
    gF                     R   S SK Jr  S SKJrJrJrJr  S SKJ	r	  S SK
JrJrJr  S SKJr  S SKJr  S r " S S	\R&                  5      r " S
 S\R&                  5      r " S S\R&                  5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      rg)    N)MAX_TGT_LIFETIMEMIN_TGT_LIFETIMEAuthenticationPolicyStrongNTLMPolicy)
ModelError)CommandCommandErrorOption)RangeNT_TICKS_PER_SECc                 $    U b  U S-  [         -  $ U $ )zJConvert minutes to the tgt_lifetime attributes unit which is 10^-7 seconds<   r   )minutess    H/usr/lib/python3/dist-packages/samba/netcmd/domain/auth/policy/policy.pymins_to_tgt_lifetimer      s    |...N    c                   ,   ^  \ rS rSrSrU 4S jrSrU =r$ )UserOptions%   z>User options used by policy create and policy modify commands.c                 V  > [         TU ]  US5        U R                  SSS[        SU R                  [        [        [        S9/S9  U R                  SS	S
SSU R                  S9  U R                  SS[        SSU R                  SS9  U R                  SS[        SSU R                  SS9  g )NzUser Optionsz--user-tgt-lifetime-minsz2Ticket-Granting-Ticket lifetime for user accounts.tgt_lifetimecallbackminmaxhelpdesttypeactionr   
validatorsz--user-allow-ntlm-authzcAllow NTLM network authentication despite the fact that the user is restricted to selected devices.allow_ntlm_authFr   r   defaultr!   r   z#--user-allowed-to-authenticate-fromzISDDL Rules setting which device the user is allowed to authenticate from.allowed_to_authenticate_fromSDDLr   r    r   r!   r   metavarz!--user-allowed-to-authenticate-tozOA target service, on a user account, requires the connecting user to match SDDLallowed_to_authenticate_to	super__init__
add_optionint
set_optionr   r   r   strselfparser	__class__s     r   r-   UserOptions.__init__(   s    02Q+#j!%$).>DT$U#V	 	 	X
 	0B.)DOO	 	 	E
 	=h 'E)DOO &	 	 	(
 	;n 'C)DOO &	 	 	(r    __name__
__module____qualname____firstlineno____doc__r-   __static_attributes____classcell__r5   s   @r   r   r   %   s    H( (r   r   c                   ,   ^  \ rS rSrSrU 4S jrSrU =r$ )ServiceOptionsA   zAService options used by policy create and policy modify commands.c                 V  > [         TU ]  US5        U R                  SSS[        SU R                  [        [        [        S9/S9  U R                  SS	S
SSU R                  S9  U R                  SS[        SSU R                  SS9  U R                  SS[        SSU R                  SS9  g )NzService Optionsz--service-tgt-lifetime-minsz5Ticket-Granting-Ticket lifetime for service accounts.r   r   r   r   z--service-allow-ntlm-authznAllow NTLM network authentication despite the fact that the service account is restricted to selected devices.r#   Fr$   z&--service-allowed-to-authenticate-fromzTSDDL Rules setting which device the service account is allowed to authenticate from.r&   r'   r(   z$--service-allowed-to-authenticate-toz=The target service requires the connecting user to match SDDLr*   r+   r2   s     r   r-   ServiceOptions.__init__D   s    !235T+#j!%$).>DT$U#V	 	 	X
 	3B /)DOO 	 	E 	@K 'E)DOO & 	 	( 	>\ 'C)DOO &	 	 	(r   r7   r8   r@   s   @r   rB   rB   A   s    K( (r   rB   c                   ,   ^  \ rS rSrSrU 4S jrSrU =r$ )ComputerOptions_   zBComputer options used by policy create and policy modify commands.c                    > [         TU ]  US5        U R                  SSS[        SU R                  [        [        [        S9/S9  U R                  SS	[        S
SU R                  SS9  g )NzComputer Optionsz--computer-tgt-lifetime-minsz6Ticket-Granting-Ticket lifetime for computer accounts.r   r   r   r   z%--computer-allowed-to-authenticate-toz]The computer account (server, workstation) service requires the connecting user to match SDDLr*   r'   r(   r+   r2   s     r   r-   ComputerOptions.__init__b   ss    !346U+#j!%$).>DT$U#V	 	 	X
 	?| 'C)DOO &	 	 	(r   r7   r8   r@   s   @r   rG   rG   _   s    L( (r   rG   c                       \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSSSS	S
9/r  SS jrSrg)cmd_domain_auth_policy_listq   z+List authentication policies on the domain.%prog -H <URL> [options]	sambaoptscredoptshostoptsz--jsonzOutput results in JSON format.output_formatstore_constjson)r   r   r!   constNc                 N   U R                  XU5      n [        R                  " U5      nUS:X  a-  U R                  U Vs0 s H  oR                  U_M     sn5        g U H!  n[        UR                  U R                  S9  M#     g ! [         a  n[	        U5      eS nAff = fs  snf )NrU   file)	ldb_connectr   queryr   r	   
print_jsonnameprintoutf)	r3   rR   rP   rQ   rS   ldbpoliciesepolicys	            r   runcmd_domain_auth_policy_list.run   s     xH=	"+11#6H
 F"OOxHxV[[&0xHI"fkk		2 #  	"q/!	"
 Is   B B"
BBBr7   NNNN)r9   r:   r;   r<   r=   synopsisoptionsSambaOptionsCredentialsOptionsHostOptionstakes_optiongroupsr
   takes_optionsrd   r>   r7   r   r   rL   rL   q   sZ    5)H ))..'' 	x>#M	IM
 ;?3r   rL   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSSS\S	S
9/rSS jrSrg)cmd_domain_auth_policy_view   z,View an authentication policy on the domain.rN   rO   --namez1Name of authentication policy to view (required).r]   storeTr   r   r!   r    requiredNc                     U R                  XU5      n [        R                  " XTS9nUc  [	        SU S35      eU R                  UR                  5       5        g ! [         a  n[	        U5      eS nAff = f)NcnAuthentication policy  not found.)rZ   r   getr   r	   r\   as_dict)r3   rR   rP   rQ   r]   r`   rc   rb   s           r   rd   cmd_domain_auth_policy_view.run   sv    xH=	")--c;F
 >!7v[IJJ 	()  	"q/!	"s   A 
A4$A//A4r7   rf   r9   r:   r;   r<   r=   rg   rh   ri   rj   rk   rl   r
   r1   rm   rd   r>   r7   r   r   ro   ro      sT    6)H ))..'' 	xG7t	EM*r   ro   c                   @   \ rS rSrSrSr\R                  \R                  \R                  \
\\S.r\" SSSS\S	S
9\" SSSS\S9\" SSSSS9\" SSSSS9\" SSSSS9\" SSSSS9\" SS\R"                  " 5        S3S S!S\R$                  " 5       S"S#9/r    S'S% jrS&rg$)(cmd_domain_auth_policy_create   z.Create an authentication policy on the domain.rN   rP   rQ   rR   useroptsserviceoptscomputeroptsrq   )Name of authentication policy (required).r]   rr   Trs   --description/Optional description for authentication policy.descriptionr   r   r!   r    	--protect5Protect authentication silo from accidental deletion.protect
store_truer   r   r!   --unprotect7Unprotect authentication silo from accidental deletion.	unprotect--audit!Only audit authentication policy.audit	--enforceEnforce authentication policy.enforce--strong-ntlm-policyStrong NTLM Policy ().strong_ntlm_policychoiceDisabled)r   r   r    r!   choicesr%   Nc                 N   U	(       a  U
(       a  [        S5      eU(       a  U(       a  [        S5      eU R                  XU5      n [        R                  " XS9nUb  [        SU S35      e[        UU[
        UR                  5          UR                  [        UR                  5      UR                  UR                  UR                  [        UR                  5      UR                  UR                  [        UR                  5      UR                  S9nUb  Xl        OU(       + Ul         UR                  U5        U	(       a  UR                  U5        [        SU 3U R                   S9  g ! [         a  n[        U5      eS nAff = f! [         a  n[        U5      eS nAff = f)	N2--protect and --unprotect cannot be used together..--audit and --enforce cannot be used together.rv   rx   z already exists.)rw   r   r   user_allow_ntlm_authuser_tgt_lifetime!user_allowed_to_authenticate_fromuser_allowed_to_authenticate_toservice_allow_ntlm_authservice_tgt_lifetime$service_allowed_to_authenticate_from"service_allowed_to_authenticate_tocomputer_tgt_lifetime#computer_allowed_to_authenticate_tozCreated authentication policy: rX   )r	   rZ   r   rz   r   r   upperr#   r   r   r&   r*   enforcedsaver   r^   r_   r3   rR   rP   rQ   r   r   r   r]   r   r   r   r   r   r   r`   rc   rb   s                    r   rd   !cmd_domain_auth_policy_create.run   s   
 ySTTWOPPxH=	")--c;F
 !7v=MNOO &#/0B0H0H0JK!)!9!9283H3HI.6.S.S,4,O,O$/$?$?!5k6N6N!O1<1Y1Y/:/U/U"6|7P7P"Q0<0W0W
$ %O"'iFO	"KKs#
 	/v6TYYGS  	"q/!	"J  	"q/!	"s0   E- ,)F
 -
F7FF

F$FF$r7   NNNNNNNNNNNNNr9   r:   r;   r<   r=   rg   rh   ri   rj   rk   r   rB   rG   rl   r
   r1   r   choices_strget_choicesrm   rd   r>   r7   r   r   r   r      s   8)H ))..''%' 	xI7t	EE!'	= 	{Kl	4 	}M	6 	y7L	2 	{4l	4 	%*+;+G+G+I*J"M(x'335!		#%M2 JNHL>B#7Hr   r   c                   >   \ rS rSrSrSr\R                  \R                  \R                  \
\\S.r\" SSSS\S	S
9\" SSSS\S9\" SSSSS9\" SSSSS9\" SSSSS9\" SSSSS9\" SS\R"                  " 5        S3S S!S\R$                  " 5       S"9/r    S&S$ jrS%rg#)'cmd_domain_auth_policy_modifyi  z-Modify authentication policies on the domain.rN   r   rq   r   r]   rr   Trs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r   r   r    r!   r   Nc                    U	(       a  U
(       a  [        S5      eU(       a  U(       a  [        S5      eU R                  XU5      n [        R                  " XS9nUc  [        SU S35      eU(       a  SUl        OU(       a  SUl        Ub  Xl        Ub  [        UR                  5          Ul	        UR                  b  [        UR                  5      Ul        UR                  b  UR                  Ul        UR                  b  UR                  Ul        UR                  b  [        UR                  5      Ul        UR                  b  UR                  Ul        UR                  b  UR                  Ul        UR                  b  [        UR                  5      Ul        UR                  b  UR                  Ul         UR-                  U5        U	(       a  UR/                  U5        OU
(       a  UR1                  U5        [3        SU 3U R4                  S	9  g ! [         a  n[        U5      eS nAff = f! [         a  n[        U5      eS nAff = f)
Nr   r   rv   rx   ry   TFzUpdated authentication policy: rX   )r	   rZ   r   rz   r   r   r   r   r   r   r   r   r   r&   r   r*   r   r   r   r   r   r   r   r   r   r^   r_   r   s                    r   rd   !cmd_domain_auth_policy_modify.run<  s)   
 ySTTWOPPxH=	")--c;F
 >!7v[IJJ "FO#FO "!,
 ) !3!9!9!;< %   ,';H<Q<Q'RF$00<55 4 ..:33 2 ##/*>{?W?W*XF'33?88 7 11=66 5 $$0+?@Y@Y+ZF(22>77 6	"KKs#  %
 	/v6TYYGO  	"q/!	"F  	"q/!	"s6   H =)H4 'H4 
H1!H,,H14
I>I		Ir7   r   r   r7   r   r   r   r     s
   7)H ))..''%' 	xI7t	EE!'	= 	{Kl	4 	}M	6 	y7L	2 	{4l	4 	%*+;+G+G+I*J"M(x'335	7%M0 JNHL>B#UHr   r   c            	           \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSSS\S	S
9\" SSSSS9/r  SS jrSrg)cmd_domain_auth_policy_deletei  z-Delete authentication policies on the domain.rN   rO   rq   r   r]   rr   Trs   z--forcez-Force delete protected authentication policy.forcer   r   Nc                    U R                  XU5      n [        R                  " XdS9nUc  [	        SU S35      e U(       a  UR                  U5        UR                  U5        [        SU 3U R                  S9  g ! [         a  n[	        U5      eS nAff = f! [         a%  nU(       d  [	        U S35      e[	        U5      eS nAff = f)Nrv   rx   ry   z9
Try --force to delete protected authentication policies.zDeleted authentication policy: rX   )	rZ   r   rz   r   r	   r   deleter^   r_   )	r3   rR   rP   rQ   r]   r   r`   rc   rb   s	            r   rd   !cmd_domain_auth_policy_delete.run  s     xH=	")--c;F
 >!7v[IJJ
	"  %MM# 	/v6TYYG+  	"q/!	"  	""cSTV V q/!	"s.   A< )B <
BBB
C# CCr7   )NNNNNr}   r7   r   r   r   r     sq    7)H ))..'' 	xI7t	EyNL	2M FJHr   r   )samba.getoptgetoptrh   samba.domain.modelsr   r   r   r   samba.domain.models.exceptionsr   samba.netcmdr   r	   r
   samba.netcmd.validatorsr   samba.nt_timer   r   OptionGroupr   rB   rG   rL   ro   r   r   r   r7   r   r   <module>r      s   . I I 5 6 6 ) *('%% (8(W(( (<(g)) ($3' 3D*' *D^HG ^HB{HG {H|.HG .Hr   