summaryrefslogtreecommitdiff
path: root/python/samba
AgeCommit message (Collapse)AuthorFilesLines
2024-01-29python:gp: Improve working of log messages to avoid confusionAndreas Schneider1-4/+2
We should not use the word "Failed". We are totally fine if we can't connect to NDES in the meantime. This logs: Try to get root or server certificates. Unable to install root certificates (requires NDES). Installing the server certificate only. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 29 10:37:29 UTC 2024 on atb-devel-224
2024-01-29python:gp: Log an error if update failsAndreas Schneider1-1/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Do not print an error if template already existsAndreas Schneider1-2/+6
We will get an exit status for duplicate in future: https://www.pagure.io/certmonger/issue/269 We can't really fix that right now, as older version of certmonger don't support the `-v` option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Do not print an error, if CA already existsAndreas Schneider1-2/+6
We will get an exit status for duplicate in future: https://www.pagure.io/certmonger/issue/269 We can't really fix that right now, as older version of certmonger don't support the `-v` option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Improve logging for certificate enrollmentAndreas Schneider1-1/+10
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Avoid path check for cepces-submitAndreas Schneider1-2/+2
find_cepces_submit() uses which(), which returns None if not found. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-26python:tests/rpcd_witness_samba_only: add tests for 'net witness force-response'Stefan Metzmacher1-3/+164
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26python:tests/rpcd_witness_samba_only: add tests for 'net witness ↵Stefan Metzmacher1-0/+34
force-unregister' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26python:tests/rpcd_witness_samba_only: add tests for 'net witness ↵Stefan Metzmacher1-5/+212
{client,share}-move' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26python:tests/rpcd_witness_samba_only: add tests for 'net witness list'Stefan Metzmacher1-0/+477
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26python/blackbox: add rpcd_witness_samba_only.py testStefan Metzmacher2-0/+461
This tests the witness service and its interaction with ctdb. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26python/tests: add TestCase.get_loadparm(s3=True) supportStefan Metzmacher1-5/+9
This will be used for tests with registry shares, as the top level loadparm system doesn't support them. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-23gp: Skip site GP list if no site is foundDavid Mulder1-12/+18
[MS-GPOL] 3.2.5.1.4 Site Search says if the site search returns ERROR_NO_SITENAME, the GP site search should be skipped. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jan 23 11:20:35 UTC 2024 on atb-devel-224
2024-01-22gpo: Do not get templates list on first runGabriel Nagy1-1/+2
This is a visual fix and has no impact on functionality apart from cleaner log messages. The point of this is to get the list of supported templates in order to compute a diff between the current applied templates and the updated list, so we are able to unapply and reapply the policy in case there are differences. However this code path is executed on first applies as well, at which point the root CA is not yet set up. This causes the `get_supported_templates` call to fail, which is not a hard failure but still pollutes the logs. In this case it's safe to avoid executing the command as the policy will be applied regardless. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 22 16:48:57 UTC 2024 on atb-devel-224
2024-01-22gpo: Decode base64 root cert before importingGabriel Nagy1-2/+3
The reasoning behind this is described in the previous commit message, but essentially this should either be wrapped in certificate blocks and imported as PEM, or converted back to binary and imported as DER. I've opted for the latter since it's how it used to work before it regressed in 157335ee93e. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15557 Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-01-22gpo: Test certificate policy without NDESGabriel Nagy1-6/+120
As of 8231eaf856b, the NDES feature is no longer required on Windows, as cert auto-enroll can use the certificate from the LDAP request. However, 157335ee93e changed the implementation to convert the LDAP certificate to base64 due to it failing to cleanly convert to a string. Because of insufficient test coverage I missed handling the part where NDES is disabled or not reachable and the LDAP certificate was imported. The call to load_der_x509_certificate now fails with an error because it expects binary data, yet it receives a base64 encoded string. This adds a test to confirm the issue. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15557 Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-01-15python: Generate HRESULT definitions automaticallyJoseph Sutton5-12/+9
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Joseph Sutton <jsutton@samba.org> Autobuild-Date(master): Mon Jan 15 01:56:53 UTC 2024 on atb-devel-224
2024-01-10python:gp: Print a nice message if cepces-submit can't be foundAndreas Schneider1-11/+13
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15552 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 10 09:54:34 UTC 2024 on atb-devel-224
2023-12-22tests/krb5: Raise an error if root key data is the wrong lengthJoseph Sutton1-0/+7
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-22tests/krb5: Test that root key data is the correct length in bytesJoseph Sutton2-6/+25
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-22tests/krb5: Create root key just for implicit root key testsJoseph Sutton1-22/+22
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-22tests/krb5: Check properties of current GKDI keyJoseph Sutton1-1/+5
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21tests/krb5: Add Python implementation and tests for Group Key Distribution ↵Joseph Sutton3-0/+1757
Service Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Dec 21 21:19:30 UTC 2023 on atb-devel-224
2023-12-21python: Add NT Time utility functionsJoseph Sutton1-0/+60
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21pyglue: Export some more HRESULT constantsJoseph Sutton1-0/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python:tests: Catch strings passed to utf16_encoded_len() with embedded nullsJoseph Sutton1-0/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21gkdi.idl: Add ‘additional_info’ field to KeyEnvelope structureJoseph Sutton1-2/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21tests/krb5: Remove redundant definitionsJoseph Sutton3-32/+5
These items are already defined elsewhere. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python:tests: Don’t needlessly create single‐element tupleJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python:tests: Rename parameter to be consistent with overridden methodJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python:tests: Raise exception of more specific type NotImplementedErrorJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21python:tests: Use ‘False’ in boolean expression rather than ‘None’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21selftest: Add tests for "samba-tool user get-kerberos-ticket"Andrew Bartlett1-0/+195
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21python/netcmd: Improve documentation for "samba-tool user getpassword"Andrew Bartlett1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21python/netcmd: Add "samba-tool user get-kerberos-ticket" to get a ticket for ↵Andrew Bartlett4-3/+153
a gMSA Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21python: tests: blackbox test for GMSARob van der Linde1-0/+171
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: document that -H can be used with gMSA accountsRob van der Linde1-2/+9
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: fix some grammar in getpassword docstringsRob van der Linde1-5/+5
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Make samba-tool user getpassword support a ';previous=1' optionAndrew Bartlett1-11/+32
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool user getpassword: Prepare to support a ;previous=1 option, change ↵Andrew Bartlett1-1/+1
behaviour for ;rounds= This will return the previous password, but the pattern is to include the option in the returned attribute name, so we need to use vatter["raw_attr"], not 'a'. This changes the behaviour for the ;rounds= option used when we hold the plaintext password (possibly under GPG encryption). This is now consistant with other parameters in the LDAP attribute, and is now included in the returned attribute name. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21selftest: Modify expected output of 'samba-tool user getpassword' to be more ↵Andrew Bartlett2-48/+50
consistant This is consistant with ;format= support for time attributes and other users of this parameter style elsewhere in LDAP. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21selftest: fix failing user setpassword testRob van der Linde1-2/+2
A side effect of being able to generate at read time unicodePwd for a gMSA is that we can also generate the unicodePwd from a virtualSambaGPG password. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Add support for getting the generated unicodePwd for a gMSA accountAndrew Bartlett1-0/+10
This pre-hashed value may be more practical to use than the random "UTF-16" password. In particular it is easy to compare with the DB values. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21netcmd: user: samba-tool support to allow non-windows use of GMSA accounts ↵Rob van der Linde1-3/+13
(show password) Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool user getpassword: Use UTF16_MUNGED charcnv to map "UTF16" to UTF8Andrew Bartlett2-10/+11
This copes with random invalid UTF-16 as seen with gMSA accounts. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21samba-tool: Prepare to allow samba-tool user getpasswords to operate against ↵Andrew Bartlett3-29/+32
a remote server While passwords are not normally available for read, Group Managed Service Account passwords are, as this is how they are distributed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21netcmd: models: add object sid field to User modelRob van der Linde1-1/+2
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21netcmd: getpassword: print OK message on stderrRob van der Linde5-16/+6
This makes it easier to machine parse the output in tests Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21selftest: Avoid assertTrue() and assertFalse() where a better test existsAndrew Bartlett1-39/+39
This allows the unittest framework to show the strings that the value was not found in. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-12-21selftest: require named parameters for callers of connect_samdb() and ↵Rob van der Linde1-4/+5
connect_samdb_ex() Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 00:16:52 +0000