s4:provision Clarify that we set, rather than modify, objectGUID values
[ira/wip.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
8 #
9 # Based on the original in EJS:
10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
11 #
12 # This program is free software; you can redistribute it and/or modify
13 # it under the terms of the GNU General Public License as published by
14 # the Free Software Foundation; either version 3 of the License, or
15 # (at your option) any later version.
16 #   
17 # This program is distributed in the hope that it will be useful,
18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20 # GNU General Public License for more details.
21 #   
22 # You should have received a copy of the GNU General Public License
23 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 #
25
26 """Functions for setting up a Samba configuration."""
27
28 from base64 import b64encode
29 import os
30 import sys
31 import pwd
32 import grp
33 import time
34 import uuid, glue
35 import socket
36 import param
37 import registry
38 import samba
39 import subprocess
40 import ldb
41
42 import shutil
43 from credentials import Credentials, DONT_USE_KERBEROS
44 from auth import system_session, admin_session
45 from samba import version, Ldb, substitute_var, valid_netbios_name
46 from samba import check_all_substituted
47 from samba import DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, DS_DC_FUNCTION_2008
48 from samba.samdb import SamDB
49 from samba.idmap import IDmapDB
50 from samba.dcerpc import security
51 from samba.ndr import ndr_pack
52 import urllib
53 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, timestring
54 from ms_schema import read_ms_schema
55 from ms_display_specifiers import read_ms_ldif
56 from signal import SIGTERM
57 from dcerpc.misc import SEC_CHAN_BDC, SEC_CHAN_WKSTA
58
59 __docformat__ = "restructuredText"
60
61 def find_setup_dir():
62     """Find the setup directory used by provision."""
63     dirname = os.path.dirname(__file__)
64     if "/site-packages/" in dirname:
65         prefix = "/".join(dirname[:dirname.index("/site-packages/")].split("/")[:-2])
66         for suffix in ["share/setup", "share/samba/setup", "setup"]:
67             ret = os.path.join(prefix, suffix)
68             if os.path.isdir(ret):
69                 return ret
70     # In source tree
71     ret = os.path.join(dirname, "../../../setup")
72     if os.path.isdir(ret):
73         return ret
74     raise Exception("Unable to find setup directory.")
75
76 def get_schema_descriptor(domain_sid):
77     sddl = "O:SAG:SAD:(A;CI;RPLCLORC;;;AU)(A;CI;RPWPCRCCLCLORCWOWDSW;;;SA)" \
78            "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \
79            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
80            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
81            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
82            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
83            "S:(AU;SA;WPCCDCWOWDSDDTSW;;;WD)" \
84            "(AU;CISA;WP;;;WD)(AU;SA;CR;;;BA)" \
85            "(AU;SA;CR;;;DU)(OU;SA;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;WD)" \
86            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
87     sec = security.descriptor.from_sddl(sddl, domain_sid)
88     return b64encode(ndr_pack(sec))
89
90 def get_config_descriptor(domain_sid):
91     sddl = "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
92            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
93            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
94            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
95            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
96            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
97            "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
98            "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \
99            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
100            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
101            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
102            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
103            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)" \
104            "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \
105            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
106     sec = security.descriptor.from_sddl(sddl, domain_sid)
107     return b64encode(ndr_pack(sec))
108
109
110 DEFAULTSITE = "Default-First-Site-Name"
111
112 # Exception classes
113
114 class ProvisioningError(Exception):
115     """A generic provision error."""
116
117 class InvalidNetbiosName(Exception):
118     """A specified name was not a valid NetBIOS name."""
119     def __init__(self, name):
120         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
121
122
123 class ProvisionPaths(object):
124     def __init__(self):
125         self.shareconf = None
126         self.hklm = None
127         self.hkcu = None
128         self.hkcr = None
129         self.hku = None
130         self.hkpd = None
131         self.hkpt = None
132         self.samdb = None
133         self.idmapdb = None
134         self.secrets = None
135         self.keytab = None
136         self.dns_keytab = None
137         self.dns = None
138         self.winsdb = None
139         self.private_dir = None
140         self.ldapdir = None
141         self.slapdconf = None
142         self.modulesconf = None
143         self.memberofconf = None
144         self.fedoradsinf = None
145         self.fedoradspartitions = None
146         self.fedoradssasl = None
147         self.olmmron = None
148         self.olmmrserveridsconf = None
149         self.olmmrsyncreplconf = None
150         self.olcdir = None
151         self.olslapd = None
152         self.olcseedldif = None
153
154
155 class ProvisionNames(object):
156     def __init__(self):
157         self.rootdn = None
158         self.domaindn = None
159         self.configdn = None
160         self.schemadn = None
161         self.sambadn = None
162         self.ldapmanagerdn = None
163         self.dnsdomain = None
164         self.realm = None
165         self.netbiosname = None
166         self.domain = None
167         self.hostname = None
168         self.sitename = None
169         self.smbconf = None
170     
171
172 class ProvisionResult(object):
173     def __init__(self):
174         self.paths = None
175         self.domaindn = None
176         self.lp = None
177         self.samdb = None
178         
179 class Schema(object):
180     def __init__(self, setup_path, domain_sid, schemadn=None,
181                  serverdn=None, sambadn=None, ldap_backend_type=None):
182         """Load schema for the SamDB from the AD schema files and samba4_schema.ldif
183         
184         :param samdb: Load a schema into a SamDB.
185         :param setup_path: Setup path function.
186         :param schemadn: DN of the schema
187         :param serverdn: DN of the server
188         
189         Returns the schema data loaded, to avoid double-parsing when then needing to add it to the db
190         """
191         
192         self.ldb = Ldb()
193         self.schema_data = read_ms_schema(setup_path('ad-schema/MS-AD_Schema_2K8_Attributes.txt'),
194                                           setup_path('ad-schema/MS-AD_Schema_2K8_Classes.txt'))
195         self.schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
196         self.schema_data = substitute_var(self.schema_data, {"SCHEMADN": schemadn})
197         check_all_substituted(self.schema_data)
198
199         self.schema_dn_modify = read_and_sub_file(setup_path("provision_schema_basedn_modify.ldif"),
200                                                   {"SCHEMADN": schemadn,
201                                                    "SERVERDN": serverdn,
202                                                    })
203
204         descr = get_schema_descriptor(domain_sid)
205         self.schema_dn_add = read_and_sub_file(setup_path("provision_schema_basedn.ldif"),
206                                                {"SCHEMADN": schemadn,
207                                                 "DESCRIPTOR": descr
208                                                 })
209
210         prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
211         prefixmap = b64encode(prefixmap)
212
213         
214
215         # We don't actually add this ldif, just parse it
216         prefixmap_ldif = "dn: cn=schema\nprefixMap:: %s\n\n" % prefixmap
217         self.ldb.set_schema_from_ldif(prefixmap_ldif, self.schema_data)
218
219
220 # Return a hash with the forward attribute as a key and the back as the value 
221 def get_linked_attributes(schemadn,schemaldb):
222     attrs = ["linkID", "lDAPDisplayName"]
223     res = schemaldb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
224     attributes = {}
225     for i in range (0, len(res)):
226         expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
227         target = schemaldb.searchone(basedn=schemadn, 
228                                      expression=expression, 
229                                      attribute="lDAPDisplayName", 
230                                      scope=SCOPE_SUBTREE)
231         if target is not None:
232             attributes[str(res[i]["lDAPDisplayName"])]=str(target)
233             
234     return attributes
235
236 def get_dnsyntax_attributes(schemadn,schemaldb):
237     attrs = ["linkID", "lDAPDisplayName"]
238     res = schemaldb.search(expression="(&(!(linkID=*))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
239     attributes = []
240     for i in range (0, len(res)):
241         attributes.append(str(res[i]["lDAPDisplayName"]))
242         
243     return attributes
244     
245     
246 def check_install(lp, session_info, credentials):
247     """Check whether the current install seems ok.
248     
249     :param lp: Loadparm context
250     :param session_info: Session information
251     :param credentials: Credentials
252     """
253     if lp.get("realm") == "":
254         raise Exception("Realm empty")
255     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
256             credentials=credentials, lp=lp)
257     if len(ldb.search("(cn=Administrator)")) != 1:
258         raise ProvisioningError("No administrator account found")
259
260
261 def findnss(nssfn, names):
262     """Find a user or group from a list of possibilities.
263     
264     :param nssfn: NSS Function to try (should raise KeyError if not found)
265     :param names: Names to check.
266     :return: Value return by first names list.
267     """
268     for name in names:
269         try:
270             return nssfn(name)
271         except KeyError:
272             pass
273     raise KeyError("Unable to find user/group %r" % names)
274
275
276 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
277 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
278
279
280 def read_and_sub_file(file, subst_vars):
281     """Read a file and sub in variables found in it
282     
283     :param file: File to be read (typically from setup directory)
284      param subst_vars: Optional variables to subsitute in the file.
285     """
286     data = open(file, 'r').read()
287     if subst_vars is not None:
288         data = substitute_var(data, subst_vars)
289     check_all_substituted(data)
290     return data
291
292
293 def setup_add_ldif(ldb, ldif_path, subst_vars=None,controls=["relax:0"]):
294     """Setup a ldb in the private dir.
295     
296     :param ldb: LDB file to import data into
297     :param ldif_path: Path of the LDIF file to load
298     :param subst_vars: Optional variables to subsitute in LDIF.
299     :param nocontrols: Optional list of controls, can be None for no controls
300     """
301     assert isinstance(ldif_path, str)
302     data = read_and_sub_file(ldif_path, subst_vars)
303     ldb.add_ldif(data,controls)
304
305
306 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
307     """Modify a ldb in the private dir.
308     
309     :param ldb: LDB object.
310     :param ldif_path: LDIF file path.
311     :param subst_vars: Optional dictionary with substitution variables.
312     """
313     data = read_and_sub_file(ldif_path, subst_vars)
314
315     ldb.modify_ldif(data)
316
317
318 def setup_ldb(ldb, ldif_path, subst_vars):
319     """Import a LDIF a file into a LDB handle, optionally substituting variables.
320
321     :note: Either all LDIF data will be added or none (using transactions).
322
323     :param ldb: LDB file to import into.
324     :param ldif_path: Path to the LDIF file.
325     :param subst_vars: Dictionary with substitution variables.
326     """
327     assert ldb is not None
328     ldb.transaction_start()
329     try:
330         setup_add_ldif(ldb, ldif_path, subst_vars)
331     except:
332         ldb.transaction_cancel()
333         raise
334     ldb.transaction_commit()
335
336
337 def setup_file(template, fname, subst_vars):
338     """Setup a file in the private dir.
339
340     :param template: Path of the template file.
341     :param fname: Path of the file to create.
342     :param subst_vars: Substitution variables.
343     """
344     f = fname
345
346     if os.path.exists(f):
347         os.unlink(f)
348
349     data = read_and_sub_file(template, subst_vars)
350     open(f, 'w').write(data)
351
352
353 def provision_paths_from_lp(lp, dnsdomain):
354     """Set the default paths for provisioning.
355
356     :param lp: Loadparm context.
357     :param dnsdomain: DNS Domain name
358     """
359     paths = ProvisionPaths()
360     paths.private_dir = lp.get("private dir")
361     paths.dns_keytab = "dns.keytab"
362
363     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
364     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
365     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
366     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
367     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
368     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
369     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
370     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
371     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
372     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
373     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
374                                             "phpldapadmin-config.php")
375     paths.ldapdir = os.path.join(paths.private_dir, 
376                                  "ldap")
377     paths.slapdconf = os.path.join(paths.ldapdir, 
378                                    "slapd.conf")
379     paths.slapdpid = os.path.join(paths.ldapdir, 
380                                    "slapd.pid")
381     paths.modulesconf = os.path.join(paths.ldapdir, 
382                                      "modules.conf")
383     paths.memberofconf = os.path.join(paths.ldapdir, 
384                                       "memberof.conf")
385     paths.fedoradsinf = os.path.join(paths.ldapdir, 
386                                      "fedorads.inf")
387     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
388                                             "fedorads-partitions.ldif")
389     paths.fedoradssasl = os.path.join(paths.ldapdir, 
390                                       "fedorads-sasl.ldif")
391     paths.fedoradssamba = os.path.join(paths.ldapdir, 
392                                         "fedorads-samba.ldif")
393     paths.olmmrserveridsconf = os.path.join(paths.ldapdir, 
394                                             "mmr_serverids.conf")
395     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir, 
396                                            "mmr_syncrepl.conf")
397     paths.olcdir = os.path.join(paths.ldapdir, 
398                                  "slapd.d")
399     paths.olcseedldif = os.path.join(paths.ldapdir, 
400                                  "olc_seed.ldif")
401     paths.hklm = "hklm.ldb"
402     paths.hkcr = "hkcr.ldb"
403     paths.hkcu = "hkcu.ldb"
404     paths.hku = "hku.ldb"
405     paths.hkpd = "hkpd.ldb"
406     paths.hkpt = "hkpt.ldb"
407
408     paths.sysvol = lp.get("path", "sysvol")
409
410     paths.netlogon = lp.get("path", "netlogon")
411
412     paths.smbconf = lp.configfile
413
414     return paths
415
416
417 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
418                 serverrole=None, rootdn=None, domaindn=None, configdn=None,
419                 schemadn=None, serverdn=None, sitename=None, sambadn=None):
420     """Guess configuration settings to use."""
421
422     if hostname is None:
423         hostname = socket.gethostname().split(".")[0].lower()
424
425     netbiosname = hostname.upper()
426     if not valid_netbios_name(netbiosname):
427         raise InvalidNetbiosName(netbiosname)
428
429     hostname = hostname.lower()
430
431     if dnsdomain is None:
432         dnsdomain = lp.get("realm")
433
434     if serverrole is None:
435         serverrole = lp.get("server role")
436
437     assert dnsdomain is not None
438     realm = dnsdomain.upper()
439
440     if lp.get("realm").upper() != realm:
441         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
442                         (lp.get("realm"), lp.configfile, realm))
443     
444     dnsdomain = dnsdomain.lower()
445
446     if serverrole == "domain controller":
447         if domain is None:
448             domain = lp.get("workgroup")
449         if domaindn is None:
450             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
451         if lp.get("workgroup").upper() != domain.upper():
452             raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
453                         lp.get("workgroup"), domain)
454     else:
455         domain = netbiosname
456         if domaindn is None:
457             domaindn = "CN=" + netbiosname
458         
459     assert domain is not None
460     domain = domain.upper()
461     if not valid_netbios_name(domain):
462         raise InvalidNetbiosName(domain)
463         
464     if netbiosname.upper() == realm.upper():
465         raise Exception("realm %s must not be equal to netbios domain name %s", realm, netbiosname)
466         
467     if hostname.upper() == realm.upper():
468         raise Exception("realm %s must not be equal to hostname %s", realm, hostname)
469         
470     if domain.upper() == realm.upper():
471         raise Exception("realm %s must not be equal to domain name %s", realm, domain)
472
473     if rootdn is None:
474        rootdn = domaindn
475        
476     if configdn is None:
477         configdn = "CN=Configuration," + rootdn
478     if schemadn is None:
479         schemadn = "CN=Schema," + configdn
480     if sambadn is None:
481         sambadn = "CN=Samba"
482
483     if sitename is None:
484         sitename=DEFAULTSITE
485
486     names = ProvisionNames()
487     names.rootdn = rootdn
488     names.domaindn = domaindn
489     names.configdn = configdn
490     names.schemadn = schemadn
491     names.sambadn = sambadn
492     names.ldapmanagerdn = "CN=Manager," + rootdn
493     names.dnsdomain = dnsdomain
494     names.domain = domain
495     names.realm = realm
496     names.netbiosname = netbiosname
497     names.hostname = hostname
498     names.sitename = sitename
499     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
500  
501     return names
502     
503
504 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
505                  targetdir):
506     """Create a new smb.conf file based on a couple of basic settings.
507     """
508     assert smbconf is not None
509     if hostname is None:
510         hostname = socket.gethostname().split(".")[0].lower()
511
512     if serverrole is None:
513         serverrole = "standalone"
514
515     assert serverrole in ("domain controller", "member server", "standalone")
516     if serverrole == "domain controller":
517         smbconfsuffix = "dc"
518     elif serverrole == "member server":
519         smbconfsuffix = "member"
520     elif serverrole == "standalone":
521         smbconfsuffix = "standalone"
522
523     assert domain is not None
524     assert realm is not None
525
526     default_lp = param.LoadParm()
527     #Load non-existant file
528     if os.path.exists(smbconf):
529         default_lp.load(smbconf)
530     
531     if targetdir is not None:
532         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
533         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
534
535         default_lp.set("lock dir", os.path.abspath(targetdir))
536     else:
537         privatedir_line = ""
538         lockdir_line = ""
539
540     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
541     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
542
543     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
544                smbconf, {
545             "HOSTNAME": hostname,
546             "DOMAIN": domain,
547             "REALM": realm,
548             "SERVERROLE": serverrole,
549             "NETLOGONPATH": netlogon,
550             "SYSVOLPATH": sysvol,
551             "PRIVATEDIR_LINE": privatedir_line,
552             "LOCKDIR_LINE": lockdir_line
553             })
554
555
556 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
557                         users_gid, wheel_gid):
558     """setup reasonable name mappings for sam names to unix names.
559
560     :param samdb: SamDB object.
561     :param idmap: IDmap db object.
562     :param sid: The domain sid.
563     :param domaindn: The domain DN.
564     :param root_uid: uid of the UNIX root user.
565     :param nobody_uid: uid of the UNIX nobody user.
566     :param users_gid: gid of the UNIX users group.
567     :param wheel_gid: gid of the UNIX wheel group."""
568
569     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
570     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
571     
572     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
573     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
574
575 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
576                            credentials, names,
577                            serverrole, ldap_backend=None, 
578                            erase=False):
579     """Setup the partitions for the SAM database. 
580     
581     Alternatively, provision() may call this, and then populate the database.
582     
583     :note: This will wipe the Sam Database!
584     
585     :note: This function always removes the local SAM LDB file. The erase 
586         parameter controls whether to erase the existing data, which 
587         may not be stored locally but in LDAP.
588     """
589     assert session_info is not None
590
591     # We use options=["modules:"] to stop the modules loading - we
592     # just want to wipe and re-initialise the database, not start it up
593
594     try:
595         samdb = Ldb(url=samdb_path, session_info=session_info, 
596                       credentials=credentials, lp=lp, options=["modules:"])
597         # Wipes the database
598         samdb.erase_except_schema_controlled()
599     except LdbError:
600         os.unlink(samdb_path)
601         samdb = Ldb(url=samdb_path, session_info=session_info, 
602                       credentials=credentials, lp=lp, options=["modules:"])
603          # Wipes the database
604         samdb.erase_except_schema_controlled()
605         
606
607     #Add modules to the list to activate them by default
608     #beware often order is important
609     #
610     # Some Known ordering constraints:
611     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
612     # - objectclass must be before password_hash, because password_hash checks
613     #   that the objectclass is of type person (filled in by objectclass
614     #   module when expanding the objectclass list)
615     # - partition must be last
616     # - each partition has its own module list then
617     modules_list = ["resolve_oids",
618                     "rootdse",
619                     "lazy_commit",
620                     "acl",
621                     "paged_results",
622                     "ranged_results",
623                     "anr",
624                     "server_sort",
625                     "asq",
626                     "extended_dn_store",
627                     "extended_dn_in",
628                     "rdn_name",
629                     "objectclass",
630                     "descriptor",
631                     "samldb",
632                     "password_hash",
633                     "operational",
634                     "kludge_acl", 
635                     "instancetype"]
636     tdb_modules_list = [
637                     "subtree_rename",
638                     "subtree_delete",
639                     "linked_attributes",
640                     "extended_dn_out_ldb"]
641     modules_list2 = ["show_deleted",
642                     "partition"]
643  
644     domaindn_ldb = "users.ldb"
645     configdn_ldb = "configuration.ldb"
646     schemadn_ldb = "schema.ldb"
647     if ldap_backend is not None:
648         domaindn_ldb = ldap_backend.ldapi_uri
649         configdn_ldb = ldap_backend.ldapi_uri
650         schemadn_ldb = ldap_backend.ldapi_uri
651         
652         if ldap_backend.ldap_backend_type == "fedora-ds":
653             backend_modules = ["nsuniqueid", "paged_searches"]
654             # We can handle linked attributes here, as we don't have directory-side subtree operations
655             tdb_modules_list = ["linked_attributes", "extended_dn_out_dereference"]
656         elif ldap_backend.ldap_backend_type == "openldap":
657             backend_modules = ["entryuuid", "paged_searches"]
658             # OpenLDAP handles subtree renames, so we don't want to do any of these things
659             tdb_modules_list = ["extended_dn_out_dereference"]
660
661     elif serverrole == "domain controller":
662         tdb_modules_list.insert(0, "repl_meta_data")
663         backend_modules = []
664     else:
665         backend_modules = ["objectguid"]
666
667     if tdb_modules_list is None:
668         tdb_modules_list_as_string = ""
669     else:
670         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
671         
672     samdb.transaction_start()
673     try:
674         message("Setting up sam.ldb partitions and settings")
675         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
676                 "SCHEMADN": names.schemadn, 
677                 "SCHEMADN_LDB": schemadn_ldb,
678                 "SCHEMADN_MOD2": ",objectguid",
679                 "CONFIGDN": names.configdn,
680                 "CONFIGDN_LDB": configdn_ldb,
681                 "DOMAINDN": names.domaindn,
682                 "DOMAINDN_LDB": domaindn_ldb,
683                 "SCHEMADN_MOD": "schema_fsmo",
684                 "CONFIGDN_MOD": "naming_fsmo",
685                 "DOMAINDN_MOD": "pdc_fsmo",
686                 "MODULES_LIST": ",".join(modules_list),
687                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
688                 "MODULES_LIST2": ",".join(modules_list2),
689                 "BACKEND_MOD": ",".join(backend_modules),
690         })
691
692         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
693
694         message("Setting up sam.ldb rootDSE")
695         setup_samdb_rootdse(samdb, setup_path, names)
696
697     except:
698         samdb.transaction_cancel()
699         raise
700
701     samdb.transaction_commit()
702     
703 def secretsdb_self_join(secretsdb, domain, 
704                         netbiosname, domainsid, machinepass, 
705                         realm=None, dnsdomain=None,
706                         keytab_path=None, 
707                         key_version_number=1,
708                         secure_channel_type=SEC_CHAN_WKSTA):
709     """Add domain join-specific bits to a secrets database.
710     
711     :param secretsdb: Ldb Handle to the secrets database
712     :param machinepass: Machine password
713     """
714     attrs=["whenChanged",
715            "secret",
716            "priorSecret",
717            "priorChanged",
718            "krb5Keytab",
719            "privateKeytab"]
720     
721
722     msg = ldb.Message(ldb.Dn(secretsdb, "flatname=%s,cn=Primary Domains" % domain));
723     msg["secureChannelType"] = str(secure_channel_type)
724     msg["flatname"] = [domain]
725     msg["objectClass"] = ["top", "primaryDomain"]
726     if realm is not None:
727       if dnsdomain is None:
728         dnsdomain = realm.lower()
729       msg["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
730       msg["realm"] = realm
731       msg["saltPrincipal"] = "host/%s.%s@%s" % (netbiosname.lower(), dnsdomain.lower(), realm.upper())
732       msg["msDS-KeyVersionNumber"] = [str(key_version_number)]
733       msg["privateKeytab"] = ["secrets.keytab"];
734
735
736     msg["secret"] = [machinepass]
737     msg["samAccountName"] = ["%s$" % netbiosname]
738     msg["secureChannelType"] = [str(secure_channel_type)]
739     msg["objectSid"] = [ndr_pack(domainsid)]
740     
741     res = secretsdb.search(base="cn=Primary Domains", 
742                            attrs=attrs, 
743                            expression=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain))" % (domain, realm, str(domainsid))), 
744                            scope=SCOPE_ONELEVEL)
745     
746     for del_msg in res:
747       if del_msg.dn is not msg.dn:
748         secretsdb.delete(del_msg.dn)
749
750     res = secretsdb.search(base=msg.dn, attrs=attrs, scope=SCOPE_BASE)
751
752     if len(res) == 1:
753       msg["priorSecret"] = res[0]["secret"]
754       msg["priorWhenChanged"] = res[0]["whenChanged"]
755
756       if res["privateKeytab"] is not None:
757         msg["privateKeytab"] = res[0]["privateKeytab"]
758
759       if res["krb5Keytab"] is not None:
760         msg["krb5Keytab"] = res[0]["krb5Keytab"]
761
762       for el in msg:
763         el.set_flags(ldb.FLAG_MOD_REPLACE)
764         secretsdb.modify(msg)
765     else:
766       secretsdb.add(msg)
767
768
769 def secretsdb_setup_dns(secretsdb, setup_path, realm, dnsdomain, 
770                         dns_keytab_path, dnspass):
771     """Add DNS specific bits to a secrets database.
772     
773     :param secretsdb: Ldb Handle to the secrets database
774     :param setup_path: Setup path function
775     :param machinepass: Machine password
776     """
777     setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), { 
778             "REALM": realm,
779             "DNSDOMAIN": dnsdomain,
780             "DNS_KEYTAB": dns_keytab_path,
781             "DNSPASS_B64": b64encode(dnspass),
782             })
783
784
785 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
786     """Setup the secrets database.
787
788     :param path: Path to the secrets database.
789     :param setup_path: Get the path to a setup file.
790     :param session_info: Session info.
791     :param credentials: Credentials
792     :param lp: Loadparm context
793     :return: LDB handle for the created secrets database
794     """
795     if os.path.exists(path):
796         os.unlink(path)
797     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
798                       lp=lp)
799     secrets_ldb.erase()
800     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
801     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
802                       lp=lp)
803     secrets_ldb.transaction_start()
804     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
805
806     if credentials is not None and credentials.authentication_requested():
807         if credentials.get_bind_dn() is not None:
808             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
809                     "LDAPMANAGERDN": credentials.get_bind_dn(),
810                     "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
811                     })
812         else:
813             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
814                     "LDAPADMINUSER": credentials.get_username(),
815                     "LDAPADMINREALM": credentials.get_realm(),
816                     "LDAPADMINPASS_B64": b64encode(credentials.get_password())
817                     })
818
819     return secrets_ldb
820
821 def setup_registry(path, setup_path, session_info, lp):
822     """Setup the registry.
823     
824     :param path: Path to the registry database
825     :param setup_path: Function that returns the path to a setup.
826     :param session_info: Session information
827     :param credentials: Credentials
828     :param lp: Loadparm context
829     """
830     reg = registry.Registry()
831     hive = registry.open_ldb(path, session_info=session_info, 
832                          lp_ctx=lp)
833     reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
834     provision_reg = setup_path("provision.reg")
835     assert os.path.exists(provision_reg)
836     reg.diff_apply(provision_reg)
837
838
839 def setup_idmapdb(path, setup_path, session_info, lp):
840     """Setup the idmap database.
841
842     :param path: path to the idmap database
843     :param setup_path: Function that returns a path to a setup file
844     :param session_info: Session information
845     :param credentials: Credentials
846     :param lp: Loadparm context
847     """
848     if os.path.exists(path):
849         os.unlink(path)
850
851     idmap_ldb = IDmapDB(path, session_info=session_info,
852                         lp=lp)
853
854     idmap_ldb.erase()
855     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
856     return idmap_ldb
857
858
859 def setup_samdb_rootdse(samdb, setup_path, names):
860     """Setup the SamDB rootdse.
861
862     :param samdb: Sam Database handle
863     :param setup_path: Obtain setup path
864     """
865     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
866         "SCHEMADN": names.schemadn, 
867         "NETBIOSNAME": names.netbiosname,
868         "DNSDOMAIN": names.dnsdomain,
869         "REALM": names.realm,
870         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
871         "DOMAINDN": names.domaindn,
872         "ROOTDN": names.rootdn,
873         "CONFIGDN": names.configdn,
874         "SERVERDN": names.serverdn,
875         })
876         
877
878 def setup_self_join(samdb, names,
879                     machinepass, dnspass, 
880                     domainsid, invocationid, setup_path,
881                     policyguid, policyguid_dc, domainControllerFunctionality,
882                     ntdsguid):
883     """Join a host to its own domain."""
884     assert isinstance(invocationid, str)
885     if ntdsguid is not None:
886         ntdsguid_line = "objectGUID: %s\n"%ntdsguid
887     else:
888         ntdsguid_line = ""
889     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
890               "CONFIGDN": names.configdn, 
891               "SCHEMADN": names.schemadn,
892               "DOMAINDN": names.domaindn,
893               "SERVERDN": names.serverdn,
894               "INVOCATIONID": invocationid,
895               "NETBIOSNAME": names.netbiosname,
896               "DEFAULTSITE": names.sitename,
897               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
898               "MACHINEPASS_B64": b64encode(machinepass),
899               "DNSPASS_B64": b64encode(dnspass),
900               "REALM": names.realm,
901               "DOMAIN": names.domain,
902               "DNSDOMAIN": names.dnsdomain,
903               "SAMBA_VERSION_STRING": version,
904               "NTDSGUID": ntdsguid_line,
905               "DOMAIN_CONTROLLER_FUNCTIONALITY": str(domainControllerFunctionality)})
906
907     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
908               "POLICYGUID": policyguid,
909               "POLICYGUID_DC": policyguid_dc,
910               "DNSDOMAIN": names.dnsdomain,
911               "DOMAINSID": str(domainsid),
912               "DOMAINDN": names.domaindn})
913     
914     # add the NTDSGUID based SPNs
915     ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
916     names.ntdsguid = samdb.searchone(basedn=ntds_dn, attribute="objectGUID",
917                                      expression="", scope=SCOPE_BASE)
918     assert isinstance(names.ntdsguid, str)
919
920     # Setup fSMORoleOwner entries to point at the newly created DC entry
921     setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
922               "DOMAIN": names.domain,
923               "DNSDOMAIN": names.dnsdomain,
924               "DOMAINDN": names.domaindn,
925               "CONFIGDN": names.configdn,
926               "SCHEMADN": names.schemadn, 
927               "DEFAULTSITE": names.sitename,
928               "SERVERDN": names.serverdn,
929               "NETBIOSNAME": names.netbiosname,
930               "NTDSGUID": names.ntdsguid
931               })
932
933
934 def setup_samdb(path, setup_path, session_info, credentials, lp, 
935                 names, message, 
936                 domainsid, domainguid, policyguid, policyguid_dc,
937                 fill, adminpass, krbtgtpass, 
938                 machinepass, invocationid, dnspass, ntdsguid,
939                 serverrole, dom_for_fun_level=None,
940                 schema=None, ldap_backend=None):
941     """Setup a complete SAM Database.
942     
943     :note: This will wipe the main SAM database file!
944     """
945
946     # ATTENTION: Do NOT change these default values without discussion with the
947     # team and/or release manager. They have a big impact on the whole program!
948     domainControllerFunctionality = DS_DC_FUNCTION_2008
949
950     if dom_for_fun_level is None:
951         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
952     if dom_for_fun_level < DS_DOMAIN_FUNCTION_2003:
953         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level lower than Windows 2003 (Native). This isn't supported!")
954
955     if dom_for_fun_level > domainControllerFunctionality:
956         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008). This won't work!")
957
958     domainFunctionality = dom_for_fun_level
959     forestFunctionality = dom_for_fun_level
960
961     # Also wipes the database
962     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
963                            credentials=credentials, session_info=session_info,
964                            names=names, ldap_backend=ldap_backend,
965                            serverrole=serverrole)
966
967     if (schema == None):
968         schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
969             sambadn=names.sambadn, ldap_backend_type=ldap_backend.ldap_backend_type)
970
971     # Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
972     samdb = Ldb(session_info=session_info, 
973                 credentials=credentials, lp=lp)
974
975     message("Pre-loading the Samba 4 and AD schema")
976
977     # Load the schema from the one we computed earlier
978     samdb.set_schema_from_ldb(schema.ldb)
979
980     # And now we can connect to the DB - the schema won't be loaded from the DB
981     samdb.connect(path)
982
983     # Load @OPTIONS
984     samdb.load_ldif_file_add(setup_path("provision_options.ldif"))
985
986     if fill == FILL_DRS:
987         return samdb
988
989     samdb.transaction_start()
990     try:
991         message("Erasing data from partitions")
992         # Load the schema (again).  This time it will force a reindex,
993         # and will therefore make the erase_partitions() below
994         # computationally sane
995         samdb.set_schema_from_ldb(schema.ldb)
996         samdb.erase_partitions()
997     
998         # Set the domain functionality levels onto the database.
999         # Various module (the password_hash module in particular) need
1000         # to know what level of AD we are emulating.
1001
1002         # These will be fixed into the database via the database
1003         # modifictions below, but we need them set from the start.
1004         samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
1005         samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
1006         samdb.set_opaque_integer("domainControllerFunctionality", domainControllerFunctionality)
1007
1008         samdb.set_domain_sid(str(domainsid))
1009         if serverrole == "domain controller":
1010             samdb.set_invocation_id(invocationid)
1011
1012         message("Adding DomainDN: %s" % names.domaindn)
1013         if serverrole == "domain controller":
1014             domain_oc = "domainDNS"
1015         else:
1016             domain_oc = "samba4LocalDomain"
1017
1018 #impersonate domain admin
1019         admin_session_info = admin_session(lp, str(domainsid))
1020         samdb.set_session_info(admin_session_info)
1021         if domainguid is not None:
1022             domainguid_line = "objectGUID: %s\n-" % domainguid
1023         else:
1024             domainguid_line = ""
1025         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
1026                 "DOMAINDN": names.domaindn,
1027                 "DOMAIN_OC": domain_oc,
1028                 "DOMAINGUID": domainguid_line
1029                 })
1030
1031
1032         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
1033             "CREATTIME": str(int(time.time()) * 1e7), # seconds -> ticks
1034             "DOMAINSID": str(domainsid),
1035             "SCHEMADN": names.schemadn, 
1036             "NETBIOSNAME": names.netbiosname,
1037             "DEFAULTSITE": names.sitename,
1038             "CONFIGDN": names.configdn,
1039             "SERVERDN": names.serverdn,
1040             "POLICYGUID": policyguid,
1041             "DOMAINDN": names.domaindn,
1042             "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
1043             "SAMBA_VERSION_STRING": version
1044             })
1045
1046         message("Adding configuration container")
1047         descr = get_config_descriptor(domainsid);
1048         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
1049             "CONFIGDN": names.configdn, 
1050             "DESCRIPTOR": descr,
1051             })
1052         message("Modifying configuration container")
1053         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
1054             "CONFIGDN": names.configdn, 
1055             "SCHEMADN": names.schemadn,
1056             })
1057
1058         # The LDIF here was created when the Schema object was constructed
1059         message("Setting up sam.ldb schema")
1060         samdb.add_ldif(schema.schema_dn_add, controls=["relax:0"])
1061         samdb.modify_ldif(schema.schema_dn_modify)
1062         samdb.write_prefixes_from_schema()
1063         samdb.add_ldif(schema.schema_data, controls=["relax:0"])
1064         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"), 
1065                        {"SCHEMADN": names.schemadn})
1066
1067         message("Setting up sam.ldb configuration data")
1068         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
1069             "CONFIGDN": names.configdn,
1070             "NETBIOSNAME": names.netbiosname,
1071             "DEFAULTSITE": names.sitename,
1072             "DNSDOMAIN": names.dnsdomain,
1073             "DOMAIN": names.domain,
1074             "SCHEMADN": names.schemadn,
1075             "DOMAINDN": names.domaindn,
1076             "SERVERDN": names.serverdn,
1077             "FOREST_FUNCTIONALALITY": str(forestFunctionality)
1078             })
1079
1080         message("Setting up display specifiers")
1081         display_specifiers_ldif = read_ms_ldif(setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
1082         display_specifiers_ldif = substitute_var(display_specifiers_ldif, {"CONFIGDN": names.configdn})
1083         check_all_substituted(display_specifiers_ldif)
1084         samdb.add_ldif(display_specifiers_ldif)
1085
1086         message("Adding users container")
1087         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
1088                 "DOMAINDN": names.domaindn})
1089         message("Modifying users container")
1090         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
1091                 "DOMAINDN": names.domaindn})
1092         message("Adding computers container")
1093         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
1094                 "DOMAINDN": names.domaindn})
1095         message("Modifying computers container")
1096         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
1097                 "DOMAINDN": names.domaindn})
1098         message("Setting up sam.ldb data")
1099         setup_add_ldif(samdb, setup_path("provision.ldif"), {
1100             "CREATTIME": str(int(time.time()) * 1e7), # seconds -> ticks
1101             "DOMAINDN": names.domaindn,
1102             "NETBIOSNAME": names.netbiosname,
1103             "DEFAULTSITE": names.sitename,
1104             "CONFIGDN": names.configdn,
1105             "SERVERDN": names.serverdn,
1106             "POLICYGUID_DC": policyguid_dc
1107             })
1108
1109         if fill == FILL_FULL:
1110             message("Setting up sam.ldb users and groups")
1111             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
1112                 "DOMAINDN": names.domaindn,
1113                 "DOMAINSID": str(domainsid),
1114                 "CONFIGDN": names.configdn,
1115                 "ADMINPASS_B64": b64encode(adminpass),
1116                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
1117                 })
1118
1119             if serverrole == "domain controller":
1120                 message("Setting up self join")
1121                 setup_self_join(samdb, names=names, invocationid=invocationid, 
1122                                 dnspass=dnspass,  
1123                                 machinepass=machinepass, 
1124                                 domainsid=domainsid, policyguid=policyguid,
1125                                 policyguid_dc=policyguid_dc,
1126                                 setup_path=setup_path,
1127                                 domainControllerFunctionality=domainControllerFunctionality,
1128                                 ntdsguid=ntdsguid)
1129
1130                 ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
1131                 names.ntdsguid = samdb.searchone(basedn=ntds_dn,
1132                   attribute="objectGUID", expression="", scope=SCOPE_BASE)
1133                 assert isinstance(names.ntdsguid, str)
1134
1135     except:
1136         samdb.transaction_cancel()
1137         raise
1138
1139     samdb.transaction_commit()
1140     return samdb
1141
1142
1143 FILL_FULL = "FULL"
1144 FILL_NT4SYNC = "NT4SYNC"
1145 FILL_DRS = "DRS"
1146
1147
1148 def provision(setup_dir, message, session_info, 
1149               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
1150               realm=None, 
1151               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
1152               serverdn=None,
1153               domain=None, hostname=None, hostip=None, hostip6=None, 
1154               domainsid=None, adminpass=None, ldapadminpass=None, 
1155               krbtgtpass=None, domainguid=None, 
1156               policyguid=None, policyguid_dc=None, invocationid=None,
1157               machinepass=None, ntdsguid=None,
1158               dnspass=None, root=None, nobody=None, users=None, 
1159               wheel=None, backup=None, aci=None, serverrole=None,
1160               dom_for_fun_level=None,
1161               ldap_backend_extra_port=None, ldap_backend_type=None,
1162               sitename=None,
1163               ol_mmr_urls=None, ol_olc=None, 
1164               setup_ds_path=None, slapd_path=None, nosync=False,
1165               ldap_dryrun_mode=False):
1166     """Provision samba4
1167     
1168     :note: caution, this wipes all existing data!
1169     """
1170
1171     def setup_path(file):
1172       return os.path.join(setup_dir, file)
1173
1174     if domainsid is None:
1175       domainsid = security.random_sid()
1176     else:
1177       domainsid = security.dom_sid(domainsid)
1178
1179     # create/adapt the group policy GUIDs
1180     if policyguid is None:
1181         policyguid = str(uuid.uuid4())
1182     policyguid = policyguid.upper()
1183     if policyguid_dc is None:
1184         policyguid_dc = str(uuid.uuid4())
1185     policyguid_dc = policyguid_dc.upper()
1186
1187     if adminpass is None:
1188         adminpass = glue.generate_random_str(12)
1189     if krbtgtpass is None:
1190         krbtgtpass = glue.generate_random_str(12)
1191     if machinepass is None:
1192         machinepass  = glue.generate_random_str(12)
1193     if dnspass is None:
1194         dnspass = glue.generate_random_str(12)
1195     if ldapadminpass is None:
1196         #Make a new, random password between Samba and it's LDAP server
1197         ldapadminpass=glue.generate_random_str(12)        
1198
1199
1200     root_uid = findnss_uid([root or "root"])
1201     nobody_uid = findnss_uid([nobody or "nobody"])
1202     users_gid = findnss_gid([users or "users"])
1203     if wheel is None:
1204         wheel_gid = findnss_gid(["wheel", "adm"])
1205     else:
1206         wheel_gid = findnss_gid([wheel])
1207
1208     if targetdir is not None:
1209         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1210             os.makedirs(os.path.join(targetdir, "etc"))
1211         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1212     elif smbconf is None:
1213         smbconf = param.default_path()
1214
1215     # only install a new smb.conf if there isn't one there already
1216     if not os.path.exists(smbconf):
1217         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
1218                      targetdir)
1219
1220     lp = param.LoadParm()
1221     lp.load(smbconf)
1222
1223     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
1224                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
1225                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
1226                         serverdn=serverdn)
1227
1228     paths = provision_paths_from_lp(lp, names.dnsdomain)
1229
1230     if hostip is None:
1231         try:
1232             hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1233         except socket.gaierror, (socket.EAI_NODATA, msg):
1234             hostip = None
1235
1236     if hostip6 is None:
1237         try:
1238             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1239         except socket.gaierror, (socket.EAI_NODATA, msg): 
1240             hostip6 = None
1241
1242     if serverrole is None:
1243         serverrole = lp.get("server role")
1244
1245     assert serverrole in ("domain controller", "member server", "standalone")
1246     if invocationid is None and serverrole == "domain controller":
1247         invocationid = str(uuid.uuid4())
1248
1249     if not os.path.exists(paths.private_dir):
1250         os.mkdir(paths.private_dir)
1251
1252     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1253     
1254     schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
1255         sambadn=names.sambadn, ldap_backend_type=ldap_backend_type)
1256     
1257     secrets_credentials = credentials
1258     provision_backend = None
1259     if ldap_backend_type:
1260         # We only support an LDAP backend over ldapi://
1261
1262         provision_backend = ProvisionBackend(paths=paths, setup_path=setup_path,
1263                                              lp=lp, credentials=credentials, 
1264                                              names=names,
1265                                              message=message, hostname=hostname,
1266                                              root=root, schema=schema,
1267                                              ldap_backend_type=ldap_backend_type,
1268                                              ldapadminpass=ldapadminpass,
1269                                              ldap_backend_extra_port=ldap_backend_extra_port,
1270                                              ol_mmr_urls=ol_mmr_urls, 
1271                                              slapd_path=slapd_path,
1272                                              setup_ds_path=setup_ds_path,
1273                                              ldap_dryrun_mode=ldap_dryrun_mode)
1274
1275         # Now use the backend credentials to access the databases
1276         credentials = provision_backend.credentials
1277         secrets_credentials = provision_backend.adminCredentials
1278         ldapi_url = provision_backend.ldapi_uri
1279
1280     # only install a new shares config db if there is none
1281     if not os.path.exists(paths.shareconf):
1282         message("Setting up share.ldb")
1283         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
1284                         credentials=credentials, lp=lp)
1285         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1286
1287      
1288     message("Setting up secrets.ldb")
1289     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
1290                                   session_info=session_info, 
1291                                   credentials=secrets_credentials, lp=lp)
1292
1293     message("Setting up the registry")
1294     setup_registry(paths.hklm, setup_path, session_info, 
1295                    lp=lp)
1296
1297     message("Setting up idmap db")
1298     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1299                           lp=lp)
1300
1301     message("Setting up SAM db")
1302     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
1303                         credentials=credentials, lp=lp, names=names,
1304                         message=message, 
1305                         domainsid=domainsid, 
1306                         schema=schema, domainguid=domainguid,
1307                         policyguid=policyguid, policyguid_dc=policyguid_dc,
1308                         fill=samdb_fill, 
1309                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1310                         invocationid=invocationid, 
1311                         machinepass=machinepass, dnspass=dnspass, 
1312                         ntdsguid=ntdsguid, serverrole=serverrole,
1313                         dom_for_fun_level=dom_for_fun_level,
1314                         ldap_backend=provision_backend)
1315
1316     if serverrole == "domain controller":
1317         if paths.netlogon is None:
1318             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1319             message("Please either remove %s or see the template at %s" % 
1320                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1321             assert(paths.netlogon is not None)
1322
1323         if paths.sysvol is None:
1324             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1325             message("Please either remove %s or see the template at %s" % 
1326                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1327             assert(paths.sysvol is not None)            
1328             
1329         # Set up group policies (domain policy and domain controller policy)
1330
1331         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1332                                    "{" + policyguid + "}")
1333         os.makedirs(policy_path, 0755)
1334         open(os.path.join(policy_path, "GPT.INI"), 'w').write(
1335                                    "[General]\r\nVersion=65543")
1336         os.makedirs(os.path.join(policy_path, "MACHINE"), 0755)
1337         os.makedirs(os.path.join(policy_path, "USER"), 0755)
1338
1339         policy_path_dc = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1340                                    "{" + policyguid_dc + "}")
1341         os.makedirs(policy_path_dc, 0755)
1342         open(os.path.join(policy_path_dc, "GPT.INI"), 'w').write(
1343                                    "[General]\r\nVersion=2")
1344         os.makedirs(os.path.join(policy_path_dc, "MACHINE"), 0755)
1345         os.makedirs(os.path.join(policy_path_dc, "USER"), 0755)
1346
1347         if not os.path.isdir(paths.netlogon):
1348             os.makedirs(paths.netlogon, 0755)
1349
1350     if samdb_fill == FILL_FULL:
1351         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1352                             root_uid=root_uid, nobody_uid=nobody_uid,
1353                             users_gid=users_gid, wheel_gid=wheel_gid)
1354
1355         message("Setting up sam.ldb rootDSE marking as synchronized")
1356         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1357
1358         # Only make a zone file on the first DC, it should be replicated with DNS replication
1359         if serverrole == "domain controller":
1360             secretsdb_self_join(secrets_ldb, domain=domain,
1361                                 realm=names.realm,
1362                                 dnsdomain=names.dnsdomain,
1363                                 netbiosname=names.netbiosname,
1364                                 domainsid=domainsid, 
1365                                 machinepass=machinepass,
1366                                 secure_channel_type=SEC_CHAN_BDC)
1367
1368             secretsdb_setup_dns(secrets_ldb, setup_path, 
1369                                 realm=names.realm, dnsdomain=names.dnsdomain,
1370                                 dns_keytab_path=paths.dns_keytab,
1371                                 dnspass=dnspass)
1372
1373             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1374             assert isinstance(domainguid, str)
1375
1376             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1377                              hostip=hostip,
1378                              hostip6=hostip6, hostname=names.hostname,
1379                              realm=names.realm,
1380                              domainguid=domainguid, ntdsguid=names.ntdsguid)
1381
1382             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1383                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1384
1385             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1386                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1387                               keytab_name=paths.dns_keytab)
1388             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1389             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1390
1391             create_krb5_conf(paths.krb5conf, setup_path,
1392                              dnsdomain=names.dnsdomain, hostname=names.hostname,
1393                              realm=names.realm)
1394             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1395
1396     #Now commit the secrets.ldb to disk
1397     secrets_ldb.transaction_commit()
1398
1399     if provision_backend is not None: 
1400       if ldap_backend_type == "fedora-ds":
1401         ldapi_db = Ldb(provision_backend.ldapi_uri, lp=lp, credentials=credentials)
1402
1403         # delete default SASL mappings
1404         res = ldapi_db.search(expression="(!(cn=samba-admin mapping))", base="cn=mapping,cn=sasl,cn=config", scope=SCOPE_ONELEVEL, attrs=["dn"])
1405
1406         # configure in-directory access control on Fedora DS via the aci attribute (over a direct ldapi:// socket)
1407         for i in range (0, len(res)):
1408           dn = str(res[i]["dn"])
1409           ldapi_db.delete(dn)
1410
1411           aci = """(targetattr = "*") (version 3.0;acl "full access to all by samba-admin";allow (all)(userdn = "ldap:///CN=samba-admin,%s");)""" % names.sambadn
1412
1413           m = ldb.Message()
1414           m["aci"] = ldb.MessageElement([aci], ldb.FLAG_MOD_REPLACE, "aci")
1415         
1416           m.dn = ldb.Dn(1, names.domaindn)
1417           ldapi_db.modify(m)
1418
1419           m.dn = ldb.Dn(1, names.configdn)
1420           ldapi_db.modify(m)
1421
1422           m.dn = ldb.Dn(1, names.schemadn)
1423           ldapi_db.modify(m)
1424
1425       # if an LDAP backend is in use, terminate slapd after final provision and check its proper termination
1426       if provision_backend.slapd.poll() is None:
1427         #Kill the slapd
1428         if hasattr(provision_backend.slapd, "terminate"):
1429           provision_backend.slapd.terminate()
1430         else:
1431           # Older python versions don't have .terminate()
1432           import signal
1433           os.kill(provision_backend.slapd.pid, signal.SIGTERM)
1434             
1435         #and now wait for it to die
1436         provision_backend.slapd.communicate()
1437             
1438     # now display slapd_command_file.txt to show how slapd must be started next time
1439         message("Use later the following commandline to start slapd, then Samba:")
1440         slapd_command = "\'" + "\' \'".join(provision_backend.slapd_command) + "\'"
1441         message(slapd_command)
1442         message("This slapd-Commandline is also stored under: " + paths.ldapdir + "/ldap_backend_startup.sh")
1443
1444         setup_file(setup_path("ldap_backend_startup.sh"), paths.ldapdir + "/ldap_backend_startup.sh", {
1445                 "SLAPD_COMMAND" : slapd_command})
1446
1447     
1448     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1449                                ldapi_url)
1450
1451     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1452
1453     message("Once the above files are installed, your Samba4 server will be ready to use")
1454     message("Server Role:           %s" % serverrole)
1455     message("Hostname:              %s" % names.hostname)
1456     message("NetBIOS Domain:        %s" % names.domain)
1457     message("DNS Domain:            %s" % names.dnsdomain)
1458     message("DOMAIN SID:            %s" % str(domainsid))
1459     if samdb_fill == FILL_FULL:
1460         message("Admin password:    %s" % adminpass)
1461     if provision_backend:
1462         if provision_backend.credentials.get_bind_dn() is not None:
1463             message("LDAP Backend Admin DN: %s" % provision_backend.credentials.get_bind_dn())
1464         else:
1465             message("LDAP Admin User:       %s" % provision_backend.credentials.get_username())
1466
1467         message("LDAP Admin Password:   %s" % provision_backend.credentials.get_password())
1468   
1469     result = ProvisionResult()
1470     result.domaindn = domaindn
1471     result.paths = paths
1472     result.lp = lp
1473     result.samdb = samdb
1474     return result
1475
1476
1477
1478 def provision_become_dc(setup_dir=None,
1479                         smbconf=None, targetdir=None, realm=None, 
1480                         rootdn=None, domaindn=None, schemadn=None,
1481                         configdn=None, serverdn=None,
1482                         domain=None, hostname=None, domainsid=None, 
1483                         adminpass=None, krbtgtpass=None, domainguid=None, 
1484                         policyguid=None, policyguid_dc=None, invocationid=None,
1485                         machinepass=None, 
1486                         dnspass=None, root=None, nobody=None, users=None, 
1487                         wheel=None, backup=None, serverrole=None, 
1488                         ldap_backend=None, ldap_backend_type=None,
1489                         sitename=None, debuglevel=1):
1490
1491     def message(text):
1492         """print a message if quiet is not set."""
1493         print text
1494
1495     glue.set_debug_level(debuglevel)
1496
1497     return provision(setup_dir, message, system_session(), None,
1498               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
1499               realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
1500               configdn=configdn, serverdn=serverdn, domain=domain,
1501               hostname=hostname, hostip="127.0.0.1", domainsid=domainsid,
1502               machinepass=machinepass, serverrole="domain controller",
1503               sitename=sitename)
1504
1505
1506 def setup_db_config(setup_path, dbdir):
1507     """Setup a Berkeley database.
1508     
1509     :param setup_path: Setup path function.
1510     :param dbdir: Database directory."""
1511     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1512         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700)
1513         if not os.path.isdir(os.path.join(dbdir, "tmp")):
1514             os.makedirs(os.path.join(dbdir, "tmp"), 0700)
1515
1516     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1517                {"LDAPDBDIR": dbdir})
1518     
1519 class ProvisionBackend(object):
1520     def __init__(self, paths=None, setup_path=None, lp=None, credentials=None, 
1521                  names=None, message=None, 
1522                  hostname=None, root=None, 
1523                  schema=None, ldapadminpass=None,
1524                  ldap_backend_type=None, ldap_backend_extra_port=None,
1525                  ol_mmr_urls=None, 
1526                  setup_ds_path=None, slapd_path=None, 
1527                  nosync=False, ldap_dryrun_mode=False):
1528         """Provision an LDAP backend for samba4
1529         
1530         This works for OpenLDAP and Fedora DS
1531         """
1532
1533         self.ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.ldapdir, "ldapi"), safe="")
1534         
1535         if not os.path.isdir(paths.ldapdir):
1536             os.makedirs(paths.ldapdir, 0700)
1537             
1538         if ldap_backend_type == "existing":
1539             #Check to see that this 'existing' LDAP backend in fact exists
1540             ldapi_db = Ldb(self.ldapi_uri, credentials=credentials)
1541             search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
1542                                                 expression="(objectClass=OpenLDAProotDSE)")
1543
1544             # If we have got here, then we must have a valid connection to the LDAP server, with valid credentials supplied
1545             # This caused them to be set into the long-term database later in the script.
1546             self.credentials = credentials
1547             self.ldap_backend_type = "openldap" #For now, assume existing backends at least emulate OpenLDAP
1548             return
1549     
1550         # we will shortly start slapd with ldapi for final provisioning. first check with ldapsearch -> rootDSE via self.ldapi_uri
1551         # if another instance of slapd is already running 
1552         try:
1553             ldapi_db = Ldb(self.ldapi_uri)
1554             search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
1555                                                 expression="(objectClass=OpenLDAProotDSE)");
1556             try:
1557                 f = open(paths.slapdpid, "r")
1558                 p = f.read()
1559                 f.close()
1560                 message("Check for slapd Process with PID: " + str(p) + " and terminate it manually.")
1561             except:
1562                 pass
1563             
1564             raise ProvisioningError("Warning: Another slapd Instance seems already running on this host, listening to " + self.ldapi_uri + ". Please shut it down before you continue. ")
1565         
1566         except LdbError, e:
1567             pass
1568
1569         # Try to print helpful messages when the user has not specified the path to slapd
1570         if slapd_path is None:
1571             raise ProvisioningError("Warning: LDAP-Backend must be setup with path to slapd, e.g. --slapd-path=\"/usr/local/libexec/slapd\"!")
1572         if not os.path.exists(slapd_path):
1573             message (slapd_path)
1574             raise ProvisioningError("Warning: Given Path to slapd does not exist!")
1575
1576         schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1577         try:
1578             os.unlink(schemadb_path)
1579         except OSError:
1580             pass
1581
1582
1583         # Put the LDIF of the schema into a database so we can search on
1584         # it to generate schema-dependent configurations in Fedora DS and
1585         # OpenLDAP
1586         os.path.join(paths.ldapdir, "schema-tmp.ldb")
1587         schema.ldb.connect(schemadb_path)
1588         schema.ldb.transaction_start()
1589     
1590         # These bits of LDIF are supplied when the Schema object is created
1591         schema.ldb.add_ldif(schema.schema_dn_add)
1592         schema.ldb.modify_ldif(schema.schema_dn_modify)
1593         schema.ldb.add_ldif(schema.schema_data)
1594         schema.ldb.transaction_commit()
1595
1596         self.credentials = Credentials()
1597         self.credentials.guess(lp)
1598         #Kerberos to an ldapi:// backend makes no sense
1599         self.credentials.set_kerberos_state(DONT_USE_KERBEROS)
1600
1601         self.adminCredentials = Credentials()
1602         self.adminCredentials.guess(lp)
1603         #Kerberos to an ldapi:// backend makes no sense
1604         self.adminCredentials.set_kerberos_state(DONT_USE_KERBEROS)
1605
1606         self.ldap_backend_type = ldap_backend_type
1607
1608         if ldap_backend_type == "fedora-ds":
1609             provision_fds_backend(self, paths=paths, setup_path=setup_path,
1610                                   names=names, message=message, 
1611                                   hostname=hostname,
1612                                   ldapadminpass=ldapadminpass, root=root, 
1613                                   schema=schema,
1614                                   ldap_backend_extra_port=ldap_backend_extra_port, 
1615                                   setup_ds_path=setup_ds_path,
1616                                   slapd_path=slapd_path,
1617                                   nosync=nosync,
1618                                   ldap_dryrun_mode=ldap_dryrun_mode)
1619             
1620         elif ldap_backend_type == "openldap":
1621             provision_openldap_backend(self, paths=paths, setup_path=setup_path,
1622                                        names=names, message=message, 
1623                                        hostname=hostname,
1624                                        ldapadminpass=ldapadminpass, root=root, 
1625                                        schema=schema,
1626                                        ldap_backend_extra_port=ldap_backend_extra_port, 
1627                                        ol_mmr_urls=ol_mmr_urls, 
1628                                        slapd_path=slapd_path,
1629                                        nosync=nosync,
1630                                        ldap_dryrun_mode=ldap_dryrun_mode)
1631         else:
1632             raise ProvisioningError("Unknown LDAP backend type selected")
1633
1634         self.credentials.set_password(ldapadminpass)
1635         self.adminCredentials.set_username("samba-admin")
1636         self.adminCredentials.set_password(ldapadminpass)
1637
1638         # Now start the slapd, so we can provision onto it.  We keep the
1639         # subprocess context around, to kill this off at the successful
1640         # end of the script
1641         self.slapd = subprocess.Popen(self.slapd_provision_command, close_fds=True, shell=False)
1642     
1643         while self.slapd.poll() is None:
1644             # Wait until the socket appears
1645             try:
1646                 ldapi_db = Ldb(self.ldapi_uri, lp=lp, credentials=self.credentials)
1647                 search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
1648                                                     expression="(objectClass=OpenLDAProotDSE)")
1649                 # If we have got here, then we must have a valid connection to the LDAP server!
1650                 return
1651             except LdbError, e:
1652                 time.sleep(1)
1653                 pass
1654         
1655         raise ProvisioningError("slapd died before we could make a connection to it")
1656
1657
1658 def provision_openldap_backend(result, paths=None, setup_path=None, names=None,
1659                                message=None, 
1660                                hostname=None, ldapadminpass=None, root=None, 
1661                                schema=None, 
1662                                ldap_backend_extra_port=None,
1663                                ol_mmr_urls=None, 
1664                                slapd_path=None, nosync=False,
1665                                ldap_dryrun_mode=False):
1666
1667     #Allow the test scripts to turn off fsync() for OpenLDAP as for TDB and LDB
1668     nosync_config = ""
1669     if nosync:
1670         nosync_config = "dbnosync"
1671         
1672     lnkattr = get_linked_attributes(names.schemadn,schema.ldb)
1673     refint_attributes = ""
1674     memberof_config = "# Generated from Samba4 schema\n"
1675     for att in  lnkattr.keys():
1676         if lnkattr[att] is not None:
1677             refint_attributes = refint_attributes + " " + att 
1678             
1679             memberof_config += read_and_sub_file(setup_path("memberof.conf"),
1680                                                  { "MEMBER_ATTR" : att ,
1681                                                    "MEMBEROF_ATTR" : lnkattr[att] })
1682             
1683     refint_config = read_and_sub_file(setup_path("refint.conf"),
1684                                       { "LINK_ATTRS" : refint_attributes})
1685     
1686     attrs = ["linkID", "lDAPDisplayName"]
1687     res = schema.ldb.search(expression="(&(objectclass=attributeSchema)(searchFlags:1.2.840.113556.1.4.803:=1))", base=names.schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
1688     index_config = ""
1689     for i in range (0, len(res)):
1690         index_attr = res[i]["lDAPDisplayName"][0]
1691         if index_attr == "objectGUID":
1692             index_attr = "entryUUID"
1693             
1694         index_config += "index " + index_attr + " eq\n"
1695
1696 # generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
1697     mmr_on_config = ""
1698     mmr_replicator_acl = ""
1699     mmr_serverids_config = ""
1700     mmr_syncrepl_schema_config = "" 
1701     mmr_syncrepl_config_config = "" 
1702     mmr_syncrepl_user_config = "" 
1703        
1704     
1705     if ol_mmr_urls is not None:
1706         # For now, make these equal
1707         mmr_pass = ldapadminpass
1708         
1709         url_list=filter(None,ol_mmr_urls.split(' ')) 
1710         if (len(url_list) == 1):
1711             url_list=filter(None,ol_mmr_urls.split(',')) 
1712                      
1713             
1714             mmr_on_config = "MirrorMode On"
1715             mmr_replicator_acl = "  by dn=cn=replicator,cn=samba read"
1716             serverid=0
1717             for url in url_list:
1718                 serverid=serverid+1
1719                 mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
1720                                                           { "SERVERID" : str(serverid),
1721                                                             "LDAPSERVER" : url })
1722                 rid=serverid*10
1723                 rid=rid+1
1724                 mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1725                                                                 {  "RID" : str(rid),
1726                                                                    "MMRDN": names.schemadn,
1727                                                                    "LDAPSERVER" : url,
1728                                                                    "MMR_PASSWORD": mmr_pass})
1729                 
1730                 rid=rid+1
1731                 mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1732                                                                 {  "RID" : str(rid),
1733                                                                    "MMRDN": names.configdn,
1734                                                                    "LDAPSERVER" : url,
1735                                                                    "MMR_PASSWORD": mmr_pass})
1736                 
1737                 rid=rid+1
1738                 mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1739                                                               {  "RID" : str(rid),
1740                                                                  "MMRDN": names.domaindn,
1741                                                                  "LDAPSERVER" : url,
1742                                                                  "MMR_PASSWORD": mmr_pass })
1743     # OpenLDAP cn=config initialisation
1744     olc_syncrepl_config = ""
1745     olc_mmr_config = "" 
1746     # if mmr = yes, generate cn=config-replication directives
1747     # and olc_seed.lif for the other mmr-servers
1748     if ol_mmr_urls is not None:
1749         serverid=0
1750         olc_serverids_config = ""
1751         olc_syncrepl_seed_config = ""
1752         olc_mmr_config += read_and_sub_file(setup_path("olc_mmr.conf"),{})
1753         rid=1000
1754         for url in url_list:
1755             serverid=serverid+1
1756             olc_serverids_config += read_and_sub_file(setup_path("olc_serverid.conf"),
1757                                                       { "SERVERID" : str(serverid),
1758                                                         "LDAPSERVER" : url })
1759             
1760             rid=rid+1
1761             olc_syncrepl_config += read_and_sub_file(setup_path("olc_syncrepl.conf"),
1762                                                      {  "RID" : str(rid),
1763                                                         "LDAPSERVER" : url,
1764                                                         "MMR_PASSWORD": mmr_pass})
1765             
1766             olc_syncrepl_seed_config += read_and_sub_file(setup_path("olc_syncrepl_seed.conf"),
1767                                                           {  "RID" : str(rid),
1768                                                              "LDAPSERVER" : url})
1769                 
1770         setup_file(setup_path("olc_seed.ldif"), paths.olcseedldif,
1771                    {"OLC_SERVER_ID_CONF": olc_serverids_config,
1772                     "OLC_PW": ldapadminpass,
1773                     "OLC_SYNCREPL_CONF": olc_syncrepl_seed_config})
1774     # end olc
1775                 
1776     setup_file(setup_path("slapd.conf"), paths.slapdconf,
1777                {"DNSDOMAIN": names.dnsdomain,
1778                 "LDAPDIR": paths.ldapdir,
1779                 "DOMAINDN": names.domaindn,
1780                 "CONFIGDN": names.configdn,
1781                 "SCHEMADN": names.schemadn,
1782                 "MEMBEROF_CONFIG": memberof_config,
1783                 "MIRRORMODE": mmr_on_config,
1784                 "REPLICATOR_ACL": mmr_replicator_acl,
1785                 "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
1786                 "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
1787                 "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
1788                 "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
1789                 "OLC_SYNCREPL_CONFIG": olc_syncrepl_config,
1790                 "OLC_MMR_CONFIG": olc_mmr_config,
1791                 "REFINT_CONFIG": refint_config,
1792                 "INDEX_CONFIG": index_config,
1793                 "NOSYNC": nosync_config})
1794         
1795     setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
1796     setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
1797     setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
1798     
1799     if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba")):
1800         os.makedirs(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba"), 0700)
1801         
1802     setup_file(setup_path("cn=samba.ldif"), 
1803                os.path.join(paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
1804                { "UUID": str(uuid.uuid4()), 
1805                  "LDAPTIME": timestring(int(time.time()))} )
1806     setup_file(setup_path("cn=samba-admin.ldif"), 
1807                os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
1808                {"LDAPADMINPASS_B64": b64encode(ldapadminpass),
1809                 "UUID": str(uuid.uuid4()), 
1810                 "LDAPTIME": timestring(int(time.time()))} )
1811     
1812     if ol_mmr_urls is not None:
1813         setup_file(setup_path("cn=replicator.ldif"),
1814                    os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=replicator.ldif"),
1815                    {"MMR_PASSWORD_B64": b64encode(mmr_pass),
1816                     "UUID": str(uuid.uuid4()),
1817                     "LDAPTIME": timestring(int(time.time()))} )
1818         
1819
1820     mapping = "schema-map-openldap-2.3"
1821     backend_schema = "backend-schema.schema"
1822
1823     backend_schema_data = schema.ldb.convert_schema_to_openldap("openldap", open(setup_path(mapping), 'r').read())
1824     assert backend_schema_data is not None
1825     open(os.path.join(paths.ldapdir, backend_schema), 'w').write(backend_schema_data)
1826
1827     # now we generate the needed strings to start slapd automatically,
1828     # first ldapi_uri...
1829     if ldap_backend_extra_port is not None:
1830         # When we use MMR, we can't use 0.0.0.0 as it uses the name
1831         # specified there as part of it's clue as to it's own name,
1832         # and not to replicate to itself
1833         if ol_mmr_urls is None:
1834             server_port_string = "ldap://0.0.0.0:%d" % ldap_backend_extra_port
1835         else:
1836             server_port_string = "ldap://" + names.hostname + "." + names.dnsdomain +":%d" % ldap_backend_extra_port
1837     else:
1838         server_port_string = ""
1839
1840     # Prepare the 'result' information - the commands to return in particular
1841     result.slapd_provision_command = [slapd_path]
1842
1843     result.slapd_provision_command.append("-F" + paths.olcdir)
1844
1845     result.slapd_provision_command.append("-h")
1846
1847     # copy this command so we have two version, one with -d0 and only ldapi, and one with all the listen commands
1848     result.slapd_command = list(result.slapd_provision_command)
1849     
1850     result.slapd_provision_command.append(result.ldapi_uri)
1851     result.slapd_provision_command.append("-d0")
1852
1853     uris = result.ldapi_uri
1854     if server_port_string is not "":
1855         uris = uris + " " + server_port_string
1856
1857     result.slapd_command.append(uris)
1858
1859     # Set the username - done here because Fedora DS still uses the admin DN and simple bind
1860     result.credentials.set_username("samba-admin")
1861     
1862     # If we were just looking for crashes up to this point, it's a
1863     # good time to exit before we realise we don't have OpenLDAP on
1864     # this system
1865     if ldap_dryrun_mode:
1866         sys.exit(0)
1867
1868     # Finally, convert the configuration into cn=config style!
1869     if not os.path.isdir(paths.olcdir):
1870         os.makedirs(paths.olcdir, 0770)
1871
1872         retcode = subprocess.call([slapd_path, "-Ttest", "-f", paths.slapdconf, "-F", paths.olcdir], close_fds=True, shell=False)
1873
1874 #        We can't do this, as OpenLDAP is strange.  It gives an error
1875 #        output to the above, but does the conversion sucessfully...
1876 #
1877 #        if retcode != 0:
1878 #            raise ProvisioningError("conversion from slapd.conf to cn=config failed")
1879
1880         if not os.path.exists(os.path.join(paths.olcdir, "cn=config.ldif")):
1881             raise ProvisioningError("conversion from slapd.conf to cn=config failed")
1882
1883         # Don't confuse the admin by leaving the slapd.conf around
1884         os.remove(paths.slapdconf)        
1885           
1886
1887 def provision_fds_backend(result, paths=None, setup_path=None, names=None,
1888                           message=None, 
1889                           hostname=None, ldapadminpass=None, root=None, 
1890                           schema=None,
1891                           ldap_backend_extra_port=None,
1892                           setup_ds_path=None,
1893                           slapd_path=None,
1894                           nosync=False, 
1895                           ldap_dryrun_mode=False):
1896
1897     if ldap_backend_extra_port is not None:
1898         serverport = "ServerPort=%d" % ldap_backend_extra_port
1899     else:
1900         serverport = ""
1901         
1902     setup_file(setup_path("fedorads.inf"), paths.fedoradsinf, 
1903                {"ROOT": root,
1904                 "HOSTNAME": hostname,
1905                 "DNSDOMAIN": names.dnsdomain,
1906                 "LDAPDIR": paths.ldapdir,
1907                 "DOMAINDN": names.domaindn,
1908                 "LDAPMANAGERDN": names.ldapmanagerdn,
1909                 "LDAPMANAGERPASS": ldapadminpass, 
1910                 "SERVERPORT": serverport})
1911
1912     setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions, 
1913                {"CONFIGDN": names.configdn,
1914                 "SCHEMADN": names.schemadn,
1915                 "SAMBADN": names.sambadn,
1916                 })
1917
1918     setup_file(setup_path("fedorads-sasl.ldif"), paths.fedoradssasl, 
1919                {"SAMBADN": names.sambadn,
1920                 })
1921
1922     setup_file(setup_path("fedorads-samba.ldif"), paths.fedoradssamba,
1923                 {"SAMBADN": names.sambadn, 
1924                  "LDAPADMINPASS": ldapadminpass
1925                 })
1926
1927     mapping = "schema-map-fedora-ds-1.0"
1928     backend_schema = "99_ad.ldif"
1929     
1930     # Build a schema file in Fedora DS format
1931     backend_schema_data = schema.ldb.convert_schema_to_openldap("fedora-ds", open(setup_path(mapping), 'r').read())
1932     assert backend_schema_data is not None
1933     open(os.path.join(paths.ldapdir, backend_schema), 'w').write(backend_schema_data)
1934
1935     result.credentials.set_bind_dn(names.ldapmanagerdn)
1936
1937     # Destory the target directory, or else setup-ds.pl will complain
1938     fedora_ds_dir = os.path.join(paths.ldapdir, "slapd-samba4")
1939     shutil.rmtree(fedora_ds_dir, True)
1940
1941     result.slapd_provision_command = [slapd_path, "-D", fedora_ds_dir, "-i", paths.slapdpid];
1942     #In the 'provision' command line, stay in the foreground so we can easily kill it
1943     result.slapd_provision_command.append("-d0")
1944
1945     #the command for the final run is the normal script
1946     result.slapd_command = [os.path.join(paths.ldapdir, "slapd-samba4", "start-slapd")]
1947
1948     # If we were just looking for crashes up to this point, it's a
1949     # good time to exit before we realise we don't have Fedora DS on
1950     if ldap_dryrun_mode:
1951         sys.exit(0)
1952
1953     # Try to print helpful messages when the user has not specified the path to the setup-ds tool
1954     if setup_ds_path is None:
1955         raise ProvisioningError("Warning: Fedora DS LDAP-Backend must be setup with path to setup-ds, e.g. --setup-ds-path=\"/usr/sbin/setup-ds.pl\"!")
1956     if not os.path.exists(setup_ds_path):
1957         message (setup_ds_path)
1958         raise ProvisioningError("Warning: Given Path to slapd does not exist!")
1959
1960     # Run the Fedora DS setup utility
1961     retcode = subprocess.call([setup_ds_path, "--silent", "--file", paths.fedoradsinf], close_fds=True, shell=False)
1962     if retcode != 0:
1963         raise ProvisioningError("setup-ds failed")
1964
1965     # Load samba-admin
1966     retcode = subprocess.call([
1967         os.path.join(paths.ldapdir, "slapd-samba4", "ldif2db"), "-s", names.sambadn, "-i", paths.fedoradssamba],
1968         close_fds=True, shell=False)
1969     if retcode != 0:
1970         raise("ldib2db failed")
1971
1972 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1973     """Create a PHP LDAP admin configuration file.
1974
1975     :param path: Path to write the configuration to.
1976     :param setup_path: Function to generate setup paths.
1977     """
1978     setup_file(setup_path("phpldapadmin-config.php"), path, 
1979             {"S4_LDAPI_URI": ldapi_uri})
1980
1981
1982 def create_zone_file(path, setup_path, dnsdomain, 
1983                      hostip, hostip6, hostname, realm, domainguid,
1984                      ntdsguid):
1985     """Write out a DNS zone file, from the info in the current database.
1986
1987     :param path: Path of the new zone file.
1988     :param setup_path: Setup path function.
1989     :param dnsdomain: DNS Domain name
1990     :param domaindn: DN of the Domain
1991     :param hostip: Local IPv4 IP
1992     :param hostip6: Local IPv6 IP
1993     :param hostname: Local hostname
1994     :param realm: Realm name
1995     :param domainguid: GUID of the domain.
1996     :param ntdsguid: GUID of the hosts nTDSDSA record.
1997     """
1998     assert isinstance(domainguid, str)
1999
2000     if hostip6 is not None:
2001         hostip6_base_line = "            IN AAAA    " + hostip6
2002         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
2003     else:
2004         hostip6_base_line = ""
2005         hostip6_host_line = ""
2006
2007     if hostip is not None:
2008         hostip_base_line = "            IN A    " + hostip
2009         hostip_host_line = hostname + "        IN A    " + hostip
2010     else:
2011         hostip_base_line = ""
2012         hostip_host_line = ""
2013
2014     setup_file(setup_path("provision.zone"), path, {
2015             "HOSTNAME": hostname,
2016             "DNSDOMAIN": dnsdomain,
2017             "REALM": realm,
2018             "HOSTIP_BASE_LINE": hostip_base_line,
2019             "HOSTIP_HOST_LINE": hostip_host_line,
2020             "DOMAINGUID": domainguid,
2021             "DATESTRING": time.strftime("%Y%m%d%H"),
2022             "DEFAULTSITE": DEFAULTSITE,
2023             "NTDSGUID": ntdsguid,
2024             "HOSTIP6_BASE_LINE": hostip6_base_line,
2025             "HOSTIP6_HOST_LINE": hostip6_host_line,
2026         })
2027
2028
2029 def create_named_conf(path, setup_path, realm, dnsdomain,
2030                       private_dir):
2031     """Write out a file containing zone statements suitable for inclusion in a
2032     named.conf file (including GSS-TSIG configuration).
2033     
2034     :param path: Path of the new named.conf file.
2035     :param setup_path: Setup path function.
2036     :param realm: Realm name
2037     :param dnsdomain: DNS Domain name
2038     :param private_dir: Path to private directory
2039     :param keytab_name: File name of DNS keytab file
2040     """
2041
2042     setup_file(setup_path("named.conf"), path, {
2043             "DNSDOMAIN": dnsdomain,
2044             "REALM": realm,
2045             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
2046             "PRIVATE_DIR": private_dir
2047             })
2048
2049 def create_named_txt(path, setup_path, realm, dnsdomain,
2050                       private_dir, keytab_name):
2051     """Write out a file containing zone statements suitable for inclusion in a
2052     named.conf file (including GSS-TSIG configuration).
2053     
2054     :param path: Path of the new named.conf file.
2055     :param setup_path: Setup path function.
2056     :param realm: Realm name
2057     :param dnsdomain: DNS Domain name
2058     :param private_dir: Path to private directory
2059     :param keytab_name: File name of DNS keytab file
2060     """
2061
2062     setup_file(setup_path("named.txt"), path, {
2063             "DNSDOMAIN": dnsdomain,
2064             "REALM": realm,
2065             "DNS_KEYTAB": keytab_name,
2066             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
2067             "PRIVATE_DIR": private_dir
2068         })
2069
2070 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
2071     """Write out a file containing zone statements suitable for inclusion in a
2072     named.conf file (including GSS-TSIG configuration).
2073     
2074     :param path: Path of the new named.conf file.
2075     :param setup_path: Setup path function.
2076     :param dnsdomain: DNS Domain name
2077     :param hostname: Local hostname
2078     :param realm: Realm name
2079     """
2080
2081     setup_file(setup_path("krb5.conf"), path, {
2082             "DNSDOMAIN": dnsdomain,
2083             "HOSTNAME": hostname,
2084             "REALM": realm,
2085         })
2086
2087