
    gsi                     8   S SK Jr  S SKrS SKJr  S SKJr  S SKJr  S SK	J
r
  S SKJr  S SKJrJr  S SKJr  S S	KJrJrJrJr   " S
 S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      rg)    N)	provision)dsdb)SamDB)system_session)security)ndr_pack
ndr_unpack)_get_user_realm_domain)CommandCommandErrorSuperCommandOptionc            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rS rSS jrSrg)cmd_delegation_show&   z*Show the delegation setting of an account.z%prog <accountname> [options]	sambaoptscredoptsversionopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestaccountnamec                 6   UR                   nUR                  nSnUb  U[        R                  -  (       d   U R                  R                  SU S35        g U[        R                  -  (       d   U R                  R                  SU S35        g SnUR                   GH4  nUR                  n UR                  SU S3[        R                  S	9n	[        U	5      S
:X  a  U	S   R                  nSnUR                  [        R"                  :X  d  UR                  [        R$                  :X  a%  U R                  R                  SU SU S35        SnO>UR                  [        R&                  :w  a   UR                  [        R(                  :w  a  SnUR*                  [        R,                  -  nUR*                  [        R.                  -  nUR*                  [        R0                  -  nUR*                  [        R2                  -  nU(       a  U(       d
  U(       d  SnOVU(       a$  U R                  R                  SU SU S35        SnU(       a$  U R                  R                  SU SU S35        SnUR4                  (       d  SnU(       a  GM  U(       a  U R6                  R                  S5        SnU R6                  R                  SU S35        GM7     g ! [        R                   a.  n
U
R                  u  pU[        R                   :w  a  e  S n
A
GN&S n
A
ff = f)NzISecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentityzWarning: DACL not present in z!
zWarning: DACL in z lacks SELF_RELATIVE flag!
Tz<SID=>)scope   r   FzWarning: ACE in z denies access for trustee zWarning: ACE for trustee z. has unexpected CONTAINER_INHERIT flag set in z* has unexpected INHERITED_ACE flag set in z0  Principals that may delegate to this account:
z*msDS-AllowedToActOnBehalfOfOtherIdentity: 
)daclr   r   SEC_DESC_DACL_PRESENTerrfwriteSEC_DESC_SELF_RELATIVEacestrusteesearchldb
SCOPE_BASElendnLdbErrorargsERR_NO_SUCH_OBJECTSEC_ACE_TYPE_ACCESS_DENIED!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWED"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTflagsSEC_ACE_FLAG_INHERIT_ONLYSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSEC_ACE_FLAG_INHERITED_ACEaccess_maskoutf)selfsamsecurity_descriptorr&   	desc_typewarning_infofirstacer,   reserrnum_ignoreinherit_onlyobject_inheritcontainer_inheritinherited_aces                     9/usr/lib/python3/dist-packages/samba/netcmd/delegation.pyshow_security_descriptor,cmd_delegation_show.show_security_descriptor8   s   "''',,	C <y8+I+IIIIOO;L>MN8:::IIOO/~ >4 5 699CkkG	(jj5	!3'*~~ ! 7 s8q=!!fiiGFH???xx8#M#MM		"2<. A66=Yc!C D ((hBBBH$O$OO99x'I'IIL YY)M)MMN		HCCC II(K(KKMN;L $IIOO&?y IP'3nC%9 : "F IIOO&?y IL'3nC%9 : "F??6IIOO %1 2!E		"L#*)2!/ 0{  << #000 1s   -"KL*#LLNc                    UR                  5       nUR                  U5      nUc2  [        R                  " XfR	                  S5      5      nUR
                  n	OUn	[        U	[        5       XvS9n
[        UU
5      u  pnU
R                  S[        R                  " U5      -  [        R                  / SQS9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        US   R	                  S
5      S   5      nUS   R	                  S5      nUS   R	                  SSS9nU R                   R#                  S[%        US   R&                  5      -  5        U R                   R#                  S[)        U[*        R,                  -  5      -  5        U R                   R#                  S[)        U[*        R.                  -  5      -  5        U(       aB  U R                   R#                  S5        U H!  nU R                   R#                  SU-  5        M#     Ub.   [1        [2        R4                  U5      nU R7                  U
U5        g g ! [8         a    U R:                  R#                  S5         g f = f)Nrealmsession_infocredentialslpsAMAccountName=%s)userAccountControlmsDS-AllowedToDelegateTo(msDS-AllowedToActOnBehalfOfOtherIdentity
expressionr#   attrsr    Unable to find account name '%s'r$   Found multiple accounts.rZ   r[   r\   idxzAccount-DN: %s
zUF_TRUSTED_FOR_DELEGATION: %s
z.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s
z)  Services this account may delegate to:
zmsDS-AllowedToDelegateTo: %s
znWarning: Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity could not be unmarshalled!
)get_loadparmget_credentialsr   provision_paths_from_lpgetsamdbr   r   r
   r-   r.   binary_encodeSCOPE_SUBTREEr0   r   intr?   r)   strr1   boolr   UF_TRUSTED_FOR_DELEGATION)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONr	   r   
descriptorrQ   RuntimeErrorr(   )r@   r    r   r   r   r   rX   credspathspathrA   cleanedaccountrT   domainrG   uacallowedallowed_fromarB   s                       rP   runcmd_delegation_show.run   sA   ##%((,955b&&/JE;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 L  M
 s8q=AKOPPX]9::#a&**12156a&**781vzz"LRSzT		*SQ^;<		9sT%C%CCDE 	F		IS4#Q#QQRS 	T IIOOHI		 @1 DE #H&01D1Dl&S# --c3FG $   @		 !? @@s   "I %I87I8 NNNN)__name__
__module____qualname____firstlineno____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   rl   takes_options
takes_argsrQ   r{   __static_attributes__r}       rP   r   r   &   se    4.H ))..-- 	tW#JQT3	(M
  JP0d1Hr   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_for_any_service   z3Set/unset UF_TRUSTED_FOR_DELEGATION for an account.(%prog <accountname> [(on|off)] [options]r   r   r   r   r   r   r   r    onoffNc                    US:X  a  SnOUS:X  a  SnO[        SU-  5      eUR                  5       nUR                  U5      n	[        R                  " XR                  S5      5      n
Uc  U
R                  nOUn[        U[        5       XS9n[        UU5      u  pnS[        R                  " U5      -  n[        R                  n UR                  UUS	USS
9  g ! [         a  n[        U5      eS nAff = f)NonToffF0invalid argument: '%s' (choose from 'on', 'off')rT   rU   rY   zTrusted-for-Delegation	flags_strr   strict)r   rd   re   r   rf   rg   rh   r   r   r
   r.   ri   r   rn   toggle_userAccountFlags	Exceptionr@   r    r   r   r   r   r   r   rX   rr   rs   rt   rA   ru   rT   rv   search_filterflagrH   s                      rP   r{   "cmd_delegation_for_any_service.run   s    D=Be^BQTYYZZ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' ,c.?.?.OO--	$''t2J+-d ( <  	$s##	$s   C 
C3#C..C3r}   r~   r   r   r   r   r   r   r   r   r   r   r   r   rl   r   r   r{   r   r}   r   rP   r   r      sf    =9H ))..-- 	tW#JQT3	(M
  )JGK $r   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_for_any_protocol   zOSet/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.r   r   r   r   r   r   r   r   r    r   Nc                    SnUS:X  a  SnOUS:X  a  SnO[        SU-  5      eUR                  5       nUR                  USS9n	[        R                  " XR                  S5      5      n
Uc  U
R                  nOUn[        U[        5       XS9n[        UU5      u  pnS	[        R                  " U5      -  n[        R                  n UR                  UUS
USS9  g ! [         a  n[        U5      eS nAff = f)NFr   Tr   r   )fallback_machinerT   rU   rY   z&Trusted-to-Authenticate-for-Delegationr   )r   rd   re   r   rf   rg   rh   r   r   r
   r.   ri   r   ro   r   r   r   s                      rP   r{   #cmd_delegation_for_any_protocol.run  s    D=Be^BQTYYZZ##%((d(C11"ffWoF9;;DDD~'7 %. +AAD+F' ,c.?.?.OO==	$''t2Z+-d ( <  	$s##	$s   C 
C4$C//C4r}   r~   r   r}   r   rP   r   r      sf    Y9H ))..-- 	tW#JQT3	(M
  )JGK!$r   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_add_servicei)  zZAdd a service principal to msDS-AllowedToDelegateTo so that an account may delegate to it.)%prog <accountname> <principal> [options]r   r   r   r   r   r   r   r    	principalNc                    UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       XS9n[        UU5      u  pnUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        R                  " 5       nUS   R                   Ul        [        R"                  " U/[        R$                  S5      US'    UR'                  U5        g ! [(         a  n[        U5      eS nAff = f
NrT   rU   rY   r[   r]   r   r`   r$   ra   )rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   Messager1   MessageElementFLAG_MOD_ADDmodifyr   r@   r    r   r   r   r   r   rX   rr   rs   rt   rA   ru   rT   rv   rG   msgrH   s                     rP   r{   cmd_delegation_add_service.run;  sT    ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPPX]9::kkmQ*-*<*<i[=@=M=M=W+Y&'	$JJsO 	$s##	$   =E 
E)E$$E)r}   r~   r   r}   r   rP   r   r   )  sf    d:H ))..-- 	tW#JQT3	(M
  -JKO#$r   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_del_serviceia  ziDelete a service principal from msDS-AllowedToDelegateTo so that an account may no longer delegate to it.r   r   r   r   r   r   r   r   r    r   Nc                    UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       XS9n[        UU5      u  pnUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        R                  " 5       nUS   R                   Ul        [        R"                  " U/[        R$                  S5      US'    UR'                  U5        g ! [(         a  n[        U5      eS nAff = fr   )rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r   r1   r   FLAG_MOD_DELETEr   r   r   s                     rP   r{   cmd_delegation_del_service.runs  sT    ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPPX]9::kkmQ*-*<*<i[=@=P=P=W+Y&'	$JJsO 	$s##	$r   r}   r~   r   r}   r   rP   r   r   a  sf    s:H ))..-- 	tW#JQT3	(M
  -JKO#$r   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_add_principali  z\Add a principal to msDS-AllowedToActOnBehalfOfOtherIdentity that may delegate to an account.r   r   r   r   r   r   r   r   r    r   Nc           
        ^ UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       XS9n[        X5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S	:w  a  [        S
5      eUS   R	                  SSS9nUc~  [        R                   " [        R"                  5      n[        R$                  " 5       n[        R&                  Ul        [        R*                  [        R,                  -  Ul        UUl        S nO' [3        [        R$                  U5      nUR6                  nUc1  [        R8                  " 5       n[        R:                  Ul        SUl        [        X+5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S	:w  a  [        S
5      e[        R                   " UR?                  SUS   R	                  SSS95      RA                  S5      5      mURB                  n[E        U4S jU 5       5      (       a  [        SU SU S35      e[        RF                  " 5       n[        RH                  Ul        SUl%        [        RL                  Ul'        TUl(        URS                  U5        UUl!        U=R<                  S	-  sl        UUl        [U        U5      n[        RV                  " 5       nUS   RX                  Ul,        Ub)  [        RZ                  " U[        R\                  S5      US'   [        RZ                  " U[        R^                  S5      US'    URa                  U5        g ! [4         a    [        SU S35      ef = f! [        Rb                   aB  nURd                  u  nnU[        Rf                  :X  a  [        SU S35      e[        U5      eS nAff = f)NrT   rU   rY   r\   r]   r   zUnable to find account name ''r$   ra   rb   WSecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account '' could not be unmarshalled!	objectSidUnable to find principal name '	objectSIDutf-8c              3   @   >#    U  H  oR                   T:H  v   M     g 7f)N)r,   ).0rF   	princ_sids     rP   	<genexpr>3cmd_delegation_add_principal.run.<locals>.<genexpr>  s     84C{{i'4s   zACE for principal 'zl' already present in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ''.01RRefused to update attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ':': a conflicting attribute update occurred simultaneously.)4rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r   dom_sidSID_BUILTIN_ADMINISTRATORSrp   SD_REVISIONrevisionr'   r*   r   	owner_sidr	   rq   r&   aclSECURITY_ACL_REVISION_ADSnum_acesschema_format_valuedecoder+   anyrF   r7   r9   SEC_ADS_GENERIC_ALLr>   r,   appendr   r   r1   r   r   r   r   r2   r3   ERR_NO_SUCH_ATTRIBUTE)r@   r    r   r   r   r   r   rX   rr   rs   rt   rA   ru   rJ   account_resdatar   security_descr&   cleanedprinc	princ_resr+   rF   new_datar   rH   rI   r   s                              @rP   r{    cmd_delegation_add_principal.run  s3    ##%((,11"ffWoF9;;DDD~'7 %.  6kG1jj*n-.##=>	 ! @
 {q !>{m1MNN"9::1~!!6A " ?< (()L)LMI$//1M%-%9%9M""*"@"@"*"A"A#BM&/M#D5 *8+>+> E !%%D<<<>D$>>DMDM 4ICaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN^q 9::$$##!  ! 466<fWoG	
 yy 84888%i[ 1  =$% % lln77	"66C	!M*
 kkmQ""))c)):<CH %%c&&68C	(JJsOO   5" &33>- @3$4 5 55P || 		(XXFCc///"#} %/01 1 #3''		(s$    O3 !P 3PQ&$=Q!!Q&r}   r~   r   r}   r   rP   r   r     sf    f:H ))..-- 	tW#JS	2M
  -JKO|(r   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)cmd_delegation_del_principali*  zkDelete a principal from msDS-AllowedToActOnBehalfOfOtherIdentity that may no longer delegate to an account.r   r   r   r   r   r   r   r   r    r   Nc           
      .   UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       XS9n[        X5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      eUS   R	                  SSS
9nUc  [        SU S35      e [        [         R"                  U5      nUR&                  nUc  [        SU S35      e[        X+5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S:w  a  [        S	5      e[         R(                  " UR+                  SUS   R	                  SSS
95      R-                  S5      5      nUR.                  nU Vs/ s H  nUR0                  U:w  d  M  UPM     nn[        U5      [        U5      :X  a  [        SU SU S35      e[        U5      Ul        UUl        UUl        [5        U5      n[        R6                  " 5       nUS   R8                  Ul        [        R:                  " U[        R<                  S5      US'   [        R:                  " U[        R>                  S5      US'    URA                  U5        g ! [$         a    [        SU S35      ef = fs  snf ! [        RB                   aB  nURD                  u  nnU[        RF                  :X  a  [        SU S35      e[        U5      eS nAff = f)NrT   rU   rY   r\   r]   r   r`   r$   ra   rb   z@Attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z' not present!r   r   zkDACL not present on Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z'!r   r   r   r   r   z"Unable to find ACE for principal 'z\' in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'r   r   r   r   r   )$rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r	   r   rp   rq   r&   r   r   r   r+   r,   r   r   r   r1   r   r   r   r   r2   r3   r   )r@   r    r   r   r   r   r   rX   rr   rs   rt   rA   ru   rJ   r   r   r   r&   r   r   r   old_acesrF   r+   r   r   rH   rI   s                               rP   r{    cmd_delegation_del_principal.run<  s    ##%((,11"ffWoF9;;DDD~'7 %.  6kG1jj*n-.##=>	 ! @
 {q AKOPP"9::1~!!6A " ?< "++6-~ G H H	1&x':':DAM !!< "+ ,7-r ; < < 4ICaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN^q 9::$$##!  ! 466<fWoG	
 99  (Dx3;;)+CxD t9H% "##,+ .+ ,7-r	 ; < < D		!M*
 kkmQ""%%#%%68C %%c&&68C	(JJsO  	1 "++6- 8/ 0 1 1	1D E< || 		(XXFCc///"#} %/01 1 #3''		(s0   L L93L9
L> L6>N=NNr}   r~   r   r}   r   rP   r   r   *  sf    u:H ))..-- 	tW#JS	2M
  -JKOm(r   r   c                       \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   \	" 5       \S'   \
" 5       \S'   \" 5       \S'   \" 5       \S	'   S
rg)cmd_delegationi  zDelegation management.showzfor-any-servicezfor-any-protocolzadd-servicezdel-servicezadd-principalzdel-principalr}   N)r   r   r   r   r   subcommandsr   r   r   r   r   r   r   r   r}   r   rP   r   r     sg     K-/K%C%EK!"&E&GK"#!;!=K!;!=K#?#AK #?#AK r   r   )samba.getoptgetoptr   r.   sambar   r   samba.samdbr   
samba.authr   samba.dcerpcr   	samba.ndrr   r	   samba.netcmd.commonr
   samba.netcmdr   r   r   r   r   r   r   r   r   r   r   r   r}   r   rP   <module>r      s   *  
    % ! * 6 UH' UHp2$W 2$j3$g 3$l5$ 5$p5$ 5$pN(7 N(b(7 (D
B\ 
Br   