# backend code for provisioning a Samba4 server
# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
-# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
# Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
#
# Based on the original in EJS:
import registry
import samba
import subprocess
+import ldb
import shutil
from credentials import Credentials, DONT_USE_KERBEROS
-from auth import system_session
+from auth import system_session, admin_session
from samba import version, Ldb, substitute_var, valid_netbios_name, check_all_substituted, \
DS_BEHAVIOR_WIN2008
from samba.samdb import SamDB
import urllib
from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, timestring
from ms_schema import read_ms_schema
+from ms_display_specifiers import read_ms_ldif
from signal import SIGTERM
__docformat__ = "restructuredText"
+class ProvisioningError(ValueError):
+ pass
+
+
def find_setup_dir():
"""Find the setup directory used by provision."""
dirname = os.path.dirname(__file__)
self.memberofconf = None
self.fedoradsinf = None
self.fedoradspartitions = None
+ self.fedoradssasl = None
self.olmmron = None
self.olmmrserveridsconf = None
self.olmmrsyncreplconf = None
self.domaindn = None
self.configdn = None
self.schemadn = None
+ self.sambadn = None
self.ldapmanagerdn = None
self.dnsdomain = None
self.realm = None
class Schema(object):
def __init__(self, setup_path, schemadn=None,
- serverdn=None):
+ serverdn=None, sambadn=None, ldap_backend_type=None):
"""Load schema for the SamDB from the AD schema files and samba4_schema.ldif
:param samdb: Load a schema into a SamDB.
self.schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
self.schema_data = substitute_var(self.schema_data, {"SCHEMADN": schemadn})
check_all_substituted(self.schema_data)
- prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
- prefixmap = b64encode(prefixmap)
-
+
self.schema_dn_modify = read_and_sub_file(setup_path("provision_schema_basedn_modify.ldif"),
{"SCHEMADN": schemadn,
- "PREFIXMAP_B64": prefixmap,
"SERVERDN": serverdn,
})
self.schema_dn_add = read_and_sub_file(setup_path("provision_schema_basedn.ldif"),
{"SCHEMADN": schemadn
})
- self.ldb.set_schema_from_ldif(self.schema_dn_modify, self.schema_data)
+ prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
+ prefixmap = b64encode(prefixmap)
+
+ # We don't actually add this ldif, just parse it
+ prefixmap_ldif = "dn: cn=schema\nprefixMap:: %s\n\n" % prefixmap
+ self.ldb.set_schema_from_ldif(prefixmap_ldif, self.schema_data)
+
+
+# Return a hash with the forward attribute as a key and the back as the value
+def get_linked_attributes(schemadn,schemaldb):
+ attrs = ["linkID", "lDAPDisplayName"]
+ res = schemaldb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
+ attributes = {}
+ for i in range (0, len(res)):
+ expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
+ target = schemaldb.searchone(basedn=schemadn,
+ expression=expression,
+ attribute="lDAPDisplayName",
+ scope=SCOPE_SUBTREE)
+ if target is not None:
+ attributes[str(res[i]["lDAPDisplayName"])]=str(target)
+
+ return attributes
+
+def get_dnsyntax_attributes(schemadn,schemaldb):
+ attrs = ["linkID", "lDAPDisplayName"]
+ res = schemaldb.search(expression="(&(!(linkID=*))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
+ attributes = []
+ for i in range (0, len(res)):
+ attributes.append(str(res[i]["lDAPDisplayName"]))
+
+ return attributes
+
def check_install(lp, session_info, credentials):
"""Check whether the current install seems ok.
ldb = Ldb(lp.get("sam database"), session_info=session_info,
credentials=credentials, lp=lp)
if len(ldb.search("(cn=Administrator)")) != 1:
- raise "No administrator account found"
+ raise ProvisioningError("No administrator account found")
def findnss(nssfn, names):
paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
- paths.templates = os.path.join(paths.private_dir, "templates.ldb")
paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
paths.namedconf = os.path.join(paths.private_dir, "named.conf")
paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
"fedorads.inf")
paths.fedoradspartitions = os.path.join(paths.ldapdir,
"fedorads-partitions.ldif")
+ paths.fedoradssasl = os.path.join(paths.ldapdir,
+ "fedorads-sasl.ldif")
+ paths.fedoradssamba = os.path.join(paths.ldapdir,
+ "fedorads-samba.ldif")
paths.olmmrserveridsconf = os.path.join(paths.ldapdir,
"mmr_serverids.conf")
paths.olmmrsyncreplconf = os.path.join(paths.ldapdir,
return paths
-def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
- rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None,
- sitename=None):
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
+ serverrole=None, rootdn=None, domaindn=None, configdn=None,
+ schemadn=None, serverdn=None, sitename=None, sambadn=None):
"""Guess configuration settings to use."""
if hostname is None:
configdn = "CN=Configuration," + rootdn
if schemadn is None:
schemadn = "CN=Schema," + configdn
+ if sambadn is None:
+ sambadn = "CN=Samba"
if sitename is None:
sitename=DEFAULTSITE
names.domaindn = domaindn
names.configdn = configdn
names.schemadn = schemadn
+ names.sambadn = sambadn
names.ldapmanagerdn = "CN=Manager," + rootdn
names.dnsdomain = dnsdomain
names.domain = domain
:param users_gid: gid of the UNIX users group.
:param wheel_gid: gid of the UNIX wheel group."""
- def add_foreign(self, domaindn, sid, desc):
- """Add a foreign security principle."""
- add = """
-dn: CN=%s,CN=ForeignSecurityPrincipals,%s
-objectClass: top
-objectClass: foreignSecurityPrincipal
-description: %s
-""" % (sid, domaindn, desc)
- # deliberately ignore errors from this, as the records may
- # already exist
- for msg in self.parse_ldif(add):
- self.add(msg[1])
-
- # add some foreign sids
- add_foreign(samdb, domaindn, "S-1-5-7", "Anonymous")
- add_foreign(samdb, domaindn, "S-1-1-0", "World")
- add_foreign(samdb, domaindn, "S-1-5-2", "Network")
- add_foreign(samdb, domaindn, "S-1-5-18", "System")
- add_foreign(samdb, domaindn, "S-1-5-11", "Authenticated Users")
-
-
idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
-
+
idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
-
def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
credentials, names,
serverrole, ldap_backend=None,
samdb = Ldb(url=samdb_path, session_info=session_info,
credentials=credentials, lp=lp, options=["modules:"])
# Wipes the database
- samdb.erase()
+ samdb.erase_except_schema_controlled()
except LdbError:
os.unlink(samdb_path)
samdb = Ldb(url=samdb_path, session_info=session_info,
credentials=credentials, lp=lp, options=["modules:"])
# Wipes the database
- samdb.erase()
+ samdb.erase_except_schema_controlled()
#Add modules to the list to activate them by default
"rdn_name",
"objectclass",
"samldb",
- "kludge_acl",
"password_hash",
- "operational"]
+ "operational",
+ "kludge_acl"]
tdb_modules_list = [
"subtree_rename",
"subtree_delete",
tdb_modules_list = ["extended_dn_out_dereference"]
elif serverrole == "domain controller":
- backend_modules = ["repl_meta_data"]
+ tdb_modules_list.insert(0, "repl_meta_data")
+ backend_modules = []
else:
backend_modules = ["objectguid"]
return secrets_ldb
-
-def setup_templatesdb(path, setup_path, session_info, lp):
- """Setup the templates database.
-
- :param path: Path to the database.
- :param setup_path: Function for obtaining the path to setup files.
- :param session_info: Session info
- :param credentials: Credentials
- :param lp: Loadparm context
- """
- templates_ldb = Ldb(url=path, session_info=session_info,
- lp=lp)
- # Wipes the database
- try:
- templates_ldb.erase()
- # This should be 'except LdbError', but on a re-provision the assert in ldb.erase fires, and we need to catch that too
- except:
- os.unlink(path)
-
- templates_ldb.load_ldif_file_add(setup_path("provision_templates_init.ldif"))
-
- templates_ldb = Ldb(url=path, session_info=session_info,
- lp=lp)
-
- templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
-
-
def setup_registry(path, setup_path, session_info, lp):
"""Setup the registry.
"DNSDOMAIN": names.dnsdomain,
"SAMBA_VERSION_STRING": version,
"DOMAIN_CONTROLLER_FUNCTIONALITY": str(domainControllerFunctionality)})
+
setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
"POLICYGUID": policyguid,
"DNSDOMAIN": names.dnsdomain,
"DOMAINSID": str(domainsid),
"DOMAINDN": names.domaindn})
+ # Setup fSMORoleOwner entries to point at the newly created DC entry
+ setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
+ "DOMAINDN": names.domaindn,
+ "CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ "DEFAULTSITE": names.sitename,
+ "SERVERDN": names.serverdn
+ })
+
def setup_samdb(path, setup_path, session_info, credentials, lp,
names, message,
names=names,
ldap_backend=ldap_backend, serverrole=serverrole)
+ if (schema == None):
+ schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn,
+ sambadn=names.sambadn, ldap_backend_type=ldap_backend.ldap_backend_type)
+
# Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
samdb = Ldb(session_info=session_info,
credentials=credentials, lp=lp)
# And now we can connect to the DB - the schema won't be loaded from the DB
samdb.connect(path)
+
+ # Load @OPTIONS
+ samdb.load_ldif_file_add(setup_path("provision_options.ldif"))
+
if fill == FILL_DRS:
return samdb
samdb.transaction_start()
try:
message("Erasing data from partitions")
- # Load the schema (again). This time it will force a reindex, to make the below computationally sane
+ # Load the schema (again). This time it will force a reindex,
+ # and will therefore make the erase_partitions() below
+ # computationally sane
samdb.set_schema_from_ldb(schema.ldb)
samdb.erase_partitions()
+ # Set the domain functionality levels onto the database.
+ # Various module (the password_hash module in particular) need
+ # to know what level of AD we are emulating.
+
+ # These will be fixed into the database via the database
+ # modifictions below, but we need them set from the start.
samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
samdb.set_opaque_integer("domainControllerFunctionality", domainControllerFunctionality)
else:
domain_oc = "samba4LocalDomain"
+#impersonate domain admin
+ admin_session_info = admin_session(lp, str(domainsid))
+ samdb.set_session_info(admin_session_info)
+
setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
"DOMAINDN": names.domaindn,
"DOMAIN_OC": domain_oc
"SCHEMADN": names.schemadn,
})
+ # The LDIF here was created when the Schema object was constructed
message("Setting up sam.ldb schema")
samdb.add_ldif(schema.schema_dn_add)
samdb.modify_ldif(schema.schema_dn_modify)
+ samdb.write_prefixes_from_schema()
samdb.add_ldif(schema.schema_data)
setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"),
{"SCHEMADN": names.schemadn})
})
message("Setting up display specifiers")
- setup_add_ldif(samdb, setup_path("display_specifiers.ldif"),
- {"CONFIGDN": names.configdn})
+ display_specifiers_ldif = read_ms_ldif(setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
+ display_specifiers_ldif = substitute_var(display_specifiers_ldif, {"CONFIGDN": names.configdn})
+ check_all_substituted(display_specifiers_ldif)
+ samdb.add_ldif(display_specifiers_ldif)
message("Adding users container")
setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
dnspass=dnspass,
machinepass=machinepass,
domainsid=domainsid, policyguid=policyguid,
- setup_path=setup_path, domainControllerFunctionality=domainControllerFunctionality)
+ setup_path=setup_path,
+ domainControllerFunctionality=domainControllerFunctionality)
except:
samdb.transaction_cancel()
def provision(setup_dir, message, session_info,
- credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None,
+ credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
+ realm=None,
rootdn=None, domaindn=None, schemadn=None, configdn=None,
serverdn=None,
domain=None, hostname=None, hostip=None, hostip6=None,
policyguid=None, invocationid=None, machinepass=None,
dnspass=None, root=None, nobody=None, users=None,
wheel=None, backup=None, aci=None, serverrole=None,
- ldap_backend_extra_port=None, ldap_backend_type=None, sitename=None,
+ ldap_backend_extra_port=None, ldap_backend_type=None,
+ sitename=None,
ol_mmr_urls=None, ol_olc=None,
setup_ds_path=None, slapd_path=None, nosync=False,
ldap_dryrun_mode=False):
ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
- schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn)
+ schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn,
+ sambadn=names.sambadn, ldap_backend_type=ldap_backend_type)
+ secrets_credentials = credentials
provision_backend = None
if ldap_backend_type:
# We only support an LDAP backend over ldapi://
- provision_backend = ProvisionBackend(paths=paths, setup_path=setup_path, lp=lp, credentials=credentials,
+ provision_backend = ProvisionBackend(paths=paths, setup_path=setup_path,
+ lp=lp, credentials=credentials,
names=names,
- message=message, hostname=hostname,
- root=root, schema=schema, ldap_backend_type=ldap_backend_type,
+ message=message, hostname=hostname,
+ root=root, schema=schema,
+ ldap_backend_type=ldap_backend_type,
ldapadminpass=ldapadminpass,
ldap_backend_extra_port=ldap_backend_extra_port,
ol_mmr_urls=ol_mmr_urls,
# Now use the backend credentials to access the databases
credentials = provision_backend.credentials
+ secrets_credentials = provision_backend.adminCredentials
+ ldapi_url = provision_backend.ldapi_uri
# only install a new shares config db if there is none
if not os.path.exists(paths.shareconf):
message("Setting up secrets.ldb")
secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
session_info=session_info,
- credentials=credentials, lp=lp)
+ credentials=secrets_credentials, lp=lp)
message("Setting up the registry")
setup_registry(paths.hklm, setup_path, session_info,
lp=lp)
- message("Setting up templates db")
- setup_templatesdb(paths.templates, setup_path, session_info=session_info,
- lp=lp)
-
message("Setting up idmap db")
idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
lp=lp)
if serverrole == "domain controller":
secrets_ldb = Ldb(paths.secrets, session_info=session_info,
credentials=credentials, lp=lp)
- secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
- netbiosname=names.netbiosname, domainsid=domainsid,
- keytab_path=paths.keytab, samdb_url=paths.samdb,
- dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
- machinepass=machinepass, dnsdomain=names.dnsdomain)
+ secretsdb_become_dc(secrets_ldb, setup_path, domain=domain,
+ realm=names.realm,
+ netbiosname=names.netbiosname,
+ domainsid=domainsid,
+ keytab_path=paths.keytab, samdb_url=paths.samdb,
+ dns_keytab_path=paths.dns_keytab,
+ dnspass=dnspass, machinepass=machinepass,
+ dnsdomain=names.dnsdomain)
domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
assert isinstance(domainguid, str)
message("See %s for an example configuration include file for BIND" % paths.namedconf)
message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
- create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
- hostname=names.hostname, realm=names.realm)
+ create_krb5_conf(paths.krb5conf, setup_path,
+ dnsdomain=names.dnsdomain, hostname=names.hostname,
+ realm=names.realm)
message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
- # if backend is openldap, terminate slapd after final provision and check its proper termination
- if provision_backend is not None and provision_backend.slapd is not None:
- if provision_backend.slapd.poll() is None:
- #Kill the slapd
- if hasattr(provision_backend.slapd, "terminate"):
- provision_backend.slapd.terminate()
- else:
- import signal
- os.kill(provision_backend.slapd.pid, signal.SIGTERM)
+ if provision_backend is not None:
+ if ldap_backend_type == "fedora-ds":
+ ldapi_db = Ldb(provision_backend.ldapi_uri, lp=lp, credentials=credentials)
+
+ # delete default SASL mappings
+ res = ldapi_db.search(expression="(!(cn=samba-admin mapping))", base="cn=mapping,cn=sasl,cn=config", scope=SCOPE_ONELEVEL, attrs=["dn"])
+
+ # configure in-directory access control on Fedora DS via the aci attribute (over a direct ldapi:// socket)
+ for i in range (0, len(res)):
+ dn = str(res[i]["dn"])
+ ldapi_db.delete(dn)
+
+ aci = """(targetattr = "*") (version 3.0;acl "full access to all by samba-admin";allow (all)(userdn = "ldap:///CN=samba-admin,%s");)""" % names.sambadn
+
+ m = ldb.Message()
+ m["aci"] = ldb.MessageElement([aci], ldb.FLAG_MOD_REPLACE, "aci")
+
+ m.dn = ldb.Dn(1, names.domaindn)
+ ldapi_db.modify(m)
+
+ m.dn = ldb.Dn(1, names.configdn)
+ ldapi_db.modify(m)
+
+ m.dn = ldb.Dn(1, names.schemadn)
+ ldapi_db.modify(m)
+
+ # if an LDAP backend is in use, terminate slapd after final provision and check its proper termination
+ if provision_backend.slapd.poll() is None:
+ #Kill the slapd
+ if hasattr(provision_backend.slapd, "terminate"):
+ provision_backend.slapd.terminate()
+ else:
+ # Older python versions don't have .terminate()
+ import signal
+ os.kill(provision_backend.slapd.pid, signal.SIGTERM)
- #and now wait for it to die
- provision_backend.slapd.communicate()
+ #and now wait for it to die
+ provision_backend.slapd.communicate()
# now display slapd_command_file.txt to show how slapd must be started next time
message("Use later the following commandline to start slapd, then Samba:")
def provision_become_dc(setup_dir=None,
smbconf=None, targetdir=None, realm=None,
- rootdn=None, domaindn=None, schemadn=None, configdn=None,
- serverdn=None,
+ rootdn=None, domaindn=None, schemadn=None,
+ configdn=None, serverdn=None,
domain=None, hostname=None, domainsid=None,
adminpass=None, krbtgtpass=None, domainguid=None,
policyguid=None, invocationid=None, machinepass=None,
dnspass=None, root=None, nobody=None, users=None,
wheel=None, backup=None, serverrole=None,
- ldap_backend=None, ldap_backend_type=None, sitename=None):
+ ldap_backend=None, ldap_backend_type=None,
+ sitename=None, debuglevel=1):
def message(text):
"""print a message if quiet is not set."""
print text
+ glue.set_debug_level(debuglevel)
+
return provision(setup_dir, message, system_session(), None,
- smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
- rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
- domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename)
-
+ smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
+ realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
+ configdn=configdn, serverdn=serverdn, domain=domain,
+ hostname=hostname, hostip="127.0.0.1", domainsid=domainsid,
+ machinepass=machinepass, serverrole="domain controller",
+ sitename=sitename)
+
def setup_db_config(setup_path, dbdir):
"""Setup a Berkeley database.
except:
pass
- raise("Warning: Another slapd Instance seems already running on this host, listening to " + ldapi_uri + ". Please shut it down before you continue. ")
+ raise ProvisioningError("Warning: Another slapd Instance seems already running on this host, listening to " + self.ldapi_uri + ". Please shut it down before you continue. ")
except LdbError, e:
pass
# Try to print helpful messages when the user has not specified the path to slapd
if slapd_path is None:
- raise("Warning: LDAP-Backend must be setup with path to slapd, e.g. --slapd-path=\"/usr/local/libexec/slapd\"!")
+ raise ProvisioningError("Warning: LDAP-Backend must be setup with path to slapd, e.g. --slapd-path=\"/usr/local/libexec/slapd\"!")
if not os.path.exists(slapd_path):
message (slapd_path)
- raise("Warning: Given Path to slapd does not exist!")
+ raise ProvisioningError("Warning: Given Path to slapd does not exist!")
schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
try:
self.credentials.guess(lp)
#Kerberos to an ldapi:// backend makes no sense
self.credentials.set_kerberos_state(DONT_USE_KERBEROS)
+
+ self.adminCredentials = Credentials()
+ self.adminCredentials.guess(lp)
+ #Kerberos to an ldapi:// backend makes no sense
+ self.adminCredentials.set_kerberos_state(DONT_USE_KERBEROS)
+
self.ldap_backend_type = ldap_backend_type
if ldap_backend_type == "fedora-ds":
- provision_fds_backend(self, paths=paths, setup_path=setup_path, names=names, message=message,
- hostname=hostname, ldapadminpass=ldapadminpass, root=root,
- schema=schema, ldap_backend_extra_port=ldap_backend_extra_port,
- setup_ds_path=setup_ds_path, slapd_path=slapd_path,
- nosync=nosync, ldap_dryrun_mode=ldap_dryrun_mode)
+ provision_fds_backend(self, paths=paths, setup_path=setup_path,
+ names=names, message=message,
+ hostname=hostname,
+ ldapadminpass=ldapadminpass, root=root,
+ schema=schema,
+ ldap_backend_extra_port=ldap_backend_extra_port,
+ setup_ds_path=setup_ds_path,
+ slapd_path=slapd_path,
+ nosync=nosync,
+ ldap_dryrun_mode=ldap_dryrun_mode)
elif ldap_backend_type == "openldap":
- provision_openldap_backend(self, paths=paths, setup_path=setup_path, names=names, message=message,
- hostname=hostname, ldapadminpass=ldapadminpass, root=root,
- schema=schema, ldap_backend_extra_port=ldap_backend_extra_port,
+ provision_openldap_backend(self, paths=paths, setup_path=setup_path,
+ names=names, message=message,
+ hostname=hostname,
+ ldapadminpass=ldapadminpass, root=root,
+ schema=schema,
+ ldap_backend_extra_port=ldap_backend_extra_port,
ol_mmr_urls=ol_mmr_urls,
slapd_path=slapd_path,
- nosync=nosync, ldap_dryrun_mode=ldap_dryrun_mode)
+ nosync=nosync,
+ ldap_dryrun_mode=ldap_dryrun_mode)
else:
- raise("Unknown LDAP backend type selected")
+ raise ProvisioningError("Unknown LDAP backend type selected")
self.credentials.set_password(ldapadminpass)
+ self.adminCredentials.set_username("samba-admin")
+ self.adminCredentials.set_password(ldapadminpass)
# Now start the slapd, so we can provision onto it. We keep the
# subprocess context around, to kill this off at the successful
time.sleep(1)
pass
- raise "slapd died before we could make a connection to it"
+ raise ProvisioningError("slapd died before we could make a connection to it")
-def provision_openldap_backend(result, paths=None, setup_path=None, names=None, message=None,
+def provision_openldap_backend(result, paths=None, setup_path=None, names=None,
+ message=None,
hostname=None, ldapadminpass=None, root=None,
schema=None,
ldap_backend_extra_port=None,
if nosync:
nosync_config = "dbnosync"
-
- attrs = ["linkID", "lDAPDisplayName"]
- res = schema.ldb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=names.schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
-
- memberof_config = "# Generated from Samba4 schema\n"
+ lnkattr = get_linked_attributes(names.schemadn,schema.ldb)
refint_attributes = ""
- for i in range (0, len(res)):
- expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
- target = schema.ldb.searchone(basedn=names.schemadn,
- expression=expression,
- attribute="lDAPDisplayName",
- scope=SCOPE_SUBTREE)
- if target is not None:
- refint_attributes = refint_attributes + " " + res[i]["lDAPDisplayName"][0]
+ memberof_config = "# Generated from Samba4 schema\n"
+ for att in lnkattr.keys():
+ if lnkattr[att] is not None:
+ refint_attributes = refint_attributes + " " + att
memberof_config += read_and_sub_file(setup_path("memberof.conf"),
- { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
- "MEMBEROF_ATTR" : str(target) })
+ { "MEMBER_ATTR" : att ,
+ "MEMBEROF_ATTR" : lnkattr[att] })
refint_config = read_and_sub_file(setup_path("refint.conf"),
{ "LINK_ATTRS" : refint_attributes})
+ attrs = ["linkID", "lDAPDisplayName"]
res = schema.ldb.search(expression="(&(objectclass=attributeSchema)(searchFlags:1.2.840.113556.1.4.803:=1))", base=names.schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
index_config = ""
for i in range (0, len(res)):
# output to the above, but does the conversion sucessfully...
#
# if retcode != 0:
-# raise("conversion from slapd.conf to cn=config failed")
+# raise ProvisioningError("conversion from slapd.conf to cn=config failed")
if not os.path.exists(os.path.join(paths.olcdir, "cn=config.ldif")):
- raise("conversion from slapd.conf to cn=config failed")
+ raise ProvisioningError("conversion from slapd.conf to cn=config failed")
# Don't confuse the admin by leaving the slapd.conf around
os.remove(paths.slapdconf)
-def provision_fds_backend(result, paths=None, setup_path=None, names=None, message=None,
+def provision_fds_backend(result, paths=None, setup_path=None, names=None,
+ message=None,
hostname=None, ldapadminpass=None, root=None,
schema=None,
ldap_backend_extra_port=None,
setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions,
{"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
+ "SAMBADN": names.sambadn,
+ })
+
+ setup_file(setup_path("fedorads-sasl.ldif"), paths.fedoradssasl,
+ {"SAMBADN": names.sambadn,
+ })
+
+ setup_file(setup_path("fedorads-samba.ldif"), paths.fedoradssamba,
+ {"SAMBADN": names.sambadn,
+ "LDAPADMINPASS": ldapadminpass
})
mapping = "schema-map-fedora-ds-1.0"
# Try to print helpful messages when the user has not specified the path to the setup-ds tool
if setup_ds_path is None:
- raise("Warning: Fedora DS LDAP-Backend must be setup with path to setup-ds, e.g. --setup-ds-path=\"/usr/sbin/setup-ds.pl\"!")
+ raise ProvisioningError("Warning: Fedora DS LDAP-Backend must be setup with path to setup-ds, e.g. --setup-ds-path=\"/usr/sbin/setup-ds.pl\"!")
if not os.path.exists(setup_ds_path):
message (setup_ds_path)
- raise("Warning: Given Path to slapd does not exist!")
+ raise ProvisioningError("Warning: Given Path to slapd does not exist!")
# Run the Fedora DS setup utility
retcode = subprocess.call([setup_ds_path, "--silent", "--file", paths.fedoradsinf], close_fds=True, shell=False)
if retcode != 0:
- raise("setup-ds failed")
+ raise ProvisioningError("setup-ds failed")
+
+ # Load samba-admin
+ retcode = subprocess.call([
+ os.path.join(paths.ldapdir, "slapd-samba4", "ldif2db"), "-s", names.sambadn, "-i", paths.fedoradssamba],
+ close_fds=True, shell=False)
+ if retcode != 0:
+ raise("ldib2db failed")
def create_phpldapadmin_config(path, setup_path, ldapi_uri):
"""Create a PHP LDAP admin configuration file.
def create_zone_file(path, setup_path, dnsdomain, domaindn,
- hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+ hostip, hostip6, hostname, dnspass, realm, domainguid,
+ hostguid):
"""Write out a DNS zone file, from the info in the current database.
:param path: Path of the new zone file.
})
-
-
-
git.samba.org / ira / wip.git / blobdiff