samba - Jun 2021 - Samba-tool Delegation Control

Hi,

We are trying to build the Admin function delegation on OU in the UI we are
designing. Is there any command in Samba or any python binding that will
help us achieve this?

Below is the output we get after executing command  - samba-tool delegation
--help

Available subcommands:
  add-service       - Add a service principal as msDS-AllowedToDelegateTo.
  del-service       - Delete a service principal as
msDS-AllowedToDelegateTo.
  for-any-protocol  - Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
(S4U2Proxy) for an account.
  for-any-service   - Set/unset UF_TRUSTED_FOR_DELEGATION for an account.
  show              - Show the delegation setting of an account.

After executing samba-tool delegation add-service --help

Usage: samba-tool delegation add-service <accountname> <principal>
[options]
Options:
  -h, --help            show this help message and exit
  -H URL, --URL=URL     LDB URL for database or target server
>From the commands we have below questions
1) There is no <option> for passing the OU name in the
"add-service"
subcommand.
2) What are all the possible inputs, we can pass in the for
"principal"
parameter in the "add-service" subcommand.
3) Where we will get all the user/group accounts information about
delegated tasks on a specific OU.



*Thanks and Regards,*

*Durga Prasad D*

*Software Engineer*

*Exzatech Consulting and Services Pvt Ltd.*

*Phone: +91-9490150379.*

On Thu, 2021-06-17 at 19:37 +0530, Durga Prasad Dwarapureddi via samba
wrote:
> Hi,
> 
> We are trying to build the Admin function delegation on OU in the UI
> we are
> designing. Is there any command in Samba or any python binding that
> will
> help us achieve this?
This can be done in Python, it is essentially an ACL modification.
This is in source4/dsdb/tests/python/user_account_control.py:

	self.sd_utils = sd_utils.SDUtils(self.admin_samdb)

        self.admin_samdb.create_ou("OU=test_computer_ou1," +
self.base_dn)
        self.unpriv_user_sid = self.sd_utils.get_object_sid(self.unpriv_user_dn)
        mod = "(OA;;CC;bf967a86-0de6-11d0-a285-00aa003049e2;;%s)" %
str(self.unpriv_user_sid)

        self.sd_utils.dacl_add_ace("OU=test_computer_ou1," +
self.base_dn, mod)

Just take care, while not giving out the administrator password is an
admirable thing, someone who can create user or computer objects (the
above is for computers, you can delegate the right to create users
instead with the users GUID) still has quite some power to disrupt the
domain.
> Below is the output we get after executing command  - samba-tool
> delegation
> --help
> 
> Available subcommands:
>   add-service       - Add a service principal as msDS-
> AllowedToDelegateTo.
>   del-service       - Delete a service principal as
> msDS-AllowedToDelegateTo.
>   for-any-protocol  - Set/unset
> UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
> (S4U2Proxy) for an account.
>   for-any-service   - Set/unset UF_TRUSTED_FOR_DELEGATION for an
> account.
>   show              - Show the delegation setting of an account.
This is a different kind of delegation, this is the right to delegate
the authentication from one service to another, not the delegation of
rights to create users etc.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions