e3c47ff4a2c902e07be025047d56e96bbab7c075
[samba.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 from base64 import b64encode
26 import os
27 import pwd
28 import grp
29 import time
30 import uuid, misc
31 from socket import gethostname, gethostbyname
32 import param
33 import registry
34 import samba
35 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
36 from samba.samdb import SamDB
37 import security
38 import urllib
39 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
40         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
41
42 """Functions for setting up a Samba configuration."""
43
44 DEFAULTSITE = "Default-First-Site-Name"
45
46 class InvalidNetbiosName(Exception):
47     def __init__(self, name):
48         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
49
50
51 class ProvisionPaths:
52     def __init__(self):
53         self.smbconf = None
54         self.shareconf = None
55         self.hklm = None
56         self.hkcu = None
57         self.hkcr = None
58         self.hku = None
59         self.hkpd = None
60         self.hkpt = None
61         self.samdb = None
62         self.idmapdb = None
63         self.secrets = None
64         self.keytab = None
65         self.dns_keytab = None
66         self.dns = None
67         self.winsdb = None
68
69
70 def check_install(lp, session_info, credentials):
71     """Check whether the current install seems ok.
72     
73     :param lp: Loadparm context
74     :param session_info: Session information
75     :param credentials: Credentials
76     """
77     if lp.get("realm") == "":
78         raise Error("Realm empty")
79     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
80             credentials=credentials, lp=lp)
81     if len(ldb.search("(cn=Administrator)")) != 1:
82         raise "No administrator account found"
83
84
85 def findnss(nssfn, names):
86     """Find a user or group from a list of possibilities.
87     
88     :param nssfn: NSS Function to try (should raise KeyError if not found)
89     :param names: Names to check.
90     :return: Value return by first names list.
91     """
92     for name in names:
93         try:
94             return nssfn(name)
95         except KeyError:
96             pass
97     raise KeyError("Unable to find user/group %r" % names)
98
99
100 def open_ldb(session_info, credentials, lp, dbname):
101     """Open a LDB, thrashing it if it is corrupt.
102
103     :param session_info: auth session information
104     :param credentials: credentials
105     :param lp: Loadparm context
106     :param dbname: Path of the database to open.
107     :return: a Ldb object
108     """
109     assert session_info is not None
110     try:
111         return Ldb(dbname, session_info=session_info, credentials=credentials, 
112                    lp=lp)
113     except LdbError, e:
114         print e
115         os.unlink(dbname)
116         return Ldb(dbname, session_info=session_info, credentials=credentials,
117                    lp=lp)
118
119
120 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
121     """Setup a ldb in the private dir.
122     
123     :param ldb: LDB file to import data into
124     :param ldif_path: Path of the LDIF file to load
125     :param subst_vars: Optional variables to subsitute in LDIF.
126     """
127     assert isinstance(ldif_path, str)
128
129     data = open(ldif_path, 'r').read()
130     if subst_vars is not None:
131         data = substitute_var(data, subst_vars)
132
133     check_all_substituted(data)
134
135     ldb.add_ldif(data)
136
137
138 def setup_modify_ldif(ldb, ldif_path, substvars=None):
139     """Modify a ldb in the private dir.
140     
141     :param ldb: LDB object.
142     :param ldif_path: LDIF file path.
143     :param substvars: Optional dictionary with substitution variables.
144     """
145     data = open(ldif_path, 'r').read()
146     if substvars is not None:
147         data = substitute_var(data, substvars)
148
149     check_all_substituted(data)
150
151     ldb.modify_ldif(data)
152
153
154 def setup_ldb(ldb, ldif_path, subst_vars):
155     """Import a LDIF a file into a LDB handle, optionally substituting variables.
156
157     :note: Either all LDIF data will be added or none (using transactions).
158
159     :param ldb: LDB file to import into.
160     :param ldif_path: Path to the LDIF file.
161     :param subst_vars: Dictionary with substitution variables.
162     """
163     assert ldb is not None
164     ldb.transaction_start()
165     try:
166         setup_add_ldif(ldb, ldif_path, subst_vars)
167     except:
168         ldb.transaction_cancel()
169         raise
170     ldb.transaction_commit()
171
172
173 def setup_file(template, fname, substvars):
174     """Setup a file in the private dir.
175
176     :param template: Path of the template file.
177     :param fname: Path of the file to create.
178     :param substvars: Substitution variables.
179     """
180     f = fname
181
182     if os.path.exists(f):
183         os.unlink(f)
184
185     data = open(template, 'r').read()
186     if substvars:
187         data = substitute_var(data, substvars)
188     check_all_substituted(data)
189
190     open(f, 'w').write(data)
191
192
193 def provision_paths_from_lp(lp, dnsdomain):
194     """Set the default paths for provisioning.
195
196     :param lp: Loadparm context.
197     :param dnsdomain: DNS Domain name
198     """
199     paths = ProvisionPaths()
200     private_dir = lp.get("private dir")
201     paths.keytab = "secrets.keytab"
202     paths.dns_keytab = "dns.keytab"
203
204     paths.shareconf = os.path.join(private_dir, "share.ldb")
205     paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
206     paths.idmapdb = os.path.join(private_dir, lp.get("idmap database") or "idmap.ldb")
207     paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
208     paths.templates = os.path.join(private_dir, "templates.ldb")
209     paths.dns = os.path.join(private_dir, dnsdomain + ".zone")
210     paths.winsdb = os.path.join(private_dir, "wins.ldb")
211     paths.s4_ldapi_path = os.path.join(private_dir, "ldapi")
212     paths.smbconf = os.path.join(private_dir, "smb.conf")
213     paths.phpldapadminconfig = os.path.join(private_dir, 
214                                             "phpldapadmin-config.php")
215     paths.hklm = "hklm.ldb"
216     paths.hkcr = "hkcr.ldb"
217     paths.hkcu = "hkcu.ldb"
218     paths.hku = "hku.ldb"
219     paths.hkpd = "hkpd.ldb"
220     paths.hkpt = "hkpt.ldb"
221
222     paths.sysvol = lp.get("sysvol", "path")
223     if paths.sysvol is None:
224         paths.sysvol = os.path.join(lp.get("lock dir"), "sysvol")
225
226     paths.netlogon = lp.get("netlogon", "path")
227     if paths.netlogon is None:
228         paths.netlogon = os.path.join(os.path.join(paths.sysvol, "scripts"))
229
230     return paths
231
232
233 def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
234                         wheel, backup):
235     """setup reasonable name mappings for sam names to unix names.
236     
237     :param ldb: SamDB object.
238     :param sid: The domain sid.
239     :param domaindn: The domain DN.
240     :param root: Name of the UNIX root user.
241     :param nobody: Name of the UNIX nobody user.
242     :param nogroup: Name of the unix nobody group.
243     :param users: Name of the unix users group.
244     :param wheel: Name of the wheel group (users that can become root).
245     :param backup: Name of the backup group."""
246     # add some foreign sids if they are not present already
247     ldb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
248     ldb.add_foreign(domaindn, "S-1-1-0", "World")
249     ldb.add_foreign(domaindn, "S-1-5-2", "Network")
250     ldb.add_foreign(domaindn, "S-1-5-18", "System")
251     ldb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
252
253     # some well known sids
254     ldb.setup_name_mapping(domaindn, "S-1-5-7", nobody)
255     ldb.setup_name_mapping(domaindn, "S-1-1-0", nogroup)
256     ldb.setup_name_mapping(domaindn, "S-1-5-2", nogroup)
257     ldb.setup_name_mapping(domaindn, "S-1-5-18", root)
258     ldb.setup_name_mapping(domaindn, "S-1-5-11", users)
259     ldb.setup_name_mapping(domaindn, "S-1-5-32-544", wheel)
260     ldb.setup_name_mapping(domaindn, "S-1-5-32-545", users)
261     ldb.setup_name_mapping(domaindn, "S-1-5-32-546", nogroup)
262     ldb.setup_name_mapping(domaindn, "S-1-5-32-551", backup)
263
264     # and some well known domain rids
265     ldb.setup_name_mapping(domaindn, sid + "-500", root)
266     ldb.setup_name_mapping(domaindn, sid + "-518", wheel)
267     ldb.setup_name_mapping(domaindn, sid + "-519", wheel)
268     ldb.setup_name_mapping(domaindn, sid + "-512", wheel)
269     ldb.setup_name_mapping(domaindn, sid + "-513", users)
270     ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
271
272
273 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
274                            credentials, configdn, schemadn, domaindn, 
275                            hostname, netbiosname, dnsdomain, realm, 
276                            rootdn, serverrole, sitename, ldap_backend=None, 
277                            ldap_backend_type=None, erase=False):
278     """Setup the partitions for the SAM database. 
279     
280     Alternatively, provision() may call this, and then populate the database.
281     
282     :param erase: Remove the existing data present in the database.
283      
284     :note: This will wipe the Sam Database!
285     
286     :note: This function always removes the local SAM LDB file. The erase 
287         parameter controls whether to erase the existing data, which 
288         may not be stored locally but in LDAP.
289     """
290     assert session_info is not None
291
292     if os.path.exists(samdb_path):
293         os.unlink(samdb_path)
294
295     # Also wipes the database
296     samdb = SamDB(samdb_path, session_info=session_info, 
297                   credentials=credentials, lp=lp)
298
299     #Add modules to the list to activate them by default
300     #beware often order is important
301     #
302     # Some Known ordering constraints:
303     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
304     # - objectclass must be before password_hash, because password_hash checks
305     #   that the objectclass is of type person (filled in by objectclass
306     #   module when expanding the objectclass list)
307     # - partition must be last
308     # - each partition has its own module list then
309     modules_list = ["rootdse",
310                     "paged_results",
311                     "ranged_results",
312                     "anr",
313                     "server_sort",
314                     "extended_dn",
315                     "asq",
316                     "samldb",
317                     "rdn_name",
318                     "objectclass",
319                     "kludge_acl",
320                     "operational"]
321     tdb_modules_list = [
322                     "subtree_rename",
323                     "subtree_delete",
324                     "linked_attributes"]
325     modules_list2 = ["show_deleted",
326                     "partition"]
327  
328     domaindn_ldb = "users.ldb"
329     if ldap_backend is not None:
330         domaindn_ldb = ldap_backend
331     configdn_ldb = "configuration.ldb"
332     if ldap_backend is not None:
333         configdn_ldb = ldap_backend
334     schemadn_ldb = "schema.ldb"
335     if ldap_backend is not None:
336         schema_ldb = ldap_backend
337         schemadn_ldb = ldap_backend
338         
339     if ldap_backend_type == "fedora-ds":
340         backend_modules = ["nsuniqueid", "paged_searches"]
341     elif ldap_backend_type == "openldap":
342         backend_modules = ["normalise", "entryuuid", "paged_searches"]
343     elif serverrole == "domain controller":
344         backend_modules = ["repl_meta_data"]
345     else:
346         backend_modules = ["objectguid"]
347         
348     samdb.transaction_start()
349     try:
350         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
351                 "SCHEMADN": schemadn, 
352                 "SCHEMADN_LDB": schemadn_ldb,
353                 "SCHEMADN_MOD2": ",objectguid",
354                 "CONFIGDN": configdn,
355                 "CONFIGDN_LDB": configdn_ldb,
356                 "DOMAINDN": domaindn,
357                 "DOMAINDN_LDB": domaindn_ldb,
358                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
359                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
360                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
361                 "MODULES_LIST": ",".join(modules_list),
362                 "TDB_MODULES_LIST": ","+",".join(tdb_modules_list),
363                 "MODULES_LIST2": ",".join(modules_list2),
364                 "BACKEND_MOD": ",".join(backend_modules),
365         })
366
367     except:
368         samdb.transaction_cancel()
369         raise
370
371     samdb.transaction_commit()
372     
373     samdb = SamDB(samdb_path, session_info=session_info, 
374                   credentials=credentials, lp=lp)
375
376     samdb.transaction_start()
377     try:
378         message("Setting up sam.ldb attributes")
379         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
380
381         message("Setting up sam.ldb rootDSE")
382         setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
383                             dnsdomain, realm, rootdn, configdn, netbiosname,
384                             sitename)
385
386         if erase:
387             message("Erasing data from partitions")
388             samdb.erase_partitions()
389
390     except:
391         samdb.transaction_cancel()
392         raise
393
394     samdb.transaction_commit()
395     
396     return samdb
397
398
399 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
400                         netbiosname, domainsid, keytab_path, samdb_url, 
401                         dns_keytab_path, dnspass, machinepass):
402     """Add DC-specific bits to a secrets database.
403     
404     :param secretsdb: Ldb Handle to the secrets database
405     :param setup_path: Setup path function
406     :param machinepass: Machine password
407     """
408     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
409             "MACHINEPASS_B64": b64encode(machinepass),
410             "DOMAIN": domain,
411             "REALM": realm,
412             "DNSDOMAIN": dnsdomain,
413             "DOMAINSID": str(domainsid),
414             "SECRETS_KEYTAB": keytab_path,
415             "NETBIOSNAME": netbiosname,
416             "SAM_LDB": samdb_url,
417             "DNS_KEYTAB": dns_keytab_path,
418             "DNSPASS_B64": b64encode(dnspass),
419             })
420
421
422 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
423     """Setup the secrets database.
424
425     :param path: Path to the secrets database.
426     :param setup_path: Get the path to a setup file.
427     :param session_info: Session info.
428     :param credentials: Credentials
429     :param lp: Loadparm context
430     :return: LDB handle for the created secrets database
431     """
432     if os.path.exists(path):
433         os.unlink(path)
434     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
435                       lp=lp)
436     secrets_ldb.erase()
437     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
438     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
439                       lp=lp)
440     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
441     return secrets_ldb
442
443
444 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
445     """Setup the templates database.
446
447     :param path: Path to the database.
448     :param setup_path: Function for obtaining the path to setup files.
449     :param session_info: Session info
450     :param credentials: Credentials
451     :param lp: Loadparm context
452     """
453     templates_ldb = SamDB(path, session_info=session_info,
454                           credentials=credentials, lp=lp)
455     templates_ldb.erase()
456     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
457
458
459 def setup_registry(path, setup_path, session_info, credentials, lp):
460     """Setup the registry.
461     
462     :param path: Path to the registry database
463     :param setup_path: Function that returns the path to a setup.
464     :param session_info: Session information
465     :param credentials: Credentials
466     :param lp: Loadparm context
467     """
468     reg = registry.Registry()
469     hive = registry.open_ldb(path, session_info=session_info, 
470                          credentials=credentials, lp_ctx=lp)
471     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
472     provision_reg = setup_path("provision.reg")
473     assert os.path.exists(provision_reg)
474     reg.diff_apply(provision_reg)
475
476 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
477     """Setup the idmap database.
478
479     :param path: path to the idmap database
480     :param setup_path: Function that returns a path to a setup file
481     :param session_info: Session information
482     :param credentials: Credentials
483     :param lp: Loadparm context
484     """
485     if os.path.exists(path):
486         os.unlink(path)
487
488     idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
489                     lp=lp)
490
491     idmap_ldb.erase()
492     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
493     return idmap_ldb
494
495 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
496                         dnsdomain, realm, rootdn, configdn, netbiosname,
497                         sitename):
498     """Setup the SamDB rootdse.
499
500     :param samdb: Sam Database handle
501     :param setup_path: Obtain setup path
502     """
503     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
504         "SCHEMADN": schemadn, 
505         "NETBIOSNAME": netbiosname,
506         "DNSDOMAIN": dnsdomain,
507         "DEFAULTSITE": sitename,
508         "REALM": realm,
509         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
510         "DOMAINDN": domaindn,
511         "ROOTDN": rootdn,
512         "CONFIGDN": configdn,
513         "VERSION": samba.version(),
514         })
515         
516
517 def setup_self_join(samdb, configdn, schemadn, domaindn, 
518                     netbiosname, hostname, dnsdomain, machinepass, dnspass, 
519                     realm, domainname, domainsid, invocationid, setup_path,
520                     policyguid, sitename, hostguid=None):
521     """Join a host to its own domain."""
522     if hostguid is not None:
523         hostguid_add = "objectGUID: %s" % hostguid
524     else:
525         hostguid_add = ""
526
527     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
528               "CONFIGDN": configdn, 
529               "SCHEMADN": schemadn,
530               "DOMAINDN": domaindn,
531               "INVOCATIONID": invocationid,
532               "NETBIOSNAME": netbiosname,
533               "DEFAULTSITE": sitename,
534               "DNSNAME": "%s.%s" % (hostname, dnsdomain),
535               "MACHINEPASS_B64": b64encode(machinepass),
536               "DNSPASS_B64": b64encode(dnspass),
537               "REALM": realm,
538               "DOMAIN": domainname,
539               "HOSTGUID_ADD": hostguid_add,
540               "DNSDOMAIN": dnsdomain})
541     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
542               "POLICYGUID": policyguid,
543               "DNSDOMAIN": dnsdomain,
544               "DOMAINSID": str(domainsid),
545               "DOMAINDN": domaindn})
546
547
548 def setup_samdb(path, setup_path, session_info, credentials, lp, 
549                 schemadn, configdn, domaindn, dnsdomain, realm, 
550                 netbiosname, message, hostname, rootdn, erase, 
551                 domainsid, aci, domainguid, policyguid, 
552                 domainname, fill, adminpass, krbtgtpass, 
553                 machinepass, hostguid, invocationid, dnspass,
554                 serverrole, sitename, ldap_backend=None, 
555                 ldap_backend_type=None):
556     """Setup a complete SAM Database.
557     
558     :note: This will wipe the main SAM database file!
559     """
560
561     assert serverrole in ("domain controller", "member server")
562
563     # Also wipes the database
564     setup_samdb_partitions(path, setup_path, schemadn=schemadn, configdn=configdn, 
565                            domaindn=domaindn, message=message, lp=lp,
566                            credentials=credentials, session_info=session_info,
567                            hostname=hostname, netbiosname=netbiosname, 
568                            dnsdomain=dnsdomain, realm=realm, rootdn=rootdn,
569                            ldap_backend=ldap_backend, serverrole=serverrole,
570                            ldap_backend_type=ldap_backend_type, erase=erase,
571                            sitename=sitename)
572
573     samdb = SamDB(path, session_info=session_info, 
574                   credentials=credentials, lp=lp)
575
576     if fill == FILL_DRS:
577        # We want to finish here, but setup the index before we do so
578         message("Setting up sam.ldb index")
579         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
580         return samdb
581
582     message("Pre-loading the Samba 4 and AD schema")
583     samdb = SamDB(path, session_info=session_info, 
584                   credentials=credentials, lp=lp)
585     samdb.set_domain_sid(domainsid)
586     if lp.get("server role") == "domain controller":
587         samdb.set_invocation_id(invocationid)
588
589     load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename)
590
591     samdb.transaction_start()
592         
593     try:
594         message("Adding DomainDN: %s (permitted to fail)" % domaindn)
595         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
596             "DOMAINDN": domaindn,
597             "ACI": aci,
598             })
599
600         message("Modifying DomainDN: " + domaindn + "")
601         if domainguid is not None:
602             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
603         else:
604             domainguid_mod = ""
605
606         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
607             "LDAPTIME": timestring(int(time.time())),
608             "DOMAINSID": str(domainsid),
609             "SCHEMADN": schemadn, 
610             "NETBIOSNAME": netbiosname,
611             "DEFAULTSITE": sitename,
612             "CONFIGDN": configdn,
613             "POLICYGUID": policyguid,
614             "DOMAINDN": domaindn,
615             "DOMAINGUID_MOD": domainguid_mod,
616             })
617
618         message("Adding configuration container (permitted to fail)")
619         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
620             "CONFIGDN": configdn, 
621             "ACI": aci,
622             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
623             })
624         message("Modifying configuration container")
625         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
626             "CONFIGDN": configdn, 
627             "SCHEMADN": schemadn,
628             })
629
630         message("Adding schema container (permitted to fail)")
631         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
632             "SCHEMADN": schemadn,
633             "ACI": aci,
634             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
635             })
636         message("Modifying schema container")
637         setup_modify_ldif(samdb, 
638             setup_path("provision_schema_basedn_modify.ldif"), {
639             "SCHEMADN": schemadn,
640             "NETBIOSNAME": netbiosname,
641             "DEFAULTSITE": sitename,
642             "CONFIGDN": configdn,
643             })
644
645         message("Setting up sam.ldb Samba4 schema")
646         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
647                        {"SCHEMADN": schemadn })
648         message("Setting up sam.ldb AD schema")
649         setup_add_ldif(samdb, setup_path("schema.ldif"), 
650                        {"SCHEMADN": schemadn})
651
652         message("Setting up sam.ldb configuration data")
653         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
654             "CONFIGDN": configdn,
655             "NETBIOSNAME": netbiosname,
656             "DEFAULTSITE": sitename,
657             "DNSDOMAIN": dnsdomain,
658             "DOMAIN": domainname,
659             "SCHEMADN": schemadn,
660             "DOMAINDN": domaindn,
661             })
662
663         message("Setting up display specifiers")
664         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
665                        {"CONFIGDN": configdn})
666
667         message("Adding users container (permitted to fail)")
668         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
669             "DOMAINDN": domaindn})
670         message("Modifying users container")
671         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
672             "DOMAINDN": domaindn})
673         message("Adding computers container (permitted to fail)")
674         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
675             "DOMAINDN": domaindn})
676         message("Modifying computers container")
677         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
678             "DOMAINDN": domaindn})
679         message("Setting up sam.ldb data")
680         setup_add_ldif(samdb, setup_path("provision.ldif"), {
681             "DOMAINDN": domaindn,
682             "NETBIOSNAME": netbiosname,
683             "DEFAULTSITE": sitename,
684             "CONFIGDN": configdn,
685             })
686
687         if fill == FILL_FULL:
688             message("Setting up sam.ldb users and groups")
689             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
690                 "DOMAINDN": domaindn,
691                 "DOMAINSID": str(domainsid),
692                 "CONFIGDN": configdn,
693                 "ADMINPASS_B64": b64encode(adminpass),
694                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
695                 })
696
697             if lp.get("server role") == "domain controller":
698                 message("Setting up self join")
699                 setup_self_join(samdb, configdn=configdn, schemadn=schemadn, 
700                                 domaindn=domaindn, invocationid=invocationid, 
701                                 dnspass=dnspass, netbiosname=netbiosname, 
702                                 dnsdomain=dnsdomain, realm=realm, 
703                                 machinepass=machinepass, domainname=domainname, 
704                                 domainsid=domainsid, policyguid=policyguid,
705                                 hostname=hostname, hostguid=hostguid, 
706                                 setup_path=setup_path, sitename=sitename)
707
708     #We want to setup the index last, as adds are faster unindexed
709         message("Setting up sam.ldb index")
710         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
711     except:
712         samdb.transaction_cancel()
713         raise
714
715     samdb.transaction_commit()
716     return samdb
717
718
719 FILL_FULL = "FULL"
720 FILL_NT4SYNC = "NT4SYNC"
721 FILL_DRS = "DRS"
722
723 def provision(lp, setup_dir, message, paths, session_info, 
724               credentials, samdb_fill=FILL_FULL, realm=None, rootdn=None,
725               domain=None, hostname=None, hostip=None, domainsid=None, 
726               hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
727               policyguid=None, invocationid=None, machinepass=None, 
728               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
729               wheel=None, backup=None, aci=None, serverrole=None, erase=False,
730               ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
731     """Provision samba4
732     
733     :note: caution, this wipes all existing data!
734     """
735
736     def setup_path(file):
737         return os.path.join(setup_dir, file)
738
739     if domainsid is None:
740         domainsid = security.random_sid()
741     if policyguid is None:
742         policyguid = uuid.random()
743     if adminpass is None:
744         adminpass = misc.random_password(12)
745     if krbtgtpass is None:
746         krbtgtpass = misc.random_password(12)
747     if machinepass is None:
748         machinepass  = misc.random_password(12)
749     if dnspass is None:
750         dnspass = misc.random_password(12)
751     if root is None:
752         root = findnss(pwd.getpwnam, ["root"])[0]
753     if nobody is None:
754         nobody = findnss(pwd.getpwnam, ["nobody"])[0]
755     if nogroup is None:
756         nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
757     if users is None:
758         users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
759                         "usr"])[0]
760     if wheel is None:
761         wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
762     if backup is None:
763         backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
764     if aci is None:
765         aci = "# no aci for local ldb"
766     if serverrole is None:
767         serverrole = lp.get("server role")
768     assert serverrole in ("domain controller", "member server")
769     if invocationid is None and serverrole == "domain controller":
770         invocationid = uuid.random()
771
772     if realm is None:
773         realm = lp.get("realm")
774
775     if lp.get("realm").upper() != realm.upper():
776         raise Exception("realm '%s' in smb.conf must match chosen realm '%s'" %
777                 (lp.get("realm"), realm))
778
779     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
780     
781     if ldap_backend == "ldapi":
782         # provision-backend will set this path suggested slapd command line / fedorads.inf
783         ldap_backend = "ldapi://" % urllib.quote(os.path.join(lp.get("private dir"), "ldap", "ldapi"), safe="")
784
785     assert realm is not None
786     realm = realm.upper()
787
788     if hostname is None:
789         hostname = gethostname().split(".")[0].lower()
790
791     if hostip is None:
792         hostip = gethostbyname(hostname)
793
794     netbiosname = hostname.upper()
795     if not valid_netbios_name(netbiosname):
796         raise InvalidNetbiosName(netbiosname)
797
798     dnsdomain = realm.lower()
799     if serverrole == "domain controller":
800         domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
801         if domain is None:
802             domain = lp.get("workgroup")
803     
804         if lp.get("workgroup").upper() != domain.upper():
805             raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
806                 lp.get("workgroup"), domain)
807
808         assert domain is not None
809         domain = domain.upper()
810         if not valid_netbios_name(domain):
811             raise InvalidNetbiosName(domain)
812     else:
813         domaindn = "CN=" + netbiosname
814         domain = netbiosname
815     
816     if rootdn is None:
817        rootdn = domaindn
818        
819     configdn = "CN=Configuration," + rootdn
820     schemadn = "CN=Schema," + configdn
821
822     message("set DOMAIN SID: %s" % str(domainsid))
823     message("Provisioning for %s in realm %s" % (domain, realm))
824     message("Using administrator password: %s" % adminpass)
825
826     assert paths.smbconf is not None
827
828     # only install a new smb.conf if there isn't one there already
829     if not os.path.exists(paths.smbconf):
830         message("Setting up smb.conf")
831         if serverrole == "domain controller":
832             smbconfsuffix = "dc"
833         elif serverrole == "member":
834             smbconfsuffix = "member"
835         setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
836                    paths.smbconf, {
837             "HOSTNAME": hostname,
838             "DOMAIN_CONF": domain,
839             "REALM_CONF": realm,
840             "SERVERROLE": serverrole,
841             "NETLOGONPATH": paths.netlogon,
842             "SYSVOLPATH": paths.sysvol,
843             })
844         lp.load(paths.smbconf)
845
846     # only install a new shares config db if there is none
847     if not os.path.exists(paths.shareconf):
848         message("Setting up share.ldb")
849         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
850                         credentials=credentials, lp=lp)
851         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
852
853      
854     message("Setting up secrets.ldb")
855     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
856                                   session_info=session_info, 
857                                   credentials=credentials, lp=lp)
858
859     message("Setting up the registry")
860     setup_registry(paths.hklm, setup_path, session_info, 
861                    credentials=credentials, lp=lp)
862
863     message("Setting up templates db")
864     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
865                       credentials=credentials, lp=lp)
866
867     message("Setting up idmap db")
868     setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
869                   credentials=credentials, lp=lp)
870
871     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
872                         credentials=credentials, lp=lp, schemadn=schemadn, 
873                         configdn=configdn, domaindn=domaindn,
874                         dnsdomain=dnsdomain, netbiosname=netbiosname, 
875                         realm=realm, message=message, hostname=hostname, 
876                         rootdn=rootdn, erase=erase, domainsid=domainsid, 
877                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
878                         domainname=domain, fill=samdb_fill, 
879                         adminpass=adminpass, krbtgtpass=krbtgtpass,
880                         hostguid=hostguid, invocationid=invocationid, 
881                         machinepass=machinepass, dnspass=dnspass,
882                         serverrole=serverrole, ldap_backend=ldap_backend, 
883                         ldap_backend_type=ldap_backend_type, sitename=sitename)
884
885     if lp.get("server role") == "domain controller":
886        policy_path = os.path.join(paths.sysvol, dnsdomain, "Policies", 
887                                   "{" + policyguid + "}")
888        os.makedirs(policy_path, 0755)
889        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
890        os.makedirs(os.path.join(policy_path, "User"), 0755)
891        if not os.path.isdir(paths.netlogon):
892             os.makedirs(paths.netlogon, 0755)
893        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
894                          credentials=credentials, lp=lp)
895        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=realm,
896                            netbiosname=netbiosname, domainsid=domainsid, 
897                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
898                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
899                            machinepass=machinepass, dnsdomain=dnsdomain)
900
901     if samdb_fill == FILL_FULL:
902         setup_name_mappings(samdb, str(domainsid), domaindn, root=root, 
903                             nobody=nobody, nogroup=nogroup, wheel=wheel, 
904                             users=users, backup=backup)
905    
906         message("Setting up sam.ldb rootDSE marking as synchronized")
907         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
908
909     message("Setting up phpLDAPadmin configuration")
910     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
911                                ldapi_url)
912
913     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
914
915     if lp.get("server role") == "domain controller":
916         samdb = SamDB(paths.samdb, session_info=session_info, 
917                       credentials=credentials, lp=lp)
918
919         domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
920         assert isinstance(domainguid, str)
921         hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
922                 expression="(&(objectClass=computer)(cn=%s))" % hostname,
923                 scope=SCOPE_SUBTREE)
924         assert isinstance(hostguid, str)
925
926         message("Setting up DNS zone: %s" % dnsdomain)
927         create_zone_file(paths.dns, setup_path, samdb, 
928                       hostname=hostname, hostip=hostip, dnsdomain=dnsdomain,
929                       domaindn=domaindn, dnspass=dnspass, realm=realm, 
930                       domainguid=domainguid, hostguid=hostguid)
931         message("Please install the zone located in %s into your DNS server" % paths.dns)
932
933     return domaindn
934
935
936 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
937     """Create a PHP LDAP admin configuration file.
938
939     :param path: Path to write the configuration to.
940     :param setup_path: Function to generate setup paths.
941     """
942     setup_file(setup_path("phpldapadmin-config.php"), path, 
943             {"S4_LDAPI_URI": ldapi_uri})
944
945
946 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
947                   hostip, hostname, dnspass, realm, domainguid, hostguid):
948     """Write out a DNS zone file, from the info in the current database.
949     
950     :param path: Path of the new file.
951     :param setup_path": Setup path function.
952     :param samdb: SamDB object
953     :param dnsdomain: DNS Domain name
954     :param domaindn: DN of the Domain
955     :param hostip: Local IP
956     :param hostname: Local hostname
957     :param dnspass: Password for DNS
958     :param realm: Realm name
959     :param domainguid: GUID of the domain.
960     :param hostguid: GUID of the host.
961     """
962     assert isinstance(domainguid, str)
963
964     setup_file(setup_path("provision.zone"), path, {
965             "DNSPASS_B64": b64encode(dnspass),
966             "HOSTNAME": hostname,
967             "DNSDOMAIN": dnsdomain,
968             "REALM": realm,
969             "HOSTIP": hostip,
970             "DOMAINGUID": domainguid,
971             "DATESTRING": time.strftime("%Y%m%d%H"),
972             "DEFAULTSITE": DEFAULTSITE,
973             "HOSTGUID": hostguid,
974         })
975
976
977 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
978     """Load schema for the SamDB.
979     
980     :param samdb: Load a schema into a SamDB.
981     :param setup_path: Setup path function.
982     :param schemadn: DN of the schema
983     :param netbiosname: NetBIOS name of the host.
984     :param configdn: DN of the configuration
985     """
986     schema_data = open(setup_path("schema.ldif"), 'r').read()
987     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
988     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
989     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
990     head_data = substitute_var(head_data, {
991                     "SCHEMADN": schemadn,
992                     "NETBIOSNAME": netbiosname,
993                     "CONFIGDN": configdn,
994                     "DEFAULTSITE":sitename 
995     })
996     samdb.attach_schema_from_ldif(head_data, schema_data)
997