python/samba/netcmd/user/readpasswords/get_kerberos_ticket.py

   1 # user management
   2 #
   3 # user get-kerberos-ticket command - obtain a TGT for a database user
   4 #
   5 # Copyright Jelmer Vernooij 2010 <jelmer@samba.org>
   6 # Copyright Theresa Halloran 2011 <theresahalloran@gmail.com>
   7 # Copyright Andrew Bartlett 2023 <abartlet@samba.org>
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 import ldb
  24 import samba.getopt as options
  25 from samba.netcmd import CommandError, Option
  26 from samba.credentials import Credentials
  27 from .common import (
  28     GetPasswordCommand,
  29     gpg_decrypt,
  30     decrypt_samba_gpg_help,
  31 )
  32 from samba.dcerpc import samr
  33
  34 class cmd_user_get_kerberos_ticket(GetPasswordCommand):
  35     """Get a Kerberos Ticket Granting Ticket as a user
  36
  37 This command gets a Kerberos TGT using the password for a user/computer account.
  38
  39 The username specified on the command is the sAMAccountName.
  40 The username may also be specified using the --filter option.
  41
  42 The command must be run from the root user id or another authorized
  43 user id. The '-H' or '--URL' option supports ldap:// for remote Group
  44 Managed Service accounts, and ldapi:// or tdb:// can be used to
  45 adjust the local path. tdb:// is used by default for a bare path.
  46
  47 The --output-krb5-ccache option should point to a location for the
  48 credentials cache.  The default is a FILE: type cache if no prefix is
  49 specified.
  50
  51 The '--decrypt-samba-gpg' option triggers decryption of the
  52 Primary:SambaGPG buffer to get the password.
  53
  54 Check with '--help' if this feature is available
  55 in your environment or not (the python-gpgme package is required).  Please
  56 note that you might need to set the GNUPGHOME environment variable.  If the
  57 decryption key has a passphrase you have to make sure that the GPG_AGENT_INFO
  58 environment variable has been set correctly and the passphrase is already
  59 known by the gpg-agent.
  60
  61 Example1:
  62 samba-tool user get-kerberos-ticket TestUser1 --output-krb5-ccache=/srv/service/krb5_ccache
  63
  64 Example2:
  65 samba-tool user get-kerberos-ticket --filter='(samAccountName=TestUser3)' --output-krb5-ccache=FILE:/srv/service/krb5_ccache
  66
  67     """
  68     synopsis = "%prog (<username>|--filter <filter>) [options]"
  69
  70     takes_optiongroups = {
  71         "sambaopts": options.SambaOptions,
  72         "versionopts": options.VersionOptions,
  73         "credopts": options.CredentialsOptions,
  74         "hostopts": options.HostOptions,
  75     }
  76
  77     takes_options = [
  78         Option("--filter", help="LDAP Filter to get Kerberos ticket for (must match single account)", type=str),
  79         Option("--output-krb5-ccache", type=str,
  80                help="Location of Kerberos credentials cache to write ticket into",
  81                metavar="CCACHE", dest="output_krb5_ccache"),
  82         Option("--decrypt-samba-gpg",
  83                help=decrypt_samba_gpg_help,
  84                action="store_true", default=False, dest="decrypt_samba_gpg"),
  85     ]
  86
  87     takes_args = ["username?"]
  88
  89     def run(self, username=None, H=None, filter=None,
  90             attributes=None, decrypt_samba_gpg=None,
  91             sambaopts=None, versionopts=None, hostopts=None,
  92             credopts=None, output_krb5_ccache=None):
  93         self.lp = sambaopts.get_loadparm()
  94
  95         if decrypt_samba_gpg and not gpg_decrypt:
  96             raise CommandError(decrypt_samba_gpg_help)
  97
  98         if filter is None and username is None:
  99             raise CommandError("Either the username or '--filter' must be specified!")
 100
 101         if filter is None:
 102             filter = "(&(objectClass=user)(sAMAccountName=%s))" % (ldb.binary_encode(username))
 103
 104         password_attrs = ["virtualClearTextUTF16", "samAccountName", "unicodePwd"]
 105
 106         creds = credopts.get_credentials(self.lp)
 107         samdb = self.connect_for_passwords(url=hostopts.H, require_ldapi=False, creds=creds)
 108
 109         obj = self.get_account_attributes(samdb, username,
 110                                           basedn=None,
 111                                           filter=filter,
 112                                           scope=ldb.SCOPE_SUBTREE,
 113                                           attrs=password_attrs,
 114                                           decrypt=decrypt_samba_gpg)
 115
 116         lp_ctx = sambaopts.get_loadparm()
 117
 118         creds = Credentials()
 119         creds.set_username(str(obj["samAccountName"][0]))
 120         creds.set_realm(samdb.domain_dns_name())
 121
 122         utf16_pw = obj.get("virtualClearTextUTF16", idx=0)
 123         nt_pass = obj.get("unicodePwd", idx=0)
 124         if utf16_pw is not None:
 125             creds.set_utf16_password(utf16_pw)
 126         elif nt_pass is not None:
 127             nt_hash = samr.Password()
 128             nt_hash.hash = list(nt_pass)
 129             creds.set_nt_hash(nt_hash)
 130         else:
 131             if samdb.url.startswith("ldap://") or samdb.url.startswith("ldaps://"):
 132                 raise CommandError("No password was available for this user.  "
 133                                    "Only Group Managed Service accounts allow access to passwords over LDAP, "
 134                                    "you may need to access the sam.ldb directly on the Samba AD DC and export the file.")
 135             else:
 136                 raise CommandError("No password was available for this user")
 137         creds.guess(lp_ctx)
 138         creds.get_named_ccache(lp_ctx, output_krb5_ccache)