
    g                     ~    S SK Jr  S SKJr  SSKJr  SSKJr  SSKJ	r	  SSK
JrJrJrJrJr  SSKJr   " S	 S
\5      rg)    )security)*DS_GUID_MANAGED_SERVICE_ACCOUNTS_CONTAINER   )Computer)GROUP_MSA_MEMBERSHIP_DEFAULT)
FieldError)BinaryField	EnumFieldIntegerField	SDDLFieldStringField)SupportedEncryptionTypesc                       \ rS rSrSr\" SSS9r\" S5      r\	" S\
S9r\" SS	S	S
9r\" SS	S	S
9r\" S\5      r\S 5       r\S 5       r\S 5       rS\4S jrS\4S jrSrg)GroupManagedServiceAccount!   zHA GroupManagedServiceAccount is a type of Computer which is also a User.zmsDS-ManagedPasswordInterval   )defaultdNSHostNamezmsDS-GroupMSAMembershipzmsDS-ManagedPasswordIdT)readonlyhiddenzmsDS-ManagedPasswordPreviousIdzmsDS-SupportedEncryptionTypesc                 J    U R                  U R                  5       [        5      $ )znReturn base Dn for Managed Service Accounts.

:param samdb: SamDB connection
:return: Dn to use for searching
)get_wellknown_dnget_default_basednr   )samdbs    :/usr/lib/python3/dist-packages/samba/domain/models/gmsa.pyget_base_dn&GroupManagedServiceAccount.get_base_dn/   s'     %%e&>&>&@&PR 	R    c                      g)NzmsDS-GroupManagedServiceAccount r    r   r   get_object_class+GroupManagedServiceAccount.get_object_class9   s    0r   c                 P   / nU R                   R                  R                   H  nUR                  [        R
                  -  (       aD  UR                  [        R                  :X  a&  UR                  [        UR                  5      5        Mi  [        S[        R                   S9e   U$ )z_Returns list of trustees from the msDS-GroupMSAMembership field.

:return: list of SID strings
z<Cannot be represented as a simple list (try viewing as SDDL))field)group_msa_membershipdaclacesaccess_maskr   SEC_ADS_READ_PROPtypeSEC_ACE_TYPE_ACCESS_ALLOWEDappendstrtrusteer   r   )selfallowedaces      r   trustees#GroupManagedServiceAccount.trustees=   s      ,,1166C8#=#==H$H$HHs3;;/0 R4IIK K 7 r   r.   c                    U R                   R                  R                  n[        R                  " 5       n[        R
                  Ul        [        R                  " U5      Ul        [        R                  Ul
        UR                  U5        X R                   R                  l        [        U5      U R                   R                  l        g)zAdds the User `trustee` to group_msa_membership.

Checking if the trustee already has access is the responsibility
of the caller.

:param trustee: SID of trustee to add
N)r%   r&   r'   r   r1   r+   r*   dom_sidr.   SEC_ADS_GENERIC_ALLr(   r,   lennum_acesr/   r.   r'   r1   s       r   add_trustee&GroupManagedServiceAccount.add_trusteeQ   s     ((--22lln77&&w/"66C /3!!&&+25d)!!&&/r   c                     U R                   R                  R                  nU H9  nU[        UR                  5      :X  d  M  U R                   R                  U5          g   g)zRemoves the User 'trustee' from group_msa_membership.

If the trustee doesn't have access already then do nothing.

:param trustee: SID of trustee to remove
N)r%   r&   r'   r-   r.   dacl_del_acer9   s       r   remove_trustee)GroupManagedServiceAccount.remove_trusteee   sM     ((--22C#ckk**))66s; r   r    N)__name__
__module____qualname____firstlineno____doc__r   managed_password_intervalr   dns_host_namer   r   r%   r	   managed_password_idmanaged_password_previous_idr
   r   supported_encryption_typesstaticmethodr   r!   propertyr2   r-   r:   r>   __static_attributes__r    r   r   r   r   !   s    R ,-K57!9.M$%>-IK%&>/3DB#./O8<T$K !*+J+C"E R R 1 1  &<3 <(c r   r   N)samba.dcerpcr   
samba.dsdbr   computerr   	constantsr   
exceptionsr   fieldsr	   r
   r   r   r   typesr   r   r    r   r   <module>rT      s-   . " A  3 " P P +P Pr   