provision: Use the official MS 2008R2 schema by default

This fixes us to have the official adminDescription etc.  While both schema were provided by
Microsoft this is a better quality one, but still under the same licence.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py
index b45e75a3b28f4f6aabb62f0afb505653cc4da73e..e4dd4708e88913966e8b9595803dfd8bcfde1fbe 100644 (file)
--- a/python/samba/netcmd/domain.py
+++ b/python/samba/netcmd/domain.py
@@ -236,7 +236,7 @@ class cmd_domain_provision(Command):
                 help="The domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2008_R2 Native.",
                 default="2008_R2"),
          Option("--base-schema", type="choice", metavar="BASE-SCHEMA",
-                choices=["2008_R2", "2012", "2012_R2"],
+                choices=["2008_R2", "2008_R2_old", "2012", "2012_R2"],
                 help="The base schema files to use. Default is (Windows) 2008_R2.",
                 default="2008_R2"),
          Option("--next-rid", type="int", metavar="NEXTRID", default=1000,

diff --git a/python/samba/schema.py b/python/samba/schema.py
index bc3ae05748416f3f58e82708dc3522b38831bfc2..67ec357a28595ab32c386c878d3fe24e0cd5c221 100644 (file)
--- a/python/samba/schema.py
+++ b/python/samba/schema.py
@@ -64,8 +64,11 @@ class Schema(object):
 
     # the schema files (and corresponding object version) that we know about
     base_schemas = {
-       "2008_R2" : ("MS-AD_Schema_2K8_R2_Attributes.txt",
-                    "MS-AD_Schema_2K8_R2_Classes.txt",
+       "2008_R2_old" : ("MS-AD_Schema_2K8_R2_Attributes.txt",
+                        "MS-AD_Schema_2K8_R2_Classes.txt",
+                        47),
+       "2008_R2" : ("Attributes_for_AD_DS__Windows_Server_2008_R2.ldf",
+                    "Classes_for_AD_DS__Windows_Server_2008_R2.ldf",
                     47),
        "2012"    : ("AD_DS_Attributes__Windows_Server_2012.ldf",
                     "AD_DS_Classes__Windows_Server_2012.ldf",

diff --git a/testprogs/blackbox/schemaupgrade.sh b/testprogs/blackbox/schemaupgrade.sh
index d79915a78fe4868935b08e69f2812fd31568b55b..b1d3f8c1b82d36a2480efea60e0e5b6cc74b7e17 100755 (executable)
--- a/testprogs/blackbox/schemaupgrade.sh
+++ b/testprogs/blackbox/schemaupgrade.sh
@@ -33,15 +33,13 @@ provision_2008r2() {
     $PYTHON $BINDIR/samba-tool domain provision $PROVISION_OPTS --domain=SAMBA --realm=w2008r2.samba.corp --targetdir=$PREFIX_ABS/2008R2_schema --base-schema=2008_R2
 }
 
-ldapcmp() {
+provision_2008r2_old() {
+    $PYTHON $BINDIR/samba-tool domain provision $PROVISION_OPTS --domain=SAMBA --realm=w2008r2.samba.corp --targetdir=$PREFIX_ABS/2008R2_old_schema --base-schema=2008_R2_old
+}
 
-    # the original 2008 schema we received from Microsoft was missing
-    # descriptions and display names. This has been fixed up in the current
-    # Microsoft schemas
-    IGNORE_ATTRS="adminDescription,description,adminDisplayName,displayName"
+ldapcmp_ignore() {
 
-    # we didn't get showInAdvancedViewOnly right on Samba
-    IGNORE_ATTRS="$IGNORE_ATTRS,showInAdvancedViewOnly"
+    IGNORE_ATTRS=$1
 
     # there's discrepancies between the SDDL strings in the adprep LDIF files
     # vs the 2012 schema, where one source will have ACE rights repeated, e.g.
@@ -52,29 +50,73 @@ ldapcmp() {
     # objects, but we don't have the 2012 DisplaySpecifiers documentation...
     IGNORE_ATTRS="$IGNORE_ATTRS,adminContextMenu,adminPropertyPages"
 
-    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/2008R2_schema/private/sam.ldb tdb://$PREFIX_ABS/2012R2_schema/private/sam.ldb --two --filter=$IGNORE_ATTRS
+    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2_schema/private/sam.ldb tdb://$PREFIX_ABS/$3_schema/private/sam.ldb --two --filter=$IGNORE_ATTRS
+}
+
+ldapcmp_old() {
+    # the original 2008 schema we received from Microsoft was missing
+    # descriptions and display names. This has been fixed up in the current
+    # Microsoft schemas
+    IGNORE_ATTRS="adminDescription,description,adminDisplayName,displayName"
+
+    # we didn't get showInAdvancedViewOnly right on Samba
+    IGNORE_ATTRS="$IGNORE_ATTRS,showInAdvancedViewOnly"
+
+    ldapcmp_ignore "$IGNORE_ATTRS" "2008R2_old" "2012R2"
+}
+
+ldapcmp() {
+    # The adminDescription and adminDisplayName have been editorially
+    # corrected in the 2012R2 schema but not in the adprep files.
+    ldapcmp_ignore "adminDescription,adminDisplayName"  "2008R2"  "2012R2"
+}
+
+ldapcmp_2008R2_2008R2_old() {
+    # the original 2008 schema we received from Microsoft was missing
+    # descriptions and display names. This has been fixed up in the current
+    # Microsoft schemas
+    IGNORE_ATTRS="adminDescription,description,adminDisplayName,displayName"
+
+    # we didn't get showInAdvancedViewOnly right on Samba
+    IGNORE_ATTRS="$IGNORE_ATTRS,showInAdvancedViewOnly"
+
+    ldapcmp_ignore $IGNORE_ATTRS  "2008R2"  "2008R2_old"
 }
 
 schema_upgrade() {
        $BINDIR/samba-tool domain schemaupgrade -H tdb://$PREFIX_ABS/2008R2_schema/private/sam.ldb --schema=2012_R2
 }
 
+schema_upgrade_old() {
+       $BINDIR/samba-tool domain schemaupgrade -H tdb://$PREFIX_ABS/2008R2_old_schema/private/sam.ldb --schema=2012_R2
+}
+
 # double-check we cleaned up from the last test run
 cleanup_output_directories
 
 # Provision 2 DCs, one based on the 2008R2 schema and one using 2012R2
 testit "provision_2008R2_schema" provision_2008r2
+testit "provision_2008R2_old_schema" provision_2008r2_old
 testit "provision_2012R2_schema" provision_2012r2
 
 # we expect the 2 schemas to be different
 testit_expect_failure "expect_schema_differences" ldapcmp
 
+# check that the 2 schemas are now the same, ignoring Samba bugs
+testit "check_2008R2_2008R2_schemas_same" ldapcmp_2008R2_2008R2_old
+
 # upgrade the 2008 schema to 2012
 testit "schema_upgrade" schema_upgrade
 
 # check that the 2 schemas are now the same
 testit "check_schemas_same" ldapcmp
 
+# upgrade the 2008 schema to 2012
+testit "schema_upgrade_old" schema_upgrade_old
+
+# check that the 2 schemas are now the same, ignoring Samba bugs
+testit "check_schemas_same_old" ldapcmp_old
+
 cleanup_output_directories
 
 exit $failed

diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh
index 4f6b4e91a5e5575dadc93ac1f4ef63ea9f9e1932..a4a0746b308e9e9dae6dc8ddbd77996a832003fb 100755 (executable)
--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh
+++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh
@@ -95,7 +95,7 @@ samba_upgradedns() {
 }
 
 referenceprovision() {
-        $PYTHON $BINDIR/samba-tool domain provision --server-role="dc" --domain=SAMBA --host-name=ares --realm=${RELEASE}.samba.corp --targetdir=$PREFIX_ABS/${RELEASE}_upgrade_reference --use-ntvfs --host-ip=127.0.0.1 --host-ip6=::1 --function-level=2003 --base-schema=2008_R2
+        $PYTHON $BINDIR/samba-tool domain provision --server-role="dc" --domain=SAMBA --host-name=ares --realm=${RELEASE}.samba.corp --targetdir=$PREFIX_ABS/${RELEASE}_upgrade_reference --use-ntvfs --host-ip=127.0.0.1 --host-ip6=::1 --function-level=2003 --base-schema=2008_R2_old
 }
 
 ldapcmp() {