+
    4Ssiê  ã                   ó€   € ^ RI Ht ^ RIHt ^RIHt ^RIHt ^RIH	t	 ^RI
HtHtHtHtHt ^RIHt  ! R R	]4      tR
# )é    )Úsecurity)Ú*DS_GUID_MANAGED_SERVICE_ACCOUNTS_CONTAINER)ÚComputer)ÚGROUP_MSA_MEMBERSHIP_DEFAULT)Ú
FieldError)ÚBinaryFieldÚ	EnumFieldÚIntegerFieldÚ	SDDLFieldÚStringField)ÚSupportedEncryptionTypesc                   óî   a € ] tR t^!t o Rt]! R^R7      t]! R4      t]	! R]
R7      t]! RRRR7      t]! R	RRR7      t]! R
]4      t]R 4       t]R 4       t]R 4       tV 3R lR ltV 3R lR ltRtV tR# )ÚGroupManagedServiceAccountzHA GroupManagedServiceAccount is a type of Computer which is also a User.zmsDS-ManagedPasswordInterval)ÚdefaultÚdNSHostNamezmsDS-GroupMSAMembershipzmsDS-ManagedPasswordIdT)ÚreadonlyÚhiddenzmsDS-ManagedPasswordPreviousIdzmsDS-SupportedEncryptionTypesc                óJ   € V P                  V P                  4       \        4      # )znReturn base Dn for Managed Service Accounts.

:param samdb: SamDB connection
:return: Dn to use for searching
)Úget_wellknown_dnÚget_default_basednr   )Úsamdbs   &Ú:/usr/lib/python3/dist-packages/samba/domain/models/gmsa.pyÚget_base_dnÚ&GroupManagedServiceAccount.get_base_dn/   s'   € ð ×%Ñ% e×&>Ñ&>Ó&@Ü&PóRð 	Ró    c                 ó   € R # )zmsDS-GroupManagedServiceAccount© r   r   r   Úget_object_classÚ+GroupManagedServiceAccount.get_object_class9   s   € á0r   c                ób  € . pV P                   P                  P                   Fˆ  pVP                  \        P
                  ,          '       dF   VP                  \        P                  8X  d'   VP                  \        VP                  4      4       Ko  \        R\        P                   R7      h	  V# )z_Returns list of trustees from the msDS-GroupMSAMembership field.

:return: list of SID strings
z<Cannot be represented as a simple list (try viewing as SDDL))Úfield)Úgroup_msa_membershipÚdaclÚacesÚaccess_maskr   ÚSEC_ADS_READ_PROPÚtypeÚSEC_ACE_TYPE_ACCESS_ALLOWEDÚappendÚstrÚtrusteer   r   )ÚselfÚallowedÚaces   &  r   ÚtrusteesÚ#GroupManagedServiceAccount.trustees=   s…   € ð ˆð ×,Ñ,×1Ñ1×6Ô6ˆCØ—‘¤8×#=Ñ#=×=Ô=ØŸ™¤H×$HÑ$HÔHØ—‘œs 3§;¡;Ó/Ö0ä ØRÜ4×IÑIôKð Kñ 7ð ˆr   c                ó    <€ V ^8„  d   QhRS[ /# ©é   r+   ©r*   )ÚformatÚ__classdict__s   "€r   Ú__annotate__Ú'GroupManagedServiceAccount.__annotate__Q   s   ø€ ÷ <ñ <¡3ñ <r   c                ó˜  € V P                   P                  P                  p\        P                  ! 4       p\        P
                  Vn        \        P                  ! V4      Vn        \        P                  Vn
        VP                  V4       W P                   P                  n        \        V4      V P                   P                  n        R# )z©Adds the User `trustee` to group_msa_membership.

Checking if the trustee already has access is the responsibility
of the caller.

:param trustee: SID of trustee to add
N)r"   r#   r$   r   r.   r(   r'   Údom_sidr+   ÚSEC_ADS_GENERIC_ALLr%   r)   ÚlenÚnum_aces©r,   r+   r$   r.   s   &&  r   Úadd_trusteeÚ&GroupManagedServiceAccount.add_trusteeQ   sŠ   € ð ×(Ñ(×-Ñ-×2Ñ2ˆä�lŠl‹nˆÜ×7Ñ7ˆŒÜ×&Ò& wÓ/ˆŒÜ"×6Ñ6ˆŒØ�‰�CÔð /3×!Ñ!×&Ñ&Ô+Ü25°d³)ˆ×!Ñ!×&Ñ&Ö/r   c                ó    <€ V ^8„  d   QhRS[ /# r2   r4   )r5   r6   s   "€r   r7   r8   e   s   ø€ ÷ ñ ¡cñ r   c                óÈ   € V P                   P                  P                  pV F;  pV\        VP                  4      8X  g   K  V P                   P                  V4        R# 	  R# )z�Removes the User 'trustee' from group_msa_membership.

If the trustee doesn't have access already then do nothing.

:param trustee: SID of trustee to remove
N)r"   r#   r$   r*   r+   Údacl_del_acer>   s   &&  r   Úremove_trusteeÚ)GroupManagedServiceAccount.remove_trusteee   sM   € ð ×(Ñ(×-Ñ-×2Ñ2ˆãˆCØœ#˜cŸk™kÓ*Ö*Ø×)Ñ)×6Ñ6°sÔ;Úó r   r   N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r
   Úmanaged_password_intervalr   Údns_host_namer   r   r"   r   Úmanaged_password_idÚmanaged_password_previous_idr	   r   Úsupported_encryption_typesÚstaticmethodr   r   Úpropertyr/   r?   rD   Ú__static_attributes__Ú__classdictcell__)r6   s   @r   r   r   !   sÁ   ø‡ € ÙRÙ ,Ð-KØ57ô!9Ðá Ó.€MÙ$Ð%>Ø-IôKÐá%Ð&>Ø/3¸DôBÐá#.Ð/OØ8<ÀTô$KÐ á!*Ð+JØ+Có"EÐð ñRó ðRð ñ1ó ð1ð ñó ð÷&<ð <÷(ö r   r   N)Úsamba.dcerpcr   Ú
samba.dsdbr   Úcomputerr   Ú	constantsr   Ú
exceptionsr   Úfieldsr   r	   r
   r   r   Útypesr   r   r   r   r   Ú<module>r[      s-   ðõ. "Ý Aå Ý 3Ý "ß PÕ PÝ +ôP ö Pr   