Handle server without WhoAmI and allow to specify ldap auto_bind parameter

[AndreasLrx]

SambaAD doesn't provide the WhoAmI operation, which made the gmsad crash at startup, this is now optional (since it seems to be debug informations)

And the for the auto_bind, the current True was not working for us (on a sambaAD too). I don't really know why but the AUTO_BIND_TLS_BEFORE_BIND worked so I made this configurable using a new ldap_auto_bind config parameter.

Don't hesitate to mention if I need to update a documentation for the config parameters somewhere.

[vruello]

Hi there!

Thank you for the PR 👍

As you said, it would be great to update the config sample: https://github.com/cea-sec/gmsad/blob/main/gmsad.conf.sample.

I see that SambaAD added support for gMSA in version 4.21 (https://wiki.samba.org/index.php/Samba_4.21_Features_added/changed#Group_Managed_Service_Accounts). Did you try to use their client? They mention:

 samba-tool user getpassword
 samba-tool user get-kerberos-ticket
 samba-tool domain exportkeytab

[AndreasLrx]

About the sambaAD gMSA client in 4.21, it's the reason why we tried to use your script.

But I'm not in charge of the overall sambaAD client tests so can't answer, I guess we did but I'll confirm you on Monday.

[vruello]

Looks good to me!

[vruello]

Thank you very much! 👍

[AndreasLrx]

About this:

 samba-tool user getpassword
 samba-tool user get-kerberos-ticket
 samba-tool domain exportkeytab

We tested it and it works fine, except for the previous=1 part here:

samba-tool user getpassword -H ldap://server --machine-pass TestUser1 --attributes=unicodePwd;previous=1

But we'll report or fix it ;)