summaryrefslogtreecommitdiff
path: root/python/samba/netcmd/user
AgeCommit message (Collapse)AuthorFilesLines
2025-11-05samba-tool: Add subcommand to generate Certificate Signing Requests with SID ↵Jennifer Sutton2-0/+90
extension Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-11-05samba-tool: Fix commentsJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add user keytrust commandDouglas Bagnall2-0/+225
This allows manipulation of key credential links for users. See `man -l bin/default/docs-xml/manpages/samba-tool.8` for documentation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-01-23samba-tool user disable: add new --remove-supplemental-groups optionBjörn Baumbach1-6/+40
Removes all supplemental groups from a user, what is commonly wanted when a user is disabled. Pair-programmed-with: Stefan Metzmacher <metze@samba.org> Signed-off-by: Björn Baumbach <bb@sernet.de> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jule Anger <janger@samba.org> Autobuild-User(master): Björn Baumbach <bb@sernet.de> Autobuild-Date(master): Thu Jan 23 19:51:05 UTC 2025 on atb-devel-224
2025-01-23samba-tool user disable: make sure that filter matches only one userBjörn Baumbach1-0/+11
toggle_userAccountFlags() can only handle one user. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Jule Anger <janger@samba.org>
2025-01-23samba-tool user disable: rename filter variable to search_filterBjörn Baumbach1-7/+10
filter() is a Python built-in function to filter iterables. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Jule Anger <janger@samba.org>
2025-01-23samba-tool user disable: set proper --filter option descriptionBjörn Baumbach1-1/+3
Seems to be copied from samba-tool user setpassword command. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Jule Anger <janger@samba.org>
2024-12-20samba-tool user: hashlib.sha1 is always presentDouglas Bagnall1-12/+4
We maybe thought we were checking that sha1 was in hashlib, but we were only checking that hashlib is in the Python library (`hashlib.sha1()` would not raise ImportError). The documentation says hashlib always contains sha1 -- if that changes, it is better we know by failing noisily with the import error at the top of the file. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-20samba-tool user: use _glue.crypt, not crypt.cryptDouglas Bagnall1-15/+6
Because we know we have _glue.crypt, and we know it raises exceptions rather than returning None, we can simplify the checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-10-31netcmd: More explicit warning when python-gpg is missingAndréas Leroux1-1/+5
Signed-off-by: Andréas Leroux <aleroux@tranquil.it> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Oct 31 00:23:09 UTC 2024 on atb-devel-224
2024-09-10netcmd: user: Fix typo in samba-tool error messageLyanis Souidi1-1/+1
Fix typo in "samba-tool user add" error message when adding a user with NIS features : the argument for the uid number is --uid-number and not --uidNumber. RN: Fix typo in samba-tool error message. Signed-off-by: Lyanis Souidi <lyanis.souidi@u-pec.fr> Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-06-11samba-tool user readpasswords: avoid `assert` for validationDouglas Bagnall1-1/+4
`assert` can be optimised away if python is run with `-O`. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Jun 11 05:32:28 UTC 2024 on atb-devel-224
2024-03-20python: pep8: fix import sorting after moveRob van der Linde2-2/+2
Only touch files where samba.domain.models import was moved Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-20python: move models out of the netcmd packageRob van der Linde2-4/+4
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-14auth/credentials: Make cli_credentials_get_aes256_key into generic key accessAndrew Bartlett1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-14auth/credentials: Use salt on credentials object for Creds.get_aes256_key()Andrew Bartlett1-1/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-12samba-tool: add "samba-tool user list --locked-only"Jule Anger1-1/+12
Signed-off-by: Jule Anger <janger@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-01samba-tool user delete: use account type constantDouglas Bagnall1-2/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-29samba-tool user getpassword: Clarify success wordingAndrew Bartlett1-1/+1
It may be the case that there was no password, or read access to the password was not permitted. The structure of the code and the pattern in LDIF that missing information is simply returned as missing attributes makes it hard to detect and communicate a clear error here, particularly as an error may not be wanted if (say) pwdLastSet is queried on a gMSA that we can not read. So we just make the string to indicate, as I think it was meant, that the tool ran to compleation. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Feb 29 05:07:45 UTC 2024 on atb-devel-224
2024-02-29samba-tool user getpassword: Also return the time a GMSA password is valid untilAndrew Bartlett1-7/+17
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-02-29samba-tool: Allow ;format=UnixTime etc to operate on virtual attributesAndrew Bartlett1-1/+5
To convert a virtual attribute we must understand that it has been put into "obj" under the name including the ;format= part and so we must look it back up with that name when looking to covert it from (say) NTTIME to a unix time. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-02-29samba-tool user getpassword: Do not show preview of gMSA passwordAndrew Bartlett1-2/+18
The AD server will send a preview of the next gMSA password, 5mins before it is expected to be active. This is useful in a keytab, which needs to be in place before a ticket could possibly be issued, but is not helpful for authentication, as the server also accepts passwords for 5mins after the change. This avoids needing teach all users of this tool how to fall back to the previous password for a 5min period every 30 days, by default. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-02-16samba-tool: Display friendlier error message if no password is availableJo Sutton1-16/+8
‘samba-tool user get-kerberos-ticket’ is supposed to display an error message if no password is available. However, the conditions for which the message is displayed are impossible to be met. If ‘utf16_pw’ is not None, the message is not displayed; if ‘utf16_pw’ *is* None, ‘nt_pass’ is assigned with a samr.Password object, which is not None — and so the message is still not displayed. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python/netcmd: Improve documentation for "samba-tool user getpassword"Andrew Bartlett1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21python/netcmd: Add "samba-tool user get-kerberos-ticket" to get a ticket for ↵Andrew Bartlett4-3/+153
a gMSA Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: document that -H can be used with gMSA accountsRob van der Linde1-2/+9
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: fix some grammar in getpassword docstringsRob van der Linde1-5/+5
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Make samba-tool user getpassword support a ';previous=1' optionAndrew Bartlett1-11/+32
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool user getpassword: Prepare to support a ;previous=1 option, change ↵Andrew Bartlett1-1/+1
behaviour for ;rounds= This will return the previous password, but the pattern is to include the option in the returned attribute name, so we need to use vatter["raw_attr"], not 'a'. This changes the behaviour for the ;rounds= option used when we hold the plaintext password (possibly under GPG encryption). This is now consistant with other parameters in the LDAP attribute, and is now included in the returned attribute name. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Add support for getting the generated unicodePwd for a gMSA accountAndrew Bartlett1-0/+10
This pre-hashed value may be more practical to use than the random "UTF-16" password. In particular it is easy to compare with the DB values. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21netcmd: user: samba-tool support to allow non-windows use of GMSA accounts ↵Rob van der Linde1-3/+13
(show password) Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool user getpassword: Use UTF16_MUNGED charcnv to map "UTF16" to UTF8Andrew Bartlett2-10/+11
This copes with random invalid UTF-16 as seen with gMSA accounts. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Prepare to allow samba-tool user getpasswords to operate against ↵Andrew Bartlett3-29/+32
a remote server While passwords are not normally available for read, Group Managed Service Account passwords are, as this is how they are distributed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21netcmd: getpassword: print OK message on stderrRob van der Linde1-1/+1
This makes it easier to machine parse the output in tests Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-15python: use python3 style super statementsRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-15netcmd: getpassword: get rid of pointless overridden constructorsRob van der Linde2-4/+0
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: add auth silo and policy sub-commands to samba-tool userRob van der Linde4-0/+396
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E303 E305: fix too many or too little blank linesRob van der Linde2-2/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E225: missing whitespace around operatorRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E221: fix multiple spaces before operatorRob van der Linde2-35/+35
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E127: fix hanging indent not lining upRob van der Linde3-7/+7
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E502: backslash is redundant between bracketsRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15netcmd: user: PEP8 E117: code is overindentedRob van der Linde2-14/+14
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-21python:netcmd: Remove semicolonJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-04netcmd: user: readpasswords: move syncpasswords command to readpasswordsRob van der Linde2-859/+881
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Aug 4 05:27:53 UTC 2023 on atb-devel-224
2023-08-04netcmd: user: readpasswords: move getpassword command to readpasswordsRob van der Linde2-171/+203
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-04netcmd: user: readpasswords: move common.py to readpasswordsRob van der Linde4-11/+2
it only contains code relating to the getpassword module Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-04netcmd: user: readpasswords: move show command to readpasswordsRob van der Linde3-3/+4
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-04netcmd: user: readpasswords: turn getpassword.py into readpasswords moduleRob van der Linde2-3/+3
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-04netcmd: user: move user sensitive commandRob van der Linde2-71/+85
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 23:49:58 +0000