from samba import dsdb, ntstatus
from samba.dcerpc import netlogon, security
from samba.ndr import ndr_pack
+from samba.netcmd.domain.models import AuthenticationPolicy, AuthenticationSilo
import samba.tests.krb5.kcrypto as kcrypto
from samba.tests.krb5.kdc_base_test import GroupType
if member_of is not None:
members += (member_of,)
if assigned_policy is not None:
- opts['assigned_policy'] = str(assigned_policy)
+ opts['assigned_policy'] = str(assigned_policy.dn)
cached = False # Policies are rarely reused between accounts.
if assigned_silo is not None:
- opts['assigned_silo'] = str(assigned_silo)
+ opts['assigned_silo'] = str(assigned_silo.dn)
cached = False # Silos are rarely reused between accounts.
if allowed_rodc:
opts['allowed_replication_mock'] = True
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
# Create a second policy with different lifetimes, so we can verify the
# correct policy is enforced.
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
- computer_policy=str(wrong_policy),
- service_policy=str(wrong_policy),
+ silo = self.create_authn_silo(user_policy=policy,
+ computer_policy=wrong_policy,
+ service_policy=wrong_policy,
enforced=True)
# Create a user account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(wrong_policy),
- computer_policy=str(policy),
- service_policy=str(wrong_policy),
+ silo = self.create_authn_silo(user_policy=wrong_policy,
+ computer_policy=policy,
+ service_policy=wrong_policy,
enforced=True)
# Create a computer account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the computer to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(wrong_policy),
- computer_policy=str(wrong_policy),
- service_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=wrong_policy,
+ computer_policy=wrong_policy,
+ service_policy=policy,
enforced=True)
# Create a managed service account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the managed service account to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
# Create a second policy with different lifetimes, so we can verify the
# correct policy is enforced.
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
- computer_policy=str(wrong_policy),
- service_policy=str(wrong_policy),
+ silo = self.create_authn_silo(user_policy=policy,
+ computer_policy=wrong_policy,
+ service_policy=wrong_policy,
enforced=True)
# Create a user account assigned to the silo, and also to a policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(wrong_policy),
- computer_policy=str(policy),
- service_policy=str(wrong_policy),
+ silo = self.create_authn_silo(user_policy=wrong_policy,
+ computer_policy=policy,
+ service_policy=wrong_policy,
enforced=True)
# Create a computer account assigned to the silo, and also to a policy.
client_dn_str = str(client_creds.get_dn())
# Add the computer to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
user_life = 111
computer_life = 222
service_life = 333
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life,
computer_tgt_lifetime=computer_life,
service_tgt_lifetime=service_life)
- wrong_policy_id = self.get_new_username()
- wrong_policy = self.create_authn_policy(wrong_policy_id,
- enforced=True,
+ wrong_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=444,
computer_tgt_lifetime=555,
service_tgt_lifetime=666)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(wrong_policy),
- computer_policy=str(wrong_policy),
- service_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=wrong_policy,
+ computer_policy=wrong_policy,
+ service_policy=policy,
enforced=True)
# Create a managed service account assigned to the silo, and also to a
client_dn_str = str(client_creds.get_dn())
# Add the managed service account to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
# lifetime set.
INT64_MAX = 0x7fff_ffff_ffff_ffff
max_lifetime = INT64_MAX // 10_000_000
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=max_lifetime)
# Create a user account with the assigned policy.
# lifetime set.
INT64_MIN = -0x8000_0000_0000_0000
min_lifetime = round(INT64_MIN / 10_000_000)
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=min_lifetime)
# Create a user account with the assigned policy.
def test_authn_policy_tgt_lifetime_zero(self):
# Create an authentication policy with the TGT lifetime set to zero.
lifetime = 0
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy.
# Create an authentication policy with the TGT lifetime set to one
# second.
lifetime = 1
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy.
# Create an authentication policy with the TGT lifetime set to two
# minutes (the lifetime of a kpasswd ticket).
lifetime = 2 * 60
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy.
def test_authn_policy_tgt_lifetime_short_protected(self):
# Create an authentication policy with a short TGT lifetime set.
lifetime = 111
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy, belonging to the
# Create an authentication policy with a long TGT lifetime set. This
# exceeds the lifetime of four hours enforced by Protected Users.
lifetime = 6 * 60 * 60 # 6 hours
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy, belonging to the
def test_authn_policy_tgt_lifetime_zero_protected(self):
# Create an authentication policy with the TGT lifetime set to zero.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=0)
# Create a user account with the assigned policy, belonging to the
def test_authn_policy_tgt_lifetime_none_protected(self):
# Create an authentication policy with no TGT lifetime set.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True)
+ policy = self.create_authn_policy(enforced=True)
# Create a user account with the assigned policy, belonging to the
# Protected Users group.
def test_authn_policy_tgt_lifetime_unenforced_protected(self):
# Create an unenforced authentication policy with a TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy, belonging to the
# Create an authentication policy with the TGT lifetime set. The policy
# is not enforced.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- user_tgt_lifetime=lifetime)
+ policy = self.create_authn_policy(user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy.
client_creds = self._get_creds(account_type=self.AccountType.USER,
# Create an authentication policy with the TGT lifetime set. The policy
# is set to be unenforced.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
user_tgt_lifetime=lifetime)
# Create a user account with the assigned policy.
def test_authn_silo_not_enforced(self):
# Create an authentication policy with the TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policy. The silo is
# not enforced.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy))
+ silo = self.create_authn_silo(user_policy=policy)
# Create a user account assigned to the silo.
client_creds = self._get_creds(account_type=self.AccountType.USER,
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
def test_authn_silo_unenforced(self):
# Create an authentication policy with the TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policy. The silo is
# set to be unenforced.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=False)
# Create a user account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
# Create an authentication policy with the TGT lifetime set. The policy
# is not enforced.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- user_tgt_lifetime=lifetime)
+ policy = self.create_authn_policy(user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=True)
# Create a user account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours. Despite the
# Create an authentication policy with the TGT lifetime set. The policy
# is set to be unenforced.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=True)
# Create a user account assigned to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours. Despite the
def test_authn_silo_not_enforced_and_assigned_policy(self):
# Create an authentication policy with the TGT lifetime set.
silo_lifetime = 123
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- enforced=True,
+ silo_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=silo_lifetime)
# Create an authentication silo with our existing policy. The silo is
# not enforced.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy))
+ silo = self.create_authn_silo(user_policy=silo_policy)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the silo, and also to the policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
def test_authn_silo_unenforced_and_assigned_policy(self):
# Create an authentication policy with the TGT lifetime set.
silo_lifetime = 123
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- enforced=True,
+ silo_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=silo_lifetime)
# Create an authentication silo with our existing policy. The silo is
# set to be unenforced.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy),
+ silo = self.create_authn_silo(user_policy=silo_policy,
enforced=False)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the silo, and also to the policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
# Create an authentication policy with the TGT lifetime set. The policy
# is not enforced.
silo_lifetime = 123
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- user_tgt_lifetime=silo_lifetime)
+ silo_policy = self.create_authn_policy(user_tgt_lifetime=silo_lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy),
+ silo = self.create_authn_silo(user_policy=silo_policy,
enforced=True)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the silo, and also to the policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours. Despite the
# Create an authentication policy with the TGT lifetime set. The policy
# is set to be unenforced.
silo_lifetime = 123
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- enforced=False,
+ silo_policy = self.create_authn_policy(enforced=False,
user_tgt_lifetime=silo_lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy),
+ silo = self.create_authn_silo(user_policy=silo_policy,
enforced=True)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the silo, and also to the policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours. Despite the
def test_authn_silo_not_a_member(self):
# Create an authentication policy with the TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=True)
# Create a user account assigned to the silo.
def test_authn_silo_not_a_member_and_assigned_policy(self):
# Create an authentication policy with the TGT lifetime set.
silo_lifetime = 123
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- enforced=True,
+ silo_policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=silo_lifetime)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy),
+ silo = self.create_authn_silo(user_policy=silo_policy,
enforced=True)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the silo, and also to the policy.
def test_authn_silo_not_assigned(self):
# Create an authentication policy with the TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=True)
# Create a user account, but don’t assign it to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
def test_authn_silo_not_assigned_and_assigned_policy(self):
# Create an authentication policy with the TGT lifetime set.
lifetime = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create an authentication silo with our existing policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(policy),
+ silo = self.create_authn_silo(user_policy=policy,
enforced=True)
# Create a second policy with a different lifetime, so we can verify
# the correct policy is enforced.
lifetime = 456
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=lifetime)
# Create a user account assigned to the policy, but not to the silo.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a lifetime of two hours, and assert
def test_authn_silo_no_applicable_policy(self):
# Create an authentication policy with the TGT lifetime set.
user_life = 111
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life)
# Create an authentication silo containing no policies.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- enforced=True)
+ silo = self.create_authn_silo(enforced=True)
# Create a user account assigned to the silo, and also to a policy.
client_creds = self._get_creds(account_type=self.AccountType.USER,
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
def test_authn_silo_no_tgt_lifetime(self):
# Create an authentication policy with no TGT lifetime set.
- silo_policy_id = self.get_new_username()
- silo_policy = self.create_authn_policy(silo_policy_id,
- enforced=True)
+ silo_policy = self.create_authn_policy(enforced=True)
# Create a second policy with a lifetime set, so we can verify the
# correct policy is enforced.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=456)
# Create an authentication silo with our existing policy.
- silo_id = self.get_new_username()
- silo = self.create_authn_silo(silo_id,
- user_policy=str(silo_policy),
+ silo = self.create_authn_silo(user_policy=silo_policy,
enforced=True)
# Create a user account assigned to the silo, and also to a policy.
client_dn_str = str(client_creds.get_dn())
# Add the user to the silo as a member.
- self.add_to_group(client_dn_str, silo, 'msDS-AuthNPolicySiloMembers',
+ self.add_to_group(client_dn_str, silo.dn,
+ 'msDS-AuthNPolicySiloMembers',
expect_attr=False)
# Request a Kerberos ticket with a ‘till’ time far in the
expected_renew_life=expected_renew_life)
def test_not_a_policy(self):
+ samdb = self.get_samdb()
+
+ not_a_policy = AuthenticationPolicy()
+ not_a_policy.dn = samdb.get_default_basedn()
+
# Create a user account with the assigned policy set to something that
# isn’t a policy.
- samdb = self.get_samdb()
client_creds = self._get_creds(
account_type=self.AccountType.USER,
- assigned_policy=samdb.get_default_basedn())
+ assigned_policy=not_a_policy)
# Request a Kerberos ticket with a ‘till’ time far in the
# future, and assert that the actual lifetime is the maximum
expected_renew_life=expected_renew_life)
def test_not_a_silo(self):
- # Create a user account assigned to a silo that isn’t a silo.
samdb = self.get_samdb()
+
+ not_a_silo = AuthenticationSilo()
+ not_a_silo.dn = samdb.get_default_basedn()
+
+ # Create a user account assigned to a silo that isn’t a silo.
client_creds = self._get_creds(
account_type=self.AccountType.USER,
- assigned_silo=samdb.get_default_basedn())
+ assigned_silo=not_a_silo)
# Request a Kerberos ticket with a ‘till’ time far in the
# future, and assert that the actual lifetime is the maximum
expected_renew_life=expected_renew_life)
def test_not_a_silo_and_policy(self):
+ samdb = self.get_samdb()
+
+ not_a_silo = AuthenticationSilo()
+ not_a_silo.dn = samdb.get_default_basedn()
+
# Create an authentication policy with the TGT lifetime set.
user_life = 123
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_tgt_lifetime=user_life)
# Create a user account assigned to a silo that isn’t a silo, and also
# to a policy.
- samdb = self.get_samdb()
client_creds = self._get_creds(
account_type=self.AccountType.USER,
- assigned_silo=samdb.get_default_basedn(),
+ assigned_silo=not_a_silo,
assigned_policy=policy)
# Request a Kerberos ticket with a lifetime of two hours, and assert
# Create an authentication policy with no DACL in the security
# descriptor.
allowed_from = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed_from)
# Create a user account with the assigned policy.
# what gets logged.
allowed = f'O:SYD:(A;;CR;;;{mach_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed,
user_tgt_lifetime=120,
computer_tgt_lifetime=240,
# what gets logged.
allowed = 'O:SYD:(A;;CR;;;WD)'
denied = f'O:SYD:(D;;CR;;;{mach_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=denied,
user_tgt_lifetime=120,
computer_tgt_lifetime=240,
# account for a user.
allowed = 'O:SYD:(A;;CR;;;WD)'
denied = f'O:SYD:(D;;CR;;;{mach_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=denied,
service_allowed_from=allowed)
# account for a service.
allowed = f'O:SYD:(A;;CR;;;{mach_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=denied,
service_allowed_from=allowed)
# account for a service.
allowed = 'O:SYD:(A;;CR;;;WD)'
denied = f'O:SYD:(D;;CR;;;{mach_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed,
service_allowed_from=denied)
# Create an authentication policy that explicitly allows the machine
# account for a user. Omit the owner (O:SY) from the SDDL.
allowed = 'D:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an unenforced authentication policy that explicitly allows the
# machine account for a user. Omit the owner (O:SY) from the SDDL.
allowed = 'D:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that explicitly allows the machine
# account for a user. Set the owner to the machine account.
allowed = f'O:{mach_creds.get_sid()}D:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that explicitly allows the machine
# account for a user. Set the owner to be anonymous.
allowed = 'O:AND:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that restricts authentication.
# Include some different TGT lifetimes for testing what gets logged.
allowed_from = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed_from,
user_tgt_lifetime=115,
computer_tgt_lifetime=235,
# authentication. Include some negative TGT lifetimes for testing what
# gets logged.
allowed_from = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed_from,
user_tgt_lifetime=-115,
computer_tgt_lifetime=-235,
# Create an unenforced authentication policy that restricts
# authentication.
allowed_from = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
user_allowed_from=allowed_from)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
f'O:SYD:(A;;CR;;;'
f'{security.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY})'
)
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Claims Valid SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_CLAIMS_VALID})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Compounded Authentication SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_COMPOUNDED_AUTHENTICATION})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Authenticated Users SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_AUTHENTICATED_USERS})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the NTLM
# Authentication SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_NTLM_AUTHENTICATION})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# account for a user.
allowed = f'O:SYD:(A;;CR;;;{mach_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed,
service_allowed_from=denied)
# account for a user.
allowed = 'O:SYD:(A;;CR;;;WD)'
denied = f'O:SYD:(D;;CR;;;{mach_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=denied,
service_allowed_from=allowed)
# account for a service.
allowed = f'O:SYD:(A;;CR;;;{mach_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=denied,
service_allowed_from=allowed)
# account for a service.
allowed = 'O:SYD:(A;;CR;;;WD)'
denied = f'O:SYD:(D;;CR;;;{mach_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed,
service_allowed_from=denied)
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
f'O:SYD:(A;;CR;;;'
f'{security.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY})'
)
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Claims Valid SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_CLAIMS_VALID})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Compounded Authentication SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_COMPOUNDED_AUTHENTICATION})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the
# Authenticated Users SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_AUTHENTICATED_USERS})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts with the NTLM
# Authentication SID.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_NTLM_AUTHENTICATION})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# account for a user, while denying the user account itself.
allowed = f'O:SYD:(A;;CR;;;{mach_sid})(D;;CR;;;{client_sid})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed,
service_allowed_from=denied)
# Assign the policy to the user account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that authentication is allowed.
self._get_tgt(client_creds, armor_tgt=mach_tgt)
# Create an authentication policy with no DACL in the security
# descriptor.
allowed_to = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed_to)
# Create a computer account with the assigned policy.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly denying the machine account.
allowed = f'O:SYD:(A;;CR;;;{client_sid})(D;;CR;;;{mach_sid})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly allows the machine account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{mach_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly disallows the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
f'{security.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY})'
)
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Valid SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_CLAIMS_VALID})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Compounded Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_COMPOUNDED_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authenticated Users SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_AUTHENTICATED_USERS})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_NTLM_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly allows the user account to obtain a service ticket. Omit
# the owner (O:SY) from the SDDL.
allowed = f'D:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# and explicitly allows the user account to obtain a service
# ticket. Omit the owner (O:SY) from the SDDL.
allowed = f'D:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# explicitly allows the user account to obtain a service ticket. Set
# the owner to the user account.
allowed = f'O:{client_sid}D:(A;;CR;;;{client_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# explicitly allows the user account to obtain a service ticket. Set
# the owner to be anonymous.
allowed = f'O:AND:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=denied)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=allowed)
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=allowed,
service_allowed_to=denied)
# allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=denied)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=allowed)
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
f'{security.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY})'
)
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Valid SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_CLAIMS_VALID})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Compounded Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_COMPOUNDED_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authenticated Users SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_AUTHENTICATED_USERS})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_NTLM_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed)
# Create a user account with the assigned policy.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that obtaining a service ticket to ourselves is allowed.
self._tgs_req(tgt, 0, client_creds, client_creds,
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that obtaining a service ticket to ourselves is allowed, despite
# the policy disallowing it.
# explicitly allows the account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that obtaining a service ticket to ourselves armored with our
# own TGT is allowed.
# explicitly denies the account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that obtaining a service ticket to ourselves armored with our
# own TGT is allowed, despite the policy’s disallowing it.
# Create an authentication policy that applies to a computer and
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# Create an authentication policy that applies to a computer and
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=denied)
# Create a computer account with the assigned policy.
# Create an authentication policy that applies to a computer and
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
- service_policy_id = self.get_new_username()
- service_policy = self.create_authn_policy(service_policy_id,
- enforced=True,
+ service_policy = self.create_authn_policy(enforced=True,
computer_allowed_to=denied)
# Create a computer account with the assigned policy.
service_creds = self.get_cached_creds(
account_type=self.AccountType.COMPUTER,
opts={
- 'assigned_policy': str(service_policy),
+ 'assigned_policy': str(service_policy.dn),
# Allow delegation to the target service.
'delegation_to_spn': target_spn,
'trusted_to_auth_for_delegation': True,
# explicitly allows the service account to obtain a service ticket,
# while denying the user.
allowed = f'O:SYD:(A;;CR;;;{service_sid})(D;;CR;;;{client_sid})'
- target_policy_id = self.get_new_username()
- target_policy = self.create_authn_policy(target_policy_id,
- enforced=True,
+ target_policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the target account.
self.add_attribute(samdb, str(target_creds.get_dn()),
- 'msDS-AssignedAuthNPolicy', str(target_policy))
+ 'msDS-AssignedAuthNPolicy', str(target_policy.dn))
def generate_s4u2self_padata(_kdc_exchange_dict,
_callback_dict,
# explicitly allows the service account to obtain a service ticket,
# while denying the user.
allowed = f'O:SYD:(A;;CR;;;{service_sid})(D;;CR;;;{client_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the target account.
self.add_attribute(samdb, str(target_creds.get_dn()),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# explicitly denies the service account to obtain a service ticket,
# while allowing the user.
denied = f'O:SYD:(D;;CR;;;{service_sid})(A;;CR;;;{client_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=denied)
# Assign the policy to the target account.
self.add_attribute(samdb, str(target_creds.get_dn()),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# explicitly allows the service account to obtain a service ticket,
# while denying the user.
allowed = f'O:SYD:(A;;CR;;;{service_sid})(D;;CR;;;{client_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a target account with the assigned policy.
target_creds = self.get_cached_creds(
account_type=self.AccountType.COMPUTER,
opts={
- 'assigned_policy': str(policy),
+ 'assigned_policy': str(policy.dn),
'delegation_from_dn': str(service_creds.get_dn()),
})
# explicitly denies the service account to obtain a service ticket,
# while allowing the user.
denied = f'O:SYD:(D;;CR;;;{service_sid})(A;;CR;;;{client_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=denied)
# Create a target account with the assigned policy.
target_creds = self.get_cached_creds(
account_type=self.AccountType.COMPUTER,
opts={
- 'assigned_policy': str(policy),
+ 'assigned_policy': str(policy.dn),
'delegation_from_dn': str(service_creds.get_dn()),
})
# explicitly allows the client account to obtain a service ticket,
# while denying the service.
allowed = f'O:SYD:(A;;CR;;;{client_sid})(D;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# explicitly denies the client account to obtain a service ticket,
# while allowing the service.
allowed = f'O:SYD:(D;;CR;;;{client_sid})(A;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
kdc_options = str(krb5_asn1.KDCOptions('cname-in-addl-tkt'))
# explicitly allows the client account to obtain a service ticket,
# while denying the service.
allowed = f'O:SYD:(A;;CR;;;{client_sid})(D;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# explicitly allows the client account to obtain a service ticket,
# while denying the service.
allowed = f'O:SYD:(A;;CR;;;{client_sid})(D;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# explicitly denies the client account to obtain a service ticket,
# while allowing the service.
allowed = f'O:SYD:(D;;CR;;;{client_sid})(A;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
kdc_options = str(krb5_asn1.KDCOptions('cname-in-addl-tkt'))
# explicitly allows the client account to obtain a service ticket,
# while denying the service.
allowed = f'O:SYD:(A;;CR;;;{client_sid})(D;;CR;;;{service_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Assign the policy to the service account.
self.add_attribute(samdb, service_dn_str,
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
client_service_tkt = self.get_service_ticket(
client_tgt,
# Create an authentication policy that applies to a computer and
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# Create an authentication policy that applies to a computer and
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=denied)
# Create a computer account with the assigned policy.
# allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=denied)
account_type=self.AccountType.USER,
spn='host/{account}',
additional_details={
- 'msDS-AssignedAuthNPolicy': str(policy),
+ 'msDS-AssignedAuthNPolicy': str(policy.dn),
'objectClass': user_class,
})
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
account_type=self.AccountType.COMPUTER,
spn=f'host/{target_name}',
additional_details={
- 'msDS-AssignedAuthNPolicy': str(policy),
+ 'msDS-AssignedAuthNPolicy': str(policy.dn),
'objectClass': computer_class,
})
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
account_type=self.AccountType.MANAGED_SERVICE,
spn=f'host/{target_name}',
additional_details={
- 'msDS-AssignedAuthNPolicy': str(policy),
+ 'msDS-AssignedAuthNPolicy': str(policy.dn),
'objectClass': service_class,
})
# Create an authentication policy allowing NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=allowed,
service_allowed_ntlm=False,
# Create an authentication policy denying NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=allowed,
service_allowed_ntlm=True,
def test_authn_policy_ntlm_computer(self):
# Create an authentication policy denying NTLM authentication.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=denied,
service_allowed_ntlm=False,
# Create an authentication policy allowing NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=allowed,
service_allowed_ntlm=True,
# Create an authentication policy denying NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=allowed,
service_allowed_ntlm=False,
def test_authn_policy_ntlm_deny_no_device_restrictions(self):
# Create an authentication policy denying NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
service_allowed_ntlm=True)
# Create an authentication policy allowing NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=allowed,
service_allowed_ntlm=False,
# Create an authentication policy denying NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=allowed,
service_allowed_ntlm=True,
def test_authn_policy_simple_bind_deny_no_device_restrictions(self):
# Create an authentication policy denying NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
service_allowed_ntlm=True)
# Create an authentication policy allowing NTLM authentication for
# managed service accounts.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=allowed)
# Create an authentication policy allowing NTLM authentication for
# managed service accounts.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=denied)
def test_authn_policy_samr_pwd_change_allow_service_no_allowed_from(self):
# Create an authentication policy allowing NTLM authentication for
# managed service accounts.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True)
# Create a managed service account with the assigned policy.
# Create an authentication policy denying NTLM authentication for
# managed service accounts.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=allowed)
# Create an authentication policy denying NTLM authentication for
# managed service accounts.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=denied)
def test_authn_policy_samr_pwd_change_deny_service_no_allowed_from(self):
# Create an authentication policy denying NTLM authentication for
# managed service accounts.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False)
# Create a managed service account with the assigned policy.
# Create an authentication policy allowing NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=allowed,
service_allowed_ntlm=False,
# Create an authentication policy denying NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=allowed,
service_allowed_ntlm=True,
def test_authn_policy_samlogon_network_computer(self):
# Create an authentication policy denying NTLM authentication.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=denied,
service_allowed_ntlm=False,
# Create an authentication policy allowing NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=allowed)
# Create an authentication policy allowing NTLM authentication for
# users.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True,
user_allowed_from=denied)
def test_authn_policy_samlogon_interactive_allow_user_no_allowed_from(self):
# Create an authentication policy allowing NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=True)
# Create a user account with the assigned policy.
# Create an authentication policy disallowing NTLM authentication for
# users.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=allowed)
# Create an authentication policy disallowing NTLM authentication for
# users.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
user_allowed_from=denied)
def test_authn_policy_samlogon_interactive_deny_user_no_allowed_from(self):
# Create an authentication policy disallowing NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False)
# Create a user account with the assigned policy.
# Create an authentication policy not specifying whether NTLM
# authentication is allowed or not.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy not specifying whether NTLM
# authentication is allowed or not.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy.
# Create an authentication policy allowing NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=allowed)
# Create an authentication policy allowing NTLM authentication for
# services.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=denied)
def test_authn_policy_samlogon_network_allow_service_no_allowed_from(self):
# Create an authentication policy allowing NTLM authentication for
# services.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True)
# Create a managed service account with the assigned policy.
# Create an authentication policy disallowing NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=allowed)
# Create an authentication policy disallowing NTLM authentication for
# services.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=denied)
def test_authn_policy_samlogon_network_deny_service_no_allowed_from(self):
# Create an authentication policy disallowing NTLM authentication for
# services.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False)
# Create a managed service account with the assigned policy.
# Create an authentication policy allowing NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=allowed)
# Create an authentication policy allowing NTLM authentication for
# services.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True,
service_allowed_from=denied)
def test_authn_policy_samlogon_network_allow_service_no_allowed_from_to_self(self):
# Create an authentication policy allowing NTLM authentication for
# services.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=True)
# Create a managed service account with the assigned policy.
# Create an authentication policy disallowing NTLM authentication for
# services.
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=allowed)
# Create an authentication policy disallowing NTLM authentication for
# services.
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False,
service_allowed_from=denied)
def test_authn_policy_samlogon_network_deny_service_no_allowed_from_to_self(self):
# Create an authentication policy disallowing NTLM authentication for
# services.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
service_allowed_ntlm=False)
# Create a managed service account with the assigned policy.
def test_authn_policy_samlogon_interactive_deny_no_device_restrictions(self):
# Create an authentication policy denying NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
service_allowed_ntlm=True)
def test_authn_policy_samlogon_network_deny_no_device_restrictions(self):
# Create an authentication policy denying NTLM authentication for
# users.
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_ntlm=False,
service_allowed_ntlm=True)
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
f'{security.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY})'
)
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Valid SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_CLAIMS_VALID})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Compounded Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_COMPOUNDED_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authenticated Users SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_AUTHENTICATED_USERS})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Authentication SID to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{security.SID_NT_NTLM_AUTHENTICATION})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# explicitly allows the user account to obtain a service ticket. Omit
# the owner (O:SY) from the SDDL.
allowed = f'D:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# and explicitly allows the user account to obtain a service
# ticket. Omit the owner (O:SY) from the SDDL.
allowed = f'D:(A;;CR;;;{client_creds.get_sid()})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=False,
+ policy = self.create_authn_policy(enforced=False,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# Create an authentication policy that allows accounts belonging to the
# group.
allowed = f'O:SYD:(A;;CR;;;{group_sid})'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
computer_allowed_to=allowed)
# Create a computer account with the assigned policy.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that a network SamLogon to ourselves succeeds.
self._test_samlogon(creds=client_creds,
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that a network SamLogon to ourselves fails, despite
# authentication being allowed in the Kerberos case.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that a network SamLogon to ourselves succeeds.
self._test_samlogon(creds=client_creds,
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=allowed,
service_allowed_to=denied)
# Assign the policy to the account.
self.add_attribute(samdb, str(client_dn),
- 'msDS-AssignedAuthNPolicy', str(policy))
+ 'msDS-AssignedAuthNPolicy', str(policy.dn))
# Show that a network SamLogon to ourselves fails, despite
# authentication being allowed in the Kerberos case.
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=allowed,
service_allowed_to=denied)
account_type=self.AccountType.COMPUTER,
spn=f'host/{target_name}',
additional_details={
- 'msDS-AssignedAuthNPolicy': str(policy),
+ 'msDS-AssignedAuthNPolicy': str(policy.dn),
'objectClass': computer_class,
})
# explicitly allows the user account to obtain a service ticket.
allowed = f'O:SYD:(A;;CR;;;{client_creds.get_sid()})'
denied = 'O:SYD:(D;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=denied,
computer_allowed_to=denied,
service_allowed_to=allowed)
account_type=self.AccountType.MANAGED_SERVICE,
spn=f'host/{target_name}',
additional_details={
- 'msDS-AssignedAuthNPolicy': str(policy),
+ 'msDS-AssignedAuthNPolicy': str(policy.dn),
'objectClass': service_class,
})
def test_samlogon_bad_pwd_client_policy(self):
# Create an authentication policy with device restrictions for users.
allowed = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy. Use a non-cached
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
def test_samlogon_bad_pwd_client_and_server_policy(self):
# Create an authentication policy with device restrictions for users.
allowed = 'O:SY'
- policy_id = self.get_new_username()
- policy = self.create_authn_policy(policy_id,
- enforced=True,
+ policy = self.create_authn_policy(enforced=True,
user_allowed_from=allowed)
# Create a user account with the assigned policy. Use a non-cached
# explicitly denies the user account to obtain a service ticket.
denied = f'O:SYD:(D;;CR;;;{client_creds.get_sid()})'
allowed = 'O:SYD:(A;;CR;;;WD)'
- server_policy_id = self.get_new_username()
- server_policy = self.create_authn_policy(server_policy_id,
- enforced=True,
+ server_policy = self.create_authn_policy(enforced=True,
user_allowed_to=allowed,
computer_allowed_to=denied,
service_allowed_to=allowed)
projects / thirdparty / samba.git / commitdiff
