ó
    cÛ–isi  ã                   ó8  • S SK Jr  S SKrS SKJr  S SKJr  S SKJr  S SK	J
r
  S SKJr  S SKJrJr  S SKJr  S S	KJrJrJrJr   " S
 S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      rg)é    N)Ú	provision)Údsdb)ÚSamDB)Úsystem_session)Úsecurity)Úndr_packÚ
ndr_unpack)Ú_get_user_realm_domain)ÚCommandÚCommandErrorÚSuperCommandÚOptionc            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rS/rS rSS jrSrg)Úcmd_delegation_showé&   z*Show the delegation setting of an account.z%prog <accountname> [options]©Ú	sambaoptsÚcredoptsÚversionoptsú-Hú--URLú%LDB URL for database or target serverÚURLÚH©ÚhelpÚtypeÚmetavarÚdestÚaccountnamec                 ó6  • UR                   nUR                  nSnUb  U[        R                  -  (       d   U R                  R                  SU S35        g U[        R                  -  (       d   U R                  R                  SU S35        g SnUR                   GH4  nUR                  n UR                  SU S3[        R                  S	9n	[        U	5      S
:X  a  U	S   R                  nSnUR                  [        R"                  :X  d  UR                  [        R$                  :X  a%  U R                  R                  SU SU S35        SnO>UR                  [        R&                  :w  a   UR                  [        R(                  :w  a  SnUR*                  [        R,                  -  nUR*                  [        R.                  -  nUR*                  [        R0                  -  nUR*                  [        R2                  -  nU(       a  U(       d
  U(       d  SnOVU(       a$  U R                  R                  SU SU S35        SnU(       a$  U R                  R                  SU SU S35        SnUR4                  (       d  SnU(       a  GMñ  U(       a  U R6                  R                  S5        SnU R6                  R                  SU S35        GM7     g ! [        R                   a.  n
U
R                  u  p¼U[        R                   :w  a  e  S n
A
GN&S n
A
ff = f)NzISecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentityzWarning: DACL not present in z!
zWarning: DACL in z lacks SELF_RELATIVE flag!
Tz<SID=Ú>)Úscopeé   r   FzWarning: ACE in z denies access for trustee zWarning: ACE for trustee z. has unexpected CONTAINER_INHERIT flag set in z* has unexpected INHERITED_ACE flag set in z0  Principals that may delegate to this account:
z*msDS-AllowedToActOnBehalfOfOtherIdentity: Ú
)Údaclr   r   ÚSEC_DESC_DACL_PRESENTÚerrfÚwriteÚSEC_DESC_SELF_RELATIVEÚacesÚtrusteeÚsearchÚldbÚ
SCOPE_BASEÚlenÚdnÚLdbErrorÚargsÚERR_NO_SUCH_OBJECTÚSEC_ACE_TYPE_ACCESS_DENIEDÚ!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTÚSEC_ACE_TYPE_ACCESS_ALLOWEDÚ"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTÚflagsÚSEC_ACE_FLAG_INHERIT_ONLYÚSEC_ACE_FLAG_OBJECT_INHERITÚSEC_ACE_FLAG_CONTAINER_INHERITÚSEC_ACE_FLAG_INHERITED_ACEÚaccess_maskÚoutf)ÚselfÚsamÚsecurity_descriptorr&   Ú	desc_typeÚwarning_infoÚfirstÚacer,   ÚresÚerrÚnumÚ_ÚignoreÚinherit_onlyÚobject_inheritÚcontainer_inheritÚinherited_aces                     Ú9/usr/lib/python3/dist-packages/samba/netcmd/delegation.pyÚshow_security_descriptorÚ,cmd_delegation_show.show_security_descriptor8   s¶  € Ø"×'Ñ'ˆØ'×,Ñ,ˆ	ðCˆð ‰<˜y¬8×+IÑ+I×IØ�I‰I�O‰OÐ;¸L¸>ÈÐMÔNØàœ8×:Ñ:×:Ø�I‰I�O‰OÐ/°¨~ð >4ð 5ô 6ààˆà—9•9ˆCØ—k‘kˆGð	(Ø—j‘j 5¨¨	°Ð!3Ü'*§~¡~ð !ð 7�ô �s“8˜q“=Ø! !™fŸi™i�GàˆFà—‘œH×?Ñ?Ó?Ø—x‘x¤8×#MÑ#MÓMØ—	‘	—‘Ð"2°<°.ð A6Ø6=°Y¸cð!Cô Dð ‘Ø—(‘(œh×BÑBÓBØŸ™¤H×$OÑ$OÓOà�àŸ9™9¤x×'IÑ'IÑIˆLØ ŸY™Y¬×)MÑ)MÑMˆNà—	‘	œH×CÑCÑCð àŸI™I¬×(KÑ(KÑKˆMæ¦NÖ;Lð ‘æ$Ø—I‘I—O‘OÐ&?À¸yð IPà'3 n°Cð%9ô :ð "�Fæ Ø—I‘I—O‘OÐ&?À¸yð ILà'3 n°Cð%9ô :ð "�Fà—?—?à�ç‘6ÞØ—I‘I—O‘Oð %1ô 2à!�Eà—	‘	—‘Ð"LØ#* )¨2ð!/÷ 0ò{ øô —<‘<ó ØŸ™‘�Øœ#×0Ñ0Ó0Øõ 1ûðús   Â-"KËLË*#LÌLNc                 óö  • UR                  5       nUR                  U5      nUc2  [        R                  " XfR	                  S5      5      nUR
                  n	OUn	[        U	[        5       XvS9n
[        UU
5      u  p¼nU
R                  S[        R                  " U5      -  [        R                  / SQS9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        US   R	                  S
5      S   5      nUS   R	                  S5      nUS   R	                  SSS9nU R                   R#                  S[%        US   R&                  5      -  5        U R                   R#                  S[)        U[*        R,                  -  5      -  5        U R                   R#                  S[)        U[*        R.                  -  5      -  5        U(       aB  U R                   R#                  S5        U H!  nU R                   R#                  SU-  5        M#     Ub.   [1        [2        R4                  U5      nU R7                  U
U5        g g ! [8         a    U R:                  R#                  S5         g f = f)NÚrealm©Úsession_infoÚcredentialsÚlpúsAMAccountName=%s)ÚuserAccountControlúmsDS-AllowedToDelegateToú(msDS-AllowedToActOnBehalfOfOtherIdentity©Ú
expressionr#   Úattrsr   ú Unable to find account name '%s'r$   úFound multiple accounts.rZ   r[   r\   ©ÚidxzAccount-DN: %s
zUF_TRUSTED_FOR_DELEGATION: %s
z.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s
z)  Services this account may delegate to:
zmsDS-AllowedToDelegateTo: %s
znWarning: Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity could not be unmarshalled!
)Úget_loadparmÚget_credentialsr   Úprovision_paths_from_lpÚgetÚsamdbr   r   r
   r-   r.   Úbinary_encodeÚSCOPE_SUBTREEr0   r   Úintr?   r)   Ústrr1   Úboolr   ÚUF_TRUSTED_FOR_DELEGATIONÚ)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONr	   r   Ú
descriptorrQ   ÚRuntimeErrorr(   )r@   r    r   r   r   r   rX   ÚcredsÚpathsÚpathrA   ÚcleanedaccountrT   ÚdomainrG   ÚuacÚallowedÚallowed_fromÚarB   s                       rP   ÚrunÚcmd_delegation_show.runŠ   sA  € Ø×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆà‰9Ü×5Ò5°b¿&¹&À»/ÓJˆEØ—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô +AÀØADó+FÑ'ˆ ð �j‰jÐ$7Ü×*Ò*¨>Ó:ñ%;ä"×0Ñ0ò Lð ð Mˆô
 ˆs‹8�q‹=ÜÐAÀKÑOÓPÐPÜ�‹X˜‹]ÜÐ9Ó:Ð:ä�#�a‘&—*‘*Ð1Ó2°1Ñ5Ó6ˆØ�a‘&—*‘*Ð7Ó8ˆØ˜1‘v—z‘zÐ"LÐRS�zÐTˆà�	‰	�‰Ð*¬S°°Q±·±«^Ñ;Ô<Ø�	‰	�‰Ð9Ü˜s¤T×%CÑ%CÑCÓDñEô 	Fà�	‰	�‰ÐIÜ˜S¤4×#QÑ#QÑQÓRñSô 	Tö Ø�I‰I�O‰OÐHÔIÛ�Ø—	‘	—‘Ð @À1Ñ DÖEñ àÑ#ðHÜ&0´×1DÑ1DÀlÓ&SÐ#ð ×-Ñ-¨cÐ3FÕGð $øô  ó @Ø—	‘	—‘ð !?ö @ð@ús   È"I É%I8É7I8© ©NNNN)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__ÚsynopsisÚoptionsÚSambaOptionsÚCredentialsOptionsÚVersionOptionsÚtakes_optiongroupsr   rl   Útakes_optionsÚ
takes_argsrQ   r{   Ú__static_attributes__r}   ó    rP   r   r   &   se   † Ù4à.€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JÐQTØ 3ñ	(ð€Mð
  �€JòP0÷d1Hr�   r   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_for_any_serviceé¾   z3Set/unset UF_TRUSTED_FOR_DELEGATION for an account.ú(%prog <accountname> [(on|off)] [options]r   r   r   r   r   r   r   r    ÚonoffNc                 óì  • US:X  a  SnOUS:X  a  SnO[        SU-  5      eUR                  5       nUR                  U5      n	[        R                  " XˆR                  S5      5      n
Uc  U
R                  nOUn[        U[        5       X˜S9n[        UU5      u  pÞnS[        R                  " U5      -  n[        R                  n UR                  UUS	USS
9  g ! [         a  n[        U5      eS nAff = f)NÚonTÚoffFú0invalid argument: '%s' (choose from 'on', 'off')rT   rU   rY   zTrusted-for-Delegation©Ú	flags_strr”   Ústrict)r   rd   re   r   rf   rg   rh   r   r   r
   r.   ri   r   rn   Útoggle_userAccountFlagsÚ	Exception©r@   r    r’   r   r   r   r   r”   rX   rr   rs   rt   rA   ru   rT   rv   Úsearch_filterÚflagrH   s                      rP   r{   Ú"cmd_delegation_for_any_service.runÐ   s  € ð �D‹=Ø‰BØ�e‹^Ø‰BäÐQÐTYÑYÓZÐZà×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô +AÀØADó+FÑ'ˆ ð ,¬c×.?Ò.?ÀÓ.OÑOˆÜ×-Ñ-ˆð	$Ø×'Ñ'¨°tØ2JØ+-°dð (ò <øô ó 	$Ü˜sÓ#Ð#ûð	$ús   ÃC Ã
C3Ã#C.Ã.C3r}   r~   ©r   r€   r�   r‚   rƒ   r„   r…   r†   r‡   rˆ   r‰   r   rl   rŠ   r‹   r{   rŒ   r}   r�   rP   r�   r�   ¾   sf   † Ù=à9€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JÐQTØ 3ñ	(ð€Mð
   Ð)€JàGKØ÷ $r�   r�   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_for_any_protocoléó   zOSet/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.r‘   r   r   r   r   r   r   r   r    r’   Nc                 óî  • SnUS:X  a  SnOUS:X  a  SnO[        SU-  5      eUR                  5       nUR                  USS9n	[        R                  " XˆR                  S5      5      n
Uc  U
R                  nOUn[        U[        5       X˜S9n[        UU5      u  pÞnS	[        R                  " U5      -  n[        R                  n UR                  UUS
USS9  g ! [         a  n[        U5      eS nAff = f)NFr”   Tr•   r–   )Úfallback_machinerT   rU   rY   z&Trusted-to-Authenticate-for-Delegationr—   )r   rd   re   r   rf   rg   rh   r   r   r
   r.   ri   r   ro   rš   r›   rœ   s                      rP   r{   Ú#cmd_delegation_for_any_protocol.run  s  € ð ˆØ�D‹=Ø‰BØ�e‹^Ø‰BäÐQÐTYÑYÓZÐZà×#Ñ#Ó%ˆØ×(Ñ(¨¸dÐ(ÐCˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô +AÀØADó+FÑ'ˆ ð ,¬c×.?Ò.?ÀÓ.OÑOˆÜ×=Ñ=ˆð	$Ø×'Ñ'¨°tØ2ZØ+-°dð (ò <øô ó 	$Ü˜sÓ#Ð#ûð	$ús   ÃC Ã
C4Ã$C/Ã/C4r}   r~   r    r}   r�   rP   r¢   r¢   ó   sf   † ÙYà9€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JÐQTØ 3ñ	(ð€Mð
   Ð)€JàGKØ÷!$r�   r¢   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_add_servicei)  zZAdd a service principal to msDS-AllowedToDelegateTo so that an account may delegate to it.ú)%prog <accountname> <principal> [options]r   r   r   r   r   r   r   r    Ú	principalNc                 óØ  • UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       X‡S9n[        UU5      u  pÍnUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        R                  " 5       nUS   R                   Ul        [        R"                  " U/[        R$                  S5      US'    UR'                  U5        g ! [(         a  n[        U5      eS nAff = f©
NrT   rU   rY   r[   r]   r   r`   r$   ra   )rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   ÚMessager1   ÚMessageElementÚFLAG_MOD_ADDÚmodifyr›   ©r@   r    rª   r   r   r   r   rX   rr   rs   rt   rA   ru   rT   rv   rG   ÚmsgrH   s                     rP   r{   Úcmd_delegation_add_service.run;  sT  € ð ×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô +AÀØADó+FÑ'ˆ ð �j‰jÐ$7Ü×*Ò*¨>Ó:ñ%;ä"×0Ñ0Ø :Ð;ð ð =ˆô ˆs‹8�q‹=ÜÐAÀKÑOÓPÐPÜ�‹X˜‹]ÜÐ9Ó:Ð:ä�kŠk‹mˆØ�Q‘—‘ˆŒÜ*-×*<Ò*<¸i¸[Ü=@×=MÑ=MØ=Wó+YˆÐ&Ñ'ð	$Ø�J‰J�s�OøÜó 	$Ü˜sÓ#Ð#ûð	$úó   Ä=E Å
E)ÅE$Å$E)r}   r~   r    r}   r�   rP   r¨   r¨   )  sf   † Ùdà:€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JÐQTØ 3ñ	(ð€Mð
   Ð-€JàKOØ÷#$r�   r¨   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_del_serviceia  ziDelete a service principal from msDS-AllowedToDelegateTo so that an account may no longer delegate to it.r©   r   r   r   r   r   r   r   r    rª   Nc                 óØ  • UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       X‡S9n[        UU5      u  pÍnUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      e[        R                  " 5       nUS   R                   Ul        [        R"                  " U/[        R$                  S5      US'    UR'                  U5        g ! [(         a  n[        U5      eS nAff = fr¬   )rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r­   r1   r®   ÚFLAG_MOD_DELETEr°   r›   r±   s                     rP   r{   Úcmd_delegation_del_service.runs  sT  € ð ×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô +AÀØADó+FÑ'ˆ ð �j‰jÐ$7Ü×*Ò*¨>Ó:ñ%;ä"×0Ñ0Ø :Ð;ð ð =ˆô ˆs‹8�q‹=ÜÐAÀKÑOÓPÐPÜ�‹X˜‹]ÜÐ9Ó:Ð:ä�kŠk‹mˆØ�Q‘—‘ˆŒÜ*-×*<Ò*<¸i¸[Ü=@×=PÑ=PØ=Wó+YˆÐ&Ñ'ð	$Ø�J‰J�s�OøÜó 	$Ü˜sÓ#Ð#ûð	$úr´   r}   r~   r    r}   r�   rP   r¶   r¶   a  sf   † Ùsà:€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JÐQTØ 3ñ	(ð€Mð
   Ð-€JàKOØ÷#$r�   r¶   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_add_principali™  z\Add a principal to msDS-AllowedToActOnBehalfOfOtherIdentity that may delegate to an account.r©   r   r   r   r   r   r   r   r    rª   Nc           
      óÒ  ^• UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       X‡S9n[        X5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S	:w  a  [        S
5      eUS   R	                  SSS9nUc~  [        R                   " [        R"                  5      n[        R$                  " 5       n[        R&                  Ul        [        R*                  [        R,                  -  Ul        UUl        S nO' [3        [        R$                  U5      nUR6                  nUc1  [        R8                  " 5       n[        R:                  Ul        SUl        [        X+5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S	:w  a  [        S
5      e[        R                   " UR?                  SUS   R	                  SSS95      RA                  S5      5      mURB                  n[E        U4S jU 5       5      (       a  [        SU SU S35      e[        RF                  " 5       n[        RH                  Ul        SUl%        [        RL                  Ul'        TUl(        URS                  U5        UUl!        U=R<                  S	-  sl        UUl        [U        U5      n[        RV                  " 5       nUS   RX                  Ul,        Ub)  [        RZ                  " U[        R\                  S5      US'   [        RZ                  " U[        R^                  S5      US'    URa                  U5        g ! [4         a    [        SU S35      ef = f! [        Rb                   aB  nURd                  u  nnU[        Rf                  :X  a  [        SU S35      e[        U5      eS nAff = f)NrT   rU   rY   r\   r]   r   zUnable to find account name 'Ú'r$   ra   rb   úWSecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'ú' could not be unmarshalled!Ú	objectSidúUnable to find principal name 'Ú	objectSIDúutf-8c              3   ó@   >#   • U  H  oR                   T:H  v •  M     g 7f)N)r,   )Ú.0rF   Ú	princ_sids     €rP   Ú	<genexpr>Ú3cmd_delegation_add_principal.run.<locals>.<genexpr>ù  s   øé € Ð8²4¨C�{‰{˜iÖ'²4ùs   ƒzACE for principal 'zl' already present in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'ú'.Ú0Ú1úRRefused to update attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'ú:': a conflicting attribute update occurred simultaneously.)4rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r   Údom_sidÚSID_BUILTIN_ADMINISTRATORSrp   ÚSD_REVISIONÚrevisionr'   r*   r   Ú	owner_sidr	   rq   r&   ÚaclÚSECURITY_ACL_REVISION_ADSÚnum_acesÚschema_format_valueÚdecoder+   ÚanyrF   r7   r9   ÚSEC_ADS_GENERIC_ALLr>   r,   Úappendr   r­   r1   r®   r¸   r¯   r°   r2   r3   ÚERR_NO_SUCH_ATTRIBUTE)r@   r    rª   r   r   r   r   rX   rr   rs   rt   rA   ru   rJ   Úaccount_resÚdatarÒ   Úsecurity_descr&   ÚcleanedprincÚ	princ_resr+   rF   Únew_datar²   rH   rI   rÆ   s                              @rP   r{   Ú cmd_delegation_add_principal.run«  s3  ø€ ð ×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô  6°kÓGÑˆ˜˜1à—j‘jØ*Ü×Ò˜nÓ-ñ.ä×#Ñ#Ø=Ð>ð	 !ð @ˆô
 ˆ{Ó˜qÓ ÜÐ!>¸{¸mÈ1ÐMÓNÐNÜ�Ó Ó"ÜÐ9Ó:Ð:à˜1‰~×!Ñ!Ø6¸Að "ð ?ˆà‰<ä ×(Ò(¬×)LÑ)LÓMˆIä$×/Ò/Ó1ˆMÜ%-×%9Ñ%9ˆMÔ"Ü"*×"@Ñ"@Ü"*×"AÑ"Añ#BˆMÔà&/ˆMÔ#à‰Dð5Ü *¬8×+>Ñ+>ÀÓ E�ð !×%Ñ%ˆDà‰<ä—<’<“>ˆDÜ$×>Ñ>ˆDŒMØˆDŒMô 4°IÓCÑˆ�a˜à—J‘JÐ*=Ü"×0Ò0°Ó>ñ+?ä%(×%6Ñ%6Ø&1 ]ð ð 4ˆ	ô ˆy‹>˜QÓÜÐ!@ÀÀÈ1ÐMÓNÐNÜ�‹^˜qÓ ÜÐ9Ó:Ð:ä×$Ò$Ø×#Ñ#ØØ˜!‘× Ñ  °!Ð Ð4ó6ç6<±f¸W³oóGˆ	ð
 �y‰yˆô Ô8±4Ó8×8Ñ8ÜØ% i [ð 1ð  �= ð$ó%ð %ô �lŠl‹nˆÜ×7Ñ7ˆŒØˆŒ	Ü"×6Ñ6ˆŒØˆŒà�‰�CÔàˆŒ	Ø�Š˜Ñ�à!ˆÔä˜MÓ*ˆô
 �kŠk‹mˆØ˜Q‘×"Ñ"ˆŒØÑÜ×)Ò)Ø”c×)Ñ)Ø:ó<ˆC�‰Hô ×%Ò%Ø”c×&Ñ&Ø6ó8ˆˆC‰ð	(Ø�J‰J�s�OøôO  ó 5Ü"ð &3à3>°-ð @3ð$4ó 5ð 5ð5ûôP �|‰|ó 		(Ø—X‘X‰FˆC�Ø”c×/Ñ/Ó/Ü"ðà#�}ð %/ð0ó1ð 1ô # 3Ó'Ð'ûð		(ús$   Æ O3 Ï!P Ï3PÐQ&Ð$=Q!Ñ!Q&r}   r~   r    r}   r�   rP   r»   r»   ™  sf   † Ùfà:€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JØ ¨Sñ	2ð€Mð
   Ð-€JàKOØ÷|(r�   r»   c            	       ó’   • \ rS rSrSrSr\R                  \R                  \R                  S.r
\" SSS\SS	S
9/rSS/r  SS jrSrg)Úcmd_delegation_del_principali*  zkDelete a principal from msDS-AllowedToActOnBehalfOfOtherIdentity that may no longer delegate to an account.r©   r   r   r   r   r   r   r   r    rª   Nc           
      ó.  • UR                  5       nUR                  U5      n[        R                  " XwR	                  S5      5      n	Uc  U	R
                  n
OUn
[        U
[        5       X‡S9n[        X5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU-  5      e[        U5      S:w  a  [        S	5      eUS   R	                  SSS
9nUc  [        SU S35      e [        [         R"                  U5      nUR&                  nUc  [        SU S35      e[        X+5      u  n  nUR                  S[        R                  " U5      -  [        R                  S/S9n[        U5      S:X  a  [        SU S35      e[        U5      S:w  a  [        S	5      e[         R(                  " UR+                  SUS   R	                  SSS
95      R-                  S5      5      nUR.                  nU Vs/ s H  nUR0                  U:w  d  M  UPM     nn[        U5      [        U5      :X  a  [        SU SU S35      e[        U5      Ul        UUl        UUl        [5        U5      n[        R6                  " 5       nUS   R8                  Ul        [        R:                  " U[        R<                  S5      US'   [        R:                  " U[        R>                  S5      US'    URA                  U5        g ! [$         a    [        SU S35      ef = fs  snf ! [        RB                   aB  nURD                  u  nnU[        RF                  :X  a  [        SU S35      e[        U5      eS nAff = f)NrT   rU   rY   r\   r]   r   r`   r$   ra   rb   z@Attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z' not present!r¾   r¿   zkDACL not present on Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z'!rÀ   rÁ   r½   rÂ   rÃ   z"Unable to find ACE for principal 'z\' in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'rÉ   rÊ   rË   rÌ   rÍ   )$rd   re   r   rf   rg   rh   r   r   r
   r-   r.   ri   rj   r0   r   r	   r   rp   rq   r&   rÎ   rÖ   r×   r+   r,   rÕ   r   r­   r1   r®   r¸   r¯   r°   r2   r3   rÛ   )r@   r    rª   r   r   r   r   rX   rr   rs   rt   rA   ru   rJ   rÜ   rÝ   rÞ   r&   rß   rà   rÆ   Úold_acesrF   r+   rá   r²   rH   rI   s                               rP   r{   Ú cmd_delegation_del_principal.run<  sÔ  € ð ×#Ñ#Ó%ˆØ×(Ñ(¨Ó,ˆÜ×1Ò1°"·f±f¸W³oÓFˆØ‰9Ø—;‘;‰DàˆDä�D¤~Ó'7Ø %ñ.ˆô  6°kÓGÑˆ˜˜1à—j‘jØ*Ü×Ò˜nÓ-ñ.ä×#Ñ#Ø=Ð>ð	 !ð @ˆô
 ˆ{Ó˜qÓ ÜÐAÀKÑOÓPÐPÜ�Ó Ó"ÜÐ9Ó:Ð:à˜1‰~×!Ñ!Ø6¸Að "ð ?ˆà‰<Üð "+à+6¨-°~ð Gó Hð Hð	1Ü&¤x×':Ñ':¸DÓAˆMð ×!Ñ!ˆØ‰<Üð "+ð ,7¨-°rð ;ó <ð <ô 4°IÓCÑˆ�a˜à—J‘JÐ*=Ü"×0Ò0°Ó>ñ+?ä%(×%6Ñ%6Ø&1 ]ð ð 4ˆ	ô ˆy‹>˜QÓÜÐ!@ÀÀÈ1ÐMÓNÐNÜ�‹^˜qÓ ÜÐ9Ó:Ð:ä×$Ò$Ø×#Ñ#ØØ˜!‘× Ñ  °!Ð Ð4ó6ç6<±f¸W³oóGˆ	ð
 —9‘9ˆñ  (ÓDšx˜¨3¯;©;¸)Ñ+C—™xˆÐDô ˆt‹9œ˜H›Ó%Üð "#Ø#, +ð .+ð ,7¨-°rð	 ;ó <ð <ô ˜D›	ˆŒØˆŒ	à!ˆÔä˜MÓ*ˆô
 �kŠk‹mˆØ˜Q‘×"Ñ"ˆŒÜ×%Ò%Ø”#×%Ñ%Ø6ó8ˆˆC‰ô ×%Ò%Ø”c×&Ñ&Ø6ó8ˆˆC‰ð	(Ø�J‰J�s�Oøô ó 	1Üð "+à+6¨-ð 8/ð 0ó 1ð 1ð	1üòD Eøô< �|‰|ó 		(Ø—X‘X‰FˆC�Ø”c×/Ñ/Ó/Ü"ðà#�}ð %/ð0ó1ð 1ô # 3Ó'Ð'ûð		(ús0   ÄL ÈL9È3L9Ì
L> ÌL6Ì>NÍ=NÎNr}   r~   r    r}   r�   rP   rä   rä   *  sf   † Ùuà:€Hð ×)Ñ)Ø×.Ñ.Ø×-Ñ-ñÐñ 	ˆt�WÐ#JØ ¨Sñ	2ð€Mð
   Ð-€JàKOØ÷m(r�   rä   c                   ó¨   • \ rS rSrSr0 r\" 5       \S'   \" 5       \S'   \" 5       \S'   \	" 5       \S'   \
" 5       \S'   \" 5       \S'   \" 5       \S	'   S
rg)Úcmd_delegationi¬  zDelegation management.Úshowzfor-any-servicezfor-any-protocolzadd-servicezdel-servicezadd-principalzdel-principalr}   N)r   r€   r�   r‚   rƒ   Úsubcommandsr   r�   r¢   r¨   r¶   r»   rä   rŒ   r}   r�   rP   ré   ré   ¬  sg   † Ù à€KÙ-Ó/€K�ÑÙ%CÓ%E€KÐ!Ñ"Ù&EÓ&G€KÐ"Ñ#Ù!;Ó!=€K�ÑÙ!;Ó!=€K�ÑÙ#?Ó#A€K�Ñ Ù#?Ó#A€K�Ô r�   ré   )Úsamba.getoptÚgetoptr…   r.   Úsambar   r   Úsamba.samdbr   Ú
samba.authr   Úsamba.dcerpcr   Ú	samba.ndrr   r	   Úsamba.netcmd.commonr
   Úsamba.netcmdr   r   r   r   r   r�   r¢   r¨   r¶   r»   rä   ré   r}   r�   rP   Ú<module>rõ      s�   ðõ* Û 
Ý Ý Ý Ý %Ý !ß *Ý 6÷ó ôUH˜'ô UHôp2$ Wô 2$ôj3$ gô 3$ôl5$ ô 5$ôp5$ ô 5$ôpN( 7ô N(ôb( 7ô (ôD
B�\õ 
Br�   