Fix some forgotten substitute variables in provision, add check to prevent this sort...
[kai/samba-autobuild/.git] / source4 / scripting / python / samba / provision.py
index a4730d8a07a79724f3f309ecdd221e0244f53ce6..33aeff2008cb9095dd0dbf768046096c636ad9f1 100644 (file)
@@ -22,6 +22,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
+"""Functions for setting up a Samba configuration."""
+
 from base64 import b64encode
 import os
 import pwd
@@ -41,8 +43,6 @@ import urllib
 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
 
-"""Functions for setting up a Samba configuration."""
-
 __docformat__ = "restructuredText"
 
 DEFAULTSITE = "Default-First-Site-Name"
@@ -153,6 +153,19 @@ def open_ldb(session_info, credentials, lp, dbname):
                    lp=lp)
 
 
+def read_and_sub_file(file, subst_vars):
+    """Read a file and sub in variables found in it
+    
+    :param file: File to be read (typically from setup directory)
+     param subst_vars: Optional variables to subsitute in the file.
+    """
+    data = open(file, 'r').read()
+    if subst_vars is not None:
+        data = substitute_var(data, subst_vars)
+    check_all_substituted(data)
+    return data
+
+
 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
     """Setup a ldb in the private dir.
     
@@ -162,27 +175,18 @@ def setup_add_ldif(ldb, ldif_path, subst_vars=None):
     """
     assert isinstance(ldif_path, str)
 
-    data = open(ldif_path, 'r').read()
-    if subst_vars is not None:
-        data = substitute_var(data, subst_vars)
-
-    check_all_substituted(data)
-
+    data = read_and_sub_file(ldif_path, subst_vars)
     ldb.add_ldif(data)
 
 
-def setup_modify_ldif(ldb, ldif_path, substvars=None):
+def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
     """Modify a ldb in the private dir.
     
     :param ldb: LDB object.
     :param ldif_path: LDIF file path.
-    :param substvars: Optional dictionary with substitution variables.
+    :param subst_vars: Optional dictionary with substitution variables.
     """
-    data = open(ldif_path, 'r').read()
-    if substvars is not None:
-        data = substitute_var(data, substvars)
-
-    check_all_substituted(data)
+    data = read_and_sub_file(ldif_path, subst_vars)
 
     ldb.modify_ldif(data)
 
@@ -206,23 +210,19 @@ def setup_ldb(ldb, ldif_path, subst_vars):
     ldb.transaction_commit()
 
 
-def setup_file(template, fname, substvars):
+def setup_file(template, fname, subst_vars):
     """Setup a file in the private dir.
 
     :param template: Path of the template file.
     :param fname: Path of the file to create.
-    :param substvars: Substitution variables.
+    :param subst_vars: Substitution variables.
     """
     f = fname
 
     if os.path.exists(f):
         os.unlink(f)
 
-    data = open(template, 'r').read()
-    if substvars:
-        data = substitute_var(data, substvars)
-    check_all_substituted(data)
-
+    data = read_and_sub_file(template, subst_vars)
     open(f, 'w').write(data)
 
 
@@ -244,6 +244,7 @@ def provision_paths_from_lp(lp, dnsdomain):
     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
+    paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
@@ -503,6 +504,8 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
         backend_modules = ["normalise", "entryuuid", "paged_searches"]
         # OpenLDAP handles subtree renames, so we don't want to do any of these things
         tdb_modules_list = None
+    elif ldap_backend is not None:
+        raise "LDAP Backend specified, but LDAP Backend Type not specified"
     elif serverrole == "domain controller":
         backend_modules = ["repl_meta_data"]
     else:
@@ -604,6 +607,20 @@ def setup_secretsdb(path, setup_path, session_info, credentials, lp):
     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
                       lp=lp)
     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
+
+    if credentials is not None and credentials.authentication_requested():
+        if credentials.get_bind_dn() is not None:
+            setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
+                    "LDAPMANAGERDN": credentials.get_bind_dn(),
+                    "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
+                    })
+        else:
+            setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
+                    "LDAPADMINUSER": credentials.get_username(),
+                    "LDAPADMINREALM": credentials.get_realm(),
+                    "LDAPADMINPASS_B64": b64encode(credentials.get_password())
+                    })
+
     return secrets_ldb
 
 
@@ -754,10 +771,10 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             domain_oc = "samba4LocalDomain"
 
         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
-            "DOMAINDN": names.domaindn,
-            "ACI": aci,
-            "DOMAIN_OC": domain_oc
-            })
+                "DOMAINDN": names.domaindn,
+                "ACI": aci,
+                "DOMAIN_OC": domain_oc
+                })
 
         message("Modifying DomainDN: " + names.domaindn + "")
         if domainguid is not None:
@@ -797,13 +814,17 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
             })
         message("Modifying schema container")
+
+        prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
+
         setup_modify_ldif(samdb, 
             setup_path("provision_schema_basedn_modify.ldif"), {
             "SCHEMADN": names.schemadn,
             "NETBIOSNAME": names.netbiosname,
             "DEFAULTSITE": names.sitename,
             "CONFIGDN": names.configdn,
-            "SERVERDN": names.serverdn
+            "SERVERDN": names.serverdn,
+            "PREFIXMAP_B64": b64encode(prefixmap)
             })
 
         message("Setting up sam.ldb Samba4 schema")
@@ -926,8 +947,9 @@ def provision(setup_dir, message, session_info,
     if aci is None:
         aci = "# no aci for local ldb"
 
-    if smbconf is None:
-        os.makedirs(os.path.join(targetdir, "etc"))
+    if targetdir is not None:
+        if (not os.path.exists(os.path.join(targetdir, "etc"))):
+            os.makedirs(os.path.join(targetdir, "etc"))
         smbconf = os.path.join(targetdir, "etc", "smb.conf")
 
     # only install a new smb.conf if there isn't one there already
@@ -969,7 +991,7 @@ def provision(setup_dir, message, session_info,
     if ldap_backend is not None:
         if ldap_backend == "ldapi":
             # provision-backend will set this path suggested slapd command line / fedorads.inf
-            ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+            ldap_backend = "ldapi://%s" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
              
     # only install a new shares config db if there is none
     if not os.path.exists(paths.shareconf):
@@ -1024,6 +1046,7 @@ def provision(setup_dir, message, session_info,
         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
                                    "{" + policyguid + "}")
         os.makedirs(policy_path, 0755)
+        open(os.path.join(policy_path, "GPT.INI"), 'w').write("")
         os.makedirs(os.path.join(policy_path, "Machine"), 0755)
         os.makedirs(os.path.join(policy_path, "User"), 0755)
         if not os.path.isdir(paths.netlogon):
@@ -1062,12 +1085,15 @@ def provision(setup_dir, message, session_info,
                              hostip6=hostip6, hostname=names.hostname,
                              dnspass=dnspass, realm=names.realm,
                              domainguid=domainguid, hostguid=hostguid)
-            message("Please install the zone located in %s into your DNS server" % paths.dns)
 
             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
+                              dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
+
+            create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
                               keytab_name=paths.dns_keytab)
-            message("See %s for example configuration statements for secure GSS-TSIG updates" % paths.namedconf)
+            message("See %s for an example configuration include file for BIND" % paths.namedconf)
+            message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
 
             create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
                              hostname=names.hostname, realm=names.realm)
@@ -1145,15 +1171,18 @@ def provision_backend(setup_dir=None, message=None,
     if root is None:
         root = findnss(pwd.getpwnam, ["root"])[0]
 
-    if smbconf is None:
-        etcdir = os.path.join(targetdir, "etc")
-        os.makedirs(etcdir)
-        smbconf = os.path.join(etcdir, "smb.conf")
+    if adminpass is None:
+        adminpass = misc.random_password(12)
+
+    if targetdir is not None:
+        if (not os.path.exists(os.path.join(targetdir, "etc"))):
+            os.makedirs(os.path.join(targetdir, "etc"))
+        smbconf = os.path.join(targetdir, "etc", "smb.conf")
 
     # only install a new smb.conf if there isn't one there already
     if not os.path.exists(smbconf):
-        make_smbconf(smbconf, setup_path, hostname, domain, realm, 
-                              serverrole, targetdir)
+        make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
+                     targetdir)
 
     lp = param.LoadParm()
     lp.load(smbconf)
@@ -1175,6 +1204,8 @@ def provision_backend(setup_dir=None, message=None,
 
     schemadb = Ldb(schemadb_path, lp=lp)
  
+    prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
+
     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
                    {"SCHEMADN": names.schemadn,
                     "ACI": "#",
@@ -1186,7 +1217,8 @@ def provision_backend(setup_dir=None, message=None,
                            "NETBIOSNAME": names.netbiosname,
                            "DEFAULTSITE": DEFAULTSITE,
                            "CONFIGDN": names.configdn,
-                           "SERVERDN": names.serverdn
+                           "SERVERDN": names.serverdn,
+                           "PREFIXMAP_B64": b64encode(prefixmap)
                            })
     
     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
@@ -1222,11 +1254,11 @@ def provision_backend(setup_dir=None, message=None,
        
     elif ldap_backend_type == "openldap":
         attrs = ["linkID", "lDAPDisplayName"]
-    res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
+        res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
 
-    memberof_config = "# Generated from schema in %s\n" % schemadb_path
-    refint_attributes = ""
-    for i in range (0, len(res)):
+        memberof_config = "# Generated from schema in %s\n" % schemadb_path
+        refint_attributes = ""
+        for i in range (0, len(res)):
             expression = "(&(objectclass=attributeSchema)(linkID=%d))" % (int(res[i]["linkID"][0])+1)
             target = schemadb.searchone(basedn=names.schemadn, 
                                         expression=expression, 
@@ -1234,56 +1266,68 @@ def provision_backend(setup_dir=None, message=None,
                                         scope=SCOPE_SUBTREE)
             if target is not None:
                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0]
-                memberof_config += """overlay memberof
-memberof-dangling error
-memberof-refint TRUE
-memberof-group-oc top
-memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
-memberof-memberof-ad """ + target + """
-memberof-dangling-error 32
-
-"""
-
-    memberof_config += """
-overlay refint
-refint_attributes""" + refint_attributes + "\n"
+            
+                memberof_config += read_and_sub_file(setup_path("memberof.conf"),
+                                                     { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
+                                                       "MEMBEROF_ATTR" : str(target) })
+
+        refint_config = read_and_sub_file(setup_path("refint.conf"),
+                                            { "LINK_ATTRS" : refint_attributes})
     
-    setup_file(setup_path("slapd.conf"), paths.slapdconf,
+        setup_file(setup_path("slapd.conf"), paths.slapdconf,
                    {"DNSDOMAIN": names.dnsdomain,
                     "LDAPDIR": paths.ldapdir,
                     "DOMAINDN": names.domaindn,
                     "CONFIGDN": names.configdn,
                     "SCHEMADN": names.schemadn,
-                    "LDAPMANAGERDN": names.ldapmanagerdn,
-                    "LDAPMANAGERPASS": adminpass,
-                    "MEMBEROF_CONFIG": memberof_config})
-    setup_file(setup_path("modules.conf"), paths.modulesconf,
+                    "MEMBEROF_CONFIG": memberof_config,
+                    "REFINT_CONFIG": refint_config})
+        setup_file(setup_path("modules.conf"), paths.modulesconf,
                    {"REALM": names.realm})
         
-    setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "user")))
-    setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "config")))
-    setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "schema")))
-    mapping = "schema-map-openldap-2.3"
-    backend_schema = "backend-schema.schema"
-
-    ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
-    if ldap_backend_port is not None:
-        server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
-    else:
-        server_port_string = ""
-    slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
+
+        if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba")):
+            os.makedirs(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba"))
+
+        setup_file(setup_path("cn=samba.ldif"), 
+                   os.path.join(paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
+                   { "UUID": str(uuid.uuid4()), 
+                     "LDAPTIME": timestring(int(time.time()))} )
+        setup_file(setup_path("cn=samba-admin.ldif"), 
+                              os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
+                              {"LDAPADMINPASS_B64": b64encode(adminpass),
+                               "UUID": str(uuid.uuid4()), 
+                               "LDAPTIME": timestring(int(time.time()))} )
+
+        mapping = "schema-map-openldap-2.3"
+        backend_schema = "backend-schema.schema"
+
+        ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+        if ldap_backend_port is not None:
+            server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
+        else:
+            server_port_string = ""
+            slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
 
+            
     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
-
+            
     os.system(schema_command)
 
-
     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ldap_backend_type)
     message("Server Role:         %s" % serverrole)
     message("Hostname:            %s" % names.hostname)
     message("DNS Domain:          %s" % names.dnsdomain)
     message("Base DN:             %s" % names.domaindn)
-    message("LDAP admin DN:       %s" % names.ldapmanagerdn)
+
+    if ldap_backend_type == "openldap":
+        message("LDAP admin user:     samba-admin")
+    else:
+        message("LDAP admin DN:       %s" % names.ldapmanagerdn)
+
     message("LDAP admin password: %s" % adminpass)
     message(slapdcommand)
 
@@ -1316,12 +1360,12 @@ def create_zone_file(path, setup_path, dnsdomain, domaindn,
     """
     assert isinstance(domainguid, str)
 
-    hostip6_base_line = ""
-    hostip6_host_line = ""
-
     if hostip6 is not None:
         hostip6_base_line = "            IN AAAA    " + hostip6
         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
+    else:
+        hostip6_base_line = ""
+        hostip6_host_line = ""
 
     setup_file(setup_path("provision.zone"), path, {
             "DNSPASS_B64": b64encode(dnspass),
@@ -1339,7 +1383,7 @@ def create_zone_file(path, setup_path, dnsdomain, domaindn,
 
 
 def create_named_conf(path, setup_path, realm, dnsdomain,
-                      private_dir, keytab_name):
+                      private_dir):
     """Write out a file containing zone statements suitable for inclusion in a
     named.conf file (including GSS-TSIG configuration).
     
@@ -1355,8 +1399,28 @@ def create_named_conf(path, setup_path, realm, dnsdomain,
             "DNSDOMAIN": dnsdomain,
             "REALM": realm,
             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
+            "PRIVATE_DIR": private_dir
+            })
+
+def create_named_txt(path, setup_path, realm, dnsdomain,
+                      private_dir, keytab_name):
+    """Write out a file containing zone statements suitable for inclusion in a
+    named.conf file (including GSS-TSIG configuration).
+    
+    :param path: Path of the new named.conf file.
+    :param setup_path: Setup path function.
+    :param realm: Realm name
+    :param dnsdomain: DNS Domain name
+    :param private_dir: Path to private directory
+    :param keytab_name: File name of DNS keytab file
+    """
+
+    setup_file(setup_path("named.txt"), path, {
+            "DNSDOMAIN": dnsdomain,
+            "REALM": realm,
             "DNS_KEYTAB": keytab_name,
             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
+            "PRIVATE_DIR": private_dir
         })
 
 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
@@ -1389,12 +1453,18 @@ def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
     schema_data = open(setup_path("schema.ldif"), 'r').read()
     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
+    check_all_substituted(schema_data)
+    prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
+    prefixmap = b64encode(prefixmap)
+
     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
     head_data = substitute_var(head_data, {
                     "SCHEMADN": schemadn,
                     "NETBIOSNAME": netbiosname,
                     "CONFIGDN": configdn,
-                    "DEFAULTSITE":sitename 
+                    "DEFAULTSITE":sitename,
+                    "PREFIXMAP_B64":prefixmap
     })
+    check_all_substituted(head_data)
     samdb.attach_schema_from_ldif(head_data, schema_data)