r20492: Add in instructions/sample LDIF to setup Fedora DS as a backend.
authorAndrew Bartlett <abartlet@samba.org>
Wed, 3 Jan 2007 03:19:02 +0000 (03:19 +0000)
committerGerald (Jerry) Carter <jerry@samba.org>
Wed, 10 Oct 2007 19:35:59 +0000 (14:35 -0500)
Add a new module entrypoint to handle the new, interesting and
different mappings required for Fedora DS.

Andrew Bartlett
(This used to be commit 600c7f1a68c175b835ce45d13794a6f66bcc8493)

source4/dsdb/samdb/ldb_modules/entryUUID.c
source4/scripting/libjs/provision.js
source4/setup/fedora-ds-init.ldif [new file with mode: 0644]
source4/setup/provision

index 9bd4c499fea59f20b14f00803f2887efcad0ea3f..7cd79cb730d396c35a73d98ae396acd615793ff5 100644 (file)
@@ -83,6 +83,50 @@ static struct ldb_val guid_always_string(struct ldb_module *module, TALLOC_CTX *
        return out;
 }
 
+static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
+{
+       struct GUID guid;
+       NTSTATUS status = NS_GUID_from_string((char *)val->data, &guid);
+       struct ldb_val out = data_blob(NULL, 0);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               return out;
+       }
+       status = ndr_push_struct_blob(&out, ctx, &guid, 
+                                     (ndr_push_flags_fn_t)ndr_push_GUID);
+       if (!NT_STATUS_IS_OK(status)) {
+               return out;
+       }
+
+       return out;
+}
+
+static struct ldb_val guid_ns_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
+{
+       NTSTATUS status;
+       struct ldb_val out = data_blob(NULL, 0);
+       if (val->length >= 32 && val->data[val->length] == '\0') {
+               struct GUID guid;
+               GUID_from_string((char *)val->data, &guid);
+               out = data_blob_string_const(NS_GUID_string(ctx, &guid));
+       } else {
+               struct GUID *guid_p;
+               guid_p = talloc(ctx, struct GUID);
+               if (guid_p == NULL) {
+                       return out;
+               }
+               status = ndr_pull_struct_blob(val, guid_p, guid_p, 
+                                             (ndr_pull_flags_fn_t)ndr_pull_GUID);
+               if (!NT_STATUS_IS_OK(status)) {
+                       talloc_free(guid_p);
+                       return out;
+               }
+               out = data_blob_string_const(NS_GUID_string(ctx, guid_p));
+               talloc_free(guid_p);
+       }
+       return out;
+}
+
 /* The backend holds binary sids, so just copy them back */
 static struct ldb_val val_copy(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
 {
@@ -411,6 +455,154 @@ const char * const wildcard_attributes[] = {
        NULL
 };
 
+const struct ldb_map_attribute nsuniqueid_attributes[] = 
+{
+       /* objectGUID */
+       {
+               .local_name = "objectGUID",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                               .remote_name = "nsuniqueid", 
+                               .convert_local = guid_ns_string,
+                               .convert_remote = encode_ns_guid,
+                       },
+               },
+       },
+       /* objectSid */
+       {
+               .local_name = "objectSid",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                               .remote_name = "objectSid", 
+                               .convert_local = sid_always_binary,
+                               .convert_remote = val_copy,
+                       },
+               },
+       },
+       {
+               .local_name = "whenCreated",
+               .type = MAP_RENAME,
+               .u = {
+                       .rename = {
+                                .remote_name = "createTimestamp"
+                        }
+               }
+       },
+       {
+               .local_name = "whenChanged",
+               .type = MAP_RENAME,
+               .u = {
+                       .rename = {
+                                .remote_name = "modifyTimestamp"
+                        }
+               }
+       },
+       {
+               .local_name = "sambaPassword",
+               .type = MAP_RENAME,
+               .u = {
+                       .rename = {
+                                .remote_name = "userPassword"
+                        }
+               }
+       },
+       {
+               .local_name = "allowedChildClassesEffective",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                               .remote_name = "allowedChildClassesEffective", 
+                               .convert_local = class_to_oid,
+                               .convert_remote = class_from_oid,
+                       },
+               },
+       },
+       {
+               .local_name = "objectCategory",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                               .remote_name = "objectCategory", 
+                               .convert_local = objectCategory_always_dn,
+                               .convert_remote = val_copy,
+                       },
+               },
+       },
+       {
+               .local_name = "distinguishedName",
+               .type = MAP_RENAME,
+               .u = {
+                       .rename = {
+                                .remote_name = "entryDN"
+                        }
+               }
+       },
+       {
+               .local_name = "groupType",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                                .remote_name = "groupType",
+                                .convert_local = normalise_to_signed32,
+                                .convert_remote = val_copy,
+                        },
+               }
+       },
+       {
+               .local_name = "sAMAccountType",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                                .remote_name = "sAMAccountType",
+                                .convert_local = normalise_to_signed32,
+                                .convert_remote = val_copy,
+                        },
+               }
+       },
+       {
+               .local_name = "usnChanged",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                                .remote_name = "modifyTimestamp",
+                                .convert_local = usn_to_timestamp,
+                                .convert_remote = timestamp_to_usn,
+                        },
+               },
+       },
+       {
+               .local_name = "usnCreated",
+               .type = MAP_CONVERT,
+               .u = {
+                       .convert = {
+                                .remote_name = "createTimestamp",
+                                .convert_local = usn_to_timestamp,
+                                .convert_remote = timestamp_to_usn,
+                        },
+               },
+       },
+       {
+               .local_name = "*",
+               .type = MAP_KEEP,
+       },
+       {
+               .local_name = NULL,
+       }
+};
+
+/* These things do not show up in wildcard searches in OpenLDAP, but
+ * we need them to show up in the AD-like view */
+const char * const nsuniqueid_wildcard_attributes[] = {
+       "objectGUID", 
+       "whenCreated", 
+       "whenChanged",
+       "usnCreated",
+       "usnChanged",
+       NULL
+};
+
 static struct ldb_dn *find_schema_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx) 
 {
        const char *rootdse_attrs[] = {"schemaNamingContext", NULL};
@@ -582,6 +774,41 @@ static int entryUUID_init(struct ldb_module *module)
        return ldb_next_init(module);
 }
 
+/* the context init function */
+static int nsuniqueid_init(struct ldb_module *module)
+{
+        int ret;
+       struct map_private *map_private;
+       struct entryUUID_private *entryUUID_private;
+       struct ldb_dn *schema_dn;
+
+       ret = ldb_map_init(module, nsuniqueid_attributes, NULL, nsuniqueid_wildcard_attributes, NULL);
+        if (ret != LDB_SUCCESS)
+                return ret;
+
+       map_private = talloc_get_type(module->private_data, struct map_private);
+
+       entryUUID_private = talloc_zero(map_private, struct entryUUID_private);
+       map_private->caller_private = entryUUID_private;
+
+       schema_dn = find_schema_dn(module->ldb, map_private);
+       if (!schema_dn) {
+               /* Perhaps no schema yet */
+               return LDB_SUCCESS;
+       }
+       
+       ret = fetch_objectclass_schema(module->ldb, schema_dn, entryUUID_private, 
+                                      &entryUUID_private->objectclass_res);
+       if (ret != LDB_SUCCESS) {
+               ldb_asprintf_errstring(module->ldb, "Failed to fetch objectClass schema elements: %s\n", ldb_errstring(module->ldb));
+               return ret;
+       }       
+
+       ret = find_base_dns(module, entryUUID_private);
+
+       return ldb_next_init(module);
+}
+
 static int get_seq(struct ldb_context *ldb, void *context, 
                   struct ldb_reply *ares) 
 {
@@ -678,9 +905,16 @@ static struct ldb_module_ops entryUUID_ops = {
        .sequence_number   = entryUUID_sequence_number
 };
 
+static struct ldb_module_ops nsuniqueid_ops = {
+       .name              = "nsuniqueid",
+       .init_context      = nsuniqueid_init,
+       .sequence_number   = entryUUID_sequence_number
+};
+
 /* the init function */
 int ldb_entryUUID_module_init(void)
 {
+       int ret;
        struct ldb_module_ops ops = ldb_map_get_ops();
        entryUUID_ops.add       = ops.add;
        entryUUID_ops.modify    = ops.modify;
@@ -688,5 +922,19 @@ int ldb_entryUUID_module_init(void)
        entryUUID_ops.rename    = ops.rename;
        entryUUID_ops.search    = ops.search;
        entryUUID_ops.wait      = ops.wait;
-       return ldb_register_module(&entryUUID_ops);
+       ret = ldb_register_module(&entryUUID_ops);
+
+       if (ret) {
+               return ret;
+       }
+
+       nsuniqueid_ops.add      = ops.add;
+       nsuniqueid_ops.modify   = ops.modify;
+       nsuniqueid_ops.del      = ops.del;
+       nsuniqueid_ops.rename   = ops.rename;
+       nsuniqueid_ops.search   = ops.search;
+       nsuniqueid_ops.wait     = ops.wait;
+       ret = ldb_register_module(&nsuniqueid_ops);
+
+       return ret;
 }
index c14a9da55fbde114e63075a2fb021eb6c5711854..96e55bc4ae1fdbe1b55f5f22acd0d73c184763dc 100644 (file)
@@ -698,6 +698,7 @@ function provision_guess()
        rdn_list = split(".", subobj.DNSDOMAIN);
        subobj.BASEDN       = "DC=" + join(",DC=", rdn_list);
        subobj.LDAPBACKEND  = "users.ldb";
+       subobj.LDAPMODULE = "entryUUID";
        subobj.LDAPMODULES = "objectguid";
        subobj.EXTENSIBLEOBJECT = "# no objectClass: extensibleObject for local ldb";
        return subobj;
diff --git a/source4/setup/fedora-ds-init.ldif b/source4/setup/fedora-ds-init.ldif
new file mode 100644 (file)
index 0000000..f7d350c
--- /dev/null
@@ -0,0 +1,26 @@
+# These entries need to be added to get the container for the 
+# provision to be aimed at.
+
+dn: cn="dc=tammy,dc=abartlet,dc=net",cn=mapping tree,cn=config
+objectclass: top
+objectclass: extensibleObject
+objectclass: nsMappingTree
+nsslapd-state: backend
+nsslapd-backend: UserData
+cn: dc=tammy,dc=abartlet,dc=net
+
+dn: cn=UserData,cn=ldbm database,cn=plugins,cn=config
+objectclass: extensibleObject
+objectclass: nsBackendInstance
+nsslapd-suffix: dc=tammy,dc=abartlet,dc=net
+
+# Generate 99_ad.ldif with 
+
+# bin/ad2oLschema -I setup/fedora-ds-init.ldif --option=convert:target=fedora-ds -O /opt/fedora-ds/slapd-piglett/config/schema/99_ad.ldif -H /data/samba/samba4/prefix/private/sam.ldb
+# Then install 00_staish_core.ldif 30ns-common.ldif and 99_ad.ldif
+# into /opt/fedora-ds/slapd-piglett/config/schema/
+#
+
+
+# provision with --ldap-backend=ldap://localhost:4389 --ldap-module=nsuniqueid
+
index 163cb932746de836570c590dc8bc9ace74292baf..8912b28792b4a7bd0d4dc13adbbe98e9ef9836c9 100755 (executable)
@@ -30,7 +30,8 @@ options = GetOptions(ARGV,
                'quiet',
                'blank',
                'ldap-base',
-               'ldap-backend=s');
+               'ldap-backend=s',
+                'ldap-module=s');
 
 if (options == undefined) {
    println("Failed to parse options");
@@ -79,6 +80,7 @@ provision [options]
  --blank                       do not add users or groups, just the structure
  --ldap-base                   output only an LDIF file, suitable for creating an LDAP baseDN
  --ldap-backend LDAPSERVER      LDAP server to use for this provision
+ --ldap-module= MODULE          LDB mapping module to use for the LDAP backend
 
 You must provide at least a realm and domain
 
@@ -112,7 +114,7 @@ for (r in options) {
 }
 
 if (options["ldap-backend"] != undefined) {
-       subobj["LDAPMODULES"] = "entryUUID,paged_searches";
+       subobj["LDAPMODULES"] = subobj["LDAPMODULE"] + ",paged_searches";
 }
 
 var blank = (options["blank"] != undefined);