summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2023-06-25tests/krb5: Improve authentication policy creationJoseph Sutton3-769/+342
Don’t require passing in an ID to create an authentication policy. Instead, have create_authn_policy() generate one for us. We now return an actual AuthenticationPolicy object rather than just a DN. This will give the tests more details to work with about the policies. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25netcmd: domain: add error handling to domain claims commandsRob van der Linde2-15/+42
Similar to the auth commands commit prior to this. Where we wre catching LdbError before we now catch ModelError, all exceptions that are known and handled in the model layer will have a user-friendly error message. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add error handling to domain auth commandsRob van der Linde5-54/+118
Where we wre catching LdbError before we now catch ModelError, all exceptions that are known and handled in the model layer will have a user-friendly error message. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add model exceptions and error handlingRob van der Linde3-15/+88
* Only handle what we know, otherwise raise the existing LdbError * Cutom messages added in the model layer so we don't have to do it in the commands themselves Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: model stores ldb message for saveRob van der Linde1-3/+9
The message is stored in self._apply which also gets called by self.refresh() This is the better thing to do than fetching in save. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: silo member command testsRob van der Linde2-0/+147
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: model field testsRob van der Linde1-0/+332
Add tests for model fields to ensure they behave as expected when calling from_db_value and to_db_value methods. Add a base class for the tests themselves via a mixin as unittest doesn't support abstract test case classes. For each field, from_db_value and to_db_value must either be a list or a property that returns a list. The list contains input values and expected values, the expected value can also be a callback for more complex comparison, this is used for the possible claim values xml. It is important that singular values and list values are tested, and also None to ensure that fields properly get unset when a model is saved. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: silo member add and remove does not write whole listRob van der Linde2-22/+49
Writing the whole list at once can lead to data loss if multiple administrators are doing this at the same time. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: remove parse_guid and parse_text as they are no longer usedRob van der Linde1-15/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: base class is no longer requiredRob van der Linde3-70/+34
base.py has been removed as this has all been moved to the model layer as the auth commands ldb is now just a local variable Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: move claim value type lookup by attribute to modelRob van der Linde2-34/+41
Also, there was no need for the cached property previously in the command, as the command only calls this once. Fetching all value types seems excessive now with the new model layer, we just fetch the one we need and get a model object back. Use the method lookup, it's consistent with the rest, and raise either LookupError or ValueError. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: make use of AttributeSchema and ClassSchema modelsRob van der Linde2-44/+10
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add models for ClassSchema and AttributeSchemaRob van der Linde2-0/+125
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: auth silos: remove base classRob van der Linde4-107/+72
There is no point to the base class anymore. And since the model layer has dramatically simplified the code in the commands, ldb can just be a local variable. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add test for silo if policy is a dnRob van der Linde1-0/+17
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: move get_policy method from base class to the modelRob van der Linde3-23/+71
There isn't much left of the base class, the next thing is to remove it. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: move method print_json to command base classRob van der Linde3-24/+11
This is used in quite a few commands, move to base class. This ensures the correct encoder class and settings are always used, and they are only defined in one place. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: fix import sort/grouping as per python standardRob van der Linde1-4/+5
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: move ldb_connect method to base classRob van der Linde3-18/+9
This method is needed by just about every command and moving it here is another step towards elinimanting the base classes in domain/auth and domain/claim. The base classes are almost empty now, since introducing the model layer. The next step is to get rid of these base classes completely. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: PEP257 fix incorrect docstring quotesRob van der Linde1-1/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: use consistent naming for optionsRob van der Linde2-32/+29
The name of the option should be the same as the attribute name. You can still tell where it's being used (display_name), especially now with the model layer: ClaimType.get(ldb, display_name=name) The silo commands tend to use the `cn` field, while the claims commands use the `displayName` field, but the option is always called `name` for consistency. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claim commands use the model layerRob van der Linde4-240/+94
This makes it consistent with the auth silo code, both should now make use of the models. Claims commands are now using the model layer with one exception and that is the get_attribute_from_schema and get_class_from_schema methods in the base class. These will be made into models in another commit. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: fix claims constant name was wrong should be claim type CNRob van der Linde1-3/+3
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: fix attributes created by test setUp methodRob van der Linde1-6/+14
Discovered this while converting the claims cli commands to use the models, some tests failed. The reason for this was that they relied on the attributes in the list ATTRIBUTES to exist. However, then we have to also prefix the attributes we create in the test_claim_type_create test. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claim: show err if assertIsNone failsRob van der Linde1-28/+28
Other tests do this too, this is very useful if things fail Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: rename claim tests for consistencyRob van der Linde1-0/+0
The domain_auth tests are also prefixed with domain, it matches the cli command "samba-tool domain claim". Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: tests for auth silo command line toolsRob van der Linde3-0/+1226
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add authentication silo commandsRob van der Linde6-0/+1077
Authentication policies: * samba-tool domain auth policy list * samba-tool domain auth policy view * samba-tool domain auth policy create * samba-tool domain auth policy modify * samba-tool domain auth policy delete Authentication silos: * samba-tool domain auth silo list * samba-tool domain auth silo view * samba-tool domain auth silo create * samba-tool domain auth silo modify * samba-tool domain auth silo delete Authentication silo members: * samba-tool domain auth silo member list * samba-tool domain auth silo member add * samba-tool domain auth silo member remove Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: add domain models and basic model layerRob van der Linde9-0/+1167
The ORM is somewhat inspired by Django, but it has some key differences that make it work better with the Ldb database. A field can be a singular value or a list, so a BooleanField can either be True, or [True, False, True], or None. The only thing that many=True does is say that the field "prefers" to be a list, but really any field can be a list. For example when creating a new object, it initialises the field as an empty list rather than None if many=True. When saving an object, if it is an update operation, only write the fields that have actually changed. When updating an object, any fields that are unset (set to None, or an empty list) will be treated as a REMOVE operation. Note that silo members should not be saved this way, writing the whole list can lead to data loss if multiple admins are saving the silo at the same time. Silo members will need to be handled differently, just removing one member but not writing the whole list. Unlike Django, there is no .objects class, instead there are a bunch of static methods for querying: * Model.get * Model.query * Model.create * Model.get_or_create Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: add custom json encoder for object type fieldsRob van der Linde1-0/+49
The custom JSONEncoder class is also capable of encoding Dn objects to str, and any object that has a __json__ method. The __json__ method is not an official dunder method, but this has been used by other frameworks too (like Pyramid). Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: add optparse validators and Range validatorRob van der Linde2-0/+105
Add the ability to the add validators to optparse Option fields. The Option class was already subclassed in `netcmd/__init__.py` so adding some functionality to this was relatively easy. Added the ability to add Validator classes to a field so that this can be used for anything else in the future, but for now there is a Range validator required by upcoming auto silo commands. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-23python:samba: Fix code spellingAndreas Schneider13-24/+24
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2023-06-23python:samba:tests: Fix code spellingAndreas Schneider33-56/+58
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:subunit: Fix code spellingAndreas Schneider2-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:samba3: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:provision: Fix code spellingAndreas Schneider3-10/+10
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:netcmd: Fix code spellingAndreas Schneider14-30/+31
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:kcc: Fix code spellingAndreas Schneider4-21/+21
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:gp_parse: Fix code spellingAndreas Schneider2-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:gp: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:emulate: Fix code spellingAndreas Schneider1-5/+5
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool/ntacl: implement set --recursiveStefan Metzmacher1-1/+16
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool/ntacl: add set --verbose and print out the file/directory nameStefan Metzmacher1-13/+27
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool/ntacl: don't announce -q,--quiet in --help as it's not used at allStefan Metzmacher1-1/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool/ntacl: let changedomsid ignore symlinksStefan Metzmacher1-13/+24
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool: print default (domain) for --dns-directory-partition option in ↵Björn Baumbach1-1/+1
help message Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21tests/krb5/s4u_tests.py: add test_constrained_delegation_authtimeStefan Metzmacher1-2/+32
This demonstrates that we use the correct authtime when doing constrained delegation. The actual fix for the problem is already in place via commit 75ec66c729faad60fa18b9504ba4053b3e2f47bc third_party/heimdal: Import lorikeet-heimdal-202306091507 (commit 7d8afc9d7e3d309ddccc2aea6405a8ca6280f6de) The related patch is: 006a365a6aa3047a4e685e1607973746a28cc1f1 kdc: use the correct authtime from addtitional ticket for S4U2Proxy tickets BUG: https://bugzilla.samba.org/show_bug.cgi?id=13137 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21tests/krb5/s4u_tests.py: add ↵Stefan Metzmacher1-3/+89
test_constrained_delegation_with_enc_auth_data_[no_]subkey() This demonstrates that we use the correct key for EncAuthorizationData together with constrained delegation. The actual fix for the problem is already in place via commit 75ec66c729faad60fa18b9504ba4053b3e2f47bc third_party/heimdal: Import lorikeet-heimdal-202306091507 (commit 7d8afc9d7e3d309ddccc2aea6405a8ca6280f6de) The related patches are: 38c47c54f0c78fed5afc1aea9c5f6683e06ec842 kdc: fix memory leak when decryption AuthorizationData 61c0089ea3f5387953818a3ac99fb529244196e6 kdc: decrypt b->enc_authorization_data in tgs_build_reply() fed5579814108ee90f701ca6bfb5500f7d839bc4 kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use the keys from evidence_tkt BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool: let 'domain level raise' call check_and_update_fl() in a transactionStefan Metzmacher1-2/+22
This makes it possible to raise the levels without starting 'samba' first, which is very useful for blackbox tests. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-21samba-tool: move some parts of 'domain level [show|raise]' in to subfunctionsStefan Metzmacher1-4/+17
This will make it easier to use transactions in the following changes... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 20:39:17 +0000