summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2022-05-05selftest: Run some tests in the ad_dc_no_ntlm environment to show expected ↵Andrew Bartlett1-4/+12
behaviour Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-05-05samba-tool user: Consistently return a tupleJoseph Sutton1-1/+1
We would get an error when get_userPassword_hash() returned None, as get_virtual_crypt_value() would try to unpack the result as a 2-element tuple. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05samba-tool user: Remove unused importsJoseph Sutton1-4/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05samba-tool tests: Remove unused variableJoseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-03gpo: Add Cert Auto Enroll Advanced ConfigDavid Mulder1-13/+183
Advanced configuration for Certifcate Auto Enrollment is stored on the sysvol, and needs to be parsed/used when provided. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue May 3 21:48:57 UTC 2022 on sn-devel-184
2022-05-03gpo: Test Cert Auto Enroll Advanced ConfigDavid Mulder2-1/+279
Adds advanced configuration to the testing of certificate auto enrollment. Currently fails. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-05-03gpo: Generalize Cert Auto Enroll CA dataDavid Mulder1-17/+19
This will simplify fetching CAs from the Registry.pol in a follow up commit. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-05-03gpo: Fix crash in Cert Auth Enroll RSOPDavid Mulder1-0/+2
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-05-03gpo: Certificate Auto Enroll correctly check templatesDavid Mulder1-9/+4
[MS-CAESO] 4.4.5.3.2.4 and 4.4.5.3.2.4.2 explain to fetch templates via cep, then to gather attrs for the templates after. This code was reversed. This will matter when implementing advanced endpoint configuration. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-05-03gpo: Correct CA Initilization to obey [MS-CAESO]David Mulder1-14/+16
fetch_certification_authorities() did not correctly obey the [MS-CAESO] spec. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-04-21python/samba/tests: add SMBConfTests suiteJohn Mulligan1-0/+102
Add an initial suite of tests for the smbconf python bindings. Currently only simple read-only methods are available. Signed-off-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Thu Apr 21 15:33:38 UTC 2022 on sn-devel-184
2022-04-13python:tests: Add krb5 tests for asserted identityAndreas Schneider1-9/+106
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org>
2022-04-13python:tests: Reorder variablesStefan Metzmacher1-15/+12
Those will be needed earlier in the next commit. Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
2022-04-13python:tests: Add support for unexpected groups in krb5 testsAndreas Schneider2-1/+21
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-04-13python:tests: Add support for expected groups in krb5 testsAndreas Schneider2-1/+28
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-04-13python:tests: Allow to print krb5 encryption keys as stringStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-04-13python:tests: Add support to print krb5 keys as stringStefan Metzmacher1-1/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-04-13python:tests: Check code error code in test_s4u2self_rodc_revealedAndreas Schneider1-1/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-04-13python:tests: Fix standalone run of kdc_tgs_testsStefan Metzmacher1-3/+3
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-04-08selftest: Add a test for PamLogOffSamuel Cabrero2-0/+102
This test also verifies the KRB5CCNAME environment variable is set after a successful PAM authentication with Kerberos. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-04-05gpo: Improve Certificate Auto Enroll Debug messagesDavid Mulder1-4/+6
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Apr 5 01:44:33 UTC 2022 on sn-devel-184
2022-04-05gpo: Certificate Auto Enrollment default Kerberos authDavid Mulder2-3/+6
Certificate Auto Enrollment uses Kerberos to authenticate to AD. If someone configures their cepces.conf to use a different default authentication, then samba-gpupdate fails. Force Kerberos auth from samba-gpupdate. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-03-30python/join: improve logging of join_replicate()Stefan Metzmacher1-2/+3
It's useful to have timestamps to see the time used for replication and committing. We also warn the user that the committing stage may take some time. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool: Check specified domain and realm against our ownJoseph Sutton3-17/+40
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Mar 28 03:11:51 UTC 2022 on sn-devel-184
2022-03-28samba-tool: Return correct result for _get_user_realm_domain()Joseph Sutton1-2/+2
We were returning the realm and the domain in the wrong order. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Clarify msDS-AllowedToDelegateTo delegation command ↵Joseph Sutton1-2/+2
documentation This makes the difference between msDS-AllowedToDelegateTo and msDS-AllowedToActOnBehalfOfOtherIdentity more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Add commands to add/remove principals for RBCDJoseph Sutton1-1/+275
These commands allow updating the msDS-AllowedToActOnBehalfOfOtherIdentity attribute with principals allowed to delegate to an account. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation show: Display information for RBCDJoseph Sutton1-2/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Add function to display security descriptor for RBCDJoseph Sutton1-0/+77
We also check some features of the security descriptor, and display warnings if they are not as expected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-24samba-gpupdate: Implement enhanced loggingDavid Mulder16-162/+223
This ports the enhanced logging capabilities from AltLinux gpupdate. It generates log messages such as: 2022-03-02 11:28:54.872|[E40104]| Failed to set interfaces for zone | {'val': 'work'} 2022-03-02 11:28:55.017|[E40104]| Failed to set interfaces for zone | {'val': 'home'} Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Mar 24 23:40:47 UTC 2022 on sn-devel-184
2022-03-18samba-tool group: Add --special parameter to add predefined special groupJoseph Sutton1-3/+194
This allows default security groups that have been added since Windows Server 2008 R2, such as Protected Users, to be created in pre-existing domains. An error message is generated if a group already exists with the same name, DN, or SID. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Add tests for the Protected Users groupJoseph Sutton4-20/+1334
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Add helper function to modify ticket flagsJoseph Sutton3-30/+19
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Remove unused importJoseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Add account to cleanup list before adding it to databaseJoseph Sutton1-3/+2
This ensures accounts are still cleaned up if a test fails before adding it to the cleanup list. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Add more encryption type constantsJoseph Sutton1-0/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Remove accounts in reverse order of additionJoseph Sutton1-4/+4
This prevents problems if accounts are added as children of other accounts. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/krb5: Simplify logicJoseph Sutton1-5/+5
This code can be made part of the previous 'else' branch. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Joseph Sutton <jsutton@samba.org> Autobuild-Date(master): Fri Mar 18 00:11:25 UTC 2022 on sn-devel-184
2022-03-17tests/krb5: Improve mock RODC creationJoseph Sutton1-9/+11
Use a unique name for the mock RODC. Don't assign to _rodc_ctx until the RODC has been created, so we don't try to use a mock RODC that failed to create. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-03-17python: Restore SDDL abbreviations for SIDsJoseph Sutton2-8/+8
This time we use the correct values. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17python: Use explicit SIDs instead of SDDL abbreviationsJoseph Sutton2-11/+11
This is to prepare for changing the SDDL string values. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17python:tests: Add tests for SDDL SID stringsJoseph Sutton1-0/+235
We get the server to decode the SDDL by putting the SID strings in the defaultSecurityDescriptor of a new class and making an object of that class. We then check that the resulting SID is what we expect. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17selftest: Remove auth_log test for RAP password changeAndrew Bartlett1-29/+0
RAP is SMB1, the password change routine requires LM hashes and so everything here is going away or has now gone, so remove the test. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17ntlm_auth: Adapt --diagnostics mode to expect that the DC does not support ↵Andrew Bartlett1-0/+13
LANMAN by default Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17selftest: Allow samba.tests.ntlm_auth to fail rather than error checking ↵Andrew Bartlett1-1/+5
--diagnostics This allows a knownfail entry to be written for this test. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17python/ntacls.py: Fix ACE type comparisonJoseph Sutton1-1/+2
SEC_ACE_TYPE_ values are not flags, so this comparison does not behave as intended. Modify the check to more closely match the one in gp_create_gpt_security_descriptor(). Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-17samba-tool: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-17python:tests: Fix type error in raw_testcase.pyAndreas Schneider1-1/+5
This fixes a lot of tests with Python 3.8. Stacktrace example: File "python/samba/tests/krb5/as_req_tests.py", line 249, in test_as_req_enc_timestamp_rc4_dummy self._run_as_req_enc_timestamp( File "python/samba/tests/krb5/as_req_tests.py", line 129, in _run_as_req_enc_timestamp as_rep, kdc_exchange_dict = self._test_as_exchange( File "python/samba/tests/krb5/raw_testcase.py", line 3982, in _test_as_exchange rep = self._generic_kdc_exchange(kdc_exchange_dict, File "python/samba/tests/krb5/raw_testcase.py", line 2029, in _generic_kdc_exchange return check_rep_fn(kdc_exchange_dict, callback_dict, rep) File "python/samba/tests/krb5/raw_testcase.py", line 2328, in generic_check_kdc_rep self.check_reply_padata(kdc_exchange_dict, File "python/samba/tests/krb5/raw_testcase.py", line 2998, in check_reply_padata got_patypes = tuple(pa['padata-type'] for pa in rep_padata) TypeError: 'NoneType' object is not iterable This adds additional checks for rep_padata. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-03-10python:tests: let insta_creds() also copy the bind_dn from the templateStefan Metzmacher1-0/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-04s4:mitkdc: Add support for MIT Kerberos 1.20Andreas Schneider1-2/+7
This also addresses CVE-2020-17049. MIT Kerberos 1.20 is in pre-release state at the time writing this commit. It will be released in autumn 2022. We need to support MIT Kerberos 1.19 till enough distributions have been released with MIT Kerberos 1.20. Pair-Programmed-With: Robbie Harwood <rharwood@redhat.com> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Stefan Metzmacher <metze@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 12:11:35 +0000