] = None subcommands["ou"] = None subcommands["processes"] = None + subcommands["service-account"] = None subcommands["visualize"] = None diff --git a/python/samba/netcmd/service_account/__init__.py b/python/samba/netcmd/service_account/__init__.py new file mode 100644 index 00000000000..3c42464fa0c --- /dev/null +++ b/python/samba/netcmd/service_account/__init__.py @@ -0,0 +1,41 @@ +# Unix SMB/CIFS implementation. +# +# Service account management. +# +# Copyright (C) Catalyst.Net Ltd. 2024 +# +# Written by Rob van der Linde +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +from samba.netcmd import SuperCommand + +from .service_account import (cmd_service_account_create, + cmd_service_account_delete, + cmd_service_account_list, + cmd_service_account_modify, + cmd_service_account_view) + + +class cmd_service_account(SuperCommand): + """Service Account and Group Managed Service Account management.""" + + subcommands = { + "create": cmd_service_account_create(), + "delete": cmd_service_account_delete(), + "list": cmd_service_account_list(), + "view": cmd_service_account_view(), + "modify": cmd_service_account_modify(), + } diff --git a/python/samba/netcmd/service_account/service_account.py b/python/samba/netcmd/service_account/service_account.py new file mode 100644 index 00000000000..d767934ff7a --- /dev/null +++ b/python/samba/netcmd/service_account/service_account.py @@ -0,0 +1,219 @@ +# Unix SMB/CIFS implementation. +# +# Manage service accounts and group managed service accounts. +# +# Copyright (C) Catalyst.Net Ltd. 2024 +# +# Written by Rob van der Linde +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +from samba.getopt import CredentialsOptions, HostOptions, Option, SambaOptions +from samba.netcmd import Command, CommandError +from samba.netcmd.domain.models import (AccountType, Computer, Group, + GroupManagedServiceAccount, + SupportedEncryptionTypes, User) +from samba.netcmd.domain.models.exceptions import ModelError + + +class cmd_service_account_list(Command): + """List service accounts.""" + + synopsis = "%prog -H [options]" + + takes_optiongroups = { + "sambaopts": SambaOptions, + "credopts": CredentialsOptions, + "hostopts": HostOptions, + } + + takes_options = [ + Option("--json", help="Output results in JSON format.", + dest="output_format", action="store_const", const="json"), + ] + + def run(self, hostopts=None, sambaopts=None, credopts=None, + output_format=None): + + ldb = self.ldb_connect(hostopts, sambaopts, credopts) + + try: + accounts = GroupManagedServiceAccount.query(ldb) + except ModelError as e: + raise CommandError(e) + + if output_format == "json": + self.print_json({account.username: account for account in accounts}) + else: + for account in accounts: + print(account.username, file=self.outf) + + +class cmd_service_account_view(Command): + """View a service account on the domain.""" + + synopsis = "%prog -H [options]" + + takes_optiongroups = { + "sambaopts": SambaOptions, + "credopts": CredentialsOptions, + "hostopts": HostOptions, + } + + takes_options = [ + Option("--name", + help="Name of managed service account (required).", + dest="name", action="store", type=str, required=True), + ] + + def run(self, hostopts=None, sambaopts=None, credopts=None, name=None): + + ldb = self.ldb_connect(hostopts, sambaopts, credopts) + + try: + account = GroupManagedServiceAccount.find(ldb, name) + except ModelError as e: + raise CommandError(e) + + if account is None: + raise CommandError(f"Group managed service account {name} not found.") + + self.print_json(account.as_dict()) + + +class cmd_service_account_create(Command): + """Create a new service account.""" + + synopsis = "%prog -H [options]" + + takes_optiongroups = { + "sambaopts": SambaOptions, + "credopts": CredentialsOptions, + "hostopts": HostOptions, + } + + takes_options = [ + Option("--name", help="Name of managed service account (required).", + dest="name", action="store", type=str, required=True), + Option("--dns-host-name", help="Name of DNS host (required).", + dest="dns_host_name", action="store", type=str, required=True), + Option("--managed-password-interval", + help="Managed password refresh interval in days.", + dest="managed_password_interval", action="store", type=int), + ] + + def run(self, hostopts=None, sambaopts=None, credopts=None, name=None, + dns_host_name=None, managed_password_interval=None): + + ldb = self.ldb_connect(hostopts, sambaopts, credopts) + + gmsa = GroupManagedServiceAccount( + name=name, + managed_password_interval=managed_password_interval, + dns_host_name=dns_host_name, + ) + + # Create group managed service account. + try: + gmsa.save(ldb) + except ModelError as e: + raise CommandError(e) + + print(f"Created group managed service account: {name}", file=self.outf) + + +class cmd_service_account_modify(Command): + """Modify a managed service account.""" + + synopsis = "%prog -H [options]" + + takes_optiongroups = { + "sambaopts": SambaOptions, + "credopts": CredentialsOptions, + "hostopts": HostOptions, + } + + takes_options = [ + Option("--name", help="Name of managed service account (required).", + dest="name", action="store", type=str, required=True), + Option("--dns-host-name", help="Update name of DNS host.", + dest="dns_host_name", action="store", type=str), + Option("--group-msa-membership", + help="Update Group MSA Membership field directly (SDDL).", + dest="group_msa_membership", action="store", type=str), + ] + + def run(self, hostopts=None, sambaopts=None, credopts=None, name=None, + dns_host_name=None, group_msa_membership=None): + + ldb = self.ldb_connect(hostopts, sambaopts, credopts) + + try: + gmsa = GroupManagedServiceAccount.find(ldb, name) + except ModelError as e: + raise CommandError(e) + + if gmsa is None: + raise CommandError(f"Group managed service account {name} not found.") + + if dns_host_name is not None: + gmsa.dns_host_name = dns_host_name + + if group_msa_membership is not None: + gmsa.group_msa_membership = group_msa_membership + + # Update group managed service account. + try: + gmsa.save(ldb) + except ModelError as e: + raise CommandError(e) + + print(f"Modified group managed service account: {name}", file=self.outf) + + +class cmd_service_account_delete(Command): + """Delete a managed service account.""" + + synopsis = "%prog -H [options]" + + takes_optiongroups = { + "sambaopts": SambaOptions, + "credopts": CredentialsOptions, + "hostopts": HostOptions, + } + + takes_options = [ + Option("--name", help="Name of managed service account (required).", + dest="name", action="store", type=str, required=True), + ] + + def run(self, hostopts=None, sambaopts=None, credopts=None, name=None): + + ldb = self.ldb_connect(hostopts, sambaopts, credopts) + + try: + account = GroupManagedServiceAccount.find(ldb, name) + except ModelError as e: + raise CommandError(e) + + if account is None: + raise CommandError(f"Group managed service account {name} not found.") + + try: + account.delete(ldb) + except ModelError as e: + raise CommandError(e) + + print(f"Deleted group managed service account: {name}", file=self.outf)