From 41379f7ad6a9442dd55cc43d832427911e86db31 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Fri, 23 Oct 2020 16:53:43 +0200

Subject: [PATCH 05/10] computer: add create-msa sub-command

Add new sub-command to create a managed service account in AD. This can

be used if LDAP access to AD is needed but the host is already joined to

a different domain.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112

---

 doc/adcli.xml      | 140 ++++++++++++++++++++++++++++++++++++++

 library/adenroll.c | 164 ++++++++++++++++++++++++++++++++++++++-------

 tools/computer.c   | 125 ++++++++++++++++++++++++++++++++++

 tools/tools.c      |   1 +

 tools/tools.h      |   4 ++

 5 files changed, 409 insertions(+), 25 deletions(-)

diff --git a/doc/adcli.xml b/doc/adcli.xml

index cc44fd8..14921f9 100644

--- a/doc/adcli.xml

+++ b/doc/adcli.xml

@@ -98,6 +98,10 @@

 		<arg choice="opt">--domain=domain.example.com</arg>

 		<arg choice="plain">computer</arg>

 	</cmdsynopsis>

+	<cmdsynopsis>

+		<command>adcli create-msa</command>

+		<arg choice="opt">--domain=domain.example.com</arg>

+	</cmdsynopsis>

 </refsynopsisdiv>

 <refsect1 id='general_overview'>

@@ -885,6 +889,142 @@ Password for Administrator:

 </refsect1>

+<refsect1 id='managed_service_account'>

+	<title>Create a managed service account</title>

+

+	<para><command>adcli create-msa</command> creates a managed service

+	account (MSA) in the given Active Directory domain. This is useful if a

+	computer should not fully join the Active Directory domain but LDAP

+	access is needed. A typical use case is that the computer is already

+	joined an Active Directory domain and needs access to another Active

+	Directory domain in the same or a trusted forest where the host

+	credentials from the joined Active Directory domain are

+	not valid, e.g. there is only a one-way trust.</para>

+

+<programlisting>

+$ adcli create-msa --domain=domain.example.com

+Password for Administrator:

+</programlisting>

+

+	<para>The managed service account, as maintained by adcli, cannot have

+	additional service principals names (SPNs) associated with it. An SPN

+	is defined within the context of a Kerberos service which is tied to a

+	machine account in Active Directory. Since a machine can be joined to a

+	single Active Directory domain, managed service account in a different

+	Active Directory domain will not have the SPNs that otherwise are part

+	of another Active Directory domain's machine.</para>

+

+	<para>Since it is expected that a client will most probably join to the

+	Active Directory domain matching its DNS domain the managed service

+	account will be needed for a different Active directory domain and as a

+	result the Active Directory domain name is a mandatory option. If

+	called with no other options <command>adcli create-msa</command>

+	will use the short hostname with an additional random suffix as

+	computer name to avoid name collisions.</para>

+

+	<para>LDAP attribute sAMAccountName has a limit of 20 characters.

+	However, machine account's NetBIOS name must be at most 16 characters

+	long, including a trailing '$' sign. Since it is not expected that the

+	managed service accounts created by adcli will be used on the NetBIOS

+	level the remaining 4 characters can be used to add uniqueness. Managed

+	service account names will have a suffix of 3 random characters from

+	number and upper- and lowercase ASCII ranges appended to the chosen

+	short host name, using '!' as a separator. For a host with the

+	shortname 'myhost', a managed service account will have a common name

+	(CN attribute) 'myhost!A2c' and a NetBIOS name

+	(sAMAccountName attribute) will be 'myhost!A2c$'. A corresponding

+	Kerberos principal in the Active Directory domain where the managed

+	service account was created would be

+	'myhost!A2c$@DOMAIN.EXAMPLE.COM'.</para>

+

+	<para>A keytab for the managed service account is stored into a file

+	specified with -K option. If it is not specified, the file is named

+	after the default keytab file, with lowercase Active Directory domain

+	of the managed service account as a suffix. On most systems it would be

+	<filename>/etc/krb5.keytab</filename> with a suffix of

+	'domain.example.com', e.g.

+	<filename>/etc/krb5.keytad.domain.example.com</filename>.</para>

+

+	<para><command>adcli create-msa</command> can be called multiple

+	times to reset the password of the managed service account. To identify

+	the right account with the random component in the name the

+	corresponding principal is read from the keytab. If the keytab got

+	deleted <command>adcli</command> will try to identify an existing

+	managed service account with the help of the fully-qualified name, if

+	this fails a new managed service account will be created.</para>

+

+	<para>The managed service account password can be updated with

+<programlisting>

+$ adcli update --domain=domain.example.com --host-keytab=/etc/krb5.keytad.domain.example.com

+</programlisting>

+	and the managed service account can be deleted with

+<programlisting>

+$ adcli delete-computer --domain=domain.example.com 'myhost!A2c'

+</programlisting>

+	</para>

+

+	<para>In addition to the global options, you can specify the following

+	options to control how this operation is done.</para>

+

+	<variablelist>

+		<varlistentry>

+			<term><option>-N, --computer-name=<parameter>computer</parameter></option></term>

+			<listitem><para>The short non-dotted name of the managed

+			service account that will be created in the Active

+			Directory domain. The long option name

+			<option>--computer-name</option> is

+			kept to underline the similarity with the same option

+			of the other sub-commands. If not specified,

+			then the first portion of the <option>--host-fqdn</option>

+			or its default is used with a random suffix.</para></listitem>

+		</varlistentry>

+		<varlistentry>

+			<term><option>-O, --domain-ou=<parameter>OU=xxx</parameter></option></term>

+			<listitem><para>The full distinguished name of the OU in

+			which to create the managed service account. If not

+			specified, then the managed service account will be

+			created in a default location.</para></listitem>

+		</varlistentry>

+		<varlistentry>

+			<term><option>-H, --host-fqdn=<parameter>host</parameter></option></term>

+			<listitem><para>Override the local machine's fully

+			qualified DNS domain name. If not specified, the local

+			machine's hostname will be retrieved via

+			<function>gethostname()</function>.

+			If <function>gethostname()</function> only returns a short name

+			<function>getaddrinfo()</function> with the AI_CANONNAME hint

+			is called to expand the name to a fully qualified DNS

+			domain name.</para></listitem>

+		</varlistentry>

+		<varlistentry>

+			<term><option>-K, --host-keytab=<parameter>/path/to/keytab</parameter></option></term>

+			<listitem><para>Specify the path to the host keytab where

+			credentials of the managed service account will be

+			written after a successful creation. If not specified,

+			the default location will be used, usually

+			<filename>/etc/krb5.keytab</filename> with

+			the lower-cased Active Directory domain name added as a

+			suffix e.g.

+			<filename>/etc/krb5.keytab.domain.example.com</filename>.

+			</para></listitem>

+		</varlistentry>

+		<varlistentry>

+			<term><option>--show-details</option></term>

+			<listitem><para>After a successful creation print out

+			information about the created object. This is output in

+			a format that should be both human and machine

+			readable.</para></listitem>

+		</varlistentry>

+		<varlistentry>

+			<term><option>--show-password</option></term>

+			<listitem><para>After a successful creation print out

+			the managed service account password. This is output in

+			a format that should be both human and machine

+			readable.</para></listitem>

+		</varlistentry>

+	</variablelist>

+</refsect1>

+

 <refsect1 id='delegation'>

 	<title>Delegated Permissions</title>

 	<para>It is common practice in AD to not use an account from the Domain

diff --git a/library/adenroll.c b/library/adenroll.c

index 5ae1f7b..dbfda36 100644

--- a/library/adenroll.c

+++ b/library/adenroll.c

@@ -155,6 +155,20 @@ struct _adcli_enroll {

 	char *description;

 };

+static void

+check_if_service (adcli_enroll *enroll,

+                  LDAP *ldap,

+                  LDAPMessage *results)

+{

+	char **objectclasses = NULL;

+

+	objectclasses = _adcli_ldap_parse_values (ldap, results, "objectClass");

+	enroll->is_service = _adcli_strv_has_ex (objectclasses,

+	                                         "msDS-ManagedServiceAccount",

+	                                         strcasecmp) == 1 ? true : false;

+	_adcli_strv_free (objectclasses);

+}

+

 static adcli_result

 ensure_host_fqdn (adcli_result res,

                   adcli_enroll *enroll)

@@ -471,13 +485,15 @@ ensure_keytab_principals (adcli_result res,

 {

 	krb5_context k5;

 	krb5_error_code code;

-	int count;

+	int count = 0;

 	int at, i;

 	/* Prepare the principals we're going to add to the keytab */

-	return_unexpected_if_fail (enroll->service_principals);

-	count = _adcli_strv_len (enroll->service_principals);

+	if (!enroll->is_service) {

+		return_unexpected_if_fail (enroll->service_principals);

+		count = _adcli_strv_len (enroll->service_principals);

+	}

 	k5 = adcli_conn_get_krb5_context (enroll->conn);

 	return_unexpected_if_fail (k5 != NULL);

@@ -556,8 +572,12 @@ static adcli_result

 lookup_computer_container (adcli_enroll *enroll,

                            LDAP *ldap)

 {

-	char *attrs[] = { "wellKnownObjects", NULL };

-	char *prefix = "B:32:AA312825768811D1ADED00C04FD8D5CD:";

+	char *attrs[] = { enroll->is_service ? "otherWellKnownObjects"

+	                                     : "wellKnownObjects", NULL };

+	const char *prefix = enroll->is_service ? "B:32:1EB93889E40C45DF9F0C64D23BBB6237:"

+	                                        : "B:32:AA312825768811D1ADED00C04FD8D5CD:";

+	const char *filter = enroll->is_service ? "(&(objectClass=container)(cn=Managed Service Accounts))"

+	                                        : "(&(objectClass=container)(cn=Computers))";

 	int prefix_len;

 	LDAPMessage *results;

 	const char *base;

@@ -586,7 +606,7 @@ lookup_computer_container (adcli_enroll *enroll,

 		                                   "Couldn't lookup computer container: %s", base);

 	}

-	values = _adcli_ldap_parse_values (ldap, results, "wellKnownObjects");

+	values = _adcli_ldap_parse_values (ldap, results, attrs[0]);

 	ldap_msgfree (results);

 	prefix_len = strlen (prefix);

@@ -604,8 +624,7 @@ lookup_computer_container (adcli_enroll *enroll,

 	/* Try harder */

 	if (!enroll->computer_container) {

-		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

-		                         "(&(objectClass=container)(cn=Computers))",

+		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE, filter,

 		                         attrs, 0, NULL, NULL, NULL, -1, &results);

 		if (ret == LDAP_SUCCESS) {

 			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);

@@ -747,7 +766,7 @@ static adcli_result

 create_computer_account (adcli_enroll *enroll,

                          LDAP *ldap)

 {

-	char *vals_objectClass[] = { "computer", NULL };

+	char *vals_objectClass[] = { enroll->is_service ? "msDS-ManagedServiceAccount" : "computer", NULL };

 	LDAPMod objectClass = { LDAP_MOD_ADD, "objectClass", { vals_objectClass, } };

 	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };

 	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };

@@ -806,7 +825,7 @@ create_computer_account (adcli_enroll *enroll,

 	m = 0;

 	for (c = 0; c < mods_count - 1; c++) {

 		/* Skip empty LDAP sttributes */

-		if (all_mods[c]->mod_vals.modv_strvals[0] != NULL) {

+		if (all_mods[c]->mod_vals.modv_strvals != NULL && all_mods[c]->mod_vals.modv_strvals[0] != NULL) {

 			mods[m++] = all_mods[c];

 		}

 	}

@@ -936,7 +955,7 @@ locate_computer_account (adcli_enroll *enroll,

                          LDAPMessage **rresults,

                          LDAPMessage **rentry)

 {

-	char *attrs[] = { "1.1", NULL };

+	char *attrs[] = { "objectClass", NULL };

 	LDAPMessage *results = NULL;

 	LDAPMessage *entry = NULL;

 	const char *base;

@@ -948,7 +967,9 @@ locate_computer_account (adcli_enroll *enroll,

 	/* If we don't yet know our computer dn, then try and find it */

 	value = _adcli_ldap_escape_filter (enroll->computer_sam);

 	return_unexpected_if_fail (value != NULL);

-	if (asprintf (&filter, "(&(objectClass=computer)(sAMAccountName=%s))", value) < 0)

+	if (asprintf (&filter, "(&(objectClass=%s)(sAMAccountName=%s))",

+	              enroll->is_service ? "msDS-ManagedServiceAccount" : "computer",

+	              value) < 0)

 		return_unexpected_if_reached ();

 	free (value);

@@ -962,8 +983,11 @@ locate_computer_account (adcli_enroll *enroll,

 	if (ret == LDAP_SUCCESS) {

 		entry = ldap_first_entry (ldap, results);

-		/* If we found a computer account, make note of dn */

+		/* If we found a computer/service account, make note of dn */

 		if (entry) {

+			if (!enroll->is_service_explicit) {

+				check_if_service ( enroll, ldap, results);

+			}

 			dn = ldap_get_dn (ldap, entry);

 			free (enroll->computer_dn);

 			enroll->computer_dn = strdup (dn);

@@ -1003,7 +1027,7 @@ load_computer_account (adcli_enroll *enroll,

                        LDAPMessage **rresults,

                        LDAPMessage **rentry)

 {

-	char *attrs[] = { "1.1", NULL };

+	char *attrs[] = { "objectClass", NULL };

 	LDAPMessage *results = NULL;

 	LDAPMessage *entry = NULL;

 	int ret;

@@ -1081,6 +1105,12 @@ locate_or_create_computer_account (adcli_enroll *enroll,

 	if (res == ADCLI_SUCCESS && entry == NULL)

 		res = create_computer_account (enroll, ldap);

+	/* Service account already exists, just continue and update the

+	 * password */

+	if (enroll->is_service && entry != NULL) {

+		res = ADCLI_SUCCESS;

+	}

+

 	if (results)

 		ldap_msgfree (results);

@@ -1413,6 +1443,11 @@ update_computer_account (adcli_enroll *enroll)

 	LDAP *ldap;

 	char *value = NULL;

+	/* No updates for service accounts */

+	if (enroll->is_service) {

+		return;

+	}

+

 	ldap = adcli_conn_get_ldap_connection (enroll->conn);

 	return_if_fail (ldap != NULL);

@@ -1501,6 +1536,11 @@ update_service_principals (adcli_enroll *enroll)

 	LDAP *ldap;

 	int ret;

+	/* No updates for service accounts */

+	if (enroll->is_service) {

+		return ADCLI_SUCCESS;

+	}

+

 	ldap = adcli_conn_get_ldap_connection (enroll->conn);

 	return_unexpected_if_fail (ldap != NULL);

@@ -1614,6 +1654,8 @@ load_keytab_entry (krb5_context k5,

 			enroll->computer_name = name;

 			name[len - 1] = '\0';

 			_adcli_info ("Found computer name in keytab: %s", name);

+			adcli_conn_set_computer_name (enroll->conn,

+			                              enroll->computer_name);

 			name = NULL;

 		} else if (!enroll->host_fqdn && _adcli_str_has_prefix (name, "host/") && strchr (name, '.')) {

@@ -2002,17 +2044,25 @@ adcli_enroll_prepare (adcli_enroll *enroll,

 	adcli_clear_last_error ();

-	/* Basic discovery and figuring out enroll params */

-	res = ensure_host_fqdn (res, enroll);

-	res = ensure_computer_name (res, enroll);

-	res = ensure_computer_sam (res, enroll);

-	res = ensure_user_principal (res, enroll);

-	res = ensure_computer_password (res, enroll);

-	if (!(flags & ADCLI_ENROLL_NO_KEYTAB))

+	if (enroll->is_service) {

+		/* Ensure basic params for service accounts */

+		res = ensure_computer_sam (res, enroll);

+		res = ensure_computer_password (res, enroll);

 		res = ensure_host_keytab (res, enroll);

-	res = ensure_service_names (res, enroll);

-	res = ensure_service_principals (res, enroll);

-	res = ensure_keytab_principals (res, enroll);

+		res = ensure_keytab_principals (res, enroll);

+	} else {

+		/* Basic discovery and figuring out enroll params */

+		res = ensure_host_fqdn (res, enroll);

+		res = ensure_computer_name (res, enroll);

+		res = ensure_computer_sam (res, enroll);

+		res = ensure_user_principal (res, enroll);

+		res = ensure_computer_password (res, enroll);

+		if (!(flags & ADCLI_ENROLL_NO_KEYTAB))

+			res = ensure_host_keytab (res, enroll);

+		res = ensure_service_names (res, enroll);

+		res = ensure_service_principals (res, enroll);

+		res = ensure_keytab_principals (res, enroll);

+	}

 	return res;

 }

@@ -2157,6 +2207,58 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,

 	return update_keytab_for_principals (enroll, flags);

 }

+static adcli_result

+adcli_enroll_add_description_for_service_account (adcli_enroll *enroll)

+{

+	const char *fqdn;

+	char *desc;

+

+	fqdn = adcli_conn_get_host_fqdn (enroll->conn);

+	return_unexpected_if_fail (fqdn != NULL);

+	if (asprintf (&desc, "Please do not edit, Service account for %s, "

+	                     "managed by adcli.", fqdn) < 0) {

+		return_unexpected_if_reached ();

+	}

+

+	adcli_enroll_set_description (enroll, desc);

+	free (desc);

+

+	return ADCLI_SUCCESS;

+}

+

+static adcli_result

+adcli_enroll_add_keytab_for_service_account (adcli_enroll *enroll)

+{

+	krb5_context k5;

+	krb5_error_code code;

+	char def_keytab_name[MAX_KEYTAB_NAME_LEN];

+	char *lc_dom_name;

+	int ret;

+

+	if (adcli_enroll_get_keytab_name (enroll) == NULL) {

+		k5 = adcli_conn_get_krb5_context (enroll->conn);

+		return_unexpected_if_fail (k5 != NULL);

+

+		code = krb5_kt_default_name (k5, def_keytab_name,

+		                             sizeof (def_keytab_name));

+		return_unexpected_if_fail (code == 0);

+

+		lc_dom_name = strdup (adcli_conn_get_domain_name (enroll->conn));

+		return_unexpected_if_fail (lc_dom_name != NULL);

+		_adcli_str_down (lc_dom_name);

+

+

+		ret = asprintf (&enroll->keytab_name, "%s.%s", def_keytab_name,

+		                                             lc_dom_name);

+		free (lc_dom_name);

+		return_unexpected_if_fail (ret > 0);

+	}

+

+	_adcli_info ("Using service account keytab: %s", enroll->keytab_name);

+

+	return ADCLI_SUCCESS;

+}

+

 adcli_result

 adcli_enroll_join (adcli_enroll *enroll,

                    adcli_enroll_flags flags)

@@ -2172,7 +2274,14 @@ adcli_enroll_join (adcli_enroll *enroll,

 	if (res != ADCLI_SUCCESS)

 		return res;

-	res = ensure_default_service_names (enroll);

+	if (enroll->is_service) {

+		res = adcli_enroll_add_description_for_service_account (enroll);

+		if (res == ADCLI_SUCCESS) {

+			res = adcli_enroll_add_keytab_for_service_account (enroll);

+		}

+	} else {

+		res = ensure_default_service_names (enroll);

+	}

 	if (res != ADCLI_SUCCESS)

 		return res;

@@ -2281,6 +2390,11 @@ adcli_enroll_update (adcli_enroll *enroll,

 	}

 	free (value);

+	/* We only support password changes for service accounts */

+	if (enroll->is_service && (flags & ADCLI_ENROLL_PASSWORD_VALID)) {

+		return ADCLI_SUCCESS;

+	}

+

 	return enroll_join_or_update_tasks (enroll, flags);

 }

diff --git a/tools/computer.c b/tools/computer.c

index 5a97d8b..63fd374 100644

--- a/tools/computer.c

+++ b/tools/computer.c

@@ -1074,3 +1074,128 @@ adcli_tool_computer_show (adcli_conn *conn,

 	adcli_enroll_unref (enroll);

 	return 0;

 }

+

+int

+adcli_tool_computer_managed_service_account (adcli_conn *conn,

+                                             int argc,

+                                             char *argv[])

+{

+	adcli_enroll *enroll;

+	adcli_result res;

+	int show_password = 0;

+	int details = 0;

+	int opt;

+

+	struct option options[] = {

+		{ "domain", required_argument, NULL, opt_domain },

+		{ "domain-realm", required_argument, NULL, opt_domain_realm },

+		{ "domain-controller", required_argument, NULL, opt_domain_controller },

+		{ "use-ldaps", no_argument, 0, opt_use_ldaps },

+		{ "login-user", required_argument, NULL, opt_login_user },

+		{ "login-ccache", optional_argument, NULL, opt_login_ccache },

+		{ "host-fqdn", required_argument, 0, opt_host_fqdn },

+		{ "computer-name", required_argument, 0, opt_computer_name },

+		{ "host-keytab", required_argument, 0, opt_host_keytab },

+		{ "no-password", no_argument, 0, opt_no_password },

+		{ "stdin-password", no_argument, 0, opt_stdin_password },

+		{ "prompt-password", no_argument, 0, opt_prompt_password },

+		{ "domain-ou", required_argument, NULL, opt_domain_ou },

+		{ "show-details", no_argument, NULL, opt_show_details },

+		{ "show-password", no_argument, NULL, opt_show_password },

+		{ "verbose", no_argument, NULL, opt_verbose },

+		{ "help", no_argument, NULL, 'h' },

+		{ 0 },

+	};

+

+	static adcli_tool_desc usages[] = {

+		{ 0, "usage: adcli create-msa --domain=xxxx" },

+		{ 0 },

+	};

+

+	enroll = adcli_enroll_new (conn);

+	if (enroll == NULL) {

+		warnx ("unexpected memory problems");

+		return -1;

+	}

+

+	while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {

+		switch (opt) {

+		case opt_one_time_password:

+			adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_COMPUTER_ACCOUNT);

+			adcli_conn_set_computer_password (conn, optarg);

+			break;

+		case opt_show_details:

+			details = 1;

+			break;

+		case opt_show_password:

+			show_password = 1;

+			break;

+		case 'h':

+		case '?':

+		case ':':

+			adcli_tool_usage (options, usages);

+			adcli_tool_usage (options, common_usages);

+			adcli_enroll_unref (enroll);

+			return opt == 'h' ? 0 : 2;

+		default:

+			res = parse_option ((Option)opt, optarg, conn, enroll);

+			if (res != ADCLI_SUCCESS) {

+				adcli_enroll_unref (enroll);

+				return res;

+			}

+			break;

+		}

+	}

+

+	argc -= optind;

+	argv += optind;

+

+	if (argc == 1)

+		adcli_conn_set_domain_name (conn, argv[0]);

+	else if (argc > 1) {

+		warnx ("extra arguments specified");

+		adcli_enroll_unref (enroll);

+		return 2;

+	}

+

+	if (adcli_conn_get_domain_name (conn) == NULL) {

+		warnx ("domain name is required");

+		adcli_enroll_unref (enroll);

+		return 2;

+	}

+

+	adcli_enroll_set_is_service (enroll, true);

+	adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);

+

+	res = adcli_enroll_load (enroll);

+	if (res != ADCLI_SUCCESS) {

+		/* ignored */

+	}

+

+	res = adcli_conn_connect (conn);

+	if (res != ADCLI_SUCCESS) {

+		warnx ("couldn't connect to %s domain: %s",

+		       adcli_conn_get_domain_name (conn),

+		       adcli_get_last_error ());

+		adcli_enroll_unref (enroll);

+		return -res;

+	}

+

+	res = adcli_enroll_join (enroll, 0);

+	if (res != ADCLI_SUCCESS) {

+		warnx ("Adding service account for %s failed: %s",

+		       adcli_conn_get_domain_name (conn),

+		       adcli_get_last_error ());

+		adcli_enroll_unref (enroll);

+		return -res;

+	}

+

+	if (details)

+		dump_details (conn, enroll, show_password);

+	else if (show_password)

+		dump_password (conn, enroll);

+

+	adcli_enroll_unref (enroll);

+

+	return 0;

+}

diff --git a/tools/tools.c b/tools/tools.c

index 1b6d879..d0dcf98 100644

--- a/tools/tools.c

+++ b/tools/tools.c

@@ -60,6 +60,7 @@ struct {

 	{ "reset-computer", adcli_tool_computer_reset, "Reset a computer account", },

 	{ "delete-computer", adcli_tool_computer_delete, "Delete a computer account", },

 	{ "show-computer", adcli_tool_computer_show, "Show computer account attributes stored in AD", },

+	{ "create-msa", adcli_tool_computer_managed_service_account, "Create a managed service account in the given AD domain", },

 	{ "create-user", adcli_tool_user_create, "Create a user account", },

 	{ "delete-user", adcli_tool_user_delete, "Delete a user account", },

 	{ "create-group", adcli_tool_group_create, "Create a group", },

diff --git a/tools/tools.h b/tools/tools.h

index 3702875..82d5e4e 100644

--- a/tools/tools.h

+++ b/tools/tools.h

@@ -82,6 +82,10 @@ int       adcli_tool_computer_show     (adcli_conn *conn,

                                         int argc,

                                         char *argv[]);

+int       adcli_tool_computer_managed_service_account (adcli_conn *conn,

+                                                       int argc,

+                                                       char *argv[]);

+

 int       adcli_tool_user_create       (adcli_conn *conn,

                                         int argc,

                                         char *argv[]);

-- 

2.28.0