7ef556c123cee319ee505afc9464549da55553d6
[ira/wip.git] / source4 / scripting / python / samba / provisionbackend.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
8 #
9 # Based on the original in EJS:
10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
11 #
12 # This program is free software; you can redistribute it and/or modify
13 # it under the terms of the GNU General Public License as published by
14 # the Free Software Foundation; either version 3 of the License, or
15 # (at your option) any later version.
16 #   
17 # This program is distributed in the hope that it will be useful,
18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20 # GNU General Public License for more details.
21 #   
22 # You should have received a copy of the GNU General Public License
23 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 #
25
26 """Functions for setting up a Samba configuration (LDB and LDAP backends)."""
27
28 from base64 import b64encode
29 import ldb
30 import os
31 import sys
32 import uuid
33 import time
34 import shutil
35 import subprocess
36
37 from samba import read_and_sub_file
38 from samba import Ldb
39 import urllib
40 from ldb import SCOPE_BASE, SCOPE_ONELEVEL, LdbError, timestring
41 from credentials import Credentials, DONT_USE_KERBEROS
42 from samba import setup_file
43
44 def setup_db_config(setup_path, dbdir):
45     """Setup a Berkeley database.
46     
47     :param setup_path: Setup path function.
48     :param dbdir: Database directory."""
49     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
50         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700)
51         if not os.path.isdir(os.path.join(dbdir, "tmp")):
52             os.makedirs(os.path.join(dbdir, "tmp"), 0700)
53
54     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
55                {"LDAPDBDIR": dbdir})
56
57 class ProvisionBackend(object):
58     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None, 
59                  names=None, message=None):
60         """Provision a backend for samba4"""
61         self.paths = paths
62         self.setup_path = setup_path
63         self.lp = lp
64         self.credentials = credentials
65         self.names = names
66         self.message = message
67
68         self.type = backend_type
69         
70         # Set a default - the code for "existing" below replaces this
71         self.ldap_backend_type = backend_type
72
73     def setup(self):
74         pass
75
76     def start(self):
77         pass
78
79     def shutdown(self):
80         pass
81
82     def post_setup(self):
83         pass
84
85
86 class LDBBackend(ProvisionBackend):
87     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None, 
88                  names=None, message=None):
89
90         super(LDBBackend, self).__init__(
91                 backend_type=backend_type,
92                 paths=paths, setup_path=setup_path,
93                 lp=lp, credentials=credentials,
94                 names=names,
95                 message=message)
96
97     def setup(self):
98         self.credentials = None
99         self.secrets_credentials = None
100     
101         # Wipe the old sam.ldb databases away
102         shutil.rmtree(self.paths.samdb + ".d", True)
103
104
105 class ExistingBackend(ProvisionBackend):
106     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None, 
107                  names=None, message=None):
108
109         super(ExistingBackend, self).__init__(
110                 backend_type=backend_type,
111                 paths=paths, setup_path=setup_path,
112                 lp=lp, credentials=credentials,
113                 names=names,
114                 message=message)
115
116         self.ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.ldapdir, "ldapi"), safe="")
117
118     def setup(self):
119         #Check to see that this 'existing' LDAP backend in fact exists
120         ldapi_db = Ldb(self.ldapi_uri, credentials=self.credentials)
121         search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
122                                             expression="(objectClass=OpenLDAProotDSE)")
123
124         # If we have got here, then we must have a valid connection to the LDAP server, with valid credentials supplied
125         # This caused them to be set into the long-term database later in the script.
126         self.secrets_credentials = self.credentials
127
128         self.ldap_backend_type = "openldap" #For now, assume existing backends at least emulate OpenLDAP
129
130
131 class LDAPBackend(ProvisionBackend):
132     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None,
133                  names=None, message=None,
134                  hostname=None,
135                  schema=None,
136                  ldapadminpass=None,
137                  slapd_path=None,
138                  ldap_backend_extra_port=None,
139                  ldap_dryrun_mode=False):
140
141         super(LDAPBackend, self).__init__(
142                 backend_type=backend_type,
143                 paths=paths, setup_path=setup_path,
144                 lp=lp, credentials=credentials,
145                 names=names,
146                 message=message)
147
148         self.hostname = hostname
149         self.schema = schema
150
151         self.ldapadminpass = ldapadminpass
152
153         self.slapd_path = slapd_path
154         self.slapd_command = None
155         self.slapd_command_escaped = None
156
157         self.ldap_backend_extra_port = ldap_backend_extra_port
158         self.ldap_dryrun_mode = ldap_dryrun_mode
159
160         self.ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.ldapdir, "ldapi"), safe="")
161
162     def setup(self):
163         # we will shortly start slapd with ldapi for final provisioning. first check with ldapsearch -> rootDSE via self.ldapi_uri
164         # if another instance of slapd is already running 
165         try:
166             ldapi_db = Ldb(self.ldapi_uri)
167             search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
168                                                 expression="(objectClass=OpenLDAProotDSE)");
169             try:
170                 f = open(self.paths.slapdpid, "r")
171                 p = f.read()
172                 f.close()
173                 self.message("Check for slapd Process with PID: " + str(p) + " and terminate it manually.")
174             except:
175                 pass
176             
177             raise ProvisioningError("Warning: Another slapd Instance seems already running on this host, listening to " + self.ldapi_uri + ". Please shut it down before you continue. ")
178         
179         except LdbError, e:
180             pass
181
182         # Try to print helpful messages when the user has not specified the path to slapd
183         if self.slapd_path is None:
184             raise ProvisioningError("Warning: LDAP-Backend must be setup with path to slapd, e.g. --slapd-path=\"/usr/local/libexec/slapd\"!")
185         if not os.path.exists(self.slapd_path):
186             self.message (self.slapd_path)
187             raise ProvisioningError("Warning: Given Path to slapd does not exist!")
188
189
190         if not os.path.isdir(self.paths.ldapdir):
191             os.makedirs(self.paths.ldapdir, 0700)
192
193         # Put the LDIF of the schema into a database so we can search on
194         # it to generate schema-dependent configurations in Fedora DS and
195         # OpenLDAP
196         schemadb_path = os.path.join(self.paths.ldapdir, "schema-tmp.ldb")
197         try:
198             os.unlink(schemadb_path)
199         except OSError:
200             pass
201
202         self.schema.write_to_tmp_ldb(schemadb_path);
203
204         self.credentials = Credentials()
205         self.credentials.guess(self.lp)
206         #Kerberos to an ldapi:// backend makes no sense
207         self.credentials.set_kerberos_state(DONT_USE_KERBEROS)
208         self.credentials.set_password(self.ldapadminpass)
209
210         self.secrets_credentials = Credentials()
211         self.secrets_credentials.guess(self.lp)
212         #Kerberos to an ldapi:// backend makes no sense
213         self.secrets_credentials.set_kerberos_state(DONT_USE_KERBEROS)
214         self.secrets_credentials.set_username("samba-admin")
215         self.secrets_credentials.set_password(self.ldapadminpass)
216
217         self.provision()
218
219     def provision(self):
220         pass
221
222     def start(self):
223         self.slapd_command_escaped = "\'" + "\' \'".join(self.slapd_command) + "\'"
224         setup_file(self.setup_path("ldap_backend_startup.sh"), self.paths.ldapdir + "/ldap_backend_startup.sh", {
225                 "SLAPD_COMMAND" : self.slapd_command_escaped})
226
227         # Now start the slapd, so we can provision onto it.  We keep the
228         # subprocess context around, to kill this off at the successful
229         # end of the script
230         self.slapd = subprocess.Popen(self.slapd_provision_command, close_fds=True, shell=False)
231     
232         while self.slapd.poll() is None:
233             # Wait until the socket appears
234             try:
235                 ldapi_db = Ldb(self.ldapi_uri, lp=self.lp, credentials=self.credentials)
236                 search_ol_rootdse = ldapi_db.search(base="", scope=SCOPE_BASE,
237                                                     expression="(objectClass=OpenLDAProotDSE)")
238                 # If we have got here, then we must have a valid connection to the LDAP server!
239                 return
240             except LdbError, e:
241                 time.sleep(1)
242                 pass
243         
244         raise ProvisioningError("slapd died before we could make a connection to it")
245
246     def shutdown(self):
247         # if an LDAP backend is in use, terminate slapd after final provision and check its proper termination
248         if self.slapd.poll() is None:
249             #Kill the slapd
250             if hasattr(self.slapd, "terminate"):
251                 self.slapd.terminate()
252             else:
253                 # Older python versions don't have .terminate()
254                 import signal
255                 os.kill(self.slapd.pid, signal.SIGTERM)
256     
257             #and now wait for it to die
258             self.slapd.communicate()
259
260
261 class OpenLDAPBackend(LDAPBackend):
262     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None,
263                  names=None, message=None,
264                  hostname=None,
265                  schema=None,
266                  ldapadminpass=None,
267                  slapd_path=None,
268                  ldap_backend_extra_port=None,
269                  ldap_dryrun_mode=False,
270                  ol_mmr_urls=None,
271                  nosync=False):
272
273         super(OpenLDAPBackend, self).__init__(
274                 backend_type=backend_type,
275                 paths=paths, setup_path=setup_path,
276                 lp=lp, credentials=credentials,
277                 names=names,
278                 message=message,
279                 hostname=hostname,
280                 schema=schema,
281                 ldapadminpass=ldapadminpass,
282                 slapd_path=slapd_path,
283                 ldap_backend_extra_port=ldap_backend_extra_port,
284                 ldap_dryrun_mode=ldap_dryrun_mode)
285
286         self.ol_mmr_urls = ol_mmr_urls
287         self.nosync = nosync
288
289     def provision(self):
290         # Wipe the directories so we can start
291         shutil.rmtree(os.path.join(self.paths.ldapdir, "db"), True)
292
293         #Allow the test scripts to turn off fsync() for OpenLDAP as for TDB and LDB
294         nosync_config = ""
295         if self.nosync:
296             nosync_config = "dbnosync"
297         
298         lnkattr = self.schema.linked_attributes()
299         refint_attributes = ""
300         memberof_config = "# Generated from Samba4 schema\n"
301         for att in  lnkattr.keys():
302             if lnkattr[att] is not None:
303                 refint_attributes = refint_attributes + " " + att 
304             
305                 memberof_config += read_and_sub_file(self.setup_path("memberof.conf"),
306                                                  { "MEMBER_ATTR" : att ,
307                                                    "MEMBEROF_ATTR" : lnkattr[att] })
308             
309         refint_config = read_and_sub_file(self.setup_path("refint.conf"),
310                                       { "LINK_ATTRS" : refint_attributes})
311     
312         attrs = ["linkID", "lDAPDisplayName"]
313         res = self.schema.ldb.search(expression="(&(objectclass=attributeSchema)(searchFlags:1.2.840.113556.1.4.803:=1))", base=self.names.schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
314         index_config = ""
315         for i in range (0, len(res)):
316             index_attr = res[i]["lDAPDisplayName"][0]
317             if index_attr == "objectGUID":
318                 index_attr = "entryUUID"
319             
320             index_config += "index " + index_attr + " eq\n"
321
322         # generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
323         mmr_on_config = ""
324         mmr_replicator_acl = ""
325         mmr_serverids_config = ""
326         mmr_syncrepl_schema_config = "" 
327         mmr_syncrepl_config_config = "" 
328         mmr_syncrepl_user_config = "" 
329        
330     
331         if self.ol_mmr_urls is not None:
332             # For now, make these equal
333             mmr_pass = self.ldapadminpass
334         
335             url_list=filter(None,self.ol_mmr_urls.split(' ')) 
336             if (len(url_list) == 1):
337                 url_list=filter(None,self.ol_mmr_urls.split(',')) 
338                      
339             
340                 mmr_on_config = "MirrorMode On"
341                 mmr_replicator_acl = "  by dn=cn=replicator,cn=samba read"
342                 serverid=0
343                 for url in url_list:
344                     serverid=serverid+1
345                     mmr_serverids_config += read_and_sub_file(self.setup_path("mmr_serverids.conf"),
346                                                           { "SERVERID" : str(serverid),
347                                                             "LDAPSERVER" : url })
348                     rid=serverid*10
349                     rid=rid+1
350                     mmr_syncrepl_schema_config += read_and_sub_file(self.setup_path("mmr_syncrepl.conf"),
351                                                                 {  "RID" : str(rid),
352                                                                    "MMRDN": self.names.schemadn,
353                                                                    "LDAPSERVER" : url,
354                                                                    "MMR_PASSWORD": mmr_pass})
355                 
356                     rid=rid+1
357                     mmr_syncrepl_config_config += read_and_sub_file(self.setup_path("mmr_syncrepl.conf"),
358                                                                 {  "RID" : str(rid),
359                                                                    "MMRDN": self.names.configdn,
360                                                                    "LDAPSERVER" : url,
361                                                                    "MMR_PASSWORD": mmr_pass})
362                 
363                     rid=rid+1
364                     mmr_syncrepl_user_config += read_and_sub_file(self.setup_path("mmr_syncrepl.conf"),
365                                                               {  "RID" : str(rid),
366                                                                  "MMRDN": self.names.domaindn,
367                                                                  "LDAPSERVER" : url,
368                                                                  "MMR_PASSWORD": mmr_pass })
369         # OpenLDAP cn=config initialisation
370         olc_syncrepl_config = ""
371         olc_mmr_config = "" 
372         # if mmr = yes, generate cn=config-replication directives
373         # and olc_seed.lif for the other mmr-servers
374         if self.ol_mmr_urls is not None:
375             serverid=0
376             olc_serverids_config = ""
377             olc_syncrepl_seed_config = ""
378             olc_mmr_config += read_and_sub_file(self.setup_path("olc_mmr.conf"),{})
379             rid=1000
380             for url in url_list:
381                 serverid=serverid+1
382                 olc_serverids_config += read_and_sub_file(self.setup_path("olc_serverid.conf"),
383                                                       { "SERVERID" : str(serverid),
384                                                         "LDAPSERVER" : url })
385             
386                 rid=rid+1
387                 olc_syncrepl_config += read_and_sub_file(self.setup_path("olc_syncrepl.conf"),
388                                                      {  "RID" : str(rid),
389                                                         "LDAPSERVER" : url,
390                                                         "MMR_PASSWORD": mmr_pass})
391             
392                 olc_syncrepl_seed_config += read_and_sub_file(self.setup_path("olc_syncrepl_seed.conf"),
393                                                           {  "RID" : str(rid),
394                                                              "LDAPSERVER" : url})
395                 
396             setup_file(self.setup_path("olc_seed.ldif"), self.paths.olcseedldif,
397                        {"OLC_SERVER_ID_CONF": olc_serverids_config,
398                         "OLC_PW": self.ldapadminpass,
399                         "OLC_SYNCREPL_CONF": olc_syncrepl_seed_config})
400         # end olc
401                 
402         setup_file(self.setup_path("slapd.conf"), self.paths.slapdconf,
403                    {"DNSDOMAIN": self.names.dnsdomain,
404                     "LDAPDIR": self.paths.ldapdir,
405                     "DOMAINDN": self.names.domaindn,
406                     "CONFIGDN": self.names.configdn,
407                     "SCHEMADN": self.names.schemadn,
408                     "MEMBEROF_CONFIG": memberof_config,
409                     "MIRRORMODE": mmr_on_config,
410                     "REPLICATOR_ACL": mmr_replicator_acl,
411                     "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
412                     "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
413                     "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
414                     "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
415                     "OLC_SYNCREPL_CONFIG": olc_syncrepl_config,
416                     "OLC_MMR_CONFIG": olc_mmr_config,
417                     "REFINT_CONFIG": refint_config,
418                     "INDEX_CONFIG": index_config,
419                     "NOSYNC": nosync_config})
420         
421         setup_db_config(self.setup_path, os.path.join(self.paths.ldapdir, "db", "user"))
422         setup_db_config(self.setup_path, os.path.join(self.paths.ldapdir, "db", "config"))
423         setup_db_config(self.setup_path, os.path.join(self.paths.ldapdir, "db", "schema"))
424     
425         if not os.path.exists(os.path.join(self.paths.ldapdir, "db", "samba",  "cn=samba")):
426             os.makedirs(os.path.join(self.paths.ldapdir, "db", "samba",  "cn=samba"), 0700)
427         
428         setup_file(self.setup_path("cn=samba.ldif"), 
429                    os.path.join(self.paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
430                    { "UUID": str(uuid.uuid4()), 
431                      "LDAPTIME": timestring(int(time.time()))} )
432         setup_file(self.setup_path("cn=samba-admin.ldif"), 
433                    os.path.join(self.paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
434                    {"LDAPADMINPASS_B64": b64encode(self.ldapadminpass),
435                     "UUID": str(uuid.uuid4()), 
436                     "LDAPTIME": timestring(int(time.time()))} )
437     
438         if self.ol_mmr_urls is not None:
439             setup_file(self.setup_path("cn=replicator.ldif"),
440                        os.path.join(self.paths.ldapdir, "db", "samba",  "cn=samba", "cn=replicator.ldif"),
441                        {"MMR_PASSWORD_B64": b64encode(mmr_pass),
442                         "UUID": str(uuid.uuid4()),
443                         "LDAPTIME": timestring(int(time.time()))} )
444         
445
446         mapping = "schema-map-openldap-2.3"
447         backend_schema = "backend-schema.schema"
448
449         backend_schema_data = self.schema.ldb.convert_schema_to_openldap("openldap", open(self.setup_path(mapping), 'r').read())
450         assert backend_schema_data is not None
451         open(os.path.join(self.paths.ldapdir, backend_schema), 'w').write(backend_schema_data)
452
453         # now we generate the needed strings to start slapd automatically,
454         # first ldapi_uri...
455         if self.ldap_backend_extra_port is not None:
456             # When we use MMR, we can't use 0.0.0.0 as it uses the name
457             # specified there as part of it's clue as to it's own name,
458             # and not to replicate to itself
459             if self.ol_mmr_urls is None:
460                 server_port_string = "ldap://0.0.0.0:%d" % self.ldap_backend_extra_port
461             else:
462                 server_port_string = "ldap://" + self.names.hostname + "." + self.names.dnsdomain +":%d" % self.ldap_backend_extra_port
463         else:
464             server_port_string = ""
465
466         # Prepare the 'result' information - the commands to return in particular
467         self.slapd_provision_command = [self.slapd_path]
468
469         self.slapd_provision_command.append("-F" + self.paths.olcdir)
470
471         self.slapd_provision_command.append("-h")
472
473         # copy this command so we have two version, one with -d0 and only ldapi, and one with all the listen commands
474         self.slapd_command = list(self.slapd_provision_command)
475     
476         self.slapd_provision_command.append(self.ldapi_uri)
477         self.slapd_provision_command.append("-d0")
478
479         uris = self.ldapi_uri
480         if server_port_string is not "":
481             uris = uris + " " + server_port_string
482
483         self.slapd_command.append(uris)
484
485         # Set the username - done here because Fedora DS still uses the admin DN and simple bind
486         self.credentials.set_username("samba-admin")
487     
488         # If we were just looking for crashes up to this point, it's a
489         # good time to exit before we realise we don't have OpenLDAP on
490         # this system
491         if self.ldap_dryrun_mode:
492             sys.exit(0)
493
494         # Finally, convert the configuration into cn=config style!
495         if not os.path.isdir(self.paths.olcdir):
496             os.makedirs(self.paths.olcdir, 0770)
497
498             retcode = subprocess.call([self.slapd_path, "-Ttest", "-f", self.paths.slapdconf, "-F", self.paths.olcdir], close_fds=True, shell=False)
499
500 #            We can't do this, as OpenLDAP is strange.  It gives an error
501 #            output to the above, but does the conversion sucessfully...
502 #
503 #            if retcode != 0:
504 #                raise ProvisioningError("conversion from slapd.conf to cn=config failed")
505
506             if not os.path.exists(os.path.join(self.paths.olcdir, "cn=config.ldif")):
507                 raise ProvisioningError("conversion from slapd.conf to cn=config failed")
508
509             # Don't confuse the admin by leaving the slapd.conf around
510             os.remove(self.paths.slapdconf)        
511
512
513 class FDSBackend(LDAPBackend):
514     def __init__(self, backend_type, paths=None, setup_path=None, lp=None, credentials=None,
515                  names=None, message=None,
516                  hostname=None,
517                  schema=None,
518                  ldapadminpass=None,
519                  slapd_path=None,
520                  ldap_backend_extra_port=None,
521                  ldap_dryrun_mode=False,
522                  root=None,
523                  setup_ds_path=None,
524                  domainsid=None):
525
526         super(FDSBackend, self).__init__(
527                 backend_type=backend_type,
528                 paths=paths, setup_path=setup_path,
529                 lp=lp, credentials=credentials,
530                 names=names,
531                 message=message,
532                 hostname=hostname,
533                 schema=schema,
534                 ldapadminpass=ldapadminpass,
535                 slapd_path=slapd_path,
536                 ldap_backend_extra_port=ldap_backend_extra_port,
537                 ldap_dryrun_mode=ldap_dryrun_mode)
538
539         self.root = root
540         self.setup_ds_path = setup_ds_path
541         self.domainsid = domainsid
542
543     def provision(self):
544         if self.ldap_backend_extra_port is not None:
545             serverport = "ServerPort=%d" % self.ldap_backend_extra_port
546         else:
547             serverport = ""
548         
549         setup_file(self.setup_path("fedorads.inf"), self.paths.fedoradsinf, 
550                    {"ROOT": self.root,
551                     "HOSTNAME": self.hostname,
552                     "DNSDOMAIN": self.names.dnsdomain,
553                     "LDAPDIR": self.paths.ldapdir,
554                     "DOMAINDN": self.names.domaindn,
555                     "LDAPMANAGERDN": self.names.ldapmanagerdn,
556                     "LDAPMANAGERPASS": self.ldapadminpass, 
557                     "SERVERPORT": serverport})
558
559         setup_file(self.setup_path("fedorads-partitions.ldif"), self.paths.fedoradspartitions, 
560                    {"CONFIGDN": self.names.configdn,
561                     "SCHEMADN": self.names.schemadn,
562                     "SAMBADN": self.names.sambadn,
563                     })
564
565         setup_file(self.setup_path("fedorads-sasl.ldif"), self.paths.fedoradssasl, 
566                    {"SAMBADN": self.names.sambadn,
567                     })
568
569         setup_file(self.setup_path("fedorads-dna.ldif"), self.paths.fedoradsdna, 
570                    {"DOMAINDN": self.names.domaindn,
571                     "SAMBADN": self.names.sambadn,
572                     "DOMAINSID": str(self.domainsid),
573                     })
574
575         setup_file(self.setup_path("fedorads-pam.ldif"), self.paths.fedoradspam)
576
577         lnkattr = self.schema.linked_attributes()
578
579         refint_config = data = open(self.setup_path("fedorads-refint-delete.ldif"), 'r').read()
580         memberof_config = ""
581         index_config = ""
582         argnum = 3
583
584         for attr in lnkattr.keys():
585             if lnkattr[attr] is not None:
586                 refint_config += read_and_sub_file(self.setup_path("fedorads-refint-add.ldif"),
587                                                  { "ARG_NUMBER" : str(argnum) ,
588                                                    "LINK_ATTR" : attr })
589                 memberof_config += read_and_sub_file(self.setup_path("fedorads-linked-attributes.ldif"),
590                                                  { "MEMBER_ATTR" : attr ,
591                                                    "MEMBEROF_ATTR" : lnkattr[attr] })
592                 index_config += read_and_sub_file(self.setup_path("fedorads-index.ldif"),
593                                                  { "ATTR" : attr })
594                 argnum += 1
595
596         open(self.paths.fedoradsrefint, 'w').write(refint_config)
597         open(self.paths.fedoradslinkedattributes, 'w').write(memberof_config)
598
599         attrs = ["lDAPDisplayName"]
600         res = self.schema.ldb.search(expression="(&(objectclass=attributeSchema)(searchFlags:1.2.840.113556.1.4.803:=1))", base=self.names.schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
601
602         for i in range (0, len(res)):
603             attr = res[i]["lDAPDisplayName"][0]
604
605             if attr == "objectGUID":
606                 attr = "nsUniqueId"
607
608             index_config += read_and_sub_file(self.setup_path("fedorads-index.ldif"),
609                                              { "ATTR" : attr })
610
611         open(self.paths.fedoradsindex, 'w').write(index_config)
612
613         setup_file(self.setup_path("fedorads-samba.ldif"), self.paths.fedoradssamba,
614                     {"SAMBADN": self.names.sambadn, 
615                      "LDAPADMINPASS": self.ldapadminpass
616                     })
617
618         mapping = "schema-map-fedora-ds-1.0"
619         backend_schema = "99_ad.ldif"
620     
621         # Build a schema file in Fedora DS format
622         backend_schema_data = self.schema.ldb.convert_schema_to_openldap("fedora-ds", open(self.setup_path(mapping), 'r').read())
623         assert backend_schema_data is not None
624         open(os.path.join(self.paths.ldapdir, backend_schema), 'w').write(backend_schema_data)
625
626         self.credentials.set_bind_dn(self.names.ldapmanagerdn)
627
628         # Destory the target directory, or else setup-ds.pl will complain
629         fedora_ds_dir = os.path.join(self.paths.ldapdir, "slapd-samba4")
630         shutil.rmtree(fedora_ds_dir, True)
631
632         self.slapd_provision_command = [self.slapd_path, "-D", fedora_ds_dir, "-i", self.paths.slapdpid];
633         #In the 'provision' command line, stay in the foreground so we can easily kill it
634         self.slapd_provision_command.append("-d0")
635
636         #the command for the final run is the normal script
637         self.slapd_command = [os.path.join(self.paths.ldapdir, "slapd-samba4", "start-slapd")]
638
639         # If we were just looking for crashes up to this point, it's a
640         # good time to exit before we realise we don't have Fedora DS on
641         if self.ldap_dryrun_mode:
642             sys.exit(0)
643
644         # Try to print helpful messages when the user has not specified the path to the setup-ds tool
645         if self.setup_ds_path is None:
646             raise ProvisioningError("Warning: Fedora DS LDAP-Backend must be setup with path to setup-ds, e.g. --setup-ds-path=\"/usr/sbin/setup-ds.pl\"!")
647         if not os.path.exists(self.setup_ds_path):
648             self.message (self.setup_ds_path)
649             raise ProvisioningError("Warning: Given Path to slapd does not exist!")
650
651         # Run the Fedora DS setup utility
652         retcode = subprocess.call([self.setup_ds_path, "--silent", "--file", self.paths.fedoradsinf], close_fds=True, shell=False)
653         if retcode != 0:
654             raise ProvisioningError("setup-ds failed")
655
656         # Load samba-admin
657         retcode = subprocess.call([
658             os.path.join(self.paths.ldapdir, "slapd-samba4", "ldif2db"), "-s", self.names.sambadn, "-i", self.paths.fedoradssamba],
659             close_fds=True, shell=False)
660         if retcode != 0:
661             raise("ldib2db failed")
662
663     def post_setup(self):
664         ldapi_db = Ldb(self.ldapi_uri, credentials=self.credentials)
665
666         # delete default SASL mappings
667         res = ldapi_db.search(expression="(!(cn=samba-admin mapping))", base="cn=mapping,cn=sasl,cn=config", scope=SCOPE_ONELEVEL, attrs=["dn"])
668     
669         # configure in-directory access control on Fedora DS via the aci attribute (over a direct ldapi:// socket)
670         for i in range (0, len(res)):
671             dn = str(res[i]["dn"])
672             ldapi_db.delete(dn)
673             
674             aci = """(targetattr = "*") (version 3.0;acl "full access to all by samba-admin";allow (all)(userdn = "ldap:///CN=samba-admin,%s");)""" % self.names.sambadn
675         
676             m = ldb.Message()
677             m["aci"] = ldb.MessageElement([aci], ldb.FLAG_MOD_REPLACE, "aci")
678
679             m.dn = ldb.Dn(1, self.names.domaindn)
680             ldapi_db.modify(m)
681             
682             m.dn = ldb.Dn(1, self.names.configdn)
683             ldapi_db.modify(m)
684             
685             m.dn = ldb.Dn(1, self.names.schemadn)
686             ldapi_db.modify(m)