2ede4b8d3d3bd4b5f2e25e989ccc7bfd32e0836a
[samba.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 from base64 import b64encode
26 import os
27 import pwd
28 import grp
29 import time
30 import uuid, misc
31 from socket import gethostname, gethostbyname
32 import param
33 import registry
34 import samba
35 from auth import system_session
36 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
37 from samba.samdb import SamDB
38 import security
39 import urllib
40 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
41         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
42
43 """Functions for setting up a Samba configuration."""
44
45 DEFAULTSITE = "Default-First-Site-Name"
46
47 class InvalidNetbiosName(Exception):
48     def __init__(self, name):
49         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
50
51
52 class ProvisionPaths:
53     def __init__(self):
54         self.shareconf = None
55         self.hklm = None
56         self.hkcu = None
57         self.hkcr = None
58         self.hku = None
59         self.hkpd = None
60         self.hkpt = None
61         self.samdb = None
62         self.idmapdb = None
63         self.secrets = None
64         self.keytab = None
65         self.dns_keytab = None
66         self.dns = None
67         self.winsdb = None
68         self.private_dir = None
69         self.ldapdir = None
70         self.slapdconf = None
71         self.modulesconf = None
72         self.memberofconf = None
73         self.fedoradsinf = None
74         self.fedoradspartitions = None
75  
76 class ProvisionNames:
77     def __init__(self):
78         self.rootdn = None
79         self.domaindn = None
80         self.configdn = None
81         self.schemadn = None
82         self.ldapmanagerdn = None
83         self.dnsdomain = None
84         self.realm = None
85         self.netbiosname = None
86         self.domain = None
87         self.hostname = None
88         self.sitename = None
89     
90 class ProvisionResult:
91     def __init__(self):
92         self.paths = None
93         self.domaindn = None
94         self.lp = None
95         self.samdb = None
96
97 def check_install(lp, session_info, credentials):
98     """Check whether the current install seems ok.
99     
100     :param lp: Loadparm context
101     :param session_info: Session information
102     :param credentials: Credentials
103     """
104     if lp.get("realm") == "":
105         raise Error("Realm empty")
106     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
107             credentials=credentials, lp=lp)
108     if len(ldb.search("(cn=Administrator)")) != 1:
109         raise "No administrator account found"
110
111
112 def findnss(nssfn, names):
113     """Find a user or group from a list of possibilities.
114     
115     :param nssfn: NSS Function to try (should raise KeyError if not found)
116     :param names: Names to check.
117     :return: Value return by first names list.
118     """
119     for name in names:
120         try:
121             return nssfn(name)
122         except KeyError:
123             pass
124     raise KeyError("Unable to find user/group %r" % names)
125
126
127 def open_ldb(session_info, credentials, lp, dbname):
128     """Open a LDB, thrashing it if it is corrupt.
129
130     :param session_info: auth session information
131     :param credentials: credentials
132     :param lp: Loadparm context
133     :param dbname: Path of the database to open.
134     :return: a Ldb object
135     """
136     assert session_info is not None
137     try:
138         return Ldb(dbname, session_info=session_info, credentials=credentials, 
139                    lp=lp)
140     except LdbError, e:
141         print e
142         os.unlink(dbname)
143         return Ldb(dbname, session_info=session_info, credentials=credentials,
144                    lp=lp)
145
146
147 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
148     """Setup a ldb in the private dir.
149     
150     :param ldb: LDB file to import data into
151     :param ldif_path: Path of the LDIF file to load
152     :param subst_vars: Optional variables to subsitute in LDIF.
153     """
154     assert isinstance(ldif_path, str)
155
156     data = open(ldif_path, 'r').read()
157     if subst_vars is not None:
158         data = substitute_var(data, subst_vars)
159
160     check_all_substituted(data)
161
162     ldb.add_ldif(data)
163
164
165 def setup_modify_ldif(ldb, ldif_path, substvars=None):
166     """Modify a ldb in the private dir.
167     
168     :param ldb: LDB object.
169     :param ldif_path: LDIF file path.
170     :param substvars: Optional dictionary with substitution variables.
171     """
172     data = open(ldif_path, 'r').read()
173     if substvars is not None:
174         data = substitute_var(data, substvars)
175
176     check_all_substituted(data)
177
178     ldb.modify_ldif(data)
179
180
181 def setup_ldb(ldb, ldif_path, subst_vars):
182     """Import a LDIF a file into a LDB handle, optionally substituting variables.
183
184     :note: Either all LDIF data will be added or none (using transactions).
185
186     :param ldb: LDB file to import into.
187     :param ldif_path: Path to the LDIF file.
188     :param subst_vars: Dictionary with substitution variables.
189     """
190     assert ldb is not None
191     ldb.transaction_start()
192     try:
193         setup_add_ldif(ldb, ldif_path, subst_vars)
194     except:
195         ldb.transaction_cancel()
196         raise
197     ldb.transaction_commit()
198
199
200 def setup_file(template, fname, substvars):
201     """Setup a file in the private dir.
202
203     :param template: Path of the template file.
204     :param fname: Path of the file to create.
205     :param substvars: Substitution variables.
206     """
207     f = fname
208
209     if os.path.exists(f):
210         os.unlink(f)
211
212     data = open(template, 'r').read()
213     if substvars:
214         data = substitute_var(data, substvars)
215     check_all_substituted(data)
216
217     open(f, 'w').write(data)
218
219
220 def provision_paths_from_lp(lp, dnsdomain):
221     """Set the default paths for provisioning.
222
223     :param lp: Loadparm context.
224     :param dnsdomain: DNS Domain name
225     """
226     paths = ProvisionPaths()
227     paths.private_dir = lp.get("private dir")
228     paths.keytab = "secrets.keytab"
229     paths.dns_keytab = "dns.keytab"
230
231     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
232     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
233     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
234     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
235     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
236     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
237     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
238     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
239     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
240                                             "phpldapadmin-config.php")
241     paths.ldapdir = os.path.join(paths.private_dir, 
242                                  "ldap")
243     paths.slapdconf = os.path.join(paths.ldapdir, 
244                                    "slapd.conf")
245     paths.modulesconf = os.path.join(paths.ldapdir, 
246                                      "modules.conf")
247     paths.memberofconf = os.path.join(paths.ldapdir, 
248                                       "memberof.conf")
249     paths.fedoradsinf = os.path.join(paths.ldapdir, 
250                                    "fedorads.inf")
251     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
252                                             "fedorads-partitions.ldif")
253     paths.hklm = "hklm.ldb"
254     paths.hkcr = "hkcr.ldb"
255     paths.hkcu = "hkcu.ldb"
256     paths.hku = "hku.ldb"
257     paths.hkpd = "hkpd.ldb"
258     paths.hkpt = "hkpt.ldb"
259
260     paths.sysvol = lp.get("path", "sysvol")
261
262     paths.netlogon = lp.get("path", "netlogon")
263
264     return paths
265
266 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
267               rootdn=None, domaindn=None, configdn=None, schemadn=None, sitename=None):
268
269     if hostname is None:
270         hostname = gethostname().split(".")[0].lower()
271
272     netbiosname = hostname.upper()
273     if not valid_netbios_name(netbiosname):
274         raise InvalidNetbiosName(netbiosname)
275
276     hostname = hostname.lower()
277
278     if dnsdomain is None:
279         dnsdomain = lp.get("realm")
280
281     if serverrole is None:
282         serverrole = lp.get("server role")
283
284     assert dnsdomain is not None
285     realm = dnsdomain.upper()
286
287     if lp.get("realm").upper() != realm:
288         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
289                         (lp.get("realm"), smbconf, realm))
290     
291     dnsdomain = dnsdomain.lower()
292
293     if (serverrole == "domain controller"):
294         if domain is None:
295             domain = lp.get("workgroup")
296         if domaindn is None:
297             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
298         if lp.get("workgroup").upper() != domain.upper():
299             raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
300                         lp.get("workgroup"), domain)
301     else:
302         domain = netbiosname
303         if domaindn is None:
304             domaindn = "CN=" + netbiosname
305         
306     assert domain is not None
307     domain = domain.upper()
308     if not valid_netbios_name(domain):
309         raise InvalidNetbiosName(domain)
310         
311     if rootdn is None:
312        rootdn = domaindn
313        
314     if configdn is None:
315         configdn = "CN=Configuration," + rootdn
316     if schemadn is None:
317         schemadn = "CN=Schema," + configdn
318
319     if sitename is None:
320         sitename=DEFAULTSITE
321
322     names = ProvisionNames()
323     names.rootdn = rootdn
324     names.domaindn = domaindn
325     names.configdn = configdn
326     names.schemadn = schemadn
327     names.ldapmanagerdn = "CN=Manager," + rootdn
328     names.dnsdomain = dnsdomain
329     names.domain = domain
330     names.realm = realm
331     names.netbiosname = netbiosname
332     names.hostname = hostname
333     names.sitename = sitename
334     
335     return names
336     
337
338 def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir):
339     if targetdir is not None:
340         if not os.path.exists(targetdir):
341             os.mkdir(targetdir)
342         if not os.path.exists(os.path.join(targetdir, "etc")):
343            os.mkdir(os.path.join(targetdir, "etc"))
344
345         smbconf = os.path.join(targetdir, "etc", "smb.conf")
346
347     # only install a new smb.conf if there isn't one there already
348
349     if not os.path.exists(smbconf):
350         if hostname is None:
351             hostname = gethostname().split(".")[0].lower()
352
353         if serverrole is None:
354             serverrole = "standalone"
355
356         assert serverrole in ("domain controller", "member server", "standalone")
357         if serverrole == "domain controller":
358             smbconfsuffix = "dc"
359         elif serverrole == "member server":
360             smbconfsuffix = "member"
361         elif serverrole == "standalone":
362             smbconfsuffix = "standalone"
363
364         assert domain is not None
365         assert realm is not None
366
367         default_lp = param.LoadParm()
368         #Load non-existant file
369         default_lp.load(smbconf)
370         
371         if targetdir is not None:
372             privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
373             lockdir_line = "lock dir = " + os.path.abspath(targetdir)
374
375             default_lp.set("lock dir", os.path.abspath(targetdir))
376             
377         sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
378         netlogon = os.path.join(sysvol, realm.lower(), "scripts")
379
380         setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
381                    smbconf, {
382                 "HOSTNAME": hostname,
383                 "DOMAIN": domain,
384                 "REALM": realm,
385                 "SERVERROLE": serverrole,
386                 "NETLOGONPATH": netlogon,
387                 "SYSVOLPATH": sysvol,
388                 "PRIVATEDIR_LINE": privatedir_line,
389                 "LOCKDIR_LINE": lockdir_line
390                 })
391
392     lp = param.LoadParm()
393     lp.load(smbconf)
394
395     return lp
396
397 def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
398                         wheel, backup):
399     """setup reasonable name mappings for sam names to unix names.
400     
401     :param ldb: SamDB object.
402     :param sid: The domain sid.
403     :param domaindn: The domain DN.
404     :param root: Name of the UNIX root user.
405     :param nobody: Name of the UNIX nobody user.
406     :param nogroup: Name of the unix nobody group.
407     :param users: Name of the unix users group.
408     :param wheel: Name of the wheel group (users that can become root).
409     :param backup: Name of the backup group."""
410     # add some foreign sids if they are not present already
411     ldb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
412     ldb.add_foreign(domaindn, "S-1-1-0", "World")
413     ldb.add_foreign(domaindn, "S-1-5-2", "Network")
414     ldb.add_foreign(domaindn, "S-1-5-18", "System")
415     ldb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
416
417     # some well known sids
418     ldb.setup_name_mapping(domaindn, "S-1-5-7", nobody)
419     ldb.setup_name_mapping(domaindn, "S-1-1-0", nogroup)
420     ldb.setup_name_mapping(domaindn, "S-1-5-2", nogroup)
421     ldb.setup_name_mapping(domaindn, "S-1-5-18", root)
422     ldb.setup_name_mapping(domaindn, "S-1-5-11", users)
423     ldb.setup_name_mapping(domaindn, "S-1-5-32-544", wheel)
424     ldb.setup_name_mapping(domaindn, "S-1-5-32-545", users)
425     ldb.setup_name_mapping(domaindn, "S-1-5-32-546", nogroup)
426     ldb.setup_name_mapping(domaindn, "S-1-5-32-551", backup)
427
428     # and some well known domain rids
429     ldb.setup_name_mapping(domaindn, sid + "-500", root)
430     ldb.setup_name_mapping(domaindn, sid + "-518", wheel)
431     ldb.setup_name_mapping(domaindn, sid + "-519", wheel)
432     ldb.setup_name_mapping(domaindn, sid + "-512", wheel)
433     ldb.setup_name_mapping(domaindn, sid + "-513", users)
434     ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
435
436
437 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
438                            credentials, names,
439                            serverrole, ldap_backend=None, 
440                            ldap_backend_type=None, erase=False):
441     """Setup the partitions for the SAM database. 
442     
443     Alternatively, provision() may call this, and then populate the database.
444     
445     :note: This will wipe the Sam Database!
446     
447     :note: This function always removes the local SAM LDB file. The erase 
448         parameter controls whether to erase the existing data, which 
449         may not be stored locally but in LDAP.
450     """
451     assert session_info is not None
452
453     samdb = SamDB(samdb_path, session_info=session_info, 
454                   credentials=credentials, lp=lp)
455
456     # Wipes the database
457     try:
458         samdb.erase()
459     except:
460         os.unlink(samdb_path)
461
462     samdb = SamDB(samdb_path, session_info=session_info, 
463                   credentials=credentials, lp=lp)
464
465     #Add modules to the list to activate them by default
466     #beware often order is important
467     #
468     # Some Known ordering constraints:
469     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
470     # - objectclass must be before password_hash, because password_hash checks
471     #   that the objectclass is of type person (filled in by objectclass
472     #   module when expanding the objectclass list)
473     # - partition must be last
474     # - each partition has its own module list then
475     modules_list = ["rootdse",
476                     "paged_results",
477                     "ranged_results",
478                     "anr",
479                     "server_sort",
480                     "extended_dn",
481                     "asq",
482                     "rdn_name",
483                     "objectclass",
484                     "samldb",
485                     "kludge_acl",
486                     "operational"]
487     tdb_modules_list = [
488                     "subtree_rename",
489                     "subtree_delete",
490                     "linked_attributes"]
491     modules_list2 = ["show_deleted",
492                     "partition"]
493  
494     domaindn_ldb = "users.ldb"
495     if ldap_backend is not None:
496         domaindn_ldb = ldap_backend
497     configdn_ldb = "configuration.ldb"
498     if ldap_backend is not None:
499         configdn_ldb = ldap_backend
500     schemadn_ldb = "schema.ldb"
501     if ldap_backend is not None:
502         schema_ldb = ldap_backend
503         schemadn_ldb = ldap_backend
504         
505     if ldap_backend_type == "fedora-ds":
506         backend_modules = ["nsuniqueid", "paged_searches"]
507         # We can handle linked attributes here, as we don't have directory-side subtree operations
508         tdb_modules_list = ["linked_attributes"]
509     elif ldap_backend_type == "openldap":
510         backend_modules = ["normalise", "entryuuid", "paged_searches"]
511         # OpenLDAP handles subtree renames, so we don't want to do any of these things
512         tdb_modules_list = None
513     elif serverrole == "domain controller":
514         backend_modules = ["repl_meta_data"]
515     else:
516         backend_modules = ["objectguid"]
517
518     if tdb_modules_list is None:
519         tdb_modules_list_as_string = ""
520     else:
521         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
522         
523     samdb.transaction_start()
524     try:
525         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
526                 "SCHEMADN": names.schemadn, 
527                 "SCHEMADN_LDB": schemadn_ldb,
528                 "SCHEMADN_MOD2": ",objectguid",
529                 "CONFIGDN": names.configdn,
530                 "CONFIGDN_LDB": configdn_ldb,
531                 "DOMAINDN": names.domaindn,
532                 "DOMAINDN_LDB": domaindn_ldb,
533                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
534                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
535                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
536                 "MODULES_LIST": ",".join(modules_list),
537                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
538                 "MODULES_LIST2": ",".join(modules_list2),
539                 "BACKEND_MOD": ",".join(backend_modules),
540         })
541
542     except:
543         samdb.transaction_cancel()
544         raise
545
546     samdb.transaction_commit()
547     
548     samdb = SamDB(samdb_path, session_info=session_info, 
549                   credentials=credentials, lp=lp)
550
551     samdb.transaction_start()
552     try:
553         message("Setting up sam.ldb attributes")
554         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
555
556         message("Setting up sam.ldb rootDSE")
557         setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn, names.hostname, 
558                             names.dnsdomain, names.realm, names.rootdn, names.configdn, names.netbiosname,
559                             names.sitename)
560
561         if erase:
562             message("Erasing data from partitions")
563             samdb.erase_partitions()
564
565     except:
566         samdb.transaction_cancel()
567         raise
568
569     samdb.transaction_commit()
570     
571     return samdb
572
573
574 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
575                         netbiosname, domainsid, keytab_path, samdb_url, 
576                         dns_keytab_path, dnspass, machinepass):
577     """Add DC-specific bits to a secrets database.
578     
579     :param secretsdb: Ldb Handle to the secrets database
580     :param setup_path: Setup path function
581     :param machinepass: Machine password
582     """
583     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
584             "MACHINEPASS_B64": b64encode(machinepass),
585             "DOMAIN": domain,
586             "REALM": realm,
587             "DNSDOMAIN": dnsdomain,
588             "DOMAINSID": str(domainsid),
589             "SECRETS_KEYTAB": keytab_path,
590             "NETBIOSNAME": netbiosname,
591             "SAM_LDB": samdb_url,
592             "DNS_KEYTAB": dns_keytab_path,
593             "DNSPASS_B64": b64encode(dnspass),
594             })
595
596
597 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
598     """Setup the secrets database.
599
600     :param path: Path to the secrets database.
601     :param setup_path: Get the path to a setup file.
602     :param session_info: Session info.
603     :param credentials: Credentials
604     :param lp: Loadparm context
605     :return: LDB handle for the created secrets database
606     """
607     if os.path.exists(path):
608         os.unlink(path)
609     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
610                       lp=lp)
611     secrets_ldb.erase()
612     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
613     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
614                       lp=lp)
615     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
616     return secrets_ldb
617
618
619 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
620     """Setup the templates database.
621
622     :param path: Path to the database.
623     :param setup_path: Function for obtaining the path to setup files.
624     :param session_info: Session info
625     :param credentials: Credentials
626     :param lp: Loadparm context
627     """
628     templates_ldb = SamDB(path, session_info=session_info,
629                           credentials=credentials, lp=lp)
630     templates_ldb.erase()
631     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
632
633
634 def setup_registry(path, setup_path, session_info, credentials, lp):
635     """Setup the registry.
636     
637     :param path: Path to the registry database
638     :param setup_path: Function that returns the path to a setup.
639     :param session_info: Session information
640     :param credentials: Credentials
641     :param lp: Loadparm context
642     """
643     reg = registry.Registry()
644     hive = registry.open_ldb(path, session_info=session_info, 
645                          credentials=credentials, lp_ctx=lp)
646     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
647     provision_reg = setup_path("provision.reg")
648     assert os.path.exists(provision_reg)
649     reg.diff_apply(provision_reg)
650
651 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
652     """Setup the idmap database.
653
654     :param path: path to the idmap database
655     :param setup_path: Function that returns a path to a setup file
656     :param session_info: Session information
657     :param credentials: Credentials
658     :param lp: Loadparm context
659     """
660     if os.path.exists(path):
661         os.unlink(path)
662
663     idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
664                     lp=lp)
665
666     idmap_ldb.erase()
667     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
668     return idmap_ldb
669
670 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
671                         dnsdomain, realm, rootdn, configdn, netbiosname,
672                         sitename):
673     """Setup the SamDB rootdse.
674
675     :param samdb: Sam Database handle
676     :param setup_path: Obtain setup path
677     """
678     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
679         "SCHEMADN": schemadn, 
680         "NETBIOSNAME": netbiosname,
681         "DNSDOMAIN": dnsdomain,
682         "DEFAULTSITE": sitename,
683         "REALM": realm,
684         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
685         "DOMAINDN": domaindn,
686         "ROOTDN": rootdn,
687         "CONFIGDN": configdn,
688         "VERSION": samba.version(),
689         })
690         
691
692 def setup_self_join(samdb, names,
693                     machinepass, dnspass, 
694                     domainsid, invocationid, setup_path,
695                     policyguid, hostguid=None):
696     """Join a host to its own domain."""
697     if hostguid is not None:
698         hostguid_add = "objectGUID: %s" % hostguid
699     else:
700         hostguid_add = ""
701
702     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
703               "CONFIGDN": names.configdn, 
704               "SCHEMADN": names.schemadn,
705               "DOMAINDN": names.domaindn,
706               "INVOCATIONID": invocationid,
707               "NETBIOSNAME": names.netbiosname,
708               "DEFAULTSITE": names.sitename,
709               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
710               "MACHINEPASS_B64": b64encode(machinepass),
711               "DNSPASS_B64": b64encode(dnspass),
712               "REALM": names.realm,
713               "DOMAIN": names.domain,
714               "HOSTGUID_ADD": hostguid_add,
715               "DNSDOMAIN": names.dnsdomain})
716     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
717               "POLICYGUID": policyguid,
718               "DNSDOMAIN": names.dnsdomain,
719               "DOMAINSID": str(domainsid),
720               "DOMAINDN": names.domaindn})
721
722
723 def setup_samdb(path, setup_path, session_info, credentials, lp, 
724                 names, message, 
725                 domainsid, aci, domainguid, policyguid, 
726                 fill, adminpass, krbtgtpass, 
727                 machinepass, hostguid, invocationid, dnspass,
728                 serverrole, ldap_backend=None, 
729                 ldap_backend_type=None):
730     """Setup a complete SAM Database.
731     
732     :note: This will wipe the main SAM database file!
733     """
734
735     erase = (fill != FILL_DRS)
736
737     # Also wipes the database
738     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
739                            credentials=credentials, session_info=session_info,
740                            names=names, 
741                            ldap_backend=ldap_backend, serverrole=serverrole,
742                            ldap_backend_type=ldap_backend_type, erase=erase)
743
744     samdb = SamDB(path, session_info=session_info, 
745                   credentials=credentials, lp=lp)
746
747     if fill == FILL_DRS:
748        # We want to finish here, but setup the index before we do so
749         message("Setting up sam.ldb index")
750         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
751         return samdb
752
753     message("Pre-loading the Samba 4 and AD schema")
754     samdb = SamDB(path, session_info=session_info, 
755                   credentials=credentials, lp=lp)
756     samdb.set_domain_sid(domainsid)
757     if serverrole == "domain controller":
758         samdb.set_invocation_id(invocationid)
759
760     load_schema(setup_path, samdb, names.schemadn, names.netbiosname, names.configdn, names.sitename)
761
762     samdb.transaction_start()
763         
764     try:
765         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
766         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
767             "DOMAINDN": names.domaindn,
768             "ACI": aci,
769             })
770
771         message("Modifying DomainDN: " + names.domaindn + "")
772         if domainguid is not None:
773             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
774         else:
775             domainguid_mod = ""
776
777         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
778             "LDAPTIME": timestring(int(time.time())),
779             "DOMAINSID": str(domainsid),
780             "SCHEMADN": names.schemadn, 
781             "NETBIOSNAME": names.netbiosname,
782             "DEFAULTSITE": names.sitename,
783             "CONFIGDN": names.configdn,
784             "POLICYGUID": policyguid,
785             "DOMAINDN": names.domaindn,
786             "DOMAINGUID_MOD": domainguid_mod,
787             })
788
789         message("Adding configuration container (permitted to fail)")
790         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
791             "CONFIGDN": names.configdn, 
792             "ACI": aci,
793             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
794             })
795         message("Modifying configuration container")
796         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
797             "CONFIGDN": names.configdn, 
798             "SCHEMADN": names.schemadn,
799             })
800
801         message("Adding schema container (permitted to fail)")
802         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
803             "SCHEMADN": names.schemadn,
804             "ACI": aci,
805             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
806             })
807         message("Modifying schema container")
808         setup_modify_ldif(samdb, 
809             setup_path("provision_schema_basedn_modify.ldif"), {
810             "SCHEMADN": names.schemadn,
811             "NETBIOSNAME": names.netbiosname,
812             "DEFAULTSITE": names.sitename,
813             "CONFIGDN": names.configdn,
814             })
815
816         message("Setting up sam.ldb Samba4 schema")
817         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
818                        {"SCHEMADN": names.schemadn })
819         message("Setting up sam.ldb AD schema")
820         setup_add_ldif(samdb, setup_path("schema.ldif"), 
821                        {"SCHEMADN": names.schemadn})
822
823         message("Setting up sam.ldb configuration data")
824         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
825             "CONFIGDN": names.configdn,
826             "NETBIOSNAME": names.netbiosname,
827             "DEFAULTSITE": names.sitename,
828             "DNSDOMAIN": names.dnsdomain,
829             "DOMAIN": names.domain,
830             "SCHEMADN": names.schemadn,
831             "DOMAINDN": names.domaindn,
832             })
833
834         message("Setting up display specifiers")
835         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
836                        {"CONFIGDN": names.configdn})
837
838         message("Adding users container (permitted to fail)")
839         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
840                 "DOMAINDN": names.domaindn})
841         message("Modifying users container")
842         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
843                 "DOMAINDN": names.domaindn})
844         message("Adding computers container (permitted to fail)")
845         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
846                 "DOMAINDN": names.domaindn})
847         message("Modifying computers container")
848         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
849                 "DOMAINDN": names.domaindn})
850         message("Setting up sam.ldb data")
851         setup_add_ldif(samdb, setup_path("provision.ldif"), {
852             "DOMAINDN": names.domaindn,
853             "NETBIOSNAME": names.netbiosname,
854             "DEFAULTSITE": names.sitename,
855             "CONFIGDN": names.configdn,
856             })
857
858         if fill == FILL_FULL:
859             message("Setting up sam.ldb users and groups")
860             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
861                 "DOMAINDN": names.domaindn,
862                 "DOMAINSID": str(domainsid),
863                 "CONFIGDN": names.configdn,
864                 "ADMINPASS_B64": b64encode(adminpass),
865                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
866                 })
867
868             if serverrole == "domain controller":
869                 message("Setting up self join")
870                 setup_self_join(samdb, names=names, invocationid=invocationid, 
871                                 dnspass=dnspass,  
872                                 machinepass=machinepass, 
873                                 domainsid=domainsid, policyguid=policyguid,
874                                 hostguid=hostguid, 
875                                 setup_path=setup_path)
876
877     #We want to setup the index last, as adds are faster unindexed
878         message("Setting up sam.ldb index")
879         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
880     except:
881         samdb.transaction_cancel()
882         raise
883
884     samdb.transaction_commit()
885     return samdb
886
887
888 FILL_FULL = "FULL"
889 FILL_NT4SYNC = "NT4SYNC"
890 FILL_DRS = "DRS"
891
892 def provision(setup_dir, message, session_info, 
893               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
894               rootdn=None, domaindn=None, schemadn=None, configdn=None,
895               domain=None, hostname=None, hostip=None, domainsid=None, 
896               hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
897               policyguid=None, invocationid=None, machinepass=None, 
898               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
899               wheel=None, backup=None, aci=None, serverrole=None, 
900               ldap_backend=None, ldap_backend_type=None, sitename=None):
901     """Provision samba4
902     
903     :note: caution, this wipes all existing data!
904     """
905
906     def setup_path(file):
907         return os.path.join(setup_dir, file)
908
909     if domainsid is None:
910         domainsid = security.random_sid()
911     else:
912         domainsid = security.Sid(domainsid)
913
914     if policyguid is None:
915         policyguid = uuid.random()
916     if adminpass is None:
917         adminpass = misc.random_password(12)
918     if krbtgtpass is None:
919         krbtgtpass = misc.random_password(12)
920     if machinepass is None:
921         machinepass  = misc.random_password(12)
922     if dnspass is None:
923         dnspass = misc.random_password(12)
924     if root is None:
925         root = findnss(pwd.getpwnam, ["root"])[0]
926     if nobody is None:
927         nobody = findnss(pwd.getpwnam, ["nobody"])[0]
928     if nogroup is None:
929         nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
930     if users is None:
931         users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
932                         "usr"])[0]
933     if wheel is None:
934         wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
935     if backup is None:
936         backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
937     if aci is None:
938         aci = "# no aci for local ldb"
939
940     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
941
942     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
943                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
944                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
945
946     paths = provision_paths_from_lp(lp, names.dnsdomain)
947
948     if hostip is None:
949         hostip = gethostbyname(names.hostname)
950
951     if serverrole is None:
952         serverrole = lp.get("server role")
953
954     assert serverrole in ("domain controller", "member server", "standalone")
955     if invocationid is None and serverrole == "domain controller":
956         invocationid = uuid.random()
957
958     if not os.path.exists(paths.private_dir):
959         os.mkdir(paths.private_dir)
960
961     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
962     
963     if ldap_backend is not None:
964         if ldap_backend == "ldapi":
965             # provision-backend will set this path suggested slapd command line / fedorads.inf
966             ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
967              
968     message("set DOMAIN SID: %s" % str(domainsid))
969     message("Provisioning for %s in realm %s" % (names.domain, realm))
970     message("Using administrator password: %s" % adminpass)
971
972     # only install a new shares config db if there is none
973     if not os.path.exists(paths.shareconf):
974         message("Setting up share.ldb")
975         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
976                         credentials=credentials, lp=lp)
977         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
978
979      
980     message("Setting up secrets.ldb")
981     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
982                                   session_info=session_info, 
983                                   credentials=credentials, lp=lp)
984
985     message("Setting up the registry")
986     setup_registry(paths.hklm, setup_path, session_info, 
987                    credentials=credentials, lp=lp)
988
989     message("Setting up templates db")
990     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
991                       credentials=credentials, lp=lp)
992
993     message("Setting up idmap db")
994     setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
995                   credentials=credentials, lp=lp)
996
997     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
998                         credentials=credentials, lp=lp, names=names,
999                         message=message, 
1000                         domainsid=domainsid, 
1001                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
1002                         fill=samdb_fill, 
1003                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1004                         hostguid=hostguid, invocationid=invocationid, 
1005                         machinepass=machinepass, dnspass=dnspass,
1006                         serverrole=serverrole, ldap_backend=ldap_backend, 
1007                         ldap_backend_type=ldap_backend_type)
1008
1009     if lp.get("server role") == "domain controller":
1010        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
1011                                   "{" + policyguid + "}")
1012        os.makedirs(policy_path, 0755)
1013        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1014        os.makedirs(os.path.join(policy_path, "User"), 0755)
1015        if not os.path.isdir(paths.netlogon):
1016             os.makedirs(paths.netlogon, 0755)
1017        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
1018                          credentials=credentials, lp=lp)
1019        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1020                            netbiosname=names.netbiosname, domainsid=domainsid, 
1021                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
1022                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
1023                            machinepass=machinepass, dnsdomain=names.dnsdomain)
1024
1025     if samdb_fill == FILL_FULL:
1026         setup_name_mappings(samdb, str(domainsid), names.domaindn, root=root, 
1027                             nobody=nobody, nogroup=nogroup, wheel=wheel, 
1028                             users=users, backup=backup)
1029    
1030         message("Setting up sam.ldb rootDSE marking as synchronized")
1031         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1032
1033         # Only make a zone file on the first DC, it should be replicated with DNS replication
1034         if serverrole == "domain controller":
1035             samdb = SamDB(paths.samdb, session_info=session_info, 
1036                       credentials=credentials, lp=lp)
1037
1038             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1039             assert isinstance(domainguid, str)
1040             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1041                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1042                                        scope=SCOPE_SUBTREE)
1043             assert isinstance(hostguid, str)
1044             
1045             message("Setting up DNS zone: %s" % names.dnsdomain)
1046             create_zone_file(paths.dns, setup_path, samdb, 
1047                              hostname=names.hostname, hostip=hostip, dnsdomain=names.dnsdomain,
1048                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
1049                              domainguid=domainguid, hostguid=hostguid)
1050             message("Please install the zone located in %s into your DNS server" % paths.dns)
1051             
1052     message("Setting up phpLDAPadmin configuration")
1053     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1054                                ldapi_url)
1055
1056     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1057
1058     result = ProvisionResult()
1059     result.domaindn = domaindn
1060     result.paths = paths
1061     result.lp = lp
1062     result.samdb = samdb
1063     return result
1064
1065 def provision_become_dc(setup_dir=None,
1066                         smbconf=None, targetdir=None, realm=None, 
1067                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1068                         domain=None, hostname=None, domainsid=None, 
1069                         hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
1070                         policyguid=None, invocationid=None, machinepass=None, 
1071                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
1072                         wheel=None, backup=None, aci=None, serverrole=None, 
1073                         ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
1074
1075     def message(text):
1076         """print a message if quiet is not set."""
1077         print text
1078
1079     provision(setup_dir, message, system_session(), None,
1080               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
1081               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, 
1082               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
1083     
1084
1085 def setup_db_config(setup_path, file, dbdir):
1086     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1087         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
1088     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1089         os.makedirs(os.path.join(dbdir, "tmp"), 0700);
1090     
1091     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1092                {"LDAPDBDIR": dbdir})
1093     
1094
1095
1096 def provision_backend(setup_dir=None, message=None,
1097                       smbconf=None, targetdir=None, realm=None, 
1098                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1099                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
1100                       ldap_backend_type=None):
1101
1102     def setup_path(file):
1103         return os.path.join(setup_dir, file)
1104
1105     if hostname is None:
1106         hostname = gethostname().split(".")[0].lower()
1107
1108     if root is None:
1109         root = findnss(pwd.getpwnam, ["root"])[0]
1110
1111     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
1112
1113     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
1114                         dnsdomain=realm, serverrole=serverrole, 
1115                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
1116
1117     paths = provision_paths_from_lp(lp, names.dnsdomain)
1118
1119     if not os.path.isdir(paths.ldapdir):
1120         os.makedirs(paths.ldapdir)
1121     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1122     try:
1123         os.unlink(schemadb_path)
1124     except:
1125         pass
1126
1127     schemadb = Ldb(schemadb_path, lp=lp)
1128  
1129     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
1130                    {"SCHEMADN": names.schemadn,
1131                     "ACI": "#",
1132                     "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
1133                     })
1134     setup_modify_ldif(schemadb, 
1135                       setup_path("provision_schema_basedn_modify.ldif"), \
1136                           {"SCHEMADN": names.schemadn,
1137                            "NETBIOSNAME": names.netbiosname,
1138                            "DEFAULTSITE": DEFAULTSITE,
1139                            "CONFIGDN": names.configdn,
1140                            })
1141     
1142     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
1143                    {"SCHEMADN": names.schemadn })
1144     setup_add_ldif(schemadb, setup_path("schema.ldif"), 
1145                    {"SCHEMADN": names.schemadn})
1146
1147     if ldap_backend_type == "fedora-ds":
1148         setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf, 
1149                    {"ROOT": root,
1150                     "HOSTNAME": hostname,
1151                     "DNSDOMAIN": names.dnsdomain,
1152                     "LDAPDIR": paths.ldapdir,
1153                     "DOMAINDN": names.domaindn,
1154                     "LDAPMANAGERDN": names.ldapmanagerdn,
1155                     "LDAPMANAGERPASS": adminpass, 
1156                     "SERVERPORT": ""})
1157         
1158         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
1159                    {"CONFIGDN": names.configdn,
1160                     "SCHEMADN": names.schemadn,
1161                     })
1162         
1163         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
1164                    {"CONFIGDN": names.configdn,
1165                     "SCHEMADN": names.schemadn,
1166                     })
1167         mapping = "schema-map-fedora-ds-1.0"
1168         backend_schema = "99_ad.ldif"
1169     elif ldap_backend_type == "openldap":
1170         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1171                    {"DNSDOMAIN": names.dnsdomain,
1172                     "LDAPDIR": paths.ldapdir,
1173                     "DOMAINDN": names.domaindn,
1174                     "CONFIGDN": names.configdn,
1175                     "SCHEMADN": names.schemadn,
1176                     "LDAPMANAGERDN": names.ldapmanagerdn,
1177                     "LDAPMANAGERPASS": adminpass})
1178         setup_file(setup_path("modules.conf"), paths.modulesconf,
1179                    {"REALM": names.realm})
1180         
1181         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
1182         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
1183         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
1184         mapping = "schema-map-openldap-2.3"
1185         backend_schema = "backend-schema.schema"
1186         
1187         attrs = ["linkID", "lDAPDisplayName"]
1188         res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
1189
1190         memberof_config = "# This is a generated file, do not edit!\n";
1191         refint_attributes = "";
1192         for i in range (0, len(res)):
1193             linkid = res[i]["linkID"][0]
1194             linkid = str(int(linkid) + 1)
1195             target = schemadb.searchone(basedn=names.schemadn, 
1196                                         expression="(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))", 
1197                                         attribute="lDAPDisplayName");
1198             if target is not None:
1199                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"];
1200                 memberof_config = memberof_config + """overlay memberof
1201 memberof-dangling error
1202 memberof-refint TRUE
1203 memberof-group-oc top
1204 memberof-member-ad """ + res[i]["lDAPDisplayName"] + """
1205 memberof-memberof-ad """ + target + """
1206 memberof-dangling-error 32
1207
1208 """;
1209
1210         memberof_config = memberof_config + """
1211 overlay refint
1212 refint_attributes""" + refint_attributes + "\n";
1213         
1214         if os.path.exists(paths.memberofconf):
1215             os.unlink(paths.memberof.conf)
1216
1217             open(paths.memberofconf, 'w').write(memberof_config)
1218
1219         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1220         message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
1221                 
1222
1223     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
1224
1225     os.system(schema_command)
1226
1227
1228
1229 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1230     """Create a PHP LDAP admin configuration file.
1231
1232     :param path: Path to write the configuration to.
1233     :param setup_path: Function to generate setup paths.
1234     """
1235     setup_file(setup_path("phpldapadmin-config.php"), path, 
1236             {"S4_LDAPI_URI": ldapi_uri})
1237
1238
1239 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
1240                   hostip, hostname, dnspass, realm, domainguid, hostguid):
1241     """Write out a DNS zone file, from the info in the current database.
1242     
1243     :param path: Path of the new file.
1244     :param setup_path": Setup path function.
1245     :param samdb: SamDB object
1246     :param dnsdomain: DNS Domain name
1247     :param domaindn: DN of the Domain
1248     :param hostip: Local IP
1249     :param hostname: Local hostname
1250     :param dnspass: Password for DNS
1251     :param realm: Realm name
1252     :param domainguid: GUID of the domain.
1253     :param hostguid: GUID of the host.
1254     """
1255     assert isinstance(domainguid, str)
1256
1257     setup_file(setup_path("provision.zone"), path, {
1258             "DNSPASS_B64": b64encode(dnspass),
1259             "HOSTNAME": hostname,
1260             "DNSDOMAIN": dnsdomain,
1261             "REALM": realm,
1262             "HOSTIP": hostip,
1263             "DOMAINGUID": domainguid,
1264             "DATESTRING": time.strftime("%Y%m%d%H"),
1265             "DEFAULTSITE": DEFAULTSITE,
1266             "HOSTGUID": hostguid,
1267         })
1268
1269 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
1270     """Load schema for the SamDB.
1271     
1272     :param samdb: Load a schema into a SamDB.
1273     :param setup_path: Setup path function.
1274     :param schemadn: DN of the schema
1275     :param netbiosname: NetBIOS name of the host.
1276     :param configdn: DN of the configuration
1277     """
1278     schema_data = open(setup_path("schema.ldif"), 'r').read()
1279     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1280     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1281     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1282     head_data = substitute_var(head_data, {
1283                     "SCHEMADN": schemadn,
1284                     "NETBIOSNAME": netbiosname,
1285                     "CONFIGDN": configdn,
1286                     "DEFAULTSITE":sitename 
1287     })
1288     samdb.attach_schema_from_ldif(head_data, schema_data)
1289