selftest: generate a ramdon domain sid during provision and export as SAMSID/[TRUST_...

This will be useful for future tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13300

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index 12452bc420d320a7be82be37df941d1aacb91f17..42c1e62736fbb997433a4daed53795d5434ee477 100755 (executable)
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -804,6 +804,7 @@ my @exported_envvars = (
        # domain stuff
        "DOMAIN",
        "REALM",
+       "DOMSID",
 
        # stuff related to a trusted domain
        "TRUST_SERVER",
@@ -814,6 +815,7 @@ my @exported_envvars = (
        "TRUST_PASSWORD",
        "TRUST_DOMAIN",
        "TRUST_REALM",
+       "TRUST_DOMSID",
 
        # domain controller stuff
        "DC_SERVER",
@@ -868,6 +870,7 @@ my @exported_envvars = (
        "SERVER_IPV6",
        "NETBIOSNAME",
        "NETBIOSALIAS",
+       "SAMSID",
 
        # user stuff
        "USERNAME",

diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm
index f25507f7201286d3fe663db856d8a9911952e596..b0482d36c91a71187bebab0037b0882377cf98fc 100644 (file)
--- a/selftest/target/Samba.pm
+++ b/selftest/target/Samba.pm
@@ -443,4 +443,10 @@ sub cleanup_child($$)
     return $childpid;
 }
 
+sub random_domain_sid()
+{
+       my $domain_sid = "S-1-5-21-". int(rand(4294967295)) . "-" . int(rand(4294967295)) . "-" . int(rand(4294967295));
+       return $domain_sid;
+}
+
 1;

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 6bedbde832f02e70e62f3dbabf73f7661197d1dd..8914507c12e2a0055103a0f723b51582bb109e1f 100755 (executable)
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -225,6 +225,7 @@ sub setup_nt4_dc
               return undef;
        }
 
+       $vars->{DOMSID} = $vars->{SAMSID};
        $vars->{DC_SERVER} = $vars->{SERVER};
        $vars->{DC_SERVER_IP} = $vars->{SERVER_IP};
        $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6};
@@ -273,6 +274,7 @@ sub setup_nt4_dc_schannel
               return undef;
        }
 
+       $vars->{DOMSID} = $vars->{SAMSID};
        $vars->{DC_SERVER} = $vars->{SERVER};
        $vars->{DC_SERVER_IP} = $vars->{SERVER_IP};
        $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6};
@@ -347,6 +349,7 @@ sub setup_nt4_member
               return undef;
        }
 
+       $ret->{DOMSID} = $nt4_dc_vars->{DOMSID};
        $ret->{DC_SERVER} = $nt4_dc_vars->{SERVER};
        $ret->{DC_SERVER_IP} = $nt4_dc_vars->{SERVER_IP};
        $ret->{DC_SERVER_IPV6} = $nt4_dc_vars->{SERVER_IPV6};
@@ -429,6 +432,7 @@ sub setup_ad_member
        close(USERMAP);
        $ret->{DOMAIN} = $dcvars->{DOMAIN};
        $ret->{REALM} = $dcvars->{REALM};
+       $ret->{DOMSID} = $dcvars->{DOMSID};
 
        my $ctx;
        $ctx = {};
@@ -521,6 +525,7 @@ sub setup_ad_member_rfc2307
        close(USERMAP);
        $ret->{DOMAIN} = $dcvars->{DOMAIN};
        $ret->{REALM} = $dcvars->{REALM};
+       $ret->{DOMSID} = $dcvars->{DOMSID};
 
        my $ctx;
        my $prefix_abs = abs_path($prefix);
@@ -606,6 +611,7 @@ sub setup_ad_member_idmap_rid
        close(USERMAP);
        $ret->{DOMAIN} = $dcvars->{DOMAIN};
        $ret->{REALM} = $dcvars->{REALM};
+       $ret->{DOMSID} = $dcvars->{DOMSID};
 
        my $ctx;
        my $prefix_abs = abs_path($prefix);
@@ -692,6 +698,7 @@ sub setup_ad_member_idmap_ad
        close(USERMAP);
        $ret->{DOMAIN} = $dcvars->{DOMAIN};
        $ret->{REALM} = $dcvars->{REALM};
+       $ret->{DOMSID} = $dcvars->{DOMSID};
 
        my $ctx;
        my $prefix_abs = abs_path($prefix);
@@ -1029,6 +1036,8 @@ $ret->{USERNAME} = KTEST\\Administrator
 #This is the secrets.tdb created by 'net ads join' from Samba3 to a
 #Samba4 DC with the same parameters as are being used here.  The
 #domain SID is S-1-5-21-1071277805-689288055-3486227160
+       $ret->{SAMSID} = "S-1-5-21-1911091480-1468226576-2729736297";
+       $ret->{DOMSID} = "S-1-5-21-1071277805-689288055-3486227160";
 
        system("cp $self->{srcdir}/source3/selftest/ktest-secrets.tdb $prefix/private/secrets.tdb");
        chmod 0600, "$prefix/private/secrets.tdb";
@@ -1364,6 +1373,7 @@ sub provision($$$$$$$$$)
        ## setup the various environment variables we need
        ##
 
+       my $samsid = Samba::random_domain_sid();
        my $swiface = Samba::get_interface($server);
        my %ret = ();
        my %createuser_env = ();
@@ -2143,6 +2153,16 @@ sub provision($$$$$$$$$)
        ";
        close(CONF);
 
+       my $net = Samba::bindir_path($self, "net");
+       my $cmd = "";
+       $cmd .= "SMB_CONF_PATH=\"$conffile\" ";
+       $cmd .= "$net setlocalsid $samsid";
+
+       if (system($cmd) != 0) {
+           warn("Join failed\n$cmd");
+           return undef;
+       }
+
        unless (open(DFQCONF, ">$dfqconffile")) {
                warn("Unable to open $dfqconffile");
                return undef;
@@ -2266,6 +2286,7 @@ force_user:x:$gid_force_user:
        $ret{USERNAME} = $unix_name;
        $ret{USERID} = $unix_uid;
        $ret{DOMAIN} = $domain;
+       $ret{SAMSID} = $samsid;
        $ret{NETBIOSNAME} = $server;
        $ret{PASSWORD} = $password;
        $ret{PIDDIR} = $piddir;

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index b537d74f31f31122af64b75f793e06cc52d78ed1..608265ca11c84112375cffd68ab49745ac66e1b3 100755 (executable)
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -372,6 +372,7 @@ sub setup_trust($$$$$)
        $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
        $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
        $localenv->{TRUST_REALM} = $remoteenv->{REALM};
+       $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
 
        my $samba_tool =  Samba::bindir_path($self, "samba-tool");
        # setup the trust
@@ -401,10 +402,10 @@ sub setup_trust($$$$$)
        return $localenv
 }
 
-sub provision_raw_prepare($$$$$$$$$$$)
+sub provision_raw_prepare($$$$$$$$$$$$)
 {
        my ($self, $prefix, $server_role, $hostname,
-           $domain, $realm, $functional_level,
+           $domain, $realm, $samsid, $functional_level,
            $password, $kdc_ipv4, $kdc_ipv6) = @_;
        my $ctx;
        my $netbiosname = uc($hostname);
@@ -448,6 +449,7 @@ sub provision_raw_prepare($$$$$$$$$$$)
        $ctx->{domain} = $domain;
        $ctx->{realm} = uc($realm);
        $ctx->{dnsname} = lc($realm);
+       $ctx->{samsid} = $samsid;
 
        $ctx->{functional_level} = $functional_level;
 
@@ -543,6 +545,9 @@ sub provision_raw_prepare($$$$$$$$$$$)
        push (@provision_options, "--quiet");
        push (@provision_options, "--domain=$ctx->{domain}");
        push (@provision_options, "--realm=$ctx->{realm}");
+       if (defined($ctx->{samsid})) {
+               push (@provision_options, "--domain-sid=$ctx->{samsid}");
+       }
        push (@provision_options, "--adminpass=$ctx->{password}");
        push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
        push (@provision_options, "--machinepass=machine$ctx->{password}");
@@ -722,6 +727,7 @@ nogroup:x:65534:nobody
                DOMAIN => $ctx->{domain},
                USERNAME => $ctx->{username},
                REALM => $ctx->{realm},
+               SAMSID => $ctx->{samsid},
                PASSWORD => $ctx->{password},
                LDAPDIR => $ctx->{ldapdir},
                LDAP_INSTANCE => $ctx->{ldap_instance},
@@ -757,6 +763,10 @@ nogroup:x:65534:nobody
                $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
        }
 
+       if ($ctx->{server_role} eq "domain controller") {
+               $ret->{DOMSID} = $ret->{SAMSID};
+       }
+
        return $ret;
 }
 
@@ -872,9 +882,13 @@ sub provision($$$$$$$$$$)
            $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
            $extra_provision_options) = @_;
 
+       my $samsid = Samba::random_domain_sid();
+
        my $ctx = $self->provision_raw_prepare($prefix, $server_role,
                                               $hostname,
-                                              $domain, $realm, $functional_level,
+                                              $domain, $realm,
+                                              $samsid,
+                                              $functional_level,
                                               $password, $kdc_ipv4, $kdc_ipv6);
 
        if (defined($extra_provision_options)) {
@@ -1086,6 +1100,7 @@ rpc_server:tcpip = no
        $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
        $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
 
+       $ret->{DOMSID} = $dcvars->{DOMSID};
        $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
        $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
        $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
@@ -1191,6 +1206,7 @@ sub provision_rpc_proxy($$$)
        $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
        $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
 
+       $ret->{DOMSID} = $dcvars->{DOMSID};
        $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
        $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
        $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
@@ -1211,6 +1227,7 @@ sub provision_promoted_dc($$$)
                                               "promotedvdc",
                                               $dcvars->{DOMAIN},
                                               $dcvars->{REALM},
+                                              $dcvars->{SAMSID},
                                               "2008",
                                               $dcvars->{PASSWORD},
                                               $dcvars->{SERVER_IP},
@@ -1306,6 +1323,7 @@ sub provision_vampire_dc($$$)
                                               $name,
                                               $dcvars->{DOMAIN},
                                               $dcvars->{REALM},
+                                              $dcvars->{DOMSID},
                                               $fl,
                                               $dcvars->{PASSWORD},
                                               $dcvars->{SERVER_IP},
@@ -1382,10 +1400,12 @@ sub provision_subdom_dc($$$)
        print "PROVISIONING SUBDOMAIN DC...\n";
 
        # We do this so that we don't run the provision.  That's the job of 'net vampire'.
+       my $samsid = undef; # TODO pass the domain sid all the way down
        my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
                                               "localsubdc",
                                               "SAMBASUBDOM",
                                               "sub.samba.example.com",
+                                              $samsid,
                                               "2008",
                                               $dcvars->{PASSWORD},
                                               undef);
@@ -1653,6 +1673,7 @@ sub provision_rodc($$$)
                                               "rodc",
                                               $dcvars->{DOMAIN},
                                               $dcvars->{REALM},
+                                              $dcvars->{DOMSID},
                                               "2008",
                                               $dcvars->{PASSWORD},
                                               $dcvars->{SERVER_IP},