
    Id#                         d dl Zd dlmZ d dlmZ d dlmZ 	 d dlm	Z	 d dl
mZ d dlmZ d Zd	 Zd
 Z G d de      Z G d de      Zy# e$ r Y -w xY w)    N)
gp_inf_ext)system_session)
get_string)LdbError)SamDB)logc                 $    dt        |       dz  z  S )N%d<   intvals    5/usr/lib/python3/dist-packages/samba/gp/gp_sec_ext.pymins_to_hoursr          3s8b=!!    c                 $    dt        |       dz  z  S )Nr
      r   r   s    r   days_to_hoursr       r   r   c                 X    d}d}d}d}t        |       } t        | |z  |z  |z  |z         S )Nr   r   i )r   str)r   secondsminuteshourssam_adds        r   days2rel_nttimer   #   s@    GGEG
c(Cw(507:;<<r   c                   6    e Zd ZddddZd Zd Zd Zd Zd	 Zy
)
gp_krb_extkdc:user_ticket_lifetimekdc:service_ticket_lifetimekdc:renewal_lifetime)MaxTicketAgeMaxServiceAgeMaxRenewAgec           	         | j                   j                  d      dk7  ry d}|D ]  \  }}| j                  j                  |       |j	                         D ]t  }|t        |       k(  s||   j                         D ]M  \  }}| j                  ||       | j                  j                  ||       | j                  j                          O v  |D ]'  }	|	j                  s| j                  j                  |	j                         t        j                  j                  |	j                  |      }
| j                  |
      }|st|j!                         D ]  }|t        |       k(  s|j                  |      D ]|  \  }}|t"        j$                  vrt"        j$                  |   }| j'                         j                  |      }| j                  | ||             | j                  j                          ~  * y Nzserver rolez"active directory domain controllerz0MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf)lpgetgp_dbset_guidkeysr   itemsset_kdc_tdbdeletecommitfile_sys_pathnameospathjoinparsesectionsr   	apply_mapmapper)selfdeleted_gpo_listchanged_gpo_listinf_fileguidsettingssectionattvaluegpor4   inf_confkey
value_funcs                 r   process_group_policyzgp_krb_ext.process_group_policy/   s   77;;}%)MME. 	,ND(JJ%#==? ,c$i'&.w&7&=&=&? ,
U((e4

))'37

))+,,	, $ 	0C  

##CHH-ww||C$5$5x@::d+'002 0G#d)+*2..*A 0JC"**>*>> (","6"6s";C)-):):3)?J ,,S*U2CD JJ--/00	0r   c                    | j                   j                  j                  |      }t        j                  |d|d|       |h| j                   j                  j                  |t        |             | j                   j                  t        |       ||rt        |             y d        y | j                   j                  j                  |       | j                   j                  t        |       |       y )Nz was changed from  to )	r*   gpostorer)   r   infostorer   r   r/   r:   	attributer   old_vals       r   r.   zgp_krb_ext.set_kdc_tdbM   s    **%%)))49gsKL?JJ%%iCAJJSY	 4>g3F *$(* JJ&&y1JJc$i3r   c                      d t         t        dS )Nc                     | S N r   s    r   <lambda>z#gp_krb_ext.mapper.<locals>.<lambda>Y   s     r   )r    r!   r"   )r   r   r:   s    r   r9   zgp_krb_ext.mapperX   s    ,;/<(5 	r   c                      y)NzKerberos PolicyrS   rU   s    r   __str__zgp_krb_ext.__str__^   s     r   c                    i }| j                   j                  d      dk7  r|S d}|j                  rt        j                  j                  |j                  |      }| j                  |      }|s|S t        |       |j                         v rRt        |       }|j                  |      D ci c]'  \  }}t        j                  j                  |      r||) c}}||<   |S c c}}w r'   )r(   r)   r1   r3   r4   r5   r6   r   r7   r-   r   r8   	r:   rC   outputr=   r4   rD   r@   kvs	            r   rsopzgp_krb_ext.rsopa   s    77;;}%)MMME77<< 1 18<Dzz$'H4yH--//d)4<NN74K #FDAq)3)=)=)A)A!)D $%a4 #Fw#F   *,CN)	__name__
__module____qualname__r8   rG   r.   r9   rW   r]   rS   r   r   r   r   +   s+    #=#@#9<I0<	4!r   r   c                   T    e Zd ZdZd ZdddddZd Zd	 Zd
 Zd Z	d Z
d Zd Zd Zy)gp_access_extzThis class takes the .inf file parameter (essentially a GPO file mapped
    to a GUID), hashmaps it to the Samba parameter, which then uses an ldb
    object to update the parameter to Samba4. Not registry oriented whatsoever.
    c                     	 t        | j                  j                         t               | j                  | j                        | _        y # t        t        f$ r t        d      w xY w)N)session_infocredentialsr(   z/Failed to load SamDB for assigning Group Policy)	r   r(   	samdb_urlr   credsldb	NameErrorr   	ExceptionrU   s    r   load_ldbzgp_access_ext.load_ldbx   s[    	OTWW..0*8*:)- $)DH 8$ 	OMNN	Os   AA A&	minPwdAge	maxPwdAgeminPwdLengthpwdProperties)MinimumPasswordAgeMaximumPasswordAgeMinimumPasswordLengthPasswordComplexityc           	      >   | j                   j                  d      dk7  ry | j                          d}|D ]  \  }}| j                  j	                  |       |j                         D ]  }|t        |       k(  s||   j                         D ]f  \  }}| j                         j                  |      \  }	}
 |	||       | j                  j                  ||       | j                  j                          h   |D ]!  }|j                  s| j                  j	                  |j                         t        j                  j                  |j                  |      }| j!                  |      }|st|j#                         D ]  }|t        |       k(  s|j                  |      D ]v  \  }}|t$        j&                  vrt$        j&                  |   }| j                         j                  |      \  }	} |	| ||             | j                  j                          x  $ y r'   )r(   r)   rl   r*   r+   r,   r   r-   r9   r/   r0   r1   r2   r3   r4   r5   r6   r7   rc   r8   )r:   r;   r<   r=   r>   r?   r@   rA   rB   update_samba_rC   r4   rD   rE   rF   s                   r   rG   z"gp_access_ext.process_group_policy   s   77;;}%)MME. 	,ND(JJ%#==? ,c$i'&.w&7&=&=&? ,
U*.++-*;*;C*@a$S%0

))'37

))+	,,	, $ 	0C  

##CHH-ww||C$5$5x@::d+'002 0G#d)+*2..*A 0JC"-*A*AA ("/"9"9#">C9=9J9J39O6\:(j.?@ JJ--/00	0r   c                    | j                   j                         }t        j                  d|d|       | j                  j                  t        |       |t        |             | j                   j                  |       y )Nz*KDC Minimum Password age was changed from rI   )ri   get_minPwdAger   rK   r*   rL   r   set_minPwdAgerM   s       r   ch_minPwdAgezgp_access_ext.ch_minPwdAge   Z    ((((*S" 	#

TIs7|<s#r   c                    | j                   j                         }t        j                  d|d|       | j                  j                  t        |       |t        |             | j                   j                  |       y )Nz*KDC Maximum Password age was changed from rI   )ri   get_maxPwdAger   rK   r*   rL   r   set_maxPwdAgerM   s       r   ch_maxPwdAgezgp_access_ext.ch_maxPwdAge   r|   r   c                    | j                   j                         }t        j                  d|d|       | j                  j                  t        |       |t        |             | j                   j                  |       y )Nz-KDC Minimum Password length was changed from rI   )ri   get_minPwdLengthr   rK   r*   rL   r   set_minPwdLengthrM   s       r   ch_minPwdLengthzgp_access_ext.ch_minPwdLength   sZ    ((++-S" 	#

TIs7|<!!#&r   c                    | j                   j                         }t        j                  d|d|       | j                  j                  t        |       |t        |             | j                   j                  |       y )Nz*KDC Password Properties were changed from rI   )ri   get_pwdPropertiesr   rK   r*   rL   r   set_pwdPropertiesrM   s       r   ch_pwdPropertieszgp_access_ext.ch_pwdProperties   sZ    ((,,.c# 	$

TIs7|<""3'r   c                     | j                   t        f| j                  t        f| j                  d f| j                  d fdS )zldap value : samba setterc                     | S rR   rS   r   s    r   rT   z&gp_access_ext.mapper.<locals>.<lambda>   s    3 r   c                     | S rR   rS   r   s    r   rT   z&gp_access_ext.mapper.<locals>.<lambda>   s    S r   )rm   rn   ro   rp   )r{   r   r   r   r   rU   s    r   r9   zgp_access_ext.mapper   sF    "//A"//A "&!5!5 G"&"7"7!I 	r   c                      y)NzSystem AccessrS   rU   s    r   rW   zgp_access_ext.__str__   s    r   c                    i }| j                   j                  d      dk7  r|S d}|j                  rt        j                  j                  |j                  |      }| j                  |      }|s|S t        |       |j                         v rRt        |       }|j                  |      D ci c]'  \  }}t        j                  j                  |      r||) c}}||<   |S c c}}w r'   )r(   r)   r1   r3   r4   r5   r6   r   r7   r-   rc   r8   rY   s	            r   r]   zgp_access_ext.rsop   s    77;;}%)MMME77<< 1 18<Dzz$'H4yH--//d)4<NN74K #IDAq)6)@)@)D)DQ)G $%a4 #Iw#Ir^   N)r_   r`   ra   __doc__rl   r8   rG   r{   r   r   r   r9   rW   r]   rS   r   r   rc   rc   r   sK    
O -8,7,:,;>I0@$$'(	r   rc   )os.pathr3   samba.gp.gpclassr   
samba.authr   samba.commonr   ri   r   samba.samdbr   ImportErrorsamba.gp.util.loggingr   r   r   r   r   rc   rS   r   r   <module>r      sd   $  ' % #	! &""=D DNkJ ks  		s   A
 
AA