PEP8: fix E225: missing whitespace around operator
[nivanova/samba-autobuild/.git] / python / samba / netcmd / fsmo.py
1 # Changes a FSMO role owner
2 #
3 # Copyright Nadezhda Ivanova 2009
4 # Copyright Jelmer Vernooij 2009
5 #
6 # This program is free software; you can redistribute it and/or modify
7 # it under the terms of the GNU General Public License as published by
8 # the Free Software Foundation; either version 3 of the License, or
9 # (at your option) any later version.
10 #
11 # This program is distributed in the hope that it will be useful,
12 # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 # GNU General Public License for more details.
15 #
16 # You should have received a copy of the GNU General Public License
17 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 #
19
20 import samba
21 import samba.getopt as options
22 import ldb
23 from ldb import LdbError
24 from samba.dcerpc import drsuapi, misc
25 from samba.auth import system_session
26 from samba.netcmd import (
27     Command,
28     CommandError,
29     SuperCommand,
30     Option,
31 )
32 from samba.samdb import SamDB
33
34 def get_fsmo_roleowner(samdb, roledn, role):
35     """Gets the owner of an FSMO role
36
37     :param roledn: The DN of the FSMO role
38     :param role: The FSMO role
39     """
40     try:
41         res = samdb.search(roledn,
42                            scope=ldb.SCOPE_BASE, attrs=["fSMORoleOwner"])
43     except LdbError as e7:
44         (num, msg) = e7.args
45         if num == ldb.ERR_NO_SUCH_OBJECT:
46             raise CommandError("The '%s' role is not present in this domain" % role)
47         raise
48
49     if 'fSMORoleOwner' in res[0]:
50         master_owner = (ldb.Dn(samdb, res[0]["fSMORoleOwner"][0].decode('utf8')))
51     else:
52         master_owner = None
53
54     return master_owner
55
56
57 def transfer_dns_role(outf, sambaopts, credopts, role, samdb):
58     """Transfer dns FSMO role. """
59
60     if role == "domaindns":
61         domain_dn = samdb.domain_dn()
62         role_object = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
63     elif role == "forestdns":
64         forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
65         role_object = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
66
67     res = samdb.search(role_object,
68                        attrs=["fSMORoleOwner"],
69                        scope=ldb.SCOPE_BASE,
70                        controls=["extended_dn:1:1"])
71
72     if 'fSMORoleOwner' in res[0]:
73         try:
74             master_guid = str(misc.GUID(ldb.Dn(samdb,
75                                                res[0]['fSMORoleOwner'][0].decode('utf8'))
76                                         .get_extended_component('GUID')))
77             master_owner = str(ldb.Dn(samdb, res[0]['fSMORoleOwner'][0].decode('utf8')))
78         except LdbError as e3:
79             (num, msg) = e3.args
80             raise CommandError("No GUID found in naming master DN %s : %s \n" %
81                                (res[0]['fSMORoleOwner'][0], msg))
82     else:
83         outf.write("* The '%s' role does not have an FSMO roleowner\n" % role)
84         return False
85
86     if role == "domaindns":
87         master_dns_name = '%s._msdcs.%s' % (master_guid,
88                                             samdb.domain_dns_name())
89         new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
90                                          samdb.domain_dns_name())
91     elif role == "forestdns":
92         master_dns_name = '%s._msdcs.%s' % (master_guid,
93                                             samdb.forest_dns_name())
94         new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
95                                          samdb.forest_dns_name())
96
97     new_owner = samdb.get_dsServiceName()
98
99     if master_dns_name != new_dns_name:
100         lp = sambaopts.get_loadparm()
101         creds = credopts.get_credentials(lp, fallback_machine=True)
102         samdb = SamDB(url="ldap://%s" % (master_dns_name),
103                       session_info=system_session(),
104                       credentials=creds, lp=lp)
105
106         m = ldb.Message()
107         m.dn = ldb.Dn(samdb, role_object)
108         m["fSMORoleOwner"] = ldb.MessageElement(master_owner,
109                                                 ldb.FLAG_MOD_DELETE,
110                                                 "fSMORoleOwner")
111
112         try:
113             samdb.modify(m)
114         except LdbError as e4:
115             (num, msg) = e4.args
116             raise CommandError("Failed to delete role '%s': %s" %
117                                (role, msg))
118
119         m = ldb.Message()
120         m.dn = ldb.Dn(samdb, role_object)
121         m["fSMORoleOwner"] = ldb.MessageElement(new_owner,
122                                                ldb.FLAG_MOD_ADD,
123                                                "fSMORoleOwner")
124         try:
125             samdb.modify(m)
126         except LdbError as e5:
127             (num, msg) = e5.args
128             raise CommandError("Failed to add role '%s': %s" % (role, msg))
129
130         try:
131             connection = samba.drs_utils.drsuapi_connect(samdb.host_dns_name(),
132                                                          lp, creds)
133         except samba.drs_utils.drsException as e:
134             raise CommandError("Drsuapi Connect failed", e)
135
136         try:
137             drsuapi_connection = connection[0]
138             drsuapi_handle = connection[1]
139             req_options = drsuapi.DRSUAPI_DRS_WRIT_REP
140             NC = role_object[18:]
141             samba.drs_utils.sendDsReplicaSync(drsuapi_connection,
142                                               drsuapi_handle,
143                                               master_guid,
144                                               NC, req_options)
145         except samba.drs_utils.drsException as estr:
146             raise CommandError("Replication failed", estr)
147
148         outf.write("FSMO transfer of '%s' role successful\n" % role)
149         return True
150     else:
151         outf.write("This DC already has the '%s' FSMO role\n" % role)
152         return False
153
154 def transfer_role(outf, role, samdb):
155     """Transfer standard FSMO role. """
156
157     domain_dn = samdb.domain_dn()
158     rid_dn = "CN=RID Manager$,CN=System," + domain_dn
159     naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
160     infrastructure_dn = "CN=Infrastructure," + domain_dn
161     schema_dn = str(samdb.get_schema_basedn())
162     new_owner = ldb.Dn(samdb, samdb.get_dsServiceName())
163     m = ldb.Message()
164     m.dn = ldb.Dn(samdb, "")
165     if role == "rid":
166         master_owner = get_fsmo_roleowner(samdb, rid_dn, role)
167         m["becomeRidMaster"] = ldb.MessageElement(
168             "1", ldb.FLAG_MOD_REPLACE,
169             "becomeRidMaster")
170     elif role == "pdc":
171         master_owner = get_fsmo_roleowner(samdb, domain_dn, role)
172
173         res = samdb.search(domain_dn,
174                            scope=ldb.SCOPE_BASE, attrs=["objectSid"])
175         assert len(res) == 1
176         sid = res[0]["objectSid"][0]
177         m["becomePdc"] = ldb.MessageElement(
178             sid, ldb.FLAG_MOD_REPLACE,
179             "becomePdc")
180     elif role == "naming":
181         master_owner = get_fsmo_roleowner(samdb, naming_dn, role)
182         m["becomeDomainMaster"] = ldb.MessageElement(
183             "1", ldb.FLAG_MOD_REPLACE,
184             "becomeDomainMaster")
185     elif role == "infrastructure":
186         master_owner = get_fsmo_roleowner(samdb, infrastructure_dn, role)
187         m["becomeInfrastructureMaster"] = ldb.MessageElement(
188             "1", ldb.FLAG_MOD_REPLACE,
189             "becomeInfrastructureMaster")
190     elif role == "schema":
191         master_owner = get_fsmo_roleowner(samdb, schema_dn, role)
192         m["becomeSchemaMaster"] = ldb.MessageElement(
193             "1", ldb.FLAG_MOD_REPLACE,
194             "becomeSchemaMaster")
195     else:
196         raise CommandError("Invalid FSMO role.")
197
198     if master_owner is None:
199         outf.write("Cannot transfer, no DC assigned to the %s role.  Try 'seize' instead\n" % role)
200         return False
201
202     if master_owner != new_owner:
203         try:
204             samdb.modify(m)
205         except LdbError as e6:
206             (num, msg) = e6.args
207             raise CommandError("Transfer of '%s' role failed: %s" %
208                                (role, msg))
209
210         outf.write("FSMO transfer of '%s' role successful\n" % role)
211         return True
212     else:
213         outf.write("This DC already has the '%s' FSMO role\n" % role)
214         return False
215
216 class cmd_fsmo_seize(Command):
217     """Seize the role."""
218
219     synopsis = "%prog [options]"
220
221     takes_optiongroups = {
222         "sambaopts": options.SambaOptions,
223         "credopts": options.CredentialsOptions,
224         "versionopts": options.VersionOptions,
225     }
226
227     takes_options = [
228         Option("-H", "--URL", help="LDB URL for database or target server",
229                type=str, metavar="URL", dest="H"),
230         Option("--force",
231                help="Force seizing of role without attempting to transfer.",
232                action="store_true"),
233         Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
234                                                  "schema", "naming", "domaindns", "forestdns", "all"],
235                help="""The FSMO role to seize or transfer.\n
236 rid=RidAllocationMasterRole\n
237 schema=SchemaMasterRole\n
238 pdc=PdcEmulationMasterRole\n
239 naming=DomainNamingMasterRole\n
240 infrastructure=InfrastructureMasterRole\n
241 domaindns=DomainDnsZonesMasterRole\n
242 forestdns=ForestDnsZonesMasterRole\n
243 all=all of the above\n
244 You must provide an Admin user and password."""),
245     ]
246
247     takes_args = []
248
249     def seize_role(self, role, samdb, force):
250         """Seize standard fsmo role. """
251
252         serviceName = samdb.get_dsServiceName()
253         domain_dn = samdb.domain_dn()
254         self.infrastructure_dn = "CN=Infrastructure," + domain_dn
255         self.naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
256         self.schema_dn = str(samdb.get_schema_basedn())
257         self.rid_dn = "CN=RID Manager$,CN=System," + domain_dn
258
259         m = ldb.Message()
260         if role == "rid":
261             m.dn = ldb.Dn(samdb, self.rid_dn)
262         elif role == "pdc":
263             m.dn = ldb.Dn(samdb, domain_dn)
264         elif role == "naming":
265             m.dn = ldb.Dn(samdb, self.naming_dn)
266         elif role == "infrastructure":
267             m.dn = ldb.Dn(samdb, self.infrastructure_dn)
268         elif role == "schema":
269             m.dn = ldb.Dn(samdb, self.schema_dn)
270         else:
271             raise CommandError("Invalid FSMO role.")
272         #first try to transfer to avoid problem if the owner is still active
273         seize = False
274         master_owner = get_fsmo_roleowner(samdb, m.dn, role)
275         # if there is a different owner
276         if master_owner is not None:
277             # if there is a different owner
278             if master_owner != serviceName:
279                 # if --force isn't given, attempt transfer
280                 if force is None:
281                     self.message("Attempting transfer...")
282                     try:
283                         transfer_role(self.outf, role, samdb)
284                     except:
285                         #transfer failed, use the big axe...
286                         seize = True
287                         self.message("Transfer unsuccessful, seizing...")
288                     else:
289                         self.message("Transfer successful, not seizing role")
290                         return True
291             else:
292                 self.outf.write("This DC already has the '%s' FSMO role\n" %
293                                 role)
294                 return False
295         else:
296             seize = True
297
298         if force is not None or seize == True:
299             self.message("Seizing %s FSMO role..." % role)
300             m["fSMORoleOwner"] = ldb.MessageElement(
301                 serviceName, ldb.FLAG_MOD_REPLACE,
302                 "fSMORoleOwner")
303
304             samdb.transaction_start()
305             try:
306                 samdb.modify(m)
307                 if role == "rid":
308                     # We may need to allocate the initial RID Set
309                     samdb.create_own_rid_set()
310
311             except LdbError as e1:
312                 (num, msg) = e1.args
313                 if role == "rid" and num == ldb.ERR_ENTRY_ALREADY_EXISTS:
314
315                     # Try again without the RID Set allocation
316                     # (normal).  We have to manage the transaction as
317                     # we do not have nested transactions and creating
318                     # a RID set touches multiple objects. :-(
319                     samdb.transaction_cancel()
320                     samdb.transaction_start()
321                     try:
322                         samdb.modify(m)
323                     except LdbError as e:
324                         (num, msg) = e.args
325                         samdb.transaction_cancel()
326                         raise CommandError("Failed to seize '%s' role: %s" %
327                                            (role, msg))
328
329                 else:
330                     samdb.transaction_cancel()
331                     raise CommandError("Failed to seize '%s' role: %s" %
332                                        (role, msg))
333             samdb.transaction_commit()
334             self.outf.write("FSMO seize of '%s' role successful\n" % role)
335
336             return True
337
338     def seize_dns_role(self, role, samdb, credopts, sambaopts,
339                        versionopts, force):
340         """Seize DNS FSMO role. """
341
342         serviceName = samdb.get_dsServiceName()
343         domain_dn = samdb.domain_dn()
344         forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
345         self.domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
346         self.forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
347
348         m = ldb.Message()
349         if role == "domaindns":
350             m.dn = ldb.Dn(samdb, self.domaindns_dn)
351         elif role == "forestdns":
352             m.dn = ldb.Dn(samdb, self.forestdns_dn)
353         else:
354             raise CommandError("Invalid FSMO role.")
355         #first try to transfer to avoid problem if the owner is still active
356         seize = False
357         master_owner = get_fsmo_roleowner(samdb, m.dn, role)
358         if master_owner is not None:
359             # if there is a different owner
360             if master_owner != serviceName:
361                 # if --force isn't given, attempt transfer
362                 if force is None:
363                     self.message("Attempting transfer...")
364                     try:
365                         transfer_dns_role(self.outf, sambaopts, credopts, role,
366                                           samdb)
367                     except:
368                         #transfer failed, use the big axe...
369                         seize = True
370                         self.message("Transfer unsuccessful, seizing...")
371                     else:
372                         self.message("Transfer successful, not seizing role\n")
373                         return True
374             else:
375                 self.outf.write("This DC already has the '%s' FSMO role\n" %
376                                 role)
377                 return False
378         else:
379             seize = True
380
381         if force is not None or seize == True:
382             self.message("Seizing %s FSMO role..." % role)
383             m["fSMORoleOwner"] = ldb.MessageElement(
384                 serviceName, ldb.FLAG_MOD_REPLACE,
385                 "fSMORoleOwner")
386             try:
387                 samdb.modify(m)
388             except LdbError as e2:
389                 (num, msg) = e2.args
390                 raise CommandError("Failed to seize '%s' role: %s" %
391                                    (role, msg))
392             self.outf.write("FSMO seize of '%s' role successful\n" % role)
393             return True
394
395
396     def run(self, force=None, H=None, role=None,
397             credopts=None, sambaopts=None, versionopts=None):
398
399         lp = sambaopts.get_loadparm()
400         creds = credopts.get_credentials(lp, fallback_machine=True)
401
402         samdb = SamDB(url=H, session_info=system_session(),
403                       credentials=creds, lp=lp)
404
405         if role == "all":
406             self.seize_role("rid", samdb, force)
407             self.seize_role("pdc", samdb, force)
408             self.seize_role("naming", samdb, force)
409             self.seize_role("infrastructure", samdb, force)
410             self.seize_role("schema", samdb, force)
411             self.seize_dns_role("domaindns", samdb, credopts, sambaopts,
412                                 versionopts, force)
413             self.seize_dns_role("forestdns", samdb, credopts, sambaopts,
414                                 versionopts, force)
415         else:
416             if role == "domaindns" or role == "forestdns":
417                 self.seize_dns_role(role, samdb, credopts, sambaopts,
418                                     versionopts, force)
419             else:
420                 self.seize_role(role, samdb, force)
421
422
423 class cmd_fsmo_show(Command):
424     """Show the roles."""
425
426     synopsis = "%prog [options]"
427
428     takes_optiongroups = {
429         "sambaopts": options.SambaOptions,
430         "credopts": options.CredentialsOptions,
431         "versionopts": options.VersionOptions,
432     }
433
434     takes_options = [
435         Option("-H", "--URL", help="LDB URL for database or target server",
436                type=str, metavar="URL", dest="H"),
437     ]
438
439     takes_args = []
440
441     def run(self, H=None, credopts=None, sambaopts=None, versionopts=None):
442         lp = sambaopts.get_loadparm()
443         creds = credopts.get_credentials(lp, fallback_machine=True)
444
445         samdb = SamDB(url=H, session_info=system_session(),
446                       credentials=creds, lp=lp)
447
448         domain_dn = samdb.domain_dn()
449         forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
450         infrastructure_dn = "CN=Infrastructure," + domain_dn
451         naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
452         schema_dn = samdb.get_schema_basedn()
453         rid_dn = "CN=RID Manager$,CN=System," + domain_dn
454         domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
455         forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
456
457         masters = [(schema_dn, "schema", "SchemaMasterRole"),
458                    (infrastructure_dn, "infrastructure", "InfrastructureMasterRole"),
459                    (rid_dn, "rid", "RidAllocationMasterRole"),
460                    (domain_dn, "pdc", "PdcEmulationMasterRole"),
461                    (naming_dn, "naming", "DomainNamingMasterRole"),
462                    (domaindns_dn, "domaindns", "DomainDnsZonesMasterRole"),
463                    (forestdns_dn, "forestdns", "ForestDnsZonesMasterRole"),
464                    ]
465
466         for master in masters:
467             (dn, short_name, long_name) = master
468             try:
469                 master = get_fsmo_roleowner(samdb, dn, short_name)
470                 if master is not None:
471                     self.message("%s owner: %s" % (long_name, str(master)))
472                 else:
473                     self.message("%s has no current owner" % (long_name))
474             except CommandError as e:
475                 self.message("%s: * %s" % (long_name, e.message))
476
477 class cmd_fsmo_transfer(Command):
478     """Transfer the role."""
479
480     synopsis = "%prog [options]"
481
482     takes_optiongroups = {
483         "sambaopts": options.SambaOptions,
484         "credopts": options.CredentialsOptions,
485         "versionopts": options.VersionOptions,
486     }
487
488     takes_options = [
489         Option("-H", "--URL", help="LDB URL for database or target server",
490                type=str, metavar="URL", dest="H"),
491         Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
492                                                  "schema", "naming", "domaindns", "forestdns", "all"],
493                help="""The FSMO role to seize or transfer.\n
494 rid=RidAllocationMasterRole\n
495 schema=SchemaMasterRole\n
496 pdc=PdcEmulationMasterRole\n
497 naming=DomainNamingMasterRole\n
498 infrastructure=InfrastructureMasterRole\n
499 domaindns=DomainDnsZonesMasterRole\n
500 forestdns=ForestDnsZonesMasterRole\n
501 all=all of the above\n
502 You must provide an Admin user and password."""),
503     ]
504
505     takes_args = []
506
507     def run(self, force=None, H=None, role=None,
508             credopts=None, sambaopts=None, versionopts=None):
509
510         lp = sambaopts.get_loadparm()
511         creds = credopts.get_credentials(lp, fallback_machine=True)
512
513         samdb = SamDB(url=H, session_info=system_session(),
514                       credentials=creds, lp=lp)
515
516         if role == "all":
517             transfer_role(self.outf, "rid", samdb)
518             transfer_role(self.outf, "pdc", samdb)
519             transfer_role(self.outf, "naming", samdb)
520             transfer_role(self.outf, "infrastructure", samdb)
521             transfer_role(self.outf, "schema", samdb)
522             transfer_dns_role(self.outf, sambaopts, credopts,
523                               "domaindns", samdb)
524             transfer_dns_role(self.outf, sambaopts, credopts, "forestdns",
525                               samdb)
526         else:
527             if role == "domaindns" or role == "forestdns":
528                 transfer_dns_role(self.outf, sambaopts, credopts, role, samdb)
529             else:
530                 transfer_role(self.outf, role, samdb)
531
532
533 class cmd_fsmo(SuperCommand):
534     """Flexible Single Master Operations (FSMO) roles management."""
535
536     subcommands = {}
537     subcommands["seize"] = cmd_fsmo_seize()
538     subcommands["show"] = cmd_fsmo_show()
539     subcommands["transfer"] = cmd_fsmo_transfer()