+
    ç‹cjó\  ã                   ó¸  € ^ RI t ^ RIt^ RIHtHtHt ^ RIHt ^ RIH	t	 ^ RI
Ht ^ RIHtHt ^ RIHt ^ RIHt ^ RIt^ R	IHt ^ R
IHtHt ^ RIt^ RIt^ RIHt ^ RIt ^ RIHt ^ RI!H"t" ^ RI#H$t$ ^ RI%H&t& ^ RI'H(t( Rt)R"t*. R#Ot+R t,R t-R t.R$R lt/R t0R t1R t2R t3R t4R t5R t6R%R lt7 ! R  R!]]4      t8R#   ] d    R t]P@                  ! R4        Lti ; i)&é    N)Ú
gp_pol_extÚ
gp_applierÚGPOSTATE)ÚLdb)Úmisc)Ú
ndr_unpack)ÚSCOPE_SUBTREEÚ
SCOPE_BASE)Úsystem_session)Úget_dc_hostname©Úwhich)ÚPopenÚPIPE)Úlog)Úload_der_pkcs7_certificatesc                 ó   € . # ©N© )Úxs   &ÚB/usr/lib/python3/dist-packages/samba/gp/gp_cert_auto_enroll_ext.pyr   r   &   s   € ¨r¨	ó    zNpython cryptography missing pkcs7 support. Certificate chain parsing will fail)ÚEncoding)Úload_der_x509_certificate)Údefault_backend)Ú
get_strings9   
-----BEGIN CERTIFICATE-----
%s
-----END CERTIFICATE-----c                ól  € / pV  FH  pVR,          VP                  4       9  d   . WR,          &   WR,          ,          P                  V4       KJ  	  VP                  4        F³  pVP                  R R7       V Uu. uF  q"R,          NK  	  pp\	        V4      pV Fu  pVP                  V4      p\        V4      \        P                  ! \        V4      V4      ,
          ^,
          pWx8X  d   KS  R p	\        W7V^,            V	R7      W7V^,           % Kw  	  Kµ  	  \        VP                  4       4      # u upi )zôGroup and Sort End Point Information.

[MS-CAESO] 4.4.5.3.2.3
In this step autoenrollment processes the end point information by grouping
it by CEP ID and sorting in the order with which it will use the end point
to access the CEP information.
ÚPolicyIDc                 ó   € V R ,          # )ÚCostr   ©Úes   &r   Ú<lambda>Ú6group_and_sort_end_point_information.<locals>.<lambda>N   s   € ¨1¨V®9r   )Úkeyr    c                 óF   € V R ,          ^8X  d   ^ # V R ,          ^8X  d   ^# ^# )Ú	AuthFlagsr   r!   s   &r   Ú	sort_authÚ7group_and_sort_end_point_information.<locals>.sort_auth]   s#   € à�[•> SÔ(Ùà�{•^ sÔ*Ùár   )ÚkeysÚappendÚvaluesÚsortÚsetÚindexÚlenÚoperatorÚindexOfÚreversedÚsortedÚlist)
Úend_point_informationÚend_point_groupsr"   Úend_point_groupÚ	cost_listÚcostsÚcostÚiÚjr(   s
   &         r   Ú$group_and_sort_end_point_informationr>   :   s!  € ð ÐÛ"ˆØˆZ�=Ð 0× 5Ñ 5Ó 7Ô7Ø.0Ð˜z�]Ñ+Ø˜:�Õ'×.Ñ.¨qÖ1ñ #ð ,×2Ñ2Ö4ˆð 	×ÑÑ!4ÐÔ5ñ )8Ó8© 1�v—Y�Y©ˆ	Ð8Ü�I“ˆÛˆDØ—‘ Ó%ˆAÜ�I“œx×/Ò/´¸Ó0CÀTÓJÕJÈ1ÕLˆAØŒvÙòô &,¨O¸aÀ½cÐ,BØ09ô&;ˆO˜a �cÒ"ó' ñ 5ô: Ð ×'Ñ'Ó)Ó*Ð*ùò/ 9s   Á;D1c                óð  € / pRpV  Fy  pVP                   P                  V4      '       g   K&  VP                   P                  VR4      pWAP                  4       9  d   / W&   VP                  W,          VP
                  &   K{  	  VP                  4        FÅ  p\        P                  ! \        VR,          4      pV'       dW   RVP                  R4      P                  RR4      ,          pWER&   VP                  R4      VR	&   VP                  R
4      VR
&   Kƒ  VR,          P                  4       R8w  g   K¡  RVR,          /p\        P                  ! RV4       / u # 	  \        VP                  4       4      pV# )zŽObtain End Point Information.

[MS-CAESO] 4.4.5.3.2.2
In this step autoenrollment initializes the
CertificateEnrollmentPolicyEndPoints table.
z7Software\Policies\Microsoft\Cryptography\PolicyServers\Ú ÚURLz%s-CAÚserverÚ.Ú-ÚnameÚhostnameÚauthzldap:ÚendpointzFailed to parse the endpoint)ÚkeynameÚ
startswithÚreplacer*   ÚdataÚ	valuenamer,   ÚreÚmatchÚendpoint_reÚgroupÚlowerr   Úerrorr>   )Úentriesr6   Úsectionr"   rE   ÚcaÚmÚedatas   &       r   Úobtain_end_point_informationrY   j   s?  € ð ÐØL€GÛˆØ�y‰y×#Ñ# G×,Ò,ÙØ�y‰y× Ñ  ¨"Ó-ˆØ×1Ñ1Ó3Ô3Ø*,Ð!Ñ'Ø34·6±6ÐÕ# A§K¡KÓ0ñ ð $×*Ñ*Ö,ˆÜ�HŠH”[ " U¥)Ó,ˆßØ˜QŸW™W XÓ.×6Ñ6°s¸CÓ@Õ@ˆDØˆv‰JØŸW™W XÓ.ˆBˆz‰NØŸ™ ›ˆBˆv‹JØ��Y�_‰_Ó 'Ö)Ø  " U¥)Ð-ˆEÜ�IŠIÐ4°eÔ<ØŠIñ -ô 	-Ð-B×-IÑ-IÓ-KÓLð à Ð r   c                ó�  € . pV P                  4       pRV,          p. ROpRpV P                  V\        WT4      p\        V4      ^ 8X  d   V# V Fu  pR\	        VR,          ^ ,          4      R\	        VR,          ^ ,          4      R\	        \
        P                  ! VR,          ^ ,          4      4      /pVP                  V4       Kw  	  V# )	z(Initialize CAs.

[MS-CAESO] 4.4.5.3.1.2
zMCN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,%sÚcACertificateÚcnÚdNSHostNamez"(objectClass=pKIEnrollmentService)rE   rF   )r[   r\   r]   )Úget_default_basednÚsearchr	   r0   r   Úbase64Ú	b64encoder+   )	ÚldbÚresultÚbasednÚdnÚattrsÚexprÚresÚesrL   s	   &        r   Úfetch_certification_authoritiesrj   ‰   s½   € ð
 €FØ×#Ñ#Ó%€Fð 
YÐ[aÕ	a€BÚ2€EØ/€DØ
�*‰*�Rœ¨Ó
4€CÜ
ˆ3ƒx�1„}ØˆÛˆØœ B t¥H¨Q¥KÓ0ØœZ¨¨=Õ(9¸!Õ(<Ó=Ø ¤*¬V×-=Ò-=¸bÀÕ>QÐRSÕ>TÓ-UÓ"Vðˆð 	�‰�dÖñ ð €Mr   c                 óì   € Vf   R.pV P                  4       pRV,          pRV,          pV P                  V\        WR4      p\        V4      ^8X  d!   RV^ ,          9   d   \	        V^ ,          4      # RR./# )NúmsPKI-Minimal-Key-SizezOCN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,%sz(cn=%s)Ú2048)r^   r_   r	   r0   Údict)rb   rE   rf   rd   re   rg   rh   s   &&&    r   Úfetch_template_attrsro       sv   € Ø‚}Ø)Ð*ˆØ×#Ñ#Ó%€FØ	ZÐ]cÕ	c€BØ�tÕ€DØ
�*‰*�Rœ¨Ó
4€CÜ
ˆ3ƒx�1„}Ð1°S¸µVÔ;Ü�C˜•F‹|Ðà(¨6¨(Ð3Ð3r   c                 ó„   € \         \        P                  ! R RV P                  4       ^ \        P                  4      ,          # )s   (.{64})s   \1
)Ú	cert_wraprN   ÚsubÚencodeÚDOTALL)Úcerts   &r   Úformat_root_certrv   ¬   s(   € Ü”r—v’v˜j¨(°D·K±K³MÀ1ÄbÇiÁiÓPÕPÐPr   c                  ó~   € \         P                  P                  R 4      RR.p \        RRP	                  V 4      R7      # )ÚPATHz/usr/lib/certmongerz/usr/libexec/certmongerzcepces-submitÚ:)Úpath)ÚosÚenvironÚgetr   Újoin)Úcertmonger_dirss    r   Úfind_cepces_submitr€   ¯   s5   € Ü—z‘z—~‘~ fÓ-Ð/DØ0ð2€Oä� s§x¡x°Ó'@ÔAÐAr   c                 ó–  € \        4       pV'       g   \        P                  ! R 4       . # \        P                  pRVR&   \        VRV ,          R.V\        \        R7      pVP                  4       w  rEVP                  ^ 8w  d*   RVP                  4       /p\        P                  ! RV4       VP                  4       P                  4       # )zFailed to find cepces-submitzGET-SUPPORTED-TEMPLATESÚCERTMONGER_OPERATIONz--server=%sz--auth=Kerberos)ÚenvÚstdoutÚstderrÚErrorz0Failed to fetch the list of supported templates.)r€   r   rS   r{   r|   r   r   ÚcommunicateÚ
returncodeÚdecodeÚstripÚsplit)rB   Úcepces_submitrƒ   ÚpÚoutÚerrrL   s   &      r   Úget_supported_templatesr�   ´   s    € Ü&Ó(€MßÜ�	Š	Ð0Ô1Øˆ	ä
�*‰*€CØ";€CÐÑÜˆ}˜m¨fÕ4Ð6GÐHØœd¬4ô	1€Aà�}‰}‹�H€CØ‡|�|�qÔØ˜Ÿ™›Ð&ˆÜ�	Š	ÐDÀdÔKØ�9‰9‹;×ÑÓÐr   c                ó  € \         P                  P                  VRV R,          ,          4      p. pRV 9   dž   \        P                  ! R4       \
        P                  ! V R,          4      p \        V4      pVP                  \        P                  4      p\        VR4      ;_uu_ 4       pVP                  V4       RRR4       VP                  V4       V#   \         d    \        T\        4       4      p L�i ; i  + '       g   i     LH; i)zFetch a certificate from LDAP.ú%s.crtrE   r[   z'Installing the server certificate only.ÚwbN)r{   rz   r~   r   Úwarnr`   Ú	b64decoder   Ú	TypeErrorr   Úpublic_bytesr   ÚPEMÚopenÚwriter+   )rV   Ú	trust_dirÚ	root_certÚ
root_certsÚder_certificateru   Ú	cert_dataÚws   &&      r   Úgetcar¡   Å   s×   € ä—‘—‘˜Y¨°2°fµ:Õ(=Ó>€IØ€JØ˜"ÔÜ�ŠÐ:Ô;Ü ×*Ò*¨2¨oÕ+>Ó?ˆð	@Ü,¨_Ó=ˆDð ×%Ñ%¤h§l¡lÓ3ˆ	Ü�)˜T×"Ô" aØ�G‰G�IÔ÷ #à×Ñ˜)Ô$ØÐøô ô 	@Ü,¨_Ü-<Ó->ó@ŠDð	@ú÷ #×"ús   Á,C Â*C<ÃC9Ã8C9Ã<D	c                 óˆ   € \          F,  p \        P                  P                  V 4      '       g   K*  V u # 	  \         ^ ,          # )zIReturn the global trust dir using known paths from various Linux distros.)Úglobal_trust_dirsr{   rz   Úisdir)r›   s    r   Úfind_global_trust_dirr¥   ×   s2   € ç&ˆ	Ü�7‰7�=‰=˜×#Ô#ØÒñ 'ô ˜QÕÐr   c                 ó>   € \        R4      ;'       g    \        R4      # )z0Return the command to update the CA trust store.zupdate-ca-certificateszupdate-ca-trustr   r   r   r   Úupdate_ca_commandr§   Þ   s   € äÐ)Ó*×FÐF¬eÐ4EÓ.FÐFr   c                ó¶   a a€ \         ;QJ d.    V V3R lS P                  4        4       F  '       g   K   R# 	  R# ! V V3R lS P                  4        4       4      # )z9Return True if any key present in both dicts has changed.c              3   ó\   <"  € T F!  pVS9   d   SV,          SV,          8g  MR x € K#  	  R# 5i)FNr   )Ú.0ÚkÚnew_dataÚold_datas   & €€r   Ú	<genexpr>Úchanged.<locals>.<genexpr>ä   s0   øé € ð &Ù$�ð /0°8¬m�˜•˜x¨�{Ò*ÀÔFÛ$ùs   ƒ),TF)Úanyr*   )r¬   r­   s   ffr   Úchangedr±   â   sJ   ù€ ç‹3õ &Ø—]‘]”_ó&�3Œ3ð &Š3ð &ˆ3õ &Ø—]‘]”_ó&ó &ð &r   c                óÎ	  € \        R. R. /3/ V B p\        P                  ! R4       \        W4      pVR,          P	                  V4       \        4       pV F�  p\        P                  P                  V\        P                  P                  V4      4      p	 \        P                  ! W‰4       VR,          P                  V	4       \        P                  ! RV: RV	: 24       K�  	  \!        4       p
\        P                  ! RV
,          4       V
e?   \#        V
.4      P%                  4       pV^ 8w  d   \        P&                  ! R	V
,          4       \)        R
4      p\+        4       pVEeÞ   VEeÙ   \#        VRRV R,          RV: RV R,          : RV: 2.\,        \,        R7      pVP/                  4       w  pp\        P0                  ! VP3                  4       4       VP4                  ^ 8w  di   VP4                  ^8X  d&   \        P                  ! RV R,          ,          4       M2RVP3                  4       RV R,          /p\        P&                  ! RV4       \7        V R,          4      pV EF—  p\9        VV4      pV R,          : RVP3                  4       : 2p\        P                  P                  VRV,          4      p\        P                  P                  VRV,          4      p\#        VRRV R,          RVP3                  4       RVRVRVRVR ,          ^ ,          .\,        \,        R7      pVP/                  4       w  pp\        P0                  ! VP3                  4       4       VP4                  ^ 8w  d[   VP4                  ^8X  d   \        P                  ! R!V,          4       M+RVP3                  4       R"V/p\        P&                  ! R#V4       VR,          P	                  VV.4       VR,          P                  V4       EKš  	  V
e?   \#        V
.4      P%                  4       pV^ 8w  d   \        P&                  ! R	V
,          4       M\        P                  ! R$4       \:        P<                  ! V4      #   \         d    \        P                  ! R4        EKB  \         d    \        P                  ! RT4        EKg  \         d    TR,          P                  T	4        EK�  i ; i)%z#Install the root certificate chain.ÚfilesÚ	templatesz&Try to get root or server certificateszCreated symlink: z -> z=Failed to symlink root certificate to the admin trust anchorszZFailed to symlink root certificate to the admin trust anchors. The directory was not foundz
Running %szFailed to run %sÚgetcertzadd-caú-crE   z-ez
 --server=rF   z --auth=)r„   r…   zThe CA [%s] already existsr†   ÚCAz#Failed to add Certificate AuthorityrC   z%s.keyr’   Úrequestz-Tz-Iz-kz-fz-grl   z The template [%s] already existsÚCertificatezFailed to request certificatezOcertmonger and cepces must be installed for certificate auto enrollment to work)rn   r   Úinfor¡   Úextendr¥   r{   rz   r~   ÚbasenameÚsymlinkr+   ÚPermissionErrorr”   ÚFileNotFoundErrorÚFileExistsErrorr§   r   ÚwaitrS   r   r€   r   r‡   Údebugr‰   rˆ   r�   ro   ÚjsonÚdumps)rV   rb   r›   Úprivate_dirrG   rL   r�   Úglobal_trust_dirÚsrcÚdstÚupdateÚretrµ   rŒ   r�   rŽ   r�   Úsupported_templatesÚtemplaterf   ÚnicknameÚkeyfileÚcertfiles   &&&&&                  r   Úcert_enrollrÐ   ç   sá  € ä�˜"˜k¨2Ð.Ñ5°"Ñ5€Dä‡H‚HÐ5Ô6ä�rÓ%€JØˆ…M×Ñ˜Ô$Ü,Ó.ÐÛˆä�g‰g�l‰lÐ+¬R¯W©W×-=Ñ-=¸cÓ-BÓCˆð	&Ü�JŠJ�sÔ Ø��M× Ñ  Ô%Ü�H‹H³CºÐ=Ö>ñ ô( Ó €FÜ‡H‚Hˆ\˜VÕ$Ô%ØÒÜ�V�H‹o×"Ñ"Ó$ˆØ�!Œ8Ü�IŠIÐ(¨FÕ3Ô4ô �IÓ€GÜ&Ó(€MØÓ˜}Ó8Ü�7˜H d¨B¨v­J¸Û0=Ø�Z—.�.¢$ð(ð)ô ¤dô,ˆð —=‘=“?‰ˆˆSÜ�	Š	�#—*‘*“,ÔØ�<‰<˜1ÔØ�|‰|˜qÔ Ü—’Ð5¸¸6½
ÕBÕCà §¡£¨t°R¸µZÐ@�Ü—	’	Ð?ÀÔFä5°b¸µnÓEÐÜ+ˆHÜ(¨¨hÓ7ˆEØ"$ V§* *¨h¯o©oÕ.?Ð@ˆHÜ—g‘g—l‘l ;°¸8Õ0CÓDˆGÜ—w‘w—|‘| I¨x¸(Õ/BÓCˆHÜ�w 	¨4°°FµØ˜XŸ_™_Ó.Ø˜X t¨W°d¸HØ˜UÐ#;Õ<¸QÕ?ðAô #¬4ô	1ˆAð
 —}‘}“‰HˆC�Ü�IŠI�c—j‘j“lÔ#Ø�|‰|˜qÔ Ø—<‘< 1Ô$Ü—H’HÐ?À8ÕLÕMà# S§Z¡Z£\°=À(ÐK�DÜ—I’IÐ=¸tÔDà��M× Ñ  '¨8Ð!4Ô5Ø�Õ×$Ñ$ X×.ñ) ,ð* ÒÜ˜˜“/×&Ñ&Ó(ˆCØ�aŒxÜ—	’	Ð,°Õ7Ô8øä�Šð 7ô 	8ä�:Š:�dÓÐøôE ô 	-Ü�HŠHð ,÷ -ð -ä ô 	GÜ�HŠHð 4à5E÷Gð Gô ô 	&ð ��M× Ñ  ×%Ð%ð		&ús+   ÂAQ3Ñ3!S$ÒS$Ò!S$Ò=S$ÓS$Ó#S$c                   óN   a € ] tR tRt o R tR tR tRR ltR tR t	R	 t
R
tV tR# )Úgp_cert_auto_enroll_exti;  c                ó   € R # )zCryptography\AutoEnrollmentr   )Úselfs   &r   Ú__str__Úgp_cert_auto_enroll_ext.__str__<  s   € Ù-r   c                ó  € \         P                  ! V4      p\        P                  ! V4      p\	        R 4      pVeK   \        VRRV.4      P                  4        VR,           F   p\        VRRV.4      P                  4        K"  	  VR,           Fg  p\        P                  P                  V4      '       g   K*  \        P                  P                  V4      '       g   KQ  \        P                  ! V4       Ki  	  V P                  W4       R# )rµ   Nz	remove-car¶   r´   zstop-trackingz-ir³   )r`   r•   rÃ   Úloadsr   r   rÁ   r{   rz   ÚexistsÚunlinkÚcache_remove_attribute)	rÔ   ÚguidÚ	attributeÚvalueÚca_cnrL   rµ   rÍ   Úfs	   &&&&     r   ÚunapplyÚgp_cert_auto_enroll_ext.unapply?  sÇ   € Ü× Ò  Ó+ˆÜ�zŠz˜%Ó ˆÜ˜	Ó"ˆØÒÜ�7˜K¨¨uÐ5Ó6×;Ñ;Ô=Ø  ×-Ð-�Ü�w °°xÐ@ÓA×FÑFÖHñ .à�g—�ˆAÜ�w‰w�~‰~˜a× Ô Ü—7‘7—>‘> !×$Ô$Ü—I’I˜a–Lñ ð 	×#Ñ# DÖ4r   c                ó¢  € \         P                  ! VR ,          P                  4       4      P                  4       pV P	                  W4      pVe   \
        P                  ! V4      M/ pVe>   \        VR,          4       U	u. uF   q’R ,          : RV	P                  4       : 2NK"  	  up	M. p
RV
/VCp\        W¸4      '       g$   V P                  4       \        P                  8X  d   V P                  WV4       Ve7   \        W¸4      '       g&   V P                  4       \        P                  8w  d   R# V! V/ VB pV P                  WV4       R# u up	i )rE   NrF   rC   r´   )r`   ra   rs   r‰   Úcache_get_attribute_valuerÃ   rØ   r�   r±   Úcache_get_apply_stater   ÚENFORCErá   Úcache_add_attribute)rÔ   rÜ   rV   Úapplier_funcÚargsÚkwargsrÝ   Úold_valr­   Útr´   r¬   rL   s   &&&&*,       r   ÚapplyÚgp_cert_auto_enroll_ext.applyM  s  € Ü×$Ò$ R¨¥Z×%6Ñ%6Ó%8Ó9×@Ñ@ÓBˆ	à×0Ñ0°ÓAˆØ*1Ò*=”4—:’:˜gÔ&À2ˆàÒ"ô BYÐY[Ð\fÕYgÔAhÓiÑAh¸A 6§
 
¨A¯H©H­JÓ7ÑAhÒiØ(*ð 	à  )Ð3¨rÐ3ˆÜ�8×&Ò&¨$×*DÑ*DÓ*FÌ(×JZÑJZÔ*ZØ�L‰L˜¨'Ô2àÒ¤w¨x×'BÒ'BØ×*Ñ*Ó,´×0@Ñ0@Ô@Ùñ ˜TÐ, VÑ,ˆØ× Ñ  °$Ö7ùò js   Á?&ENc           	     óî  € Vf   V P                   P                  R4      pVf   V P                   P                  R4      p\        P                  P                  V4      '       g   \        P                  ! VRR7       \        P                  P                  V4      '       g   \        P                  ! VRR7       V FR  w  rV\        V 4      V9   g   K  V\        V 4      ,          P                  4        F  w  rxV P                  WWV4       K  	  KT  	  V EFØ  p	V	P                  '       g   K  Rp
Rp\        P                  P                  V	P                  V4      pV P                  V4      pV'       g   Ka  VP                   EFf  pVP                  V
8X  g   K  VP                  R8X  g   K*  VP                   R,          '       d   KE  VP                   ^,          ^8H  pVP                   ^,          ^8H  pVP                   ^,          ^8H  pV'       d‰   V P#                  V	P$                  VP                  W44      pV Uu. uF5  p\&        P(                  ! VP+                  4       4      P-                  4       NK7  	  ppV P/                  V	P$                  VR	7       EK  V P1                  V	P$                  4      pV P/                  V	P$                  \3        VP5                  4       4      R
7       EKi  	  EKÛ  	  R # u upi )NÚcertsií  )ÚmodeiÀ  ú7Software\Policies\Microsoft\Cryptography\AutoEnrollmentúMACHINE/Registry.polÚAEPolicyé €  )Úkeep)Úremove)ÚlpÚ
cache_pathÚprivate_pathr{   rz   rÙ   ÚmkdirÚstrÚitemsrá   Úfile_sys_pathr~   ÚparserT   rI   rM   rL   Ú _gp_cert_auto_enroll_ext__enrollrE   r`   ra   rs   r‰   ÚcleanÚcache_get_all_attribute_valuesr5   r*   )rÔ   Údeleted_gpo_listÚchanged_gpo_listr›   rÅ   rÜ   ÚsettingsÚ	ca_cn_encrL   ÚgporU   Úpol_filerz   Úpol_confr"   ÚenrollÚmanageÚretrive_pendingÚca_namesÚnÚca_attrss   &&&&&                r   Úprocess_group_policyÚ,gp_cert_auto_enroll_ext.process_group_policy`  s+  € àÒØŸ™×*Ñ*¨7Ó3ˆIØÒØŸ'™'×.Ñ.¨wÓ7ˆKÜ�w‰w�~‰~˜i×(Ò(Ü�HŠH�Y UÕ+Ü�w‰w�~‰~˜k×*Ò*Ü�HŠH�[ uÕ-ã.‰NˆDÜ�4‹y˜HÖ$Ø'/´°D³	Õ':×'@Ñ'@Ö'B‘O�IØ—L‘L °$Ö7ó (Cñ /ô
 $ˆCØ× × Ò ØT�Ø1�Ü—w‘w—|‘| C×$5Ñ$5°xÓ@�ØŸ:™: dÓ+�ßÙØ!×)Õ)�AØ—y‘y GÖ+°·±¸zÖ0IàŸ6™6 FŸ?œ?Ù$Ø!"§¡¨#¥°Ñ!4˜Ø!"§¡¨#¥°Ñ!4˜Ø*+¯&©&°3­,¸#Ñ*=˜ß!Ø'+§}¡}°S·X±XØ5=×5EÑ5EØ5>ó(M˜Hñ .6ó(7Ù-5¨ô )/×(8Ò(8¸¿¹»Ó(D×(KÑ(KÖ(MÙ-5ð %ð (7à ŸJ™J s§x¡x°h˜J×?ð
 !%× CÑ CÀCÇHÁHÓ Mð %à ŸJ™J s§x¡x¼¸X¿]¹]»_Ó8M˜J×Nô- *ó $ùò,(7s   È:;K2c                óä  € V EFc  pV^ ,          pVR,          ^,          '       g   K%  \        V Uu. uF  qwR,          R8H  NK  	  up4      '       dÊ   VP                  R\        RR.4      p\        V4      ^8w  d   Kz  VP                  V^ ,          R,          ^ ,          \        RR.4      p	\        V	4      ^8w  d   Kº  R\	        \        \        P                  V	^ ,          R,          ^ ,          4      4      P                  4       ,          p
V
XR	,          8w  d   EK  . pV EFA  pVR,          R8X  dr   \        V4      pV F^  pR
V9  d$   \        P                  ! RVR,           R24       K-  V P                  W\        WâVV4       VP                  VR,          4       K`  	  Kƒ  VR,          P                  4       P!                  R4      '       dq   R
V9  d.   \        P                  ! RVR,           RVR,           R24       Kã  V P                  W\        WÂVW\R,          R7       VP                  VR,          4       EK  RVR,          /p\        P"                  ! RV4       EKD  	  Vu # 	  R# u upi )zÍRead CEP Data.

[MS-CAESO] 4.4.5.3.2.4
In this step autoenrollment initializes instances of the
CertificateEnrollmentPolicy by accessing end points associated with CEP
groups created in the previous step.
ÚFlagsrA   úLDAP:r@   z(objectClass=*)ÚrootDomainNamingContextÚ
objectGUIDz{%s}r   r[   zignoring CA 'rE   z ' with no cACertificate in LDAP.zhttps://z' (z ) with no cACertificate in LDAP.rG   )rG   rH   zUnrecognized endpointN)r°   r_   r
   r0   rü   r   r   ÚGUIDÚupperrj   r   Úwarningrí   rÐ   r+   rR   rJ   rS   )rÔ   rÜ   rb   r6   r›   rÅ   r8   r"   rh   Úres2r  r  rV   ÚcasÚ_carX   s   &&&&&&          r   Ú__read_cep_dataÚ'gp_cert_auto_enroll_ext.__read_cep_data�  s8  € ô  5ˆOð   Õ"ˆAð �W•: ×$Ô$Ùô
 ±ÓA±¨A�e•H Ô'±ÑA×BÒBð —j‘j ¤ZÐ1BØ";Ð!<ó>�ä�s“8˜q”=ÙØ—z‘z # a¥&Ð)BÕ"CÀAÕ"FÜ",Ð.?Ø#/ .ó2�ô �t“9 ”>Ùð $Üœ
¤4§9¡9¨d°1­g°lÕ.CÀAÕ.FÓGÓH×NÑNÓPõQ�
à  :¥Ô.Úð ˆHÜ%�à�e•9 Ô'ä9¸#Ó>�CÛ"˜Ø*°#Ô5ÜŸKšK¨-¸¸F½°}ð EAð )Aô Bá$àŸ
™
 4¬k¸3ÀYØ#.ô0à Ÿ™¨¨F­Ö4ó  #ð ˜•Y—_‘_Ó&×1Ñ1°*×=Ò=Ø&¨bÔ0ÜŸš m°B°vµJ°<ð @(Ø(*¨5­	 {ð 3=ð%=ô >ñ !Ø—J‘J˜t¬°b¸yØ*°Fµð ô =à—O‘O B v¥J×/à(¨"¨U­)Ð5�EÜ—I’IÐ5°u×=ñ5 &ð6 ŠOóE  5ùò Bs   ±I-
c           
     ó¶  € R \        V P                  V P                  4      ,          p\        V\	        4       V P                  V P                  R7      p. p\        V4      p\        V4      ^ 8”  d%   VP                  V P                  WVW44      4       V# \        V4      p	V	 F4  p
V P                  W\        W¦VV4       VP                  V
R,          4       K6  	  V# )ú	ldap://%s©ÚurlÚsession_inforø   ÚcredentialsrE   )r   Úcredsrø   r   r   rY   r0   r»   Ú'_gp_cert_auto_enroll_ext__read_cep_datarj   rí   rÐ   r+   )rÔ   rÜ   rT   r›   rÅ   r"  rb   r  r6   r  rV   s   &&&&&      r   Ú__enrollÚ gp_cert_auto_enroll_ext.__enrollÞ  sÇ   € ØœO¨D¯J©J¸¿¹Ó@Õ@ˆÜ�c¬Ó(8Ø—W‘W¨$¯*©*ô6ˆð ˆÜ <¸WÓ EÐÜÐ$Ó%¨Ô)Ø�O‰O˜D×0Ñ0°Ø1FØ1:óIô Jð ˆô 2°#Ó6ˆCÛ�Ø—
‘
˜4¤[°"¸9Ø&ô(à—‘  6¥
Ö+ñ ð ˆr   c                ó:  € / pR pRpVP                   '       Edr   \        P                  P                  VP                   V4      pV P	                  V4      pV'       g   V# VP
                   EF  pVP                  V8X  g   K  VP                  R8X  g   K*  VP                  ^,          ^8H  pVP                  R,          '       g	   V'       g   Kc  / VR&   R\        V P                  V P                  4      ,          p	\        V	\        4       V P                  V P                  R7      p
\        VP
                  4      p\        V
4      p\!        V4      ^ 8”  dZ   V UUu. uF  qÝ F  qîNK  	  K  	  ppp\#        V Uu. uF  pVR,          R8H  NK  	  up4      '       d   VP%                  V4       MTpV FÒ  pRV9   d   VR,          R8X  d   K  RpVR	,          pVV9  d   / VV&   / VV,          V&   R
V9   d2   \'        VR
,          4      P)                  4       VV,          V,          R&   VR,          VV,          V,          R&   \+        VR,          4      pV Uu. uF  pVP)                  4       NK  	  upVV,          V,          R&   KÔ  	  EK  	  V# u uppi u upi u upi )ró   rò   rô   rõ   zAuto Enrollment Policyr   r!  rA   r  rE   r[   zCA CertificaterF   zAuto Enrollment ServerÚ	Templates)rþ   r{   rz   r~   rÿ   rT   rI   rM   rL   r   r%  rø   r   r   rY   rj   r0   r°   r»   rv   r‰   r�   )rÔ   r  Úoutputr  rU   rz   r	  r"   r
  r"  rb   r6   r  ÚslÚepÚcas2rV   Úpolicyr\   rË   rì   s   &&                   r   ÚrsopÚgp_cert_auto_enroll_ext.rsopñ  sO  € ØˆØ)ˆØLˆØ××ÑÜ—7‘7—<‘< × 1Ñ 1°8Ó<ˆDØ—z‘z $Ó'ˆHßØ�Ø×%Õ%�Ø—9‘9 Ö'¨A¯K©K¸:Ö,EØŸV™V c�\¨SÑ0�FØ—v‘v —”¯fÙ Ø79�FÐ3Ñ4Ø%¬¸¿
¹
ÀDÇGÁGÓ(LÕL�CÜ #´NÓ4DØ!%§¡°d·j±jôB�Cô 5°X×5EÑ5EÓFð *ä9¸#Ó>�CÜÐ0Ó1°AÔ5Ù-BÔPÑ-B rÊRÀr¢ÉR¡Ñ-B˜ÑPÜ¹tÓD¹t¸  5¥	¨WÔ 4¹tÑD×EÒEØŸJ™J tÕ,à"&˜CÛ!˜Ø  Bœ;¨2¨e­9¸Ô+?Ù$Ø!9˜Ø �Z˜Ø!¨Ô/Ø-/˜F 6™NØ-/˜˜v� rÑ*Ø*¨bÔ0ä 0°°OÕ1DÓ E× LÑ LÓ Nð # 6�N¨2Õ.Ð/?Ñ@ð ˜z�Nð ˜v� rÕ*Ð+CÑDô 4°B°zµNÓCð ,ñ 2EÓEÑ1D¨A˜QŸX™XžZÑ1DÑEð ˜v� rÕ*¨;Ó7ô "ñ% &ðF ˆùó-  QùÚDùò( Fs   ÅJÅ8J
ÉJr   )NN)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__rÕ   rá   rí   r  r&  r   r0  Ú__static_attributes__Ú__classdictcell__)Ú__classdict__s   @r   rÒ   rÒ   ;  s1   ø‡ € ò.ò5ò8ô&.Oò`Lò\÷&,ð ,r   rÒ   zc(https|HTTPS)://(?P<server>[a-zA-Z0-9.-]+)/ADPolicyProvider_CEP_(?P<auth>[a-zA-Z]+)/service.svc/CEP)z/etc/pki/trust/anchorsz /etc/pki/ca-trust/source/anchorsz /usr/local/share/ca-certificatesr   )ÚKerberos)9r{   r1   Úsamba.gp.gpclassr   r   r   Úsambar   Úsamba.dcerpcr   Ú	samba.ndrr   rb   r	   r
   Ú
samba.authr   r   r`   Úshutilr   Ú
subprocessr   r   rN   rÃ   Úsamba.gp.util.loggingr   ÚstructÚ2cryptography.hazmat.primitives.serialization.pkcs7r   ÚModuleNotFoundErrorrS   Ú,cryptography.hazmat.primitives.serializationr   Úcryptography.x509r   Úcryptography.hazmat.backendsr   Úsamba.commonr   rq   rP   r£   r>   rY   rj   ro   rv   r€   r�   r¡   r¥   r§   r±   rÐ   rÒ   r   r   r   Ú<module>rI     sá   ðó" 
Û ß =Ñ =Ý Ý Ý  ç )Ý %Ý ,Û Ý ß "Û 	Û Ý %Û ð5õ$õ BÝ 7Ý 8Ý #ð€	ð9€ò9Ð ò
.+ò`!ò>ô.
4òQòBò
ò"ò$ òGò&ô
Rôhb˜j¨*ö bøðm ô 5Ú1Ø‡I‚Ið 4ö 5ð5ús   ÁB: Â:CÃC