+
    4Ssisi                     :   ^ RI Ht ^ RIt^ RIHt ^ RIHt ^ RIHt ^ RI	H
t
 ^ RIHt ^ RIHtHt ^ RIHt ^ R	IHtHtHtHt  ! R
 R]4      t ! R R]4      t ! R R]4      t ! R R]4      t ! R R]4      t ! R R]4      t ! R R]4      t ! R R]4      tR# )    N)	provision)dsdb)SamDB)system_session)security)ndr_pack
ndr_unpack)_get_user_realm_domain)CommandCommandErrorSuperCommandOptionc            	          a  ] tR t^&t o RtRtR]P                  R]P                  R]P                  /t
]! RRR]R	R
R7      .tR.tR tRR ltRtV tR# )cmd_delegation_showz*Show the delegation setting of an account.z%prog <accountname> [options]	sambaoptscredoptsversionopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestaccountnamec                   VP                   pVP                  pR pVe   V\        P                  ,          '       g"   V P                  P                  RV R24       R# V\        P                  ,          '       g"   V P                  P                  RV R24       R# RpVP                   EFX  pVP                  p VP                  RV R2\        P                  R	7      p	\        V	4      ^8X  d   V	^ ,          P                  pR
pTP                  \        P"                  8X  g    TP                  \        P$                  8X  d&   T P                  P                  RT RT R24       RpM@TP                  \        P&                  8w  d"   TP                  \        P(                  8w  d   RpTP*                  \        P,                  ,          pTP*                  \        P.                  ,          pTP*                  \        P0                  ,          pTP*                  \        P2                  ,          pT'       d   T'       g   T'       g   RpMXT'       d%   T P                  P                  RT RT R24       RpT'       d%   T P                  P                  RT RT R24       RpTP4                  '       g   RpT'       d   EK  T'       d   T P6                  P                  R4       R
pT P6                  P                  RT R24       EK[  	  R#   \        P                   d0   p
T
P                  w  rT\        P                   8w  d   h  Rp
?
ELERp
?
ii ; i)zISecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentityNzWarning: DACL not present in z!
zWarning: DACL in z lacks SELF_RELATIVE flag!
Tz<SID=>)scopeFzWarning: ACE in z denies access for trustee zWarning: ACE for trustee z. has unexpected CONTAINER_INHERIT flag set in z* has unexpected INHERITED_ACE flag set in z0  Principals that may delegate to this account:
z*msDS-AllowedToActOnBehalfOfOtherIdentity: 
)daclr   r   SEC_DESC_DACL_PRESENTerrfwriteSEC_DESC_SELF_RELATIVEacestrusteesearchldb
SCOPE_BASElendnLdbErrorargsERR_NO_SUCH_OBJECTSEC_ACE_TYPE_ACCESS_DENIED!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWED"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTflagsSEC_ACE_FLAG_INHERIT_ONLYSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSEC_ACE_FLAG_INHERITED_ACEaccess_maskoutf)selfsamsecurity_descriptorr#   	desc_typewarning_infofirstacer)   reserrnum_ignoreinherit_onlyobject_inheritcontainer_inheritinherited_aces   &&&               9/usr/lib/python3/dist-packages/samba/netcmd/delegation.pyshow_security_descriptor,cmd_delegation_show.show_security_descriptor8   s   "''',,	C <y8+I+IIIIIOO;L>MN8::::IIOO/~ >4 5 699CkkG	(jj5	!3'*~~ ! 7 s8q=!!fiiGFH???xx8#M#MM		"2<. A66=Yc!C D ((hBBBH$O$OO99x'I'IIL YY)M)MMN		HCCC II(K(KKMN;L $IIOO&?y IP'3nC%9 : "F IIOO&?y IL'3nC%9 : "F???6IIOO %1 2!E		"L#*)2!/ 0{  << #000 1s   :%LM$MMNc                   VP                  4       pVP                  V4      pVf3   \        P                  ! WfP	                  R4      4      pVP
                  p	MTp	\        V	\        4       WvR7      p
\        VV
4      w  rpV
P                  R\        P                  ! V4      ,          \        P                  . ROR7      p\        V4      ^ 8X  d   \        RV,          4      h\        V4      ^8w  d   \        R	4      h\        V^ ,          P	                  R4      ^ ,          4      pV^ ,          P	                  R4      pV^ ,          P	                  R^ R
7      pV P                   P#                  R\%        V^ ,          P&                  4      ,          4       V P                   P#                  R\)        V\*        P,                  ,          4      ,          4       V P                   P#                  R\)        V\*        P.                  ,          4      ,          4       V'       dG   V P                   P#                  R4       V F%  pV P                   P#                  RV,          4       K'  	  Ve0    \1        \2        P4                  V4      pV P7                  V
V4       R # R #   \8         d     T P:                  P#                  R4        R # i ; i)Nrealmsession_infocredentialslpsAMAccountName=%suserAccountControlmsDS-AllowedToDelegateTo(msDS-AllowedToActOnBehalfOfOtherIdentity
expressionr!   attrs Unable to find account name '%s'Found multiple accounts.idxzAccount-DN: %s
zUF_TRUSTED_FOR_DELEGATION: %s
z.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s
z)  Services this account may delegate to:
zmsDS-AllowedToDelegateTo: %s
znWarning: Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity could not be unmarshalled!
)rW   rX   rY   )get_loadparmget_credentialsr   provision_paths_from_lpgetsamdbr   r   r
   r*   r+   binary_encodeSCOPE_SUBTREEr-   r   intr<   r&   strr.   boolr   UF_TRUSTED_FOR_DELEGATION)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONr	   r   
descriptorrN   RuntimeErrorr%   )r=   r   r   r   r   r   rU   credspathspathr>   cleanedaccountrQ   domainrD   uacallowedallowed_fromar?   s   &&&&&&              rM   runcmd_delegation_show.run   sA   ##%((,955b&&/JE;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 L  M
 s8q=AKOPPX]9::#a&**12156a&**781vzz"LRSzT		*SQ^;<		9sT%C%CCDE 	F		IS4#Q#QQRS 	T IIOOHI		 @1 DE #H&01D1Dl&S# --c3FG $   @		 !? @@s   $J &J>=J> NNNN)__name__
__module____qualname____firstlineno____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   ri   takes_options
takes_argsrN   rx   __static_attributes____classdictcell____classdict__s   @rM   r   r   &   st     4.H 	W))G..w-- 	tW#JQT3	(M
  JP0d1H 1H    r   c            	          a  ] tR t^t o RtRtR]P                  R]P                  R]P                  /t
]! RRR]R	R
R7      .tRR.tRR ltRtV tR# )cmd_delegation_for_any_servicez3Set/unset UF_TRUSTED_FOR_DELEGATION for an account.(%prog <accountname> [(on|off)] [options]r   r   r   r   r   r   r   r   r   r   onoffNc                   VR 8X  d   RpMVR8X  d   RpM\        RV,          4      hVP                  4       pVP                  V4      p	\        P                  ! WP                  R4      4      p
Vf   V
P                  pMTp\        V\        4       WR7      p\        VV4      w  rpR\        P                  ! V4      ,          p\        P                  p VP                  VVR	VRR
7       R#   \         d   p\        T4      hRp?ii ; i)onToffF0invalid argument: '%s' (choose from 'on', 'off')rQ   NrR   rV   zTrusted-for-Delegation	flags_strr   strict)r   ra   rb   r   rc   rd   re   r   r   r
   r+   rf   r   rk   toggle_userAccountFlags	Exceptionr=   r   r   r   r   r   r   r   rU   ro   rp   rq   r>   rr   rQ   rs   search_filterflagrE   s   &&&&&&&            rM   rx   "cmd_delegation_for_any_service.run   s    D=Be^BQTYYZZ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' ,c.?.?.OO--	$''t2J+-d ( <  	$s##	$s   C+ +D6DDrz   r{   r|   r}   r~   r   r   r   r   r   r   r   r   r   ri   r   r   rx   r   r   r   s   @rM   r   r      sn     =9H 	W))G..w-- 	tW#JQT3	(M
  )J $  $r   r   c            	          a  ] tR t^t o RtRtR]P                  R]P                  R]P                  /t
]! RRR]R	R
R7      .tRR.tRR ltRtV tR# )cmd_delegation_for_any_protocolzOSet/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.r   r   r   r   r   r   r   r   r   r   r   r   Nc                   R pVR8X  d   RpMVR8X  d   R pM\        RV,          4      hVP                  4       pVP                  VRR7      p	\        P                  ! WP                  R4      4      p
Vf   V
P                  pMTp\        V\        4       WR7      p\        VV4      w  rpR	\        P                  ! V4      ,          p\        P                  p VP                  VVR
VRR7       R#   \         d   p\        T4      hRp?ii ; i)Fr   Tr   r   )fallback_machinerQ   NrR   rV   z&Trusted-to-Authenticate-for-Delegationr   )r   ra   rb   r   rc   rd   re   r   r   r
   r+   rf   r   rl   r   r   r   s   &&&&&&&            rM   rx   #cmd_delegation_for_any_protocol.run  s    D=Be^BQTYYZZ##%((d(C11"ffWoF9;;DDD~'7 %. +AAD+F' ,c.?.?.OO==	$''t2Z+-d ( <  	$s##	$s   C/ /D
:DD
rz   r{   r   r   s   @rM   r   r      sn     Y9H 	W))G..w-- 	tW#JQT3	(M
  )J!$ !$r   r   c            	          a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
]! RRR	]R
RR7      .tRR.tRR ltRtV tR# )cmd_delegation_add_servicei)  zZAdd a service principal to msDS-AllowedToDelegateTo so that an account may delegate to it.)%prog <accountname> <principal> [options]r   r   r   r   r   r   r   r   r   r   	principalNc                   VP                  4       pVP                  V4      p\        P                  ! WwP	                  R 4      4      p	Vf   V	P
                  p
MTp
\        V
\        4       WR7      p\        VV4      w  rpVP                  R\        P                  ! V4      ,          \        P                  R.R7      p\        V4      ^ 8X  d   \        RV,          4      h\        V4      ^8w  d   \        R4      h\        P                  ! 4       pV^ ,          P                   Vn        \        P"                  ! V.\        P$                  R4      VR&    VP'                  V4       R#   \(         d   p\        T4      hRp?ii ; irQ   NrR   rV   rX   rZ   r]   r^   )ra   rb   r   rc   rd   re   r   r   r
   r*   r+   rf   rg   r-   r   Messager.   MessageElementFLAG_MOD_ADDmodifyr   r=   r   r   r   r   r   r   rU   ro   rp   rq   r>   rr   rQ   rs   rD   msgrE   s   &&&&&&&           rM   rx   cmd_delegation_add_service.run;  sT    ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPPX]9::kkmQ*-*<*<i[=@=M=M=W+Y&'	$JJsO 	$s##	$   E% %F 0E;;F rz   r{   r   r   s   @rM   r   r   )  sn     d:H 	W))G..w-- 	tW#JQT3	(M
  -J#$ #$r   r   c            	          a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
]! RRR	]R
RR7      .tRR.tRR ltRtV tR# )cmd_delegation_del_serviceia  ziDelete a service principal from msDS-AllowedToDelegateTo so that an account may no longer delegate to it.r   r   r   r   r   r   r   r   r   r   r   r   Nc                   VP                  4       pVP                  V4      p\        P                  ! WwP	                  R 4      4      p	Vf   V	P
                  p
MTp
\        V
\        4       WR7      p\        VV4      w  rpVP                  R\        P                  ! V4      ,          \        P                  R.R7      p\        V4      ^ 8X  d   \        RV,          4      h\        V4      ^8w  d   \        R4      h\        P                  ! 4       pV^ ,          P                   Vn        \        P"                  ! V.\        P$                  R4      VR&    VP'                  V4       R#   \(         d   p\        T4      hRp?ii ; ir   )ra   rb   r   rc   rd   re   r   r   r
   r*   r+   rf   rg   r-   r   r   r.   r   FLAG_MOD_DELETEr   r   r   s   &&&&&&&           rM   rx   cmd_delegation_del_service.runs  sT    ##%((,11"ffWoF9;;DDD~'7 %. +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPPX]9::kkmQ*-*<*<i[=@=P=P=W+Y&'	$JJsO 	$s##	$r   rz   r{   r   r   s   @rM   r   r   a  sn     s:H 	W))G..w-- 	tW#JQT3	(M
  -J#$ #$r   r   c            	          a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
]! RRR	]R
RR7      .tRR.tRR ltRtV tR# )cmd_delegation_add_principali  z\Add a principal to msDS-AllowedToActOnBehalfOfOtherIdentity that may delegate to an account.r   r   r   r   r   r   r   r   r   r   r   r   Nc           
     	  a VP                  4       pVP                  V4      p\        P                  ! WwP	                  R 4      4      p	Vf   V	P
                  p
MTp
\        V
\        4       WR7      p\        W4      w  p pVP                  R\        P                  ! V4      ,          \        P                  R.R7      p\        V4      ^ 8X  d   \        RV R24      h\        V4      ^8w  d   \        R4      hV^ ,          P	                  R^ R	7      pVf   \        P                   ! \        P"                  4      p\        P$                  ! 4       p\        P&                  Vn        \        P*                  \        P,                  ,          Vn        VVn        RpM' \3        \        P$                  V4      pTP6                  pVf2   \        P8                  ! 4       p\        P:                  Vn        ^ Vn        \        W+4      w  p pVP                  R\        P                  ! V4      ,          \        P                  R.R7      p\        V4      ^ 8X  d   \        RV R24      h\        V4      ^8w  d   \        R4      h\        P                   ! VP?                  RV^ ,          P	                  R^ R	7      4      PA                  R4      4      oVPB                  p\D        ;QJ d    V3R lV 4       F  '       g   K   RM	  RM! V3R lV 4       4      '       d   \        RV RV R24      h\        PF                  ! 4       p\        PH                  Vn        ^ Vn%        \        PL                  Vn'        SVn(        VPS                  V4       VVn!        V;P<                  ^,          un        VVn        \U        V4      p\        PV                  ! 4       pV^ ,          PX                  Vn,        Ve*   \        PZ                  ! V\        P\                  R4      VR&   \        PZ                  ! V\        P^                  R4      VR&    VPa                  V4       R#   \4         d    \        R
T R24      hi ; i  \        Pb                   dD   pTPd                  w  ppT\        Pf                  8X  d   \        RT R24      h\        T4      hRp?ii ; i)rQ   NrR   rV   rY   rZ   zUnable to find account name ''r^   r_   WSecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account '' could not be unmarshalled!	objectSidUnable to find principal name '	objectSIDutf-8c              3   @   <"   T F  qP                   S8H  x  K  	  R # 5i)N)r)   ).0rC   	princ_sids   & rM   	<genexpr>3cmd_delegation_add_principal.run.<locals>.<genexpr>  s     84C{{i'4s   TFzACE for principal 'zl' already present in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ''.01RRefused to update attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ':': a conflicting attribute update occurred simultaneously.)4ra   rb   r   rc   rd   re   r   r   r
   r*   r+   rf   rg   r-   r   r   dom_sidSID_BUILTIN_ADMINISTRATORSrm   SD_REVISIONrevisionr$   r'   r   	owner_sidr	   rn   r#   aclSECURITY_ACL_REVISION_ADSnum_acesschema_format_valuedecoder(   anyrC   r4   r6   SEC_ADS_GENERIC_ALLr;   r)   appendr   r   r.   r   r   r   r   r/   r0   ERR_NO_SUCH_ATTRIBUTE)r=   r   r   r   r   r   r   rU   ro   rp   rq   r>   rr   rG   account_resdatar   security_descr#   cleanedprinc	princ_resr(   rC   new_datar   rE   rF   r   s   &&&&&&&                    @rM   rx    cmd_delegation_add_principal.run  sC    ##%((,11"ffWoF9;;DDD~'7 %.  6kG1jj*n-.##=>	 ! @
 {q !>{m1MNN"9::1~!!6A " ?< (()L)LMI$//1M%-%9%9M""*"@"@"*"A"A#BM&/M#D5 *8+>+> E !%%D<<<>D$>>DMDM 4ICaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN^q 9::$$##!  ! 466<fWoG	
 yy 384833384888%i[ 1  =$% % lln77	"66C	!M*
 kkmQ""))c)):<CH %%c&&68C	(JJsOO   5" &33>- @3$4 5 55P || 		(XXFCc///"#} %/01 1 #3''		(s$   Q :Q+ Q(+S >R>>Srz   r{   r   r   s   @rM   r   r     so     f:H 	W))G..w-- 	tW#JS	2M
  -J|( |(r   r   c            	          a  ] tR tRt o RtRtR]P                  R]P                  R]P                  /t
]! RRR	]R
RR7      .tRR.tRR ltRtV tR# )cmd_delegation_del_principali*  zkDelete a principal from msDS-AllowedToActOnBehalfOfOtherIdentity that may no longer delegate to an account.r   r   r   r   r   r   r   r   r   r   r   r   Nc           
        VP                  4       pVP                  V4      p\        P                  ! WwP	                  R 4      4      p	Vf   V	P
                  p
MTp
\        V
\        4       WR7      p\        W4      w  p pVP                  R\        P                  ! V4      ,          \        P                  R.R7      p\        V4      ^ 8X  d   \        RV,          4      h\        V4      ^8w  d   \        R4      hV^ ,          P	                  R^ R7      pVf   \        R	V R
24      h \        \         P"                  V4      pTP&                  pTf   \        RT R24      h\        Y+4      w  p pTP                  R\        P                  ! T4      ,          \        P                  R.R7      p\        T4      ^ 8X  d   \        RT R24      h\        T4      ^8w  d   \        R4      h\         P(                  ! TP+                  RT^ ,          P	                  R^ R7      4      P-                  R4      4      pTP.                  pT Uu. uF  pTP0                  T8w  g   K  TNK  	  pp\        T4      \        T4      8X  d   \        RT RT R24      h\        T4      Tn        TTn        TTn        \5        T4      p\        P6                  ! 4       pT^ ,          P8                  Tn        \        P:                  ! T\        P<                  R4      TR&   \        P:                  ! T\        P>                  R4      TR&    TPA                  T4       R#   \$         d    \        RT R24      hi ; iu upi   \        PB                   dD   pTPD                  w  ppT\        PF                  8X  d   \        RT R24      h\        T4      hRp?ii ; i)rQ   NrR   rV   rY   rZ   r]   r^   r_   z@Attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z' not present!r   r   zkDACL not present on Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z'!r   r   r   r   r   z"Unable to find ACE for principal 'z\' in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'r   r   r   r   r   )$ra   rb   r   rc   rd   re   r   r   r
   r*   r+   rf   rg   r-   r   r	   r   rm   rn   r#   r   r   r   r(   r)   r   r   r   r.   r   r   r   r   r/   r0   r   )r=   r   r   r   r   r   r   rU   ro   rp   rq   r>   rr   rG   r   r   r   r#   r   r   r   old_acesrC   r(   r   r   rE   rF   s   &&&&&&&                     rM   rx    cmd_delegation_del_principal.run<  s    ##%((,11"ffWoF9;;DDD~'7 %.  6kG1jj*n-.##=>	 ! @
 {q AKOPP"9::1~!!6A " ?< "++6-~ G H H	1&x':':DAM !!< "+ ,7-r ; < < 4ICaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN^q 9::$$##!  ! 466<fWoG	
 99  (Dx3;;)+CxD t9H% "##,+ .+ ,7-r	 ; < < D		!M*
 kkmQ""%%#%%68C %%c&&68C	(JJsO  	1 "++6- 8/ 0 1 1	1D E< || 		(XXFCc///"#} %/01 1 #3''		(s0   (M M*M*9M/ M'/O>OOrz   r{   r   r   s   @rM   r   r   *  so     u:H 	W))G..w-- 	tW#JS	2M
  -Jm( m(r   r   c                       ] tR tRtRt/ t]! 4       ]R&   ]! 4       ]R&   ]! 4       ]R&   ]	! 4       ]R&   ]
! 4       ]R&   ]! 4       ]R&   ]! 4       ]R	&   R
tR# )cmd_delegationi  zDelegation management.showzfor-any-servicezfor-any-protocolzadd-servicezdel-servicezadd-principalzdel-principalrz   N)r|   r}   r~   r   r   subcommandsr   r   r   r   r   r   r   r   rz   r   rM   r   r     sg     K-/K%C%EK!"&E&GK"#!;!=K!;!=K#?#AK #?#AK r   r   )samba.getoptgetoptr   r+   sambar   r   samba.samdbr   
samba.authr   samba.dcerpcr   	samba.ndrr   r	   samba.netcmd.commonr
   samba.netcmdr   r   r   r   r   r   r   r   r   r   r   r   rz   r   rM   <module>r      s   *  
    % ! * 6 UH' UHp2$W 2$j3$g 3$l5$ 5$p5$ 5$pN(7 N(b(7 (D
B\ 
Br   