[Samba] time based group membership in FL 2016

[Rowland Penny]

On Wed, 31 Jan 2024 20:42:44 +0100
Kees van Vloten via samba <samba at lists.samba.org> wrote:

> 
> On 31-01-2024 20:36, Rowland Penny via samba wrote:
> > On Wed, 31 Jan 2024 20:02:55 +0100
> > Stefan Kania via samba <samba at lists.samba.org> wrote:
> >
> >>
> >> Am 31.01.24 um 17:45 schrieb Kees van Vloten via samba:
> >>> Op 31-01-2024 om 17:21 schreef Stefan Kania via samba:
> >>>> Hi all,
> >>>>
> >>>> it's again a question about FL 2016 and if samba supports it. If
> >>>> yes, how can I use it without powershell.
> >>>>
> >>>> In FL 2016 there is the possibility to put a user into a group
> >>>> and the membership is time based. So I could put the user Foo
> >>>> into the group 'domain admins' for 30 minutes and after 30
> >>>> minutes the system will remove user foo from the group.
> >>>>
> >>>> But to activated this feature you have to give a powershell
> >>>> command: ----------------
> >>>> Enable-ADOptionalFeature "Privileged Access Management Feature"
> >>>> -Scope ForestOrConfigurationSet -Target example.net"
> >>>> -----------------
> >>>>
> >>>> This feature once enabled can't be disabled anymore
> >>>>
> >>>> Then I could add a user to a group:
> >>>> ---------------
> >>>> Add-ADGroupMember -Identity "Domain Admins" -Members "Foo"
> >>>> -MemberTimeToLive (New-TimeSpan -Minutes 30)
> >>>> ---------------
> >>>>
> >>>> After 30 minutes Foo will be removed automatically.
> >>>>
> >>>> But if this feature is supported by samba 4.19 or 4.20 with FL
> >>>> 2016 activated, how could I set this?
> >>> I am not aware of the developments on this.
> >>>
> >>> But in general, what I would do is: execute the powershell command
> >>> and then check with "samba-tool group show" of ldbsearch what
> >>> attributes where set.
> >>>
> >>> If you know what it does under the hood, it is easy enough to
> >>> create some scripting to mimic the behaviour.
> >>>
> >>> - Kees.
> >>>
> >> I can install powershell on my DC but the Linux-powershell is not
> >> supporting the ad-commands :-(
> >>
> >> Maybe someone has a different solution to my problem. We have a lot
> >> of Admins managing the AD (all over the world). Yes it's samba :-).
> >> We want to restrict admins from login to the DCs via ssh. Ssh login
> >> should only be possible if an admin sends a request via a ticket
> >> system and the ticket management team then adds him to a special
> >> group for a  certain period of time. During this time he can login
> >> via ssh. After the time is over, he will be removed automatically
> >> from the group, so then he can't login on the DC anymore. That's
> >> why I thought about time based group membership. But this function
> >> needs FL 2016.
> >>
> >> Allow only users of a certain to login via ssh is not the problem.
> >>
> >> Stefan
> >>
> >>>> Stefan
> >>>>
> > I think this is going to require code to get it to work. Just
> > adding an attribute (if that is what is happening ?) will not be
> > enough, there must be something that either counts down to 0 and
> > then removes the user from the group, or constantly checks AD and
> > then removes the user from the group at the relevant time, or
> > something along those lines.
> >
> > Rowland
> 
> If that is part of FL 2016 as Stefan suggests, I would think, that
> bit is taken care of by the AD, i.e. the Samba-AD code.
> 
> In that case setting the right attribute(s) on an LDAP group could be 
> the only thing needed...
> 
> Perhaps one the Samba developers knows more about the exact 
> implementation (@Andrew ?).
> 
> - Kees.
> 
> >
> 

I would love to hear Andrew's take on this, but I still think that code
will be required, just placing an attribute in AD will do nothing,
something needs to use it.

For instance, I added a uidNumber attribute to my object in AD (I did
this for some testing), it is still there, but is ignored because
nothing is using it.

Rowland