netcmd: gmsa: base cli commands for group managed service accounts

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

3 files changed, 261 insertions, 0 deletions

diff --git a/python/samba/netcmd/main.py b/python/samba/netcmd/main.py
index c1e89412bd4..cce1f291f34 100644
--- a/python/samba/netcmd/main.py
+++ b/python/samba/netcmd/main.py
@@ -82,6 +82,7 @@ class cmd_sambatool(SuperCommand):
     subcommands["user"] = None
     subcommands["ou"] = None
     subcommands["processes"] = None
+    subcommands["service-account"] = None
     subcommands["visualize"] = None
 
 
diff --git a/python/samba/netcmd/service_account/__init__.py b/python/samba/netcmd/service_account/__init__.py
new file mode 100644
index 00000000000..3c42464fa0c
--- /dev/null
+++ b/python/samba/netcmd/service_account/__init__.py
@@ -0,0 +1,41 @@
+# Unix SMB/CIFS implementation.
+#
+# Service account management.
+#
+# Copyright (C) Catalyst.Net Ltd. 2024
+#
+# Written by Rob van der Linde <rob@catalyst.net.nz>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from samba.netcmd import SuperCommand
+
+from .service_account import (cmd_service_account_create,
+                              cmd_service_account_delete,
+                              cmd_service_account_list,
+                              cmd_service_account_modify,
+                              cmd_service_account_view)
+
+
+class cmd_service_account(SuperCommand):
+    """Service Account and Group Managed Service Account management."""
+
+    subcommands = {
+        "create": cmd_service_account_create(),
+        "delete": cmd_service_account_delete(),
+        "list": cmd_service_account_list(),
+        "view": cmd_service_account_view(),
+        "modify": cmd_service_account_modify(),
+    }
diff --git a/python/samba/netcmd/service_account/service_account.py b/python/samba/netcmd/service_account/service_account.py
new file mode 100644
index 00000000000..d767934ff7a
--- /dev/null
+++ b/python/samba/netcmd/service_account/service_account.py
@@ -0,0 +1,219 @@
+# Unix SMB/CIFS implementation.
+#
+# Manage service accounts and group managed service accounts.
+#
+# Copyright (C) Catalyst.Net Ltd. 2024
+#
+# Written by Rob van der Linde <rob@catalyst.net.nz>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from samba.getopt import CredentialsOptions, HostOptions, Option, SambaOptions
+from samba.netcmd import Command, CommandError
+from samba.netcmd.domain.models import (AccountType, Computer, Group,
+                                        GroupManagedServiceAccount,
+                                        SupportedEncryptionTypes, User)
+from samba.netcmd.domain.models.exceptions import ModelError
+
+
+class cmd_service_account_list(Command):
+    """List service accounts."""
+
+    synopsis = "%prog -H <URL> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": SambaOptions,
+        "credopts": CredentialsOptions,
+        "hostopts": HostOptions,
+    }
+
+    takes_options = [
+        Option("--json", help="Output results in JSON format.",
+               dest="output_format", action="store_const", const="json"),
+    ]
+
+    def run(self, hostopts=None, sambaopts=None, credopts=None,
+            output_format=None):
+
+        ldb = self.ldb_connect(hostopts, sambaopts, credopts)
+
+        try:
+            accounts = GroupManagedServiceAccount.query(ldb)
+        except ModelError as e:
+            raise CommandError(e)
+
+        if output_format == "json":
+            self.print_json({account.username: account for account in accounts})
+        else:
+            for account in accounts:
+                print(account.username, file=self.outf)
+
+
+class cmd_service_account_view(Command):
+    """View a service account on the domain."""
+
+    synopsis = "%prog -H <URL> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": SambaOptions,
+        "credopts": CredentialsOptions,
+        "hostopts": HostOptions,
+    }
+
+    takes_options = [
+        Option("--name",
+               help="Name of managed service account (required).",
+               dest="name", action="store", type=str, required=True),
+    ]
+
+    def run(self, hostopts=None, sambaopts=None, credopts=None, name=None):
+
+        ldb = self.ldb_connect(hostopts, sambaopts, credopts)
+
+        try:
+            account = GroupManagedServiceAccount.find(ldb, name)
+        except ModelError as e:
+            raise CommandError(e)
+
+        if account is None:
+            raise CommandError(f"Group managed service account {name} not found.")
+
+        self.print_json(account.as_dict())
+
+
+class cmd_service_account_create(Command):
+    """Create a new service account."""
+
+    synopsis = "%prog -H <URL> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": SambaOptions,
+        "credopts": CredentialsOptions,
+        "hostopts": HostOptions,
+    }
+
+    takes_options = [
+        Option("--name", help="Name of managed service account (required).",
+               dest="name", action="store", type=str, required=True),
+        Option("--dns-host-name", help="Name of DNS host (required).",
+               dest="dns_host_name", action="store", type=str, required=True),
+        Option("--managed-password-interval",
+               help="Managed password refresh interval in days.",
+               dest="managed_password_interval", action="store", type=int),
+    ]
+
+    def run(self, hostopts=None, sambaopts=None, credopts=None, name=None,
+            dns_host_name=None, managed_password_interval=None):
+
+        ldb = self.ldb_connect(hostopts, sambaopts, credopts)
+
+        gmsa = GroupManagedServiceAccount(
+            name=name,
+            managed_password_interval=managed_password_interval,
+            dns_host_name=dns_host_name,
+        )
+
+        # Create group managed service account.
+        try:
+            gmsa.save(ldb)
+        except ModelError as e:
+            raise CommandError(e)
+
+        print(f"Created group managed service account: {name}", file=self.outf)
+
+
+class cmd_service_account_modify(Command):
+    """Modify a managed service account."""
+
+    synopsis = "%prog -H <URL> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": SambaOptions,
+        "credopts": CredentialsOptions,
+        "hostopts": HostOptions,
+    }
+
+    takes_options = [
+        Option("--name", help="Name of managed service account (required).",
+               dest="name", action="store", type=str, required=True),
+        Option("--dns-host-name", help="Update name of DNS host.",
+               dest="dns_host_name", action="store", type=str),
+        Option("--group-msa-membership",
+               help="Update Group MSA Membership field directly (SDDL).",
+               dest="group_msa_membership", action="store", type=str),
+    ]
+
+    def run(self, hostopts=None, sambaopts=None, credopts=None, name=None,
+            dns_host_name=None, group_msa_membership=None):
+
+        ldb = self.ldb_connect(hostopts, sambaopts, credopts)
+
+        try:
+            gmsa = GroupManagedServiceAccount.find(ldb, name)
+        except ModelError as e:
+            raise CommandError(e)
+
+        if gmsa is None:
+            raise CommandError(f"Group managed service account {name} not found.")
+
+        if dns_host_name is not None:
+            gmsa.dns_host_name = dns_host_name
+
+        if group_msa_membership is not None:
+            gmsa.group_msa_membership = group_msa_membership
+
+        # Update group managed service account.
+        try:
+            gmsa.save(ldb)
+        except ModelError as e:
+            raise CommandError(e)
+
+        print(f"Modified group managed service account: {name}", file=self.outf)
+
+
+class cmd_service_account_delete(Command):
+    """Delete a managed service account."""
+
+    synopsis = "%prog -H <URL> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": SambaOptions,
+        "credopts": CredentialsOptions,
+        "hostopts": HostOptions,
+    }
+
+    takes_options = [
+        Option("--name", help="Name of managed service account (required).",
+               dest="name", action="store", type=str, required=True),
+    ]
+
+    def run(self, hostopts=None, sambaopts=None, credopts=None, name=None):
+
+        ldb = self.ldb_connect(hostopts, sambaopts, credopts)
+
+        try:
+            account = GroupManagedServiceAccount.find(ldb, name)
+        except ModelError as e:
+            raise CommandError(e)
+
+        if account is None:
+            raise CommandError(f"Group managed service account {name} not found.")
+
+        try:
+            account.delete(ldb)
+        except ModelError as e:
+            raise CommandError(e)
+
+        print(f"Deleted group managed service account: {name}", file=self.outf)