source4/scripting/python/samba/provision.py

   1 #
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 # Based on the original in EJS:
   9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
  10 #
  11 # This program is free software; you can redistribute it and/or modify
  12 # it under the terms of the GNU General Public License as published by
  13 # the Free Software Foundation; either version 3 of the License, or
  14 # (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 #
  24
  25 from base64 import b64encode
  26 import os
  27 import pwd
  28 import grp
  29 import time
  30 import uuid, misc
  31 import socket
  32 import param
  33 import registry
  34 import samba
  35 from auth import system_session
  36 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
  37 from samba.samdb import SamDB
  38 from samba.idmap import IDmapDB
  39 import security
  40 import urllib
  41 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
  42         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
  43
  44 """Functions for setting up a Samba configuration."""
  45
  46 DEFAULTSITE = "Default-First-Site-Name"
  47
  48 class InvalidNetbiosName(Exception):
  49     def __init__(self, name):
  50         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
  51
  52
  53 class ProvisionPaths:
  54     def __init__(self):
  55         self.shareconf = None
  56         self.hklm = None
  57         self.hkcu = None
  58         self.hkcr = None
  59         self.hku = None
  60         self.hkpd = None
  61         self.hkpt = None
  62         self.samdb = None
  63         self.idmapdb = None
  64         self.secrets = None
  65         self.keytab = None
  66         self.dns_keytab = None
  67         self.dns = None
  68         self.winsdb = None
  69         self.private_dir = None
  70         self.ldapdir = None
  71         self.slapdconf = None
  72         self.modulesconf = None
  73         self.memberofconf = None
  74         self.fedoradsinf = None
  75         self.fedoradspartitions = None
  76
  77 class ProvisionNames:
  78     def __init__(self):
  79         self.rootdn = None
  80         self.domaindn = None
  81         self.configdn = None
  82         self.schemadn = None
  83         self.ldapmanagerdn = None
  84         self.dnsdomain = None
  85         self.realm = None
  86         self.netbiosname = None
  87         self.domain = None
  88         self.hostname = None
  89         self.sitename = None
  90
  91 class ProvisionResult:
  92     def __init__(self):
  93         self.paths = None
  94         self.domaindn = None
  95         self.lp = None
  96         self.samdb = None
  97
  98 def check_install(lp, session_info, credentials):
  99     """Check whether the current install seems ok.
 100
 101     :param lp: Loadparm context
 102     :param session_info: Session information
 103     :param credentials: Credentials
 104     """
 105     if lp.get("realm") == "":
 106         raise Error("Realm empty")
 107     ldb = Ldb(lp.get("sam database"), session_info=session_info,
 108             credentials=credentials, lp=lp)
 109     if len(ldb.search("(cn=Administrator)")) != 1:
 110         raise "No administrator account found"
 111
 112
 113 def findnss(nssfn, names):
 114     """Find a user or group from a list of possibilities.
 115
 116     :param nssfn: NSS Function to try (should raise KeyError if not found)
 117     :param names: Names to check.
 118     :return: Value return by first names list.
 119     """
 120     for name in names:
 121         try:
 122             return nssfn(name)
 123         except KeyError:
 124             pass
 125     raise KeyError("Unable to find user/group %r" % names)
 126
 127
 128 def open_ldb(session_info, credentials, lp, dbname):
 129     """Open a LDB, thrashing it if it is corrupt.
 130
 131     :param session_info: auth session information
 132     :param credentials: credentials
 133     :param lp: Loadparm context
 134     :param dbname: Path of the database to open.
 135     :return: a Ldb object
 136     """
 137     assert session_info is not None
 138     try:
 139         return Ldb(dbname, session_info=session_info, credentials=credentials,
 140                    lp=lp)
 141     except LdbError, e:
 142         print e
 143         os.unlink(dbname)
 144         return Ldb(dbname, session_info=session_info, credentials=credentials,
 145                    lp=lp)
 146
 147
 148 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
 149     """Setup a ldb in the private dir.
 150
 151     :param ldb: LDB file to import data into
 152     :param ldif_path: Path of the LDIF file to load
 153     :param subst_vars: Optional variables to subsitute in LDIF.
 154     """
 155     assert isinstance(ldif_path, str)
 156
 157     data = open(ldif_path, 'r').read()
 158     if subst_vars is not None:
 159         data = substitute_var(data, subst_vars)
 160
 161     check_all_substituted(data)
 162
 163     ldb.add_ldif(data)
 164
 165
 166 def setup_modify_ldif(ldb, ldif_path, substvars=None):
 167     """Modify a ldb in the private dir.
 168
 169     :param ldb: LDB object.
 170     :param ldif_path: LDIF file path.
 171     :param substvars: Optional dictionary with substitution variables.
 172     """
 173     data = open(ldif_path, 'r').read()
 174     if substvars is not None:
 175         data = substitute_var(data, substvars)
 176
 177     check_all_substituted(data)
 178
 179     ldb.modify_ldif(data)
 180
 181
 182 def setup_ldb(ldb, ldif_path, subst_vars):
 183     """Import a LDIF a file into a LDB handle, optionally substituting variables.
 184
 185     :note: Either all LDIF data will be added or none (using transactions).
 186
 187     :param ldb: LDB file to import into.
 188     :param ldif_path: Path to the LDIF file.
 189     :param subst_vars: Dictionary with substitution variables.
 190     """
 191     assert ldb is not None
 192     ldb.transaction_start()
 193     try:
 194         setup_add_ldif(ldb, ldif_path, subst_vars)
 195     except:
 196         ldb.transaction_cancel()
 197         raise
 198     ldb.transaction_commit()
 199
 200
 201 def setup_file(template, fname, substvars):
 202     """Setup a file in the private dir.
 203
 204     :param template: Path of the template file.
 205     :param fname: Path of the file to create.
 206     :param substvars: Substitution variables.
 207     """
 208     f = fname
 209
 210     if os.path.exists(f):
 211         os.unlink(f)
 212
 213     data = open(template, 'r').read()
 214     if substvars:
 215         data = substitute_var(data, substvars)
 216     check_all_substituted(data)
 217
 218     open(f, 'w').write(data)
 219
 220
 221 def provision_paths_from_lp(lp, dnsdomain):
 222     """Set the default paths for provisioning.
 223
 224     :param lp: Loadparm context.
 225     :param dnsdomain: DNS Domain name
 226     """
 227     paths = ProvisionPaths()
 228     paths.private_dir = lp.get("private dir")
 229     paths.keytab = "secrets.keytab"
 230     paths.dns_keytab = "dns.keytab"
 231
 232     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
 233     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
 234     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
 235     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
 236     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
 237     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
 238     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
 239     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
 240     paths.phpldapadminconfig = os.path.join(paths.private_dir,
 241                                             "phpldapadmin-config.php")
 242     paths.ldapdir = os.path.join(paths.private_dir,
 243                                  "ldap")
 244     paths.slapdconf = os.path.join(paths.ldapdir,
 245                                    "slapd.conf")
 246     paths.modulesconf = os.path.join(paths.ldapdir,
 247                                      "modules.conf")
 248     paths.memberofconf = os.path.join(paths.ldapdir,
 249                                       "memberof.conf")
 250     paths.fedoradsinf = os.path.join(paths.ldapdir,
 251                                    "fedorads.inf")
 252     paths.fedoradspartitions = os.path.join(paths.ldapdir,
 253                                             "fedorads-partitions.ldif")
 254     paths.hklm = "hklm.ldb"
 255     paths.hkcr = "hkcr.ldb"
 256     paths.hkcu = "hkcu.ldb"
 257     paths.hku = "hku.ldb"
 258     paths.hkpd = "hkpd.ldb"
 259     paths.hkpt = "hkpt.ldb"
 260
 261     paths.sysvol = lp.get("path", "sysvol")
 262
 263     paths.netlogon = lp.get("path", "netlogon")
 264
 265     return paths
 266
 267
 268 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
 269                 rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None,
 270                 sitename=None):
 271     """Guess configuration settings to use."""
 272
 273     if hostname is None:
 274         hostname = socket.gethostname().split(".")[0].lower()
 275
 276     netbiosname = hostname.upper()
 277     if not valid_netbios_name(netbiosname):
 278         raise InvalidNetbiosName(netbiosname)
 279
 280     hostname = hostname.lower()
 281
 282     if dnsdomain is None:
 283         dnsdomain = lp.get("realm")
 284
 285     if serverrole is None:
 286         serverrole = lp.get("server role")
 287
 288     assert dnsdomain is not None
 289     realm = dnsdomain.upper()
 290
 291     if lp.get("realm").upper() != realm:
 292         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
 293                         (lp.get("realm"), lp.configfile(), realm))
 294
 295     dnsdomain = dnsdomain.lower()
 296
 297     if (serverrole == "domain controller"):
 298         if domain is None:
 299             domain = lp.get("workgroup")
 300         if domaindn is None:
 301             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
 302         if lp.get("workgroup").upper() != domain.upper():
 303             raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
 304                         lp.get("workgroup"), domain)
 305     else:
 306         domain = netbiosname
 307         if domaindn is None:
 308             domaindn = "CN=" + netbiosname
 309
 310     assert domain is not None
 311     domain = domain.upper()
 312     if not valid_netbios_name(domain):
 313         raise InvalidNetbiosName(domain)
 314
 315     if rootdn is None:
 316        rootdn = domaindn
 317
 318     if configdn is None:
 319         configdn = "CN=Configuration," + rootdn
 320     if schemadn is None:
 321         schemadn = "CN=Schema," + configdn
 322
 323     if sitename is None:
 324         sitename=DEFAULTSITE
 325
 326     names = ProvisionNames()
 327     names.rootdn = rootdn
 328     names.domaindn = domaindn
 329     names.configdn = configdn
 330     names.schemadn = schemadn
 331     names.ldapmanagerdn = "CN=Manager," + rootdn
 332     names.dnsdomain = dnsdomain
 333     names.domain = domain
 334     names.realm = realm
 335     names.netbiosname = netbiosname
 336     names.hostname = hostname
 337     names.sitename = sitename
 338     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
 339
 340     return names
 341
 342
 343 def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir):
 344     if targetdir is not None:
 345         if not os.path.exists(targetdir):
 346             os.mkdir(targetdir)
 347         if not os.path.exists(os.path.join(targetdir, "etc")):
 348            os.mkdir(os.path.join(targetdir, "etc"))
 349
 350         smbconf = os.path.join(targetdir, "etc", "smb.conf")
 351
 352     # only install a new smb.conf if there isn't one there already
 353
 354     if not os.path.exists(smbconf):
 355         if hostname is None:
 356             hostname = socket.gethostname().split(".")[0].lower()
 357
 358         if serverrole is None:
 359             serverrole = "standalone"
 360
 361         assert serverrole in ("domain controller", "member server", "standalone")
 362         if serverrole == "domain controller":
 363             smbconfsuffix = "dc"
 364         elif serverrole == "member server":
 365             smbconfsuffix = "member"
 366         elif serverrole == "standalone":
 367             smbconfsuffix = "standalone"
 368
 369         assert domain is not None
 370         assert realm is not None
 371
 372         default_lp = param.LoadParm()
 373         #Load non-existant file
 374         default_lp.load(smbconf)
 375
 376         if targetdir is not None:
 377             privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 378             lockdir_line = "lock dir = " + os.path.abspath(targetdir)
 379
 380             default_lp.set("lock dir", os.path.abspath(targetdir))
 381         else:
 382             privatedir_line = ""
 383             lockdir_line = ""
 384
 385         sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
 386         netlogon = os.path.join(sysvol, realm.lower(), "scripts")
 387
 388         setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix),
 389                    smbconf, {
 390                 "HOSTNAME": hostname,
 391                 "DOMAIN": domain,
 392                 "REALM": realm,
 393                 "SERVERROLE": serverrole,
 394                 "NETLOGONPATH": netlogon,
 395                 "SYSVOLPATH": sysvol,
 396                 "PRIVATEDIR_LINE": privatedir_line,
 397                 "LOCKDIR_LINE": lockdir_line
 398                 })
 399
 400     lp = param.LoadParm()
 401     lp.load(smbconf)
 402
 403     return lp
 404
 405
 406 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
 407                         users_gid, wheel_gid):
 408     """setup reasonable name mappings for sam names to unix names.
 409
 410     :param samdb: SamDB object.
 411     :param idmap: IDmap db object.
 412     :param sid: The domain sid.
 413     :param domaindn: The domain DN.
 414     :param root_uid: uid of the UNIX root user.
 415     :param nobody_uid: uid of the UNIX nobody user.
 416     :param users_gid: gid of the UNIX users group.
 417     :param wheel_gid: gid of the UNIX wheel group."""
 418     # add some foreign sids if they are not present already
 419     samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
 420     samdb.add_foreign(domaindn, "S-1-1-0", "World")
 421     samdb.add_foreign(domaindn, "S-1-5-2", "Network")
 422     samdb.add_foreign(domaindn, "S-1-5-18", "System")
 423     samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
 424
 425     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
 426     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
 427
 428     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
 429     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
 430
 431
 432 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
 433                            credentials, names,
 434                            serverrole, ldap_backend=None,
 435                            ldap_backend_type=None, erase=False):
 436     """Setup the partitions for the SAM database.
 437
 438     Alternatively, provision() may call this, and then populate the database.
 439
 440     :note: This will wipe the Sam Database!
 441
 442     :note: This function always removes the local SAM LDB file. The erase
 443         parameter controls whether to erase the existing data, which
 444         may not be stored locally but in LDAP.
 445     """
 446     assert session_info is not None
 447
 448     samdb = SamDB(samdb_path, session_info=session_info,
 449                   credentials=credentials, lp=lp)
 450
 451     # Wipes the database
 452     try:
 453         samdb.erase()
 454     except:
 455         os.unlink(samdb_path)
 456
 457     samdb = SamDB(samdb_path, session_info=session_info,
 458                   credentials=credentials, lp=lp)
 459
 460     #Add modules to the list to activate them by default
 461     #beware often order is important
 462     #
 463     # Some Known ordering constraints:
 464     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
 465     # - objectclass must be before password_hash, because password_hash checks
 466     #   that the objectclass is of type person (filled in by objectclass
 467     #   module when expanding the objectclass list)
 468     # - partition must be last
 469     # - each partition has its own module list then
 470     modules_list = ["rootdse",
 471                     "paged_results",
 472                     "ranged_results",
 473                     "anr",
 474                     "server_sort",
 475                     "extended_dn",
 476                     "asq",
 477                     "rdn_name",
 478                     "objectclass",
 479                     "samldb",
 480                     "kludge_acl",
 481                     "operational"]
 482     tdb_modules_list = [
 483                     "subtree_rename",
 484                     "subtree_delete",
 485                     "linked_attributes"]
 486     modules_list2 = ["show_deleted",
 487                     "partition"]
 488
 489     domaindn_ldb = "users.ldb"
 490     if ldap_backend is not None:
 491         domaindn_ldb = ldap_backend
 492     configdn_ldb = "configuration.ldb"
 493     if ldap_backend is not None:
 494         configdn_ldb = ldap_backend
 495     schemadn_ldb = "schema.ldb"
 496     if ldap_backend is not None:
 497         schema_ldb = ldap_backend
 498         schemadn_ldb = ldap_backend
 499
 500     if ldap_backend_type == "fedora-ds":
 501         backend_modules = ["nsuniqueid", "paged_searches"]
 502         # We can handle linked attributes here, as we don't have directory-side subtree operations
 503         tdb_modules_list = ["linked_attributes"]
 504     elif ldap_backend_type == "openldap":
 505         backend_modules = ["normalise", "entryuuid", "paged_searches"]
 506         # OpenLDAP handles subtree renames, so we don't want to do any of these things
 507         tdb_modules_list = None
 508     elif serverrole == "domain controller":
 509         backend_modules = ["repl_meta_data"]
 510     else:
 511         backend_modules = ["objectguid"]
 512
 513     if tdb_modules_list is None:
 514         tdb_modules_list_as_string = ""
 515     else:
 516         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
 517
 518     samdb.transaction_start()
 519     try:
 520         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
 521                 "SCHEMADN": names.schemadn,
 522                 "SCHEMADN_LDB": schemadn_ldb,
 523                 "SCHEMADN_MOD2": ",objectguid",
 524                 "CONFIGDN": names.configdn,
 525                 "CONFIGDN_LDB": configdn_ldb,
 526                 "DOMAINDN": names.domaindn,
 527                 "DOMAINDN_LDB": domaindn_ldb,
 528                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
 529                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
 530                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
 531                 "MODULES_LIST": ",".join(modules_list),
 532                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
 533                 "MODULES_LIST2": ",".join(modules_list2),
 534                 "BACKEND_MOD": ",".join(backend_modules),
 535         })
 536
 537     except:
 538         samdb.transaction_cancel()
 539         raise
 540
 541     samdb.transaction_commit()
 542
 543     samdb = SamDB(samdb_path, session_info=session_info,
 544                   credentials=credentials, lp=lp)
 545
 546     samdb.transaction_start()
 547     try:
 548         message("Setting up sam.ldb attributes")
 549         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 550
 551         message("Setting up sam.ldb rootDSE")
 552         setup_samdb_rootdse(samdb, setup_path, names)
 553
 554         if erase:
 555             message("Erasing data from partitions")
 556             samdb.erase_partitions()
 557
 558     except:
 559         samdb.transaction_cancel()
 560         raise
 561
 562     samdb.transaction_commit()
 563
 564     return samdb
 565
 566
 567 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain,
 568                         netbiosname, domainsid, keytab_path, samdb_url,
 569                         dns_keytab_path, dnspass, machinepass):
 570     """Add DC-specific bits to a secrets database.
 571
 572     :param secretsdb: Ldb Handle to the secrets database
 573     :param setup_path: Setup path function
 574     :param machinepass: Machine password
 575     """
 576     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), {
 577             "MACHINEPASS_B64": b64encode(machinepass),
 578             "DOMAIN": domain,
 579             "REALM": realm,
 580             "DNSDOMAIN": dnsdomain,
 581             "DOMAINSID": str(domainsid),
 582             "SECRETS_KEYTAB": keytab_path,
 583             "NETBIOSNAME": netbiosname,
 584             "SAM_LDB": samdb_url,
 585             "DNS_KEYTAB": dns_keytab_path,
 586             "DNSPASS_B64": b64encode(dnspass),
 587             })
 588
 589
 590 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
 591     """Setup the secrets database.
 592
 593     :param path: Path to the secrets database.
 594     :param setup_path: Get the path to a setup file.
 595     :param session_info: Session info.
 596     :param credentials: Credentials
 597     :param lp: Loadparm context
 598     :return: LDB handle for the created secrets database
 599     """
 600     if os.path.exists(path):
 601         os.unlink(path)
 602     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 603                       lp=lp)
 604     secrets_ldb.erase()
 605     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
 606     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 607                       lp=lp)
 608     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
 609     return secrets_ldb
 610
 611
 612 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
 613     """Setup the templates database.
 614
 615     :param path: Path to the database.
 616     :param setup_path: Function for obtaining the path to setup files.
 617     :param session_info: Session info
 618     :param credentials: Credentials
 619     :param lp: Loadparm context
 620     """
 621     templates_ldb = SamDB(path, session_info=session_info,
 622                           credentials=credentials, lp=lp)
 623     templates_ldb.erase()
 624     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
 625
 626
 627 def setup_registry(path, setup_path, session_info, credentials, lp):
 628     """Setup the registry.
 629
 630     :param path: Path to the registry database
 631     :param setup_path: Function that returns the path to a setup.
 632     :param session_info: Session information
 633     :param credentials: Credentials
 634     :param lp: Loadparm context
 635     """
 636     reg = registry.Registry()
 637     hive = registry.open_ldb(path, session_info=session_info,
 638                          credentials=credentials, lp_ctx=lp)
 639     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
 640     provision_reg = setup_path("provision.reg")
 641     assert os.path.exists(provision_reg)
 642     reg.diff_apply(provision_reg)
 643
 644
 645 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
 646     """Setup the idmap database.
 647
 648     :param path: path to the idmap database
 649     :param setup_path: Function that returns a path to a setup file
 650     :param session_info: Session information
 651     :param credentials: Credentials
 652     :param lp: Loadparm context
 653     """
 654     if os.path.exists(path):
 655         os.unlink(path)
 656
 657     idmap_ldb = IDmapDB(path, session_info=session_info,
 658                         credentials=credentials, lp=lp)
 659
 660     idmap_ldb.erase()
 661     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
 662     return idmap_ldb
 663
 664
 665 def setup_samdb_rootdse(samdb, setup_path, names):
 666     """Setup the SamDB rootdse.
 667
 668     :param samdb: Sam Database handle
 669     :param setup_path: Obtain setup path
 670     """
 671     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
 672         "SCHEMADN": names.schemadn,
 673         "NETBIOSNAME": names.netbiosname,
 674         "DNSDOMAIN": names.dnsdomain,
 675         "REALM": names.realm,
 676         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
 677         "DOMAINDN": names.domaindn,
 678         "ROOTDN": names.rootdn,
 679         "CONFIGDN": names.configdn,
 680         "SERVERDN": names.serverdn,
 681         })
 682
 683
 684 def setup_self_join(samdb, names,
 685                     machinepass, dnspass,
 686                     domainsid, invocationid, setup_path,
 687                     policyguid):
 688     """Join a host to its own domain."""
 689     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
 690               "CONFIGDN": names.configdn,
 691               "SCHEMADN": names.schemadn,
 692               "DOMAINDN": names.domaindn,
 693               "INVOCATIONID": invocationid,
 694               "NETBIOSNAME": names.netbiosname,
 695               "DEFAULTSITE": names.sitename,
 696               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
 697               "MACHINEPASS_B64": b64encode(machinepass),
 698               "DNSPASS_B64": b64encode(dnspass),
 699               "REALM": names.realm,
 700               "DOMAIN": names.domain,
 701               "DNSDOMAIN": names.dnsdomain})
 702     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
 703               "POLICYGUID": policyguid,
 704               "DNSDOMAIN": names.dnsdomain,
 705               "DOMAINSID": str(domainsid),
 706               "DOMAINDN": names.domaindn})
 707
 708
 709 def setup_samdb(path, setup_path, session_info, credentials, lp,
 710                 names, message,
 711                 domainsid, aci, domainguid, policyguid,
 712                 fill, adminpass, krbtgtpass,
 713                 machinepass, invocationid, dnspass,
 714                 serverrole, ldap_backend=None,
 715                 ldap_backend_type=None):
 716     """Setup a complete SAM Database.
 717
 718     :note: This will wipe the main SAM database file!
 719     """
 720
 721     erase = (fill != FILL_DRS)
 722
 723     # Also wipes the database
 724     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
 725                            credentials=credentials, session_info=session_info,
 726                            names=names,
 727                            ldap_backend=ldap_backend, serverrole=serverrole,
 728                            ldap_backend_type=ldap_backend_type, erase=erase)
 729
 730     samdb = SamDB(path, session_info=session_info,
 731                   credentials=credentials, lp=lp)
 732
 733     if fill == FILL_DRS:
 734        # We want to finish here, but setup the index before we do so
 735         message("Setting up sam.ldb index")
 736         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
 737         return samdb
 738
 739     message("Pre-loading the Samba 4 and AD schema")
 740     samdb = SamDB(path, session_info=session_info,
 741                   credentials=credentials, lp=lp)
 742     samdb.set_domain_sid(domainsid)
 743     if serverrole == "domain controller":
 744         samdb.set_invocation_id(invocationid)
 745
 746     load_schema(setup_path, samdb, names.schemadn, names.netbiosname, names.configdn, names.sitename)
 747
 748     samdb.transaction_start()
 749
 750     try:
 751         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
 752         if serverrole == "domain controller":
 753             domain_oc = "domainDNS"
 754         else:
 755             domain_oc = "samba4LocalDomain"
 756
 757         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
 758             "DOMAINDN": names.domaindn,
 759             "ACI": aci,
 760             "DOMAIN_OC": domain_oc
 761             })
 762
 763         message("Modifying DomainDN: " + names.domaindn + "")
 764         if domainguid is not None:
 765             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
 766         else:
 767             domainguid_mod = ""
 768
 769         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
 770             "LDAPTIME": timestring(int(time.time())),
 771             "DOMAINSID": str(domainsid),
 772             "SCHEMADN": names.schemadn,
 773             "NETBIOSNAME": names.netbiosname,
 774             "DEFAULTSITE": names.sitename,
 775             "CONFIGDN": names.configdn,
 776             "POLICYGUID": policyguid,
 777             "DOMAINDN": names.domaindn,
 778             "DOMAINGUID_MOD": domainguid_mod,
 779             })
 780
 781         message("Adding configuration container (permitted to fail)")
 782         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
 783             "CONFIGDN": names.configdn,
 784             "ACI": aci,
 785             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
 786             })
 787         message("Modifying configuration container")
 788         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
 789             "CONFIGDN": names.configdn,
 790             "SCHEMADN": names.schemadn,
 791             })
 792
 793         message("Adding schema container (permitted to fail)")
 794         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
 795             "SCHEMADN": names.schemadn,
 796             "ACI": aci,
 797             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
 798             })
 799         message("Modifying schema container")
 800         setup_modify_ldif(samdb,
 801             setup_path("provision_schema_basedn_modify.ldif"), {
 802             "SCHEMADN": names.schemadn,
 803             "NETBIOSNAME": names.netbiosname,
 804             "DEFAULTSITE": names.sitename,
 805             "CONFIGDN": names.configdn,
 806             })
 807
 808         message("Setting up sam.ldb Samba4 schema")
 809         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"),
 810                        {"SCHEMADN": names.schemadn })
 811         message("Setting up sam.ldb AD schema")
 812         setup_add_ldif(samdb, setup_path("schema.ldif"),
 813                        {"SCHEMADN": names.schemadn})
 814
 815         message("Setting up sam.ldb configuration data")
 816         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
 817             "CONFIGDN": names.configdn,
 818             "NETBIOSNAME": names.netbiosname,
 819             "DEFAULTSITE": names.sitename,
 820             "DNSDOMAIN": names.dnsdomain,
 821             "DOMAIN": names.domain,
 822             "SCHEMADN": names.schemadn,
 823             "DOMAINDN": names.domaindn,
 824             })
 825
 826         message("Setting up display specifiers")
 827         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"),
 828                        {"CONFIGDN": names.configdn})
 829
 830         message("Adding users container (permitted to fail)")
 831         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
 832                 "DOMAINDN": names.domaindn})
 833         message("Modifying users container")
 834         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
 835                 "DOMAINDN": names.domaindn})
 836         message("Adding computers container (permitted to fail)")
 837         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
 838                 "DOMAINDN": names.domaindn})
 839         message("Modifying computers container")
 840         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
 841                 "DOMAINDN": names.domaindn})
 842         message("Setting up sam.ldb data")
 843         setup_add_ldif(samdb, setup_path("provision.ldif"), {
 844             "DOMAINDN": names.domaindn,
 845             "NETBIOSNAME": names.netbiosname,
 846             "DEFAULTSITE": names.sitename,
 847             "CONFIGDN": names.configdn,
 848             })
 849
 850         if fill == FILL_FULL:
 851             message("Setting up sam.ldb users and groups")
 852             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
 853                 "DOMAINDN": names.domaindn,
 854                 "DOMAINSID": str(domainsid),
 855                 "CONFIGDN": names.configdn,
 856                 "ADMINPASS_B64": b64encode(adminpass),
 857                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
 858                 })
 859
 860             if serverrole == "domain controller":
 861                 message("Setting up self join")
 862                 setup_self_join(samdb, names=names, invocationid=invocationid,
 863                                 dnspass=dnspass,
 864                                 machinepass=machinepass,
 865                                 domainsid=domainsid, policyguid=policyguid,
 866                                 setup_path=setup_path)
 867
 868     #We want to setup the index last, as adds are faster unindexed
 869         message("Setting up sam.ldb index")
 870         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
 871     except:
 872         samdb.transaction_cancel()
 873         raise
 874
 875     samdb.transaction_commit()
 876     return samdb
 877
 878
 879 FILL_FULL = "FULL"
 880 FILL_NT4SYNC = "NT4SYNC"
 881 FILL_DRS = "DRS"
 882
 883 def provision(setup_dir, message, session_info,
 884               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None,
 885               rootdn=None, domaindn=None, schemadn=None, configdn=None,
 886               serverdn=None,
 887               domain=None, hostname=None, hostip=None, hostip6=None,
 888               domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None,
 889               policyguid=None, invocationid=None, machinepass=None,
 890               dnspass=None, root=None, nobody=None, nogroup=None, users=None,
 891               wheel=None, backup=None, aci=None, serverrole=None,
 892               ldap_backend=None, ldap_backend_type=None, sitename=None):
 893     """Provision samba4
 894
 895     :note: caution, this wipes all existing data!
 896     """
 897
 898     def setup_path(file):
 899         return os.path.join(setup_dir, file)
 900
 901     if domainsid is None:
 902         domainsid = security.random_sid()
 903     else:
 904         domainsid = security.Sid(domainsid)
 905
 906     if policyguid is None:
 907         policyguid = uuid.random()
 908     if adminpass is None:
 909         adminpass = misc.random_password(12)
 910     if krbtgtpass is None:
 911         krbtgtpass = misc.random_password(12)
 912     if machinepass is None:
 913         machinepass  = misc.random_password(12)
 914     if dnspass is None:
 915         dnspass = misc.random_password(12)
 916     if root is None:
 917         root_uid = findnss(pwd.getpwnam, ["root"])[2]
 918     else:
 919         root_uid = findnss(pwd.getpwnam, [root])[2]
 920     if nobody is None:
 921         nobody_uid = findnss(pwd.getpwnam, ["nobody"])[2]
 922     else:
 923         nobody_uid = findnss(pwd.getpwnam, [nobody])[2]
 924     if users is None:
 925         users_gid = findnss(grp.getgrnam, ["users"])[2]
 926     else:
 927         users_gid = findnss(grp.getgrnam, [users])[2]
 928     if wheel is None:
 929         wheel_gid = findnss(grp.getgrnam, ["wheel", "adm"])[2]
 930     else:
 931         wheel_gid = findnss(grp.getgrnam, [wheel])[2]
 932     if aci is None:
 933         aci = "# no aci for local ldb"
 934
 935     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
 936
 937     names = guess_names(lp=lp, hostname=hostname, domain=domain,
 938                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
 939                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
 940                         serverdn=serverdn)
 941
 942     paths = provision_paths_from_lp(lp, names.dnsdomain)
 943
 944     if hostip is None:
 945         hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 946
 947     if hostip6 is None:
 948         try:
 949             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 950         except socket.gaierror: pass
 951
 952     if serverrole is None:
 953         serverrole = lp.get("server role")
 954
 955     assert serverrole in ("domain controller", "member server", "standalone")
 956     if invocationid is None and serverrole == "domain controller":
 957         invocationid = uuid.random()
 958
 959     if not os.path.exists(paths.private_dir):
 960         os.mkdir(paths.private_dir)
 961
 962     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
 963
 964     if ldap_backend is not None:
 965         if ldap_backend == "ldapi":
 966             # provision-backend will set this path suggested slapd command line / fedorads.inf
 967             ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
 968
 969     # only install a new shares config db if there is none
 970     if not os.path.exists(paths.shareconf):
 971         message("Setting up share.ldb")
 972         share_ldb = Ldb(paths.shareconf, session_info=session_info,
 973                         credentials=credentials, lp=lp)
 974         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
 975
 976
 977     message("Setting up secrets.ldb")
 978     secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
 979                                   session_info=session_info,
 980                                   credentials=credentials, lp=lp)
 981
 982     message("Setting up the registry")
 983     setup_registry(paths.hklm, setup_path, session_info,
 984                    credentials=credentials, lp=lp)
 985
 986     message("Setting up templates db")
 987     setup_templatesdb(paths.templates, setup_path, session_info=session_info,
 988                       credentials=credentials, lp=lp)
 989
 990     message("Setting up idmap db")
 991     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
 992                           credentials=credentials, lp=lp)
 993
 994     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info,
 995                         credentials=credentials, lp=lp, names=names,
 996                         message=message,
 997                         domainsid=domainsid,
 998                         aci=aci, domainguid=domainguid, policyguid=policyguid,
 999                         fill=samdb_fill,
1000                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1001                         invocationid=invocationid,
1002                         machinepass=machinepass, dnspass=dnspass,
1003                         serverrole=serverrole, ldap_backend=ldap_backend,
1004                         ldap_backend_type=ldap_backend_type)
1005
1006     if lp.get("server role") == "domain controller":
1007        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1008                                   "{" + policyguid + "}")
1009        os.makedirs(policy_path, 0755)
1010        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1011        os.makedirs(os.path.join(policy_path, "User"), 0755)
1012        if not os.path.isdir(paths.netlogon):
1013             os.makedirs(paths.netlogon, 0755)
1014        secrets_ldb = Ldb(paths.secrets, session_info=session_info,
1015                          credentials=credentials, lp=lp)
1016        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1017                            netbiosname=names.netbiosname, domainsid=domainsid,
1018                            keytab_path=paths.keytab, samdb_url=paths.samdb,
1019                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
1020                            machinepass=machinepass, dnsdomain=names.dnsdomain)
1021
1022     if samdb_fill == FILL_FULL:
1023         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1024                             root_uid=root_uid, nobody_uid=nobody_uid,
1025                             users_gid=users_gid, wheel_gid=wheel_gid)
1026
1027         message("Setting up sam.ldb rootDSE marking as synchronized")
1028         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1029
1030         # Only make a zone file on the first DC, it should be replicated with DNS replication
1031         if serverrole == "domain controller":
1032             samdb = SamDB(paths.samdb, session_info=session_info,
1033                       credentials=credentials, lp=lp)
1034
1035             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1036             assert isinstance(domainguid, str)
1037             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1038                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1039                                        scope=SCOPE_SUBTREE)
1040             assert isinstance(hostguid, str)
1041
1042             create_zone_file(paths.dns, setup_path, samdb,
1043                              hostname=names.hostname, hostip=hostip,
1044                              hostip6=hostip6, dnsdomain=names.dnsdomain,
1045                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm,
1046                              domainguid=domainguid, hostguid=hostguid)
1047             message("Please install the zone located in %s into your DNS server" % paths.dns)
1048
1049     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path,
1050                                ldapi_url)
1051
1052     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1053
1054     message("Once the above files are installed, your Samba4 server will be ready to use")
1055     message("Server Role:    %s" % serverrole)
1056     message("Hostname:       %s" % names.hostname)
1057     message("NetBIOS Domain: %s" % names.domain)
1058     message("DNS Domain:     %s" % names.dnsdomain)
1059     message("DOMAIN SID:     %s" % str(domainsid))
1060     message("Admin password: %s" % adminpass)
1061
1062     result = ProvisionResult()
1063     result.domaindn = domaindn
1064     result.paths = paths
1065     result.lp = lp
1066     result.samdb = samdb
1067     return result
1068
1069
1070 def provision_become_dc(setup_dir=None,
1071                         smbconf=None, targetdir=None, realm=None,
1072                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1073                         serverdn=None,
1074                         domain=None, hostname=None, domainsid=None,
1075                         adminpass=None, krbtgtpass=None, domainguid=None,
1076                         policyguid=None, invocationid=None, machinepass=None,
1077                         dnspass=None, root=None, nobody=None, nogroup=None, users=None,
1078                         wheel=None, backup=None, aci=None, serverrole=None,
1079                         ldap_backend=None, ldap_backend_type=None, sitename=None):
1080
1081     def message(text):
1082         """print a message if quiet is not set."""
1083         print text
1084
1085     return provision(setup_dir, message, system_session(), None,
1086               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
1087               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
1088               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
1089
1090
1091 def setup_db_config(setup_path, dbdir):
1092     """Setup a Berkeley database.
1093
1094     :param setup_path: Setup path function.
1095     :param dbdir: Database directory."""
1096     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1097         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
1098     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1099         os.makedirs(os.path.join(dbdir, "tmp"), 0700);
1100
1101     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1102                {"LDAPDBDIR": dbdir})
1103
1104
1105
1106 def provision_backend(setup_dir=None, message=None,
1107                       smbconf=None, targetdir=None, realm=None,
1108                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1109                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
1110                       ldap_backend_type=None, ldap_backend_port=None):
1111
1112     def setup_path(file):
1113         return os.path.join(setup_dir, file)
1114
1115     if hostname is None:
1116         hostname = socket.gethostname().split(".")[0].lower()
1117
1118     if root is None:
1119         root = findnss(pwd.getpwnam, ["root"])[0]
1120
1121     lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
1122
1123     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1124                         dnsdomain=realm, serverrole=serverrole,
1125                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
1126
1127     paths = provision_paths_from_lp(lp, names.dnsdomain)
1128
1129     if not os.path.isdir(paths.ldapdir):
1130         os.makedirs(paths.ldapdir)
1131     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1132     try:
1133         os.unlink(schemadb_path)
1134     except:
1135         pass
1136
1137     schemadb = Ldb(schemadb_path, lp=lp)
1138
1139     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"),
1140                    {"SCHEMADN": names.schemadn,
1141                     "ACI": "#",
1142                     "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
1143                     })
1144     setup_modify_ldif(schemadb,
1145                       setup_path("provision_schema_basedn_modify.ldif"), \
1146                           {"SCHEMADN": names.schemadn,
1147                            "NETBIOSNAME": names.netbiosname,
1148                            "DEFAULTSITE": DEFAULTSITE,
1149                            "CONFIGDN": names.configdn,
1150                            })
1151
1152     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
1153                    {"SCHEMADN": names.schemadn })
1154     setup_add_ldif(schemadb, setup_path("schema.ldif"),
1155                    {"SCHEMADN": names.schemadn})
1156
1157     if ldap_backend_type == "fedora-ds":
1158         if ldap_backend_port is not None:
1159             serverport = "ServerPort=%d" % ldap_backend_port
1160         else:
1161             serverport = ""
1162
1163         setup_file(setup_path("fedorads.inf"), paths.fedoradsinf,
1164                    {"ROOT": root,
1165                     "HOSTNAME": hostname,
1166                     "DNSDOMAIN": names.dnsdomain,
1167                     "LDAPDIR": paths.ldapdir,
1168                     "DOMAINDN": names.domaindn,
1169                     "LDAPMANAGERDN": names.ldapmanagerdn,
1170                     "LDAPMANAGERPASS": adminpass,
1171                     "SERVERPORT": serverport})
1172
1173         setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions,
1174                    {"CONFIGDN": names.configdn,
1175                     "SCHEMADN": names.schemadn,
1176                     })
1177
1178         mapping = "schema-map-fedora-ds-1.0"
1179         backend_schema = "99_ad.ldif"
1180
1181         slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
1182
1183     elif ldap_backend_type == "openldap":
1184         attrs = ["linkID", "lDAPDisplayName"]
1185         res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
1186
1187         memberof_config = "# Generated from schema in " + schemadb_path + "\n";
1188         refint_attributes = "";
1189         for i in range (0, len(res)):
1190             linkid = res[i]["linkID"][0]
1191             linkid = str(int(linkid) + 1)
1192             expression = "(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))"
1193             target = schemadb.searchone(basedn=names.schemadn,
1194                                         expression=expression,
1195                                         attribute="lDAPDisplayName",
1196                                         scope=SCOPE_SUBTREE);
1197             if target is not None:
1198                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0];
1199                 memberof_config = memberof_config + """overlay memberof
1200 memberof-dangling error
1201 memberof-refint TRUE
1202 memberof-group-oc top
1203 memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
1204 memberof-memberof-ad """ + target + """
1205 memberof-dangling-error 32
1206
1207 """;
1208
1209         memberof_config = memberof_config + """
1210 overlay refint
1211 refint_attributes""" + refint_attributes + "\n";
1212
1213         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1214                    {"DNSDOMAIN": names.dnsdomain,
1215                     "LDAPDIR": paths.ldapdir,
1216                     "DOMAINDN": names.domaindn,
1217                     "CONFIGDN": names.configdn,
1218                     "SCHEMADN": names.schemadn,
1219                     "LDAPMANAGERDN": names.ldapmanagerdn,
1220                     "LDAPMANAGERPASS": adminpass,
1221                     "MEMBEROF_CONFIG": memberof_config})
1222         setup_file(setup_path("modules.conf"), paths.modulesconf,
1223                    {"REALM": names.realm})
1224
1225         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "user"))
1226         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "config"))
1227         setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "schema"))
1228         mapping = "schema-map-openldap-2.3"
1229         backend_schema = "backend-schema.schema"
1230
1231         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1232         if ldap_backend_port is not None:
1233             server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
1234         else:
1235             server_port_string = ""
1236         slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
1237
1238     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
1239
1240     os.system(schema_command)
1241
1242
1243     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ( ldap_backend_type) )
1244     message("Server Role:         %s" % serverrole)
1245     message("Hostname:            %s" % names.hostname)
1246     message("DNS Domain:          %s" % names.dnsdomain)
1247     message("Base DN:             %s" % names.domaindn)
1248     message("LDAP admin DN:       %s" % names.ldapmanagerdn)
1249     message("LDAP admin password: %s" % adminpass)
1250     message(slapdcommand)
1251
1252
1253 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1254     """Create a PHP LDAP admin configuration file.
1255
1256     :param path: Path to write the configuration to.
1257     :param setup_path: Function to generate setup paths.
1258     """
1259     setup_file(setup_path("phpldapadmin-config.php"), path,
1260             {"S4_LDAPI_URI": ldapi_uri})
1261
1262
1263 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
1264                   hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
1265     """Write out a DNS zone file, from the info in the current database.
1266
1267     :param path: Path of the new file.
1268     :param setup_path": Setup path function.
1269     :param samdb: SamDB object
1270     :param dnsdomain: DNS Domain name
1271     :param domaindn: DN of the Domain
1272     :param hostip: Local IPv4 IP
1273     :param hostip6: Local IPv6 IP
1274     :param hostname: Local hostname
1275     :param dnspass: Password for DNS
1276     :param realm: Realm name
1277     :param domainguid: GUID of the domain.
1278     :param hostguid: GUID of the host.
1279     """
1280     assert isinstance(domainguid, str)
1281
1282     hostip6_base_line = ""
1283     hostip6_host_line = ""
1284
1285     if hostip6 is not None:
1286         hostip6_base_line = "                   IN AAAA " + hostip6
1287         hostip6_host_line = hostname + "                IN AAAA " + hostip6
1288
1289     setup_file(setup_path("provision.zone"), path, {
1290             "DNSPASS_B64": b64encode(dnspass),
1291             "HOSTNAME": hostname,
1292             "DNSDOMAIN": dnsdomain,
1293             "REALM": realm,
1294             "HOSTIP": hostip,
1295             "DOMAINGUID": domainguid,
1296             "DATESTRING": time.strftime("%Y%m%d%H"),
1297             "DEFAULTSITE": DEFAULTSITE,
1298             "HOSTGUID": hostguid,
1299             "HOSTIP6_BASE_LINE": hostip6_base_line,
1300             "HOSTIP6_HOST_LINE": hostip6_host_line,
1301         })
1302
1303 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
1304     """Load schema for the SamDB.
1305
1306     :param samdb: Load a schema into a SamDB.
1307     :param setup_path: Setup path function.
1308     :param schemadn: DN of the schema
1309     :param netbiosname: NetBIOS name of the host.
1310     :param configdn: DN of the configuration
1311     """
1312     schema_data = open(setup_path("schema.ldif"), 'r').read()
1313     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1314     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1315     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1316     head_data = substitute_var(head_data, {
1317                     "SCHEMADN": schemadn,
1318                     "NETBIOSNAME": netbiosname,
1319                     "CONFIGDN": configdn,
1320                     "DEFAULTSITE":sitename
1321     })
1322     samdb.attach_schema_from_ldif(head_data, schema_data)
1323