Skip to content

Commit

Permalink
roles: extended gpo feature to samba role
Browse files Browse the repository at this point in the history
* added SambaSite object
* added SambaComputer object
* added GenericGPO class and methods
* added some ldap variables to perform ldap functions
  • Loading branch information
Dan Lavu committed Sep 16, 2024
1 parent 0b213ff commit c677682
Show file tree
Hide file tree
Showing 4 changed files with 674 additions and 34 deletions.
3 changes: 3 additions & 0 deletions sssd_test_framework/hosts/samba.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ def __init__(self, *args, **kwargs) -> None:

self._features: dict[str, bool] | None = None

self.admin: str = self.config.get("username", "Administrator")
"""Username of the admin user, defaults to value of ``Administrator``."""

self.adminpw: str = self.config.get("adminpw", self.bindpw)
"""Password of the admin user, defaults to value of ``bindpw``."""

Expand Down
66 changes: 39 additions & 27 deletions sssd_test_framework/roles/ad.py
Original file line number Diff line number Diff line change
Expand Up @@ -549,7 +549,7 @@ def _add(self, attrs: CLIBuilderArgs) -> None:

def _modify(self, attrs: CLIBuilderArgs) -> None:
"""
Modifiy Active Directory object.
Modify Active Directory object.
:param attrs: Object attributes in :class:`pytest_mh.cli.CLIBuilder` format, defaults to dict()
:type attrs: pytest_mh.cli.CLIBuilderArgs, optional
Expand Down Expand Up @@ -1655,16 +1655,18 @@ def __init__(self, role: AD, name: str) -> None:
self._search_base: str = f"cn=policies,cn=system,{self.role.host.naming_context}"
"""Group policy search base."""

self._dn = self.get("DistinguishedName")
self._dn = self._get("DistinguishedName")
"""Group policy dn."""

self._cn = self.get("CN")
self._cn = self._get("CN")
"""Group policy cn."""

def get(self, key: str) -> str | None:
def _get(self, key: str) -> str | None:
"""
Get group policy attributes.
This method is unique for the GPO class, unlike SambaGPO class, the ADObject class is not inherited.
:param key: Attribute to get.
:type key: str
:return: Key value.
Expand Down Expand Up @@ -1713,8 +1715,8 @@ def add(self) -> GPO:
"""
self.role.host.conn.run(f'New-GPO -name "{self.name}"')

self._cn = self.get("CN")
self._dn = self.get("DistinguishedName")
self._cn = self._get("CN")
self._dn = self._get("DistinguishedName")

self.role.host.conn.run(
rf"""
Expand All @@ -1733,43 +1735,53 @@ def add(self) -> GPO:

def link(
self,
op: str | None = "New",
target: str | None = None,
args: list[str] | str | None = None,
enforced: bool | None = None,
disabled: bool | None = False,
order: int | None = 0,
) -> GPO:
"""
Link the group policy to the a target object inside the directory, a site, domain or an ou.
..Note::
The New and Set cmdlets are identical. To modify an an existing link,
change the $op parameter to "Set", i.e. to disable 'Enforced'
Link the group policy to the target object inside the directory, a site, domain or an ou.
ou_policy.link("Set", args=["-Enforced No"])
:param op: Cmdlet operation, defaults to "New"
:type op: str, optional
:param target: Group policy target
:type target: str, optional
:param args: Additional arguments
:type args: list[str] | None, optional
:param enforced: Enforced the policy
:type enforced: bool, optional
:param disabled: Disable the policy
:type disabled: bool, optional
:param order: Order number
:type order: int, optional
:return: Group policy object
:rtype: GPO
"""
if args is None:
args = []
args: str = ""

if isinstance(args, list):
args = " ".join(args)
elif args is None:
args = ""
if enforced is True:
args = args + " -Enforce Yes"
if enforced is False:
args = args + " -Enforce No"

if disabled is True:
args = args + " -LinkEnabled No"
else:
args = args + " -LinkEnabled Yes"

if order != 0:
args = args + f" -Order {str(order)}"

if target is None and self.target is None:
self.target = "Default-First-Site-Name"

if target is not None and self.target is None:
self.target = target

self.role.host.conn.run(f'{op}-GPLink -Guid "{self._cn}" -Target "{self.target}" -LinkEnabled Yes {args}')
# The cmdlets take the same arguements, but one is for new links and the other is for existing links.
# This is combined to simplify gpo management.
new_link = self.role.host.conn.run(
f'New-GPLink -Guid "{self._cn}" -Target "{self.target}" {args}', raise_on_error=False
)
if new_link.rc != 0:
self.role.host.conn.run(f'Set-GPLink -Guid "{self._cn}" -Target "{self.target}" {args}')

return self

Expand Down Expand Up @@ -1836,7 +1848,7 @@ def policy(self, logon_rights: dict[str, list[ADObject]], cfg: dict[str, Any] |
This method does the remaining configuration of the group policy. It updates
'GptTmpl.inf' with security logon right keys with the SIDs of users and groups
objects. The *Remote* keys can be omitted, in which the corresponding keys values
objects. The *Remote* keys can be omitted, in which the interactive key's value
will then be used.
To add users and groups to the policy, the SID must be used for the values. The
Expand Down
Loading

0 comments on commit c677682

Please sign in to comment.