Blame SOURCES/0002-computer-add-create-msa-sub-command.patch

436d93
From 41379f7ad6a9442dd55cc43d832427911e86db31 Mon Sep 17 00:00:00 2001
436d93
From: Sumit Bose <sbose@redhat.com>
436d93
Date: Fri, 23 Oct 2020 16:53:43 +0200
436d93
Subject: [PATCH 2/7] computer: add create-msa sub-command
436d93
436d93
Add new sub-command to create a managed service account in AD. This can
436d93
be used if LDAP access to AD is needed but the host is already joined to
436d93
a different domain.
436d93
436d93
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
436d93
---
436d93
 doc/adcli.xml      | 140 ++++++++++++++++++++++++++++++++++++++
436d93
 library/adenroll.c | 164 ++++++++++++++++++++++++++++++++++++++-------
436d93
 tools/computer.c   | 125 ++++++++++++++++++++++++++++++++++
436d93
 tools/tools.c      |   1 +
436d93
 tools/tools.h      |   4 ++
436d93
 5 files changed, 409 insertions(+), 25 deletions(-)
436d93
436d93
diff --git a/doc/adcli.xml b/doc/adcli.xml
436d93
index cc44fd8..14921f9 100644
436d93
--- a/doc/adcli.xml
436d93
+++ b/doc/adcli.xml
436d93
@@ -98,6 +98,10 @@
436d93
 		<arg choice="opt">--domain=domain.example.com</arg>
436d93
 		<arg choice="plain">computer</arg>
436d93
 	</cmdsynopsis>
436d93
+	<cmdsynopsis>
436d93
+		<command>adcli create-msa</command>
436d93
+		<arg choice="opt">--domain=domain.example.com</arg>
436d93
+	</cmdsynopsis>
436d93
 </refsynopsisdiv>
436d93
 
436d93
 <refsect1 id='general_overview'>
436d93
@@ -885,6 +889,142 @@ Password for Administrator:
436d93
 
436d93
 </refsect1>
436d93
 
436d93
+<refsect1 id='managed_service_account'>
436d93
+	<title>Create a managed service account</title>
436d93
+
436d93
+	<para><command>adcli create-msa</command> creates a managed service
436d93
+	account (MSA) in the given Active Directory domain. This is useful if a
436d93
+	computer should not fully join the Active Directory domain but LDAP
436d93
+	access is needed. A typical use case is that the computer is already
436d93
+	joined an Active Directory domain and needs access to another Active
436d93
+	Directory domain in the same or a trusted forest where the host
436d93
+	credentials from the joined Active Directory domain are
436d93
+	not valid, e.g. there is only a one-way trust.</para>
436d93
+
436d93
+<programlisting>
436d93
+$ adcli create-msa --domain=domain.example.com
436d93
+Password for Administrator:
436d93
+</programlisting>
436d93
+
436d93
+	<para>The managed service account, as maintained by adcli, cannot have
436d93
+	additional service principals names (SPNs) associated with it. An SPN
436d93
+	is defined within the context of a Kerberos service which is tied to a
436d93
+	machine account in Active Directory. Since a machine can be joined to a
436d93
+	single Active Directory domain, managed service account in a different
436d93
+	Active Directory domain will not have the SPNs that otherwise are part
436d93
+	of another Active Directory domain's machine.</para>
436d93
+
436d93
+	<para>Since it is expected that a client will most probably join to the
436d93
+	Active Directory domain matching its DNS domain the managed service
436d93
+	account will be needed for a different Active directory domain and as a
436d93
+	result the Active Directory domain name is a mandatory option. If
436d93
+	called with no other options <command>adcli create-msa</command>
436d93
+	will use the short hostname with an additional random suffix as
436d93
+	computer name to avoid name collisions.</para>
436d93
+
436d93
+	<para>LDAP attribute sAMAccountName has a limit of 20 characters.
436d93
+	However, machine account's NetBIOS name must be at most 16 characters
436d93
+	long, including a trailing '$' sign. Since it is not expected that the
436d93
+	managed service accounts created by adcli will be used on the NetBIOS
436d93
+	level the remaining 4 characters can be used to add uniqueness. Managed
436d93
+	service account names will have a suffix of 3 random characters from
436d93
+	number and upper- and lowercase ASCII ranges appended to the chosen
436d93
+	short host name, using '!' as a separator. For a host with the
436d93
+	shortname 'myhost', a managed service account will have a common name
436d93
+	(CN attribute) 'myhost!A2c' and a NetBIOS name
436d93
+	(sAMAccountName attribute) will be 'myhost!A2c$'. A corresponding
436d93
+	Kerberos principal in the Active Directory domain where the managed
436d93
+	service account was created would be
436d93
+	'myhost!A2c$@DOMAIN.EXAMPLE.COM'.</para>
436d93
+
436d93
+	<para>A keytab for the managed service account is stored into a file
436d93
+	specified with -K option. If it is not specified, the file is named
436d93
+	after the default keytab file, with lowercase Active Directory domain
436d93
+	of the managed service account as a suffix. On most systems it would be
436d93
+	<filename>/etc/krb5.keytab</filename> with a suffix of
436d93
+	'domain.example.com', e.g.
436d93
+	<filename>/etc/krb5.keytad.domain.example.com</filename>.</para>
436d93
+
436d93
+	<para><command>adcli create-msa</command> can be called multiple
436d93
+	times to reset the password of the managed service account. To identify
436d93
+	the right account with the random component in the name the
436d93
+	corresponding principal is read from the keytab. If the keytab got
436d93
+	deleted <command>adcli</command> will try to identify an existing
436d93
+	managed service account with the help of the fully-qualified name, if
436d93
+	this fails a new managed service account will be created.</para>
436d93
+
436d93
+	<para>The managed service account password can be updated with
436d93
+<programlisting>
436d93
+$ adcli update --domain=domain.example.com --host-keytab=/etc/krb5.keytad.domain.example.com
436d93
+</programlisting>
436d93
+	and the managed service account can be deleted with
436d93
+<programlisting>
436d93
+$ adcli delete-computer --domain=domain.example.com 'myhost!A2c'
436d93
+</programlisting>
436d93
+	</para>
436d93
+
436d93
+	<para>In addition to the global options, you can specify the following
436d93
+	options to control how this operation is done.</para>
436d93
+
436d93
+	<variablelist>
436d93
+		<varlistentry>
436d93
+			<term><option>-N, --computer-name=<parameter>computer</parameter></option></term>
436d93
+			<listitem><para>The short non-dotted name of the managed
436d93
+			service account that will be created in the Active
436d93
+			Directory domain. The long option name
436d93
+			<option>--computer-name</option> is
436d93
+			kept to underline the similarity with the same option
436d93
+			of the other sub-commands. If not specified,
436d93
+			then the first portion of the <option>--host-fqdn</option>
436d93
+			or its default is used with a random suffix.</para></listitem>
436d93
+		</varlistentry>
436d93
+		<varlistentry>
436d93
+			<term><option>-O, --domain-ou=<parameter>OU=xxx</parameter></option></term>
436d93
+			<listitem><para>The full distinguished name of the OU in
436d93
+			which to create the managed service account. If not
436d93
+			specified, then the managed service account will be
436d93
+			created in a default location.</para></listitem>
436d93
+		</varlistentry>
436d93
+		<varlistentry>
436d93
+			<term><option>-H, --host-fqdn=<parameter>host</parameter></option></term>
436d93
+			<listitem><para>Override the local machine's fully
436d93
+			qualified DNS domain name. If not specified, the local
436d93
+			machine's hostname will be retrieved via
436d93
+			<function>gethostname()</function>.
436d93
+			If <function>gethostname()</function> only returns a short name
436d93
+			<function>getaddrinfo()</function> with the AI_CANONNAME hint
436d93
+			is called to expand the name to a fully qualified DNS
436d93
+			domain name.</para></listitem>
436d93
+		</varlistentry>
436d93
+		<varlistentry>
436d93
+			<term><option>-K, --host-keytab=<parameter>/path/to/keytab</parameter></option></term>
436d93
+			<listitem><para>Specify the path to the host keytab where
436d93
+			credentials of the managed service account will be
436d93
+			written after a successful creation. If not specified,
436d93
+			the default location will be used, usually
436d93
+			<filename>/etc/krb5.keytab</filename> with
436d93
+			the lower-cased Active Directory domain name added as a
436d93
+			suffix e.g.
436d93
+			<filename>/etc/krb5.keytab.domain.example.com</filename>.
436d93
+			</para></listitem>
436d93
+		</varlistentry>
436d93
+		<varlistentry>
436d93
+			<term><option>--show-details</option></term>
436d93
+			<listitem><para>After a successful creation print out
436d93
+			information about the created object. This is output in
436d93
+			a format that should be both human and machine
436d93
+			readable.</para></listitem>
436d93
+		</varlistentry>
436d93
+		<varlistentry>
436d93
+			<term><option>--show-password</option></term>
436d93
+			<listitem><para>After a successful creation print out
436d93
+			the managed service account password. This is output in
436d93
+			a format that should be both human and machine
436d93
+			readable.</para></listitem>
436d93
+		</varlistentry>
436d93
+	</variablelist>
436d93
+</refsect1>
436d93
+
436d93
 <refsect1 id='delegation'>
436d93
 	<title>Delegated Permissions</title>
436d93
 	<para>It is common practice in AD to not use an account from the Domain
436d93
diff --git a/library/adenroll.c b/library/adenroll.c
436d93
index 5ae1f7b..dbfda36 100644
436d93
--- a/library/adenroll.c
436d93
+++ b/library/adenroll.c
436d93
@@ -155,6 +155,20 @@ struct _adcli_enroll {
436d93
 	char *description;
436d93
 };
436d93
 
436d93
+static void
436d93
+check_if_service (adcli_enroll *enroll,
436d93
+                  LDAP *ldap,
436d93
+                  LDAPMessage *results)
436d93
+{
436d93
+	char **objectclasses = NULL;
436d93
+
436d93
+	objectclasses = _adcli_ldap_parse_values (ldap, results, "objectClass");
436d93
+	enroll->is_service = _adcli_strv_has_ex (objectclasses,
436d93
+	                                         "msDS-ManagedServiceAccount",
436d93
+	                                         strcasecmp) == 1 ? true : false;
436d93
+	_adcli_strv_free (objectclasses);
436d93
+}
436d93
+
436d93
 static adcli_result
436d93
 ensure_host_fqdn (adcli_result res,
436d93
                   adcli_enroll *enroll)
436d93
@@ -471,13 +485,15 @@ ensure_keytab_principals (adcli_result res,
436d93
 {
436d93
 	krb5_context k5;
436d93
 	krb5_error_code code;
436d93
-	int count;
436d93
+	int count = 0;
436d93
 	int at, i;
436d93
 
436d93
 	/* Prepare the principals we're going to add to the keytab */
436d93
 
436d93
-	return_unexpected_if_fail (enroll->service_principals);
436d93
-	count = _adcli_strv_len (enroll->service_principals);
436d93
+	if (!enroll->is_service) {
436d93
+		return_unexpected_if_fail (enroll->service_principals);
436d93
+		count = _adcli_strv_len (enroll->service_principals);
436d93
+	}
436d93
 
436d93
 	k5 = adcli_conn_get_krb5_context (enroll->conn);
436d93
 	return_unexpected_if_fail (k5 != NULL);
436d93
@@ -556,8 +572,12 @@ static adcli_result
436d93
 lookup_computer_container (adcli_enroll *enroll,
436d93
                            LDAP *ldap)
436d93
 {
436d93
-	char *attrs[] = { "wellKnownObjects", NULL };
436d93
-	char *prefix = "B:32:AA312825768811D1ADED00C04FD8D5CD:";
436d93
+	char *attrs[] = { enroll->is_service ? "otherWellKnownObjects"
436d93
+	                                     : "wellKnownObjects", NULL };
436d93
+	const char *prefix = enroll->is_service ? "B:32:1EB93889E40C45DF9F0C64D23BBB6237:"
436d93
+	                                        : "B:32:AA312825768811D1ADED00C04FD8D5CD:";
436d93
+	const char *filter = enroll->is_service ? "(&(objectClass=container)(cn=Managed Service Accounts))"
436d93
+	                                        : "(&(objectClass=container)(cn=Computers))";
436d93
 	int prefix_len;
436d93
 	LDAPMessage *results;
436d93
 	const char *base;
436d93
@@ -586,7 +606,7 @@ lookup_computer_container (adcli_enroll *enroll,
436d93
 		                                   "Couldn't lookup computer container: %s", base);
436d93
 	}
436d93
 
436d93
-	values = _adcli_ldap_parse_values (ldap, results, "wellKnownObjects");
436d93
+	values = _adcli_ldap_parse_values (ldap, results, attrs[0]);
436d93
 	ldap_msgfree (results);
436d93
 
436d93
 	prefix_len = strlen (prefix);
436d93
@@ -604,8 +624,7 @@ lookup_computer_container (adcli_enroll *enroll,
436d93
 
436d93
 	/* Try harder */
436d93
 	if (!enroll->computer_container) {
436d93
-		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,
436d93
-		                         "(&(objectClass=container)(cn=Computers))",
436d93
+		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE, filter,
436d93
 		                         attrs, 0, NULL, NULL, NULL, -1, &results);
436d93
 		if (ret == LDAP_SUCCESS) {
436d93
 			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);
436d93
@@ -747,7 +766,7 @@ static adcli_result
436d93
 create_computer_account (adcli_enroll *enroll,
436d93
                          LDAP *ldap)
436d93
 {
436d93
-	char *vals_objectClass[] = { "computer", NULL };
436d93
+	char *vals_objectClass[] = { enroll->is_service ? "msDS-ManagedServiceAccount" : "computer", NULL };
436d93
 	LDAPMod objectClass = { LDAP_MOD_ADD, "objectClass", { vals_objectClass, } };
436d93
 	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };
436d93
 	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };
436d93
@@ -806,7 +825,7 @@ create_computer_account (adcli_enroll *enroll,
436d93
 	m = 0;
436d93
 	for (c = 0; c < mods_count - 1; c++) {
436d93
 		/* Skip empty LDAP sttributes */
436d93
-		if (all_mods[c]->mod_vals.modv_strvals[0] != NULL) {
436d93
+		if (all_mods[c]->mod_vals.modv_strvals != NULL && all_mods[c]->mod_vals.modv_strvals[0] != NULL) {
436d93
 			mods[m++] = all_mods[c];
436d93
 		}
436d93
 	}
436d93
@@ -936,7 +955,7 @@ locate_computer_account (adcli_enroll *enroll,
436d93
                          LDAPMessage **rresults,
436d93
                          LDAPMessage **rentry)
436d93
 {
436d93
-	char *attrs[] = { "1.1", NULL };
436d93
+	char *attrs[] = { "objectClass", NULL };
436d93
 	LDAPMessage *results = NULL;
436d93
 	LDAPMessage *entry = NULL;
436d93
 	const char *base;
436d93
@@ -948,7 +967,9 @@ locate_computer_account (adcli_enroll *enroll,
436d93
 	/* If we don't yet know our computer dn, then try and find it */
436d93
 	value = _adcli_ldap_escape_filter (enroll->computer_sam);
436d93
 	return_unexpected_if_fail (value != NULL);
436d93
-	if (asprintf (&filter, "(&(objectClass=computer)(sAMAccountName=%s))", value) < 0)
436d93
+	if (asprintf (&filter, "(&(objectClass=%s)(sAMAccountName=%s))",
436d93
+	              enroll->is_service ? "msDS-ManagedServiceAccount" : "computer",
436d93
+	              value) < 0)
436d93
 		return_unexpected_if_reached ();
436d93
 	free (value);
436d93
 
436d93
@@ -962,8 +983,11 @@ locate_computer_account (adcli_enroll *enroll,
436d93
 	if (ret == LDAP_SUCCESS) {
436d93
 		entry = ldap_first_entry (ldap, results);
436d93
 
436d93
-		/* If we found a computer account, make note of dn */
436d93
+		/* If we found a computer/service account, make note of dn */
436d93
 		if (entry) {
436d93
+			if (!enroll->is_service_explicit) {
436d93
+				check_if_service ( enroll, ldap, results);
436d93
+			}
436d93
 			dn = ldap_get_dn (ldap, entry);
436d93
 			free (enroll->computer_dn);
436d93
 			enroll->computer_dn = strdup (dn);
436d93
@@ -1003,7 +1027,7 @@ load_computer_account (adcli_enroll *enroll,
436d93
                        LDAPMessage **rresults,
436d93
                        LDAPMessage **rentry)
436d93
 {
436d93
-	char *attrs[] = { "1.1", NULL };
436d93
+	char *attrs[] = { "objectClass", NULL };
436d93
 	LDAPMessage *results = NULL;
436d93
 	LDAPMessage *entry = NULL;
436d93
 	int ret;
436d93
@@ -1081,6 +1105,12 @@ locate_or_create_computer_account (adcli_enroll *enroll,
436d93
 	if (res == ADCLI_SUCCESS && entry == NULL)
436d93
 		res = create_computer_account (enroll, ldap);
436d93
 
436d93
+	/* Service account already exists, just continue and update the
436d93
+	 * password */
436d93
+	if (enroll->is_service && entry != NULL) {
436d93
+		res = ADCLI_SUCCESS;
436d93
+	}
436d93
+
436d93
 	if (results)
436d93
 		ldap_msgfree (results);
436d93
 
436d93
@@ -1413,6 +1443,11 @@ update_computer_account (adcli_enroll *enroll)
436d93
 	LDAP *ldap;
436d93
 	char *value = NULL;
436d93
 
436d93
+	/* No updates for service accounts */
436d93
+	if (enroll->is_service) {
436d93
+		return;
436d93
+	}
436d93
+
436d93
 	ldap = adcli_conn_get_ldap_connection (enroll->conn);
436d93
 	return_if_fail (ldap != NULL);
436d93
 
436d93
@@ -1501,6 +1536,11 @@ update_service_principals (adcli_enroll *enroll)
436d93
 	LDAP *ldap;
436d93
 	int ret;
436d93
 
436d93
+	/* No updates for service accounts */
436d93
+	if (enroll->is_service) {
436d93
+		return ADCLI_SUCCESS;
436d93
+	}
436d93
+
436d93
 	ldap = adcli_conn_get_ldap_connection (enroll->conn);
436d93
 	return_unexpected_if_fail (ldap != NULL);
436d93
 
436d93
@@ -1614,6 +1654,8 @@ load_keytab_entry (krb5_context k5,
436d93
 			enroll->computer_name = name;
436d93
 			name[len - 1] = '\0';
436d93
 			_adcli_info ("Found computer name in keytab: %s", name);
436d93
+			adcli_conn_set_computer_name (enroll->conn,
436d93
+			                              enroll->computer_name);
436d93
 			name = NULL;
436d93
 
436d93
 		} else if (!enroll->host_fqdn && _adcli_str_has_prefix (name, "host/") && strchr (name, '.')) {
436d93
@@ -2002,17 +2044,25 @@ adcli_enroll_prepare (adcli_enroll *enroll,
436d93
 
436d93
 	adcli_clear_last_error ();
436d93
 
436d93
-	/* Basic discovery and figuring out enroll params */
436d93
-	res = ensure_host_fqdn (res, enroll);
436d93
-	res = ensure_computer_name (res, enroll);
436d93
-	res = ensure_computer_sam (res, enroll);
436d93
-	res = ensure_user_principal (res, enroll);
436d93
-	res = ensure_computer_password (res, enroll);
436d93
-	if (!(flags & ADCLI_ENROLL_NO_KEYTAB))
436d93
+	if (enroll->is_service) {
436d93
+		/* Ensure basic params for service accounts */
436d93
+		res = ensure_computer_sam (res, enroll);
436d93
+		res = ensure_computer_password (res, enroll);
436d93
 		res = ensure_host_keytab (res, enroll);
436d93
-	res = ensure_service_names (res, enroll);
436d93
-	res = ensure_service_principals (res, enroll);
436d93
-	res = ensure_keytab_principals (res, enroll);
436d93
+		res = ensure_keytab_principals (res, enroll);
436d93
+	} else {
436d93
+		/* Basic discovery and figuring out enroll params */
436d93
+		res = ensure_host_fqdn (res, enroll);
436d93
+		res = ensure_computer_name (res, enroll);
436d93
+		res = ensure_computer_sam (res, enroll);
436d93
+		res = ensure_user_principal (res, enroll);
436d93
+		res = ensure_computer_password (res, enroll);
436d93
+		if (!(flags & ADCLI_ENROLL_NO_KEYTAB))
436d93
+			res = ensure_host_keytab (res, enroll);
436d93
+		res = ensure_service_names (res, enroll);
436d93
+		res = ensure_service_principals (res, enroll);
436d93
+		res = ensure_keytab_principals (res, enroll);
436d93
+	}
436d93
 
436d93
 	return res;
436d93
 }
436d93
@@ -2157,6 +2207,58 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
436d93
 	return update_keytab_for_principals (enroll, flags);
436d93
 }
436d93
 
436d93
+static adcli_result
436d93
+adcli_enroll_add_description_for_service_account (adcli_enroll *enroll)
436d93
+{
436d93
+	const char *fqdn;
436d93
+	char *desc;
436d93
+
436d93
+	fqdn = adcli_conn_get_host_fqdn (enroll->conn);
436d93
+	return_unexpected_if_fail (fqdn != NULL);
436d93
+	if (asprintf (&desc, "Please do not edit, Service account for %s, "
436d93
+	                     "managed by adcli.", fqdn) < 0) {
436d93
+		return_unexpected_if_reached ();
436d93
+	}
436d93
+
436d93
+	adcli_enroll_set_description (enroll, desc);
436d93
+	free (desc);
436d93
+
436d93
+	return ADCLI_SUCCESS;
436d93
+}
436d93
+
436d93
+static adcli_result
436d93
+adcli_enroll_add_keytab_for_service_account (adcli_enroll *enroll)
436d93
+{
436d93
+	krb5_context k5;
436d93
+	krb5_error_code code;
436d93
+	char def_keytab_name[MAX_KEYTAB_NAME_LEN];
436d93
+	char *lc_dom_name;
436d93
+	int ret;
436d93
+
436d93
+	if (adcli_enroll_get_keytab_name (enroll) == NULL) {
436d93
+		k5 = adcli_conn_get_krb5_context (enroll->conn);
436d93
+		return_unexpected_if_fail (k5 != NULL);
436d93
+
436d93
+		code = krb5_kt_default_name (k5, def_keytab_name,
436d93
+		                             sizeof (def_keytab_name));
436d93
+		return_unexpected_if_fail (code == 0);
436d93
+
436d93
+		lc_dom_name = strdup (adcli_conn_get_domain_name (enroll->conn));
436d93
+		return_unexpected_if_fail (lc_dom_name != NULL);
436d93
+		_adcli_str_down (lc_dom_name);
436d93
+
436d93
+
436d93
+		ret = asprintf (&enroll->keytab_name, "%s.%s", def_keytab_name,
436d93
+		                                             lc_dom_name);
436d93
+		free (lc_dom_name);
436d93
+		return_unexpected_if_fail (ret > 0);
436d93
+	}
436d93
+
436d93
+	_adcli_info ("Using service account keytab: %s", enroll->keytab_name);
436d93
+
436d93
+	return ADCLI_SUCCESS;
436d93
+}
436d93
+
436d93
 adcli_result
436d93
 adcli_enroll_join (adcli_enroll *enroll,
436d93
                    adcli_enroll_flags flags)
436d93
@@ -2172,7 +2274,14 @@ adcli_enroll_join (adcli_enroll *enroll,
436d93
 	if (res != ADCLI_SUCCESS)
436d93
 		return res;
436d93
 
436d93
-	res = ensure_default_service_names (enroll);
436d93
+	if (enroll->is_service) {
436d93
+		res = adcli_enroll_add_description_for_service_account (enroll);
436d93
+		if (res == ADCLI_SUCCESS) {
436d93
+			res = adcli_enroll_add_keytab_for_service_account (enroll);
436d93
+		}
436d93
+	} else {
436d93
+		res = ensure_default_service_names (enroll);
436d93
+	}
436d93
 	if (res != ADCLI_SUCCESS)
436d93
 		return res;
436d93
 
436d93
@@ -2281,6 +2390,11 @@ adcli_enroll_update (adcli_enroll *enroll,
436d93
 	}
436d93
 	free (value);
436d93
 
436d93
+	/* We only support password changes for service accounts */
436d93
+	if (enroll->is_service && (flags & ADCLI_ENROLL_PASSWORD_VALID)) {
436d93
+		return ADCLI_SUCCESS;
436d93
+	}
436d93
+
436d93
 	return enroll_join_or_update_tasks (enroll, flags);
436d93
 }
436d93
 
436d93
diff --git a/tools/computer.c b/tools/computer.c
436d93
index 5a97d8b..63fd374 100644
436d93
--- a/tools/computer.c
436d93
+++ b/tools/computer.c
436d93
@@ -1074,3 +1074,128 @@ adcli_tool_computer_show (adcli_conn *conn,
436d93
 	adcli_enroll_unref (enroll);
436d93
 	return 0;
436d93
 }
436d93
+
436d93
+int
436d93
+adcli_tool_computer_managed_service_account (adcli_conn *conn,
436d93
+                                             int argc,
436d93
+                                             char *argv[])
436d93
+{
436d93
+	adcli_enroll *enroll;
436d93
+	adcli_result res;
436d93
+	int show_password = 0;
436d93
+	int details = 0;
436d93
+	int opt;
436d93
+
436d93
+	struct option options[] = {
436d93
+		{ "domain", required_argument, NULL, opt_domain },
436d93
+		{ "domain-realm", required_argument, NULL, opt_domain_realm },
436d93
+		{ "domain-controller", required_argument, NULL, opt_domain_controller },
436d93
+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },
436d93
+		{ "login-user", required_argument, NULL, opt_login_user },
436d93
+		{ "login-ccache", optional_argument, NULL, opt_login_ccache },
436d93
+		{ "host-fqdn", required_argument, 0, opt_host_fqdn },
436d93
+		{ "computer-name", required_argument, 0, opt_computer_name },
436d93
+		{ "host-keytab", required_argument, 0, opt_host_keytab },
436d93
+		{ "no-password", no_argument, 0, opt_no_password },
436d93
+		{ "stdin-password", no_argument, 0, opt_stdin_password },
436d93
+		{ "prompt-password", no_argument, 0, opt_prompt_password },
436d93
+		{ "domain-ou", required_argument, NULL, opt_domain_ou },
436d93
+		{ "show-details", no_argument, NULL, opt_show_details },
436d93
+		{ "show-password", no_argument, NULL, opt_show_password },
436d93
+		{ "verbose", no_argument, NULL, opt_verbose },
436d93
+		{ "help", no_argument, NULL, 'h' },
436d93
+		{ 0 },
436d93
+	};
436d93
+
436d93
+	static adcli_tool_desc usages[] = {
436d93
+		{ 0, "usage: adcli create-msa --domain=xxxx" },
436d93
+		{ 0 },
436d93
+	};
436d93
+
436d93
+	enroll = adcli_enroll_new (conn);
436d93
+	if (enroll == NULL) {
436d93
+		warnx ("unexpected memory problems");
436d93
+		return -1;
436d93
+	}
436d93
+
436d93
+	while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
436d93
+		switch (opt) {
436d93
+		case opt_one_time_password:
436d93
+			adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_COMPUTER_ACCOUNT);
436d93
+			adcli_conn_set_computer_password (conn, optarg);
436d93
+			break;
436d93
+		case opt_show_details:
436d93
+			details = 1;
436d93
+			break;
436d93
+		case opt_show_password:
436d93
+			show_password = 1;
436d93
+			break;
436d93
+		case 'h':
436d93
+		case '?':
436d93
+		case ':':
436d93
+			adcli_tool_usage (options, usages);
436d93
+			adcli_tool_usage (options, common_usages);
436d93
+			adcli_enroll_unref (enroll);
436d93
+			return opt == 'h' ? 0 : 2;
436d93
+		default:
436d93
+			res = parse_option ((Option)opt, optarg, conn, enroll);
436d93
+			if (res != ADCLI_SUCCESS) {
436d93
+				adcli_enroll_unref (enroll);
436d93
+				return res;
436d93
+			}
436d93
+			break;
436d93
+		}
436d93
+	}
436d93
+
436d93
+	argc -= optind;
436d93
+	argv += optind;
436d93
+
436d93
+	if (argc == 1)
436d93
+		adcli_conn_set_domain_name (conn, argv[0]);
436d93
+	else if (argc > 1) {
436d93
+		warnx ("extra arguments specified");
436d93
+		adcli_enroll_unref (enroll);
436d93
+		return 2;
436d93
+	}
436d93
+
436d93
+	if (adcli_conn_get_domain_name (conn) == NULL) {
436d93
+		warnx ("domain name is required");
436d93
+		adcli_enroll_unref (enroll);
436d93
+		return 2;
436d93
+	}
436d93
+
436d93
+	adcli_enroll_set_is_service (enroll, true);
436d93
+	adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
436d93
+
436d93
+	res = adcli_enroll_load (enroll);
436d93
+	if (res != ADCLI_SUCCESS) {
436d93
+		/* ignored */
436d93
+	}
436d93
+
436d93
+	res = adcli_conn_connect (conn);
436d93
+	if (res != ADCLI_SUCCESS) {
436d93
+		warnx ("couldn't connect to %s domain: %s",
436d93
+		       adcli_conn_get_domain_name (conn),
436d93
+		       adcli_get_last_error ());
436d93
+		adcli_enroll_unref (enroll);
436d93
+		return -res;
436d93
+	}
436d93
+
436d93
+	res = adcli_enroll_join (enroll, 0);
436d93
+	if (res != ADCLI_SUCCESS) {
436d93
+		warnx ("Adding service account for %s failed: %s",
436d93
+		       adcli_conn_get_domain_name (conn),
436d93
+		       adcli_get_last_error ());
436d93
+		adcli_enroll_unref (enroll);
436d93
+		return -res;
436d93
+	}
436d93
+
436d93
+	if (details)
436d93
+		dump_details (conn, enroll, show_password);
436d93
+	else if (show_password)
436d93
+		dump_password (conn, enroll);
436d93
+
436d93
+	adcli_enroll_unref (enroll);
436d93
+
436d93
+	return 0;
436d93
+}
436d93
diff --git a/tools/tools.c b/tools/tools.c
436d93
index 1b6d879..d0dcf98 100644
436d93
--- a/tools/tools.c
436d93
+++ b/tools/tools.c
436d93
@@ -60,6 +60,7 @@ struct {
436d93
 	{ "reset-computer", adcli_tool_computer_reset, "Reset a computer account", },
436d93
 	{ "delete-computer", adcli_tool_computer_delete, "Delete a computer account", },
436d93
 	{ "show-computer", adcli_tool_computer_show, "Show computer account attributes stored in AD", },
436d93
+	{ "create-msa", adcli_tool_computer_managed_service_account, "Create a managed service account in the given AD domain", },
436d93
 	{ "create-user", adcli_tool_user_create, "Create a user account", },
436d93
 	{ "delete-user", adcli_tool_user_delete, "Delete a user account", },
436d93
 	{ "create-group", adcli_tool_group_create, "Create a group", },
436d93
diff --git a/tools/tools.h b/tools/tools.h
436d93
index 3702875..82d5e4e 100644
436d93
--- a/tools/tools.h
436d93
+++ b/tools/tools.h
436d93
@@ -82,6 +82,10 @@ int       adcli_tool_computer_show     (adcli_conn *conn,
436d93
                                         int argc,
436d93
                                         char *argv[]);
436d93
 
436d93
+int       adcli_tool_computer_managed_service_account (adcli_conn *conn,
436d93
+                                                       int argc,
436d93
+                                                       char *argv[]);
436d93
+
436d93
 int       adcli_tool_user_create       (adcli_conn *conn,
436d93
                                         int argc,
436d93
                                         char *argv[]);
436d93
-- 
436d93
2.28.0
436d93