Merge lp:~kernevil/samba/devel into lp:samba

[Kernevil]

Added switch "--enable-reversible-encryption" when creating an user. This sets the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED flag on the user account, storing the password in clear text inside the "supplementalCredentials" blob. This is needed to sync passwords with external applications.

[lp:~kernevil/samba/devel]

25247. By Kernevil on 2012-02-20

Merge trunk revs 318..320

[Jelmer Vernooij (jelmer)]

Hi,

Thanks for the MP.

On Sun, Feb 19, 2012 at 07:11:20PM -0000, Kernevil wrote:
> Added switch "--enable-reversible-encryption" when creating an user. This sets the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED flag on the user account, storing the password in clear text inside the "supplementalCredentials" blob. This is needed to sync passwords with external applications.
> --
> === modified file 'source4/scripting/python/samba/samdb.py'
> --- source4/scripting/python/samba/samdb.py 2011-12-07 02:09:08 +0000
> +++ source4/scripting/python/samba/samdb.py 2012-02-19 19:10:26 +0000
> @@ -104,6 +104,24 @@
> flags = samba.dsdb.UF_ACCOUNTDISABLE | samba.dsdb.UF_PASSWD_NOTREQD
> self.toggle_userAccountFlags(search_filter, flags, on=False)
>
> + def enable_reversible_encryption(self, search_filter):
> + """Enables reversible password encryption
> +
> + :param search_filter: LDAP filter to find the user (eg
> + samccountname=name)
s/samccountname/samaccountname/

> + """
> + flags = samba.dsdb.UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
> + self.toggle_userAccountFlags(search_filter, flags, on=True)
> +
> + def disable_reversible_encryption(self, search_filter):
> + """Disables reversible password encryption
> +
> + :param search_filter: LDAP filter to find the user (eg
> + samccountname=name)
> + """
> + flags = samba.dsdb.UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
> + self.toggle_userAccountFlags(search_filter, flags, on=False)
I'm not sure if this really warrants separate methods (though I guess
it is consistent with the other methods).

Can you make this a single method with just a boolean argument
"enabled" or something like that?
> +
> def toggle_userAccountFlags(self, search_filter, flags, flags_str=None,
> on=True, strict=False):
> """toggle_userAccountFlags
> @@ -292,8 +310,8 @@

Cheers,

Jelmer

[lp:~kernevil/samba/devel]

25248. By Kernevil on 2012-02-22

* Fix spell errors on comments
* Replace 'disable_reversible_encryption' method by a boolean parameter on
  method 'set_reversible_encryption'

25249. By Kernevil on 2012-02-24

Merge trunk revs 25321..25400

25250. By Kernevil on 2012-02-24

Fix wrong function call

Unmerged revisions

25250. By Kernevil on 2012-02-24

Fix wrong function call

25249. By Kernevil on 2012-02-24

Merge trunk revs 25321..25400

25248. By Kernevil on 2012-02-22

* Fix spell errors on comments
* Replace 'disable_reversible_encryption' method by a boolean parameter on
  method 'set_reversible_encryption'

25247. By Kernevil on 2012-02-20

Merge trunk revs 318..320

25246. By Kernevil on 2012-02-19

Merge trunk

25245. By Kernevil on 2012-02-19

Merge trunk

25244. By Kernevil on 2012-02-16

Merge parent branch

25243. By Kernevil on 2012-02-16

Add '--enable-reversible-encryption' to user creation'

=== modified file 'source4/scripting/python/samba/netcmd/user.py'
--- source4/scripting/python/samba/netcmd/user.py	2012-02-07 00:11:08 +0000
+++ source4/scripting/python/samba/netcmd/user.py	2012-02-24 12:21:22 +0000
@@ -98,6 +98,7 @@
         Option("--internet-address", help="User's home page", type=str),
         Option("--telephone-number", help="User's phone number", type=str),
         Option("--physical-delivery-office", help="User's office location", type=str),
+        Option("--enable-reversible-encryption", help="Enable reversible password encryption", action="store_true"),
     ]
 
     takes_args = ["username", "password?"]
@@ -113,7 +114,8 @@
             use_username_as_cn=False, userou=None, surname=None, given_name=None, initials=None,
             profile_path=None, script_path=None, home_drive=None, home_directory=None,
             job_title=None, department=None, company=None, description=None,
-            mail_address=None, internet_address=None, telephone_number=None, physical_delivery_office=None):
+            mail_address=None, internet_address=None, telephone_number=None, physical_delivery_office=None,
+            enable_reversible_encryption=False):
 
         if random_password:
             password = generate_random_password(128, 255)
@@ -135,7 +137,8 @@
                           profilepath=profile_path, homedrive=home_drive, scriptpath=script_path, homedirectory=home_directory,
                           jobtitle=job_title, department=department, company=company, description=description,
                           mailaddress=mail_address, internetaddress=internet_address,
-                          telephonenumber=telephone_number, physicaldeliveryoffice=physical_delivery_office)
+                          telephonenumber=telephone_number, physicaldeliveryoffice=physical_delivery_office,
+                          enablereversibleencryption=enable_reversible_encryption)
         except Exception, e:
             raise CommandError("Failed to add user '%s': " % username, e)
 

=== modified file 'source4/scripting/python/samba/samdb.py'
--- source4/scripting/python/samba/samdb.py	2011-12-07 02:09:08 +0000
+++ source4/scripting/python/samba/samdb.py	2012-02-24 12:21:22 +0000
@@ -88,7 +88,7 @@
         """Disables an account
 
         :param search_filter: LDAP filter to find the user (eg
-            samccountname=name)
+            samaccountname=name)
         """
 
         flags = samba.dsdb.UF_ACCOUNTDISABLE
@@ -98,18 +98,28 @@
         """Enables an account
 
         :param search_filter: LDAP filter to find the user (eg
-            samccountname=name)
+            samaccountname=name)
         """
 
         flags = samba.dsdb.UF_ACCOUNTDISABLE | samba.dsdb.UF_PASSWD_NOTREQD
         self.toggle_userAccountFlags(search_filter, flags, on=False)
 
+    def set_reversible_encryption(self, search_filter, enabled):
+        """Enables or disables the reversible password encryption account flag
+
+        :param search_filter: LDAP filter to find the user (eg
+            samaccountname=name)
+        :param enable: Enable or disable the flag
+        """
+        flags = samba.dsdb.UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
+        self.toggle_userAccountFlags(search_filter, flags, on=enabled)
+
     def toggle_userAccountFlags(self, search_filter, flags, flags_str=None,
                                 on=True, strict=False):
         """toggle_userAccountFlags
 
         :param search_filter: LDAP filter to find the user (eg
-            samccountname=name)
+            samaccountname=name)
         :flags: samba.dsdb.UF_* flags
         :on: on=True (default) => set, on=False => unset
         :strict: strict=False (default) ignore if no action is needed
@@ -153,7 +163,7 @@
         """Forces a password change at next login
 
         :param search_filter: LDAP filter to find the user (eg
-            samccountname=name)
+            samaccountname=name)
         """
         res = self.search(base=self.domain_dn(), scope=ldb.SCOPE_SUBTREE,
                           expression=search_filter, attrs=[])
@@ -292,8 +302,8 @@
             initials=None, profilepath=None, scriptpath=None, homedrive=None,
             homedirectory=None, jobtitle=None, department=None, company=None,
             description=None, mailaddress=None, internetaddress=None,
-            telephonenumber=None, physicaldeliveryoffice=None, sd=None,
-            setpassword=True):
+            telephonenumber=None, physicaldeliveryoffice=None, enablereversibleencryption=False,
+            sd=None, setpassword=True):
         """Adds a new user with additional parameters
 
         :param username: Name of the new user
@@ -317,6 +327,7 @@
         :param internetaddress: Home page of the new user
         :param telephonenumber: Phone number of the new user
         :param physicaldeliveryoffice: Office location of the new user
+        :param enablereversibleencryption: Enable reversible password encryption
         :param sd: security descriptor of the object
         :param setpassword: optionally disable password reset
         """
@@ -402,6 +413,9 @@
         try:
             self.add(ldbmessage)
 
+            if enablereversibleencryption:
+                self.set_reversible_encryption("(sAMAccountName=%s)" % ldb.binary_encode(username), True)
+
             # Sets the password for it
             if setpassword:
                 self.setpassword("(samAccountName=%s)" % ldb.binary_encode(username), password,
@@ -440,7 +454,7 @@
         """Sets the password for a user
 
         :param search_filter: LDAP filter to find the user (eg
-            samccountname=name)
+            samaccountname=name)
         :param password: Password for the user
         :param force_change_at_next_login: Force password change
         """