selftest: add test for subdomain support
[ira/wip.git] / selftest / target / Samba4.pm
index 959c16131a320c8a283500f3b3d15fbff416e068..ff8f5ee84bf294d3aad1a5b1e54debf2213e8760 100644 (file)
@@ -85,9 +85,9 @@ sub slapd_stop($$)
        return 1;
 }
 
-sub check_or_start($$)
+sub check_or_start($$$)
 {
-       my ($self, $env_vars) = @_;
+       my ($self, $env_vars, $process_model) = @_;
        return 0 if ( -p $env_vars->{SAMBA_TEST_FIFO});
 
        unlink($env_vars->{SAMBA_TEST_FIFO});
@@ -135,16 +135,8 @@ sub check_or_start($$)
                }
                my $samba =  Samba::bindir_path($self, "samba");
 
-               # allow selection of the process model using
-               # the environment varibale SAMBA_PROCESS_MODEL
-               # that allows us to change the process model for
-               # individual machines in the build farm
-               my $model = "single";
-               if (defined($ENV{SAMBA_PROCESS_MODEL})) {
-                       $model = $ENV{SAMBA_PROCESS_MODEL};
-               }
                chomp($pwd);
-               my $cmdline = "$valgrind ${pwd}/$samba $optarg $env_vars->{CONFIGURATION} -M $model -i";
+               my $cmdline = "$valgrind ${pwd}/$samba $optarg $env_vars->{CONFIGURATION} -M $process_model -i";
                my $ret = system("$cmdline");
                if ($ret == -1) {
                        print "Unable to start $cmdline: $ret: $!\n";
@@ -456,10 +448,11 @@ EOF
 
 sub provision_raw_prepare($$$$$$$$$$)
 {
-       my ($self, $prefix, $server_role, $netbiosname, 
+       my ($self, $prefix, $server_role, $hostname,
            $domain, $realm, $functional_level,
            $swiface, $password, $kdc_ipv4) = @_;
        my $ctx;
+       my $netbiosname = uc($hostname);
 
        unless(-d $prefix or mkdir($prefix, 0777)) {
                warn("Unable to create $prefix");
@@ -480,6 +473,7 @@ sub provision_raw_prepare($$$$$$$$$$)
        $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 
        $ctx->{server_role} = $server_role;
+       $ctx->{hostname} = $hostname;
        $ctx->{netbiosname} = $netbiosname;
        $ctx->{swiface} = $swiface;
        $ctx->{password} = $password;
@@ -508,6 +502,8 @@ sub provision_raw_prepare($$$$$$$$$$)
        $ctx->{privatedir} = "$prefix_abs/private";
        $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
        $ctx->{lockdir} = "$prefix_abs/lockdir";
+       $ctx->{statedir} = "$prefix_abs/statedir";
+       $ctx->{cachedir} = "$prefix_abs/cachedir";
        $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
        $ctx->{winbindd_privileged_socket_dir} = "$prefix_abs/winbindd_privileged_socket";
        $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
@@ -522,8 +518,9 @@ sub provision_raw_prepare($$$$$$$$$$)
        push(@{$ctx->{directories}}, $ctx->{privatedir});
        push(@{$ctx->{directories}}, $ctx->{etcdir});
        push(@{$ctx->{directories}}, $ctx->{piddir});
-       push(@{$ctx->{directories}}, $ctx->{ncalrpcdir});
        push(@{$ctx->{directories}}, $ctx->{lockdir});
+       push(@{$ctx->{directories}}, $ctx->{statedir});
+       push(@{$ctx->{directories}}, $ctx->{cachedir});
 
        $ctx->{smb_conf_extra_options} = "";
 
@@ -549,7 +546,7 @@ sub provision_raw_prepare($$$$$$$$$$)
        }
        push (@provision_options, "$self->{srcdir}/source4/setup/provision");
        push (@provision_options, "--configfile=$ctx->{smb_conf}");
-       push (@provision_options, "--host-name=$ctx->{netbiosname}");
+       push (@provision_options, "--host-name=$ctx->{hostname}");
        push (@provision_options, "--host-ip=$ctx->{ipv4}");
        push (@provision_options, "--quiet");
        push (@provision_options, "--domain=$ctx->{domain}");
@@ -579,16 +576,21 @@ sub provision_raw_step1($$)
                warn("can't open $ctx->{smb_conf}$?");
                return undef;
        }
+       my $acl = "false";
+       $acl = "true" if (defined $ENV{WITH_ACL});
        print CONFFILE "
 [global]
+       acl:search = $acl
        netbios name = $ctx->{netbiosname}
-       posix:eadb = $ctx->{lockdir}/eadb.tdb
+       posix:eadb = $ctx->{statedir}/eadb.tdb
        workgroup = $ctx->{domain}
        realm = $ctx->{realm}
        private dir = $ctx->{privatedir}
        pid directory = $ctx->{piddir}
        ncalrpc dir = $ctx->{ncalrpcdir}
        lock dir = $ctx->{lockdir}
+       state directory = $ctx->{statedir}
+       cache directory = $ctx->{cachedir}
        winbindd socket directory = $ctx->{winbindd_socket_dir}
        winbindd privileged socket directory = $ctx->{winbindd_privileged_socket_dir}
        ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
@@ -596,7 +598,7 @@ sub provision_raw_step1($$)
        name resolve order = file bcast
        interfaces = $ctx->{interfaces}
        tls dh params file = $ctx->{tlsdir}/dhparms.pem
-       panic action = $RealBin/gdb_backtrace \%PID% \%PROG%
+       panic action = $RealBin/gdb_backtrace \%d
        wins support = yes
        server role = $ctx->{server_role}
        server services = +echo
@@ -611,6 +613,8 @@ sub provision_raw_step1($$)
         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate
         resolv:host file = $ctx->{dns_host_file}
        dreplsrv:periodic_startup_interval = 0
+
+        passdb backend = samba4
 ";
 
        if (defined($ctx->{sid_generator}) && $ctx->{sid_generator} ne "internal") {
@@ -633,7 +637,7 @@ sub provision_raw_step1($$)
              $ctx->{kdc_ipv4} = $ctx->{ipv4};
         }
 
-       Samba::mk_krb5_conf($ctx);
+       Samba::mk_krb5_conf($ctx, "");
 
        open(PWD, ">$ctx->{nsswrap_passwd}");
        print PWD "
@@ -656,7 +660,7 @@ nogroup:x:65534:nobody
        my $configuration = "--configfile=$ctx->{smb_conf}";
 
 #Ensure the config file is valid before we start
-       my $testparm = $self->scriptdir_path("bin/testparm");
+       my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
        if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
                system("$testparm -v --suppress-prompt $configuration >&2");
                warn("Failed to create a valid smb.conf configuration $testparm!");
@@ -670,7 +674,7 @@ nogroup:x:65534:nobody
        my $ret = {
                KRB5_CONFIG => $ctx->{krb5_conf},
                PIDDIR => $ctx->{piddir},
-               SERVER => $ctx->{netbiosname},
+               SERVER => $ctx->{hostname},
                SERVER_IP => $ctx->{ipv4},
                NETBIOSNAME => $ctx->{netbiosname},
                DOMAIN => $ctx->{domain},
@@ -682,6 +686,8 @@ nogroup:x:65534:nobody
                WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
                NCALRPCDIR => $ctx->{ncalrpcdir},
                LOCKDIR => $ctx->{lockdir},
+               STATEDIR => $ctx->{statedir},
+               CACHEDIR => $ctx->{cachedir},
                SERVERCONFFILE => $ctx->{smb_conf},
                CONFIGURATION => $configuration,
                SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
@@ -713,12 +719,12 @@ sub provision_raw_step2($$$)
 
 sub provision($$$$$$$$$)
 {
-       my ($self, $prefix, $server_role, $netbiosname, 
+       my ($self, $prefix, $server_role, $hostname,
            $domain, $realm, $functional_level,
            $swiface, $password, $kdc_ipv4, $extra_smbconf_options) = @_;
 
        my $ctx = $self->provision_raw_prepare($prefix, $server_role,
-                                              $netbiosname, 
+                                              $hostname,
                                               $domain, $realm, $functional_level,
                                               $swiface, $password, $kdc_ipv4);
 
@@ -732,10 +738,11 @@ sub provision($$$$$$$$$)
 
        max xmit = 32K
        server max protocol = SMB2
-        $extra_smbconf_options
        host msdfs = $msdfs
        lanman auth = yes
 
+       $extra_smbconf_options
+
 [tmp]
        path = $ctx->{tmpdir}
        read only = no
@@ -762,8 +769,10 @@ sub provision($$$$$$$$$)
        ntvfs handler = cifs
        cifs:server = $ctx->{netbiosname}
        cifs:share = tmp
-#There is no username specified here, instead the client is expected
-#to log in with kerberos, and the serverwill use delegated credentials.
+       cifs:use-s4u2proxy = yes
+       # There is no username specified here, instead the client is expected
+       # to log in with kerberos, and the serverwill use delegated credentials.
+       # Or the server tries s4u2self/s4u2proxy to impersonate the client
 
 [simple]
        path = $ctx->{tmpdir}
@@ -771,11 +780,11 @@ sub provision($$$$$$$$$)
        ntvfs handler = simple
 
 [sysvol]
-       path = $ctx->{lockdir}/sysvol
+       path = $ctx->{statedir}/sysvol
        read only = yes
 
 [netlogon]
-       path = $ctx->{lockdir}/sysvol/$ctx->{dnsname}/scripts
+       path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
        read only = no
 
 [cifsposix]
@@ -845,7 +854,7 @@ sub provision_member($$$)
        my $cmd = "";
        $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
        $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
-       $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} member";
+       $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
        $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
 
        unless (system($cmd) == 0) {
@@ -873,9 +882,23 @@ sub provision_rpc_proxy($$$)
        my ($self, $prefix, $dcvars) = @_;
        print "PROVISIONING RPC PROXY...";
 
-       my $extra_smbconf_options = "dcerpc_remote:binding = ncacn_ip_tcp:localdc
-       dcerpc endpoint servers = epmapper, remote
-       dcerpc_remote:interfaces = rpcecho
+       my $extra_smbconf_options = "
+
+       # rpc_proxy
+       dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
+       dcerpc endpoint servers = epmapper, remote
+       dcerpc_remote:interfaces = rpcecho
+
+[cifs_to_dc]
+       read only = no
+       ntvfs handler = cifs
+       cifs:server = $dcvars->{SERVER}
+       cifs:share = cifs
+       cifs:use-s4u2proxy = yes
+       # There is no username specified here, instead the client is expected
+       # to log in with kerberos, and the serverwill use delegated credentials.
+       # Or the server tries s4u2self/s4u2proxy to impersonate the client
+
 ";
 
        my $ret = $self->provision($prefix,
@@ -894,10 +917,12 @@ sub provision_rpc_proxy($$$)
        }
 
        my $samba_tool =  Samba::bindir_path($self, "samba-tool");
+
+       # The joind runs in the context of the rpc_proxy/member for now
        my $cmd = "";
        $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
        $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
-       $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} member";
+       $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
        $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
 
        unless (system($cmd) == 0) {
@@ -905,6 +930,30 @@ sub provision_rpc_proxy($$$)
                return undef;
        }
 
+       # Setting up delegation runs in the context of the DC for now
+       $cmd = "";
+       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
+       $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
+       $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
+       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+
+       unless (system($cmd) == 0) {
+               warn("Delegation failed\n$cmd");
+               return undef;
+       }
+
+       # Setting up delegation runs in the context of the DC for now
+       $cmd = "";
+       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
+       $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
+       $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
+       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+
+       unless (system($cmd) == 0) {
+               warn("Delegation failed\n$cmd");
+               return undef;
+       }
+
        $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
        $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
        $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
@@ -939,11 +988,11 @@ sub provision_vampire_dc($$$)
        server max protocol = SMB2
 
 [sysvol]
-       path = $ctx->{lockdir}/sysvol
+       path = $ctx->{statedir}/sysvol
        read only = yes
 
 [netlogon]
-       path = $ctx->{lockdir}/sysvol/$ctx->{dnsname}/scripts
+       path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
        read only = no
 
 ";
@@ -957,8 +1006,8 @@ sub provision_vampire_dc($$$)
        my $cmd = "";
        $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
        $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
-       $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
-       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
+       $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
+       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
 
        unless (system($cmd) == 0) {
                warn("Join failed\n$cmd");
@@ -978,6 +1027,68 @@ sub provision_vampire_dc($$$)
        return $ret;
 }
 
+sub provision_subdom_dc($$$)
+{
+       my ($self, $prefix, $dcvars) = @_;
+       print "PROVISIONING SUBDOMAIN DC...";
+
+       # We do this so that we don't run the provision.  That's the job of 'net vampire'.
+       my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
+                                              "localsubdc",
+                                              "SAMBASUBDOM",
+                                              "sub.samba.example.com",
+                                              "2008",
+                                              31, $dcvars->{PASSWORD},
+                                              undef);
+
+       $ctx->{smb_conf_extra_options} = "
+       max xmit = 32K
+       server max protocol = SMB2
+
+[sysvol]
+       path = $ctx->{statedir}/sysvol
+       read only = yes
+
+[netlogon]
+       path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
+       read only = no
+
+";
+
+       my $ret = $self->provision_raw_step1($ctx);
+       unless ($ret) {
+               return undef;
+       }
+
+        my $dc_realms = Samba::mk_realms_stanza($dcvars->{REALM}, lc($dcvars->{REALM}),
+                                                $dcvars->{DOMAIN}, $dcvars->{SERVER_IP});
+       Samba::mk_krb5_conf($ctx, $dc_realms);
+
+       my $samba_tool =  Samba::bindir_path($self, "samba-tool");
+       my $cmd = "";
+       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
+       $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
+       $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{realm} subdomain ";
+       $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
+
+       unless (system($cmd) == 0) {
+               warn("Join failed\n$cmd");
+               return undef;
+       }
+
+       $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
+       $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
+       $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
+
+       $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
+       $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
+       $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
+       $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
+       $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
+
+       return $ret;
+}
+
 sub provision_dc($$)
 {
        my ($self, $prefix) = @_;
@@ -1104,11 +1215,11 @@ sub provision_rodc($$$)
        server max protocol = SMB2
 
 [sysvol]
-       path = $ctx->{lockdir}/sysvol
+       path = $ctx->{statedir}/sysvol
        read only = yes
 
 [netlogon]
-       path = $ctx->{lockdir}/sysvol/$ctx->{dnsname}/scripts
+       path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
        read only = yes
 
 [tmp]
@@ -1129,7 +1240,7 @@ sub provision_rodc($$$)
        my $cmd = "";
        $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
        $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
-       $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
+       $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
        $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
        $cmd .= " --server=$dcvars->{DC_SERVER}";
 
@@ -1157,6 +1268,40 @@ sub provision_rodc($$$)
        return $ret;
 }
 
+sub provision_plugin_s4_dc($$)
+{
+       my ($self, $prefix) = @_;
+
+       my $extra_smbconf_options = "
+server services = -smb
+";
+
+       print "PROVISIONING PLUGIN S4 DC...";
+       my $ret = $self->provision($prefix,
+                                  "domain controller",
+                                  "plugindc",
+                                  "PLUGINDOMAIN",
+                                  "plugin.samba.example.com",
+                                  "2008",
+                                  30,
+                                  "locDCpass1",
+                                  undef, $extra_smbconf_options);
+
+       return undef unless(defined $ret);
+       unless($self->add_wins_config("$prefix/private")) {
+               warn("Unable to add wins configuration");
+               return undef;
+       }
+
+       $ret->{DC_SERVER} = $ret->{SERVER};
+       $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
+       $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
+       $ret->{DC_USERNAME} = $ret->{USERNAME};
+       $ret->{DC_PASSWORD} = $ret->{PASSWORD};
+
+       return $ret;
+}
+
 sub teardown_env($$)
 {
        my ($self, $envvars) = @_;
@@ -1246,6 +1391,11 @@ sub setup_env($$$)
                        $self->setup_dc("$path/dc");
                }
                return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{dc});
+       } elsif ($envname eq "subdom_dc") {
+               if (not defined($self->{vars}->{dc})) {
+                       $self->setup_dc("$path/dc");
+               }
+               return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{dc});
        } elsif ($envname eq "s4member") {
                if (not defined($self->{vars}->{dc})) {
                        $self->setup_dc("$path/dc");
@@ -1261,6 +1411,8 @@ sub setup_env($$$)
                        $self->setup_dc("$path/dc");
                }
                return $target3->setup_admember("$path/s3member", $self->{vars}->{dc}, 29);
+       } elsif ($envname eq "plugin_s4_dc") {
+               return $self->setup_plugin_s4_dc("$path/plugin_s4_dc");
        } elsif ($envname eq "all") {
                if (not defined($self->{vars}->{dc})) {
                        $ENV{ENVNAME} = "dc";
@@ -1332,7 +1484,7 @@ sub setup_member($$$)
        my $env = $self->provision_member($path, $dc_vars);
 
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1349,7 +1501,7 @@ sub setup_rpc_proxy($$$)
        my $env = $self->provision_rpc_proxy($path, $dc_vars);
 
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1364,7 +1516,7 @@ sub setup_dc($$)
 
        my $env = $self->provision_dc($path);
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "standard");
 
                $self->wait_for_start($env);
 
@@ -1379,7 +1531,7 @@ sub setup_fl2000dc($$)
 
        my $env = $self->provision_fl2000dc($path);
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1396,7 +1548,7 @@ sub setup_fl2003dc($$)
        my $env = $self->provision_fl2003dc($path);
 
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1412,7 +1564,7 @@ sub setup_fl2008r2dc($$)
        my $env = $self->provision_fl2008r2dc($path);
 
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1429,7 +1581,7 @@ sub setup_vampire_dc($$$)
        my $env = $self->provision_vampire_dc($path, $dc_vars);
 
        if (defined $env) {
-               $self->check_or_start($env);
+               $self->check_or_start($env, "single");
 
                $self->wait_for_start($env);
 
@@ -1442,6 +1594,7 @@ sub setup_vampire_dc($$$)
                $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
                $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
                $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
+               $cmd .= " $env->{CONFIGURATION}";
                $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
                unless (system($cmd) == 0) {
                        warn("Failed to exec kcc\n$cmd");
@@ -1454,6 +1607,7 @@ sub setup_vampire_dc($$$)
                $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
                $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
                $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{VAMPIRE_DC_SERVER}";
+               $cmd .= " $dc_vars->{CONFIGURATION}";
                $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
                # replicate Configuration NC
                my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
@@ -1472,6 +1626,59 @@ sub setup_vampire_dc($$$)
        return $env;
 }
 
+sub setup_subdom_dc($$$)
+{
+       my ($self, $path, $dc_vars) = @_;
+
+       my $env = $self->provision_subdom_dc($path, $dc_vars);
+
+       if (defined $env) {
+               $self->check_or_start($env, "single");
+
+               $self->wait_for_start($env);
+
+               $self->{vars}->{subdom_dc} = $env;
+
+               # force replicated DC to update repsTo/repsFrom
+               # for primary domain partitions
+               my $samba_tool =  Samba::bindir_path($self, "samba-tool");
+               my $cmd = "";
+               $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
+               $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
+               $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
+               $cmd .= " $env->{CONFIGURATION}";
+               $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
+               unless (system($cmd) == 0) {
+                       warn("Failed to exec kcc\n$cmd");
+                       return undef;
+               }
+
+               # as 'subdomain' dc may add data in its local replica
+               # we need to synchronize data between DCs
+               my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
+               my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
+               $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
+               $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
+               $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
+               $cmd .= " $dc_vars->{CONFIGURATION}";
+               $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
+               # replicate Configuration NC
+               my $cmd_repl = "$cmd \"$config_dn\"";
+               unless(system($cmd_repl) == 0) {
+                       warn("Failed to replicate\n$cmd_repl");
+                       return undef;
+               }
+               # replicate Default NC
+               $cmd_repl = "$cmd \"$base_dn\"";
+               unless(system($cmd_repl) == 0) {
+                       warn("Failed to replicate\n$cmd_repl");
+                       return undef;
+               }
+       }
+
+       return $env;
+}
+
 sub setup_rodc($$$)
 {
        my ($self, $path, $dc_vars) = @_;
@@ -1482,7 +1689,7 @@ sub setup_rodc($$$)
                return undef;
        }
 
-       $self->check_or_start($env);
+       $self->check_or_start($env, "single");
 
        $self->wait_for_start($env);
 
@@ -1491,4 +1698,24 @@ sub setup_rodc($$$)
        return $env;
 }
 
+sub setup_plugin_s4_dc($$)
+{
+       my ($self, $path) = @_;
+
+       my $env = $self->provision_plugin_s4_dc($path);
+       if (defined $env) {
+               $self->check_or_start($env, "single");
+
+               $self->wait_for_start($env);
+
+               my $s3_part_env = $self->{target3}->setup_plugin_s4_dc($path, $env, 30);
+               if (not defined($s3_part_env)) {
+                   return undef;
+               }
+
+               $self->{vars}->{plugin_s4_dc} = $s3_part_env;
+       }
+       return $env;
+}
+
 1;