Usage of the machine account for ldapsearch

Hallo lovely samba-people,

we've got some script that automate some tasks like Creation of 
direction for samba users based on their AD groups. So we need to query 
the complete group list of AD-Users in a bash or python script regularly.

ATM we're creating a new user for this, exporting his keytab and using 
kinit and ldapsearch -Y GSSAPI for this.

These scripts run on domain-joined debian servers. So they have a 
machine account for winbind to get the same data. Can we use this 
machine account to query the group membership of users somehow? "net ads 
keytab list" shows a lot of principals:

Vno  Type                                        Principal
   1  aes256-cts-hmac-sha1-96  [email protected]
   1  aes128-cts-hmac-sha1-96  [email protected]
   1  arcfour-hmac-md5 [email protected]
   1  aes256-cts-hmac-sha1-96 
  HOST/[email protected]
   1  aes128-cts-hmac-sha1-96 
  HOST/[email protected]
   1  arcfour-hmac-md5 HOST/[email protected]
   1  aes256-cts-hmac-sha1-96 
  RestrictedKrbHost/[email protected]
   1  aes128-cts-hmac-sha1-96 
  RestrictedKrbHost/[email protected]
   1  arcfour-hmac-md5 
RestrictedKrbHost/[email protected]
   1  aes256-cts-hmac-sha1-96  HOST/[email protected]
   1  aes128-cts-hmac-sha1-96  HOST/[email protected]
   1  arcfour-hmac-md5 HOST/[email protected]
   1  aes256-cts-hmac-sha1-96 
  RestrictedKrbHost/[email protected]
   1  aes128-cts-hmac-sha1-96 
  RestrictedKrbHost/[email protected]
   1  arcfour-hmac-md5 RestrictedKrbHost/[email protected]
   1  aes256-cts-hmac-sha1-96 
  host/[email protected]
   1  aes128-cts-hmac-sha1-96 
  host/[email protected]
   1  arcfour-hmac-md5 host/[email protected]
   1  aes256-cts-hmac-sha1-96  host/[email protected]
   1  aes128-cts-hmac-sha1-96  host/[email protected]
   1  arcfour-hmac-md5 host/[email protected]

I can run kinit '[email protected]' and it prompts me for a 
PW. There must be a keytab somewhere on this server that I can use, right?

Alternativly can I query winbind directly via bash / python? I guess I 
could always run "groups <User>" to get the groups...

Thanks in advance and have a nice day!

-- 
Senior Webentwickler
Datenschutzbeauftragter

Ellerhold Aktiengesellschaft
Friedrich-List-Str. 4
01445 Radebeul

Telefon: +49 (0) 351 83933-61
Web: www.ellerhold.de
Facebook: www.facebook.com/ellerhold.gruppe
Instagram: www.instagram.com/ellerhold.gruppe
LinkedIn: www.linkedin.com/company/ellerhold-gruppe

Amtsgericht Dresden / HRB 23769
Vorstand: Stephan Ellerhold, Maximilian Ellerhold
Vorsitzender des Aufsichtsrates: Frank Ellerhold



---
Diese E-Mail und Ihre Anlagen enthalten vertrauliche Mitteilungen. Sollten Sie nicht der beabsichtigte Adressat sein, so bitten wir Sie um Mitteilung und um sofortiges löschen dieser E-Mail und der Anlagen.

Unsere Hinweise zum Datenschutz finden Sie hier: https://www.ellerhold.de/datenschutz/

This e-mail and its attachments are privileged and confidential. If you are not the intended recipient, please notify us and immediately delete this e-mail and its attachments.

You can find our privacy policy here: https://www.ellerhold.de/datenschutz/




-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba