a5b3e8322faec34404bd83ca2a06d0ddb8313f43
[amitay/samba.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 """Functions for setting up a Samba configuration."""
26
27 from base64 import b64encode
28 import os
29 import pwd
30 import grp
31 import time
32 import uuid, glue
33 import socket
34 import param
35 import registry
36 import samba
37 from auth import system_session
38 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
39 from samba.samdb import SamDB
40 from samba.idmap import IDmapDB
41 from samba.dcerpc import security
42 import urllib
43 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
44         timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
45
46 __docformat__ = "restructuredText"
47
48
49 def find_setup_dir():
50     """Find the setup directory used by provision."""
51     dirname = os.path.dirname(__file__)
52     if "/site-packages/" in dirname:
53         prefix = dirname[:dirname.index("/site-packages/")]
54         for suffix in ["share/setup", "share/samba/setup", "setup"]:
55             ret = os.path.join(prefix, suffix)
56             if os.path.isdir(ret):
57                 return ret
58     # In source tree
59     ret = os.path.join(dirname, "../../../setup")
60     if os.path.isdir(ret):
61         return ret
62     raise Exception("Unable to find setup directory.")
63
64
65 DEFAULTSITE = "Default-First-Site-Name"
66
67 class InvalidNetbiosName(Exception):
68     """A specified name was not a valid NetBIOS name."""
69     def __init__(self, name):
70         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
71
72
73 class ProvisionPaths(object):
74     def __init__(self):
75         self.shareconf = None
76         self.hklm = None
77         self.hkcu = None
78         self.hkcr = None
79         self.hku = None
80         self.hkpd = None
81         self.hkpt = None
82         self.samdb = None
83         self.idmapdb = None
84         self.secrets = None
85         self.keytab = None
86         self.dns_keytab = None
87         self.dns = None
88         self.winsdb = None
89         self.private_dir = None
90         self.ldapdir = None
91         self.slapdconf = None
92         self.modulesconf = None
93         self.memberofconf = None
94         self.fedoradsinf = None
95         self.fedoradspartitions = None
96         self.olmmron = None
97         self.olmmrserveridsconf = None
98         self.olmmrsyncreplconf = None
99
100
101 class ProvisionNames(object):
102     def __init__(self):
103         self.rootdn = None
104         self.domaindn = None
105         self.configdn = None
106         self.schemadn = None
107         self.ldapmanagerdn = None
108         self.dnsdomain = None
109         self.realm = None
110         self.netbiosname = None
111         self.domain = None
112         self.hostname = None
113         self.sitename = None
114         self.smbconf = None
115     
116
117 class ProvisionResult(object):
118     def __init__(self):
119         self.paths = None
120         self.domaindn = None
121         self.lp = None
122         self.samdb = None
123
124 def check_install(lp, session_info, credentials):
125     """Check whether the current install seems ok.
126     
127     :param lp: Loadparm context
128     :param session_info: Session information
129     :param credentials: Credentials
130     """
131     if lp.get("realm") == "":
132         raise Exception("Realm empty")
133     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
134             credentials=credentials, lp=lp)
135     if len(ldb.search("(cn=Administrator)")) != 1:
136         raise "No administrator account found"
137
138
139 def findnss(nssfn, names):
140     """Find a user or group from a list of possibilities.
141     
142     :param nssfn: NSS Function to try (should raise KeyError if not found)
143     :param names: Names to check.
144     :return: Value return by first names list.
145     """
146     for name in names:
147         try:
148             return nssfn(name)
149         except KeyError:
150             pass
151     raise KeyError("Unable to find user/group %r" % names)
152
153
154 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
155 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
156
157
158 def read_and_sub_file(file, subst_vars):
159     """Read a file and sub in variables found in it
160     
161     :param file: File to be read (typically from setup directory)
162      param subst_vars: Optional variables to subsitute in the file.
163     """
164     data = open(file, 'r').read()
165     if subst_vars is not None:
166         data = substitute_var(data, subst_vars)
167     check_all_substituted(data)
168     return data
169
170
171 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
172     """Setup a ldb in the private dir.
173     
174     :param ldb: LDB file to import data into
175     :param ldif_path: Path of the LDIF file to load
176     :param subst_vars: Optional variables to subsitute in LDIF.
177     """
178     assert isinstance(ldif_path, str)
179
180     data = read_and_sub_file(ldif_path, subst_vars)
181     ldb.add_ldif(data)
182
183
184 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
185     """Modify a ldb in the private dir.
186     
187     :param ldb: LDB object.
188     :param ldif_path: LDIF file path.
189     :param subst_vars: Optional dictionary with substitution variables.
190     """
191     data = read_and_sub_file(ldif_path, subst_vars)
192
193     ldb.modify_ldif(data)
194
195
196 def setup_ldb(ldb, ldif_path, subst_vars):
197     """Import a LDIF a file into a LDB handle, optionally substituting variables.
198
199     :note: Either all LDIF data will be added or none (using transactions).
200
201     :param ldb: LDB file to import into.
202     :param ldif_path: Path to the LDIF file.
203     :param subst_vars: Dictionary with substitution variables.
204     """
205     assert ldb is not None
206     ldb.transaction_start()
207     try:
208         setup_add_ldif(ldb, ldif_path, subst_vars)
209     except:
210         ldb.transaction_cancel()
211         raise
212     ldb.transaction_commit()
213
214
215 def setup_file(template, fname, subst_vars):
216     """Setup a file in the private dir.
217
218     :param template: Path of the template file.
219     :param fname: Path of the file to create.
220     :param subst_vars: Substitution variables.
221     """
222     f = fname
223
224     if os.path.exists(f):
225         os.unlink(f)
226
227     data = read_and_sub_file(template, subst_vars)
228     open(f, 'w').write(data)
229
230
231 def provision_paths_from_lp(lp, dnsdomain):
232     """Set the default paths for provisioning.
233
234     :param lp: Loadparm context.
235     :param dnsdomain: DNS Domain name
236     """
237     paths = ProvisionPaths()
238     paths.private_dir = lp.get("private dir")
239     paths.keytab = "secrets.keytab"
240     paths.dns_keytab = "dns.keytab"
241
242     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
243     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
244     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
245     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
246     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
247     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
248     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
249     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
250     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
251     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
252     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
253     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
254                                             "phpldapadmin-config.php")
255     paths.ldapdir = os.path.join(paths.private_dir, 
256                                  "ldap")
257     paths.slapdconf = os.path.join(paths.ldapdir, 
258                                    "slapd.conf")
259     paths.modulesconf = os.path.join(paths.ldapdir, 
260                                      "modules.conf")
261     paths.memberofconf = os.path.join(paths.ldapdir, 
262                                       "memberof.conf")
263     paths.fedoradsinf = os.path.join(paths.ldapdir, 
264                                      "fedorads.inf")
265     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
266                                             "fedorads-partitions.ldif")
267     paths.olmmrserveridsconf = os.path.join(paths.ldapdir, 
268                                             "mmr_serverids.conf")
269     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir, 
270                                            "mmr_syncrepl.conf")
271     paths.hklm = "hklm.ldb"
272     paths.hkcr = "hkcr.ldb"
273     paths.hkcu = "hkcu.ldb"
274     paths.hku = "hku.ldb"
275     paths.hkpd = "hkpd.ldb"
276     paths.hkpt = "hkpt.ldb"
277
278     paths.sysvol = lp.get("path", "sysvol")
279
280     paths.netlogon = lp.get("path", "netlogon")
281
282     paths.smbconf = lp.configfile
283
284     return paths
285
286
287 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
288                 rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None, 
289                 sitename=None):
290     """Guess configuration settings to use."""
291
292     if hostname is None:
293         hostname = socket.gethostname().split(".")[0].lower()
294
295     netbiosname = hostname.upper()
296     if not valid_netbios_name(netbiosname):
297         raise InvalidNetbiosName(netbiosname)
298
299     hostname = hostname.lower()
300
301     if dnsdomain is None:
302         dnsdomain = lp.get("realm")
303
304     if serverrole is None:
305         serverrole = lp.get("server role")
306
307     assert dnsdomain is not None
308     realm = dnsdomain.upper()
309
310     if lp.get("realm").upper() != realm:
311         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
312                         (lp.get("realm"), lp.configfile, realm))
313     
314     dnsdomain = dnsdomain.lower()
315
316     if serverrole == "domain controller":
317         if domain is None:
318             domain = lp.get("workgroup")
319         if domaindn is None:
320             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
321         if lp.get("workgroup").upper() != domain.upper():
322             raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
323                         lp.get("workgroup"), domain)
324     else:
325         domain = netbiosname
326         if domaindn is None:
327             domaindn = "CN=" + netbiosname
328         
329     assert domain is not None
330     domain = domain.upper()
331     if not valid_netbios_name(domain):
332         raise InvalidNetbiosName(domain)
333         
334     if rootdn is None:
335        rootdn = domaindn
336        
337     if configdn is None:
338         configdn = "CN=Configuration," + rootdn
339     if schemadn is None:
340         schemadn = "CN=Schema," + configdn
341
342     if sitename is None:
343         sitename=DEFAULTSITE
344
345     names = ProvisionNames()
346     names.rootdn = rootdn
347     names.domaindn = domaindn
348     names.configdn = configdn
349     names.schemadn = schemadn
350     names.ldapmanagerdn = "CN=Manager," + rootdn
351     names.dnsdomain = dnsdomain
352     names.domain = domain
353     names.realm = realm
354     names.netbiosname = netbiosname
355     names.hostname = hostname
356     names.sitename = sitename
357     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
358  
359     return names
360     
361
362 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
363                  targetdir):
364     """Create a new smb.conf file based on a couple of basic settings.
365     """
366     assert smbconf is not None
367     if hostname is None:
368         hostname = socket.gethostname().split(".")[0].lower()
369
370     if serverrole is None:
371         serverrole = "standalone"
372
373     assert serverrole in ("domain controller", "member server", "standalone")
374     if serverrole == "domain controller":
375         smbconfsuffix = "dc"
376     elif serverrole == "member server":
377         smbconfsuffix = "member"
378     elif serverrole == "standalone":
379         smbconfsuffix = "standalone"
380
381     assert domain is not None
382     assert realm is not None
383
384     default_lp = param.LoadParm()
385     #Load non-existant file
386     if os.path.exists(smbconf):
387         default_lp.load(smbconf)
388     
389     if targetdir is not None:
390         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
391         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
392
393         default_lp.set("lock dir", os.path.abspath(targetdir))
394     else:
395         privatedir_line = ""
396         lockdir_line = ""
397
398     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
399     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
400
401     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
402                smbconf, {
403             "HOSTNAME": hostname,
404             "DOMAIN": domain,
405             "REALM": realm,
406             "SERVERROLE": serverrole,
407             "NETLOGONPATH": netlogon,
408             "SYSVOLPATH": sysvol,
409             "PRIVATEDIR_LINE": privatedir_line,
410             "LOCKDIR_LINE": lockdir_line
411             })
412
413
414 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
415                         users_gid, wheel_gid):
416     """setup reasonable name mappings for sam names to unix names.
417
418     :param samdb: SamDB object.
419     :param idmap: IDmap db object.
420     :param sid: The domain sid.
421     :param domaindn: The domain DN.
422     :param root_uid: uid of the UNIX root user.
423     :param nobody_uid: uid of the UNIX nobody user.
424     :param users_gid: gid of the UNIX users group.
425     :param wheel_gid: gid of the UNIX wheel group."""
426     # add some foreign sids if they are not present already
427     samdb.add_stock_foreign_sids()
428
429     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
430     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
431
432     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
433     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
434
435
436 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
437                            credentials, names,
438                            serverrole, ldap_backend=None, 
439                            ldap_backend_type=None, erase=False):
440     """Setup the partitions for the SAM database. 
441     
442     Alternatively, provision() may call this, and then populate the database.
443     
444     :note: This will wipe the Sam Database!
445     
446     :note: This function always removes the local SAM LDB file. The erase 
447         parameter controls whether to erase the existing data, which 
448         may not be stored locally but in LDAP.
449     """
450     assert session_info is not None
451
452     try:
453         samdb = SamDB(samdb_path, session_info=session_info, 
454                       credentials=credentials, lp=lp)
455         # Wipes the database
456         samdb.erase()
457     except LdbError:
458         os.unlink(samdb_path)
459         samdb = SamDB(samdb_path, session_info=session_info, 
460                       credentials=credentials, lp=lp)
461          # Wipes the database
462         samdb.erase()
463         
464
465     #Add modules to the list to activate them by default
466     #beware often order is important
467     #
468     # Some Known ordering constraints:
469     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
470     # - objectclass must be before password_hash, because password_hash checks
471     #   that the objectclass is of type person (filled in by objectclass
472     #   module when expanding the objectclass list)
473     # - partition must be last
474     # - each partition has its own module list then
475     modules_list = ["rootdse",
476                     "paged_results",
477                     "ranged_results",
478                     "anr",
479                     "server_sort",
480                     "asq",
481                     "extended_dn_store",
482                     "extended_dn_in",
483                     "rdn_name",
484                     "objectclass",
485                     "samldb",
486                     "kludge_acl",
487                     "password_hash",
488                     "operational"]
489     tdb_modules_list = [
490                     "subtree_rename",
491                     "subtree_delete",
492                     "linked_attributes",
493                     "extended_dn_out_ldb"]
494     modules_list2 = ["show_deleted",
495                     "partition"]
496  
497     domaindn_ldb = "users.ldb"
498     if ldap_backend is not None:
499         domaindn_ldb = ldap_backend
500     configdn_ldb = "configuration.ldb"
501     if ldap_backend is not None:
502         configdn_ldb = ldap_backend
503     schemadn_ldb = "schema.ldb"
504     if ldap_backend is not None:
505         schema_ldb = ldap_backend
506         schemadn_ldb = ldap_backend
507         
508     if ldap_backend_type == "fedora-ds":
509         backend_modules = ["nsuniqueid", "paged_searches"]
510         # We can handle linked attributes here, as we don't have directory-side subtree operations
511         tdb_modules_list = ["linked_attributes", "extended_dn_out_dereference"]
512     elif ldap_backend_type == "openldap":
513         backend_modules = ["entryuuid", "paged_searches"]
514         # OpenLDAP handles subtree renames, so we don't want to do any of these things
515         tdb_modules_list = ["extended_dn_out_dereference"]
516     elif ldap_backend is not None:
517         raise "LDAP Backend specified, but LDAP Backend Type not specified"
518     elif serverrole == "domain controller":
519         backend_modules = ["repl_meta_data"]
520     else:
521         backend_modules = ["objectguid"]
522
523     if tdb_modules_list is None:
524         tdb_modules_list_as_string = ""
525     else:
526         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
527         
528     samdb.transaction_start()
529     try:
530         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
531                 "SCHEMADN": names.schemadn, 
532                 "SCHEMADN_LDB": schemadn_ldb,
533                 "SCHEMADN_MOD2": ",objectguid",
534                 "CONFIGDN": names.configdn,
535                 "CONFIGDN_LDB": configdn_ldb,
536                 "DOMAINDN": names.domaindn,
537                 "DOMAINDN_LDB": domaindn_ldb,
538                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
539                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
540                 "DOMAINDN_MOD": "pdc_fsmo,instancetype",
541                 "MODULES_LIST": ",".join(modules_list),
542                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
543                 "MODULES_LIST2": ",".join(modules_list2),
544                 "BACKEND_MOD": ",".join(backend_modules),
545         })
546
547     except:
548         samdb.transaction_cancel()
549         raise
550
551     samdb.transaction_commit()
552     
553     samdb = SamDB(samdb_path, session_info=session_info, 
554                   credentials=credentials, lp=lp)
555
556     samdb.transaction_start()
557     try:
558         message("Setting up sam.ldb attributes")
559         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
560
561         message("Setting up sam.ldb rootDSE")
562         setup_samdb_rootdse(samdb, setup_path, names)
563
564         if erase:
565             message("Erasing data from partitions")
566             samdb.erase_partitions()
567
568     except:
569         samdb.transaction_cancel()
570         raise
571
572     samdb.transaction_commit()
573     
574     return samdb
575
576
577 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
578                         netbiosname, domainsid, keytab_path, samdb_url, 
579                         dns_keytab_path, dnspass, machinepass):
580     """Add DC-specific bits to a secrets database.
581     
582     :param secretsdb: Ldb Handle to the secrets database
583     :param setup_path: Setup path function
584     :param machinepass: Machine password
585     """
586     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
587             "MACHINEPASS_B64": b64encode(machinepass),
588             "DOMAIN": domain,
589             "REALM": realm,
590             "DNSDOMAIN": dnsdomain,
591             "DOMAINSID": str(domainsid),
592             "SECRETS_KEYTAB": keytab_path,
593             "NETBIOSNAME": netbiosname,
594             "SAM_LDB": samdb_url,
595             "DNS_KEYTAB": dns_keytab_path,
596             "DNSPASS_B64": b64encode(dnspass),
597             })
598
599
600 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
601     """Setup the secrets database.
602
603     :param path: Path to the secrets database.
604     :param setup_path: Get the path to a setup file.
605     :param session_info: Session info.
606     :param credentials: Credentials
607     :param lp: Loadparm context
608     :return: LDB handle for the created secrets database
609     """
610     if os.path.exists(path):
611         os.unlink(path)
612     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
613                       lp=lp)
614     secrets_ldb.erase()
615     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
616     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
617                       lp=lp)
618     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
619
620     if credentials is not None and credentials.authentication_requested():
621         if credentials.get_bind_dn() is not None:
622             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
623                     "LDAPMANAGERDN": credentials.get_bind_dn(),
624                     "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
625                     })
626         else:
627             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
628                     "LDAPADMINUSER": credentials.get_username(),
629                     "LDAPADMINREALM": credentials.get_realm(),
630                     "LDAPADMINPASS_B64": b64encode(credentials.get_password())
631                     })
632
633     return secrets_ldb
634
635
636 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
637     """Setup the templates database.
638
639     :param path: Path to the database.
640     :param setup_path: Function for obtaining the path to setup files.
641     :param session_info: Session info
642     :param credentials: Credentials
643     :param lp: Loadparm context
644     """
645     templates_ldb = SamDB(path, session_info=session_info,
646                           credentials=credentials, lp=lp)
647     # Wipes the database
648     try:
649         templates_ldb.erase()
650     # This should be 'except LdbError', but on a re-provision the assert in ldb.erase fires, and we need to catch that too
651     except:
652         os.unlink(path)
653
654     templates_ldb.load_ldif_file_add(setup_path("provision_templates_init.ldif"))
655
656     templates_ldb = SamDB(path, session_info=session_info,
657                           credentials=credentials, lp=lp)
658
659     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
660
661
662 def setup_registry(path, setup_path, session_info, credentials, lp):
663     """Setup the registry.
664     
665     :param path: Path to the registry database
666     :param setup_path: Function that returns the path to a setup.
667     :param session_info: Session information
668     :param credentials: Credentials
669     :param lp: Loadparm context
670     """
671     reg = registry.Registry()
672     hive = registry.open_ldb(path, session_info=session_info, 
673                          credentials=credentials, lp_ctx=lp)
674     reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
675     provision_reg = setup_path("provision.reg")
676     assert os.path.exists(provision_reg)
677     reg.diff_apply(provision_reg)
678
679
680 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
681     """Setup the idmap database.
682
683     :param path: path to the idmap database
684     :param setup_path: Function that returns a path to a setup file
685     :param session_info: Session information
686     :param credentials: Credentials
687     :param lp: Loadparm context
688     """
689     if os.path.exists(path):
690         os.unlink(path)
691
692     idmap_ldb = IDmapDB(path, session_info=session_info,
693                         credentials=credentials, lp=lp)
694
695     idmap_ldb.erase()
696     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
697     return idmap_ldb
698
699
700 def setup_samdb_rootdse(samdb, setup_path, names):
701     """Setup the SamDB rootdse.
702
703     :param samdb: Sam Database handle
704     :param setup_path: Obtain setup path
705     """
706     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
707         "SCHEMADN": names.schemadn, 
708         "NETBIOSNAME": names.netbiosname,
709         "DNSDOMAIN": names.dnsdomain,
710         "REALM": names.realm,
711         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
712         "DOMAINDN": names.domaindn,
713         "ROOTDN": names.rootdn,
714         "CONFIGDN": names.configdn,
715         "SERVERDN": names.serverdn,
716         })
717         
718
719 def setup_self_join(samdb, names,
720                     machinepass, dnspass, 
721                     domainsid, invocationid, setup_path,
722                     policyguid):
723     """Join a host to its own domain."""
724     assert isinstance(invocationid, str)
725     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
726               "CONFIGDN": names.configdn, 
727               "SCHEMADN": names.schemadn,
728               "DOMAINDN": names.domaindn,
729               "SERVERDN": names.serverdn,
730               "INVOCATIONID": invocationid,
731               "NETBIOSNAME": names.netbiosname,
732               "DEFAULTSITE": names.sitename,
733               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
734               "MACHINEPASS_B64": b64encode(machinepass),
735               "DNSPASS_B64": b64encode(dnspass),
736               "REALM": names.realm,
737               "DOMAIN": names.domain,
738               "DNSDOMAIN": names.dnsdomain})
739     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
740               "POLICYGUID": policyguid,
741               "DNSDOMAIN": names.dnsdomain,
742               "DOMAINSID": str(domainsid),
743               "DOMAINDN": names.domaindn})
744
745
746 def setup_samdb(path, setup_path, session_info, credentials, lp, 
747                 names, message, 
748                 domainsid, aci, domainguid, policyguid, 
749                 fill, adminpass, krbtgtpass, 
750                 machinepass, invocationid, dnspass,
751                 serverrole, ldap_backend=None, 
752                 ldap_backend_type=None):
753     """Setup a complete SAM Database.
754     
755     :note: This will wipe the main SAM database file!
756     """
757
758     erase = (fill != FILL_DRS)
759
760     # Also wipes the database
761     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
762                            credentials=credentials, session_info=session_info,
763                            names=names, 
764                            ldap_backend=ldap_backend, serverrole=serverrole,
765                            ldap_backend_type=ldap_backend_type, erase=erase)
766
767     samdb = SamDB(path, session_info=session_info, 
768                   credentials=credentials, lp=lp)
769     if fill == FILL_DRS:
770         return samdb
771
772     message("Pre-loading the Samba 4 and AD schema")
773     samdb.set_domain_sid(str(domainsid))
774     if serverrole == "domain controller":
775         samdb.set_invocation_id(invocationid)
776
777     load_schema(setup_path, samdb, names.schemadn, names.netbiosname, 
778                 names.configdn, names.sitename, names.serverdn,
779                 names.hostname)
780
781     samdb.transaction_start()
782         
783     try:
784         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
785         if serverrole == "domain controller":
786             domain_oc = "domainDNS"
787         else:
788             domain_oc = "samba4LocalDomain"
789
790         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
791                 "DOMAINDN": names.domaindn,
792                 "ACI": aci,
793                 "DOMAIN_OC": domain_oc
794                 })
795
796         message("Modifying DomainDN: " + names.domaindn + "")
797         if domainguid is not None:
798             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
799         else:
800             domainguid_mod = ""
801
802         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
803             "LDAPTIME": timestring(int(time.time())),
804             "DOMAINSID": str(domainsid),
805             "SCHEMADN": names.schemadn, 
806             "NETBIOSNAME": names.netbiosname,
807             "DEFAULTSITE": names.sitename,
808             "CONFIGDN": names.configdn,
809             "SERVERDN": names.serverdn,
810             "POLICYGUID": policyguid,
811             "DOMAINDN": names.domaindn,
812             "DOMAINGUID_MOD": domainguid_mod,
813             })
814
815         message("Adding configuration container (permitted to fail)")
816         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
817             "CONFIGDN": names.configdn, 
818             "ACI": aci,
819             })
820         message("Modifying configuration container")
821         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
822             "CONFIGDN": names.configdn, 
823             "SCHEMADN": names.schemadn,
824             })
825
826         message("Adding schema container (permitted to fail)")
827         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
828             "SCHEMADN": names.schemadn,
829             "ACI": aci,
830             })
831         message("Modifying schema container")
832
833         prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
834
835         setup_modify_ldif(samdb, 
836             setup_path("provision_schema_basedn_modify.ldif"), {
837             "SCHEMADN": names.schemadn,
838             "NETBIOSNAME": names.netbiosname,
839             "DEFAULTSITE": names.sitename,
840             "CONFIGDN": names.configdn,
841             "SERVERDN": names.serverdn,
842             "PREFIXMAP_B64": b64encode(prefixmap)
843             })
844
845         message("Setting up sam.ldb Samba4 schema")
846         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
847                        {"SCHEMADN": names.schemadn })
848         message("Setting up sam.ldb AD schema")
849         setup_add_ldif(samdb, setup_path("schema.ldif"), 
850                        {"SCHEMADN": names.schemadn})
851         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"), 
852                        {"SCHEMADN": names.schemadn})
853
854         message("Setting up sam.ldb configuration data")
855         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
856             "CONFIGDN": names.configdn,
857             "NETBIOSNAME": names.netbiosname,
858             "DEFAULTSITE": names.sitename,
859             "DNSDOMAIN": names.dnsdomain,
860             "DOMAIN": names.domain,
861             "SCHEMADN": names.schemadn,
862             "DOMAINDN": names.domaindn,
863             "SERVERDN": names.serverdn
864             })
865
866         message("Setting up display specifiers")
867         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
868                        {"CONFIGDN": names.configdn})
869
870         message("Adding users container (permitted to fail)")
871         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
872                 "DOMAINDN": names.domaindn})
873         message("Modifying users container")
874         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
875                 "DOMAINDN": names.domaindn})
876         message("Adding computers container (permitted to fail)")
877         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
878                 "DOMAINDN": names.domaindn})
879         message("Modifying computers container")
880         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
881                 "DOMAINDN": names.domaindn})
882         message("Setting up sam.ldb data")
883         setup_add_ldif(samdb, setup_path("provision.ldif"), {
884             "DOMAINDN": names.domaindn,
885             "NETBIOSNAME": names.netbiosname,
886             "DEFAULTSITE": names.sitename,
887             "CONFIGDN": names.configdn,
888             "SERVERDN": names.serverdn
889             })
890
891         if fill == FILL_FULL:
892             message("Setting up sam.ldb users and groups")
893             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
894                 "DOMAINDN": names.domaindn,
895                 "DOMAINSID": str(domainsid),
896                 "CONFIGDN": names.configdn,
897                 "ADMINPASS_B64": b64encode(adminpass),
898                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
899                 })
900
901             if serverrole == "domain controller":
902                 message("Setting up self join")
903                 setup_self_join(samdb, names=names, invocationid=invocationid, 
904                                 dnspass=dnspass,  
905                                 machinepass=machinepass, 
906                                 domainsid=domainsid, policyguid=policyguid,
907                                 setup_path=setup_path)
908
909     except:
910         samdb.transaction_cancel()
911         raise
912
913     samdb.transaction_commit()
914     return samdb
915
916
917 FILL_FULL = "FULL"
918 FILL_NT4SYNC = "NT4SYNC"
919 FILL_DRS = "DRS"
920
921 def provision(setup_dir, message, session_info, 
922               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
923               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
924               serverdn=None,
925               domain=None, hostname=None, hostip=None, hostip6=None, 
926               domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
927               policyguid=None, invocationid=None, machinepass=None, 
928               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
929               wheel=None, backup=None, aci=None, serverrole=None, 
930               ldap_backend=None, ldap_backend_type=None, sitename=None):
931     """Provision samba4
932     
933     :note: caution, this wipes all existing data!
934     """
935
936     def setup_path(file):
937         return os.path.join(setup_dir, file)
938
939     if domainsid is None:
940         domainsid = security.random_sid()
941
942     if policyguid is None:
943         policyguid = str(uuid.uuid4())
944     if adminpass is None:
945         adminpass = glue.generate_random_str(12)
946     if krbtgtpass is None:
947         krbtgtpass = glue.generate_random_str(12)
948     if machinepass is None:
949         machinepass  = glue.generate_random_str(12)
950     if dnspass is None:
951         dnspass = glue.generate_random_str(12)
952     root_uid = findnss_uid([root or "root"])
953     nobody_uid = findnss_uid([nobody or "nobody"])
954     users_gid = findnss_gid([users or "users"])
955     if wheel is None:
956         wheel_gid = findnss_gid(["wheel", "adm"])
957     else:
958         wheel_gid = findnss_gid([wheel])
959     if aci is None:
960         aci = "# no aci for local ldb"
961
962     if targetdir is not None:
963         if (not os.path.exists(os.path.join(targetdir, "etc"))):
964             os.makedirs(os.path.join(targetdir, "etc"))
965         smbconf = os.path.join(targetdir, "etc", "smb.conf")
966     elif smbconf is None:
967         smbconf = param.default_path()
968
969     # only install a new smb.conf if there isn't one there already
970     if not os.path.exists(smbconf):
971         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
972                      targetdir)
973
974     lp = param.LoadParm()
975     lp.load(smbconf)
976
977     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
978                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
979                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
980                         serverdn=serverdn)
981
982     paths = provision_paths_from_lp(lp, names.dnsdomain)
983
984     if hostip is None:
985         try:
986             hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
987         except socket.gaierror, (socket.EAI_NODATA, msg):
988             hostip = None
989
990     if hostip6 is None:
991         try:
992             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
993         except socket.gaierror, (socket.EAI_NODATA, msg): 
994             hostip6 = None
995
996     if serverrole is None:
997         serverrole = lp.get("server role")
998
999     assert serverrole in ("domain controller", "member server", "standalone")
1000     if invocationid is None and serverrole == "domain controller":
1001         invocationid = str(uuid.uuid4())
1002
1003     if not os.path.exists(paths.private_dir):
1004         os.mkdir(paths.private_dir)
1005
1006     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1007     
1008     if ldap_backend is not None:
1009         if ldap_backend == "ldapi":
1010             # provision-backend will set this path suggested slapd command line / fedorads.inf
1011             ldap_backend = "ldapi://%s" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1012              
1013     # only install a new shares config db if there is none
1014     if not os.path.exists(paths.shareconf):
1015         message("Setting up share.ldb")
1016         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
1017                         credentials=credentials, lp=lp)
1018         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1019
1020      
1021     message("Setting up secrets.ldb")
1022     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
1023                                   session_info=session_info, 
1024                                   credentials=credentials, lp=lp)
1025
1026     message("Setting up the registry")
1027     setup_registry(paths.hklm, setup_path, session_info, 
1028                    credentials=credentials, lp=lp)
1029
1030     message("Setting up templates db")
1031     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
1032                       credentials=credentials, lp=lp)
1033
1034     message("Setting up idmap db")
1035     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1036                           credentials=credentials, lp=lp)
1037
1038     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
1039                         credentials=credentials, lp=lp, names=names,
1040                         message=message, 
1041                         domainsid=domainsid, 
1042                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
1043                         fill=samdb_fill, 
1044                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1045                         invocationid=invocationid, 
1046                         machinepass=machinepass, dnspass=dnspass,
1047                         serverrole=serverrole, ldap_backend=ldap_backend, 
1048                         ldap_backend_type=ldap_backend_type)
1049
1050     if lp.get("server role") == "domain controller":
1051         if paths.netlogon is None:
1052             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1053             message("Please either remove %s or see the template at %s" % 
1054                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1055             assert(paths.netlogon is not None)
1056
1057         if paths.sysvol is None:
1058             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1059             message("Please either remove %s or see the template at %s" % 
1060                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1061             assert(paths.sysvol is not None)            
1062             
1063         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
1064                                    "{" + policyguid + "}")
1065         os.makedirs(policy_path, 0755)
1066         open(os.path.join(policy_path, "GPT.INI"), 'w').write("")
1067         os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1068         os.makedirs(os.path.join(policy_path, "User"), 0755)
1069         if not os.path.isdir(paths.netlogon):
1070             os.makedirs(paths.netlogon, 0755)
1071
1072     if samdb_fill == FILL_FULL:
1073         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1074                             root_uid=root_uid, nobody_uid=nobody_uid,
1075                             users_gid=users_gid, wheel_gid=wheel_gid)
1076
1077         message("Setting up sam.ldb rootDSE marking as synchronized")
1078         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1079
1080         # Only make a zone file on the first DC, it should be replicated with DNS replication
1081         if serverrole == "domain controller":
1082             secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
1083                               credentials=credentials, lp=lp)
1084             secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1085                                 netbiosname=names.netbiosname, domainsid=domainsid, 
1086                                 keytab_path=paths.keytab, samdb_url=paths.samdb, 
1087                                 dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
1088                                 machinepass=machinepass, dnsdomain=names.dnsdomain)
1089
1090             samdb = SamDB(paths.samdb, session_info=session_info, 
1091                       credentials=credentials, lp=lp)
1092
1093             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1094             assert isinstance(domainguid, str)
1095             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1096                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1097                                        scope=SCOPE_SUBTREE)
1098             assert isinstance(hostguid, str)
1099
1100             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1101                              domaindn=names.domaindn, hostip=hostip,
1102                              hostip6=hostip6, hostname=names.hostname,
1103                              dnspass=dnspass, realm=names.realm,
1104                              domainguid=domainguid, hostguid=hostguid)
1105
1106             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1107                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1108
1109             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1110                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1111                               keytab_name=paths.dns_keytab)
1112             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1113             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1114
1115             create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
1116                              hostname=names.hostname, realm=names.realm)
1117             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1118
1119     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1120                                ldapi_url)
1121
1122     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1123
1124     message("Once the above files are installed, your Samba4 server will be ready to use")
1125     message("Server Role:    %s" % serverrole)
1126     message("Hostname:       %s" % names.hostname)
1127     message("NetBIOS Domain: %s" % names.domain)
1128     message("DNS Domain:     %s" % names.dnsdomain)
1129     message("DOMAIN SID:     %s" % str(domainsid))
1130     message("Admin password: %s" % adminpass)
1131
1132     result = ProvisionResult()
1133     result.domaindn = domaindn
1134     result.paths = paths
1135     result.lp = lp
1136     result.samdb = samdb
1137     return result
1138
1139
1140 def provision_become_dc(setup_dir=None,
1141                         smbconf=None, targetdir=None, realm=None, 
1142                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1143                         serverdn=None,
1144                         domain=None, hostname=None, domainsid=None, 
1145                         adminpass=None, krbtgtpass=None, domainguid=None, 
1146                         policyguid=None, invocationid=None, machinepass=None, 
1147                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
1148                         wheel=None, backup=None, aci=None, serverrole=None, 
1149                         ldap_backend=None, ldap_backend_type=None, sitename=None):
1150
1151     def message(text):
1152         """print a message if quiet is not set."""
1153         print text
1154
1155     return provision(setup_dir, message, system_session(), None,
1156               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
1157               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
1158               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename)
1159     
1160
1161 def setup_db_config(setup_path, dbdir):
1162     """Setup a Berkeley database.
1163     
1164     :param setup_path: Setup path function.
1165     :param dbdir: Database directory."""
1166     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1167         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700)
1168     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1169         os.makedirs(os.path.join(dbdir, "tmp"), 0700)
1170     
1171     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1172                {"LDAPDBDIR": dbdir})
1173     
1174
1175
1176 def provision_backend(setup_dir=None, message=None,
1177                       smbconf=None, targetdir=None, realm=None, 
1178                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1179                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
1180                       ldap_backend_type=None, ldap_backend_port=None,
1181                       ol_mmr_urls=None):
1182
1183     def setup_path(file):
1184         return os.path.join(setup_dir, file)
1185
1186     if hostname is None:
1187         hostname = socket.gethostname().split(".")[0].lower()
1188
1189     if root is None:
1190         root = findnss(pwd.getpwnam, ["root"])[0]
1191
1192     if adminpass is None:
1193         adminpass = glue.generate_random_str(12)
1194
1195     if targetdir is not None:
1196         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1197             os.makedirs(os.path.join(targetdir, "etc"))
1198         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1199     elif smbconf is None:
1200         smbconf = param.default_path()
1201         assert smbconf is not None
1202
1203     # only install a new smb.conf if there isn't one there already
1204     if not os.path.exists(smbconf):
1205         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
1206                      targetdir)
1207
1208     lp = param.LoadParm()
1209     lp.load(smbconf)
1210
1211     if serverrole is None:
1212         serverrole = lp.get("server role")
1213
1214     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
1215                         dnsdomain=realm, serverrole=serverrole, 
1216                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, 
1217                         schemadn=schemadn)
1218
1219     paths = provision_paths_from_lp(lp, names.dnsdomain)
1220
1221     if not os.path.isdir(paths.ldapdir):
1222         os.makedirs(paths.ldapdir, 0700)
1223     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1224     try:
1225         os.unlink(schemadb_path)
1226     except OSError:
1227         pass
1228
1229     schemadb = Ldb(schemadb_path, lp=lp)
1230  
1231     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1232
1233     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
1234                    {"SCHEMADN": names.schemadn,
1235                     "ACI": "#",
1236                     })
1237     setup_modify_ldif(schemadb, 
1238                       setup_path("provision_schema_basedn_modify.ldif"), \
1239                           {"SCHEMADN": names.schemadn,
1240                            "NETBIOSNAME": names.netbiosname,
1241                            "DEFAULTSITE": DEFAULTSITE,
1242                            "CONFIGDN": names.configdn,
1243                            "SERVERDN": names.serverdn,
1244                            "PREFIXMAP_B64": b64encode(prefixmap)
1245                            })
1246     
1247     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
1248                    {"SCHEMADN": names.schemadn })
1249     setup_add_ldif(schemadb, setup_path("schema.ldif"), 
1250                    {"SCHEMADN": names.schemadn})
1251
1252     if ldap_backend_type == "fedora-ds":
1253         if ldap_backend_port is not None:
1254             serverport = "ServerPort=%d" % ldap_backend_port
1255         else:
1256             serverport = ""
1257
1258         setup_file(setup_path("fedorads.inf"), paths.fedoradsinf, 
1259                    {"ROOT": root,
1260                     "HOSTNAME": hostname,
1261                     "DNSDOMAIN": names.dnsdomain,
1262                     "LDAPDIR": paths.ldapdir,
1263                     "DOMAINDN": names.domaindn,
1264                     "LDAPMANAGERDN": names.ldapmanagerdn,
1265                     "LDAPMANAGERPASS": adminpass, 
1266                     "SERVERPORT": serverport})
1267         
1268         setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions, 
1269                    {"CONFIGDN": names.configdn,
1270                     "SCHEMADN": names.schemadn,
1271                     })
1272         
1273         mapping = "schema-map-fedora-ds-1.0"
1274         backend_schema = "99_ad.ldif"
1275         
1276         slapdcommand="Initialise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
1277        
1278         ldapuser = "--simple-bind-dn=" + names.ldapmanagerdn
1279
1280     elif ldap_backend_type == "openldap":
1281         attrs = ["linkID", "lDAPDisplayName"]
1282         res = schemadb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
1283
1284         memberof_config = "# Generated from schema in %s\n" % schemadb_path
1285         refint_attributes = ""
1286         for i in range (0, len(res)):
1287             expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
1288             target = schemadb.searchone(basedn=names.schemadn, 
1289                                         expression=expression, 
1290                                         attribute="lDAPDisplayName", 
1291                                         scope=SCOPE_SUBTREE)
1292             if target is not None:
1293                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0]
1294             
1295                 memberof_config += read_and_sub_file(setup_path("memberof.conf"),
1296                                                      { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
1297                                                        "MEMBEROF_ATTR" : str(target) })
1298
1299         refint_config = read_and_sub_file(setup_path("refint.conf"),
1300                                             { "LINK_ATTRS" : refint_attributes})
1301
1302 # generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
1303         mmr_on_config = ""
1304         mmr_replicator_acl = ""
1305         mmr_serverids_config = ""
1306         mmr_syncrepl_schema_config = "" 
1307         mmr_syncrepl_config_config = "" 
1308         mmr_syncrepl_user_config = "" 
1309         
1310         if ol_mmr_urls is not None:
1311                 # For now, make these equal
1312                 mmr_pass = adminpass
1313
1314                 url_list=filter(None,ol_mmr_urls.split(' ')) 
1315                 if (len(url_list) == 1):
1316                     url_list=filter(None,ol_mmr_urls.split(',')) 
1317                      
1318
1319                 mmr_on_config = "MirrorMode On"
1320                 mmr_replicator_acl = "  by dn=cn=replicator,cn=samba read"
1321                 serverid=0
1322                 for url in url_list:
1323                         serverid=serverid+1
1324                         mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
1325                                                                      { "SERVERID" : str(serverid),
1326                                                                        "LDAPSERVER" : url })
1327                         rid=serverid*10
1328                         rid=rid+1
1329                         mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1330                                                                      {  "RID" : str(rid),
1331                                                                         "MMRDN": names.schemadn,
1332                                                                         "LDAPSERVER" : url,
1333                                                                         "MMR_PASSWORD": mmr_pass})
1334
1335                         rid=rid+1
1336                         mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1337                                                                      {  "RID" : str(rid),
1338                                                                         "MMRDN": names.configdn,
1339                                                                         "LDAPSERVER" : url,
1340                                                                         "MMR_PASSWORD": mmr_pass})
1341
1342                         rid=rid+1
1343                         mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1344                                                                      {  "RID" : str(rid),
1345                                                                         "MMRDN": names.domaindn,
1346                                                                         "LDAPSERVER" : url,
1347                                                                         "MMR_PASSWORD": mmr_pass })
1348
1349
1350         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1351                    {"DNSDOMAIN": names.dnsdomain,
1352                     "LDAPDIR": paths.ldapdir,
1353                     "DOMAINDN": names.domaindn,
1354                     "CONFIGDN": names.configdn,
1355                     "SCHEMADN": names.schemadn,
1356                     "MEMBEROF_CONFIG": memberof_config,
1357                     "MIRRORMODE": mmr_on_config,
1358                     "REPLICATOR_ACL": mmr_replicator_acl,
1359                     "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
1360                     "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
1361                     "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
1362                     "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
1363                     "REFINT_CONFIG": refint_config})
1364         setup_file(setup_path("modules.conf"), paths.modulesconf,
1365                    {"REALM": names.realm})
1366         
1367         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
1368         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
1369         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
1370
1371         if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba")):
1372             os.makedirs(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba"), 0700)
1373
1374         setup_file(setup_path("cn=samba.ldif"), 
1375                    os.path.join(paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
1376                    { "UUID": str(uuid.uuid4()), 
1377                      "LDAPTIME": timestring(int(time.time()))} )
1378         setup_file(setup_path("cn=samba-admin.ldif"), 
1379                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
1380                               {"LDAPADMINPASS_B64": b64encode(adminpass),
1381                                "UUID": str(uuid.uuid4()), 
1382                                "LDAPTIME": timestring(int(time.time()))} )
1383         
1384         if ol_mmr_urls is not None:
1385            setup_file(setup_path("cn=replicator.ldif"),
1386                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=replicator.ldif"),
1387                               {"MMR_PASSWORD_B64": b64encode(mmr_pass),
1388                                "UUID": str(uuid.uuid4()),
1389                                "LDAPTIME": timestring(int(time.time()))} )
1390
1391
1392
1393         mapping = "schema-map-openldap-2.3"
1394         backend_schema = "backend-schema.schema"
1395
1396         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1397         if ldap_backend_port is not None:
1398             server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
1399         else:
1400             server_port_string = ""
1401
1402         slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
1403
1404         ldapuser = "--username=samba-admin"
1405
1406             
1407     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
1408             
1409     os.system(schema_command)
1410
1411     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ldap_backend_type)
1412     message("Server Role:         %s" % serverrole)
1413     message("Hostname:            %s" % names.hostname)
1414     message("DNS Domain:          %s" % names.dnsdomain)
1415     message("Base DN:             %s" % names.domaindn)
1416
1417     if ldap_backend_type == "openldap":
1418         message("LDAP admin user:     samba-admin")
1419     else:
1420         message("LDAP admin DN:       %s" % names.ldapmanagerdn)
1421
1422     message("LDAP admin password: %s" % adminpass)
1423     message(slapdcommand)
1424     assert isinstance(ldap_backend_type, str)
1425     assert isinstance(ldapuser, str)
1426     assert isinstance(adminpass, str)
1427     assert isinstance(names.dnsdomain, str)
1428     assert isinstance(names.domain, str)
1429     assert isinstance(serverrole, str)
1430     args = ["--ldap-backend=ldapi",
1431             "--ldap-backend-type=" + ldap_backend_type,
1432             "--password=" + adminpass,
1433             ldapuser,
1434             "--realm=" + names.dnsdomain,
1435             "--domain=" + names.domain,
1436             "--server-role='" + serverrole + "'"]
1437     message("Run provision with: " + " ".join(args))
1438
1439
1440 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1441     """Create a PHP LDAP admin configuration file.
1442
1443     :param path: Path to write the configuration to.
1444     :param setup_path: Function to generate setup paths.
1445     """
1446     setup_file(setup_path("phpldapadmin-config.php"), path, 
1447             {"S4_LDAPI_URI": ldapi_uri})
1448
1449
1450 def create_zone_file(path, setup_path, dnsdomain, domaindn, 
1451                      hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
1452     """Write out a DNS zone file, from the info in the current database.
1453
1454     :param path: Path of the new zone file.
1455     :param setup_path: Setup path function.
1456     :param dnsdomain: DNS Domain name
1457     :param domaindn: DN of the Domain
1458     :param hostip: Local IPv4 IP
1459     :param hostip6: Local IPv6 IP
1460     :param hostname: Local hostname
1461     :param dnspass: Password for DNS
1462     :param realm: Realm name
1463     :param domainguid: GUID of the domain.
1464     :param hostguid: GUID of the host.
1465     """
1466     assert isinstance(domainguid, str)
1467
1468     if hostip6 is not None:
1469         hostip6_base_line = "            IN AAAA    " + hostip6
1470         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1471     else:
1472         hostip6_base_line = ""
1473         hostip6_host_line = ""
1474
1475     if hostip is not None:
1476         hostip_base_line = "            IN A    " + hostip
1477         hostip_host_line = hostname + "        IN A    " + hostip
1478     else:
1479         hostip_base_line = ""
1480         hostip_host_line = ""
1481
1482     setup_file(setup_path("provision.zone"), path, {
1483             "DNSPASS_B64": b64encode(dnspass),
1484             "HOSTNAME": hostname,
1485             "DNSDOMAIN": dnsdomain,
1486             "REALM": realm,
1487             "HOSTIP_BASE_LINE": hostip_base_line,
1488             "HOSTIP_HOST_LINE": hostip_host_line,
1489             "DOMAINGUID": domainguid,
1490             "DATESTRING": time.strftime("%Y%m%d%H"),
1491             "DEFAULTSITE": DEFAULTSITE,
1492             "HOSTGUID": hostguid,
1493             "HOSTIP6_BASE_LINE": hostip6_base_line,
1494             "HOSTIP6_HOST_LINE": hostip6_host_line,
1495         })
1496
1497
1498 def create_named_conf(path, setup_path, realm, dnsdomain,
1499                       private_dir):
1500     """Write out a file containing zone statements suitable for inclusion in a
1501     named.conf file (including GSS-TSIG configuration).
1502     
1503     :param path: Path of the new named.conf file.
1504     :param setup_path: Setup path function.
1505     :param realm: Realm name
1506     :param dnsdomain: DNS Domain name
1507     :param private_dir: Path to private directory
1508     :param keytab_name: File name of DNS keytab file
1509     """
1510
1511     setup_file(setup_path("named.conf"), path, {
1512             "DNSDOMAIN": dnsdomain,
1513             "REALM": realm,
1514             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
1515             "PRIVATE_DIR": private_dir
1516             })
1517
1518 def create_named_txt(path, setup_path, realm, dnsdomain,
1519                       private_dir, keytab_name):
1520     """Write out a file containing zone statements suitable for inclusion in a
1521     named.conf file (including GSS-TSIG configuration).
1522     
1523     :param path: Path of the new named.conf file.
1524     :param setup_path: Setup path function.
1525     :param realm: Realm name
1526     :param dnsdomain: DNS Domain name
1527     :param private_dir: Path to private directory
1528     :param keytab_name: File name of DNS keytab file
1529     """
1530
1531     setup_file(setup_path("named.txt"), path, {
1532             "DNSDOMAIN": dnsdomain,
1533             "REALM": realm,
1534             "DNS_KEYTAB": keytab_name,
1535             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
1536             "PRIVATE_DIR": private_dir
1537         })
1538
1539 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
1540     """Write out a file containing zone statements suitable for inclusion in a
1541     named.conf file (including GSS-TSIG configuration).
1542     
1543     :param path: Path of the new named.conf file.
1544     :param setup_path: Setup path function.
1545     :param dnsdomain: DNS Domain name
1546     :param hostname: Local hostname
1547     :param realm: Realm name
1548     """
1549
1550     setup_file(setup_path("krb5.conf"), path, {
1551             "DNSDOMAIN": dnsdomain,
1552             "HOSTNAME": hostname,
1553             "REALM": realm,
1554         })
1555
1556
1557 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename,
1558                 serverdn, servername):
1559     """Load schema for the SamDB.
1560     
1561     :param samdb: Load a schema into a SamDB.
1562     :param setup_path: Setup path function.
1563     :param schemadn: DN of the schema
1564     :param netbiosname: NetBIOS name of the host.
1565     :param configdn: DN of the configuration
1566     :param serverdn: DN of the server
1567     :param servername: Host name of the server
1568     """
1569     schema_data = open(setup_path("schema.ldif"), 'r').read()
1570     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1571     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1572     check_all_substituted(schema_data)
1573     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1574     prefixmap = b64encode(prefixmap)
1575
1576     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1577     head_data = substitute_var(head_data, {
1578                     "SCHEMADN": schemadn,
1579                     "NETBIOSNAME": netbiosname,
1580                     "CONFIGDN": configdn,
1581                     "DEFAULTSITE": sitename,
1582                     "PREFIXMAP_B64": prefixmap,
1583                     "SERVERDN": serverdn,
1584                     "SERVERNAME": servername,
1585     })
1586     check_all_substituted(head_data)
1587     samdb.attach_schema_from_ldif(head_data, schema_data)
1588