Conversation
| CHAR Hash[29][16]; // The formal definition has Hash1, Hash2, ..., Hash29 | ||
| } WDIGEST_CREDENTIALS; | ||
|
|
||
| typedef struct _GMS_MANAGED_PASSWORD { |
There was a problem hiding this comment.
Do you have a resource for the structure you used? All resources I can find on msDS-ManagedPassword show a very different structure, but I'm not sure if that's just the difference between what LDAP would return vs what's stored in the database.
There was a problem hiding this comment.
You're absolutely right. I checked and realized my sources were incorrect, so I will make sure to fix it.
| "trustAuthIncoming": (None, _pek_decrypt), | ||
| "trustAuthOutgoing": (None, _pek_decrypt), | ||
| "msDS-ExecuteScriptPassword": (None, _pek_decrypt), | ||
| "msDS-ManagedPassword": (None, lambda db, value: bytearray(c_ds.GMS_MANAGED_PASSWORD(value).Password).hex()), |
There was a problem hiding this comment.
This is now positioned under a # Protected attributes comment, while this is not a protected attribute (as far as I can find). Can this attribute appear on any object type, or just specific types? I was thinking more of a @property on e.g. the User object, but it would help to know on which object types this attribute can appear.
There was a problem hiding this comment.
As far as I understand, it can only exist under a computer account, but I don't really get how this is different from supplemental credentials
2 participants
Add GMS Managed Password Support
Overview
This PR integrates the GMS-managed password into our utility attributes. By mapping this structure, we enable automatic decoding, ensuring that GMS passwords are handled consistently with our existing attribute workflows.
🛠 Proposed Changes
c_ds.py.c_ds.pyiwith relevant struct metadata for better IDE support and type safety.ATTRIBUTE_ENCODE_DECODE_MAPwithinutil.pyto enable seamless encoding/decoding.🧪 Testing & Validation
Important
Status: Manual verification is pending due to a lack of specific GMS test data.
I am looking for suggestions on how best to validate this change. Specifically:
Mock Data: Does anyone have a hex dump or sample GMS-managed password blob I can use for a unit test?
📝 Checklist
c_ds.pyc_ds.pyiutil.py