2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 """Functions for setting up a Samba Schema."""
25 from base64 import b64encode
26 from samba import read_and_sub_file, substitute_var, check_all_substituted
27 from samba.dcerpc import security
28 from samba.ms_schema import read_ms_schema
29 from samba.ndr import ndr_pack
30 from samba.samdb import SamDB
31 from samba import dsdb
32 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL
36 def get_schema_descriptor(domain_sid, name_map={}):
37 sddl = "O:SAG:SAD:AI(OA;;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;SA)" \
38 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
39 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
40 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
41 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
42 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
43 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
44 "(A;CI;RPLCLORC;;;AU)" \
45 "(A;CI;RPWPCRCCLCLORCWOWDSW;;;SA)" \
46 "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \
47 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
48 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
49 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
50 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
51 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
52 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
53 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ER)" \
54 "S:(AU;SA;WPCCDCWOWDSDDTSW;;;WD)" \
58 "(OU;SA;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;WD)" \
59 "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
60 sec = security.descriptor.from_sddl(sddl, domain_sid)
66 # the schema files (and corresponding object version) that we know about
68 "2008_R2_old": ("MS-AD_Schema_2K8_R2_Attributes.txt",
69 "MS-AD_Schema_2K8_R2_Classes.txt",
71 "2008_R2": ("Attributes_for_AD_DS__Windows_Server_2008_R2.ldf",
72 "Classes_for_AD_DS__Windows_Server_2008_R2.ldf",
74 "2012": ("AD_DS_Attributes__Windows_Server_2012.ldf",
75 "AD_DS_Classes__Windows_Server_2012.ldf",
77 "2012_R2": ("AD_DS_Attributes__Windows_Server_2012_R2.ldf",
78 "AD_DS_Classes__Windows_Server_2012_R2.ldf",
82 def __init__(self, domain_sid, invocationid=None, schemadn=None,
83 files=None, override_prefixmap=None, additional_prefixmap=None,
85 from samba.provision import setup_path
87 """Load schema for the SamDB from the AD schema files and
90 :param samdb: Load a schema into a SamDB.
91 :param schemadn: DN of the schema
93 Returns the schema data loaded, to avoid double-parsing when then
94 needing to add it to the db
97 if base_schema is None:
98 base_schema = Schema.default_base_schema()
100 self.base_schema = base_schema
102 self.schemadn = schemadn
103 # We need to have the am_rodc=False just to keep some warnings quiet -
104 # this isn't a real SAM, so it's meaningless.
105 self.ldb = SamDB(global_schema=False, am_rodc=False)
106 if invocationid is not None:
107 self.ldb.set_invocation_id(invocationid)
109 self.schema_data = read_ms_schema(
110 setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][0]),
111 setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][1]))
113 if files is not None:
115 self.schema_data += open(file, 'rb').read()
117 self.schema_data = substitute_var(self.schema_data,
118 {"SCHEMADN": schemadn})
119 check_all_substituted(self.schema_data)
121 schema_version = str(Schema.get_version(base_schema))
122 self.schema_dn_modify = read_and_sub_file(
123 setup_path("provision_schema_basedn_modify.ldif"),
124 {"SCHEMADN": schemadn, "OBJVERSION": schema_version})
126 descr = b64encode(get_schema_descriptor(domain_sid)).decode('utf8')
127 self.schema_dn_add = read_and_sub_file(
128 setup_path("provision_schema_basedn.ldif"),
129 {"SCHEMADN": schemadn, "DESCRIPTOR": descr})
131 if override_prefixmap is not None:
132 self.prefixmap_data = override_prefixmap
134 self.prefixmap_data = open(setup_path("prefixMap.txt"), 'rb').read()
136 if additional_prefixmap is not None:
137 for map in additional_prefixmap:
138 self.prefixmap_data += "%s\n" % map
140 self.prefixmap_data = b64encode(self.prefixmap_data).decode('utf8')
142 # We don't actually add this ldif, just parse it
143 prefixmap_ldif = "dn: %s\nprefixMap:: %s\n\n" % (self.schemadn, self.prefixmap_data)
144 self.set_from_ldif(prefixmap_ldif, self.schema_data, self.schemadn)
147 def default_base_schema():
148 """Returns the default base schema to use"""
152 def get_version(base_schema):
153 """Returns the base schema's object version, e.g. 47 for 2008_R2"""
154 return Schema.base_schemas[base_schema][2]
156 def set_from_ldif(self, pf, df, dn):
157 dsdb._dsdb_set_schema_from_ldif(self.ldb, pf, df, dn)
159 def write_to_tmp_ldb(self, schemadb_path):
160 self.ldb.connect(url=schemadb_path)
161 self.ldb.transaction_start()
163 # These are actually ignored, as the schema has been forced
164 # when the ldb object was created, and that overrides this
165 self.ldb.add_ldif("""dn: @ATTRIBUTES
170 @IDXATTR: attributeSyntax
174 schema_dn_add = self.schema_dn_add \
175 + "objectGUID: 24e2ca70-b093-4ae8-84c0-2d7ac652a1b8\n"
177 # These bits of LDIF are supplied when the Schema object is created
178 self.ldb.add_ldif(schema_dn_add)
179 self.ldb.modify_ldif(self.schema_dn_modify)
180 self.ldb.add_ldif(self.schema_data)
182 self.ldb.transaction_cancel()
185 self.ldb.transaction_commit()
187 # Return a hash with the forward attribute as a key and the back as the
189 def linked_attributes(self):
190 return get_linked_attributes(self.schemadn, self.ldb)
192 def dnsyntax_attributes(self):
193 return get_dnsyntax_attributes(self.schemadn, self.ldb)
195 def convert_to_openldap(self, target, mapping):
196 return dsdb._dsdb_convert_schema_to_openldap(self.ldb, target, mapping)
199 # Return a hash with the forward attribute as a key and the back as the value
200 def get_linked_attributes(schemadn, schemaldb):
201 attrs = ["linkID", "lDAPDisplayName"]
202 res = schemaldb.search(
203 expression="(&(linkID=*)"
204 "(!(linkID:1.2.840.113556.1.4.803:=1))"
205 "(objectclass=attributeSchema)"
206 "(attributeSyntax=2.5.5.1))",
207 base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
209 for i in range(0, len(res)):
210 expression = ("(&(objectclass=attributeSchema)(linkID=%d)"
211 "(attributeSyntax=2.5.5.1))" %
212 (int(res[i]["linkID"][0]) + 1))
213 target = schemaldb.searchone(basedn=schemadn,
214 expression=expression,
215 attribute="lDAPDisplayName",
217 if target is not None:
218 attributes[str(res[i]["lDAPDisplayName"])] = str(target)
223 def get_dnsyntax_attributes(schemadn, schemaldb):
224 res = schemaldb.search(
225 expression="(&(!(linkID=*))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))",
226 base=schemadn, scope=SCOPE_ONELEVEL,
227 attrs=["linkID", "lDAPDisplayName"])
229 for i in range(0, len(res)):
230 attributes.append(str(res[i]["lDAPDisplayName"]))
234 def ldb_with_schema(schemadn="cn=schema,cn=configuration,dc=example,dc=com",
236 override_prefixmap=None):
237 """Load schema for the SamDB from the AD schema files and samba4_schema.ldif
239 :param schemadn: DN of the schema
240 :param serverdn: DN of the server
242 Returns the schema data loaded as an object, with .ldb being a
243 new ldb with the schema loaded. This allows certain tests to
244 operate without a remote or local schema.
247 if domainsid is None:
248 domainsid = security.random_sid()
250 domainsid = security.dom_sid(domainsid)
251 return Schema(domainsid, schemadn=schemadn,
252 override_prefixmap=override_prefixmap)