Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-wsgi
authorJelmer Vernooij <jelmer@samba.org>
Fri, 23 May 2008 14:24:07 +0000 (16:24 +0200)
committerJelmer Vernooij <jelmer@samba.org>
Fri, 23 May 2008 14:24:07 +0000 (16:24 +0200)
Conflicts:

source/scripting/python/samba/provision.py
(This used to be commit d27de633656f8a699222df77c4c58326890889a2)

1  2 
source4/scripting/python/samba/provision.py

index 4d5a9cb1f1e2ad6000fc333596e8172b0c7a24ef,68b43eff406fac615cc7ead99115ed69af095755..fe9b582d567d213b0d6d55905f1ed2a8c0636e79
@@@ -43,6 -43,8 +43,8 @@@ from ldb import SCOPE_SUBTREE, SCOPE_ON
  
  """Functions for setting up a Samba configuration."""
  
+ __docformat__ = "restructuredText"
  DEFAULTSITE = "Default-First-Site-Name"
  
  class InvalidNetbiosName(Exception):
@@@ -87,6 -89,7 +89,7 @@@ class ProvisionNames
          self.domain = None
          self.hostname = None
          self.sitename = None
+         self.smbconf = None
      
  class ProvisionResult:
      def __init__(self):
@@@ -103,7 -106,7 +106,7 @@@ def check_install(lp, session_info, cre
      :param credentials: Credentials
      """
      if lp.get("realm") == "":
 -        raise Error("Realm empty")
 +        raise Exception("Realm empty")
      ldb = Ldb(lp.get("sam database"), session_info=session_info, 
              credentials=credentials, lp=lp)
      if len(ldb.search("(cn=Administrator)")) != 1:
@@@ -125,10 -128,6 +128,10 @@@ def findnss(nssfn, names)
      raise KeyError("Unable to find user/group %r" % names)
  
  
 +findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
 +findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
 +
 +
  def open_ldb(session_info, credentials, lp, dbname):
      """Open a LDB, thrashing it if it is corrupt.
  
@@@ -239,6 -238,8 +242,8 @@@ def provision_paths_from_lp(lp, dnsdoma
      paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
      paths.templates = os.path.join(paths.private_dir, "templates.ldb")
      paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
+     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
+     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
      paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
      paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
      paths.phpldapadminconfig = os.path.join(paths.private_dir, 
  
      paths.netlogon = lp.get("path", "netlogon")
  
+     paths.smbconf = lp.configfile()
      return paths
  
  
- def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, 
-                 serverrole=None, rootdn=None, domaindn=None, configdn=None, 
-                 schemadn=None, sitename=None):
+ def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
+                 rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None, 
+                 sitename=None):
+     """Guess configuration settings to use."""
  
      if hostname is None:
          hostname = socket.gethostname().split(".")[0].lower()
      realm = dnsdomain.upper()
  
      if lp.get("realm").upper() != realm:
-         raise Exception("realm '%s' must match chosen realm '%s'" %
-                         (lp.get("realm"), realm))
+         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
+                         (lp.get("realm"), lp.configfile(), realm))
      
      dnsdomain = dnsdomain.lower()
  
 -    if (serverrole == "domain controller"):
 +    if serverrole == "domain controller":
          if domain is None:
              domain = lp.get("workgroup")
          if domaindn is None:
              domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
          if lp.get("workgroup").upper() != domain.upper():
 -            raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
 +            raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
                          lp.get("workgroup"), domain)
      else:
          domain = netbiosname
      names.netbiosname = netbiosname
      names.hostname = hostname
      names.sitename = sitename
+     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
      
      return names
      
  
 -def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir):
 -    if targetdir is not None:
 -        if not os.path.exists(targetdir):
 -            os.mkdir(targetdir)
 -        if not os.path.exists(os.path.join(targetdir, "etc")):
 -           os.mkdir(os.path.join(targetdir, "etc"))
 +def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
 +                 targetdir):
 +    if hostname is None:
 +        hostname = socket.gethostname().split(".")[0].lower()
  
 -        smbconf = os.path.join(targetdir, "etc", "smb.conf")
 +    if serverrole is None:
 +        serverrole = "standalone"
  
 -    # only install a new smb.conf if there isn't one there already
 +    assert serverrole in ("domain controller", "member server", "standalone")
 +    if serverrole == "domain controller":
 +        smbconfsuffix = "dc"
 +    elif serverrole == "member server":
 +        smbconfsuffix = "member"
 +    elif serverrole == "standalone":
 +        smbconfsuffix = "standalone"
  
 -    if not os.path.exists(smbconf):
 -        if hostname is None:
 -            hostname = socket.gethostname().split(".")[0].lower()
 +    assert domain is not None
 +    assert realm is not None
  
 -        if serverrole is None:
 -            serverrole = "standalone"
 +    default_lp = param.LoadParm()
 +    #Load non-existant file
 +    default_lp.load(smbconf)
 +    
 +    if targetdir is not None:
 +        privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 +        lockdir_line = "lock dir = " + os.path.abspath(targetdir)
  
 -        assert serverrole in ("domain controller", "member server", "standalone")
 -        if serverrole == "domain controller":
 -            smbconfsuffix = "dc"
 -        elif serverrole == "member server":
 -            smbconfsuffix = "member"
 -        elif serverrole == "standalone":
 -            smbconfsuffix = "standalone"
 -
 -        assert domain is not None
 -        assert realm is not None
 -
 -        default_lp = param.LoadParm()
 -        #Load non-existant file
 -        default_lp.load(smbconf)
 -        
 -        if targetdir is not None:
 -            privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 -            lockdir_line = "lock dir = " + os.path.abspath(targetdir)
 +        default_lp.set("lock dir", os.path.abspath(targetdir))
 +    else:
 +        privatedir_line = ""
 +        lockdir_line = ""
  
 -            default_lp.set("lock dir", os.path.abspath(targetdir))
 -        else:
 -          privatedir_line = ""
 -          lockdir_line = ""
 -
 -        sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
 -        netlogon = os.path.join(sysvol, realm.lower(), "scripts")
 -
 -        setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
 -                   smbconf, {
 -                "HOSTNAME": hostname,
 -                "DOMAIN": domain,
 -                "REALM": realm,
 -                "SERVERROLE": serverrole,
 -                "NETLOGONPATH": netlogon,
 -                "SYSVOLPATH": sysvol,
 -                "PRIVATEDIR_LINE": privatedir_line,
 -                "LOCKDIR_LINE": lockdir_line
 -                })
 +    sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
 +    netlogon = os.path.join(sysvol, realm.lower(), "scripts")
  
 -    lp = param.LoadParm()
 -    lp.load(smbconf)
 +    setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
 +               smbconf, {
 +            "HOSTNAME": hostname,
 +            "DOMAIN": domain,
 +            "REALM": realm,
 +            "SERVERROLE": serverrole,
 +            "NETLOGONPATH": netlogon,
 +            "SYSVOLPATH": sysvol,
 +            "PRIVATEDIR_LINE": privatedir_line,
 +            "LOCKDIR_LINE": lockdir_line
 +            })
  
 -    return lp
  
  def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
                          users_gid, wheel_gid):
      """setup reasonable name mappings for sam names to unix names.
@@@ -482,8 -502,8 +492,8 @@@ def setup_samdb_partitions(samdb_path, 
      schemadn_ldb = "schema.ldb"
      if ldap_backend is not None:
          schema_ldb = ldap_backend
 -      schemadn_ldb = ldap_backend
 -      
 +        schemadn_ldb = ldap_backend
 +        
      if ldap_backend_type == "fedora-ds":
          backend_modules = ["nsuniqueid", "paged_searches"]
          # We can handle linked attributes here, as we don't have directory-side subtree operations
          samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
  
          message("Setting up sam.ldb rootDSE")
-         setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn, 
-                             names.hostname, names.dnsdomain, names.realm, 
-                             names.rootdn, names.configdn, names.netbiosname,
-                             names.sitename)
+         setup_samdb_rootdse(samdb, setup_path, names)
  
          if erase:
              message("Erasing data from partitions")
@@@ -652,25 -669,22 +659,22 @@@ def setup_idmapdb(path, setup_path, ses
      return idmap_ldb
  
  
- def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
-                         dnsdomain, realm, rootdn, configdn, netbiosname,
-                         sitename):
+ def setup_samdb_rootdse(samdb, setup_path, names):
      """Setup the SamDB rootdse.
  
      :param samdb: Sam Database handle
      :param setup_path: Obtain setup path
      """
      setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
-         "SCHEMADN": schemadn, 
-         "NETBIOSNAME": netbiosname,
-         "DNSDOMAIN": dnsdomain,
-         "DEFAULTSITE": sitename,
-         "REALM": realm,
-         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
-         "DOMAINDN": domaindn,
-         "ROOTDN": rootdn,
-         "CONFIGDN": configdn,
-         "VERSION": samba.version(),
+         "SCHEMADN": names.schemadn, 
+         "NETBIOSNAME": names.netbiosname,
+         "DNSDOMAIN": names.dnsdomain,
+         "REALM": names.realm,
+         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
+         "DOMAINDN": names.domaindn,
+         "ROOTDN": names.rootdn,
+         "CONFIGDN": names.configdn,
+         "SERVERDN": names.serverdn,
          })
          
  
@@@ -679,10 -693,12 +683,12 @@@ def setup_self_join(samdb, names
                      domainsid, invocationid, setup_path,
                      policyguid):
      """Join a host to its own domain."""
+     assert isinstance(invocationid, str)
      setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
                "CONFIGDN": names.configdn, 
                "SCHEMADN": names.schemadn,
                "DOMAINDN": names.domaindn,
+               "SERVERDN": names.serverdn,
                "INVOCATIONID": invocationid,
                "NETBIOSNAME": names.netbiosname,
                "DEFAULTSITE": names.sitename,
@@@ -730,14 -746,11 +736,12 @@@ def setup_samdb(path, setup_path, sessi
          return samdb
  
      message("Pre-loading the Samba 4 and AD schema")
-     samdb = SamDB(path, session_info=session_info, 
-                   credentials=credentials, lp=lp)
      samdb.set_domain_sid(domainsid)
      if serverrole == "domain controller":
          samdb.set_invocation_id(invocationid)
  
 -    load_schema(setup_path, samdb, names.schemadn, names.netbiosname, names.configdn, names.sitename)
 +    load_schema(setup_path, samdb, names.schemadn, names.netbiosname, 
 +                names.configdn, names.sitename)
  
      samdb.transaction_start()
          
              "NETBIOSNAME": names.netbiosname,
              "DEFAULTSITE": names.sitename,
              "CONFIGDN": names.configdn,
+             "SERVERDN": names.serverdn,
              "POLICYGUID": policyguid,
              "DOMAINDN": names.domaindn,
              "DOMAINGUID_MOD": domainguid_mod,
              "NETBIOSNAME": names.netbiosname,
              "DEFAULTSITE": names.sitename,
              "CONFIGDN": names.configdn,
+             "SERVERDN": names.serverdn
              })
  
          message("Setting up sam.ldb Samba4 schema")
              "DOMAIN": names.domain,
              "SCHEMADN": names.schemadn,
              "DOMAINDN": names.domaindn,
+             "SERVERDN": names.serverdn
              })
  
          message("Setting up display specifiers")
              "NETBIOSNAME": names.netbiosname,
              "DEFAULTSITE": names.sitename,
              "CONFIGDN": names.configdn,
+             "SERVERDN": names.serverdn
              })
  
          if fill == FILL_FULL:
@@@ -875,15 -892,15 +883,15 @@@ FILL_NT4SYNC = "NT4SYNC
  FILL_DRS = "DRS"
  
  def provision(setup_dir, message, session_info, 
-               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, 
-               realm=None, rootdn=None, domaindn=None, schemadn=None, 
-               configdn=None, domain=None, hostname=None, hostip=None, 
-               hostip6=None, domainsid=None, adminpass=None, krbtgtpass=None, 
-               domainguid=None, policyguid=None, invocationid=None, 
-               machinepass=None, dnspass=None, root=None, nobody=None, 
-               nogroup=None, users=None, wheel=None, backup=None, aci=None, 
-               serverrole=None, ldap_backend=None, ldap_backend_type=None, 
-               sitename=None):
+               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
+               rootdn=None, domaindn=None, schemadn=None, configdn=None, 
+               serverdn=None,
+               domain=None, hostname=None, hostip=None, hostip6=None, 
+               domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
+               policyguid=None, invocationid=None, machinepass=None, 
+               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
+               wheel=None, backup=None, aci=None, serverrole=None, 
+               ldap_backend=None, ldap_backend_type=None, sitename=None):
      """Provision samba4
      
      :note: caution, this wipes all existing data!
          domainsid = security.Sid(domainsid)
  
      if policyguid is None:
-         policyguid = uuid.random()
+         policyguid = str(uuid.uuid4())
      if adminpass is None:
          adminpass = misc.random_password(12)
      if krbtgtpass is None:
          machinepass  = misc.random_password(12)
      if dnspass is None:
          dnspass = misc.random_password(12)
 -    if root is None:
 -        root_uid = findnss(pwd.getpwnam, ["root"])[2]
 -    else:
 -        root_uid = findnss(pwd.getpwnam, [root])[2]
 -    if nobody is None:
 -        nobody_uid = findnss(pwd.getpwnam, ["nobody"])[2]
 -    else:
 -        nobody_uid = findnss(pwd.getpwnam, [nobody])[2]
 -    if users is None:
 -        users_gid = findnss(grp.getgrnam, ["users"])[2]
 -    else:
 -        users_gid = findnss(grp.getgrnam, [users])[2]
 +    root_uid = findnss_uid([root or "root"])
 +    nobody_uid = findnss_uid([nobody or "nobody"])
 +    users_gid = findnss_gid([users or "users"])
      if wheel is None:
 -        wheel_gid = findnss(grp.getgrnam, ["wheel", "adm"])[2]
 +        wheel_gid = findnss_gid(["wheel", "adm"])
      else:
 -        wheel_gid = findnss(grp.getgrnam, [wheel])[2]
 +        wheel_gid = findnss_gid([wheel])
      if aci is None:
          aci = "# no aci for local ldb"
  
 -    lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
 +    if smbconf is None:
 +        os.makedirs(os.path.join(targetdir, "etc"))
 +        smbconf = os.path.join(targetdir, "etc", "smb.conf")
 +
 +    # only install a new smb.conf if there isn't one there already
 +    if not os.path.exists(smbconf):
 +        make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, 
 +                     targetdir)
 +
 +    lp = param.LoadParm()
 +    lp.load(smbconf)
  
      names = guess_names(lp=lp, hostname=hostname, domain=domain, 
-                         dnsdomain=realm, serverrole=serverrole, 
-                         sitename=sitename, rootdn=rootdn, domaindn=domaindn, 
-                         configdn=configdn, schemadn=schemadn)
+                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
+                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
+                         serverdn=serverdn)
  
      paths = provision_paths_from_lp(lp, names.dnsdomain)
  
      if hostip6 is None:
          try:
              hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 -        except socket.gaierror: pass
 +        except socket.gaierror: 
 +            pass
  
      if serverrole is None:
          serverrole = lp.get("server role")
  
      assert serverrole in ("domain controller", "member server", "standalone")
      if invocationid is None and serverrole == "domain controller":
-         invocationid = uuid.random()
+         invocationid = str(uuid.uuid4())
  
      if not os.path.exists(paths.private_dir):
          os.mkdir(paths.private_dir)
                          ldap_backend_type=ldap_backend_type)
  
      if lp.get("server role") == "domain controller":
-        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
-                                   "{" + policyguid + "}")
-        os.makedirs(policy_path, 0755)
-        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
-        os.makedirs(os.path.join(policy_path, "User"), 0755)
-        if not os.path.isdir(paths.netlogon):
+         if paths.netlogon is None:
+             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
+             message("Please either remove %s or see the template at %s" % 
+                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
+             assert(paths.netlogon is not None)
+         if paths.sysvol is None:
+             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
+             message("Please either remove %s or see the template at %s" % 
+                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
+             assert(paths.sysvol is not None)            
+             
+         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
+                                    "{" + policyguid + "}")
+         os.makedirs(policy_path, 0755)
+         os.makedirs(os.path.join(policy_path, "Machine"), 0755)
+         os.makedirs(os.path.join(policy_path, "User"), 0755)
+         if not os.path.isdir(paths.netlogon):
              os.makedirs(paths.netlogon, 0755)
-        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
-                          credentials=credentials, lp=lp)
-        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
-                            netbiosname=names.netbiosname, domainsid=domainsid, 
-                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
-                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
-                            machinepass=machinepass, dnsdomain=names.dnsdomain)
  
      if samdb_fill == FILL_FULL:
          setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
  
          # Only make a zone file on the first DC, it should be replicated with DNS replication
          if serverrole == "domain controller":
+             secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
+                               credentials=credentials, lp=lp)
+             secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
+                                 netbiosname=names.netbiosname, domainsid=domainsid, 
+                                 keytab_path=paths.keytab, samdb_url=paths.samdb, 
+                                 dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
+                                 machinepass=machinepass, dnsdomain=names.dnsdomain)
              samdb = SamDB(paths.samdb, session_info=session_info, 
                        credentials=credentials, lp=lp)
  
                                         expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
                                         scope=SCOPE_SUBTREE)
              assert isinstance(hostguid, str)
-             
-             create_zone_file(paths.dns, setup_path, samdb, 
-                              hostname=names.hostname, hostip=hostip,
-                              hostip6=hostip6, dnsdomain=names.dnsdomain,
-                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
+             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
+                              domaindn=names.domaindn, hostip=hostip,
+                              hostip6=hostip6, hostname=names.hostname,
+                              dnspass=dnspass, realm=names.realm,
                               domainguid=domainguid, hostguid=hostguid)
              message("Please install the zone located in %s into your DNS server" % paths.dns)
-             
+             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
+                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
+                               keytab_name=paths.dns_keytab)
+             message("See %s for example configuration statements for secure GSS-TSIG updates" % paths.namedconf)
+             create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
+                              hostname=names.hostname, realm=names.realm)
+             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
      create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
                                 ldapi_url)
  
      message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
  
-     message("Once the above files are installed, your server will be ready to use")
-     message("Server Type:    %s" % serverrole)
+     message("Once the above files are installed, your Samba4 server will be ready to use")
+     message("Server Role:    %s" % serverrole)
      message("Hostname:       %s" % names.hostname)
      message("NetBIOS Domain: %s" % names.domain)
      message("DNS Domain:     %s" % names.dnsdomain)
      result.samdb = samdb
      return result
  
  def provision_become_dc(setup_dir=None,
                          smbconf=None, targetdir=None, realm=None, 
                          rootdn=None, domaindn=None, schemadn=None, configdn=None,
+                         serverdn=None,
                          domain=None, hostname=None, domainsid=None, 
                          adminpass=None, krbtgtpass=None, domainguid=None, 
                          policyguid=None, invocationid=None, machinepass=None, 
                          dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
                          wheel=None, backup=None, aci=None, serverrole=None, 
-                         ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
+                         ldap_backend=None, ldap_backend_type=None, sitename=None):
  
      def message(text):
 -      """print a message if quiet is not set."""
 +        """print a message if quiet is not set."""
          print text
  
-     provision(setup_dir, message, system_session(), None,
+     return provision(setup_dir, message, system_session(), None,
                smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
-               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, 
+               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
                domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
      
  
- def setup_db_config(setup_path, file, dbdir):
+ def setup_db_config(setup_path, dbdir):
+     """Setup a Berkeley database.
+     
+     :param setup_path: Setup path function.
+     :param dbdir: Database directory."""
      if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
          os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
      if not os.path.isdir(os.path.join(dbdir, "tmp")):
@@@ -1097,7 -1140,7 +1133,7 @@@ def provision_backend(setup_dir=None, m
                        smbconf=None, targetdir=None, realm=None, 
                        rootdn=None, domaindn=None, schemadn=None, configdn=None,
                        domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
-                       ldap_backend_type=None):
+                       ldap_backend_type=None, ldap_backend_port=None):
  
      def setup_path(file):
          return os.path.join(setup_dir, file)
      if root is None:
          root = findnss(pwd.getpwnam, ["root"])[0]
  
 -    lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
 +    if smbconf is None:
 +        os.makedirs(os.path.join(targetdir, "etc"))
 +        smbconf = os.path.join(targetdir, "etc", "smb.conf")
 +
 +    # only install a new smb.conf if there isn't one there already
 +    if not os.path.exists(smbconf):
 +        make_smbconf(smbconf, setup_path, hostname, domain, realm, 
 +                              serverrole, targetdir)
 +
 +    lp = param.LoadParm()
 +    lp.load(smbconf)
  
      names = guess_names(lp=lp, hostname=hostname, domain=domain, 
                          dnsdomain=realm, serverrole=serverrole, 
 -                        rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
 +                        rootdn=rootdn, domaindn=domaindn, configdn=configdn, 
 +                        schemadn=schemadn)
  
      paths = provision_paths_from_lp(lp, names.dnsdomain)
  
                             "NETBIOSNAME": names.netbiosname,
                             "DEFAULTSITE": DEFAULTSITE,
                             "CONFIGDN": names.configdn,
+                            "SERVERDN": names.serverdn
                             })
      
      setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
                     {"SCHEMADN": names.schemadn})
  
      if ldap_backend_type == "fedora-ds":
-         setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf, 
+         if ldap_backend_port is not None:
+             serverport = "ServerPort=%d" % ldap_backend_port
+         else:
+             serverport = ""
+         setup_file(setup_path("fedorads.inf"), paths.fedoradsinf, 
                     {"ROOT": root,
                      "HOSTNAME": hostname,
                      "DNSDOMAIN": names.dnsdomain,
                      "DOMAINDN": names.domaindn,
                      "LDAPMANAGERDN": names.ldapmanagerdn,
                      "LDAPMANAGERPASS": adminpass, 
-                     "SERVERPORT": ""})
+                     "SERVERPORT": serverport})
          
-         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
+         setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions, 
                     {"CONFIGDN": names.configdn,
                      "SCHEMADN": names.schemadn,
                      })
          
-         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
-                    {"CONFIGDN": names.configdn,
-                     "SCHEMADN": names.schemadn,
-                     })
          mapping = "schema-map-fedora-ds-1.0"
          backend_schema = "99_ad.ldif"
+         
+         slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
+        
      elif ldap_backend_type == "openldap":
          attrs = ["linkID", "lDAPDisplayName"]
 -      res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
 +    res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
  
 -      memberof_config = "# Generated from schema in " + schemadb_path + "\n";
 -      refint_attributes = "";
 -      for i in range (0, len(res)):
 +    memberof_config = "# Generated from schema in " + schemadb_path + "\n";
 +    refint_attributes = "";
 +    for i in range (0, len(res)):
              linkid = res[i]["linkID"][0]
              linkid = str(int(linkid) + 1)
              expression = "(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))"
@@@ -1203,11 -1240,11 +1244,11 @@@ memberof-dangling-error 3
  
  """;
  
 -      memberof_config = memberof_config + """
 +    memberof_config = memberof_config + """
  overlay refint
  refint_attributes""" + refint_attributes + "\n";
 -      
 -        setup_file(setup_path("slapd.conf"), paths.slapdconf,
 +    
 +    setup_file(setup_path("slapd.conf"), paths.slapdconf,
                     {"DNSDOMAIN": names.dnsdomain,
                      "LDAPDIR": paths.ldapdir,
                      "DOMAINDN": names.domaindn,
                      "LDAPMANAGERDN": names.ldapmanagerdn,
                      "LDAPMANAGERPASS": adminpass,
                      "MEMBEROF_CONFIG": memberof_config})
 -        setup_file(setup_path("modules.conf"), paths.modulesconf,
 +    setup_file(setup_path("modules.conf"), paths.modulesconf,
                     {"REALM": names.realm})
          
-     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
-     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
-     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
-     mapping = "schema-map-openldap-2.3"
-     backend_schema = "backend-schema.schema"
-         
-     ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
-     message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
-                 
+         setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "user")))
+         setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "config")))
+         setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "schema")))
+         mapping = "schema-map-openldap-2.3"
+         backend_schema = "backend-schema.schema"
+         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+         if ldap_backend_port is not None:
+             server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
+         else:
+             server_port_string = ""
+         slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
  
      schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
  
      os.system(schema_command)
  
  
+     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ( ldap_backend_type) )
+     message("Server Role:         %s" % serverrole)
+     message("Hostname:            %s" % names.hostname)
+     message("DNS Domain:          %s" % names.dnsdomain)
+     message("Base DN:             %s" % names.domaindn)
+     message("LDAP admin DN:       %s" % names.ldapmanagerdn)
+     message("LDAP admin password: %s" % adminpass)
+     message(slapdcommand)
  
  def create_phpldapadmin_config(path, setup_path, ldapi_uri):
      """Create a PHP LDAP admin configuration file.
              {"S4_LDAPI_URI": ldapi_uri})
  
  
- def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
-                   hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+ def create_zone_file(path, setup_path, dnsdomain, domaindn, 
+                      hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
      """Write out a DNS zone file, from the info in the current database.
-     
-     :param path: Path of the new file.
-     :param setup_path": Setup path function.
-     :param samdb: SamDB object
+     :param path: Path of the new zone file.
+     :param setup_path: Setup path function.
      :param dnsdomain: DNS Domain name
      :param domaindn: DN of the Domain
      :param hostip: Local IPv4 IP
      hostip6_host_line = ""
  
      if hostip6 is not None:
 -        hostip6_base_line = "                 IN AAAA " + hostip6
 -        hostip6_host_line = hostname + "              IN AAAA " + hostip6
 +        hostip6_base_line = "            IN AAAA    " + hostip6
 +        hostip6_host_line = hostname + "        IN AAAA    " + hostip6
  
      setup_file(setup_path("provision.zone"), path, {
              "DNSPASS_B64": b64encode(dnspass),
              "HOSTIP6_HOST_LINE": hostip6_host_line,
          })
  
+ def create_named_conf(path, setup_path, realm, dnsdomain,
+                       private_dir, keytab_name):
+     """Write out a file containing zone statements suitable for inclusion in a
+     named.conf file (including GSS-TSIG configuration).
+     
+     :param path: Path of the new named.conf file.
+     :param setup_path: Setup path function.
+     :param realm: Realm name
+     :param dnsdomain: DNS Domain name
+     :param private_dir: Path to private directory
+     :param keytab_name: File name of DNS keytab file
+     """
+     setup_file(setup_path("named.conf"), path, {
+             "DNSDOMAIN": dnsdomain,
+             "REALM": realm,
+             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
+             "DNS_KEYTAB": keytab_name,
+             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
+         })
+ def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
+     """Write out a file containing zone statements suitable for inclusion in a
+     named.conf file (including GSS-TSIG configuration).
+     
+     :param path: Path of the new named.conf file.
+     :param setup_path: Setup path function.
+     :param dnsdomain: DNS Domain name
+     :param hostname: Local hostname
+     :param realm: Realm name
+     """
+     setup_file(setup_path("krb5.conf"), path, {
+             "DNSDOMAIN": dnsdomain,
+             "HOSTNAME": hostname,
+             "REALM": realm,
+         })
  def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
      """Load schema for the SamDB.