Catch specific exceptions, rather than catching everything, which might hide other...
[kai/samba-autobuild/.git] / source4 / scripting / python / samba / provision.py
1 #
2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
7 #
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
10 #
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
15 #   
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19 # GNU General Public License for more details.
20 #   
21 # You should have received a copy of the GNU General Public License
22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 #
24
25 """Functions for setting up a Samba configuration."""
26
27 from base64 import b64encode
28 import os
29 import pwd
30 import grp
31 import time
32 import uuid, glue
33 import socket
34 import param
35 import registry
36 import samba
37 from auth import system_session
38 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
39 from samba.samdb import SamDB
40 from samba.idmap import IDmapDB
41 from samba.dcerpc import security
42 import urllib
43 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
44         timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
45
46 __docformat__ = "restructuredText"
47
48
49 def find_setup_dir():
50     """Find the setup directory used by provision."""
51     dirname = os.path.dirname(__file__)
52     if "/site-packages/" in dirname:
53         prefix = dirname[:dirname.index("/site-packages/")]
54         for suffix in ["share/setup", "share/samba/setup", "setup"]:
55             ret = os.path.join(prefix, suffix)
56             if os.path.isdir(ret):
57                 return ret
58     # In source tree
59     ret = os.path.join(dirname, "../../../setup")
60     if os.path.isdir(ret):
61         return ret
62     raise Exception("Unable to find setup directory.")
63
64
65 DEFAULTSITE = "Default-First-Site-Name"
66
67 class InvalidNetbiosName(Exception):
68     """A specified name was not a valid NetBIOS name."""
69     def __init__(self, name):
70         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
71
72
73 class ProvisionPaths(object):
74     def __init__(self):
75         self.shareconf = None
76         self.hklm = None
77         self.hkcu = None
78         self.hkcr = None
79         self.hku = None
80         self.hkpd = None
81         self.hkpt = None
82         self.samdb = None
83         self.idmapdb = None
84         self.secrets = None
85         self.keytab = None
86         self.dns_keytab = None
87         self.dns = None
88         self.winsdb = None
89         self.private_dir = None
90         self.ldapdir = None
91         self.slapdconf = None
92         self.modulesconf = None
93         self.memberofconf = None
94         self.fedoradsinf = None
95         self.fedoradspartitions = None
96         self.olmmron = None
97         self.olmmrserveridsconf = None
98         self.olmmrsyncreplconf = None
99
100
101 class ProvisionNames(object):
102     def __init__(self):
103         self.rootdn = None
104         self.domaindn = None
105         self.configdn = None
106         self.schemadn = None
107         self.ldapmanagerdn = None
108         self.dnsdomain = None
109         self.realm = None
110         self.netbiosname = None
111         self.domain = None
112         self.hostname = None
113         self.sitename = None
114         self.smbconf = None
115     
116
117 class ProvisionResult(object):
118     def __init__(self):
119         self.paths = None
120         self.domaindn = None
121         self.lp = None
122         self.samdb = None
123
124 def check_install(lp, session_info, credentials):
125     """Check whether the current install seems ok.
126     
127     :param lp: Loadparm context
128     :param session_info: Session information
129     :param credentials: Credentials
130     """
131     if lp.get("realm") == "":
132         raise Exception("Realm empty")
133     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
134             credentials=credentials, lp=lp)
135     if len(ldb.search("(cn=Administrator)")) != 1:
136         raise "No administrator account found"
137
138
139 def findnss(nssfn, names):
140     """Find a user or group from a list of possibilities.
141     
142     :param nssfn: NSS Function to try (should raise KeyError if not found)
143     :param names: Names to check.
144     :return: Value return by first names list.
145     """
146     for name in names:
147         try:
148             return nssfn(name)
149         except KeyError:
150             pass
151     raise KeyError("Unable to find user/group %r" % names)
152
153
154 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
155 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
156
157
158 def read_and_sub_file(file, subst_vars):
159     """Read a file and sub in variables found in it
160     
161     :param file: File to be read (typically from setup directory)
162      param subst_vars: Optional variables to subsitute in the file.
163     """
164     data = open(file, 'r').read()
165     if subst_vars is not None:
166         data = substitute_var(data, subst_vars)
167     check_all_substituted(data)
168     return data
169
170
171 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
172     """Setup a ldb in the private dir.
173     
174     :param ldb: LDB file to import data into
175     :param ldif_path: Path of the LDIF file to load
176     :param subst_vars: Optional variables to subsitute in LDIF.
177     """
178     assert isinstance(ldif_path, str)
179
180     data = read_and_sub_file(ldif_path, subst_vars)
181     ldb.add_ldif(data)
182
183
184 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
185     """Modify a ldb in the private dir.
186     
187     :param ldb: LDB object.
188     :param ldif_path: LDIF file path.
189     :param subst_vars: Optional dictionary with substitution variables.
190     """
191     data = read_and_sub_file(ldif_path, subst_vars)
192
193     ldb.modify_ldif(data)
194
195
196 def setup_ldb(ldb, ldif_path, subst_vars):
197     """Import a LDIF a file into a LDB handle, optionally substituting variables.
198
199     :note: Either all LDIF data will be added or none (using transactions).
200
201     :param ldb: LDB file to import into.
202     :param ldif_path: Path to the LDIF file.
203     :param subst_vars: Dictionary with substitution variables.
204     """
205     assert ldb is not None
206     ldb.transaction_start()
207     try:
208         setup_add_ldif(ldb, ldif_path, subst_vars)
209     except:
210         ldb.transaction_cancel()
211         raise
212     ldb.transaction_commit()
213
214
215 def setup_file(template, fname, subst_vars):
216     """Setup a file in the private dir.
217
218     :param template: Path of the template file.
219     :param fname: Path of the file to create.
220     :param subst_vars: Substitution variables.
221     """
222     f = fname
223
224     if os.path.exists(f):
225         os.unlink(f)
226
227     data = read_and_sub_file(template, subst_vars)
228     open(f, 'w').write(data)
229
230
231 def provision_paths_from_lp(lp, dnsdomain):
232     """Set the default paths for provisioning.
233
234     :param lp: Loadparm context.
235     :param dnsdomain: DNS Domain name
236     """
237     paths = ProvisionPaths()
238     paths.private_dir = lp.get("private dir")
239     paths.keytab = "secrets.keytab"
240     paths.dns_keytab = "dns.keytab"
241
242     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
243     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
244     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
245     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
246     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
247     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
248     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
249     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
250     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
251     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
252     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
253     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
254                                             "phpldapadmin-config.php")
255     paths.ldapdir = os.path.join(paths.private_dir, 
256                                  "ldap")
257     paths.slapdconf = os.path.join(paths.ldapdir, 
258                                    "slapd.conf")
259     paths.modulesconf = os.path.join(paths.ldapdir, 
260                                      "modules.conf")
261     paths.memberofconf = os.path.join(paths.ldapdir, 
262                                       "memberof.conf")
263     paths.fedoradsinf = os.path.join(paths.ldapdir, 
264                                      "fedorads.inf")
265     paths.fedoradspartitions = os.path.join(paths.ldapdir, 
266                                             "fedorads-partitions.ldif")
267     paths.olmmrserveridsconf = os.path.join(paths.ldapdir, 
268                                             "mmr_serverids.conf")
269     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir, 
270                                            "mmr_syncrepl.conf")
271     paths.hklm = "hklm.ldb"
272     paths.hkcr = "hkcr.ldb"
273     paths.hkcu = "hkcu.ldb"
274     paths.hku = "hku.ldb"
275     paths.hkpd = "hkpd.ldb"
276     paths.hkpt = "hkpt.ldb"
277
278     paths.sysvol = lp.get("path", "sysvol")
279
280     paths.netlogon = lp.get("path", "netlogon")
281
282     paths.smbconf = lp.configfile
283
284     return paths
285
286
287 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
288                 rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None, 
289                 sitename=None):
290     """Guess configuration settings to use."""
291
292     if hostname is None:
293         hostname = socket.gethostname().split(".")[0].lower()
294
295     netbiosname = hostname.upper()
296     if not valid_netbios_name(netbiosname):
297         raise InvalidNetbiosName(netbiosname)
298
299     hostname = hostname.lower()
300
301     if dnsdomain is None:
302         dnsdomain = lp.get("realm")
303
304     if serverrole is None:
305         serverrole = lp.get("server role")
306
307     assert dnsdomain is not None
308     realm = dnsdomain.upper()
309
310     if lp.get("realm").upper() != realm:
311         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
312                         (lp.get("realm"), lp.configfile, realm))
313     
314     dnsdomain = dnsdomain.lower()
315
316     if serverrole == "domain controller":
317         if domain is None:
318             domain = lp.get("workgroup")
319         if domaindn is None:
320             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
321         if lp.get("workgroup").upper() != domain.upper():
322             raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
323                         lp.get("workgroup"), domain)
324     else:
325         domain = netbiosname
326         if domaindn is None:
327             domaindn = "CN=" + netbiosname
328         
329     assert domain is not None
330     domain = domain.upper()
331     if not valid_netbios_name(domain):
332         raise InvalidNetbiosName(domain)
333         
334     if rootdn is None:
335        rootdn = domaindn
336        
337     if configdn is None:
338         configdn = "CN=Configuration," + rootdn
339     if schemadn is None:
340         schemadn = "CN=Schema," + configdn
341
342     if sitename is None:
343         sitename=DEFAULTSITE
344
345     names = ProvisionNames()
346     names.rootdn = rootdn
347     names.domaindn = domaindn
348     names.configdn = configdn
349     names.schemadn = schemadn
350     names.ldapmanagerdn = "CN=Manager," + rootdn
351     names.dnsdomain = dnsdomain
352     names.domain = domain
353     names.realm = realm
354     names.netbiosname = netbiosname
355     names.hostname = hostname
356     names.sitename = sitename
357     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
358  
359     return names
360     
361
362 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
363                  targetdir):
364     """Create a new smb.conf file based on a couple of basic settings.
365     """
366     assert smbconf is not None
367     if hostname is None:
368         hostname = socket.gethostname().split(".")[0].lower()
369
370     if serverrole is None:
371         serverrole = "standalone"
372
373     assert serverrole in ("domain controller", "member server", "standalone")
374     if serverrole == "domain controller":
375         smbconfsuffix = "dc"
376     elif serverrole == "member server":
377         smbconfsuffix = "member"
378     elif serverrole == "standalone":
379         smbconfsuffix = "standalone"
380
381     assert domain is not None
382     assert realm is not None
383
384     default_lp = param.LoadParm()
385     #Load non-existant file
386     if os.path.exists(smbconf):
387         default_lp.load(smbconf)
388     
389     if targetdir is not None:
390         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
391         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
392
393         default_lp.set("lock dir", os.path.abspath(targetdir))
394     else:
395         privatedir_line = ""
396         lockdir_line = ""
397
398     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
399     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
400
401     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
402                smbconf, {
403             "HOSTNAME": hostname,
404             "DOMAIN": domain,
405             "REALM": realm,
406             "SERVERROLE": serverrole,
407             "NETLOGONPATH": netlogon,
408             "SYSVOLPATH": sysvol,
409             "PRIVATEDIR_LINE": privatedir_line,
410             "LOCKDIR_LINE": lockdir_line
411             })
412
413
414 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
415                         users_gid, wheel_gid):
416     """setup reasonable name mappings for sam names to unix names.
417
418     :param samdb: SamDB object.
419     :param idmap: IDmap db object.
420     :param sid: The domain sid.
421     :param domaindn: The domain DN.
422     :param root_uid: uid of the UNIX root user.
423     :param nobody_uid: uid of the UNIX nobody user.
424     :param users_gid: gid of the UNIX users group.
425     :param wheel_gid: gid of the UNIX wheel group."""
426     # add some foreign sids if they are not present already
427     samdb.add_stock_foreign_sids()
428
429     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
430     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
431
432     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
433     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
434
435
436 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
437                            credentials, names,
438                            serverrole, ldap_backend=None, 
439                            ldap_backend_type=None, erase=False):
440     """Setup the partitions for the SAM database. 
441     
442     Alternatively, provision() may call this, and then populate the database.
443     
444     :note: This will wipe the Sam Database!
445     
446     :note: This function always removes the local SAM LDB file. The erase 
447         parameter controls whether to erase the existing data, which 
448         may not be stored locally but in LDAP.
449     """
450     assert session_info is not None
451
452     try:
453         samdb = SamDB(samdb_path, session_info=session_info, 
454                       credentials=credentials, lp=lp)
455         # Wipes the database
456         samdb.erase()
457     except LdbError:
458         os.unlink(samdb_path)
459         samdb = SamDB(samdb_path, session_info=session_info, 
460                       credentials=credentials, lp=lp)
461          # Wipes the database
462         samdb.erase()
463         
464
465     #Add modules to the list to activate them by default
466     #beware often order is important
467     #
468     # Some Known ordering constraints:
469     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
470     # - objectclass must be before password_hash, because password_hash checks
471     #   that the objectclass is of type person (filled in by objectclass
472     #   module when expanding the objectclass list)
473     # - partition must be last
474     # - each partition has its own module list then
475     modules_list = ["rootdse",
476                     "paged_results",
477                     "ranged_results",
478                     "anr",
479                     "server_sort",
480                     "asq",
481                     "extended_dn_store",
482                     "extended_dn_in",
483                     "rdn_name",
484                     "objectclass",
485                     "samldb",
486                     "kludge_acl",
487                     "password_hash",
488                     "operational"]
489     tdb_modules_list = [
490                     "subtree_rename",
491                     "subtree_delete",
492                     "linked_attributes",
493                     "extended_dn_out_ldb"]
494     modules_list2 = ["show_deleted",
495                     "partition"]
496  
497     domaindn_ldb = "users.ldb"
498     if ldap_backend is not None:
499         domaindn_ldb = ldap_backend
500     configdn_ldb = "configuration.ldb"
501     if ldap_backend is not None:
502         configdn_ldb = ldap_backend
503     schemadn_ldb = "schema.ldb"
504     if ldap_backend is not None:
505         schema_ldb = ldap_backend
506         schemadn_ldb = ldap_backend
507         
508     if ldap_backend_type == "fedora-ds":
509         backend_modules = ["nsuniqueid", "paged_searches"]
510         # We can handle linked attributes here, as we don't have directory-side subtree operations
511         tdb_modules_list = ["linked_attributes", "extended_dn_out_dereference"]
512     elif ldap_backend_type == "openldap":
513         backend_modules = ["entryuuid", "paged_searches"]
514         # OpenLDAP handles subtree renames, so we don't want to do any of these things
515         tdb_modules_list = ["extended_dn_out_dereference"]
516     elif ldap_backend is not None:
517         raise "LDAP Backend specified, but LDAP Backend Type not specified"
518     elif serverrole == "domain controller":
519         backend_modules = ["repl_meta_data"]
520     else:
521         backend_modules = ["objectguid"]
522
523     if tdb_modules_list is None:
524         tdb_modules_list_as_string = ""
525     else:
526         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
527         
528     samdb.transaction_start()
529     try:
530         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
531                 "SCHEMADN": names.schemadn, 
532                 "SCHEMADN_LDB": schemadn_ldb,
533                 "SCHEMADN_MOD2": ",objectguid",
534                 "CONFIGDN": names.configdn,
535                 "CONFIGDN_LDB": configdn_ldb,
536                 "DOMAINDN": names.domaindn,
537                 "DOMAINDN_LDB": domaindn_ldb,
538                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
539                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
540                 "DOMAINDN_MOD": "pdc_fsmo,instancetype",
541                 "MODULES_LIST": ",".join(modules_list),
542                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
543                 "MODULES_LIST2": ",".join(modules_list2),
544                 "BACKEND_MOD": ",".join(backend_modules),
545         })
546
547     except:
548         samdb.transaction_cancel()
549         raise
550
551     samdb.transaction_commit()
552     
553     samdb = SamDB(samdb_path, session_info=session_info, 
554                   credentials=credentials, lp=lp)
555
556     samdb.transaction_start()
557     try:
558         message("Setting up sam.ldb attributes")
559         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
560
561         message("Setting up sam.ldb rootDSE")
562         setup_samdb_rootdse(samdb, setup_path, names)
563
564         if erase:
565             message("Erasing data from partitions")
566             samdb.erase_partitions()
567
568     except:
569         samdb.transaction_cancel()
570         raise
571
572     samdb.transaction_commit()
573     
574     return samdb
575
576
577 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
578                         netbiosname, domainsid, keytab_path, samdb_url, 
579                         dns_keytab_path, dnspass, machinepass):
580     """Add DC-specific bits to a secrets database.
581     
582     :param secretsdb: Ldb Handle to the secrets database
583     :param setup_path: Setup path function
584     :param machinepass: Machine password
585     """
586     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
587             "MACHINEPASS_B64": b64encode(machinepass),
588             "DOMAIN": domain,
589             "REALM": realm,
590             "DNSDOMAIN": dnsdomain,
591             "DOMAINSID": str(domainsid),
592             "SECRETS_KEYTAB": keytab_path,
593             "NETBIOSNAME": netbiosname,
594             "SAM_LDB": samdb_url,
595             "DNS_KEYTAB": dns_keytab_path,
596             "DNSPASS_B64": b64encode(dnspass),
597             })
598
599
600 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
601     """Setup the secrets database.
602
603     :param path: Path to the secrets database.
604     :param setup_path: Get the path to a setup file.
605     :param session_info: Session info.
606     :param credentials: Credentials
607     :param lp: Loadparm context
608     :return: LDB handle for the created secrets database
609     """
610     if os.path.exists(path):
611         os.unlink(path)
612     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
613                       lp=lp)
614     secrets_ldb.erase()
615     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
616     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
617                       lp=lp)
618     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
619
620     if credentials is not None and credentials.authentication_requested():
621         if credentials.get_bind_dn() is not None:
622             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
623                     "LDAPMANAGERDN": credentials.get_bind_dn(),
624                     "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
625                     })
626         else:
627             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
628                     "LDAPADMINUSER": credentials.get_username(),
629                     "LDAPADMINREALM": credentials.get_realm(),
630                     "LDAPADMINPASS_B64": b64encode(credentials.get_password())
631                     })
632
633     return secrets_ldb
634
635
636 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
637     """Setup the templates database.
638
639     :param path: Path to the database.
640     :param setup_path: Function for obtaining the path to setup files.
641     :param session_info: Session info
642     :param credentials: Credentials
643     :param lp: Loadparm context
644     """
645     templates_ldb = SamDB(path, session_info=session_info,
646                           credentials=credentials, lp=lp)
647     # Wipes the database
648     try:
649         templates_ldb.erase()
650     except LdbError:
651         os.unlink(path)
652
653     templates_ldb.load_ldif_file_add(setup_path("provision_templates_init.ldif"))
654
655     templates_ldb = SamDB(path, session_info=session_info,
656                           credentials=credentials, lp=lp)
657
658     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
659
660
661 def setup_registry(path, setup_path, session_info, credentials, lp):
662     """Setup the registry.
663     
664     :param path: Path to the registry database
665     :param setup_path: Function that returns the path to a setup.
666     :param session_info: Session information
667     :param credentials: Credentials
668     :param lp: Loadparm context
669     """
670     reg = registry.Registry()
671     hive = registry.open_ldb(path, session_info=session_info, 
672                          credentials=credentials, lp_ctx=lp)
673     reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
674     provision_reg = setup_path("provision.reg")
675     assert os.path.exists(provision_reg)
676     reg.diff_apply(provision_reg)
677
678
679 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
680     """Setup the idmap database.
681
682     :param path: path to the idmap database
683     :param setup_path: Function that returns a path to a setup file
684     :param session_info: Session information
685     :param credentials: Credentials
686     :param lp: Loadparm context
687     """
688     if os.path.exists(path):
689         os.unlink(path)
690
691     idmap_ldb = IDmapDB(path, session_info=session_info,
692                         credentials=credentials, lp=lp)
693
694     idmap_ldb.erase()
695     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
696     return idmap_ldb
697
698
699 def setup_samdb_rootdse(samdb, setup_path, names):
700     """Setup the SamDB rootdse.
701
702     :param samdb: Sam Database handle
703     :param setup_path: Obtain setup path
704     """
705     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
706         "SCHEMADN": names.schemadn, 
707         "NETBIOSNAME": names.netbiosname,
708         "DNSDOMAIN": names.dnsdomain,
709         "REALM": names.realm,
710         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
711         "DOMAINDN": names.domaindn,
712         "ROOTDN": names.rootdn,
713         "CONFIGDN": names.configdn,
714         "SERVERDN": names.serverdn,
715         })
716         
717
718 def setup_self_join(samdb, names,
719                     machinepass, dnspass, 
720                     domainsid, invocationid, setup_path,
721                     policyguid):
722     """Join a host to its own domain."""
723     assert isinstance(invocationid, str)
724     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
725               "CONFIGDN": names.configdn, 
726               "SCHEMADN": names.schemadn,
727               "DOMAINDN": names.domaindn,
728               "SERVERDN": names.serverdn,
729               "INVOCATIONID": invocationid,
730               "NETBIOSNAME": names.netbiosname,
731               "DEFAULTSITE": names.sitename,
732               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
733               "MACHINEPASS_B64": b64encode(machinepass),
734               "DNSPASS_B64": b64encode(dnspass),
735               "REALM": names.realm,
736               "DOMAIN": names.domain,
737               "DNSDOMAIN": names.dnsdomain})
738     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
739               "POLICYGUID": policyguid,
740               "DNSDOMAIN": names.dnsdomain,
741               "DOMAINSID": str(domainsid),
742               "DOMAINDN": names.domaindn})
743
744
745 def setup_samdb(path, setup_path, session_info, credentials, lp, 
746                 names, message, 
747                 domainsid, aci, domainguid, policyguid, 
748                 fill, adminpass, krbtgtpass, 
749                 machinepass, invocationid, dnspass,
750                 serverrole, ldap_backend=None, 
751                 ldap_backend_type=None):
752     """Setup a complete SAM Database.
753     
754     :note: This will wipe the main SAM database file!
755     """
756
757     erase = (fill != FILL_DRS)
758
759     # Also wipes the database
760     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
761                            credentials=credentials, session_info=session_info,
762                            names=names, 
763                            ldap_backend=ldap_backend, serverrole=serverrole,
764                            ldap_backend_type=ldap_backend_type, erase=erase)
765
766     samdb = SamDB(path, session_info=session_info, 
767                   credentials=credentials, lp=lp)
768     if fill == FILL_DRS:
769         return samdb
770
771     message("Pre-loading the Samba 4 and AD schema")
772     samdb.set_domain_sid(str(domainsid))
773     if serverrole == "domain controller":
774         samdb.set_invocation_id(invocationid)
775
776     load_schema(setup_path, samdb, names.schemadn, names.netbiosname, 
777                 names.configdn, names.sitename, names.serverdn,
778                 names.hostname)
779
780     samdb.transaction_start()
781         
782     try:
783         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
784         if serverrole == "domain controller":
785             domain_oc = "domainDNS"
786         else:
787             domain_oc = "samba4LocalDomain"
788
789         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
790                 "DOMAINDN": names.domaindn,
791                 "ACI": aci,
792                 "DOMAIN_OC": domain_oc
793                 })
794
795         message("Modifying DomainDN: " + names.domaindn + "")
796         if domainguid is not None:
797             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
798         else:
799             domainguid_mod = ""
800
801         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
802             "LDAPTIME": timestring(int(time.time())),
803             "DOMAINSID": str(domainsid),
804             "SCHEMADN": names.schemadn, 
805             "NETBIOSNAME": names.netbiosname,
806             "DEFAULTSITE": names.sitename,
807             "CONFIGDN": names.configdn,
808             "SERVERDN": names.serverdn,
809             "POLICYGUID": policyguid,
810             "DOMAINDN": names.domaindn,
811             "DOMAINGUID_MOD": domainguid_mod,
812             })
813
814         message("Adding configuration container (permitted to fail)")
815         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
816             "CONFIGDN": names.configdn, 
817             "ACI": aci,
818             })
819         message("Modifying configuration container")
820         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
821             "CONFIGDN": names.configdn, 
822             "SCHEMADN": names.schemadn,
823             })
824
825         message("Adding schema container (permitted to fail)")
826         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
827             "SCHEMADN": names.schemadn,
828             "ACI": aci,
829             })
830         message("Modifying schema container")
831
832         prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
833
834         setup_modify_ldif(samdb, 
835             setup_path("provision_schema_basedn_modify.ldif"), {
836             "SCHEMADN": names.schemadn,
837             "NETBIOSNAME": names.netbiosname,
838             "DEFAULTSITE": names.sitename,
839             "CONFIGDN": names.configdn,
840             "SERVERDN": names.serverdn,
841             "PREFIXMAP_B64": b64encode(prefixmap)
842             })
843
844         message("Setting up sam.ldb Samba4 schema")
845         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
846                        {"SCHEMADN": names.schemadn })
847         message("Setting up sam.ldb AD schema")
848         setup_add_ldif(samdb, setup_path("schema.ldif"), 
849                        {"SCHEMADN": names.schemadn})
850         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"), 
851                        {"SCHEMADN": names.schemadn})
852
853         message("Setting up sam.ldb configuration data")
854         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
855             "CONFIGDN": names.configdn,
856             "NETBIOSNAME": names.netbiosname,
857             "DEFAULTSITE": names.sitename,
858             "DNSDOMAIN": names.dnsdomain,
859             "DOMAIN": names.domain,
860             "SCHEMADN": names.schemadn,
861             "DOMAINDN": names.domaindn,
862             "SERVERDN": names.serverdn
863             })
864
865         message("Setting up display specifiers")
866         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
867                        {"CONFIGDN": names.configdn})
868
869         message("Adding users container (permitted to fail)")
870         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
871                 "DOMAINDN": names.domaindn})
872         message("Modifying users container")
873         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
874                 "DOMAINDN": names.domaindn})
875         message("Adding computers container (permitted to fail)")
876         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
877                 "DOMAINDN": names.domaindn})
878         message("Modifying computers container")
879         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
880                 "DOMAINDN": names.domaindn})
881         message("Setting up sam.ldb data")
882         setup_add_ldif(samdb, setup_path("provision.ldif"), {
883             "DOMAINDN": names.domaindn,
884             "NETBIOSNAME": names.netbiosname,
885             "DEFAULTSITE": names.sitename,
886             "CONFIGDN": names.configdn,
887             "SERVERDN": names.serverdn
888             })
889
890         if fill == FILL_FULL:
891             message("Setting up sam.ldb users and groups")
892             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
893                 "DOMAINDN": names.domaindn,
894                 "DOMAINSID": str(domainsid),
895                 "CONFIGDN": names.configdn,
896                 "ADMINPASS_B64": b64encode(adminpass),
897                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
898                 })
899
900             if serverrole == "domain controller":
901                 message("Setting up self join")
902                 setup_self_join(samdb, names=names, invocationid=invocationid, 
903                                 dnspass=dnspass,  
904                                 machinepass=machinepass, 
905                                 domainsid=domainsid, policyguid=policyguid,
906                                 setup_path=setup_path)
907
908     except:
909         samdb.transaction_cancel()
910         raise
911
912     samdb.transaction_commit()
913     return samdb
914
915
916 FILL_FULL = "FULL"
917 FILL_NT4SYNC = "NT4SYNC"
918 FILL_DRS = "DRS"
919
920 def provision(setup_dir, message, session_info, 
921               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
922               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
923               serverdn=None,
924               domain=None, hostname=None, hostip=None, hostip6=None, 
925               domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
926               policyguid=None, invocationid=None, machinepass=None, 
927               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
928               wheel=None, backup=None, aci=None, serverrole=None, 
929               ldap_backend=None, ldap_backend_type=None, sitename=None):
930     """Provision samba4
931     
932     :note: caution, this wipes all existing data!
933     """
934
935     def setup_path(file):
936         return os.path.join(setup_dir, file)
937
938     if domainsid is None:
939         domainsid = security.random_sid()
940
941     if policyguid is None:
942         policyguid = str(uuid.uuid4())
943     if adminpass is None:
944         adminpass = glue.generate_random_str(12)
945     if krbtgtpass is None:
946         krbtgtpass = glue.generate_random_str(12)
947     if machinepass is None:
948         machinepass  = glue.generate_random_str(12)
949     if dnspass is None:
950         dnspass = glue.generate_random_str(12)
951     root_uid = findnss_uid([root or "root"])
952     nobody_uid = findnss_uid([nobody or "nobody"])
953     users_gid = findnss_gid([users or "users"])
954     if wheel is None:
955         wheel_gid = findnss_gid(["wheel", "adm"])
956     else:
957         wheel_gid = findnss_gid([wheel])
958     if aci is None:
959         aci = "# no aci for local ldb"
960
961     if targetdir is not None:
962         if (not os.path.exists(os.path.join(targetdir, "etc"))):
963             os.makedirs(os.path.join(targetdir, "etc"))
964         smbconf = os.path.join(targetdir, "etc", "smb.conf")
965     elif smbconf is None:
966         smbconf = param.default_path()
967
968     # only install a new smb.conf if there isn't one there already
969     if not os.path.exists(smbconf):
970         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
971                      targetdir)
972
973     lp = param.LoadParm()
974     lp.load(smbconf)
975
976     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
977                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
978                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
979                         serverdn=serverdn)
980
981     paths = provision_paths_from_lp(lp, names.dnsdomain)
982
983     if hostip is None:
984         try:
985             hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
986         except socket.gaierror, (socket.EAI_NODATA, msg):
987             hostip = None
988
989     if hostip6 is None:
990         try:
991             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
992         except socket.gaierror, (socket.EAI_NODATA, msg): 
993             hostip6 = None
994
995     if serverrole is None:
996         serverrole = lp.get("server role")
997
998     assert serverrole in ("domain controller", "member server", "standalone")
999     if invocationid is None and serverrole == "domain controller":
1000         invocationid = str(uuid.uuid4())
1001
1002     if not os.path.exists(paths.private_dir):
1003         os.mkdir(paths.private_dir)
1004
1005     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1006     
1007     if ldap_backend is not None:
1008         if ldap_backend == "ldapi":
1009             # provision-backend will set this path suggested slapd command line / fedorads.inf
1010             ldap_backend = "ldapi://%s" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1011              
1012     # only install a new shares config db if there is none
1013     if not os.path.exists(paths.shareconf):
1014         message("Setting up share.ldb")
1015         share_ldb = Ldb(paths.shareconf, session_info=session_info, 
1016                         credentials=credentials, lp=lp)
1017         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1018
1019      
1020     message("Setting up secrets.ldb")
1021     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
1022                                   session_info=session_info, 
1023                                   credentials=credentials, lp=lp)
1024
1025     message("Setting up the registry")
1026     setup_registry(paths.hklm, setup_path, session_info, 
1027                    credentials=credentials, lp=lp)
1028
1029     message("Setting up templates db")
1030     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
1031                       credentials=credentials, lp=lp)
1032
1033     message("Setting up idmap db")
1034     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1035                           credentials=credentials, lp=lp)
1036
1037     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
1038                         credentials=credentials, lp=lp, names=names,
1039                         message=message, 
1040                         domainsid=domainsid, 
1041                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
1042                         fill=samdb_fill, 
1043                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1044                         invocationid=invocationid, 
1045                         machinepass=machinepass, dnspass=dnspass,
1046                         serverrole=serverrole, ldap_backend=ldap_backend, 
1047                         ldap_backend_type=ldap_backend_type)
1048
1049     if lp.get("server role") == "domain controller":
1050         if paths.netlogon is None:
1051             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1052             message("Please either remove %s or see the template at %s" % 
1053                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1054             assert(paths.netlogon is not None)
1055
1056         if paths.sysvol is None:
1057             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1058             message("Please either remove %s or see the template at %s" % 
1059                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1060             assert(paths.sysvol is not None)            
1061             
1062         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
1063                                    "{" + policyguid + "}")
1064         os.makedirs(policy_path, 0755)
1065         open(os.path.join(policy_path, "GPT.INI"), 'w').write("")
1066         os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1067         os.makedirs(os.path.join(policy_path, "User"), 0755)
1068         if not os.path.isdir(paths.netlogon):
1069             os.makedirs(paths.netlogon, 0755)
1070
1071     if samdb_fill == FILL_FULL:
1072         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1073                             root_uid=root_uid, nobody_uid=nobody_uid,
1074                             users_gid=users_gid, wheel_gid=wheel_gid)
1075
1076         message("Setting up sam.ldb rootDSE marking as synchronized")
1077         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1078
1079         # Only make a zone file on the first DC, it should be replicated with DNS replication
1080         if serverrole == "domain controller":
1081             secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
1082                               credentials=credentials, lp=lp)
1083             secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1084                                 netbiosname=names.netbiosname, domainsid=domainsid, 
1085                                 keytab_path=paths.keytab, samdb_url=paths.samdb, 
1086                                 dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
1087                                 machinepass=machinepass, dnsdomain=names.dnsdomain)
1088
1089             samdb = SamDB(paths.samdb, session_info=session_info, 
1090                       credentials=credentials, lp=lp)
1091
1092             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1093             assert isinstance(domainguid, str)
1094             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1095                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1096                                        scope=SCOPE_SUBTREE)
1097             assert isinstance(hostguid, str)
1098
1099             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1100                              domaindn=names.domaindn, hostip=hostip,
1101                              hostip6=hostip6, hostname=names.hostname,
1102                              dnspass=dnspass, realm=names.realm,
1103                              domainguid=domainguid, hostguid=hostguid)
1104
1105             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1106                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1107
1108             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1109                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1110                               keytab_name=paths.dns_keytab)
1111             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1112             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1113
1114             create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
1115                              hostname=names.hostname, realm=names.realm)
1116             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1117
1118     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
1119                                ldapi_url)
1120
1121     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1122
1123     message("Once the above files are installed, your Samba4 server will be ready to use")
1124     message("Server Role:    %s" % serverrole)
1125     message("Hostname:       %s" % names.hostname)
1126     message("NetBIOS Domain: %s" % names.domain)
1127     message("DNS Domain:     %s" % names.dnsdomain)
1128     message("DOMAIN SID:     %s" % str(domainsid))
1129     message("Admin password: %s" % adminpass)
1130
1131     result = ProvisionResult()
1132     result.domaindn = domaindn
1133     result.paths = paths
1134     result.lp = lp
1135     result.samdb = samdb
1136     return result
1137
1138
1139 def provision_become_dc(setup_dir=None,
1140                         smbconf=None, targetdir=None, realm=None, 
1141                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1142                         serverdn=None,
1143                         domain=None, hostname=None, domainsid=None, 
1144                         adminpass=None, krbtgtpass=None, domainguid=None, 
1145                         policyguid=None, invocationid=None, machinepass=None, 
1146                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
1147                         wheel=None, backup=None, aci=None, serverrole=None, 
1148                         ldap_backend=None, ldap_backend_type=None, sitename=None):
1149
1150     def message(text):
1151         """print a message if quiet is not set."""
1152         print text
1153
1154     return provision(setup_dir, message, system_session(), None,
1155               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
1156               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
1157               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename)
1158     
1159
1160 def setup_db_config(setup_path, dbdir):
1161     """Setup a Berkeley database.
1162     
1163     :param setup_path: Setup path function.
1164     :param dbdir: Database directory."""
1165     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1166         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700)
1167     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1168         os.makedirs(os.path.join(dbdir, "tmp"), 0700)
1169     
1170     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1171                {"LDAPDBDIR": dbdir})
1172     
1173
1174
1175 def provision_backend(setup_dir=None, message=None,
1176                       smbconf=None, targetdir=None, realm=None, 
1177                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1178                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
1179                       ldap_backend_type=None, ldap_backend_port=None,
1180                       ol_mmr_urls=None):
1181
1182     def setup_path(file):
1183         return os.path.join(setup_dir, file)
1184
1185     if hostname is None:
1186         hostname = socket.gethostname().split(".")[0].lower()
1187
1188     if root is None:
1189         root = findnss(pwd.getpwnam, ["root"])[0]
1190
1191     if adminpass is None:
1192         adminpass = glue.generate_random_str(12)
1193
1194     if targetdir is not None:
1195         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1196             os.makedirs(os.path.join(targetdir, "etc"))
1197         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1198     elif smbconf is None:
1199         smbconf = param.default_path()
1200         assert smbconf is not None
1201
1202     # only install a new smb.conf if there isn't one there already
1203     if not os.path.exists(smbconf):
1204         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
1205                      targetdir)
1206
1207     lp = param.LoadParm()
1208     lp.load(smbconf)
1209
1210     if serverrole is None:
1211         serverrole = lp.get("server role")
1212
1213     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
1214                         dnsdomain=realm, serverrole=serverrole, 
1215                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, 
1216                         schemadn=schemadn)
1217
1218     paths = provision_paths_from_lp(lp, names.dnsdomain)
1219
1220     if not os.path.isdir(paths.ldapdir):
1221         os.makedirs(paths.ldapdir, 0700)
1222     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1223     try:
1224         os.unlink(schemadb_path)
1225     except OSError:
1226         pass
1227
1228     schemadb = Ldb(schemadb_path, lp=lp)
1229  
1230     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1231
1232     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
1233                    {"SCHEMADN": names.schemadn,
1234                     "ACI": "#",
1235                     })
1236     setup_modify_ldif(schemadb, 
1237                       setup_path("provision_schema_basedn_modify.ldif"), \
1238                           {"SCHEMADN": names.schemadn,
1239                            "NETBIOSNAME": names.netbiosname,
1240                            "DEFAULTSITE": DEFAULTSITE,
1241                            "CONFIGDN": names.configdn,
1242                            "SERVERDN": names.serverdn,
1243                            "PREFIXMAP_B64": b64encode(prefixmap)
1244                            })
1245     
1246     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
1247                    {"SCHEMADN": names.schemadn })
1248     setup_add_ldif(schemadb, setup_path("schema.ldif"), 
1249                    {"SCHEMADN": names.schemadn})
1250
1251     if ldap_backend_type == "fedora-ds":
1252         if ldap_backend_port is not None:
1253             serverport = "ServerPort=%d" % ldap_backend_port
1254         else:
1255             serverport = ""
1256
1257         setup_file(setup_path("fedorads.inf"), paths.fedoradsinf, 
1258                    {"ROOT": root,
1259                     "HOSTNAME": hostname,
1260                     "DNSDOMAIN": names.dnsdomain,
1261                     "LDAPDIR": paths.ldapdir,
1262                     "DOMAINDN": names.domaindn,
1263                     "LDAPMANAGERDN": names.ldapmanagerdn,
1264                     "LDAPMANAGERPASS": adminpass, 
1265                     "SERVERPORT": serverport})
1266         
1267         setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions, 
1268                    {"CONFIGDN": names.configdn,
1269                     "SCHEMADN": names.schemadn,
1270                     })
1271         
1272         mapping = "schema-map-fedora-ds-1.0"
1273         backend_schema = "99_ad.ldif"
1274         
1275         slapdcommand="Initialise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
1276        
1277         ldapuser = "--simple-bind-dn=" + names.ldapmanagerdn
1278
1279     elif ldap_backend_type == "openldap":
1280         attrs = ["linkID", "lDAPDisplayName"]
1281         res = schemadb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
1282
1283         memberof_config = "# Generated from schema in %s\n" % schemadb_path
1284         refint_attributes = ""
1285         for i in range (0, len(res)):
1286             expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
1287             target = schemadb.searchone(basedn=names.schemadn, 
1288                                         expression=expression, 
1289                                         attribute="lDAPDisplayName", 
1290                                         scope=SCOPE_SUBTREE)
1291             if target is not None:
1292                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0]
1293             
1294                 memberof_config += read_and_sub_file(setup_path("memberof.conf"),
1295                                                      { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
1296                                                        "MEMBEROF_ATTR" : str(target) })
1297
1298         refint_config = read_and_sub_file(setup_path("refint.conf"),
1299                                             { "LINK_ATTRS" : refint_attributes})
1300
1301 # generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
1302         mmr_on_config = ""
1303         mmr_replicator_acl = ""
1304         mmr_serverids_config = ""
1305         mmr_syncrepl_schema_config = "" 
1306         mmr_syncrepl_config_config = "" 
1307         mmr_syncrepl_user_config = "" 
1308         
1309         if ol_mmr_urls is not None:
1310                 # For now, make these equal
1311                 mmr_pass = adminpass
1312
1313                 url_list=filter(None,ol_mmr_urls.split(' ')) 
1314                 if (len(url_list) == 1):
1315                     url_list=filter(None,ol_mmr_urls.split(',')) 
1316                      
1317
1318                 mmr_on_config = "MirrorMode On"
1319                 mmr_replicator_acl = "  by dn=cn=replicator,cn=samba read"
1320                 serverid=0
1321                 for url in url_list:
1322                         serverid=serverid+1
1323                         mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
1324                                                                      { "SERVERID" : str(serverid),
1325                                                                        "LDAPSERVER" : url })
1326                         rid=serverid*10
1327                         rid=rid+1
1328                         mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1329                                                                      {  "RID" : str(rid),
1330                                                                         "MMRDN": names.schemadn,
1331                                                                         "LDAPSERVER" : url,
1332                                                                         "MMR_PASSWORD": mmr_pass})
1333
1334                         rid=rid+1
1335                         mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1336                                                                      {  "RID" : str(rid),
1337                                                                         "MMRDN": names.configdn,
1338                                                                         "LDAPSERVER" : url,
1339                                                                         "MMR_PASSWORD": mmr_pass})
1340
1341                         rid=rid+1
1342                         mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1343                                                                      {  "RID" : str(rid),
1344                                                                         "MMRDN": names.domaindn,
1345                                                                         "LDAPSERVER" : url,
1346                                                                         "MMR_PASSWORD": mmr_pass })
1347
1348
1349         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1350                    {"DNSDOMAIN": names.dnsdomain,
1351                     "LDAPDIR": paths.ldapdir,
1352                     "DOMAINDN": names.domaindn,
1353                     "CONFIGDN": names.configdn,
1354                     "SCHEMADN": names.schemadn,
1355                     "MEMBEROF_CONFIG": memberof_config,
1356                     "MIRRORMODE": mmr_on_config,
1357                     "REPLICATOR_ACL": mmr_replicator_acl,
1358                     "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
1359                     "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
1360                     "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
1361                     "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
1362                     "REFINT_CONFIG": refint_config})
1363         setup_file(setup_path("modules.conf"), paths.modulesconf,
1364                    {"REALM": names.realm})
1365         
1366         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
1367         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
1368         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
1369
1370         if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba")):
1371             os.makedirs(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba"), 0700)
1372
1373         setup_file(setup_path("cn=samba.ldif"), 
1374                    os.path.join(paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
1375                    { "UUID": str(uuid.uuid4()), 
1376                      "LDAPTIME": timestring(int(time.time()))} )
1377         setup_file(setup_path("cn=samba-admin.ldif"), 
1378                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
1379                               {"LDAPADMINPASS_B64": b64encode(adminpass),
1380                                "UUID": str(uuid.uuid4()), 
1381                                "LDAPTIME": timestring(int(time.time()))} )
1382         
1383         if ol_mmr_urls is not None:
1384            setup_file(setup_path("cn=replicator.ldif"),
1385                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=replicator.ldif"),
1386                               {"MMR_PASSWORD_B64": b64encode(mmr_pass),
1387                                "UUID": str(uuid.uuid4()),
1388                                "LDAPTIME": timestring(int(time.time()))} )
1389
1390
1391
1392         mapping = "schema-map-openldap-2.3"
1393         backend_schema = "backend-schema.schema"
1394
1395         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1396         if ldap_backend_port is not None:
1397             server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
1398         else:
1399             server_port_string = ""
1400
1401         slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
1402
1403         ldapuser = "--username=samba-admin"
1404
1405             
1406     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
1407             
1408     os.system(schema_command)
1409
1410     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ldap_backend_type)
1411     message("Server Role:         %s" % serverrole)
1412     message("Hostname:            %s" % names.hostname)
1413     message("DNS Domain:          %s" % names.dnsdomain)
1414     message("Base DN:             %s" % names.domaindn)
1415
1416     if ldap_backend_type == "openldap":
1417         message("LDAP admin user:     samba-admin")
1418     else:
1419         message("LDAP admin DN:       %s" % names.ldapmanagerdn)
1420
1421     message("LDAP admin password: %s" % adminpass)
1422     message(slapdcommand)
1423     assert isinstance(ldap_backend_type, str)
1424     assert isinstance(ldapuser, str)
1425     assert isinstance(adminpass, str)
1426     assert isinstance(names.dnsdomain, str)
1427     assert isinstance(names.domain, str)
1428     assert isinstance(serverrole, str)
1429     args = ["--ldap-backend=ldapi",
1430             "--ldap-backend-type=" + ldap_backend_type,
1431             "--password=" + adminpass,
1432             ldapuser,
1433             "--realm=" + names.dnsdomain,
1434             "--domain=" + names.domain,
1435             "--server-role='" + serverrole + "'"]
1436     message("Run provision with: " + " ".join(args))
1437
1438
1439 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1440     """Create a PHP LDAP admin configuration file.
1441
1442     :param path: Path to write the configuration to.
1443     :param setup_path: Function to generate setup paths.
1444     """
1445     setup_file(setup_path("phpldapadmin-config.php"), path, 
1446             {"S4_LDAPI_URI": ldapi_uri})
1447
1448
1449 def create_zone_file(path, setup_path, dnsdomain, domaindn, 
1450                      hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
1451     """Write out a DNS zone file, from the info in the current database.
1452
1453     :param path: Path of the new zone file.
1454     :param setup_path: Setup path function.
1455     :param dnsdomain: DNS Domain name
1456     :param domaindn: DN of the Domain
1457     :param hostip: Local IPv4 IP
1458     :param hostip6: Local IPv6 IP
1459     :param hostname: Local hostname
1460     :param dnspass: Password for DNS
1461     :param realm: Realm name
1462     :param domainguid: GUID of the domain.
1463     :param hostguid: GUID of the host.
1464     """
1465     assert isinstance(domainguid, str)
1466
1467     if hostip6 is not None:
1468         hostip6_base_line = "            IN AAAA    " + hostip6
1469         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1470     else:
1471         hostip6_base_line = ""
1472         hostip6_host_line = ""
1473
1474     if hostip is not None:
1475         hostip_base_line = "            IN A    " + hostip
1476         hostip_host_line = hostname + "        IN A    " + hostip
1477     else:
1478         hostip_base_line = ""
1479         hostip_host_line = ""
1480
1481     setup_file(setup_path("provision.zone"), path, {
1482             "DNSPASS_B64": b64encode(dnspass),
1483             "HOSTNAME": hostname,
1484             "DNSDOMAIN": dnsdomain,
1485             "REALM": realm,
1486             "HOSTIP_BASE_LINE": hostip_base_line,
1487             "HOSTIP_HOST_LINE": hostip_host_line,
1488             "DOMAINGUID": domainguid,
1489             "DATESTRING": time.strftime("%Y%m%d%H"),
1490             "DEFAULTSITE": DEFAULTSITE,
1491             "HOSTGUID": hostguid,
1492             "HOSTIP6_BASE_LINE": hostip6_base_line,
1493             "HOSTIP6_HOST_LINE": hostip6_host_line,
1494         })
1495
1496
1497 def create_named_conf(path, setup_path, realm, dnsdomain,
1498                       private_dir):
1499     """Write out a file containing zone statements suitable for inclusion in a
1500     named.conf file (including GSS-TSIG configuration).
1501     
1502     :param path: Path of the new named.conf file.
1503     :param setup_path: Setup path function.
1504     :param realm: Realm name
1505     :param dnsdomain: DNS Domain name
1506     :param private_dir: Path to private directory
1507     :param keytab_name: File name of DNS keytab file
1508     """
1509
1510     setup_file(setup_path("named.conf"), path, {
1511             "DNSDOMAIN": dnsdomain,
1512             "REALM": realm,
1513             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
1514             "PRIVATE_DIR": private_dir
1515             })
1516
1517 def create_named_txt(path, setup_path, realm, dnsdomain,
1518                       private_dir, keytab_name):
1519     """Write out a file containing zone statements suitable for inclusion in a
1520     named.conf file (including GSS-TSIG configuration).
1521     
1522     :param path: Path of the new named.conf file.
1523     :param setup_path: Setup path function.
1524     :param realm: Realm name
1525     :param dnsdomain: DNS Domain name
1526     :param private_dir: Path to private directory
1527     :param keytab_name: File name of DNS keytab file
1528     """
1529
1530     setup_file(setup_path("named.txt"), path, {
1531             "DNSDOMAIN": dnsdomain,
1532             "REALM": realm,
1533             "DNS_KEYTAB": keytab_name,
1534             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
1535             "PRIVATE_DIR": private_dir
1536         })
1537
1538 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
1539     """Write out a file containing zone statements suitable for inclusion in a
1540     named.conf file (including GSS-TSIG configuration).
1541     
1542     :param path: Path of the new named.conf file.
1543     :param setup_path: Setup path function.
1544     :param dnsdomain: DNS Domain name
1545     :param hostname: Local hostname
1546     :param realm: Realm name
1547     """
1548
1549     setup_file(setup_path("krb5.conf"), path, {
1550             "DNSDOMAIN": dnsdomain,
1551             "HOSTNAME": hostname,
1552             "REALM": realm,
1553         })
1554
1555
1556 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename,
1557                 serverdn, servername):
1558     """Load schema for the SamDB.
1559     
1560     :param samdb: Load a schema into a SamDB.
1561     :param setup_path: Setup path function.
1562     :param schemadn: DN of the schema
1563     :param netbiosname: NetBIOS name of the host.
1564     :param configdn: DN of the configuration
1565     :param serverdn: DN of the server
1566     :param servername: Host name of the server
1567     """
1568     schema_data = open(setup_path("schema.ldif"), 'r').read()
1569     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1570     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1571     check_all_substituted(schema_data)
1572     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1573     prefixmap = b64encode(prefixmap)
1574
1575     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1576     head_data = substitute_var(head_data, {
1577                     "SCHEMADN": schemadn,
1578                     "NETBIOSNAME": netbiosname,
1579                     "CONFIGDN": configdn,
1580                     "DEFAULTSITE": sitename,
1581                     "PREFIXMAP_B64": prefixmap,
1582                     "SERVERDN": serverdn,
1583                     "SERVERNAME": servername,
1584     })
1585     check_all_substituted(head_data)
1586     samdb.attach_schema_from_ldif(head_data, schema_data)
1587