
    g                     r    S SK JrJrJrJrJr  S SKJr  SSKJ	r	J
r
  SSKJrJrJr  SSKJr   " S S\5      rg	)
    )FLAG_MOD_ADDFLAG_MOD_DELETELdbErrorMessageMessageElement)escaped_claim_id   )GrantMemberErrorRevokeMemberError)DnFieldBooleanFieldStringField)Modelc                       \ rS rSr\" S5      r\" S5      r\" S5      r	\" S5      r
\" S5      r\" SSS	9r\S
 5       r\S 5       rS rS rS rSrg)AuthenticationSilo    descriptionzmsDS-AuthNPolicySiloEnforcedzmsDS-UserAuthNPolicyzmsDS-ServiceAuthNPolicyzmsDS-ComputerAuthNPolicymsDS-AuthNPolicySiloMembersT)manyc                 H    U R                  5       nUR                  S5        U$ )zuReturn the base DN for the AuthenticationSilo model.

:param samdb: SamDB connection
:return: Dn object of container
z8CN=AuthN Silos,CN=AuthN Policy Configuration,CN=Services)get_config_basedn	add_child)samdbbase_dns     ?/usr/lib/python3/dist-packages/samba/domain/models/auth_silo.pyget_base_dnAuthenticationSilo.get_base_dn(   s)     ))+F	H    c                      g)NzmsDS-AuthNPolicySilo r    r   r   get_object_class#AuthenticationSilo.get_object_class4   s    %r   c                    [        U R                  S9nUR                  [        [	        UR                  5      [
        S5      5         UR                  U5        U R                  US/S9  g! [         a  n[        SU 35      eSnAff = f)zGrant a member access to the Authentication Silo.

Rather than saving the silo object and writing the entire member
list out again, just add one member only.

:param samdb: SamDB connection
:param member: Member to grant access to silo
dnr   z'Failed to grant access to silo member: Nmembersfields)
r   r%   addr   strr   modifyr   r
   refreshselfr   membermessagees        r   grantAuthenticationSilo.grant8   s     TWW%N3vyy><#@B 	C	RLL!
 	UI;/	  	R"%LQC#PQQ	R   A+ +
B5BBc                    [        U R                  S9nUR                  [        [	        UR                  5      [
        S5      5         UR                  U5        U R                  US/S9  g! [         a  n[        SU 35      eSnAff = f)zRevoke a member from the Authentication Silo.

Rather than saving the silo object and writing the entire member
list out again, just remove one member only.

:param samdb: SamDB connection
:param member: Member to revoke from silo
r$   r   zFailed to revoke silo member: Nr&   r'   )
r   r%   r)   r   r*   r   r+   r   r   r,   r-   s        r   revokeAuthenticationSilo.revokeO   s     TWW%N3vyy>?#@B 	C	JLL!
 	UI;/	  	J#&DQC$HII	Jr4   c                 4    S[        U R                  5       S3$ )NzBO:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/AuthenticationSilo == "z")))r   name)r.   s    r   get_authentication_sddl*AuthenticationSilo.get_authentication_sddlf   s$    **:499*E)FcK 	Lr   r    N)__name__
__module____qualname____firstlineno__r   r   r   enforcedr   user_authentication_policyservice_authentication_policycomputer_authentication_policyr&   staticmethodr   r!   r2   r6   r:   __static_attributes__r    r   r   r   r       s~    m,K:;H!()?!@$+,E$F!%,-G%H"3$?G	 	 & &0.0.Lr   r   N)ldbr   r   r   r   r   samba.sd_utilsr   
exceptionsr
   r   r(   r   r   r   modelr   r   r    r   r   <module>rJ      s-   . Q P + ; 6 6 HL HLr   