Remove references to setting the host GUID, as the repl_meta_data
[samba.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 from base64 import b64encode
26 import os
27 import pwd
28 import grp
29 import time
30 import uuid, misc
31 from socket import gethostname, gethostbyname
32 import param
33 import registry
34 import samba
35 from auth import system_session
36 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
37 from samba.samdb import SamDB
38 import security
39 import urllib
40 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
41         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
42
43 """Functions for setting up a Samba configuration."""
44
45 DEFAULTSITE = "Default-First-Site-Name"
46
47 class InvalidNetbiosName(Exception):
48     def __init__(self, name):
49         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
50
51
52 class ProvisionPaths:
53     def __init__(self):
54         self.shareconf = None
55         self.hklm = None
56         self.hkcu = None
57         self.hkcr = None
58         self.hku = None
59         self.hkpd = None
60         self.hkpt = None
61         self.samdb = None
62         self.idmapdb = None
63         self.secrets = None
64         self.keytab = None
65         self.dns_keytab = None
66         self.dns = None
67         self.winsdb = None
68         self.private_dir = None
69         self.ldapdir = None
70         self.slapdconf = None
71         self.modulesconf = None
72         self.memberofconf = None
73         self.fedoradsinf = None
74         self.fedoradspartitions = None
75  
76 class ProvisionNames:
77     def __init__(self):
78         self.rootdn = None
79         self.domaindn = None
80         self.configdn = None
81         self.schemadn = None
82         self.ldapmanagerdn = None
83         self.dnsdomain = None
84         self.realm = None
85         self.netbiosname = None
86         self.domain = None
87         self.hostname = None
88         self.sitename = None
89     
90 class ProvisionResult:
91     def __init__(self):
92         self.paths = None
93         self.domaindn = None
94         self.lp = None
95         self.samdb = None
96
97 def check_install(lp, session_info, credentials):
98     """Check whether the current install seems ok.
99     
100     :param lp: Loadparm context
101     :param session_info: Session information
102     :param credentials: Credentials
103     """
104     if lp.get("realm") == "":
105         raise Error("Realm empty")
106     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
107             credentials=credentials, lp=lp)
108     if len(ldb.search("(cn=Administrator)")) != 1:
109         raise "No administrator account found"
110
111
112 def findnss(nssfn, names):
113     """Find a user or group from a list of possibilities.
114     
115     :param nssfn: NSS Function to try (should raise KeyError if not found)
116     :param names: Names to check.
117     :return: Value return by first names list.
118     """
119     for name in names:
120         try:
121             return nssfn(name)
122         except KeyError:
123             pass
124     raise KeyError("Unable to find user/group %r" % names)
125
126
127 def open_ldb(session_info, credentials, lp, dbname):
128     """Open a LDB, thrashing it if it is corrupt.
129
130     :param session_info: auth session information
131     :param credentials: credentials
132     :param lp: Loadparm context
133     :param dbname: Path of the database to open.
134     :return: a Ldb object
135     """
136     assert session_info is not None
137     try:
138         return Ldb(dbname, session_info=session_info, credentials=credentials, 
139                    lp=lp)
140     except LdbError, e:
141         print e
142         os.unlink(dbname)
143         return Ldb(dbname, session_info=session_info, credentials=credentials,
144                    lp=lp)
145
146
147 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
148     """Setup a ldb in the private dir.
149     
150     :param ldb: LDB file to import data into
151     :param ldif_path: Path of the LDIF file to load
152     :param subst_vars: Optional variables to subsitute in LDIF.
153     """
154     assert isinstance(ldif_path, str)
155
156     data = open(ldif_path, 'r').read()
157     if subst_vars is not None:
158         data = substitute_var(data, subst_vars)
159
160     check_all_substituted(data)
161
162     ldb.add_ldif(data)
163
164
165 def setup_modify_ldif(ldb, ldif_path, substvars=None):
166     """Modify a ldb in the private dir.
167     
168     :param ldb: LDB object.
169     :param ldif_path: LDIF file path.
170     :param substvars: Optional dictionary with substitution variables.
171     """
172     data = open(ldif_path, 'r').read()
173     if substvars is not None:
174         data = substitute_var(data, substvars)
175
176     check_all_substituted(data)
177
178     ldb.modify_ldif(data)
179
180
181 def setup_ldb(ldb, ldif_path, subst_vars):
182     """Import a LDIF a file into a LDB handle, optionally substituting variables.
183
184     :note: Either all LDIF data will be added or none (using transactions).
185
186     :param ldb: LDB file to import into.
187     :param ldif_path: Path to the LDIF file.
188     :param subst_vars: Dictionary with substitution variables.
189     """
190     assert ldb is not None
191     ldb.transaction_start()
192     try:
193         setup_add_ldif(ldb, ldif_path, subst_vars)
194     except:
195         ldb.transaction_cancel()
196         raise
197     ldb.transaction_commit()
198
199
200 def setup_file(template, fname, substvars):
201     """Setup a file in the private dir.
202
203     :param template: Path of the template file.
204     :param fname: Path of the file to create.
205     :param substvars: Substitution variables.
206     """
207     f = fname
208
209     if os.path.exists(f):
210         os.unlink(f)
211
212     data = open(template, 'r').read()
213     if substvars:
214         data = substitute_var(data, substvars)
215     check_all_substituted(data)
216
217     open(f, 'w').write(data)
218
219
220 def provision_paths_from_lp(lp, dnsdomain):
221     """Set the default paths for provisioning.
222
223     :param lp: Loadparm context.
224     :param dnsdomain: DNS Domain name
225     """
226     paths = ProvisionPaths()
227     paths.private_dir = lp.get("private dir")
228     paths.keytab = "secrets.keytab"
229     paths.dns_keytab = "dns.keytab"
230
231     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
232     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
233     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
234     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
235     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
236     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
237     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
238     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
239     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
240                                             "phpldapadmin-config.php")
241     paths.ldapdir = os.path.join(paths.private_dir, 
242                                  "ldap")
243     paths.slapdconf = os.path.join(paths.ldapdir, 
244                                    "slapd.conf")
245     paths.modulesconf = os.path.join(paths.ldapdir, 
246                                      "modules.conf")
247     paths.memberofconf = os.path.join(paths.ldapdir, 
248                                       "memberof.conf")
249     paths.fedoradsinf = os.path.join(paths.ldapdir, 
250                                    "fedorads.inf")
251     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
252                                             "fedorads-partitions.ldif")
253     paths.hklm = "hklm.ldb"
254     paths.hkcr = "hkcr.ldb"
255     paths.hkcu = "hkcu.ldb"
256     paths.hku = "hku.ldb"
257     paths.hkpd = "hkpd.ldb"
258     paths.hkpt = "hkpt.ldb"
259
260     paths.sysvol = lp.get("path", "sysvol")
261
262     paths.netlogon = lp.get("path", "netlogon")
263
264     return paths
265
266 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
267               rootdn=None, domaindn=None, configdn=None, schemadn=None, sitename=None):
268
269     if hostname is None:
270         hostname = gethostname().split(".")[0].lower()
271
272     netbiosname = hostname.upper()
273     if not valid_netbios_name(netbiosname):
274         raise InvalidNetbiosName(netbiosname)
275
276     hostname = hostname.lower()
277
278     if dnsdomain is None:
279         dnsdomain = lp.get("realm")
280
281     if serverrole is None:
282         serverrole = lp.get("server role")
283
284     assert dnsdomain is not None
285     realm = dnsdomain.upper()
286
287     if lp.get("realm").upper() != realm:
288         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
289                         (lp.get("realm"), smbconf, realm))
290     
291     dnsdomain = dnsdomain.lower()
292
293     if (serverrole == "domain controller"):
294         if domain is None:
295             domain = lp.get("workgroup")
296         if domaindn is None:
297             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
298         if lp.get("workgroup").upper() != domain.upper():
299             raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
300                         lp.get("workgroup"), domain)
301     else:
302         domain = netbiosname
303         if domaindn is None:
304             domaindn = "CN=" + netbiosname
305         
306     assert domain is not None
307     domain = domain.upper()
308     if not valid_netbios_name(domain):
309         raise InvalidNetbiosName(domain)
310         
311     if rootdn is None:
312        rootdn = domaindn
313        
314     if configdn is None:
315         configdn = "CN=Configuration," + rootdn
316     if schemadn is None:
317         schemadn = "CN=Schema," + configdn
318
319     if sitename is None:
320         sitename=DEFAULTSITE
321
322     names = ProvisionNames()
323     names.rootdn = rootdn
324     names.domaindn = domaindn
325     names.configdn = configdn
326     names.schemadn = schemadn
327     names.ldapmanagerdn = "CN=Manager," + rootdn
328     names.dnsdomain = dnsdomain
329     names.domain = domain
330     names.realm = realm
331     names.netbiosname = netbiosname
332     names.hostname = hostname
333     names.sitename = sitename
334     
335     return names
336     
337
338 def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir):
339     if targetdir is not None:
340         if not os.path.exists(targetdir):
341             os.mkdir(targetdir)
342         if not os.path.exists(os.path.join(targetdir, "etc")):
343            os.mkdir(os.path.join(targetdir, "etc"))
344
345         smbconf = os.path.join(targetdir, "etc", "smb.conf")
346
347     # only install a new smb.conf if there isn't one there already
348
349     if not os.path.exists(smbconf):
350         if hostname is None:
351             hostname = gethostname().split(".")[0].lower()
352
353         if serverrole is None:
354             serverrole = "standalone"
355
356         assert serverrole in ("domain controller", "member server", "standalone")
357         if serverrole == "domain controller":
358             smbconfsuffix = "dc"
359         elif serverrole == "member server":
360             smbconfsuffix = "member"
361         elif serverrole == "standalone":
362             smbconfsuffix = "standalone"
363
364         assert domain is not None
365         assert realm is not None
366
367         default_lp = param.LoadParm()
368         #Load non-existant file
369         default_lp.load(smbconf)
370         
371         if targetdir is not None:
372             privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
373             lockdir_line = "lock dir = " + os.path.abspath(targetdir)
374
375             default_lp.set("lock dir", os.path.abspath(targetdir))
376         else:
377             privatedir_line = ""
378             lockdir_line = ""
379
380         sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
381         netlogon = os.path.join(sysvol, realm.lower(), "scripts")
382
383         setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
384                    smbconf, {
385                 "HOSTNAME": hostname,
386                 "DOMAIN": domain,
387                 "REALM": realm,
388                 "SERVERROLE": serverrole,
389                 "NETLOGONPATH": netlogon,
390                 "SYSVOLPATH": sysvol,
391                 "PRIVATEDIR_LINE": privatedir_line,
392                 "LOCKDIR_LINE": lockdir_line
393                 })
394
395     lp = param.LoadParm()
396     lp.load(smbconf)
397
398     return lp
399
400 def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
401                         wheel, backup):
402     """setup reasonable name mappings for sam names to unix names.
403     
404     :param ldb: SamDB object.
405     :param sid: The domain sid.
406     :param domaindn: The domain DN.
407     :param root: Name of the UNIX root user.
408     :param nobody: Name of the UNIX nobody user.
409     :param nogroup: Name of the unix nobody group.
410     :param users: Name of the unix users group.
411     :param wheel: Name of the wheel group (users that can become root).
412     :param backup: Name of the backup group."""
413     # add some foreign sids if they are not present already
414     ldb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
415     ldb.add_foreign(domaindn, "S-1-1-0", "World")
416     ldb.add_foreign(domaindn, "S-1-5-2", "Network")
417     ldb.add_foreign(domaindn, "S-1-5-18", "System")
418     ldb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
419
420     # some well known sids
421     ldb.setup_name_mapping(domaindn, "S-1-5-7", nobody)
422     ldb.setup_name_mapping(domaindn, "S-1-1-0", nogroup)
423     ldb.setup_name_mapping(domaindn, "S-1-5-2", nogroup)
424     ldb.setup_name_mapping(domaindn, "S-1-5-18", root)
425     ldb.setup_name_mapping(domaindn, "S-1-5-11", users)
426     ldb.setup_name_mapping(domaindn, "S-1-5-32-544", wheel)
427     ldb.setup_name_mapping(domaindn, "S-1-5-32-545", users)
428     ldb.setup_name_mapping(domaindn, "S-1-5-32-546", nogroup)
429     ldb.setup_name_mapping(domaindn, "S-1-5-32-551", backup)
430
431     # and some well known domain rids
432     ldb.setup_name_mapping(domaindn, sid + "-500", root)
433     ldb.setup_name_mapping(domaindn, sid + "-518", wheel)
434     ldb.setup_name_mapping(domaindn, sid + "-519", wheel)
435     ldb.setup_name_mapping(domaindn, sid + "-512", wheel)
436     ldb.setup_name_mapping(domaindn, sid + "-513", users)
437     ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
438
439
440 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
441                            credentials, names,
442                            serverrole, ldap_backend=None, 
443                            ldap_backend_type=None, erase=False):
444     """Setup the partitions for the SAM database. 
445     
446     Alternatively, provision() may call this, and then populate the database.
447     
448     :note: This will wipe the Sam Database!
449     
450     :note: This function always removes the local SAM LDB file. The erase 
451         parameter controls whether to erase the existing data, which 
452         may not be stored locally but in LDAP.
453     """
454     assert session_info is not None
455
456     samdb = SamDB(samdb_path, session_info=session_info, 
457                   credentials=credentials, lp=lp)
458
459     # Wipes the database
460     try:
461         samdb.erase()
462     except:
463         os.unlink(samdb_path)
464
465     samdb = SamDB(samdb_path, session_info=session_info, 
466                   credentials=credentials, lp=lp)
467
468     #Add modules to the list to activate them by default
469     #beware often order is important
470     #
471     # Some Known ordering constraints:
472     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
473     # - objectclass must be before password_hash, because password_hash checks
474     #   that the objectclass is of type person (filled in by objectclass
475     #   module when expanding the objectclass list)
476     # - partition must be last
477     # - each partition has its own module list then
478     modules_list = ["rootdse",
479                     "paged_results",
480                     "ranged_results",
481                     "anr",
482                     "server_sort",
483                     "extended_dn",
484                     "asq",
485                     "rdn_name",
486                     "objectclass",
487                     "samldb",
488                     "kludge_acl",
489                     "operational"]
490     tdb_modules_list = [
491                     "subtree_rename",
492                     "subtree_delete",
493                     "linked_attributes"]
494     modules_list2 = ["show_deleted",
495                     "partition"]
496  
497     domaindn_ldb = "users.ldb"
498     if ldap_backend is not None:
499         domaindn_ldb = ldap_backend
500     configdn_ldb = "configuration.ldb"
501     if ldap_backend is not None:
502         configdn_ldb = ldap_backend
503     schemadn_ldb = "schema.ldb"
504     if ldap_backend is not None:
505         schema_ldb = ldap_backend
506         schemadn_ldb = ldap_backend
507         
508     if ldap_backend_type == "fedora-ds":
509         backend_modules = ["nsuniqueid", "paged_searches"]
510         # We can handle linked attributes here, as we don't have directory-side subtree operations
511         tdb_modules_list = ["linked_attributes"]
512     elif ldap_backend_type == "openldap":
513         backend_modules = ["normalise", "entryuuid", "paged_searches"]
514         # OpenLDAP handles subtree renames, so we don't want to do any of these things
515         tdb_modules_list = None
516     elif serverrole == "domain controller":
517         backend_modules = ["repl_meta_data"]
518     else:
519         backend_modules = ["objectguid"]
520
521     if tdb_modules_list is None:
522         tdb_modules_list_as_string = ""
523     else:
524         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
525         
526     samdb.transaction_start()
527     try:
528         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
529                 "SCHEMADN": names.schemadn, 
530                 "SCHEMADN_LDB": schemadn_ldb,
531                 "SCHEMADN_MOD2": ",objectguid",
532                 "CONFIGDN": names.configdn,
533                 "CONFIGDN_LDB": configdn_ldb,
534                 "DOMAINDN": names.domaindn,
535                 "DOMAINDN_LDB": domaindn_ldb,
536                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
537                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
538                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
539                 "MODULES_LIST": ",".join(modules_list),
540                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
541                 "MODULES_LIST2": ",".join(modules_list2),
542                 "BACKEND_MOD": ",".join(backend_modules),
543         })
544
545     except:
546         samdb.transaction_cancel()
547         raise
548
549     samdb.transaction_commit()
550     
551     samdb = SamDB(samdb_path, session_info=session_info, 
552                   credentials=credentials, lp=lp)
553
554     samdb.transaction_start()
555     try:
556         message("Setting up sam.ldb attributes")
557         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
558
559         message("Setting up sam.ldb rootDSE")
560         setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn, names.hostname, 
561                             names.dnsdomain, names.realm, names.rootdn, names.configdn, names.netbiosname,
562                             names.sitename)
563
564         if erase:
565             message("Erasing data from partitions")
566             samdb.erase_partitions()
567
568     except:
569         samdb.transaction_cancel()
570         raise
571
572     samdb.transaction_commit()
573     
574     return samdb
575
576
577 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
578                         netbiosname, domainsid, keytab_path, samdb_url, 
579                         dns_keytab_path, dnspass, machinepass):
580     """Add DC-specific bits to a secrets database.
581     
582     :param secretsdb: Ldb Handle to the secrets database
583     :param setup_path: Setup path function
584     :param machinepass: Machine password
585     """
586     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
587             "MACHINEPASS_B64": b64encode(machinepass),
588             "DOMAIN": domain,
589             "REALM": realm,
590             "DNSDOMAIN": dnsdomain,
591             "DOMAINSID": str(domainsid),
592             "SECRETS_KEYTAB": keytab_path,
593             "NETBIOSNAME": netbiosname,
594             "SAM_LDB": samdb_url,
595             "DNS_KEYTAB": dns_keytab_path,
596             "DNSPASS_B64": b64encode(dnspass),
597             })
598
599
600 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
601     """Setup the secrets database.
602
603     :param path: Path to the secrets database.
604     :param setup_path: Get the path to a setup file.
605     :param session_info: Session info.
606     :param credentials: Credentials
607     :param lp: Loadparm context
608     :return: LDB handle for the created secrets database
609     """
610     if os.path.exists(path):
611         os.unlink(path)
612     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
613                       lp=lp)
614     secrets_ldb.erase()
615     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
616     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
617                       lp=lp)
618     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
619     return secrets_ldb
620
621
622 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
623     """Setup the templates database.
624
625     :param path: Path to the database.
626     :param setup_path: Function for obtaining the path to setup files.
627     :param session_info: Session info
628     :param credentials: Credentials
629     :param lp: Loadparm context
630     """
631     templates_ldb = SamDB(path, session_info=session_info,
632                           credentials=credentials, lp=lp)
633     templates_ldb.erase()
634     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
635
636
637 def setup_registry(path, setup_path, session_info, credentials, lp):
638     """Setup the registry.
639     
640     :param path: Path to the registry database
641     :param setup_path: Function that returns the path to a setup.
642     :param session_info: Session information
643     :param credentials: Credentials
644     :param lp: Loadparm context
645     """
646     reg = registry.Registry()
647     hive = registry.open_ldb(path, session_info=session_info, 
648                          credentials=credentials, lp_ctx=lp)
649     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
650     provision_reg = setup_path("provision.reg")
651     assert os.path.exists(provision_reg)
652     reg.diff_apply(provision_reg)
653
654 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
655     """Setup the idmap database.
656
657     :param path: path to the idmap database
658     :param setup_path: Function that returns a path to a setup file
659     :param session_info: Session information
660     :param credentials: Credentials
661     :param lp: Loadparm context
662     """
663     if os.path.exists(path):
664         os.unlink(path)
665
666     idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
667                     lp=lp)
668
669     idmap_ldb.erase()
670     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
671     return idmap_ldb
672
673 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
674                         dnsdomain, realm, rootdn, configdn, netbiosname,
675                         sitename):
676     """Setup the SamDB rootdse.
677
678     :param samdb: Sam Database handle
679     :param setup_path: Obtain setup path
680     """
681     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
682         "SCHEMADN": schemadn, 
683         "NETBIOSNAME": netbiosname,
684         "DNSDOMAIN": dnsdomain,
685         "DEFAULTSITE": sitename,
686         "REALM": realm,
687         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
688         "DOMAINDN": domaindn,
689         "ROOTDN": rootdn,
690         "CONFIGDN": configdn,
691         "VERSION": samba.version(),
692         })
693         
694
695 def setup_self_join(samdb, names,
696                     machinepass, dnspass, 
697                     domainsid, invocationid, setup_path,
698                     policyguid):
699     """Join a host to its own domain."""
700     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
701               "CONFIGDN": names.configdn, 
702               "SCHEMADN": names.schemadn,
703               "DOMAINDN": names.domaindn,
704               "INVOCATIONID": invocationid,
705               "NETBIOSNAME": names.netbiosname,
706               "DEFAULTSITE": names.sitename,
707               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
708               "MACHINEPASS_B64": b64encode(machinepass),
709               "DNSPASS_B64": b64encode(dnspass),
710               "REALM": names.realm,
711               "DOMAIN": names.domain,
712               "DNSDOMAIN": names.dnsdomain})
713     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
714               "POLICYGUID": policyguid,
715               "DNSDOMAIN": names.dnsdomain,
716               "DOMAINSID": str(domainsid),
717               "DOMAINDN": names.domaindn})
718
719
720 def setup_samdb(path, setup_path, session_info, credentials, lp, 
721                 names, message, 
722                 domainsid, aci, domainguid, policyguid, 
723                 fill, adminpass, krbtgtpass, 
724                 machinepass, invocationid, dnspass,
725                 serverrole, ldap_backend=None, 
726                 ldap_backend_type=None):
727     """Setup a complete SAM Database.
728     
729     :note: This will wipe the main SAM database file!
730     """
731
732     erase = (fill != FILL_DRS)
733
734     # Also wipes the database
735     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
736                            credentials=credentials, session_info=session_info,
737                            names=names, 
738                            ldap_backend=ldap_backend, serverrole=serverrole,
739                            ldap_backend_type=ldap_backend_type, erase=erase)
740
741     samdb = SamDB(path, session_info=session_info, 
742                   credentials=credentials, lp=lp)
743
744     if fill == FILL_DRS:
745        # We want to finish here, but setup the index before we do so
746         message("Setting up sam.ldb index")
747         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
748         return samdb
749
750     message("Pre-loading the Samba 4 and AD schema")
751     samdb = SamDB(path, session_info=session_info, 
752                   credentials=credentials, lp=lp)
753     samdb.set_domain_sid(domainsid)
754     if serverrole == "domain controller":
755         samdb.set_invocation_id(invocationid)
756
757     load_schema(setup_path, samdb, names.schemadn, names.netbiosname, names.configdn, names.sitename)
758
759     samdb.transaction_start()
760         
761     try:
762         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
763         if serverrole == "domain controller":
764             domain_oc = "domainDNS"
765         else:
766             domain_oc = "samba4LocalDomain"
767
768         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
769             "DOMAINDN": names.domaindn,
770             "ACI": aci,
771             "DOMAIN_OC": domain_oc
772             })
773
774         message("Modifying DomainDN: " + names.domaindn + "")
775         if domainguid is not None:
776             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
777         else:
778             domainguid_mod = ""
779
780         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
781             "LDAPTIME": timestring(int(time.time())),
782             "DOMAINSID": str(domainsid),
783             "SCHEMADN": names.schemadn, 
784             "NETBIOSNAME": names.netbiosname,
785             "DEFAULTSITE": names.sitename,
786             "CONFIGDN": names.configdn,
787             "POLICYGUID": policyguid,
788             "DOMAINDN": names.domaindn,
789             "DOMAINGUID_MOD": domainguid_mod,
790             })
791
792         message("Adding configuration container (permitted to fail)")
793         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
794             "CONFIGDN": names.configdn, 
795             "ACI": aci,
796             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
797             })
798         message("Modifying configuration container")
799         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
800             "CONFIGDN": names.configdn, 
801             "SCHEMADN": names.schemadn,
802             })
803
804         message("Adding schema container (permitted to fail)")
805         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
806             "SCHEMADN": names.schemadn,
807             "ACI": aci,
808             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
809             })
810         message("Modifying schema container")
811         setup_modify_ldif(samdb, 
812             setup_path("provision_schema_basedn_modify.ldif"), {
813             "SCHEMADN": names.schemadn,
814             "NETBIOSNAME": names.netbiosname,
815             "DEFAULTSITE": names.sitename,
816             "CONFIGDN": names.configdn,
817             })
818
819         message("Setting up sam.ldb Samba4 schema")
820         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
821                        {"SCHEMADN": names.schemadn })
822         message("Setting up sam.ldb AD schema")
823         setup_add_ldif(samdb, setup_path("schema.ldif"), 
824                        {"SCHEMADN": names.schemadn})
825
826         message("Setting up sam.ldb configuration data")
827         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
828             "CONFIGDN": names.configdn,
829             "NETBIOSNAME": names.netbiosname,
830             "DEFAULTSITE": names.sitename,
831             "DNSDOMAIN": names.dnsdomain,
832             "DOMAIN": names.domain,
833             "SCHEMADN": names.schemadn,
834             "DOMAINDN": names.domaindn,
835             })
836
837         message("Setting up display specifiers")
838         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
839                        {"CONFIGDN": names.configdn})
840
841         message("Adding users container (permitted to fail)")
842         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
843                 "DOMAINDN": names.domaindn})
844         message("Modifying users container")
845         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
846                 "DOMAINDN": names.domaindn})
847         message("Adding computers container (permitted to fail)")
848         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
849                 "DOMAINDN": names.domaindn})
850         message("Modifying computers container")
851         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
852                 "DOMAINDN": names.domaindn})
853         message("Setting up sam.ldb data")
854         setup_add_ldif(samdb, setup_path("provision.ldif"), {
855             "DOMAINDN": names.domaindn,
856             "NETBIOSNAME": names.netbiosname,
857             "DEFAULTSITE": names.sitename,
858             "CONFIGDN": names.configdn,
859             })
860
861         if fill == FILL_FULL:
862             message("Setting up sam.ldb users and groups")
863             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
864                 "DOMAINDN": names.domaindn,
865                 "DOMAINSID": str(domainsid),
866                 "CONFIGDN": names.configdn,
867                 "ADMINPASS_B64": b64encode(adminpass),
868                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
869                 })
870
871             if serverrole == "domain controller":
872                 message("Setting up self join")
873                 setup_self_join(samdb, names=names, invocationid=invocationid, 
874                                 dnspass=dnspass,  
875                                 machinepass=machinepass, 
876                                 domainsid=domainsid, policyguid=policyguid,
877                                 setup_path=setup_path)
878
879     #We want to setup the index last, as adds are faster unindexed
880         message("Setting up sam.ldb index")
881         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
882     except:
883         samdb.transaction_cancel()
884         raise
885
886     samdb.transaction_commit()
887     return samdb
888
889
890 FILL_FULL = "FULL"
891 FILL_NT4SYNC = "NT4SYNC"
892 FILL_DRS = "DRS"
893
894 def provision(setup_dir, message, session_info, 
895               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
896               rootdn=None, domaindn=None, schemadn=None, configdn=None,
897               domain=None, hostname=None, hostip=None, domainsid=None, 
898               adminpass=None, krbtgtpass=None, domainguid=None, 
899               policyguid=None, invocationid=None, machinepass=None, 
900               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
901               wheel=None, backup=None, aci=None, serverrole=None, 
902               ldap_backend=None, ldap_backend_type=None, sitename=None):
903     """Provision samba4
904     
905     :note: caution, this wipes all existing data!
906     """
907
908     def setup_path(file):
909         return os.path.join(setup_dir, file)
910
911     if domainsid is None:
912         domainsid = security.random_sid()
913     else:
914         domainsid = security.Sid(domainsid)
915
916     if policyguid is None:
917         policyguid = uuid.random()
918     if adminpass is None:
919         adminpass = misc.random_password(12)
920     if krbtgtpass is None:
921         krbtgtpass = misc.random_password(12)
922     if machinepass is None:
923         machinepass  = misc.random_password(12)
924     if dnspass is None:
925         dnspass = misc.random_password(12)
926     if root is None:
927         root = findnss(pwd.getpwnam, ["root"])[0]
928     if nobody is None:
929         nobody = findnss(pwd.getpwnam, ["nobody"])[0]
930     if nogroup is None:
931         nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
932     if users is None:
933         users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
934                         "usr"])[0]
935     if wheel is None:
936         wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
937     if backup is None:
938         backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
939     if aci is None:
940         aci = "# no aci for local ldb"
941
942     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
943
944     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
945                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
946                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
947
948     paths = provision_paths_from_lp(lp, names.dnsdomain)
949
950     if hostip is None:
951         hostip = gethostbyname(names.hostname)
952
953     if serverrole is None:
954         serverrole = lp.get("server role")
955
956     assert serverrole in ("domain controller", "member server", "standalone")
957     if invocationid is None and serverrole == "domain controller":
958         invocationid = uuid.random()
959
960     if not os.path.exists(paths.private_dir):
961         os.mkdir(paths.private_dir)
962
963     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
964     
965     if ldap_backend is not None:
966         if ldap_backend == "ldapi":
967             # provision-backend will set this path suggested slapd command line / fedorads.inf
968             ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
969              
970     # only install a new shares config db if there is none
971     if not os.path.exists(paths.shareconf):
972         message("Setting up share.ldb")
973         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
974                         credentials=credentials, lp=lp)
975         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
976
977      
978     message("Setting up secrets.ldb")
979     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
980                                   session_info=session_info, 
981                                   credentials=credentials, lp=lp)
982
983     message("Setting up the registry")
984     setup_registry(paths.hklm, setup_path, session_info, 
985                    credentials=credentials, lp=lp)
986
987     message("Setting up templates db")
988     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
989                       credentials=credentials, lp=lp)
990
991     message("Setting up idmap db")
992     setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
993                   credentials=credentials, lp=lp)
994
995     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
996                         credentials=credentials, lp=lp, names=names,
997                         message=message, 
998                         domainsid=domainsid, 
999                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
1000                         fill=samdb_fill, 
1001                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1002                         invocationid=invocationid, 
1003                         machinepass=machinepass, dnspass=dnspass,
1004                         serverrole=serverrole, ldap_backend=ldap_backend, 
1005                         ldap_backend_type=ldap_backend_type)
1006
1007     if lp.get("server role") == "domain controller":
1008        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
1009                                   "{" + policyguid + "}")
1010        os.makedirs(policy_path, 0755)
1011        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1012        os.makedirs(os.path.join(policy_path, "User"), 0755)
1013        if not os.path.isdir(paths.netlogon):
1014             os.makedirs(paths.netlogon, 0755)
1015        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
1016                          credentials=credentials, lp=lp)
1017        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1018                            netbiosname=names.netbiosname, domainsid=domainsid, 
1019                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
1020                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
1021                            machinepass=machinepass, dnsdomain=names.dnsdomain)
1022
1023     if samdb_fill == FILL_FULL:
1024         setup_name_mappings(samdb, str(domainsid), names.domaindn, root=root, 
1025                             nobody=nobody, nogroup=nogroup, wheel=wheel, 
1026                             users=users, backup=backup)
1027    
1028         message("Compleating sam.ldb setup by marking as synchronized")
1029         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1030
1031         # Only make a zone file on the first DC, it should be replicated with DNS replication
1032         if serverrole == "domain controller":
1033             samdb = SamDB(paths.samdb, session_info=session_info, 
1034                       credentials=credentials, lp=lp)
1035
1036             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1037             assert isinstance(domainguid, str)
1038             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1039                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1040                                        scope=SCOPE_SUBTREE)
1041             assert isinstance(hostguid, str)
1042             
1043             create_zone_file(paths.dns, setup_path, samdb, 
1044                              hostname=names.hostname, hostip=hostip, dnsdomain=names.dnsdomain,
1045                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
1046                              domainguid=domainguid, hostguid=hostguid)
1047             message("Please install the zone located in %s into your DNS server" % paths.dns)
1048             
1049     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1050                                ldapi_url)
1051
1052     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1053
1054     message("Once the above files are installed, your server will be ready to use")
1055     message("Server Type:    %s" % serverrole)
1056     message("Hostname:       %s" % names.hostname)
1057     message("NetBIOS Domain: %s" % names.domain)
1058     message("DNS Domain:     %s" % names.dnsdomain)
1059     message("DOMAIN SID:     %s" % str(domainsid))
1060     message("Admin password: %s" % adminpass)
1061
1062     result = ProvisionResult()
1063     result.domaindn = domaindn
1064     result.paths = paths
1065     result.lp = lp
1066     result.samdb = samdb
1067     return result
1068
1069 def provision_become_dc(setup_dir=None,
1070                         smbconf=None, targetdir=None, realm=None, 
1071                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1072                         domain=None, hostname=None, domainsid=None, 
1073                         adminpass=None, krbtgtpass=None, domainguid=None, 
1074                         policyguid=None, invocationid=None, machinepass=None, 
1075                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
1076                         wheel=None, backup=None, aci=None, serverrole=None, 
1077                         ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
1078
1079     def message(text):
1080         """print a message if quiet is not set."""
1081         print text
1082
1083     provision(setup_dir, message, system_session(), None,
1084               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
1085               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, 
1086               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
1087     
1088
1089 def setup_db_config(setup_path, file, dbdir):
1090     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1091         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
1092     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1093         os.makedirs(os.path.join(dbdir, "tmp"), 0700);
1094     
1095     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1096                {"LDAPDBDIR": dbdir})
1097     
1098
1099
1100 def provision_backend(setup_dir=None, message=None,
1101                       smbconf=None, targetdir=None, realm=None, 
1102                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1103                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
1104                       ldap_backend_type=None):
1105
1106     def setup_path(file):
1107         return os.path.join(setup_dir, file)
1108
1109     if hostname is None:
1110         hostname = gethostname().split(".")[0].lower()
1111
1112     if root is None:
1113         root = findnss(pwd.getpwnam, ["root"])[0]
1114
1115     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
1116
1117     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
1118                         dnsdomain=realm, serverrole=serverrole, 
1119                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
1120
1121     paths = provision_paths_from_lp(lp, names.dnsdomain)
1122
1123     if not os.path.isdir(paths.ldapdir):
1124         os.makedirs(paths.ldapdir)
1125     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1126     try:
1127         os.unlink(schemadb_path)
1128     except:
1129         pass
1130
1131     schemadb = Ldb(schemadb_path, lp=lp)
1132  
1133     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
1134                    {"SCHEMADN": names.schemadn,
1135                     "ACI": "#",
1136                     "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
1137                     })
1138     setup_modify_ldif(schemadb, 
1139                       setup_path("provision_schema_basedn_modify.ldif"), \
1140                           {"SCHEMADN": names.schemadn,
1141                            "NETBIOSNAME": names.netbiosname,
1142                            "DEFAULTSITE": DEFAULTSITE,
1143                            "CONFIGDN": names.configdn,
1144                            })
1145     
1146     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
1147                    {"SCHEMADN": names.schemadn })
1148     setup_add_ldif(schemadb, setup_path("schema.ldif"), 
1149                    {"SCHEMADN": names.schemadn})
1150
1151     if ldap_backend_type == "fedora-ds":
1152         setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf, 
1153                    {"ROOT": root,
1154                     "HOSTNAME": hostname,
1155                     "DNSDOMAIN": names.dnsdomain,
1156                     "LDAPDIR": paths.ldapdir,
1157                     "DOMAINDN": names.domaindn,
1158                     "LDAPMANAGERDN": names.ldapmanagerdn,
1159                     "LDAPMANAGERPASS": adminpass, 
1160                     "SERVERPORT": ""})
1161         
1162         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
1163                    {"CONFIGDN": names.configdn,
1164                     "SCHEMADN": names.schemadn,
1165                     })
1166         
1167         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
1168                    {"CONFIGDN": names.configdn,
1169                     "SCHEMADN": names.schemadn,
1170                     })
1171         mapping = "schema-map-fedora-ds-1.0"
1172         backend_schema = "99_ad.ldif"
1173     elif ldap_backend_type == "openldap":
1174         attrs = ["linkID", "lDAPDisplayName"]
1175         res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
1176
1177         memberof_config = "# Generated from schema in " + schemadb_path + "\n";
1178         refint_attributes = "";
1179         for i in range (0, len(res)):
1180             linkid = res[i]["linkID"][0]
1181             linkid = str(int(linkid) + 1)
1182             expression = "(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))"
1183             target = schemadb.searchone(basedn=names.schemadn, 
1184                                         expression=expression, 
1185                                         attribute="lDAPDisplayName", 
1186                                         scope=SCOPE_SUBTREE);
1187             if target is not None:
1188                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0];
1189                 memberof_config = memberof_config + """overlay memberof
1190 memberof-dangling error
1191 memberof-refint TRUE
1192 memberof-group-oc top
1193 memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
1194 memberof-memberof-ad """ + target + """
1195 memberof-dangling-error 32
1196
1197 """;
1198
1199         memberof_config = memberof_config + """
1200 overlay refint
1201 refint_attributes""" + refint_attributes + "\n";
1202         
1203         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1204                    {"DNSDOMAIN": names.dnsdomain,
1205                     "LDAPDIR": paths.ldapdir,
1206                     "DOMAINDN": names.domaindn,
1207                     "CONFIGDN": names.configdn,
1208                     "SCHEMADN": names.schemadn,
1209                     "LDAPMANAGERDN": names.ldapmanagerdn,
1210                     "LDAPMANAGERPASS": adminpass,
1211                     "MEMBEROF_CONFIG": memberof_config})
1212         setup_file(setup_path("modules.conf"), paths.modulesconf,
1213                    {"REALM": names.realm})
1214         
1215         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
1216         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
1217         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
1218         mapping = "schema-map-openldap-2.3"
1219         backend_schema = "backend-schema.schema"
1220         
1221
1222         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1223         message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
1224                 
1225
1226     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
1227
1228     os.system(schema_command)
1229
1230
1231
1232 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1233     """Create a PHP LDAP admin configuration file.
1234
1235     :param path: Path to write the configuration to.
1236     :param setup_path: Function to generate setup paths.
1237     """
1238     setup_file(setup_path("phpldapadmin-config.php"), path, 
1239             {"S4_LDAPI_URI": ldapi_uri})
1240
1241
1242 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
1243                   hostip, hostname, dnspass, realm, domainguid, hostguid):
1244     """Write out a DNS zone file, from the info in the current database.
1245     
1246     :param path: Path of the new file.
1247     :param setup_path": Setup path function.
1248     :param samdb: SamDB object
1249     :param dnsdomain: DNS Domain name
1250     :param domaindn: DN of the Domain
1251     :param hostip: Local IP
1252     :param hostname: Local hostname
1253     :param dnspass: Password for DNS
1254     :param realm: Realm name
1255     :param domainguid: GUID of the domain.
1256     :param hostguid: GUID of the host.
1257     """
1258     assert isinstance(domainguid, str)
1259
1260     setup_file(setup_path("provision.zone"), path, {
1261             "DNSPASS_B64": b64encode(dnspass),
1262             "HOSTNAME": hostname,
1263             "DNSDOMAIN": dnsdomain,
1264             "REALM": realm,
1265             "HOSTIP": hostip,
1266             "DOMAINGUID": domainguid,
1267             "DATESTRING": time.strftime("%Y%m%d%H"),
1268             "DEFAULTSITE": DEFAULTSITE,
1269             "HOSTGUID": hostguid,
1270         })
1271
1272 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
1273     """Load schema for the SamDB.
1274     
1275     :param samdb: Load a schema into a SamDB.
1276     :param setup_path: Setup path function.
1277     :param schemadn: DN of the schema
1278     :param netbiosname: NetBIOS name of the host.
1279     :param configdn: DN of the configuration
1280     """
1281     schema_data = open(setup_path("schema.ldif"), 'r').read()
1282     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1283     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1284     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1285     head_data = substitute_var(head_data, {
1286                     "SCHEMADN": schemadn,
1287                     "NETBIOSNAME": netbiosname,
1288                     "CONFIGDN": configdn,
1289                     "DEFAULTSITE":sitename 
1290     })
1291     samdb.attach_schema_from_ldif(head_data, schema_data)
1292