
    g                     j    S SK r S SKJr  S SKJrJr  S SKJr  SSK	J
r
JrJr  S SKJr   " S S\
5      rg)	    N)CommandErrorOption)Credentials   )GetPasswordCommandgpg_decryptdecrypt_samba_gpg_help)samrc            
           \ rS rSrSrSr\R                  \R                  \R                  \R                  S.r\" SS\S9\" S\S	S
SS9\" S\SSSS9/rS/r    SS jrSrg)cmd_user_get_kerberos_ticket"   aw  Get a Kerberos Ticket Granting Ticket as a user

This command gets a Kerberos TGT using the password for a user/computer account.

The username specified on the command is the sAMAccountName.
The username may also be specified using the --filter option.

The command must be run from the root user id or another authorized
user id. The '-H' or '--URL' option supports ldap:// for remote Group
Managed Service accounts, and ldapi:// or tdb:// can be used to
adjust the local path. tdb:// is used by default for a bare path.

The --output-krb5-ccache option should point to a location for the
credentials cache.  The default is a FILE: type cache if no prefix is
specified.

The '--decrypt-samba-gpg' option triggers decryption of the
Primary:SambaGPG buffer to get the password.

Check with '--help' if this feature is available
in your environment or not (the python-gpgme package is required).  Please
note that you might need to set the GNUPGHOME environment variable.  If the
decryption key has a passphrase you have to make sure that the GPG_AGENT_INFO
environment variable has been set correctly and the passphrase is already
known by the gpg-agent.

Example1:
samba-tool user get-kerberos-ticket TestUser1 --output-krb5-ccache=/srv/service/krb5_ccache

Example2:
samba-tool user get-kerberos-ticket --filter='(samAccountName=TestUser3)' --output-krb5-ccache=FILE:/srv/service/krb5_ccache

    z.%prog (<username>|--filter <filter>) [options])	sambaoptsversionoptscredoptshostoptsz--filterzBLDAP Filter to get Kerberos ticket for (must match single account))helptypez--output-krb5-ccachez;Location of Kerberos credentials cache to write ticket intoCCACHEoutput_krb5_ccache)r   r   metavardestz--decrypt-samba-gpg
store_trueFdecrypt_samba_gpg)r   actiondefaultr   z	username?Nc           
         UR                  5       U l        U(       a  [        (       d  [        [        5      eUc  Uc  [        S5      eUc  S[
        R                  " U5      -  n/ SQnU	R                  U R                  5      nU R                  UR                  SUS9nU R                  XS U[
        R                  UUS9nUR                  5       n[        5       nUR                  [        US   S   5      5        UR                  UR!                  5       5        UR#                  S	SS
9nUR#                  SSS
9nUb  UR%                  U5        OUb7  [&        R(                  " 5       n[+        U5      Ul        UR/                  U5        OVUR0                  R3                  S5      (       d   UR0                  R3                  S5      (       a  [        S5      e[        S5      eUR5                  U5        UR7                  X5        g )Nz4Either the username or '--filter' must be specified!z((&(objectClass=user)(sAMAccountName=%s)))virtualClearTextUTF16samAccountName
unicodePwdF)urlrequire_ldapicreds)basednfilterscopeattrsdecryptr   r   r   )idxr   zldap://zldaps://zNo password was available for this user.  Only Group Managed Service accounts allow access to passwords over LDAP, you may need to access the sam.ldb directly on the Samba AD DC and export the file.z'No password was available for this user)get_loadparmlpr   r   r	   ldbbinary_encodeget_credentialsconnect_for_passwordsHget_account_attributesSCOPE_SUBTREEr   set_usernamestr	set_realmdomain_dns_namegetset_utf16_passwordr
   Passwordlisthashset_nt_hashr    
startswithguessget_named_ccache)selfusernamer/   r$   
attributesr   r   r   r   r   r   password_attrsr"   samdbobjlp_ctxutf16_pwnt_passnt_hashs                      U/usr/lib/python3/dist-packages/samba/netcmd/user/readpasswords/get_kerberos_ticket.pyrun cmd_user_get_kerberos_ticket.runY   s    ((*[[566>h.UVV>?3CTCTU]C^_FR((1**xzzV[*\))%1517030A0A0>2C * E '')3s#34Q789--/07727:'',A'.$$X. mmoG=GLg&yy##I..%))2F2Fz2R2R" $y z z ##LMMFv:    )r*   )
NNNNNNNNNN)__name__
__module____qualname____firstlineno____doc__synopsisoptionsSambaOptionsVersionOptionsCredentialsOptionsHostOptionstakes_optiongroupsr   r3   r	   takes_options
takes_argsrJ   __static_attributes__ rL   rI   r   r   "   s     B @H ))--..''	 	z dkno%CQ&:	< 	$*"E8K	MM J04/37;.21;rL   r   )r+   samba.getoptgetoptrS   samba.netcmdr   r   samba.credentialsr   commonr   r   r	   samba.dcerpcr
   r   r\   rL   rI   <module>rc      s1   .   - ) 
 h;#5 h;rL   