ea2feb981bbfb3ea378cf30b1bfaa1e776199d34
[samba.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 from base64 import b64encode
26 import os
27 import pwd
28 import grp
29 import time
30 import uuid, misc
31 from socket import gethostname, gethostbyname
32 import param
33 import registry
34 import samba
35 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
36 from samba.samdb import SamDB
37 import security
38 import urllib
39 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
40         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
41
42 """Functions for setting up a Samba configuration."""
43
44 DEFAULTSITE = "Default-First-Site-Name"
45
46 class InvalidNetbiosName(Exception):
47     def __init__(self, name):
48         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
49
50
51 class ProvisionPaths:
52     def __init__(self):
53         self.smbconf = None
54         self.shareconf = None
55         self.hklm = None
56         self.hkcu = None
57         self.hkcr = None
58         self.hku = None
59         self.hkpd = None
60         self.hkpt = None
61         self.samdb = None
62         self.idmapdb = None
63         self.secrets = None
64         self.keytab = None
65         self.dns_keytab = None
66         self.dns = None
67         self.winsdb = None
68
69
70 def check_install(lp, session_info, credentials):
71     """Check whether the current install seems ok.
72     
73     :param lp: Loadparm context
74     :param session_info: Session information
75     :param credentials: Credentials
76     """
77     if lp.get("realm") == "":
78         raise Error("Realm empty")
79     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
80             credentials=credentials, lp=lp)
81     if len(ldb.search("(cn=Administrator)")) != 1:
82         raise "No administrator account found"
83
84
85 def findnss(nssfn, names):
86     """Find a user or group from a list of possibilities.
87     
88     :param nssfn: NSS Function to try (should raise KeyError if not found)
89     :param names: Names to check.
90     :return: Value return by first names list.
91     """
92     for name in names:
93         try:
94             return nssfn(name)
95         except KeyError:
96             pass
97     raise KeyError("Unable to find user/group %r" % names)
98
99
100 def open_ldb(session_info, credentials, lp, dbname):
101     """Open a LDB, thrashing it if it is corrupt.
102
103     :param session_info: auth session information
104     :param credentials: credentials
105     :param lp: Loadparm context
106     :param dbname: Path of the database to open.
107     :return: a Ldb object
108     """
109     assert session_info is not None
110     try:
111         return Ldb(dbname, session_info=session_info, credentials=credentials, 
112                    lp=lp)
113     except LdbError, e:
114         print e
115         os.unlink(dbname)
116         return Ldb(dbname, session_info=session_info, credentials=credentials,
117                    lp=lp)
118
119
120 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
121     """Setup a ldb in the private dir.
122     
123     :param ldb: LDB file to import data into
124     :param ldif_path: Path of the LDIF file to load
125     :param subst_vars: Optional variables to subsitute in LDIF.
126     """
127     assert isinstance(ldif_path, str)
128
129     data = open(ldif_path, 'r').read()
130     if subst_vars is not None:
131         data = substitute_var(data, subst_vars)
132
133     check_all_substituted(data)
134
135     ldb.add_ldif(data)
136
137
138 def setup_modify_ldif(ldb, ldif_path, substvars=None):
139     """Modify a ldb in the private dir.
140     
141     :param ldb: LDB object.
142     :param ldif_path: LDIF file path.
143     :param substvars: Optional dictionary with substitution variables.
144     """
145     data = open(ldif_path, 'r').read()
146     if substvars is not None:
147         data = substitute_var(data, substvars)
148
149     check_all_substituted(data)
150
151     ldb.modify_ldif(data)
152
153
154 def setup_ldb(ldb, ldif_path, subst_vars):
155     """Import a LDIF a file into a LDB handle, optionally substituting variables.
156
157     :note: Either all LDIF data will be added or none (using transactions).
158
159     :param ldb: LDB file to import into.
160     :param ldif_path: Path to the LDIF file.
161     :param subst_vars: Dictionary with substitution variables.
162     """
163     assert ldb is not None
164     ldb.transaction_start()
165     try:
166         setup_add_ldif(ldb, ldif_path, subst_vars)
167     except:
168         ldb.transaction_cancel()
169         raise
170     ldb.transaction_commit()
171
172
173 def setup_file(template, fname, substvars):
174     """Setup a file in the private dir.
175
176     :param template: Path of the template file.
177     :param fname: Path of the file to create.
178     :param substvars: Substitution variables.
179     """
180     f = fname
181
182     if os.path.exists(f):
183         os.unlink(f)
184
185     data = open(template, 'r').read()
186     if substvars:
187         data = substitute_var(data, substvars)
188     check_all_substituted(data)
189
190     open(f, 'w').write(data)
191
192
193 def provision_paths_from_lp(lp, dnsdomain):
194     """Set the default paths for provisioning.
195
196     :param lp: Loadparm context.
197     :param dnsdomain: DNS Domain name
198     """
199     paths = ProvisionPaths()
200     private_dir = lp.get("private dir")
201     paths.keytab = "secrets.keytab"
202     paths.dns_keytab = "dns.keytab"
203
204     paths.shareconf = os.path.join(private_dir, "share.ldb")
205     paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
206     paths.idmapdb = os.path.join(private_dir, lp.get("idmap database") or "idmap.ldb")
207     paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
208     paths.templates = os.path.join(private_dir, "templates.ldb")
209     paths.dns = os.path.join(private_dir, dnsdomain + ".zone")
210     paths.winsdb = os.path.join(private_dir, "wins.ldb")
211     paths.s4_ldapi_path = os.path.join(private_dir, "ldapi")
212     paths.smbconf = os.path.join(private_dir, "smb.conf")
213     paths.phpldapadminconfig = os.path.join(private_dir, 
214                                             "phpldapadmin-config.php")
215     paths.hklm = "hklm.ldb"
216     paths.hkcr = "hkcr.ldb"
217     paths.hkcu = "hkcu.ldb"
218     paths.hku = "hku.ldb"
219     paths.hkpd = "hkpd.ldb"
220     paths.hkpt = "hkpt.ldb"
221
222     paths.sysvol = lp.get("sysvol", "path")
223     if paths.sysvol is None:
224         paths.sysvol = os.path.join(lp.get("lock dir"), "sysvol")
225
226     paths.netlogon = lp.get("netlogon", "path")
227     if paths.netlogon is None:
228         paths.netlogon = os.path.join(os.path.join(paths.sysvol, "scripts"))
229
230     return paths
231
232
233 def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
234                         wheel, backup):
235     """setup reasonable name mappings for sam names to unix names.
236     
237     :param ldb: SamDB object.
238     :param sid: The domain sid.
239     :param domaindn: The domain DN.
240     :param root: Name of the UNIX root user.
241     :param nobody: Name of the UNIX nobody user.
242     :param nogroup: Name of the unix nobody group.
243     :param users: Name of the unix users group.
244     :param wheel: Name of the wheel group (users that can become root).
245     :param backup: Name of the backup group."""
246     # add some foreign sids if they are not present already
247     ldb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
248     ldb.add_foreign(domaindn, "S-1-1-0", "World")
249     ldb.add_foreign(domaindn, "S-1-5-2", "Network")
250     ldb.add_foreign(domaindn, "S-1-5-18", "System")
251     ldb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
252
253     # some well known sids
254     ldb.setup_name_mapping(domaindn, "S-1-5-7", nobody)
255     ldb.setup_name_mapping(domaindn, "S-1-1-0", nogroup)
256     ldb.setup_name_mapping(domaindn, "S-1-5-2", nogroup)
257     ldb.setup_name_mapping(domaindn, "S-1-5-18", root)
258     ldb.setup_name_mapping(domaindn, "S-1-5-11", users)
259     ldb.setup_name_mapping(domaindn, "S-1-5-32-544", wheel)
260     ldb.setup_name_mapping(domaindn, "S-1-5-32-545", users)
261     ldb.setup_name_mapping(domaindn, "S-1-5-32-546", nogroup)
262     ldb.setup_name_mapping(domaindn, "S-1-5-32-551", backup)
263
264     # and some well known domain rids
265     ldb.setup_name_mapping(domaindn, sid + "-500", root)
266     ldb.setup_name_mapping(domaindn, sid + "-518", wheel)
267     ldb.setup_name_mapping(domaindn, sid + "-519", wheel)
268     ldb.setup_name_mapping(domaindn, sid + "-512", wheel)
269     ldb.setup_name_mapping(domaindn, sid + "-513", users)
270     ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
271
272
273 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
274                            credentials, configdn, schemadn, domaindn, 
275                            hostname, netbiosname, dnsdomain, realm, 
276                            rootdn, serverrole, sitename, ldap_backend=None, 
277                            ldap_backend_type=None, erase=False):
278     """Setup the partitions for the SAM database. 
279     
280     Alternatively, provision() may call this, and then populate the database.
281     
282     :note: This will wipe the Sam Database!
283     
284     :note: This function always removes the local SAM LDB file. The erase 
285         parameter controls whether to erase the existing data, which 
286         may not be stored locally but in LDAP.
287     """
288     assert session_info is not None
289
290     samdb = SamDB(samdb_path, session_info=session_info, 
291                   credentials=credentials, lp=lp)
292
293     # Wipes the database
294     try:
295         samdb.erase()
296     except:
297         os.unlink(samdb_path)
298
299     samdb = SamDB(samdb_path, session_info=session_info, 
300                   credentials=credentials, lp=lp)
301
302     #Add modules to the list to activate them by default
303     #beware often order is important
304     #
305     # Some Known ordering constraints:
306     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
307     # - objectclass must be before password_hash, because password_hash checks
308     #   that the objectclass is of type person (filled in by objectclass
309     #   module when expanding the objectclass list)
310     # - partition must be last
311     # - each partition has its own module list then
312     modules_list = ["rootdse",
313                     "paged_results",
314                     "ranged_results",
315                     "anr",
316                     "server_sort",
317                     "extended_dn",
318                     "asq",
319                     "rdn_name",
320                     "objectclass",
321                     "samldb",
322                     "kludge_acl",
323                     "operational"]
324     tdb_modules_list = [
325                     "subtree_rename",
326                     "subtree_delete",
327                     "linked_attributes"]
328     modules_list2 = ["show_deleted",
329                     "partition"]
330  
331     domaindn_ldb = "users.ldb"
332     if ldap_backend is not None:
333         domaindn_ldb = ldap_backend
334     configdn_ldb = "configuration.ldb"
335     if ldap_backend is not None:
336         configdn_ldb = ldap_backend
337     schemadn_ldb = "schema.ldb"
338     if ldap_backend is not None:
339         schema_ldb = ldap_backend
340         schemadn_ldb = ldap_backend
341         
342     if ldap_backend_type == "fedora-ds":
343         backend_modules = ["nsuniqueid", "paged_searches"]
344     elif ldap_backend_type == "openldap":
345         backend_modules = ["normalise", "entryuuid", "paged_searches"]
346     elif serverrole == "domain controller":
347         backend_modules = ["repl_meta_data"]
348     else:
349         backend_modules = ["objectguid"]
350         
351     samdb.transaction_start()
352     try:
353         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
354                 "SCHEMADN": schemadn, 
355                 "SCHEMADN_LDB": schemadn_ldb,
356                 "SCHEMADN_MOD2": ",objectguid",
357                 "CONFIGDN": configdn,
358                 "CONFIGDN_LDB": configdn_ldb,
359                 "DOMAINDN": domaindn,
360                 "DOMAINDN_LDB": domaindn_ldb,
361                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
362                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
363                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
364                 "MODULES_LIST": ",".join(modules_list),
365                 "TDB_MODULES_LIST": ","+",".join(tdb_modules_list),
366                 "MODULES_LIST2": ",".join(modules_list2),
367                 "BACKEND_MOD": ",".join(backend_modules),
368         })
369
370     except:
371         samdb.transaction_cancel()
372         raise
373
374     samdb.transaction_commit()
375     
376     samdb = SamDB(samdb_path, session_info=session_info, 
377                   credentials=credentials, lp=lp)
378
379     samdb.transaction_start()
380     try:
381         message("Setting up sam.ldb attributes")
382         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
383
384         message("Setting up sam.ldb rootDSE")
385         setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
386                             dnsdomain, realm, rootdn, configdn, netbiosname,
387                             sitename)
388
389         if erase:
390             message("Erasing data from partitions")
391             samdb.erase_partitions()
392
393     except:
394         samdb.transaction_cancel()
395         raise
396
397     samdb.transaction_commit()
398     
399     return samdb
400
401
402 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
403                         netbiosname, domainsid, keytab_path, samdb_url, 
404                         dns_keytab_path, dnspass, machinepass):
405     """Add DC-specific bits to a secrets database.
406     
407     :param secretsdb: Ldb Handle to the secrets database
408     :param setup_path: Setup path function
409     :param machinepass: Machine password
410     """
411     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
412             "MACHINEPASS_B64": b64encode(machinepass),
413             "DOMAIN": domain,
414             "REALM": realm,
415             "DNSDOMAIN": dnsdomain,
416             "DOMAINSID": str(domainsid),
417             "SECRETS_KEYTAB": keytab_path,
418             "NETBIOSNAME": netbiosname,
419             "SAM_LDB": samdb_url,
420             "DNS_KEYTAB": dns_keytab_path,
421             "DNSPASS_B64": b64encode(dnspass),
422             })
423
424
425 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
426     """Setup the secrets database.
427
428     :param path: Path to the secrets database.
429     :param setup_path: Get the path to a setup file.
430     :param session_info: Session info.
431     :param credentials: Credentials
432     :param lp: Loadparm context
433     :return: LDB handle for the created secrets database
434     """
435     if os.path.exists(path):
436         os.unlink(path)
437     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
438                       lp=lp)
439     secrets_ldb.erase()
440     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
441     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
442                       lp=lp)
443     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
444     return secrets_ldb
445
446
447 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
448     """Setup the templates database.
449
450     :param path: Path to the database.
451     :param setup_path: Function for obtaining the path to setup files.
452     :param session_info: Session info
453     :param credentials: Credentials
454     :param lp: Loadparm context
455     """
456     templates_ldb = SamDB(path, session_info=session_info,
457                           credentials=credentials, lp=lp)
458     templates_ldb.erase()
459     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
460
461
462 def setup_registry(path, setup_path, session_info, credentials, lp):
463     """Setup the registry.
464     
465     :param path: Path to the registry database
466     :param setup_path: Function that returns the path to a setup.
467     :param session_info: Session information
468     :param credentials: Credentials
469     :param lp: Loadparm context
470     """
471     reg = registry.Registry()
472     hive = registry.open_ldb(path, session_info=session_info, 
473                          credentials=credentials, lp_ctx=lp)
474     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
475     provision_reg = setup_path("provision.reg")
476     assert os.path.exists(provision_reg)
477     reg.diff_apply(provision_reg)
478
479 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
480     """Setup the idmap database.
481
482     :param path: path to the idmap database
483     :param setup_path: Function that returns a path to a setup file
484     :param session_info: Session information
485     :param credentials: Credentials
486     :param lp: Loadparm context
487     """
488     if os.path.exists(path):
489         os.unlink(path)
490
491     idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
492                     lp=lp)
493
494     idmap_ldb.erase()
495     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
496     return idmap_ldb
497
498 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
499                         dnsdomain, realm, rootdn, configdn, netbiosname,
500                         sitename):
501     """Setup the SamDB rootdse.
502
503     :param samdb: Sam Database handle
504     :param setup_path: Obtain setup path
505     """
506     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
507         "SCHEMADN": schemadn, 
508         "NETBIOSNAME": netbiosname,
509         "DNSDOMAIN": dnsdomain,
510         "DEFAULTSITE": sitename,
511         "REALM": realm,
512         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
513         "DOMAINDN": domaindn,
514         "ROOTDN": rootdn,
515         "CONFIGDN": configdn,
516         "VERSION": samba.version(),
517         })
518         
519
520 def setup_self_join(samdb, configdn, schemadn, domaindn, 
521                     netbiosname, hostname, dnsdomain, machinepass, dnspass, 
522                     realm, domainname, domainsid, invocationid, setup_path,
523                     policyguid, sitename, hostguid=None):
524     """Join a host to its own domain."""
525     if hostguid is not None:
526         hostguid_add = "objectGUID: %s" % hostguid
527     else:
528         hostguid_add = ""
529
530     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
531               "CONFIGDN": configdn, 
532               "SCHEMADN": schemadn,
533               "DOMAINDN": domaindn,
534               "INVOCATIONID": invocationid,
535               "NETBIOSNAME": netbiosname,
536               "DEFAULTSITE": sitename,
537               "DNSNAME": "%s.%s" % (hostname, dnsdomain),
538               "MACHINEPASS_B64": b64encode(machinepass),
539               "DNSPASS_B64": b64encode(dnspass),
540               "REALM": realm,
541               "DOMAIN": domainname,
542               "HOSTGUID_ADD": hostguid_add,
543               "DNSDOMAIN": dnsdomain})
544     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
545               "POLICYGUID": policyguid,
546               "DNSDOMAIN": dnsdomain,
547               "DOMAINSID": str(domainsid),
548               "DOMAINDN": domaindn})
549
550
551 def setup_samdb(path, setup_path, session_info, credentials, lp, 
552                 schemadn, configdn, domaindn, dnsdomain, realm, 
553                 netbiosname, message, hostname, rootdn, 
554                 domainsid, aci, domainguid, policyguid, 
555                 domainname, fill, adminpass, krbtgtpass, 
556                 machinepass, hostguid, invocationid, dnspass,
557                 serverrole, sitename, ldap_backend=None, 
558                 ldap_backend_type=None):
559     """Setup a complete SAM Database.
560     
561     :note: This will wipe the main SAM database file!
562     """
563
564     assert serverrole in ("domain controller", "member server")
565
566     erase = (fill != FILL_DRS)    
567
568     # Also wipes the database
569     setup_samdb_partitions(path, setup_path, schemadn=schemadn, configdn=configdn, 
570                            domaindn=domaindn, message=message, lp=lp,
571                            credentials=credentials, session_info=session_info,
572                            hostname=hostname, netbiosname=netbiosname, 
573                            dnsdomain=dnsdomain, realm=realm, rootdn=rootdn,
574                            ldap_backend=ldap_backend, serverrole=serverrole,
575                            ldap_backend_type=ldap_backend_type, erase=erase,
576                            sitename=sitename)
577
578     samdb = SamDB(path, session_info=session_info, 
579                   credentials=credentials, lp=lp)
580
581     if fill == FILL_DRS:
582        # We want to finish here, but setup the index before we do so
583         message("Setting up sam.ldb index")
584         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
585         return samdb
586
587     message("Pre-loading the Samba 4 and AD schema")
588     samdb = SamDB(path, session_info=session_info, 
589                   credentials=credentials, lp=lp)
590     samdb.set_domain_sid(domainsid)
591     if lp.get("server role") == "domain controller":
592         samdb.set_invocation_id(invocationid)
593
594     load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename)
595
596     samdb.transaction_start()
597         
598     try:
599         message("Adding DomainDN: %s (permitted to fail)" % domaindn)
600         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
601             "DOMAINDN": domaindn,
602             "ACI": aci,
603             })
604
605         message("Modifying DomainDN: " + domaindn + "")
606         if domainguid is not None:
607             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
608         else:
609             domainguid_mod = ""
610
611         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
612             "LDAPTIME": timestring(int(time.time())),
613             "DOMAINSID": str(domainsid),
614             "SCHEMADN": schemadn, 
615             "NETBIOSNAME": netbiosname,
616             "DEFAULTSITE": sitename,
617             "CONFIGDN": configdn,
618             "POLICYGUID": policyguid,
619             "DOMAINDN": domaindn,
620             "DOMAINGUID_MOD": domainguid_mod,
621             })
622
623         message("Adding configuration container (permitted to fail)")
624         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
625             "CONFIGDN": configdn, 
626             "ACI": aci,
627             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
628             })
629         message("Modifying configuration container")
630         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
631             "CONFIGDN": configdn, 
632             "SCHEMADN": schemadn,
633             })
634
635         message("Adding schema container (permitted to fail)")
636         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
637             "SCHEMADN": schemadn,
638             "ACI": aci,
639             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
640             })
641         message("Modifying schema container")
642         setup_modify_ldif(samdb, 
643             setup_path("provision_schema_basedn_modify.ldif"), {
644             "SCHEMADN": schemadn,
645             "NETBIOSNAME": netbiosname,
646             "DEFAULTSITE": sitename,
647             "CONFIGDN": configdn,
648             })
649
650         message("Setting up sam.ldb Samba4 schema")
651         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
652                        {"SCHEMADN": schemadn })
653         message("Setting up sam.ldb AD schema")
654         setup_add_ldif(samdb, setup_path("schema.ldif"), 
655                        {"SCHEMADN": schemadn})
656
657         message("Setting up sam.ldb configuration data")
658         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
659             "CONFIGDN": configdn,
660             "NETBIOSNAME": netbiosname,
661             "DEFAULTSITE": sitename,
662             "DNSDOMAIN": dnsdomain,
663             "DOMAIN": domainname,
664             "SCHEMADN": schemadn,
665             "DOMAINDN": domaindn,
666             })
667
668         message("Setting up display specifiers")
669         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
670                        {"CONFIGDN": configdn})
671
672         message("Adding users container (permitted to fail)")
673         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
674             "DOMAINDN": domaindn})
675         message("Modifying users container")
676         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
677             "DOMAINDN": domaindn})
678         message("Adding computers container (permitted to fail)")
679         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
680             "DOMAINDN": domaindn})
681         message("Modifying computers container")
682         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
683             "DOMAINDN": domaindn})
684         message("Setting up sam.ldb data")
685         setup_add_ldif(samdb, setup_path("provision.ldif"), {
686             "DOMAINDN": domaindn,
687             "NETBIOSNAME": netbiosname,
688             "DEFAULTSITE": sitename,
689             "CONFIGDN": configdn,
690             })
691
692         if fill == FILL_FULL:
693             message("Setting up sam.ldb users and groups")
694             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
695                 "DOMAINDN": domaindn,
696                 "DOMAINSID": str(domainsid),
697                 "CONFIGDN": configdn,
698                 "ADMINPASS_B64": b64encode(adminpass),
699                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
700                 })
701
702             if lp.get("server role") == "domain controller":
703                 message("Setting up self join")
704                 setup_self_join(samdb, configdn=configdn, schemadn=schemadn, 
705                                 domaindn=domaindn, invocationid=invocationid, 
706                                 dnspass=dnspass, netbiosname=netbiosname, 
707                                 dnsdomain=dnsdomain, realm=realm, 
708                                 machinepass=machinepass, domainname=domainname, 
709                                 domainsid=domainsid, policyguid=policyguid,
710                                 hostname=hostname, hostguid=hostguid, 
711                                 setup_path=setup_path, sitename=sitename)
712
713     #We want to setup the index last, as adds are faster unindexed
714         message("Setting up sam.ldb index")
715         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
716     except:
717         samdb.transaction_cancel()
718         raise
719
720     samdb.transaction_commit()
721     return samdb
722
723
724 FILL_FULL = "FULL"
725 FILL_NT4SYNC = "NT4SYNC"
726 FILL_DRS = "DRS"
727
728 def provision(lp, setup_dir, message, paths, session_info, 
729               credentials, samdb_fill=FILL_FULL, realm=None, rootdn=None,
730               domain=None, hostname=None, hostip=None, domainsid=None, 
731               hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
732               policyguid=None, invocationid=None, machinepass=None, 
733               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
734               wheel=None, backup=None, aci=None, serverrole=None,
735               ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
736     """Provision samba4
737     
738     :note: caution, this wipes all existing data!
739     """
740
741     def setup_path(file):
742         return os.path.join(setup_dir, file)
743
744     if domainsid is None:
745         domainsid = security.random_sid()
746     if policyguid is None:
747         policyguid = uuid.random()
748     if adminpass is None:
749         adminpass = misc.random_password(12)
750     if krbtgtpass is None:
751         krbtgtpass = misc.random_password(12)
752     if machinepass is None:
753         machinepass  = misc.random_password(12)
754     if dnspass is None:
755         dnspass = misc.random_password(12)
756     if root is None:
757         root = findnss(pwd.getpwnam, ["root"])[0]
758     if nobody is None:
759         nobody = findnss(pwd.getpwnam, ["nobody"])[0]
760     if nogroup is None:
761         nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
762     if users is None:
763         users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
764                         "usr"])[0]
765     if wheel is None:
766         wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
767     if backup is None:
768         backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
769     if aci is None:
770         aci = "# no aci for local ldb"
771     if serverrole is None:
772         serverrole = lp.get("server role")
773     assert serverrole in ("domain controller", "member server")
774     if invocationid is None and serverrole == "domain controller":
775         invocationid = uuid.random()
776
777     if realm is None:
778         realm = lp.get("realm")
779
780     if lp.get("realm").upper() != realm.upper():
781         raise Exception("realm '%s' in smb.conf must match chosen realm '%s'" %
782                 (lp.get("realm"), realm))
783
784     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
785     
786     if ldap_backend == "ldapi":
787         # provision-backend will set this path suggested slapd command line / fedorads.inf
788         ldap_backend = "ldapi://" % urllib.quote(os.path.join(lp.get("private dir"), "ldap", "ldapi"), safe="")
789
790     assert realm is not None
791     realm = realm.upper()
792
793     if hostname is None:
794         hostname = gethostname().split(".")[0].lower()
795
796     if hostip is None:
797         hostip = gethostbyname(hostname)
798
799     netbiosname = hostname.upper()
800     if not valid_netbios_name(netbiosname):
801         raise InvalidNetbiosName(netbiosname)
802
803     dnsdomain = realm.lower()
804     if serverrole == "domain controller":
805         domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
806         if domain is None:
807             domain = lp.get("workgroup")
808     
809         if lp.get("workgroup").upper() != domain.upper():
810             raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
811                 lp.get("workgroup"), domain)
812
813         assert domain is not None
814         domain = domain.upper()
815         if not valid_netbios_name(domain):
816             raise InvalidNetbiosName(domain)
817     else:
818         domaindn = "CN=" + netbiosname
819         domain = netbiosname
820     
821     if rootdn is None:
822        rootdn = domaindn
823        
824     configdn = "CN=Configuration," + rootdn
825     schemadn = "CN=Schema," + configdn
826
827     message("set DOMAIN SID: %s" % str(domainsid))
828     message("Provisioning for %s in realm %s" % (domain, realm))
829     message("Using administrator password: %s" % adminpass)
830
831     assert paths.smbconf is not None
832
833     # only install a new smb.conf if there isn't one there already
834     if not os.path.exists(paths.smbconf):
835         message("Setting up smb.conf")
836         if serverrole == "domain controller":
837             smbconfsuffix = "dc"
838         elif serverrole == "member server":
839             smbconfsuffix = "member"
840         setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
841                    paths.smbconf, {
842             "HOSTNAME": hostname,
843             "DOMAIN_CONF": domain,
844             "REALM_CONF": realm,
845             "SERVERROLE": serverrole,
846             "NETLOGONPATH": paths.netlogon,
847             "SYSVOLPATH": paths.sysvol,
848             })
849         lp.load(paths.smbconf)
850
851     # only install a new shares config db if there is none
852     if not os.path.exists(paths.shareconf):
853         message("Setting up share.ldb")
854         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
855                         credentials=credentials, lp=lp)
856         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
857
858      
859     message("Setting up secrets.ldb")
860     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
861                                   session_info=session_info, 
862                                   credentials=credentials, lp=lp)
863
864     message("Setting up the registry")
865     setup_registry(paths.hklm, setup_path, session_info, 
866                    credentials=credentials, lp=lp)
867
868     message("Setting up templates db")
869     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
870                       credentials=credentials, lp=lp)
871
872     message("Setting up idmap db")
873     setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
874                   credentials=credentials, lp=lp)
875
876     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
877                         credentials=credentials, lp=lp, schemadn=schemadn, 
878                         configdn=configdn, domaindn=domaindn,
879                         dnsdomain=dnsdomain, netbiosname=netbiosname, 
880                         realm=realm, message=message, hostname=hostname, 
881                         rootdn=rootdn, domainsid=domainsid, 
882                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
883                         domainname=domain, fill=samdb_fill, 
884                         adminpass=adminpass, krbtgtpass=krbtgtpass,
885                         hostguid=hostguid, invocationid=invocationid, 
886                         machinepass=machinepass, dnspass=dnspass,
887                         serverrole=serverrole, ldap_backend=ldap_backend, 
888                         ldap_backend_type=ldap_backend_type, sitename=sitename)
889
890     if lp.get("server role") == "domain controller":
891        policy_path = os.path.join(paths.sysvol, dnsdomain, "Policies", 
892                                   "{" + policyguid + "}")
893        os.makedirs(policy_path, 0755)
894        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
895        os.makedirs(os.path.join(policy_path, "User"), 0755)
896        if not os.path.isdir(paths.netlogon):
897             os.makedirs(paths.netlogon, 0755)
898        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
899                          credentials=credentials, lp=lp)
900        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=realm,
901                            netbiosname=netbiosname, domainsid=domainsid, 
902                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
903                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
904                            machinepass=machinepass, dnsdomain=dnsdomain)
905
906     if samdb_fill == FILL_FULL:
907         setup_name_mappings(samdb, str(domainsid), domaindn, root=root, 
908                             nobody=nobody, nogroup=nogroup, wheel=wheel, 
909                             users=users, backup=backup)
910    
911         message("Setting up sam.ldb rootDSE marking as synchronized")
912         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
913
914     message("Setting up phpLDAPadmin configuration")
915     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
916                                ldapi_url)
917
918     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
919
920     if lp.get("server role") == "domain controller":
921         samdb = SamDB(paths.samdb, session_info=session_info, 
922                       credentials=credentials, lp=lp)
923
924         domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
925         assert isinstance(domainguid, str)
926         hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
927                 expression="(&(objectClass=computer)(cn=%s))" % hostname,
928                 scope=SCOPE_SUBTREE)
929         assert isinstance(hostguid, str)
930
931         message("Setting up DNS zone: %s" % dnsdomain)
932         create_zone_file(paths.dns, setup_path, samdb, 
933                       hostname=hostname, hostip=hostip, dnsdomain=dnsdomain,
934                       domaindn=domaindn, dnspass=dnspass, realm=realm, 
935                       domainguid=domainguid, hostguid=hostguid)
936         message("Please install the zone located in %s into your DNS server" % paths.dns)
937
938     return domaindn
939
940
941 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
942     """Create a PHP LDAP admin configuration file.
943
944     :param path: Path to write the configuration to.
945     :param setup_path: Function to generate setup paths.
946     """
947     setup_file(setup_path("phpldapadmin-config.php"), path, 
948             {"S4_LDAPI_URI": ldapi_uri})
949
950
951 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
952                   hostip, hostname, dnspass, realm, domainguid, hostguid):
953     """Write out a DNS zone file, from the info in the current database.
954     
955     :param path: Path of the new file.
956     :param setup_path": Setup path function.
957     :param samdb: SamDB object
958     :param dnsdomain: DNS Domain name
959     :param domaindn: DN of the Domain
960     :param hostip: Local IP
961     :param hostname: Local hostname
962     :param dnspass: Password for DNS
963     :param realm: Realm name
964     :param domainguid: GUID of the domain.
965     :param hostguid: GUID of the host.
966     """
967     assert isinstance(domainguid, str)
968
969     setup_file(setup_path("provision.zone"), path, {
970             "DNSPASS_B64": b64encode(dnspass),
971             "HOSTNAME": hostname,
972             "DNSDOMAIN": dnsdomain,
973             "REALM": realm,
974             "HOSTIP": hostip,
975             "DOMAINGUID": domainguid,
976             "DATESTRING": time.strftime("%Y%m%d%H"),
977             "DEFAULTSITE": DEFAULTSITE,
978             "HOSTGUID": hostguid,
979         })
980
981
982 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
983     """Load schema for the SamDB.
984     
985     :param samdb: Load a schema into a SamDB.
986     :param setup_path: Setup path function.
987     :param schemadn: DN of the schema
988     :param netbiosname: NetBIOS name of the host.
989     :param configdn: DN of the configuration
990     """
991     schema_data = open(setup_path("schema.ldif"), 'r').read()
992     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
993     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
994     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
995     head_data = substitute_var(head_data, {
996                     "SCHEMADN": schemadn,
997                     "NETBIOSNAME": netbiosname,
998                     "CONFIGDN": configdn,
999                     "DEFAULTSITE":sitename 
1000     })
1001     samdb.attach_schema_from_ldif(head_data, schema_data)
1002