Make the repl_meta_data module the default for domain controllers.

[samba.git] / source4 / setup / provision

diff --git a/source4/setup/provision b/source4/setup/provision
index 168fe8292f8da51a7782bb7c72f5ba6ebf3d9c07..9e135cddbb49207356041849b1fa89b681ae7009 100755 (executable)
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -15,6 +15,7 @@ options = GetOptions(ARGV,
                'domain=s',
                'domain-guid=s',
                'domain-sid=s',
+               'policy-guid=s',
                'host-name=s',
                'host-ip=s',
                'host-guid=s',
@@ -22,6 +23,7 @@ options = GetOptions(ARGV,
                'adminpass=s',
                'krbtgtpass=s',
                'machinepass=s',
+               'dnspass=s',
                'root=s',
                'nobody=s',
                'nogroup=s',
@@ -29,6 +31,8 @@ options = GetOptions(ARGV,
                'users=s',
                'quiet',
                'blank',
+               'server-role=s',
+               'partitions-only',
                'ldap-base',
                'ldap-backend=s',
                 'ldap-module=s',
@@ -68,6 +72,7 @@ provision [options]
  --host-name   HOSTNAME        set hostname
  --host-ip     IPADDRESS       set ipaddress
  --host-guid   GUID            set hostguid (otherwise random)
+ --policy-guid  GUID            set group policy guid (otherwise random)
  --invocationid        GUID            set invocationid (otherwise random)
  --adminpass   PASSWORD        choose admin password (otherwise random)
  --krbtgtpass  PASSWORD        choose krbtgt password (otherwise random)
@@ -79,10 +84,12 @@ provision [options]
  --users       GROUPNAME       choose 'users' group
  --quiet                       Be quiet
  --blank                       do not add users or groups, just the structure
+ --server-role  ROLE            Set server role to provision for (default standalone)
+ --partitions-only              Configure Samba's partitions, but do not modify them (ie, join a BDC)
  --ldap-base                   output only an LDIF file, suitable for creating an LDAP baseDN
  --ldap-backend LDAPSERVER      LDAP server to use for this provision
- --ldap-module= MODULE          LDB mapping module to use for the LDAP backend
- --aci=         ACI             An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server
+ --ldap-module  MODULE          LDB mapping module to use for the LDAP backend
+ --aci          ACI             An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server
 You must provide at least a realm and domain
 
 ");
@@ -106,6 +113,7 @@ if (options["realm"] == undefined ||
 var lp = loadparm_init();
 lp.set("realm", options.realm);
 lp.set("workgroup", options.domain);
+lp.set("server role", options["server-role"]);
 lp.reload();
 
 var subobj = provision_guess();
@@ -115,26 +123,31 @@ for (r in options) {
 }
 
 var blank = (options["blank"] != undefined);
-var ldapbase = (options["ldap-base"] != undefined);
 var ldapbackend = (options["ldap-backend"] != undefined);
 var ldapmodule = (options["ldap-module"] != undefined);
-
+var partitions_only = (options["partitions-only"] != undefined);
+var paths = provision_default_paths(subobj);
 if (options["aci"] != undefined) {
        message("set ACI: %s\n", subobj["ACI"]);
 }
 
 message("set DOMAIN SID: %s\n", subobj["DOMAINSID"]);
 
+provision_fix_subobj(subobj, paths);
+
 if (ldapbackend) {
+       if (options["ldap-backend"] == "ldapi") {
+               subobj.LDAPBACKEND = subobj.LDAPI_URI;
+       }
        if (!ldapmodule) {
-               subobj["LDAPMODULE"] = "entryUUID";
+               subobj.LDAPMODULE = "normalise,entryuuid";
+               subobj.TDB_MODULES_LIST = "";
        }
-       subobj["DOMAINDN_LDB"] = subobj["LDAPBACKEND"];
-       subobj["DOMAINDN_MOD"] = subobj["LDAPMODULE"] + ",paged_searches";
-       subobj["CONFIGDN_LDB"] = subobj["LDAPBACKEND"];
-       subobj["CONFIGDN_MOD"] = subobj["LDAPMODULE"] + ",paged_searches";
-       subobj["SCHEMADN_LDB"] = subobj["LDAPBACKEND"];
-       subobj["SCHEMADN_MOD"] = subobj["LDAPMODULE"] + ",paged_searches";
+       subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches";
+       subobj.DOMAINDN_LDB = subobj.LDAPBACKEND;
+       subobj.CONFIGDN_LDB = subobj.LDAPBACKEND;
+       subobj.SCHEMADN_LDB = subobj.LDAPBACKEND;
+       message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND);
 }
 
 if (!provision_validate(subobj, message)) {
@@ -143,14 +156,39 @@ if (!provision_validate(subobj, message)) {
 
 var system_session = system_session();
 var creds = options.get_credentials();
-var paths = provision_default_paths(subobj);
 message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM);
 message("Using administrator password: %s\n", subobj.ADMINPASS);
-if (ldapbase) {
-       provision_ldapbase(subobj, message, paths);
+if (partitions_only) {
+       provision_become_dc(subobj, message, false, paths, system_session);
 } else {
        provision(subobj, message, blank, paths, system_session, creds, ldapbackend);
        provision_dns(subobj, message, paths, system_session, creds);
+       message("To reproduce this provision, run with:\n");
+/*     There has to be a better way than this... */
+       message("--realm='%s' --domain='%s' \\\n", subobj.REALM_CONF, subobj.DOMAIN_CONF);
+       if (subobj.DOMAINGUID != undefined) {
+                message("--domain-guid='%s' \\\n", subobj.DOMAINGUID);
+       }
+       if (subobj.HOSTGUID != undefined) {
+                message("--host-guid='%s' \\\n", subobj.HOSTGUID);
+       }
+       message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP);
+       if (subobj.INVOCATIONID != undefined) {
+               message("--invocationid='%s' \\\n", subobj.INVOCATIONID);
+       }
+       message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS);
+       message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS);
+       message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP);
+       message("--wheel='%s' --users='%s' --server-role='%s' \\\n", subobj.WHEEL, subobj.USERS, subobj.SERVERROLE);
+       if (ldapbackend) {
+               message("--ldap-backend='%s' \\\n", subobj.LDAPBACKEND);
+       }
+       if (ldapmodule) {
+               message("--ldap-module='%s' \\\n", + subobj.LDAPMODULE);
+       }
+       message("--aci='" + subobj.ACI + "' \\\n")
 }
+
+
 message("All OK\n");
 return 0;