s4:provision Split ProvisionBackend out of the main provision script
[ira/wip.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
8 #
9 # Based on the original in EJS:
10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
11 #
12 # This program is free software; you can redistribute it and/or modify
13 # it under the terms of the GNU General Public License as published by
14 # the Free Software Foundation; either version 3 of the License, or
15 # (at your option) any later version.
16 #   
17 # This program is distributed in the hope that it will be useful,
18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20 # GNU General Public License for more details.
21 #   
22 # You should have received a copy of the GNU General Public License
23 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 #
25
26 """Functions for setting up a Samba configuration."""
27
28 from base64 import b64encode
29 import os
30 import sys
31 import pwd
32 import grp
33 import time
34 import uuid, glue
35 import socket
36 import param
37 import registry
38 import samba
39 import subprocess
40 import ldb
41
42 import shutil
43
44 from auth import system_session, admin_session
45 from samba import version, Ldb, substitute_var, valid_netbios_name, setup_file
46 from samba import check_all_substituted, read_and_sub_file
47 from samba import DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, DS_DC_FUNCTION_2008
48 from samba.samdb import SamDB
49 from samba.idmap import IDmapDB
50 from samba.dcerpc import security
51 from samba.ndr import ndr_pack
52 import urllib
53 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
54 from ms_display_specifiers import read_ms_ldif
55 from schema import Schema
56 from provisionbackend import ProvisionBackend
57 from signal import SIGTERM
58 from dcerpc.misc import SEC_CHAN_BDC, SEC_CHAN_WKSTA
59
60 __docformat__ = "restructuredText"
61
62 def find_setup_dir():
63     """Find the setup directory used by provision."""
64     dirname = os.path.dirname(__file__)
65     if "/site-packages/" in dirname:
66         prefix = "/".join(dirname[:dirname.index("/site-packages/")].split("/")[:-2])
67         for suffix in ["share/setup", "share/samba/setup", "setup"]:
68             ret = os.path.join(prefix, suffix)
69             if os.path.isdir(ret):
70                 return ret
71     # In source tree
72     ret = os.path.join(dirname, "../../../setup")
73     if os.path.isdir(ret):
74         return ret
75     raise Exception("Unable to find setup directory.")
76
77 def get_config_descriptor(domain_sid):
78     sddl = "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
79            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
80            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
81            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
82            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
83            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
84            "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
85            "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \
86            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
87            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
88            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
89            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
90            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)" \
91            "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \
92            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
93     sec = security.descriptor.from_sddl(sddl, domain_sid)
94     return b64encode(ndr_pack(sec))
95
96
97 DEFAULTSITE = "Default-First-Site-Name"
98
99 # Exception classes
100
101 class ProvisioningError(Exception):
102     """A generic provision error."""
103
104 class InvalidNetbiosName(Exception):
105     """A specified name was not a valid NetBIOS name."""
106     def __init__(self, name):
107         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
108
109
110 class ProvisionPaths(object):
111     def __init__(self):
112         self.shareconf = None
113         self.hklm = None
114         self.hkcu = None
115         self.hkcr = None
116         self.hku = None
117         self.hkpd = None
118         self.hkpt = None
119         self.samdb = None
120         self.idmapdb = None
121         self.secrets = None
122         self.keytab = None
123         self.dns_keytab = None
124         self.dns = None
125         self.winsdb = None
126         self.private_dir = None
127         self.ldapdir = None
128         self.slapdconf = None
129         self.modulesconf = None
130         self.memberofconf = None
131         self.fedoradsinf = None
132         self.fedoradspartitions = None
133         self.fedoradssasl = None
134         self.fedoradsdna = None
135         self.fedoradspam = None
136         self.fedoradsrefint = None
137         self.fedoradslinkedattributes = None
138         self.fedoradsindex = None
139         self.fedoradssamba = None
140         self.olmmron = None
141         self.olmmrserveridsconf = None
142         self.olmmrsyncreplconf = None
143         self.olcdir = None
144         self.olslapd = None
145         self.olcseedldif = None
146
147
148 class ProvisionNames(object):
149     def __init__(self):
150         self.rootdn = None
151         self.domaindn = None
152         self.configdn = None
153         self.schemadn = None
154         self.sambadn = None
155         self.ldapmanagerdn = None
156         self.dnsdomain = None
157         self.realm = None
158         self.netbiosname = None
159         self.domain = None
160         self.hostname = None
161         self.sitename = None
162         self.smbconf = None
163     
164
165 class ProvisionResult(object):
166     def __init__(self):
167         self.paths = None
168         self.domaindn = None
169         self.lp = None
170         self.samdb = None
171
172 def check_install(lp, session_info, credentials):
173     """Check whether the current install seems ok.
174     
175     :param lp: Loadparm context
176     :param session_info: Session information
177     :param credentials: Credentials
178     """
179     if lp.get("realm") == "":
180         raise Exception("Realm empty")
181     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
182             credentials=credentials, lp=lp)
183     if len(ldb.search("(cn=Administrator)")) != 1:
184         raise ProvisioningError("No administrator account found")
185
186
187 def findnss(nssfn, names):
188     """Find a user or group from a list of possibilities.
189     
190     :param nssfn: NSS Function to try (should raise KeyError if not found)
191     :param names: Names to check.
192     :return: Value return by first names list.
193     """
194     for name in names:
195         try:
196             return nssfn(name)
197         except KeyError:
198             pass
199     raise KeyError("Unable to find user/group %r" % names)
200
201
202 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
203 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
204
205
206 def setup_add_ldif(ldb, ldif_path, subst_vars=None,controls=["relax:0"]):
207     """Setup a ldb in the private dir.
208     
209     :param ldb: LDB file to import data into
210     :param ldif_path: Path of the LDIF file to load
211     :param subst_vars: Optional variables to subsitute in LDIF.
212     :param nocontrols: Optional list of controls, can be None for no controls
213     """
214     assert isinstance(ldif_path, str)
215     data = read_and_sub_file(ldif_path, subst_vars)
216     ldb.add_ldif(data,controls)
217
218
219 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
220     """Modify a ldb in the private dir.
221     
222     :param ldb: LDB object.
223     :param ldif_path: LDIF file path.
224     :param subst_vars: Optional dictionary with substitution variables.
225     """
226     data = read_and_sub_file(ldif_path, subst_vars)
227
228     ldb.modify_ldif(data)
229
230
231 def setup_ldb(ldb, ldif_path, subst_vars):
232     """Import a LDIF a file into a LDB handle, optionally substituting variables.
233
234     :note: Either all LDIF data will be added or none (using transactions).
235
236     :param ldb: LDB file to import into.
237     :param ldif_path: Path to the LDIF file.
238     :param subst_vars: Dictionary with substitution variables.
239     """
240     assert ldb is not None
241     ldb.transaction_start()
242     try:
243         setup_add_ldif(ldb, ldif_path, subst_vars)
244     except:
245         ldb.transaction_cancel()
246         raise
247     ldb.transaction_commit()
248
249
250 def provision_paths_from_lp(lp, dnsdomain):
251     """Set the default paths for provisioning.
252
253     :param lp: Loadparm context.
254     :param dnsdomain: DNS Domain name
255     """
256     paths = ProvisionPaths()
257     paths.private_dir = lp.get("private dir")
258     paths.dns_keytab = "dns.keytab"
259
260     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
261     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
262     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
263     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
264     paths.privilege = os.path.join(paths.private_dir, "privilege.ldb")
265     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
266     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
267     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
268     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
269     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
270     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
271     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
272                                             "phpldapadmin-config.php")
273     paths.ldapdir = os.path.join(paths.private_dir, 
274                                  "ldap")
275     paths.slapdconf = os.path.join(paths.ldapdir, 
276                                    "slapd.conf")
277     paths.slapdpid = os.path.join(paths.ldapdir, 
278                                    "slapd.pid")
279     paths.modulesconf = os.path.join(paths.ldapdir, 
280                                      "modules.conf")
281     paths.memberofconf = os.path.join(paths.ldapdir, 
282                                       "memberof.conf")
283     paths.fedoradsinf = os.path.join(paths.ldapdir, 
284                                      "fedorads.inf")
285     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
286                                             "fedorads-partitions.ldif")
287     paths.fedoradssasl = os.path.join(paths.ldapdir, 
288                                       "fedorads-sasl.ldif")
289     paths.fedoradsdna = os.path.join(paths.ldapdir, 
290                                      "fedorads-dna.ldif")
291     paths.fedoradspam = os.path.join(paths.ldapdir,
292                                      "fedorads-pam.ldif")
293     paths.fedoradsrefint = os.path.join(paths.ldapdir,
294                                         "fedorads-refint.ldif")
295     paths.fedoradslinkedattributes = os.path.join(paths.ldapdir,
296                                                   "fedorads-linked-attributes.ldif")
297     paths.fedoradsindex = os.path.join(paths.ldapdir,
298                                        "fedorads-index.ldif")
299     paths.fedoradssamba = os.path.join(paths.ldapdir, 
300                                        "fedorads-samba.ldif")
301     paths.olmmrserveridsconf = os.path.join(paths.ldapdir, 
302                                             "mmr_serverids.conf")
303     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir, 
304                                            "mmr_syncrepl.conf")
305     paths.olcdir = os.path.join(paths.ldapdir, 
306                                  "slapd.d")
307     paths.olcseedldif = os.path.join(paths.ldapdir, 
308                                  "olc_seed.ldif")
309     paths.hklm = "hklm.ldb"
310     paths.hkcr = "hkcr.ldb"
311     paths.hkcu = "hkcu.ldb"
312     paths.hku = "hku.ldb"
313     paths.hkpd = "hkpd.ldb"
314     paths.hkpt = "hkpt.ldb"
315
316     paths.sysvol = lp.get("path", "sysvol")
317
318     paths.netlogon = lp.get("path", "netlogon")
319
320     paths.smbconf = lp.configfile
321
322     return paths
323
324
325 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
326                 serverrole=None, rootdn=None, domaindn=None, configdn=None,
327                 schemadn=None, serverdn=None, sitename=None, sambadn=None):
328     """Guess configuration settings to use."""
329
330     if hostname is None:
331         hostname = socket.gethostname().split(".")[0]
332
333     netbiosname = lp.get("netbios name")
334     if netbiosname is None:
335         netbiosname = hostname
336     assert netbiosname is not None
337     netbiosname = netbiosname.upper()
338     if not valid_netbios_name(netbiosname):
339         raise InvalidNetbiosName(netbiosname)
340
341     if dnsdomain is None:
342         dnsdomain = lp.get("realm")
343     assert dnsdomain is not None
344     dnsdomain = dnsdomain.lower()
345
346     if serverrole is None:
347         serverrole = lp.get("server role")
348     assert serverrole is not None
349     serverrole = serverrole.lower()
350
351     realm = dnsdomain.upper()
352
353     if lp.get("realm").upper() != realm:
354         raise ProvisioningError("guess_names: Realm '%s' in smb.conf must match chosen realm '%s'!", lp.get("realm").upper(), realm)
355
356     if serverrole == "domain controller":
357         if domain is None:
358             domain = lp.get("workgroup")
359         assert domain is not None
360         domain = domain.upper()
361
362         if lp.get("workgroup").upper() != domain:
363             raise ProvisioningError("guess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!", lp.get("workgroup").upper(), domain)
364
365         if domaindn is None:
366             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
367     else:
368         domain = netbiosname
369         if domaindn is None:
370             domaindn = "DC=" + netbiosname
371         
372     if not valid_netbios_name(domain):
373         raise InvalidNetbiosName(domain)
374         
375     if hostname.upper() == realm:
376         raise ProvisioningError("guess_names: Realm '%s' must not be equal to hostname '%s'!", realm, hostname)
377     if netbiosname == realm:
378         raise ProvisioningError("guess_names: Realm '%s' must not be equal to netbios hostname '%s'!", realm, netbiosname)
379     if domain == realm:
380         raise ProvisioningError("guess_names: Realm '%s' must not be equal to short domain name '%s'!", realm, domain)
381
382     if rootdn is None:
383        rootdn = domaindn
384        
385     if configdn is None:
386         configdn = "CN=Configuration," + rootdn
387     if schemadn is None:
388         schemadn = "CN=Schema," + configdn
389     if sambadn is None:
390         sambadn = "CN=Samba"
391
392     if sitename is None:
393         sitename=DEFAULTSITE
394
395     names = ProvisionNames()
396     names.rootdn = rootdn
397     names.domaindn = domaindn
398     names.configdn = configdn
399     names.schemadn = schemadn
400     names.sambadn = sambadn
401     names.ldapmanagerdn = "CN=Manager," + rootdn
402     names.dnsdomain = dnsdomain
403     names.domain = domain
404     names.realm = realm
405     names.netbiosname = netbiosname
406     names.hostname = hostname
407     names.sitename = sitename
408     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
409  
410     return names
411     
412
413 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
414                  targetdir, sid_generator):
415     """Create a new smb.conf file based on a couple of basic settings.
416     """
417     assert smbconf is not None
418     if hostname is None:
419         hostname = socket.gethostname().split(".")[0]
420     netbiosname = hostname.upper()
421
422     if serverrole is None:
423         serverrole = "standalone"
424
425     assert serverrole in ("domain controller", "member server", "standalone")
426     if serverrole == "domain controller":
427         smbconfsuffix = "dc"
428     elif serverrole == "member server":
429         smbconfsuffix = "member"
430     elif serverrole == "standalone":
431         smbconfsuffix = "standalone"
432
433     if sid_generator is None:
434         sid_generator = "internal"
435
436     assert domain is not None
437     domain = domain.upper()
438
439     assert realm is not None
440     realm = realm.upper()
441
442     default_lp = param.LoadParm()
443     #Load non-existant file
444     if os.path.exists(smbconf):
445         default_lp.load(smbconf)
446     
447     if targetdir is not None:
448         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
449         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
450
451         default_lp.set("lock dir", os.path.abspath(targetdir))
452     else:
453         privatedir_line = ""
454         lockdir_line = ""
455
456     if sid_generator == "internal":
457         sid_generator_line = ""
458     else:
459         sid_generator_line = "sid generator = " + sid_generator
460
461     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
462     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
463
464     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
465                smbconf, {
466             "NETBIOS_NAME": netbiosname,
467             "DOMAIN": domain,
468             "REALM": realm,
469             "SERVERROLE": serverrole,
470             "NETLOGONPATH": netlogon,
471             "SYSVOLPATH": sysvol,
472             "SIDGENERATOR_LINE": sid_generator_line,
473             "PRIVATEDIR_LINE": privatedir_line,
474             "LOCKDIR_LINE": lockdir_line
475             })
476
477
478 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
479                         users_gid, wheel_gid):
480     """setup reasonable name mappings for sam names to unix names.
481
482     :param samdb: SamDB object.
483     :param idmap: IDmap db object.
484     :param sid: The domain sid.
485     :param domaindn: The domain DN.
486     :param root_uid: uid of the UNIX root user.
487     :param nobody_uid: uid of the UNIX nobody user.
488     :param users_gid: gid of the UNIX users group.
489     :param wheel_gid: gid of the UNIX wheel group."""
490
491     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
492     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
493     
494     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
495     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
496
497 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
498                            provision_backend, names, schema,
499                            serverrole, 
500                            erase=False):
501     """Setup the partitions for the SAM database. 
502     
503     Alternatively, provision() may call this, and then populate the database.
504     
505     :note: This will wipe the Sam Database!
506     
507     :note: This function always removes the local SAM LDB file. The erase 
508         parameter controls whether to erase the existing data, which 
509         may not be stored locally but in LDAP.
510
511     """
512     assert session_info is not None
513
514     old_partitions = None
515     new_partitions = None
516
517     # We use options=["modules:"] to stop the modules loading - we
518     # just want to wipe and re-initialise the database, not start it up
519
520     try:
521         samdb = Ldb(url=samdb_path, session_info=session_info, 
522                       lp=lp, options=["modules:"])
523         res = samdb.search(base="@PARTITION", scope=SCOPE_BASE, attrs=["partition"], expression="partition=*")
524         if len(res) == 1:
525             try:
526                 old_partitions = res[0]["partition"]
527             except KeyError:
528                 pass
529
530         if old_partitions is not None:
531             new_partitions = [];
532             for old_partition in old_partitions:
533                 new_partition = old_partition
534                 if old_partition.endswith(".ldb"):
535                     p = old_partition.split(":")[0]
536                     dn = ldb.Dn(schema.ldb, p)
537                     new_partition = dn.get_casefold()
538                 new_partitions.append(new_partition)
539
540         # Wipes the database
541         samdb.erase_except_schema_controlled()
542     except LdbError:
543         os.unlink(samdb_path)
544         samdb = Ldb(url=samdb_path, session_info=session_info, 
545                       lp=lp, options=["modules:"])
546          # Wipes the database
547         samdb.erase_except_schema_controlled()
548
549     #Add modules to the list to activate them by default
550     #beware often order is important
551     #
552     # Some Known ordering constraints:
553     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
554     # - objectclass must be before password_hash, because password_hash checks
555     #   that the objectclass is of type person (filled in by objectclass
556     #   module when expanding the objectclass list)
557     # - partition must be last
558     # - each partition has its own module list then
559     modules_list = ["resolve_oids",
560                     "rootdse",
561                     "lazy_commit",
562                     "acl",
563                     "paged_results",
564                     "ranged_results",
565                     "anr",
566                     "server_sort",
567                     "asq",
568                     "extended_dn_store",
569                     "extended_dn_in",
570                     "rdn_name",
571                     "objectclass",
572                     "descriptor",
573                     "samldb",
574                     "password_hash",
575                     "operational",
576                     "kludge_acl", 
577                     "instancetype"]
578     tdb_modules_list = [
579                     "subtree_rename",
580                     "subtree_delete",
581                     "linked_attributes",
582                     "extended_dn_out_ldb"]
583     modules_list2 = ["show_deleted",
584                      "schema_load",
585                      "new_partition",
586                      "partition"]
587
588     ldap_backend_line = "# No LDAP backend"
589     if provision_backend.type is not "ldb":
590         ldap_backend_line = "ldapBackend: %s" % provision_backend.ldapi_uri
591         
592         if provision_backend.ldap_backend_type == "fedora-ds":
593             backend_modules = ["nsuniqueid", "paged_searches"]
594             # We can handle linked attributes here, as we don't have directory-side subtree operations
595             tdb_modules_list = ["extended_dn_out_fds"]
596         elif ldap_backend.ldap_backend_type == "openldap":
597             backend_modules = ["entryuuid", "paged_searches"]
598             # OpenLDAP handles subtree renames, so we don't want to do any of these things
599             tdb_modules_list = ["extended_dn_out_openldap"]
600
601     elif serverrole == "domain controller":
602         tdb_modules_list.insert(0, "repl_meta_data")
603         backend_modules = []
604     else:
605         backend_modules = ["objectguid"]
606
607     if tdb_modules_list is None:
608         tdb_modules_list_as_string = ""
609     else:
610         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
611         
612     samdb.transaction_start()
613     try:
614         message("Setting up sam.ldb partitions and settings")
615         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
616                 "SCHEMADN": ldb.Dn(schema.ldb, names.schemadn).get_casefold(), 
617                 "SCHEMADN_MOD2": ",objectguid",
618                 "CONFIGDN": ldb.Dn(schema.ldb, names.configdn).get_casefold(),
619                 "DOMAINDN": ldb.Dn(schema.ldb, names.domaindn).get_casefold(),
620                 "SCHEMADN_MOD": "schema_data",
621                 "CONFIGDN_MOD": "naming_fsmo",
622                 "DOMAINDN_MOD": "pdc_fsmo",
623                 "MODULES_LIST": ",".join(modules_list),
624                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
625                 "MODULES_LIST2": ",".join(modules_list2),
626                 "BACKEND_MOD": ",".join(backend_modules),
627                 "LDAP_BACKEND_LINE": ldap_backend_line,
628         })
629
630         
631         if new_partitions is not None:
632             m = ldb.Message()
633             m.dn = ldb.Dn(samdb, "@PARTITION")
634             
635             m["partition"] = ldb.MessageElement(new_partitions, ldb.FLAG_MOD_ADD, "partition")
636             samdb.modify(m)
637
638         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
639
640         message("Setting up sam.ldb rootDSE")
641         setup_samdb_rootdse(samdb, setup_path, names)
642
643     except:
644         samdb.transaction_cancel()
645         raise
646
647     samdb.transaction_commit()
648
649         
650 def secretsdb_self_join(secretsdb, domain, 
651                         netbiosname, domainsid, machinepass, 
652                         realm=None, dnsdomain=None,
653                         keytab_path=None, 
654                         key_version_number=1,
655                         secure_channel_type=SEC_CHAN_WKSTA):
656     """Add domain join-specific bits to a secrets database.
657     
658     :param secretsdb: Ldb Handle to the secrets database
659     :param machinepass: Machine password
660     """
661     attrs=["whenChanged",
662            "secret",
663            "priorSecret",
664            "priorChanged",
665            "krb5Keytab",
666            "privateKeytab"]
667     
668
669     msg = ldb.Message(ldb.Dn(secretsdb, "flatname=%s,cn=Primary Domains" % domain));
670     msg["secureChannelType"] = str(secure_channel_type)
671     msg["flatname"] = [domain]
672     msg["objectClass"] = ["top", "primaryDomain"]
673     if realm is not None:
674       if dnsdomain is None:
675         dnsdomain = realm.lower()
676       msg["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
677       msg["realm"] = realm
678       msg["saltPrincipal"] = "host/%s.%s@%s" % (netbiosname.lower(), dnsdomain.lower(), realm.upper())
679       msg["msDS-KeyVersionNumber"] = [str(key_version_number)]
680       msg["privateKeytab"] = ["secrets.keytab"];
681
682
683     msg["secret"] = [machinepass]
684     msg["samAccountName"] = ["%s$" % netbiosname]
685     msg["secureChannelType"] = [str(secure_channel_type)]
686     msg["objectSid"] = [ndr_pack(domainsid)]
687     
688     res = secretsdb.search(base="cn=Primary Domains", 
689                            attrs=attrs, 
690                            expression=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain))" % (domain, realm, str(domainsid))), 
691                            scope=SCOPE_ONELEVEL)
692     
693     for del_msg in res:
694       if del_msg.dn is not msg.dn:
695         secretsdb.delete(del_msg.dn)
696
697     res = secretsdb.search(base=msg.dn, attrs=attrs, scope=SCOPE_BASE)
698
699     if len(res) == 1:
700       msg["priorSecret"] = res[0]["secret"]
701       msg["priorWhenChanged"] = res[0]["whenChanged"]
702
703       if res["privateKeytab"] is not None:
704         msg["privateKeytab"] = res[0]["privateKeytab"]
705
706       if res["krb5Keytab"] is not None:
707         msg["krb5Keytab"] = res[0]["krb5Keytab"]
708
709       for el in msg:
710         el.set_flags(ldb.FLAG_MOD_REPLACE)
711         secretsdb.modify(msg)
712     else:
713       secretsdb.add(msg)
714
715
716 def secretsdb_setup_dns(secretsdb, setup_path, realm, dnsdomain, 
717                         dns_keytab_path, dnspass):
718     """Add DNS specific bits to a secrets database.
719     
720     :param secretsdb: Ldb Handle to the secrets database
721     :param setup_path: Setup path function
722     :param machinepass: Machine password
723     """
724     setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), { 
725             "REALM": realm,
726             "DNSDOMAIN": dnsdomain,
727             "DNS_KEYTAB": dns_keytab_path,
728             "DNSPASS_B64": b64encode(dnspass),
729             })
730
731
732 def setup_secretsdb(path, setup_path, session_info, backend_credentials, lp):
733     """Setup the secrets database.
734
735     :param path: Path to the secrets database.
736     :param setup_path: Get the path to a setup file.
737     :param session_info: Session info.
738     :param credentials: Credentials
739     :param lp: Loadparm context
740     :return: LDB handle for the created secrets database
741     """
742     if os.path.exists(path):
743         os.unlink(path)
744     secrets_ldb = Ldb(path, session_info=session_info, 
745                       lp=lp)
746     secrets_ldb.erase()
747     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
748     secrets_ldb = Ldb(path, session_info=session_info, 
749                       lp=lp)
750     secrets_ldb.transaction_start()
751     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
752
753     if backend_credentials is not None and backend_credentials.authentication_requested():
754         if backend_credentials.get_bind_dn() is not None:
755             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
756                     "LDAPMANAGERDN": backend_credentials.get_bind_dn(),
757                     "LDAPMANAGERPASS_B64": b64encode(backend_credentials.get_password())
758                     })
759         else:
760             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
761                     "LDAPADMINUSER": backend_credentials.get_username(),
762                     "LDAPADMINREALM": backend_credentials.get_realm(),
763                     "LDAPADMINPASS_B64": b64encode(backend_credentials.get_password())
764                     })
765
766     return secrets_ldb
767
768 def setup_privileges(path, setup_path, session_info, lp):
769     """Setup the privileges database.
770
771     :param path: Path to the privileges database.
772     :param setup_path: Get the path to a setup file.
773     :param session_info: Session info.
774     :param credentials: Credentials
775     :param lp: Loadparm context
776     :return: LDB handle for the created secrets database
777     """
778     if os.path.exists(path):
779         os.unlink(path)
780     privilege_ldb = Ldb(path, session_info=session_info, lp=lp)
781     privilege_ldb.erase()
782     privilege_ldb.load_ldif_file_add(setup_path("provision_privilege.ldif"))
783
784
785 def setup_registry(path, setup_path, session_info, lp):
786     """Setup the registry.
787     
788     :param path: Path to the registry database
789     :param setup_path: Function that returns the path to a setup.
790     :param session_info: Session information
791     :param credentials: Credentials
792     :param lp: Loadparm context
793     """
794     reg = registry.Registry()
795     hive = registry.open_ldb(path, session_info=session_info, 
796                          lp_ctx=lp)
797     reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
798     provision_reg = setup_path("provision.reg")
799     assert os.path.exists(provision_reg)
800     reg.diff_apply(provision_reg)
801
802
803 def setup_idmapdb(path, setup_path, session_info, lp):
804     """Setup the idmap database.
805
806     :param path: path to the idmap database
807     :param setup_path: Function that returns a path to a setup file
808     :param session_info: Session information
809     :param credentials: Credentials
810     :param lp: Loadparm context
811     """
812     if os.path.exists(path):
813         os.unlink(path)
814
815     idmap_ldb = IDmapDB(path, session_info=session_info,
816                         lp=lp)
817
818     idmap_ldb.erase()
819     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
820     return idmap_ldb
821
822
823 def setup_samdb_rootdse(samdb, setup_path, names):
824     """Setup the SamDB rootdse.
825
826     :param samdb: Sam Database handle
827     :param setup_path: Obtain setup path
828     """
829     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
830         "SCHEMADN": names.schemadn, 
831         "NETBIOSNAME": names.netbiosname,
832         "DNSDOMAIN": names.dnsdomain,
833         "REALM": names.realm,
834         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
835         "DOMAINDN": names.domaindn,
836         "ROOTDN": names.rootdn,
837         "CONFIGDN": names.configdn,
838         "SERVERDN": names.serverdn,
839         })
840         
841
842 def setup_self_join(samdb, names,
843                     machinepass, dnspass, 
844                     domainsid, invocationid, setup_path,
845                     policyguid, policyguid_dc, domainControllerFunctionality,
846                     ntdsguid):
847     """Join a host to its own domain."""
848     assert isinstance(invocationid, str)
849     if ntdsguid is not None:
850         ntdsguid_line = "objectGUID: %s\n"%ntdsguid
851     else:
852         ntdsguid_line = ""
853     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
854               "CONFIGDN": names.configdn, 
855               "SCHEMADN": names.schemadn,
856               "DOMAINDN": names.domaindn,
857               "SERVERDN": names.serverdn,
858               "INVOCATIONID": invocationid,
859               "NETBIOSNAME": names.netbiosname,
860               "DEFAULTSITE": names.sitename,
861               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
862               "MACHINEPASS_B64": b64encode(machinepass),
863               "DNSPASS_B64": b64encode(dnspass),
864               "REALM": names.realm,
865               "DOMAIN": names.domain,
866               "DNSDOMAIN": names.dnsdomain,
867               "SAMBA_VERSION_STRING": version,
868               "NTDSGUID": ntdsguid_line,
869               "DOMAIN_CONTROLLER_FUNCTIONALITY": str(domainControllerFunctionality)})
870
871     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
872               "POLICYGUID": policyguid,
873               "POLICYGUID_DC": policyguid_dc,
874               "DNSDOMAIN": names.dnsdomain,
875               "DOMAINSID": str(domainsid),
876               "DOMAINDN": names.domaindn})
877     
878     # add the NTDSGUID based SPNs
879     ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
880     names.ntdsguid = samdb.searchone(basedn=ntds_dn, attribute="objectGUID",
881                                      expression="", scope=SCOPE_BASE)
882     assert isinstance(names.ntdsguid, str)
883
884     # Setup fSMORoleOwner entries to point at the newly created DC entry
885     setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
886               "DOMAIN": names.domain,
887               "DNSDOMAIN": names.dnsdomain,
888               "DOMAINDN": names.domaindn,
889               "CONFIGDN": names.configdn,
890               "SCHEMADN": names.schemadn, 
891               "DEFAULTSITE": names.sitename,
892               "SERVERDN": names.serverdn,
893               "NETBIOSNAME": names.netbiosname,
894               "NTDSGUID": names.ntdsguid
895               })
896
897
898 def setup_samdb(path, setup_path, session_info, provision_backend, lp, 
899                 names, message, 
900                 domainsid, domainguid, policyguid, policyguid_dc,
901                 fill, adminpass, krbtgtpass, 
902                 machinepass, invocationid, dnspass, ntdsguid,
903                 serverrole, dom_for_fun_level=None,
904                 schema=None):
905     """Setup a complete SAM Database.
906     
907     :note: This will wipe the main SAM database file!
908     """
909
910     # ATTENTION: Do NOT change these default values without discussion with the
911     # team and/or release manager. They have a big impact on the whole program!
912     domainControllerFunctionality = DS_DC_FUNCTION_2008
913
914     if dom_for_fun_level is None:
915         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
916     if dom_for_fun_level < DS_DOMAIN_FUNCTION_2003:
917         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level lower than Windows 2003 (Native). This isn't supported!")
918
919     if dom_for_fun_level > domainControllerFunctionality:
920         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008). This won't work!")
921
922     domainFunctionality = dom_for_fun_level
923     forestFunctionality = dom_for_fun_level
924
925     # Also wipes the database
926     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
927                            provision_backend=provision_backend, session_info=session_info,
928                            names=names, 
929                            serverrole=serverrole, schema=schema)
930
931     if (schema == None):
932         schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
933                         sambadn=names.sambadn)
934
935     # Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
936     samdb = Ldb(session_info=session_info, 
937                 credentials=provision_backend.credentials, lp=lp)
938
939     message("Pre-loading the Samba 4 and AD schema")
940
941     # Load the schema from the one we computed earlier
942     samdb.set_schema_from_ldb(schema.ldb)
943
944     # And now we can connect to the DB - the schema won't be loaded from the DB
945     samdb.connect(path)
946
947     if fill == FILL_DRS:
948         return samdb
949         
950     samdb.transaction_start()
951     try:
952         message("Erasing data from partitions")
953         # Load the schema (again).  This time it will force a reindex,
954         # and will therefore make the erase_partitions() below
955         # computationally sane
956         samdb.set_schema_from_ldb(schema.ldb)
957         samdb.erase_partitions()
958     
959         # Set the domain functionality levels onto the database.
960         # Various module (the password_hash module in particular) need
961         # to know what level of AD we are emulating.
962
963         # These will be fixed into the database via the database
964         # modifictions below, but we need them set from the start.
965         samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
966         samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
967         samdb.set_opaque_integer("domainControllerFunctionality", domainControllerFunctionality)
968
969         samdb.set_domain_sid(str(domainsid))
970         if serverrole == "domain controller":
971             samdb.set_invocation_id(invocationid)
972
973         message("Adding DomainDN: %s" % names.domaindn)
974
975 #impersonate domain admin
976         admin_session_info = admin_session(lp, str(domainsid))
977         samdb.set_session_info(admin_session_info)
978         if domainguid is not None:
979             domainguid_line = "objectGUID: %s\n-" % domainguid
980         else:
981             domainguid_line = ""
982         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
983                 "DOMAINDN": names.domaindn,
984                 "DOMAINGUID": domainguid_line
985                 })
986
987
988         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
989             "CREATTIME": str(int(time.time() * 1e7)), # seconds -> ticks
990             "DOMAINSID": str(domainsid),
991             "SCHEMADN": names.schemadn, 
992             "NETBIOSNAME": names.netbiosname,
993             "DEFAULTSITE": names.sitename,
994             "CONFIGDN": names.configdn,
995             "SERVERDN": names.serverdn,
996             "POLICYGUID": policyguid,
997             "DOMAINDN": names.domaindn,
998             "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
999             "SAMBA_VERSION_STRING": version
1000             })
1001
1002         message("Adding configuration container")
1003         descr = get_config_descriptor(domainsid);
1004         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
1005             "CONFIGDN": names.configdn, 
1006             "DESCRIPTOR": descr,
1007             })
1008         message("Modifying configuration container")
1009         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
1010             "CONFIGDN": names.configdn, 
1011             "SCHEMADN": names.schemadn,
1012             })
1013
1014         # The LDIF here was created when the Schema object was constructed
1015         message("Setting up sam.ldb schema")
1016         samdb.add_ldif(schema.schema_dn_add, controls=["relax:0"])
1017         samdb.modify_ldif(schema.schema_dn_modify)
1018         samdb.write_prefixes_from_schema()
1019         samdb.add_ldif(schema.schema_data, controls=["relax:0"])
1020         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"), 
1021                        {"SCHEMADN": names.schemadn})
1022
1023         message("Setting up sam.ldb configuration data")
1024         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
1025             "CONFIGDN": names.configdn,
1026             "NETBIOSNAME": names.netbiosname,
1027             "DEFAULTSITE": names.sitename,
1028             "DNSDOMAIN": names.dnsdomain,
1029             "DOMAIN": names.domain,
1030             "SCHEMADN": names.schemadn,
1031             "DOMAINDN": names.domaindn,
1032             "SERVERDN": names.serverdn,
1033             "FOREST_FUNCTIONALALITY": str(forestFunctionality)
1034             })
1035
1036         message("Setting up display specifiers")
1037         display_specifiers_ldif = read_ms_ldif(setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
1038         display_specifiers_ldif = substitute_var(display_specifiers_ldif, {"CONFIGDN": names.configdn})
1039         check_all_substituted(display_specifiers_ldif)
1040         samdb.add_ldif(display_specifiers_ldif)
1041
1042         message("Adding users container")
1043         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
1044                 "DOMAINDN": names.domaindn})
1045         message("Modifying users container")
1046         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
1047                 "DOMAINDN": names.domaindn})
1048         message("Adding computers container")
1049         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
1050                 "DOMAINDN": names.domaindn})
1051         message("Modifying computers container")
1052         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
1053                 "DOMAINDN": names.domaindn})
1054         message("Setting up sam.ldb data")
1055         setup_add_ldif(samdb, setup_path("provision.ldif"), {
1056             "CREATTIME": str(int(time.time() * 1e7)), # seconds -> ticks
1057             "DOMAINDN": names.domaindn,
1058             "NETBIOSNAME": names.netbiosname,
1059             "DEFAULTSITE": names.sitename,
1060             "CONFIGDN": names.configdn,
1061             "SERVERDN": names.serverdn,
1062             "POLICYGUID_DC": policyguid_dc
1063             })
1064
1065         if fill == FILL_FULL:
1066             message("Setting up sam.ldb users and groups")
1067             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
1068                 "DOMAINDN": names.domaindn,
1069                 "DOMAINSID": str(domainsid),
1070                 "CONFIGDN": names.configdn,
1071                 "ADMINPASS_B64": b64encode(adminpass),
1072                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
1073                 })
1074
1075             if serverrole == "domain controller":
1076                 message("Setting up self join")
1077                 setup_self_join(samdb, names=names, invocationid=invocationid, 
1078                                 dnspass=dnspass,  
1079                                 machinepass=machinepass, 
1080                                 domainsid=domainsid, policyguid=policyguid,
1081                                 policyguid_dc=policyguid_dc,
1082                                 setup_path=setup_path,
1083                                 domainControllerFunctionality=domainControllerFunctionality,
1084                                 ntdsguid=ntdsguid)
1085
1086                 ntds_dn = "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names.hostname, names.domaindn)
1087                 names.ntdsguid = samdb.searchone(basedn=ntds_dn,
1088                   attribute="objectGUID", expression="", scope=SCOPE_BASE)
1089                 assert isinstance(names.ntdsguid, str)
1090
1091     except:
1092         samdb.transaction_cancel()
1093         raise
1094
1095     samdb.transaction_commit()
1096     return samdb
1097
1098
1099 FILL_FULL = "FULL"
1100 FILL_NT4SYNC = "NT4SYNC"
1101 FILL_DRS = "DRS"
1102
1103
1104 def provision(setup_dir, message, session_info, 
1105               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
1106               realm=None, 
1107               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
1108               serverdn=None,
1109               domain=None, hostname=None, hostip=None, hostip6=None, 
1110               domainsid=None, adminpass=None, ldapadminpass=None, 
1111               krbtgtpass=None, domainguid=None, 
1112               policyguid=None, policyguid_dc=None, invocationid=None,
1113               machinepass=None, ntdsguid=None,
1114               dnspass=None, root=None, nobody=None, users=None, 
1115               wheel=None, backup=None, aci=None, serverrole=None,
1116               dom_for_fun_level=None,
1117               ldap_backend_extra_port=None, backend_type=None,
1118               sitename=None,
1119               ol_mmr_urls=None, ol_olc=None, 
1120               setup_ds_path=None, slapd_path=None, nosync=False,
1121               ldap_dryrun_mode=False):
1122     """Provision samba4
1123     
1124     :note: caution, this wipes all existing data!
1125     """
1126
1127     def setup_path(file):
1128       return os.path.join(setup_dir, file)
1129
1130     if domainsid is None:
1131       domainsid = security.random_sid()
1132     else:
1133       domainsid = security.dom_sid(domainsid)
1134
1135     # create/adapt the group policy GUIDs
1136     if policyguid is None:
1137         policyguid = str(uuid.uuid4())
1138     policyguid = policyguid.upper()
1139     if policyguid_dc is None:
1140         policyguid_dc = str(uuid.uuid4())
1141     policyguid_dc = policyguid_dc.upper()
1142
1143     if adminpass is None:
1144         adminpass = glue.generate_random_str(12)
1145     if krbtgtpass is None:
1146         krbtgtpass = glue.generate_random_str(12)
1147     if machinepass is None:
1148         machinepass  = glue.generate_random_str(12)
1149     if dnspass is None:
1150         dnspass = glue.generate_random_str(12)
1151     if ldapadminpass is None:
1152         #Make a new, random password between Samba and it's LDAP server
1153         ldapadminpass=glue.generate_random_str(12)        
1154
1155     if backend_type is None:
1156         backend_type = "ldb"
1157
1158     sid_generator = "internal"
1159     if backend_type == "fedora-ds":
1160         sid_generator = "backend"
1161
1162     root_uid = findnss_uid([root or "root"])
1163     nobody_uid = findnss_uid([nobody or "nobody"])
1164     users_gid = findnss_gid([users or "users"])
1165     if wheel is None:
1166         wheel_gid = findnss_gid(["wheel", "adm"])
1167     else:
1168         wheel_gid = findnss_gid([wheel])
1169
1170     if targetdir is not None:
1171         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1172             os.makedirs(os.path.join(targetdir, "etc"))
1173         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1174     elif smbconf is None:
1175         smbconf = param.default_path()
1176
1177     # only install a new smb.conf if there isn't one there already
1178     if not os.path.exists(smbconf):
1179         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
1180                      targetdir, sid_generator)
1181
1182     lp = param.LoadParm()
1183     lp.load(smbconf)
1184
1185     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1186                         dnsdomain=realm, serverrole=serverrole,
1187                         domaindn=domaindn, configdn=configdn, schemadn=schemadn,
1188                         serverdn=serverdn, sitename=sitename)
1189
1190     paths = provision_paths_from_lp(lp, names.dnsdomain)
1191
1192     if hostip is None:
1193         try:
1194             hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1195         except socket.gaierror, (socket.EAI_NODATA, msg):
1196             hostip = None
1197
1198     if hostip6 is None:
1199         try:
1200             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
1201         except socket.gaierror, (socket.EAI_NODATA, msg): 
1202             hostip6 = None
1203
1204     if serverrole is None:
1205         serverrole = lp.get("server role")
1206
1207     assert serverrole in ("domain controller", "member server", "standalone")
1208     if invocationid is None and serverrole == "domain controller":
1209         invocationid = str(uuid.uuid4())
1210
1211     if not os.path.exists(paths.private_dir):
1212         os.mkdir(paths.private_dir)
1213
1214     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1215     
1216     schema = Schema(setup_path, domainsid, schemadn=names.schemadn, serverdn=names.serverdn,
1217                     sambadn=names.sambadn)
1218     
1219     provision_backend = ProvisionBackend(backend_type,
1220                                          paths=paths, setup_path=setup_path,
1221                                          lp=lp, credentials=credentials, 
1222                                          names=names,
1223                                          message=message, hostname=hostname,
1224                                          root=root, schema=schema,
1225                                          ldapadminpass=ldapadminpass,
1226                                          ldap_backend_extra_port=ldap_backend_extra_port,
1227                                          ol_mmr_urls=ol_mmr_urls, 
1228                                          slapd_path=slapd_path,
1229                                          setup_ds_path=setup_ds_path,
1230                                          ldap_dryrun_mode=ldap_dryrun_mode,
1231                                          domainsid=domainsid)
1232
1233     # only install a new shares config db if there is none
1234     if not os.path.exists(paths.shareconf):
1235         message("Setting up share.ldb")
1236         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
1237                         lp=lp)
1238         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1239
1240      
1241     message("Setting up secrets.ldb")
1242     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
1243                                   session_info=session_info, 
1244                                   backend_credentials=provision_backend.secrets_credentials, lp=lp)
1245
1246     message("Setting up the registry")
1247     setup_registry(paths.hklm, setup_path, session_info, 
1248                    lp=lp)
1249
1250     message("Setting up the privileges database")
1251     setup_privileges(paths.privilege, setup_path, session_info, lp=lp)
1252
1253     message("Setting up idmap db")
1254     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1255                           lp=lp)
1256
1257     message("Setting up SAM db")
1258     samdb = setup_samdb(paths.samdb, setup_path, session_info, 
1259                         provision_backend, lp, names,
1260                         message, 
1261                         domainsid=domainsid, 
1262                         schema=schema, domainguid=domainguid,
1263                         policyguid=policyguid, policyguid_dc=policyguid_dc,
1264                         fill=samdb_fill, 
1265                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1266                         invocationid=invocationid, 
1267                         machinepass=machinepass, dnspass=dnspass, 
1268                         ntdsguid=ntdsguid, serverrole=serverrole,
1269                         dom_for_fun_level=dom_for_fun_level)
1270
1271     if serverrole == "domain controller":
1272         if paths.netlogon is None:
1273             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1274             message("Please either remove %s or see the template at %s" % 
1275                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1276             assert(paths.netlogon is not None)
1277
1278         if paths.sysvol is None:
1279             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1280             message("Please either remove %s or see the template at %s" % 
1281                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1282             assert(paths.sysvol is not None)            
1283             
1284         # Set up group policies (domain policy and domain controller policy)
1285
1286         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1287                                    "{" + policyguid + "}")
1288         os.makedirs(policy_path, 0755)
1289         open(os.path.join(policy_path, "GPT.INI"), 'w').write(
1290                                    "[General]\r\nVersion=65543")
1291         os.makedirs(os.path.join(policy_path, "MACHINE"), 0755)
1292         os.makedirs(os.path.join(policy_path, "USER"), 0755)
1293
1294         policy_path_dc = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1295                                    "{" + policyguid_dc + "}")
1296         os.makedirs(policy_path_dc, 0755)
1297         open(os.path.join(policy_path_dc, "GPT.INI"), 'w').write(
1298                                    "[General]\r\nVersion=2")
1299         os.makedirs(os.path.join(policy_path_dc, "MACHINE"), 0755)
1300         os.makedirs(os.path.join(policy_path_dc, "USER"), 0755)
1301
1302         if not os.path.isdir(paths.netlogon):
1303             os.makedirs(paths.netlogon, 0755)
1304
1305     if samdb_fill == FILL_FULL:
1306         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1307                             root_uid=root_uid, nobody_uid=nobody_uid,
1308                             users_gid=users_gid, wheel_gid=wheel_gid)
1309
1310         message("Setting up sam.ldb rootDSE marking as synchronized")
1311         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1312
1313         # Only make a zone file on the first DC, it should be replicated with DNS replication
1314         if serverrole == "domain controller":
1315             secretsdb_self_join(secrets_ldb, domain=domain,
1316                                 realm=names.realm,
1317                                 dnsdomain=names.dnsdomain,
1318                                 netbiosname=names.netbiosname,
1319                                 domainsid=domainsid, 
1320                                 machinepass=machinepass,
1321                                 secure_channel_type=SEC_CHAN_BDC)
1322
1323             secretsdb_setup_dns(secrets_ldb, setup_path, 
1324                                 realm=names.realm, dnsdomain=names.dnsdomain,
1325                                 dns_keytab_path=paths.dns_keytab,
1326                                 dnspass=dnspass)
1327
1328             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1329             assert isinstance(domainguid, str)
1330
1331             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1332                              hostip=hostip,
1333                              hostip6=hostip6, hostname=names.hostname,
1334                              realm=names.realm,
1335                              domainguid=domainguid, ntdsguid=names.ntdsguid)
1336
1337             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1338                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1339
1340             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1341                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1342                               keytab_name=paths.dns_keytab)
1343             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1344             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1345
1346             create_krb5_conf(paths.krb5conf, setup_path,
1347                              dnsdomain=names.dnsdomain, hostname=names.hostname,
1348                              realm=names.realm)
1349             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1350
1351     if provision_backend.post_setup is not None:
1352         provision_backend.post_setup()
1353
1354     if provision_backend.shutdown is not None:
1355         provision_backend.shutdown()
1356     
1357     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1358                                ldapi_url)
1359
1360     #Now commit the secrets.ldb to disk
1361     secrets_ldb.transaction_commit()
1362
1363     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1364
1365     message("Once the above files are installed, your Samba4 server will be ready to use")
1366     message("Server Role:           %s" % serverrole)
1367     message("Hostname:              %s" % names.hostname)
1368     message("NetBIOS Domain:        %s" % names.domain)
1369     message("DNS Domain:            %s" % names.dnsdomain)
1370     message("DOMAIN SID:            %s" % str(domainsid))
1371     if samdb_fill == FILL_FULL:
1372         message("Admin password:    %s" % adminpass)
1373     if provision_backend.type is not "ldb":
1374         if provision_backend.credentials.get_bind_dn() is not None:
1375             message("LDAP Backend Admin DN: %s" % provision_backend.credentials.get_bind_dn())
1376         else:
1377             message("LDAP Admin User:       %s" % provision_backend.credentials.get_username())
1378
1379         message("LDAP Admin Password:   %s" % provision_backend.credentials.get_password())
1380
1381         if provision_backend.slapd_command_escaped is not None:
1382             # now display slapd_command_file.txt to show how slapd must be started next time
1383             message("Use later the following commandline to start slapd, then Samba:")
1384             message(provision_backend.slapd_command_escaped)
1385             message("This slapd-Commandline is also stored under: " + paths.ldapdir + "/ldap_backend_startup.sh")
1386
1387
1388     result = ProvisionResult()
1389     result.domaindn = domaindn
1390     result.paths = paths
1391     result.lp = lp
1392     result.samdb = samdb
1393     return result
1394
1395
1396
1397 def provision_become_dc(setup_dir=None,
1398                         smbconf=None, targetdir=None, realm=None, 
1399                         rootdn=None, domaindn=None, schemadn=None,
1400                         configdn=None, serverdn=None,
1401                         domain=None, hostname=None, domainsid=None, 
1402                         adminpass=None, krbtgtpass=None, domainguid=None, 
1403                         policyguid=None, policyguid_dc=None, invocationid=None,
1404                         machinepass=None, 
1405                         dnspass=None, root=None, nobody=None, users=None, 
1406                         wheel=None, backup=None, serverrole=None, 
1407                         ldap_backend=None, ldap_backend_type=None,
1408                         sitename=None, debuglevel=1):
1409
1410     def message(text):
1411         """print a message if quiet is not set."""
1412         print text
1413
1414     glue.set_debug_level(debuglevel)
1415
1416     return provision(setup_dir, message, system_session(), None,
1417               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
1418               realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
1419               configdn=configdn, serverdn=serverdn, domain=domain,
1420               hostname=hostname, hostip="127.0.0.1", domainsid=domainsid,
1421               machinepass=machinepass, serverrole="domain controller",
1422               sitename=sitename)
1423
1424
1425 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1426     """Create a PHP LDAP admin configuration file.
1427
1428     :param path: Path to write the configuration to.
1429     :param setup_path: Function to generate setup paths.
1430     """
1431     setup_file(setup_path("phpldapadmin-config.php"), path, 
1432             {"S4_LDAPI_URI": ldapi_uri})
1433
1434
1435 def create_zone_file(path, setup_path, dnsdomain, 
1436                      hostip, hostip6, hostname, realm, domainguid,
1437                      ntdsguid):
1438     """Write out a DNS zone file, from the info in the current database.
1439
1440     :param path: Path of the new zone file.
1441     :param setup_path: Setup path function.
1442     :param dnsdomain: DNS Domain name
1443     :param domaindn: DN of the Domain
1444     :param hostip: Local IPv4 IP
1445     :param hostip6: Local IPv6 IP
1446     :param hostname: Local hostname
1447     :param realm: Realm name
1448     :param domainguid: GUID of the domain.
1449     :param ntdsguid: GUID of the hosts nTDSDSA record.
1450     """
1451     assert isinstance(domainguid, str)
1452
1453     if hostip6 is not None:
1454         hostip6_base_line = "            IN AAAA    " + hostip6
1455         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1456     else:
1457         hostip6_base_line = ""
1458         hostip6_host_line = ""
1459
1460     if hostip is not None:
1461         hostip_base_line = "            IN A    " + hostip
1462         hostip_host_line = hostname + "        IN A    " + hostip
1463     else:
1464         hostip_base_line = ""
1465         hostip_host_line = ""
1466
1467     setup_file(setup_path("provision.zone"), path, {
1468             "HOSTNAME": hostname,
1469             "DNSDOMAIN": dnsdomain,
1470             "REALM": realm,
1471             "HOSTIP_BASE_LINE": hostip_base_line,
1472             "HOSTIP_HOST_LINE": hostip_host_line,
1473             "DOMAINGUID": domainguid,
1474             "DATESTRING": time.strftime("%Y%m%d%H"),
1475             "DEFAULTSITE": DEFAULTSITE,
1476             "NTDSGUID": ntdsguid,
1477             "HOSTIP6_BASE_LINE": hostip6_base_line,
1478             "HOSTIP6_HOST_LINE": hostip6_host_line,
1479         })
1480
1481
1482 def create_named_conf(path, setup_path, realm, dnsdomain,
1483                       private_dir):
1484     """Write out a file containing zone statements suitable for inclusion in a
1485     named.conf file (including GSS-TSIG configuration).
1486     
1487     :param path: Path of the new named.conf file.
1488     :param setup_path: Setup path function.
1489     :param realm: Realm name
1490     :param dnsdomain: DNS Domain name
1491     :param private_dir: Path to private directory
1492     :param keytab_name: File name of DNS keytab file
1493     """
1494
1495     setup_file(setup_path("named.conf"), path, {
1496             "DNSDOMAIN": dnsdomain,
1497             "REALM": realm,
1498             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
1499             "PRIVATE_DIR": private_dir
1500             })
1501
1502 def create_named_txt(path, setup_path, realm, dnsdomain,
1503                       private_dir, keytab_name):
1504     """Write out a file containing zone statements suitable for inclusion in a
1505     named.conf file (including GSS-TSIG configuration).
1506     
1507     :param path: Path of the new named.conf file.
1508     :param setup_path: Setup path function.
1509     :param realm: Realm name
1510     :param dnsdomain: DNS Domain name
1511     :param private_dir: Path to private directory
1512     :param keytab_name: File name of DNS keytab file
1513     """
1514
1515     setup_file(setup_path("named.txt"), path, {
1516             "DNSDOMAIN": dnsdomain,
1517             "REALM": realm,
1518             "DNS_KEYTAB": keytab_name,
1519             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
1520             "PRIVATE_DIR": private_dir
1521         })
1522
1523 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
1524     """Write out a file containing zone statements suitable for inclusion in a
1525     named.conf file (including GSS-TSIG configuration).
1526     
1527     :param path: Path of the new named.conf file.
1528     :param setup_path: Setup path function.
1529     :param dnsdomain: DNS Domain name
1530     :param hostname: Local hostname
1531     :param realm: Realm name
1532     """
1533
1534     setup_file(setup_path("krb5.conf"), path, {
1535             "DNSDOMAIN": dnsdomain,
1536             "HOSTNAME": hostname,
1537             "REALM": realm,
1538         })
1539
1540