s4:provision Remove LDB backend files in provision
[ira/wip.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
8 #
9 # Based on the original in EJS:
10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
11 #
12 # This program is free software; you can redistribute it and/or modify
13 # it under the terms of the GNU General Public License as published by
14 # the Free Software Foundation; either version 3 of the License, or
15 # (at your option) any later version.
16 #   
17 # This program is distributed in the hope that it will be useful,
18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20 # GNU General Public License for more details.
21 #   
22 # You should have received a copy of the GNU General Public License
23 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 #
25
26 """Functions for setting up a Samba configuration."""
27
28 from base64 import b64encode
29 import os
30 import sys
31 import pwd
32 import grp
33 import time
34 import uuid, glue
35 import socket
36 import param
37 import registry
38 import samba
39 import subprocess
40 import ldb
41
42
43 from auth import system_session, admin_session
44 from samba import version, Ldb, substitute_var, valid_netbios_name, setup_file
45 from samba import check_all_substituted, read_and_sub_file
46 from samba import DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, DS_DC_FUNCTION_2008
47 from samba.samdb import SamDB
48 from samba.idmap import IDmapDB
49 from samba.dcerpc import security
50 from samba.ndr import ndr_pack
51 import urllib
52 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
53 from ms_display_specifiers import read_ms_ldif
54 from schema import Schema
55 from provisionbackend import ProvisionBackend
56 from signal import SIGTERM
57 from dcerpc.misc import SEC_CHAN_BDC, SEC_CHAN_WKSTA
58
59 __docformat__ = "restructuredText"
60
61 def find_setup_dir():
62     """Find the setup directory used by provision."""
63     dirname = os.path.dirname(__file__)
64     if "/site-packages/" in dirname:
65         prefix = "/".join(dirname[:dirname.index("/site-packages/")].split("/")[:-2])
66         for suffix in ["share/setup", "share/samba/setup", "setup"]:
67             ret = os.path.join(prefix, suffix)
68             if os.path.isdir(ret):
69                 return ret
70     # In source tree
71     ret = os.path.join(dirname, "../../../setup")
72     if os.path.isdir(ret):
73         return ret
74     raise Exception("Unable to find setup directory.")
75
76 def get_config_descriptor(domain_sid):
77     sddl = "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
78            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
79            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
80            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
81            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
82            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
83            "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
84            "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \
85            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
86            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
87            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
88            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
89            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)" \
90            "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \
91            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
92     sec = security.descriptor.from_sddl(sddl, domain_sid)
93     return b64encode(ndr_pack(sec))
94
95
96 DEFAULTSITE = "Default-First-Site-Name"
97
98 # Exception classes
99
100 class ProvisioningError(Exception):
101     """A generic provision error."""
102
103 class InvalidNetbiosName(Exception):
104     """A specified name was not a valid NetBIOS name."""
105     def __init__(self, name):
106         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
107
108
109 class ProvisionPaths(object):
110     def __init__(self):
111         self.shareconf = None
112         self.hklm = None
113         self.hkcu = None
114         self.hkcr = None
115         self.hku = None
116         self.hkpd = None
117         self.hkpt = None
118         self.samdb = None
119         self.idmapdb = None
120         self.secrets = None
121         self.keytab = None
122         self.dns_keytab = None
123         self.dns = None
124         self.winsdb = None
125         self.private_dir = None
126         self.ldapdir = None
127         self.slapdconf = None
128         self.modulesconf = None
129         self.memberofconf = None
130         self.fedoradsinf = None
131         self.fedoradspartitions = None
132         self.fedoradssasl = None
133         self.fedoradsdna = None
134         self.fedoradspam = None
135         self.fedoradsrefint = None
136         self.fedoradslinkedattributes = None
137         self.fedoradsindex = None
138         self.fedoradssamba = None
139         self.olmmron = None
140         self.olmmrserveridsconf = None
141         self.olmmrsyncreplconf = None
142         self.olcdir = None
143         self.olslapd = None
144         self.olcseedldif = None
145
146
147 class ProvisionNames(object):
148     def __init__(self):
149         self.rootdn = None
150         self.domaindn = None
151         self.configdn = None
152         self.schemadn = None
153         self.sambadn = None
154         self.ldapmanagerdn = None
155         self.dnsdomain = None
156         self.realm = None
157         self.netbiosname = None
158         self.domain = None
159         self.hostname = None
160         self.sitename = None
161         self.smbconf = None
162     
163
164 class ProvisionResult(object):
165     def __init__(self):
166         self.paths = None
167         self.domaindn = None
168         self.lp = None
169         self.samdb = None
170
171 def check_install(lp, session_info, credentials):
172     """Check whether the current install seems ok.
173     
174     :param lp: Loadparm context
175     :param session_info: Session information
176     :param credentials: Credentials
177     """
178     if lp.get("realm") == "":
179         raise Exception("Realm empty")
180     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
181             credentials=credentials, lp=lp)
182     if len(ldb.search("(cn=Administrator)")) != 1:
183         raise ProvisioningError("No administrator account found")
184
185
186 def findnss(nssfn, names):
187     """Find a user or group from a list of possibilities.
188     
189     :param nssfn: NSS Function to try (should raise KeyError if not found)
190     :param names: Names to check.
191     :return: Value return by first names list.
192     """
193     for name in names:
194         try:
195             return nssfn(name)
196         except KeyError:
197             pass
198     raise KeyError("Unable to find user/group %r" % names)
199
200
201 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
202 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
203
204
205 def setup_add_ldif(ldb, ldif_path, subst_vars=None,controls=["relax:0"]):
206     """Setup a ldb in the private dir.
207     
208     :param ldb: LDB file to import data into
209     :param ldif_path: Path of the LDIF file to load
210     :param subst_vars: Optional variables to subsitute in LDIF.
211     :param nocontrols: Optional list of controls, can be None for no controls
212     """
213     assert isinstance(ldif_path, str)
214     data = read_and_sub_file(ldif_path, subst_vars)
215     ldb.add_ldif(data,controls)
216
217
218 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
219     """Modify a ldb in the private dir.
220     
221     :param ldb: LDB object.
222     :param ldif_path: LDIF file path.
223     :param subst_vars: Optional dictionary with substitution variables.
224     """
225     data = read_and_sub_file(ldif_path, subst_vars)
226
227     ldb.modify_ldif(data)
228
229
230 def setup_ldb(ldb, ldif_path, subst_vars):
231     """Import a LDIF a file into a LDB handle, optionally substituting variables.
232
233     :note: Either all LDIF data will be added or none (using transactions).
234
235     :param ldb: LDB file to import into.
236     :param ldif_path: Path to the LDIF file.
237     :param subst_vars: Dictionary with substitution variables.
238     """
239     assert ldb is not None
240     ldb.transaction_start()
241     try:
242         setup_add_ldif(ldb, ldif_path, subst_vars)
243     except:
244         ldb.transaction_cancel()
245         raise
246     ldb.transaction_commit()
247
248
249 def provision_paths_from_lp(lp, dnsdomain):
250     """Set the default paths for provisioning.
251
252     :param lp: Loadparm context.
253     :param dnsdomain: DNS Domain name
254     """
255     paths = ProvisionPaths()
256     paths.private_dir = lp.get("private dir")
257     paths.dns_keytab = "dns.keytab"
258
259     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
260     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
261     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
262     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
263     paths.privilege = os.path.join(paths.private_dir, "privilege.ldb")
264     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
265     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
266     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
267     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
268     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
269     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
270     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
271                                             "phpldapadmin-config.php")
272     paths.ldapdir = os.path.join(paths.private_dir, 
273                                  "ldap")
274     paths.slapdconf = os.path.join(paths.ldapdir, 
275                                    "slapd.conf")
276     paths.slapdpid = os.path.join(paths.ldapdir, 
277                                    "slapd.pid")
278     paths.modulesconf = os.path.join(paths.ldapdir, 
279                                      "modules.conf")
280     paths.memberofconf = os.path.join(paths.ldapdir, 
281                                       "memberof.conf")
282     paths.fedoradsinf = os.path.join(paths.ldapdir, 
283                                      "fedorads.inf")
284     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
285                                             "fedorads-partitions.ldif")
286     paths.fedoradssasl = os.path.join(paths.ldapdir, 
287                                       "fedorads-sasl.ldif")
288     paths.fedoradsdna = os.path.join(paths.ldapdir, 
289                                      "fedorads-dna.ldif")
290     paths.fedoradspam = os.path.join(paths.ldapdir,
291                                      "fedorads-pam.ldif")
292     paths.fedoradsrefint = os.path.join(paths.ldapdir,
293                                         "fedorads-refint.ldif")
294     paths.fedoradslinkedattributes = os.path.join(paths.ldapdir,
295                                                   "fedorads-linked-attributes.ldif")
296     paths.fedoradsindex = os.path.join(paths.ldapdir,
297                                        "fedorads-index.ldif")
298     paths.fedoradssamba = os.path.join(paths.ldapdir, 
299                                        "fedorads-samba.ldif")
300     paths.olmmrserveridsconf = os.path.join(paths.ldapdir, 
301                                             "mmr_serverids.conf")
302     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir, 
303                                            "mmr_syncrepl.conf")
304     paths.olcdir = os.path.join(paths.ldapdir, 
305                                  "slapd.d")
306     paths.olcseedldif = os.path.join(paths.ldapdir, 
307                                  "olc_seed.ldif")
308     paths.hklm = "hklm.ldb"
309     paths.hkcr = "hkcr.ldb"
310     paths.hkcu = "hkcu.ldb"
311     paths.hku = "hku.ldb"
312     paths.hkpd = "hkpd.ldb"
313     paths.hkpt = "hkpt.ldb"
314
315     paths.sysvol = lp.get("path", "sysvol")
316
317     paths.netlogon = lp.get("path", "netlogon")
318
319     paths.smbconf = lp.configfile
320
321     return paths
322
323
324 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
325                 serverrole=None, rootdn=None, domaindn=None, configdn=None,
326                 schemadn=None, serverdn=None, sitename=None, sambadn=None):
327     """Guess configuration settings to use."""
328
329     if hostname is None:
330         hostname = socket.gethostname().split(".")[0]
331
332     netbiosname = lp.get("netbios name")
333     if netbiosname is None:
334         netbiosname = hostname
335     assert netbiosname is not None
336     netbiosname = netbiosname.upper()
337     if not valid_netbios_name(netbiosname):
338         raise InvalidNetbiosName(netbiosname)
339
340     if dnsdomain is None:
341         dnsdomain = lp.get("realm")
342     assert dnsdomain is not None
343     dnsdomain = dnsdomain.lower()
344
345     if serverrole is None:
346         serverrole = lp.get("server role")
347     assert serverrole is not None
348     serverrole = serverrole.lower()
349
350     realm = dnsdomain.upper()
351
352     if lp.get("realm").upper() != realm:
353         raise ProvisioningError("guess_names: Realm '%s' in smb.conf must match chosen realm '%s'!", lp.get("realm").upper(), realm)
354
355     if serverrole == "domain controller":
356         if domain is None:
357             domain = lp.get("workgroup")
358         assert domain is not None
359         domain = domain.upper()
360
361         if lp.get("workgroup").upper() != domain:
362             raise ProvisioningError("guess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!", lp.get("workgroup").upper(), domain)
363
364         if domaindn is None:
365             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
366     else:
367         domain = netbiosname
368         if domaindn is None:
369             domaindn = "DC=" + netbiosname
370         
371     if not valid_netbios_name(domain):
372         raise InvalidNetbiosName(domain)
373         
374     if hostname.upper() == realm:
375         raise ProvisioningError("guess_names: Realm '%s' must not be equal to hostname '%s'!", realm, hostname)
376     if netbiosname == realm:
377         raise ProvisioningError("guess_names: Realm '%s' must not be equal to netbios hostname '%s'!", realm, netbiosname)
378     if domain == realm:
379         raise ProvisioningError("guess_names: Realm '%s' must not be equal to short domain name '%s'!", realm, domain)
380
381     if rootdn is None:
382        rootdn = domaindn
383        
384     if configdn is None:
385         configdn = "CN=Configuration," + rootdn
386     if schemadn is None:
387         schemadn = "CN=Schema," + configdn
388     if sambadn is None:
389         sambadn = "CN=Samba"
390
391     if sitename is None:
392         sitename=DEFAULTSITE
393
394     names = ProvisionNames()
395     names.rootdn = rootdn
396     names.domaindn = domaindn
397     names.configdn = configdn
398     names.schemadn = schemadn
399     names.sambadn = sambadn
400     names.ldapmanagerdn = "CN=Manager," + rootdn
401     names.dnsdomain = dnsdomain
402     names.domain = domain
403     names.realm = realm
404     names.netbiosname = netbiosname
405     names.hostname = hostname
406     names.sitename = sitename
407     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
408  
409     return names
410     
411
412 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
413                  targetdir, sid_generator):
414     """Create a new smb.conf file based on a couple of basic settings.
415     """
416     assert smbconf is not None
417     if hostname is None:
418         hostname = socket.gethostname().split(".")[0]
419     netbiosname = hostname.upper()
420
421     if serverrole is None:
422         serverrole = "standalone"
423
424     assert serverrole in ("domain controller", "member server", "standalone")
425     if serverrole == "domain controller":
426         smbconfsuffix = "dc"
427     elif serverrole == "member server":
428         smbconfsuffix = "member"
429     elif serverrole == "standalone":
430         smbconfsuffix = "standalone"
431
432     if sid_generator is None:
433         sid_generator = "internal"
434
435     assert domain is not None
436     domain = domain.upper()
437
438     assert realm is not None
439     realm = realm.upper()
440
441     default_lp = param.LoadParm()
442     #Load non-existant file
443     if os.path.exists(smbconf):
444         default_lp.load(smbconf)
445     
446     if targetdir is not None:
447         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
448         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
449
450         default_lp.set("lock dir", os.path.abspath(targetdir))
451     else:
452         privatedir_line = ""
453         lockdir_line = ""
454
455     if sid_generator == "internal":
456         sid_generator_line = ""
457     else:
458         sid_generator_line = "sid generator = " + sid_generator
459
460     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
461     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
462
463     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
464                smbconf, {
465             "NETBIOS_NAME": netbiosname,
466             "DOMAIN": domain,
467             "REALM": realm,
468             "SERVERROLE": serverrole,
469             "NETLOGONPATH": netlogon,
470             "SYSVOLPATH": sysvol,
471             "SIDGENERATOR_LINE": sid_generator_line,
472             "PRIVATEDIR_LINE": privatedir_line,
473             "LOCKDIR_LINE": lockdir_line
474             })
475
476
477 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
478                         users_gid, wheel_gid):
479     """setup reasonable name mappings for sam names to unix names.
480
481     :param samdb: SamDB object.
482     :param idmap: IDmap db object.
483     :param sid: The domain sid.
484     :param domaindn: The domain DN.
485     :param root_uid: uid of the UNIX root user.
486     :param nobody_uid: uid of the UNIX nobody user.
487     :param users_gid: gid of the UNIX users group.
488     :param wheel_gid: gid of the UNIX wheel group."""
489
490     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
491     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
492     
493     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
494     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
495
496 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
497                            provision_backend, names, schema,
498                            serverrole, 
499                            erase=False):
500     """Setup the partitions for the SAM database. 
501     
502     Alternatively, provision() may call this, and then populate the database.
503     
504     :note: This will wipe the Sam Database!
505     
506     :note: This function always removes the local SAM LDB file. The erase 
507         parameter controls whether to erase the existing data, which 
508         may not be stored locally but in LDAP.
509
510     """
511     assert session_info is not None
512
513     old_partitions = None
514     new_partitions = None
515
516     # We use options=["modules:"] to stop the modules loading - we
517     # just want to wipe and re-initialise the database, not start it up
518
519     try:
520         os.unlink(samdb_path)
521     except OSError:
522         pass
523
524     samdb = Ldb(url=samdb_path, session_info=session_info, 
525                 lp=lp, options=["modules:"])
526
527     #Add modules to the list to activate them by default
528     #beware often order is important
529     #
530     # Some Known ordering constraints:
531     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
532     # - objectclass must be before password_hash, because password_hash checks
533     #   that the objectclass is of type person (filled in by objectclass
534     #   module when expanding the objectclass list)
535     # - partition must be last
536     # - each partition has its own module list then
537     modules_list = ["resolve_oids",
538                     "rootdse",
539                     "lazy_commit",
540                     "acl",
541                     "paged_results",
542                     "ranged_results",
543                     "anr",
544                     "server_sort",
545                     "asq",
546                     "extended_dn_store",
547                     "extended_dn_in",
548                     "rdn_name",
549                     "objectclass",
550                     "descriptor",
551                     "samldb",
552                     "password_hash",
553                     "operational",
554                     "kludge_acl", 
555                     "instancetype"]
556     tdb_modules_list = [
557                     "subtree_rename",
558                     "subtree_delete",
559                     "linked_attributes",
560                     "extended_dn_out_ldb"]
561     modules_list2 = ["show_deleted",
562                      "schema_load",
563                      "new_partition",
564                      "partition"]
565
566     ldap_backend_line = "# No LDAP backend"
567     if provision_backend.type is not "ldb":
568         ldap_backend_line = "ldapBackend: %s" % provision_backend.ldapi_uri
569         
570         if provision_backend.ldap_backend_type == "fedora-ds":
571             backend_modules = ["nsuniqueid", "paged_searches"]
572             # We can handle linked attributes here, as we don't have directory-side subtree operations
573             tdb_modules_list = ["extended_dn_out_fds"]
574         elif ldap_backend.ldap_backend_type == "openldap":
575             backend_modules = ["entryuuid", "paged_searches"]
576             # OpenLDAP handles subtree renames, so we don't want to do any of these things
577             tdb_modules_list = ["extended_dn_out_openldap"]
578
579     elif serverrole == "domain controller":
580         tdb_modules_list.insert(0, "repl_meta_data")
581         backend_modules = []
582     else:
583         backend_modules = ["objectguid"]
584
585     if tdb_modules_list is None:
586         tdb_modules_list_as_string = ""
587     else:
588         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
589         
590     samdb.transaction_start()
591     try:
592         message("Setting up sam.ldb partitions and settings")
593         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
594                 "SCHEMADN": ldb.Dn(schema.ldb, names.schemadn).get_casefold(), 
595                 "SCHEMADN_MOD2": ",objectguid",
596                 "CONFIGDN": ldb.Dn(schema.ldb, names.configdn).get_casefold(),
597                 "DOMAINDN": ldb.Dn(schema.ldb, names.domaindn).get_casefold(),
598                 "SCHEMADN_MOD": "schema_data",
599                 "CONFIGDN_MOD": "naming_fsmo",
600                 "DOMAINDN_MOD": "pdc_fsmo",
601                 "MODULES_LIST": ",".join(modules_list),
602                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
603                 "MODULES_LIST2": ",".join(modules_list2),
604                 "BACKEND_MOD": ",".join(backend_modules),
605                 "LDAP_BACKEND_LINE": ldap_backend_line,
606         })
607
608         
609         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
610
611         message("Setting up sam.ldb rootDSE")
612         setup_samdb_rootdse(samdb, setup_path, names)
613
614     except:
615         samdb.transaction_cancel()
616         raise
617
618     samdb.transaction_commit()
619
620         
621 def secretsdb_self_join(secretsdb, domain, 
622                         netbiosname, domainsid, machinepass, 
623                         realm=None, dnsdomain=None,
624                         keytab_path=None, 
625                         key_version_number=1,
626                         secure_channel_type=SEC_CHAN_WKSTA):
627     """Add domain join-specific bits to a secrets database.
628     
629     :param secretsdb: Ldb Handle to the secrets database
630     :param machinepass: Machine password
631     """
632     attrs=["whenChanged",
633            "secret",
634            "priorSecret",
635            "priorChanged",
636            "krb5Keytab",
637            "privateKeytab"]
638     
639
640     msg = ldb.Message(ldb.Dn(secretsdb, "flatname=%s,cn=Primary Domains" % domain));
641     msg["secureChannelType"] = str(secure_channel_type)
642     msg["flatname"] = [domain]
643     msg["objectClass"] = ["top", "primaryDomain"]
644     if realm is not None:
645       if dnsdomain is None:
646         dnsdomain = realm.lower()
647       msg["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
648       msg["realm"] = realm
649       msg["saltPrincipal"] = "host/%s.%s@%s" % (netbiosname.lower(), dnsdomain.lower(), realm.upper())
650       msg["msDS-KeyVersionNumber"] = [str(key_version_number)]
651       msg["privateKeytab"] = ["secrets.keytab"];
652
653
654     msg["secret"] = [machinepass]
655     msg["samAccountName"] = ["%s$" % netbiosname]
656     msg["secureChannelType"] = [str(secure_channel_type)]
657     msg["objectSid"] = [ndr_pack(domainsid)]
658     
659     res = secretsdb.search(base="cn=Primary Domains", 
660                            attrs=attrs, 
661                            expression=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain))" % (domain, realm, str(domainsid))), 
662                            scope=SCOPE_ONELEVEL)
663     
664     for del_msg in res:
665       if del_msg.dn is not msg.dn:
666         secretsdb.delete(del_msg.dn)
667
668     res = secretsdb.search(base=msg.dn, attrs=attrs, scope=SCOPE_BASE)
669
670     if len(res) == 1:
671       msg["priorSecret"] = res[0]["secret"]
672       msg["priorWhenChanged"] = res[0]["whenChanged"]
673
674       if res["privateKeytab"] is not None:
675         msg["privateKeytab"] = res[0]["privateKeytab"]
676
677       if res["krb5Keytab"] is not None:
678         msg["krb5Keytab"] = res[0]["krb5Keytab"]
679
680       for el in msg:
681         el.set_flags(ldb.FLAG_MOD_REPLACE)
682         secretsdb.modify(msg)
683     else:
684       secretsdb.add(msg)
685
686
687 def secretsdb_setup_dns(secretsdb, setup_path, realm, dnsdomain, 
688                         dns_keytab_path, dnspass):
689     """Add DNS specific bits to a secrets database.
690     
691     :param secretsdb: Ldb Handle to the secrets database
692     :param setup_path: Setup path function
693     :param machinepass: Machine password
694     """
695     setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), { 
696             "REALM": realm,
697             "DNSDOMAIN": dnsdomain,
698             "DNS_KEYTAB": dns_keytab_path,
699             "DNSPASS_B64": b64encode(dnspass),
700             })
701
702
703 def setup_secretsdb(path, setup_path, session_info, backend_credentials, lp):
704     """Setup the secrets database.
705
706     :param path: Path to the secrets database.
707     :param setup_path: Get the path to a setup file.
708     :param session_info: Session info.
709     :param credentials: Credentials
710     :param lp: Loadparm context
711     :return: LDB handle for the created secrets database
712     """
713     if os.path.exists(path):
714         os.unlink(path)
715     secrets_ldb = Ldb(path, session_info=session_info, 
716                       lp=lp)
717     secrets_ldb.erase()
718     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
719     secrets_ldb = Ldb(path, session_info=session_info, 
720                       lp=lp)
721     secrets_ldb.transaction_start()
722     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
723
724     if backend_credentials is not None and backend_credentials.authentication_requested():
725         if backend_credentials.get_bind_dn() is not None:
726             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
727                     "LDAPMANAGERDN": backend_credentials.get_bind_dn(),
728                     "LDAPMANAGERPASS_B64": b64encode(backend_credentials.get_password())
729                     })
730         else:
731             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
732                     "LDAPADMINUSER": backend_credentials.get_username(),
733                     "LDAPADMINREALM": backend_credentials.get_realm(),
734                     "LDAPADMINPASS_B64": b64encode(backend_credentials.get_password())
735                     })
736
737     return secrets_ldb
738
739 def setup_privileges(path, setup_path, session_info, lp):
740     """Setup the privileges database.
741
742     :param path: Path to the privileges database.
743     :param setup_path: Get the path to a setup file.
744     :param session_info: Session info.
745     :param credentials: Credentials
746     :param lp: Loadparm context
747     :return: LDB handle for the created secrets database
748     """
749     if os.path.exists(path):
750         os.unlink(path)
751     privilege_ldb = Ldb(path, session_info=session_info, lp=lp)
752     privilege_ldb.erase()
753     privilege_ldb.load_ldif_file_add(setup_path("provision_privilege.ldif"))
754
755
756 def setup_registry(path, setup_path, session_info, lp):
757     """Setup the registry.
758     
759     :param path: Path to the registry database
760     :param setup_path: Function that returns the path to a setup.
761     :param session_info: Session information
762     :param credentials: Credentials
763     :param lp: Loadparm context
764     """
765     reg = registry.Registry()
766     hive = registry.open_ldb(path, session_info=session_info, 
767                          lp_ctx=lp)
768     reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
769     provision_reg = setup_path("provision.reg")
770     assert os.path.exists(provision_reg)
771     reg.diff_apply(provision_reg)
772
773
774 def setup_idmapdb(path, setup_path, session_info, lp):
775     """Setup the idmap database.
776
777     :param path: path to the idmap database
778     :param setup_path: Function that returns a path to a setup file
779     :param session_info: Session information
780     :param credentials: Credentials
781     :param lp: Loadparm context
782     """
783     if os.path.exists(path):
784         os.unlink(path)
785
786     idmap_ldb = IDmapDB(path, session_info=session_info,
787                         lp=lp)
788
789     idmap_ldb.erase()
790     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
791     return idmap_ldb
792
793
794 def setup_samdb_rootdse(samdb, setup_path, names):
795     """Setup the SamDB rootdse.
796
797     :param samdb: Sam Database handle
798     :param setup_path: Obtain setup path
799     """
800     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
801         "SCHEMADN": names.schemadn, 
802         "NETBIOSNAME": names.netbiosname,
803         "DNSDOMAIN": names.dnsdomain,
804         "REALM": names.realm,
805         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
806         "DOMAINDN": names.domaindn,
807         "ROOTDN": names.rootdn,
808         "CONFIGDN": names.configdn,
809         "SERVERDN": names.serverdn,
810         })
811         
812
813 def setup_self_join(samdb, names,
814                     machinepass, dnspass, 
815                     domainsid, invocationid, setup_path,
816                     policyguid, policyguid_dc, domainControllerFunctionality,
817                     ntdsguid):
818     """Join a host to its own domain."""
819     assert isinstance(invocationid, str)
820     if ntdsguid is not None:
821         ntdsguid_line = "objectGUID: %s\n"%ntdsguid
822     else:
823         ntdsguid_line = ""
824     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
825               "CONFIGDN": names.configdn, 
826               "SCHEMADN": names.schemadn,
827               "DOMAINDN": names.domaindn,
828               "SERVERDN": names.serverdn,
829               "INVOCATIONID": invocationid,
830               "NETBIOSNAME": names.netbiosname,
831               "DEFAULTSITE": names.sitename,
832               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
833               "MACHINEPASS_B64": b64encode(machinepass),
834               "DNSPASS_B64": b64encode(dnspass),
835               "REALM": names.realm,
836               "DOMAIN": names.domain,
837               "DNSDOMAIN": names.dnsdomain,
838               "SAMBA_VERSION_STRING": version,
839               "NTDSGUID": ntdsguid_line,
840               "DOMAIN_CONTROLLER_FUNCTIONALITY": str(domainControllerFunctionality)})
841
842     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
843               "POLICYGUID": policyguid,
844               "POLICYGUID_DC": policyguid_dc,
845               "DNSDOMAIN": names.dnsdomain,
846               "DOMAINSID": str(domainsid),
847               "DOMAINDN": names.domaindn})
848     
849     # add the NTDSGUID based SPNs
850     ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
851     names.ntdsguid = samdb.searchone(basedn=ntds_dn, attribute="objectGUID",
852                                      expression="", scope=SCOPE_BASE)
853     assert isinstance(names.ntdsguid, str)
854
855     # Setup fSMORoleOwner entries to point at the newly created DC entry
856     setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
857               "DOMAIN": names.domain,
858               "DNSDOMAIN": names.dnsdomain,
859               "DOMAINDN": names.domaindn,
860               "CONFIGDN": names.configdn,
861               "SCHEMADN": names.schemadn, 
862               "DEFAULTSITE": names.sitename,
863               "SERVERDN": names.serverdn,
864               "NETBIOSNAME": names.netbiosname,
865               "NTDSGUID": names.ntdsguid
866               })
867
868
869 def setup_samdb(path, setup_path, session_info, provision_backend, lp, 
870                 names, message, 
871                 domainsid, domainguid, policyguid, policyguid_dc,
872                 fill, adminpass, krbtgtpass, 
873                 machinepass, invocationid, dnspass, ntdsguid,
874                 serverrole, dom_for_fun_level=None,
875                 schema=None):
876     """Setup a complete SAM Database.
877     
878     :note: This will wipe the main SAM database file!
879     """
880
881     # ATTENTION: Do NOT change these default values without discussion with the
882     # team and/or release manager. They have a big impact on the whole program!
883     domainControllerFunctionality = DS_DC_FUNCTION_2008
884
885     if dom_for_fun_level is None:
886         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
887     if dom_for_fun_level < DS_DOMAIN_FUNCTION_2003:
888         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level lower than Windows 2003 (Native). This isn't supported!")
889
890     if dom_for_fun_level > domainControllerFunctionality:
891         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008). This won't work!")
892
893     domainFunctionality = dom_for_fun_level
894     forestFunctionality = dom_for_fun_level
895
896     # Also wipes the database
897     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
898                            provision_backend=provision_backend, session_info=session_info,
899                            names=names, 
900                            serverrole=serverrole, schema=schema)
901
902     if (schema == None):
903         schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
904                         sambadn=names.sambadn)
905
906     # Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
907     samdb = Ldb(session_info=session_info, 
908                 credentials=provision_backend.credentials, lp=lp)
909
910     message("Pre-loading the Samba 4 and AD schema")
911
912     # Load the schema from the one we computed earlier
913     samdb.set_schema_from_ldb(schema.ldb)
914
915     # And now we can connect to the DB - the schema won't be loaded from the DB
916     samdb.connect(path)
917
918     if fill == FILL_DRS:
919         return samdb
920         
921     samdb.transaction_start()
922     try:
923         # Set the domain functionality levels onto the database.
924         # Various module (the password_hash module in particular) need
925         # to know what level of AD we are emulating.
926
927         # These will be fixed into the database via the database
928         # modifictions below, but we need them set from the start.
929         samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
930         samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
931         samdb.set_opaque_integer("domainControllerFunctionality", domainControllerFunctionality)
932
933         samdb.set_domain_sid(str(domainsid))
934         if serverrole == "domain controller":
935             samdb.set_invocation_id(invocationid)
936
937         message("Adding DomainDN: %s" % names.domaindn)
938
939 #impersonate domain admin
940         admin_session_info = admin_session(lp, str(domainsid))
941         samdb.set_session_info(admin_session_info)
942         if domainguid is not None:
943             domainguid_line = "objectGUID: %s\n-" % domainguid
944         else:
945             domainguid_line = ""
946         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
947                 "DOMAINDN": names.domaindn,
948                 "DOMAINGUID": domainguid_line
949                 })
950
951
952         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
953             "CREATTIME": str(int(time.time() * 1e7)), # seconds -> ticks
954             "DOMAINSID": str(domainsid),
955             "SCHEMADN": names.schemadn, 
956             "NETBIOSNAME": names.netbiosname,
957             "DEFAULTSITE": names.sitename,
958             "CONFIGDN": names.configdn,
959             "SERVERDN": names.serverdn,
960             "POLICYGUID": policyguid,
961             "DOMAINDN": names.domaindn,
962             "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
963             "SAMBA_VERSION_STRING": version
964             })
965
966         message("Adding configuration container")
967         descr = get_config_descriptor(domainsid);
968         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
969             "CONFIGDN": names.configdn, 
970             "DESCRIPTOR": descr,
971             })
972         message("Modifying configuration container")
973         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
974             "CONFIGDN": names.configdn, 
975             "SCHEMADN": names.schemadn,
976             })
977
978         # The LDIF here was created when the Schema object was constructed
979         message("Setting up sam.ldb schema")
980         samdb.add_ldif(schema.schema_dn_add, controls=["relax:0"])
981         samdb.modify_ldif(schema.schema_dn_modify)
982         samdb.write_prefixes_from_schema()
983         samdb.add_ldif(schema.schema_data, controls=["relax:0"])
984         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"), 
985                        {"SCHEMADN": names.schemadn})
986
987         message("Setting up sam.ldb configuration data")
988         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
989             "CONFIGDN": names.configdn,
990             "NETBIOSNAME": names.netbiosname,
991             "DEFAULTSITE": names.sitename,
992             "DNSDOMAIN": names.dnsdomain,
993             "DOMAIN": names.domain,
994             "SCHEMADN": names.schemadn,
995             "DOMAINDN": names.domaindn,
996             "SERVERDN": names.serverdn,
997             "FOREST_FUNCTIONALALITY": str(forestFunctionality)
998             })
999
1000         message("Setting up display specifiers")
1001         display_specifiers_ldif = read_ms_ldif(setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
1002         display_specifiers_ldif = substitute_var(display_specifiers_ldif, {"CONFIGDN": names.configdn})
1003         check_all_substituted(display_specifiers_ldif)
1004         samdb.add_ldif(display_specifiers_ldif)
1005
1006         message("Adding users container")
1007         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
1008                 "DOMAINDN": names.domaindn})
1009         message("Modifying users container")
1010         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
1011                 "DOMAINDN": names.domaindn})
1012         message("Adding computers container")
1013         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
1014                 "DOMAINDN": names.domaindn})
1015         message("Modifying computers container")
1016         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
1017                 "DOMAINDN": names.domaindn})
1018         message("Setting up sam.ldb data")
1019         setup_add_ldif(samdb, setup_path("provision.ldif"), {
1020             "CREATTIME": str(int(time.time() * 1e7)), # seconds -> ticks
1021             "DOMAINDN": names.domaindn,
1022             "NETBIOSNAME": names.netbiosname,
1023             "DEFAULTSITE": names.sitename,
1024             "CONFIGDN": names.configdn,
1025             "SERVERDN": names.serverdn,
1026             "POLICYGUID_DC": policyguid_dc
1027             })
1028
1029         if fill == FILL_FULL:
1030             message("Setting up sam.ldb users and groups")
1031             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
1032                 "DOMAINDN": names.domaindn,
1033                 "DOMAINSID": str(domainsid),
1034                 "CONFIGDN": names.configdn,
1035                 "ADMINPASS_B64": b64encode(adminpass),
1036                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
1037                 })
1038
1039             if serverrole == "domain controller":
1040                 message("Setting up self join")
1041                 setup_self_join(samdb, names=names, invocationid=invocationid, 
1042                                 dnspass=dnspass,  
1043                                 machinepass=machinepass, 
1044                                 domainsid=domainsid, policyguid=policyguid,
1045                                 policyguid_dc=policyguid_dc,
1046                                 setup_path=setup_path,
1047                                 domainControllerFunctionality=domainControllerFunctionality,
1048                                 ntdsguid=ntdsguid)
1049
1050                 ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
1051                 names.ntdsguid = samdb.searchone(basedn=ntds_dn,
1052                   attribute="objectGUID", expression="", scope=SCOPE_BASE)
1053                 assert isinstance(names.ntdsguid, str)
1054
1055     except:
1056         samdb.transaction_cancel()
1057         raise
1058
1059     samdb.transaction_commit()
1060     return samdb
1061
1062
1063 FILL_FULL = "FULL"
1064 FILL_NT4SYNC = "NT4SYNC"
1065 FILL_DRS = "DRS"
1066
1067
1068 def provision(setup_dir, message, session_info, 
1069               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
1070               realm=None, 
1071               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
1072               serverdn=None,
1073               domain=None, hostname=None, hostip=None, hostip6=None, 
1074               domainsid=None, adminpass=None, ldapadminpass=None, 
1075               krbtgtpass=None, domainguid=None, 
1076               policyguid=None, policyguid_dc=None, invocationid=None,
1077               machinepass=None, ntdsguid=None,
1078               dnspass=None, root=None, nobody=None, users=None, 
1079               wheel=None, backup=None, aci=None, serverrole=None,
1080               dom_for_fun_level=None,
1081               ldap_backend_extra_port=None, backend_type=None,
1082               sitename=None,
1083               ol_mmr_urls=None, ol_olc=None, 
1084               setup_ds_path=None, slapd_path=None, nosync=False,
1085               ldap_dryrun_mode=False):
1086     """Provision samba4
1087     
1088     :note: caution, this wipes all existing data!
1089     """
1090
1091     def setup_path(file):
1092       return os.path.join(setup_dir, file)
1093
1094     if domainsid is None:
1095       domainsid = security.random_sid()
1096     else:
1097       domainsid = security.dom_sid(domainsid)
1098
1099     # create/adapt the group policy GUIDs
1100     if policyguid is None:
1101         policyguid = str(uuid.uuid4())
1102     policyguid = policyguid.upper()
1103     if policyguid_dc is None:
1104         policyguid_dc = str(uuid.uuid4())
1105     policyguid_dc = policyguid_dc.upper()
1106
1107     if adminpass is None:
1108         adminpass = glue.generate_random_str(12)
1109     if krbtgtpass is None:
1110         krbtgtpass = glue.generate_random_str(12)
1111     if machinepass is None:
1112         machinepass  = glue.generate_random_str(12)
1113     if dnspass is None:
1114         dnspass = glue.generate_random_str(12)
1115     if ldapadminpass is None:
1116         #Make a new, random password between Samba and it's LDAP server
1117         ldapadminpass=glue.generate_random_str(12)        
1118
1119     if backend_type is None:
1120         backend_type = "ldb"
1121
1122     sid_generator = "internal"
1123     if backend_type == "fedora-ds":
1124         sid_generator = "backend"
1125
1126     root_uid = findnss_uid([root or "root"])
1127     nobody_uid = findnss_uid([nobody or "nobody"])
1128     users_gid = findnss_gid([users or "users"])
1129     if wheel is None:
1130         wheel_gid = findnss_gid(["wheel", "adm"])
1131     else:
1132         wheel_gid = findnss_gid([wheel])
1133
1134     if targetdir is not None:
1135         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1136             os.makedirs(os.path.join(targetdir, "etc"))
1137         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1138     elif smbconf is None:
1139         smbconf = param.default_path()
1140
1141     # only install a new smb.conf if there isn't one there already
1142     if not os.path.exists(smbconf):
1143         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
1144                      targetdir, sid_generator)
1145
1146     lp = param.LoadParm()
1147     lp.load(smbconf)
1148
1149     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1150                         dnsdomain=realm, serverrole=serverrole,
1151                         domaindn=domaindn, configdn=configdn, schemadn=schemadn,
1152                         serverdn=serverdn, sitename=sitename)
1153
1154     paths = provision_paths_from_lp(lp, names.dnsdomain)
1155
1156     if hostip is None:
1157         try:
1158             hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1159         except socket.gaierror, (socket.EAI_NODATA, msg):
1160             hostip = None
1161
1162     if hostip6 is None:
1163         try:
1164             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1165         except socket.gaierror, (socket.EAI_NODATA, msg): 
1166             hostip6 = None
1167
1168     if serverrole is None:
1169         serverrole = lp.get("server role")
1170
1171     assert serverrole in ("domain controller", "member server", "standalone")
1172     if invocationid is None and serverrole == "domain controller":
1173         invocationid = str(uuid.uuid4())
1174
1175     if not os.path.exists(paths.private_dir):
1176         os.mkdir(paths.private_dir)
1177
1178     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1179     
1180     schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
1181                     sambadn=names.sambadn)
1182     
1183     provision_backend = ProvisionBackend(backend_type,
1184                                          paths=paths, setup_path=setup_path,
1185                                          lp=lp, credentials=credentials, 
1186                                          names=names,
1187                                          message=message, hostname=hostname,
1188                                          root=root, schema=schema,
1189                                          ldapadminpass=ldapadminpass,
1190                                          ldap_backend_extra_port=ldap_backend_extra_port,
1191                                          ol_mmr_urls=ol_mmr_urls, 
1192                                          slapd_path=slapd_path,
1193                                          setup_ds_path=setup_ds_path,
1194                                          ldap_dryrun_mode=ldap_dryrun_mode,
1195                                          domainsid=domainsid)
1196
1197     # only install a new shares config db if there is none
1198     if not os.path.exists(paths.shareconf):
1199         message("Setting up share.ldb")
1200         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
1201                         lp=lp)
1202         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1203
1204      
1205     message("Setting up secrets.ldb")
1206     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
1207                                   session_info=session_info, 
1208                                   backend_credentials=provision_backend.secrets_credentials, lp=lp)
1209
1210     message("Setting up the registry")
1211     setup_registry(paths.hklm, setup_path, session_info, 
1212                    lp=lp)
1213
1214     message("Setting up the privileges database")
1215     setup_privileges(paths.privilege, setup_path, session_info, lp=lp)
1216
1217     message("Setting up idmap db")
1218     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1219                           lp=lp)
1220
1221     message("Setting up SAM db")
1222     samdb = setup_samdb(paths.samdb, setup_path, session_info, 
1223                         provision_backend, lp, names,
1224                         message, 
1225                         domainsid=domainsid, 
1226                         schema=schema, domainguid=domainguid,
1227                         policyguid=policyguid, policyguid_dc=policyguid_dc,
1228                         fill=samdb_fill, 
1229                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1230                         invocationid=invocationid, 
1231                         machinepass=machinepass, dnspass=dnspass, 
1232                         ntdsguid=ntdsguid, serverrole=serverrole,
1233                         dom_for_fun_level=dom_for_fun_level)
1234
1235     if serverrole == "domain controller":
1236         if paths.netlogon is None:
1237             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1238             message("Please either remove %s or see the template at %s" % 
1239                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1240             assert(paths.netlogon is not None)
1241
1242         if paths.sysvol is None:
1243             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1244             message("Please either remove %s or see the template at %s" % 
1245                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1246             assert(paths.sysvol is not None)            
1247             
1248         # Set up group policies (domain policy and domain controller policy)
1249
1250         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1251                                    "{" + policyguid + "}")
1252         os.makedirs(policy_path, 0755)
1253         open(os.path.join(policy_path, "GPT.INI"), 'w').write(
1254                                    "[General]\r\nVersion=65543")
1255         os.makedirs(os.path.join(policy_path, "MACHINE"), 0755)
1256         os.makedirs(os.path.join(policy_path, "USER"), 0755)
1257
1258         policy_path_dc = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1259                                    "{" + policyguid_dc + "}")
1260         os.makedirs(policy_path_dc, 0755)
1261         open(os.path.join(policy_path_dc, "GPT.INI"), 'w').write(
1262                                    "[General]\r\nVersion=2")
1263         os.makedirs(os.path.join(policy_path_dc, "MACHINE"), 0755)
1264         os.makedirs(os.path.join(policy_path_dc, "USER"), 0755)
1265
1266         if not os.path.isdir(paths.netlogon):
1267             os.makedirs(paths.netlogon, 0755)
1268
1269     if samdb_fill == FILL_FULL:
1270         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1271                             root_uid=root_uid, nobody_uid=nobody_uid,
1272                             users_gid=users_gid, wheel_gid=wheel_gid)
1273
1274         message("Setting up sam.ldb rootDSE marking as synchronized")
1275         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1276
1277         # Only make a zone file on the first DC, it should be replicated with DNS replication
1278         if serverrole == "domain controller":
1279             secretsdb_self_join(secrets_ldb, domain=domain,
1280                                 realm=names.realm,
1281                                 dnsdomain=names.dnsdomain,
1282                                 netbiosname=names.netbiosname,
1283                                 domainsid=domainsid, 
1284                                 machinepass=machinepass,
1285                                 secure_channel_type=SEC_CHAN_BDC)
1286
1287             secretsdb_setup_dns(secrets_ldb, setup_path, 
1288                                 realm=names.realm, dnsdomain=names.dnsdomain,
1289                                 dns_keytab_path=paths.dns_keytab,
1290                                 dnspass=dnspass)
1291
1292             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1293             assert isinstance(domainguid, str)
1294
1295             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1296                              hostip=hostip,
1297                              hostip6=hostip6, hostname=names.hostname,
1298                              realm=names.realm,
1299                              domainguid=domainguid, ntdsguid=names.ntdsguid)
1300
1301             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1302                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1303
1304             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1305                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1306                               keytab_name=paths.dns_keytab)
1307             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1308             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1309
1310             create_krb5_conf(paths.krb5conf, setup_path,
1311                              dnsdomain=names.dnsdomain, hostname=names.hostname,
1312                              realm=names.realm)
1313             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1314
1315     if provision_backend.post_setup is not None:
1316         provision_backend.post_setup()
1317
1318     if provision_backend.shutdown is not None:
1319         provision_backend.shutdown()
1320     
1321     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1322                                ldapi_url)
1323
1324     #Now commit the secrets.ldb to disk
1325     secrets_ldb.transaction_commit()
1326
1327     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1328
1329     message("Once the above files are installed, your Samba4 server will be ready to use")
1330     message("Server Role:           %s" % serverrole)
1331     message("Hostname:              %s" % names.hostname)
1332     message("NetBIOS Domain:        %s" % names.domain)
1333     message("DNS Domain:            %s" % names.dnsdomain)
1334     message("DOMAIN SID:            %s" % str(domainsid))
1335     if samdb_fill == FILL_FULL:
1336         message("Admin password:    %s" % adminpass)
1337     if provision_backend.type is not "ldb":
1338         if provision_backend.credentials.get_bind_dn() is not None:
1339             message("LDAP Backend Admin DN: %s" % provision_backend.credentials.get_bind_dn())
1340         else:
1341             message("LDAP Admin User:       %s" % provision_backend.credentials.get_username())
1342
1343         message("LDAP Admin Password:   %s" % provision_backend.credentials.get_password())
1344
1345         if provision_backend.slapd_command_escaped is not None:
1346             # now display slapd_command_file.txt to show how slapd must be started next time
1347             message("Use later the following commandline to start slapd, then Samba:")
1348             message(provision_backend.slapd_command_escaped)
1349             message("This slapd-Commandline is also stored under: " + paths.ldapdir + "/ldap_backend_startup.sh")
1350
1351
1352     result = ProvisionResult()
1353     result.domaindn = domaindn
1354     result.paths = paths
1355     result.lp = lp
1356     result.samdb = samdb
1357     return result
1358
1359
1360
1361 def provision_become_dc(setup_dir=None,
1362                         smbconf=None, targetdir=None, realm=None, 
1363                         rootdn=None, domaindn=None, schemadn=None,
1364                         configdn=None, serverdn=None,
1365                         domain=None, hostname=None, domainsid=None, 
1366                         adminpass=None, krbtgtpass=None, domainguid=None, 
1367                         policyguid=None, policyguid_dc=None, invocationid=None,
1368                         machinepass=None, 
1369                         dnspass=None, root=None, nobody=None, users=None, 
1370                         wheel=None, backup=None, serverrole=None, 
1371                         ldap_backend=None, ldap_backend_type=None,
1372                         sitename=None, debuglevel=1):
1373
1374     def message(text):
1375         """print a message if quiet is not set."""
1376         print text
1377
1378     glue.set_debug_level(debuglevel)
1379
1380     return provision(setup_dir, message, system_session(), None,
1381               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
1382               realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
1383               configdn=configdn, serverdn=serverdn, domain=domain,
1384               hostname=hostname, hostip="127.0.0.1", domainsid=domainsid,
1385               machinepass=machinepass, serverrole="domain controller",
1386               sitename=sitename)
1387
1388
1389 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1390     """Create a PHP LDAP admin configuration file.
1391
1392     :param path: Path to write the configuration to.
1393     :param setup_path: Function to generate setup paths.
1394     """
1395     setup_file(setup_path("phpldapadmin-config.php"), path, 
1396             {"S4_LDAPI_URI": ldapi_uri})
1397
1398
1399 def create_zone_file(path, setup_path, dnsdomain, 
1400                      hostip, hostip6, hostname, realm, domainguid,
1401                      ntdsguid):
1402     """Write out a DNS zone file, from the info in the current database.
1403
1404     :param path: Path of the new zone file.
1405     :param setup_path: Setup path function.
1406     :param dnsdomain: DNS Domain name
1407     :param domaindn: DN of the Domain
1408     :param hostip: Local IPv4 IP
1409     :param hostip6: Local IPv6 IP
1410     :param hostname: Local hostname
1411     :param realm: Realm name
1412     :param domainguid: GUID of the domain.
1413     :param ntdsguid: GUID of the hosts nTDSDSA record.
1414     """
1415     assert isinstance(domainguid, str)
1416
1417     if hostip6 is not None:
1418         hostip6_base_line = "            IN AAAA    " + hostip6
1419         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1420     else:
1421         hostip6_base_line = ""
1422         hostip6_host_line = ""
1423
1424     if hostip is not None:
1425         hostip_base_line = "            IN A    " + hostip
1426         hostip_host_line = hostname + "        IN A    " + hostip
1427     else:
1428         hostip_base_line = ""
1429         hostip_host_line = ""
1430
1431     setup_file(setup_path("provision.zone"), path, {
1432             "HOSTNAME": hostname,
1433             "DNSDOMAIN": dnsdomain,
1434             "REALM": realm,
1435             "HOSTIP_BASE_LINE": hostip_base_line,
1436             "HOSTIP_HOST_LINE": hostip_host_line,
1437             "DOMAINGUID": domainguid,
1438             "DATESTRING": time.strftime("%Y%m%d%H"),
1439             "DEFAULTSITE": DEFAULTSITE,
1440             "NTDSGUID": ntdsguid,
1441             "HOSTIP6_BASE_LINE": hostip6_base_line,
1442             "HOSTIP6_HOST_LINE": hostip6_host_line,
1443         })
1444
1445
1446 def create_named_conf(path, setup_path, realm, dnsdomain,
1447                       private_dir):
1448     """Write out a file containing zone statements suitable for inclusion in a
1449     named.conf file (including GSS-TSIG configuration).
1450     
1451     :param path: Path of the new named.conf file.
1452     :param setup_path: Setup path function.
1453     :param realm: Realm name
1454     :param dnsdomain: DNS Domain name
1455     :param private_dir: Path to private directory
1456     :param keytab_name: File name of DNS keytab file
1457     """
1458
1459     setup_file(setup_path("named.conf"), path, {
1460             "DNSDOMAIN": dnsdomain,
1461             "REALM": realm,
1462             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
1463             "PRIVATE_DIR": private_dir
1464             })
1465
1466 def create_named_txt(path, setup_path, realm, dnsdomain,
1467                       private_dir, keytab_name):
1468     """Write out a file containing zone statements suitable for inclusion in a
1469     named.conf file (including GSS-TSIG configuration).
1470     
1471     :param path: Path of the new named.conf file.
1472     :param setup_path: Setup path function.
1473     :param realm: Realm name
1474     :param dnsdomain: DNS Domain name
1475     :param private_dir: Path to private directory
1476     :param keytab_name: File name of DNS keytab file
1477     """
1478
1479     setup_file(setup_path("named.txt"), path, {
1480             "DNSDOMAIN": dnsdomain,
1481             "REALM": realm,
1482             "DNS_KEYTAB": keytab_name,
1483             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
1484             "PRIVATE_DIR": private_dir
1485         })
1486
1487 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
1488     """Write out a file containing zone statements suitable for inclusion in a
1489     named.conf file (including GSS-TSIG configuration).
1490     
1491     :param path: Path of the new named.conf file.
1492     :param setup_path: Setup path function.
1493     :param dnsdomain: DNS Domain name
1494     :param hostname: Local hostname
1495     :param realm: Realm name
1496     """
1497
1498     setup_file(setup_path("krb5.conf"), path, {
1499             "DNSDOMAIN": dnsdomain,
1500             "HOSTNAME": hostname,
1501             "REALM": realm,
1502         })
1503
1504