s4-rodc: enable the DRS_GET_ALL_GROUP_MEMBERSHIP flag for RODC replication

[kai/samba.git] / source4 / scripting / python / samba / join.py

diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
index bdd63db7181000b99b46983d2be46c671beaab55..deeedc5ad38f99885966fd2ca4ac44e2ed86b78a 100644 (file)
--- a/source4/scripting/python/samba/join.py
+++ b/source4/scripting/python/samba/join.py
@@ -233,7 +233,10 @@ class dc_join:
 
     def drsuapi_connect(ctx):
         '''make a DRSUAPI connection to the server'''
-        binding_string = "ncacn_ip_tcp:%s[seal]" % ctx.server
+        binding_options = "seal"
+        if ctx.lp.get("log level") >= 5:
+            binding_options += ",print"
+        binding_string = "ncacn_ip_tcp:%s[%s]" % (ctx.server, binding_options)
         ctx.drsuapi = drsuapi.drsuapi(binding_string, ctx.lp, ctx.creds)
         (ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_utils.drs_DsBind(ctx.drsuapi)
 
@@ -291,7 +294,12 @@ class dc_join:
         req2.first_object = first_object
 
         (level, ctr) = ctx.drsuapi.DsAddEntry(ctx.drsuapi_handle, 2, req2)
-
+        if ctr.err_ver != 1:
+            raise RuntimeError("expected err_ver 1, got %u" % ctr.err_ver)
+        if ctr.err_data.status != (0, 'WERR_OK'):
+            print("DsAddEntry failed with status %s info %s" % (ctr.err_data.status,
+                                                                ctr.err_data.info.extended_err))
+            raise RuntimeError("DsAddEntry failed")
 
     def join_add_objects(ctx):
         '''add the various objects needed for the join'''
@@ -301,9 +309,9 @@ class dc_join:
             "objectClass": "computer",
             "displayname": ctx.samname,
             "samaccountname" : ctx.samname,
-            "userAccountControl" : str(ctx.userAccountControl),
+            "userAccountControl" : str(ctx.userAccountControl | samba.dsdb.UF_ACCOUNTDISABLE),
             "dnshostname" : ctx.dnshostname}
-        if ctx.behavior_version >= samba.dsdb.DS_DOMAIN_FUNCTION_2003:
+        if ctx.behavior_version >= samba.dsdb.DS_DOMAIN_FUNCTION_2008:
             rec['msDS-SupportedEncryptionTypes'] = str(samba.dsdb.ENC_ALL_TYPES)
         if ctx.managedby:
             rec["managedby"] = ctx.managedby
@@ -337,6 +345,8 @@ class dc_join:
 
         if ctx.behavior_version >= samba.dsdb.DS_DOMAIN_FUNCTION_2003:
             rec["msDS-Behavior-Version"] = str(ctx.behavior_version)
+
+        if ctx.behavior_version >= samba.dsdb.DS_DOMAIN_FUNCTION_2003:
             rec["msDS-HasDomainNCs"] = ctx.base_dn
 
         if ctx.RODC:
@@ -394,6 +404,13 @@ class dc_join:
         res = ctx.samdb.search(base=ctx.acct_dn, scope=ldb.SCOPE_BASE, attrs=["msDS-keyVersionNumber"])
         ctx.key_version_number = int(res[0]["msDS-keyVersionNumber"][0])
 
+        print("Enabling account")
+        m = ldb.Message()
+        m.dn = ldb.Dn(ctx.samdb, ctx.acct_dn)
+        m["userAccountControl"] = ldb.MessageElement(str(ctx.userAccountControl),
+                                                     ldb.FLAG_MOD_REPLACE,
+                                                     "userAccountControl")
+        ctx.samdb.modify(m)
 
     def join_provision(ctx):
         '''provision the local SAM'''
@@ -437,7 +454,11 @@ class dc_join:
         else:
             repl_creds = ctx.creds
 
-        repl = drs_utils.drs_Replicate("ncacn_ip_tcp:%s[seal]" % ctx.server, ctx.lp, repl_creds, ctx.local_samdb)
+        binding_options = "seal"
+        if ctx.lp.get("debug level") >= 5:
+            binding_options += ",print"
+        repl = drs_utils.drs_Replicate("ncacn_ip_tcp:%s[%s]" % (ctx.server, binding_options),
+                                       ctx.lp, repl_creds, ctx.local_samdb)
 
         repl.replicate(ctx.schema_dn, source_dsa_invocation_id, destination_dsa_guid,
                        schema=True, rodc=ctx.RODC,
@@ -524,7 +545,8 @@ def join_RODC(server=None, creds=None, lp=None, site=None, netbios_name=None,
                            drsuapi.DRSUAPI_DRS_PER_SYNC |
                            drsuapi.DRSUAPI_DRS_GET_ANC |
                            drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
-                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
+                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
+                           drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
     ctx.do_join()