netcmd: auth policy: remove old user-allowed-to-authenticate-to-silo and group

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/netcmd/domain/auth/policy/policy.py b/python/samba/netcmd/domain/auth/policy/policy.py
index 42d197cd73e78ca1110829f48a515fa4a4a39ede..257e337d16df12e5d61684f50f6cc34babc7aba5 100644 (file)
--- a/python/samba/netcmd/domain/auth/policy/policy.py
+++ b/python/samba/netcmd/domain/auth/policy/policy.py
@@ -76,16 +76,6 @@ class UserOptions(options.OptionGroup):
                         type=str, dest="allowed_to_authenticate_to",
                         action="callback", callback=self.set_option,
                         metavar="SDDL")
-        self.add_option("--user-allowed-to-authenticate-to-by-group",
-                        help="A target service, on a user account, requires the connecting user to be in GROUP",
-                        type=str, dest="allowed_to_authenticate_to_by_group",
-                        action="callback", callback=self.set_option,
-                        metavar="GROUP")
-        self.add_option("--user-allowed-to-authenticate-to-by-silo",
-                        help="A target service, on a user account, requires the connecting user to be in SILO",
-                        type=str, dest="allowed_to_authenticate_to_by_silo",
-                        action="callback", callback=self.set_option,
-                        metavar="SILO")
 
 
 class ServiceOptions(options.OptionGroup):
@@ -278,10 +268,6 @@ class cmd_domain_auth_policy_create(Command):
                            [useropts.allowed_to_authenticate_from,
                             useropts.allowed_to_authenticate_from_device_group,
                             useropts.allowed_to_authenticate_from_device_silo])
-        check_similar_args("--user-allowed-to-authenticate-to",
-                           [useropts.allowed_to_authenticate_to,
-                            useropts.allowed_to_authenticate_to_by_group,
-                            useropts.allowed_to_authenticate_to_by_silo])
         check_similar_args("--service-allowed-to-authenticate-from",
                            [serviceopts.allowed_to_authenticate_from,
                             serviceopts.allowed_to_authenticate_from_device_group,
@@ -305,18 +291,6 @@ class cmd_domain_auth_policy_create(Command):
                 ldb, cn=useropts.allowed_to_authenticate_from_device_silo)
             useropts.allowed_to_authenticate_from = silo.get_authentication_sddl()
 
-        # Generate SDDL for authenticating user accounts to a group
-        if useropts.allowed_to_authenticate_to_by_group:
-            group = Group.get(
-                ldb, cn=useropts.allowed_to_authenticate_to_by_group)
-            useropts.allowed_to_authenticate_to = group.get_authentication_sddl()
-
-        # Generate SDDL for authenticating user accounts to a silo
-        if useropts.allowed_to_authenticate_to_by_silo:
-            silo = AuthenticationSilo.get(
-                ldb, cn=useropts.allowed_to_authenticate_to_by_silo)
-            useropts.allowed_to_authenticate_to = silo.get_authentication_sddl()
-
         # Generate SDDL for authenticating service accounts from a device in a group
         if serviceopts.allowed_to_authenticate_from_device_group:
             group = Group.get(
@@ -440,10 +414,6 @@ class cmd_domain_auth_policy_modify(Command):
                            [useropts.allowed_to_authenticate_from,
                             useropts.allowed_to_authenticate_from_device_group,
                             useropts.allowed_to_authenticate_from_device_silo])
-        check_similar_args("--user-allowed-to-authenticate-to",
-                           [useropts.allowed_to_authenticate_to,
-                            useropts.allowed_to_authenticate_to_by_group,
-                            useropts.allowed_to_authenticate_to_by_silo])
         check_similar_args("--service-allowed-to-authenticate-from",
                            [serviceopts.allowed_to_authenticate_from,
                             serviceopts.allowed_to_authenticate_from_device_group,
@@ -467,18 +437,6 @@ class cmd_domain_auth_policy_modify(Command):
                 ldb, cn=useropts.allowed_to_authenticate_from_device_silo)
             useropts.allowed_to_authenticate_from = silo.get_authentication_sddl()
 
-        # Generate SDDL for authenticating user accounts to a group
-        if useropts.allowed_to_authenticate_to_by_group:
-            group = Group.get(
-                ldb, cn=useropts.allowed_to_authenticate_to_by_group)
-            useropts.allowed_to_authenticate_to = group.get_authentication_sddl()
-
-        # Generate SDDL for authenticating user accounts to a silo
-        if useropts.allowed_to_authenticate_to_by_silo:
-            silo = AuthenticationSilo.get(
-                ldb, cn=useropts.allowed_to_authenticate_to_by_silo)
-            useropts.allowed_to_authenticate_to = silo.get_authentication_sddl()
-
         # Generate SDDL for authenticating users from a device a device in a group
         if serviceopts.allowed_to_authenticate_from_device_group:
             group = Group.get(

diff --git a/python/samba/tests/samba_tool/domain_auth_policy.py b/python/samba/tests/samba_tool/domain_auth_policy.py
index 7a05796b38835f65ae2e89e33b4fb31abc0a89e7..bdd7c3d9338efeb13060aa5ec57e9ea078f7ed94 100644 (file)
--- a/python/samba/tests/samba_tool/domain_auth_policy.py
+++ b/python/samba/tests/samba_tool/domain_auth_policy.py
@@ -197,47 +197,6 @@ class AuthPolicyCmdTestCase(SiloTest):
             sddl,
             'O:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/AuthenticationSilo == "Developers"))')
 
-    def test_create__user_allowed_to_authenticate_to_by_group(self):
-        """Tests the --user-allowed-to-authenticate-to-by-group shortcut."""
-        name = self.unique_name()
-        expected = "O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of_any {SID(%s)}))" % (
-            self.device_group.object_sid)
-
-        # Create a user with authenticate to by group attribute.
-        self.addCleanup(self.delete_authentication_policy, name=name, force=True)
-        result, out, err = self.runcmd(
-            "domain", "auth", "policy", "create", "--name", name,
-            "--user-allowed-to-authenticate-to-by-group",
-            self.device_group.name)
-        self.assertIsNone(result, msg=err)
-
-        # Check user allowed to authenticate to field was modified.
-        policy = self.get_authentication_policy(name)
-        self.assertEqual(str(policy["cn"]), name)
-        desc = policy["msDS-UserAllowedToAuthenticateTo"][0]
-        sddl = ndr_unpack(security.descriptor, desc).as_sddl()
-        self.assertEqual(sddl, expected)
-
-    def test_create__user_allowed_to_authenticate_to_by_silo(self):
-        """Tests the --user-allowed-to-authenticate-to-by-silo shortcut."""
-        name = self.unique_name()
-        expected = ('O:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/'
-                    'AuthenticationSilo == "QA"))')
-
-        # Create a user with authenticate to by silo attribute.
-        self.addCleanup(self.delete_authentication_policy, name=name, force=True)
-        result, out, err = self.runcmd(
-            "domain", "auth", "policy", "create", "--name", name,
-            "--user-allowed-to-authenticate-to-by-silo", "QA")
-        self.assertIsNone(result, msg=err)
-
-        # Check user allowed to authenticate to field was modified.
-        policy = self.get_authentication_policy(name)
-        self.assertEqual(str(policy["cn"]), name)
-        desc = policy["msDS-UserAllowedToAuthenticateTo"][0]
-        sddl = ndr_unpack(security.descriptor, desc).as_sddl()
-        self.assertEqual(sddl, expected)
-
     def test_create__service_tgt_lifetime_mins(self):
         """Test create a new authentication policy with --service-tgt-lifetime-mins.
 
@@ -648,24 +607,27 @@ class AuthPolicyCmdTestCase(SiloTest):
         self.assertEqual(result, -1)
         self.assertIn("--user-allowed-to-authenticate-from argument repeated 2 times.", err)
 
-    def test_create__user_allowed_to_authenticate_to_repeated(self):
+    def test_user_allowed_to_authenticate_to__set_repeated(self):
         """Test repeating similar arguments doesn't make sense to use together.
 
-        --user-allowed-to-authenticate-to
-        --user-allowed-to-authenticate-to-by-silo
+        user-allowed-to-authenticate-to set --by-group
+        user-allowed-to-authenticate-to set --by-silo
         """
-        sddl = 'O:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/AuthenticationSilo == "Developers"))'
         name = self.unique_name()
 
-        result, out, err = self.runcmd("domain", "auth", "policy", "create",
-                                       "--name", name,
-                                       "--user-allowed-to-authenticate-to",
-                                       sddl,
-                                       "--user-allowed-to-authenticate-to-by-silo",
+        self.runcmd("domain", "auth", "policy", "create", "--name", name)
+        self.addCleanup(self.delete_authentication_policy, name=name, force=True)
+
+        result, out, err = self.runcmd("domain", "auth", "policy",
+                                       "user-allowed-to-authenticate-to",
+                                       "set", "--name", name,
+                                       "--by-group",
+                                       self.device_group.name,
+                                       "--by-silo",
                                        "Managers")
 
         self.assertEqual(result, -1)
-        self.assertIn("--user-allowed-to-authenticate-to argument repeated 2 times.", err)
+        self.assertIn("Cannot have both --by-group and --by-silo options.", err)
 
     def test_create__service_allowed_to_authenticate_from_repeated(self):
         """Test repeating similar arguments doesn't make sense to use together.
@@ -984,8 +946,8 @@ class AuthPolicyCmdTestCase(SiloTest):
         sddl = ndr_unpack(security.descriptor, desc).as_sddl()
         self.assertEqual(sddl, expected)
 
-    def test_modify__user_allowed_to_authenticate_to_by_group(self):
-        """Tests the --user-allowed-to-authenticate-to-by-group shortcut."""
+    def test_user_allowed_to_authenticate_to__set_by_group(self):
+        """Tests the user-allowed-to-authenticate-to set --by-group shortcut."""
         name = self.unique_name()
         expected = "O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of_any {SID(%s)}))" % (
             self.device_group.object_sid)
@@ -995,10 +957,10 @@ class AuthPolicyCmdTestCase(SiloTest):
         self.runcmd("domain", "auth", "policy", "create", "--name", name)
 
         # Modify user allowed to authenticate to field
-        result, out, err = self.runcmd("domain", "auth", "policy", "modify",
-                                       "--name", name,
-                                       "--user-allowed-to-authenticate-to-by-group",
-                                       self.device_group.name)
+        result, out, err = self.runcmd("domain", "auth", "policy",
+                                       "user-allowed-to-authenticate-to",
+                                       "set", "--name", name,
+                                       "--by-group", self.device_group.name)
         self.assertIsNone(result, msg=err)
 
         # Check user allowed to authenticate to field was modified.
@@ -1008,8 +970,8 @@ class AuthPolicyCmdTestCase(SiloTest):
         sddl = ndr_unpack(security.descriptor, desc).as_sddl()
         self.assertEqual(sddl, expected)
 
-    def test_modify__user_allowed_to_authenticate_to_by_silo(self):
-        """Tests the --user-allowed-to-authenticate-to-by-silo shortcut."""
+    def test_user_allowed_to_authenticate_to__set_by_silo(self):
+        """Tests the user-allowed-to-authenticate-to set --by-silo shortcut."""
         name = self.unique_name()
         expected = ('O:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/'
                     'AuthenticationSilo == "Developers"))')
@@ -1019,10 +981,10 @@ class AuthPolicyCmdTestCase(SiloTest):
         self.runcmd("domain", "auth", "policy", "create", "--name", name)
 
         # Modify user allowed to authenticate to field
-        result, out, err = self.runcmd("domain", "auth", "policy", "modify",
-                                       "--name", name,
-                                       "--user-allowed-to-authenticate-to-by-silo",
-                                       "Developers")
+        result, out, err = self.runcmd("domain", "auth", "policy",
+                                       "user-allowed-to-authenticate-to",
+                                       "set", "--name", name,
+                                       "--by-silo", "Developers")
         self.assertIsNone(result, msg=err)
 
         # Check user allowed to authenticate to field was modified.