2 Unix SMB/CIFS implementation.
3 msDS-ManagedPassword attribute for Group Managed Service Accounts
5 Copyright (C) Catalyst.Net Ltd 2024
7 This program is free software: you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation, either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <https://www.gnu.org/licenses/>.
21 #ifndef DSDB_GMSA_UTIL_H
22 #define DSDB_GMSA_UTIL_H
25 #include "ldb_module.h"
28 #include "lib/crypto/gkdi.h"
29 #include "lib/crypto/gmsa.h"
30 #include "lib/util/data_blob.h"
31 #include "lib/util/time.h"
34 /* The DN of the gMSA to be updated. */
36 /* An optional request to set the previous password. */
37 struct ldb_request
*old_pw_req
;
38 /* A request to set the current password. */
39 struct ldb_request
*new_pw_req
;
40 /* An request to set the managed password ID. */
41 struct ldb_request
*pwd_id_req
;
44 struct gmsa_update_pwd_part
{
45 const struct ProvRootKey
*root_key
;
49 struct gmsa_update_pwd
{
50 struct gmsa_update_pwd_part prev_id
;
51 struct gmsa_update_pwd_part new_id
;
55 int gmsa_allowed_to_view_managed_password(TALLOC_CTX
*mem_ctx
,
56 struct ldb_context
*ldb
,
57 const struct ldb_message
*msg
,
58 const struct dom_sid
*account_sid
,
62 void gmsa_update_managed_pwd_id(struct KeyEnvelope
*pwd_id
,
63 const struct gmsa_update_pwd_part
*new_pwd
);
65 NTSTATUS
gmsa_pack_managed_pwd_id(TALLOC_CTX
*mem_ctx
,
66 const struct KeyEnvelope
*pwd_id
,
67 DATA_BLOB
*pwd_id_out
);
69 int gmsa_generate_blobs(struct ldb_context
*ldb
,
71 const NTTIME current_time
,
72 const struct dom_sid
*const account_sid
,
73 DATA_BLOB
*pwd_id_blob_out
,
74 struct gmsa_null_terminated_password
**password_out
);
76 NTSTATUS
gmsa_pack_managed_pwd(TALLOC_CTX
*mem_ctx
,
77 const uint8_t *new_password
,
78 const uint8_t *old_password
,
79 uint64_t query_interval
,
80 uint64_t unchanged_interval
,
81 DATA_BLOB
*managed_pwd_out
);
83 bool dsdb_account_is_gmsa(struct ldb_context
*ldb
,
84 const struct ldb_message
*msg
);
86 const struct KeyEnvelopeId
*gmsa_get_managed_pwd_id(
87 const struct ldb_message
*msg
,
88 struct KeyEnvelopeId
*key_env_out
);
90 struct gmsa_return_pwd
{
91 struct gmsa_null_terminated_password
*prev_pwd
;
92 struct gmsa_null_terminated_password
*new_pwd
;
93 NTTIME query_interval
;
94 NTTIME unchanged_interval
;
97 int gmsa_recalculate_managed_pwd(TALLOC_CTX
*mem_ctx
,
98 struct ldb_context
*ldb
,
99 const struct ldb_message
*msg
,
100 const NTTIME current_time
,
101 struct gmsa_update
**update_out
,
102 struct gmsa_return_pwd
*return_out
);
104 #define DSDB_GMSA_TIME_OPAQUE ("dsdb_gmsa_time_opaque")
106 bool dsdb_gmsa_current_time(struct ldb_context
*ldb
, NTTIME
*current_time_out
);
108 #endif /* DSDB_GMSA_UTIL_H */