#!/usr/bin/python3
# SPDX-FileCopyrightText: 2026 Univention GmbH
# SPDX-License-Identifier: AGPL-3.0-only

"""This tool removes the sambaNTPassword value from all accounts"""

from argparse import ArgumentParser

import univention.uldap
from univention.config_registry import ucr


WARNING = '''
Warning: At least S4/AD Connector password synchronization, Squid NTLM authentication, and RADIUS MS-CHAP/NTLM authentication depend on NT hashes.
Setting password/samba/nthash to false will break these use cases.

This cannot be undone! All users and service accounts would have to re-set their passwords.
'''.strip()


def main():
    parser = ArgumentParser(description=__doc__)
    parser.add_argument('-n', '--dry-run', action='store_true')
    args = parser.parse_args()

    lo = univention.uldap.getAdminConnection()
    res = lo.search('sambaNTPassword=*', attr=['sambaNTPassword'])

    print(WARNING)
    if not ucr.is_false('password/samba/nthash'):
        print('The UCR variable "password/samba/nthash" is not set to false.')

    if not res:
        print('No account with sambaNTPassword was found.')
        return

    for dn, attr in res:
        print('Remove sambaNTPassword for %s' % (dn,), end=' ')
        if not args.dry_run:
            lo.modify(dn, [('sambaNTPassword', attr.get('sambaNTPassword', []), b'')])
            print('done')
        else:
            print('(dry run!)')


if __name__ == '__main__':
    main()
