source/scripting/python/samba/provision.py

   1 #
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 # Based on the original in EJS:
   9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
  10 #
  11 # This program is free software; you can redistribute it and/or modify
  12 # it under the terms of the GNU General Public License as published by
  13 # the Free Software Foundation; either version 3 of the License, or
  14 # (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 #
  24
  25 from base64 import b64encode
  26 import os
  27 import pwd
  28 import grp
  29 import time
  30 import uuid, misc
  31 import socket
  32 import param
  33 import registry
  34 import samba
  35 from auth import system_session
  36 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
  37 from samba.samdb import SamDB
  38 from samba.idmap import IDmapDB
  39 import security
  40 import urllib
  41 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
  42         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
  43
  44 """Functions for setting up a Samba configuration."""
  45
  46 DEFAULTSITE = "Default-First-Site-Name"
  47
  48 class InvalidNetbiosName(Exception):
  49     def __init__(self, name):
  50         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
  51
  52
  53 class ProvisionPaths:
  54     def __init__(self):
  55         self.shareconf = None
  56         self.hklm = None
  57         self.hkcu = None
  58         self.hkcr = None
  59         self.hku = None
  60         self.hkpd = None
  61         self.hkpt = None
  62         self.samdb = None
  63         self.idmapdb = None
  64         self.secrets = None
  65         self.keytab = None
  66         self.dns_keytab = None
  67         self.dns = None
  68         self.winsdb = None
  69         self.private_dir = None
  70         self.ldapdir = None
  71         self.slapdconf = None
  72         self.modulesconf = None
  73         self.memberofconf = None
  74         self.fedoradsinf = None
  75         self.fedoradspartitions = None
  76
  77 class ProvisionNames:
  78     def __init__(self):
  79         self.rootdn = None
  80         self.domaindn = None
  81         self.configdn = None
  82         self.schemadn = None
  83         self.ldapmanagerdn = None
  84         self.dnsdomain = None
  85         self.realm = None
  86         self.netbiosname = None
  87         self.domain = None
  88         self.hostname = None
  89         self.sitename = None
  90
  91 class ProvisionResult:
  92     def __init__(self):
  93         self.paths = None
  94         self.domaindn = None
  95         self.lp = None
  96         self.samdb = None
  97
  98 def check_install(lp, session_info, credentials):
  99     """Check whether the current install seems ok.
 100
 101     :param lp: Loadparm context
 102     :param session_info: Session information
 103     :param credentials: Credentials
 104     """
 105     if lp.get("realm") == "":
 106         raise Exception("Realm empty")
 107     ldb = Ldb(lp.get("sam database"), session_info=session_info,
 108             credentials=credentials, lp=lp)
 109     if len(ldb.search("(cn=Administrator)")) != 1:
 110         raise "No administrator account found"
 111
 112
 113 def findnss(nssfn, names):
 114     """Find a user or group from a list of possibilities.
 115
 116     :param nssfn: NSS Function to try (should raise KeyError if not found)
 117     :param names: Names to check.
 118     :return: Value return by first names list.
 119     """
 120     for name in names:
 121         try:
 122             return nssfn(name)
 123         except KeyError:
 124             pass
 125     raise KeyError("Unable to find user/group %r" % names)
 126
 127
 128 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
 129 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
 130
 131
 132 def open_ldb(session_info, credentials, lp, dbname):
 133     """Open a LDB, thrashing it if it is corrupt.
 134
 135     :param session_info: auth session information
 136     :param credentials: credentials
 137     :param lp: Loadparm context
 138     :param dbname: Path of the database to open.
 139     :return: a Ldb object
 140     """
 141     assert session_info is not None
 142     try:
 143         return Ldb(dbname, session_info=session_info, credentials=credentials,
 144                    lp=lp)
 145     except LdbError, e:
 146         print e
 147         os.unlink(dbname)
 148         return Ldb(dbname, session_info=session_info, credentials=credentials,
 149                    lp=lp)
 150
 151
 152 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
 153     """Setup a ldb in the private dir.
 154
 155     :param ldb: LDB file to import data into
 156     :param ldif_path: Path of the LDIF file to load
 157     :param subst_vars: Optional variables to subsitute in LDIF.
 158     """
 159     assert isinstance(ldif_path, str)
 160
 161     data = open(ldif_path, 'r').read()
 162     if subst_vars is not None:
 163         data = substitute_var(data, subst_vars)
 164
 165     check_all_substituted(data)
 166
 167     ldb.add_ldif(data)
 168
 169
 170 def setup_modify_ldif(ldb, ldif_path, substvars=None):
 171     """Modify a ldb in the private dir.
 172
 173     :param ldb: LDB object.
 174     :param ldif_path: LDIF file path.
 175     :param substvars: Optional dictionary with substitution variables.
 176     """
 177     data = open(ldif_path, 'r').read()
 178     if substvars is not None:
 179         data = substitute_var(data, substvars)
 180
 181     check_all_substituted(data)
 182
 183     ldb.modify_ldif(data)
 184
 185
 186 def setup_ldb(ldb, ldif_path, subst_vars):
 187     """Import a LDIF a file into a LDB handle, optionally substituting variables.
 188
 189     :note: Either all LDIF data will be added or none (using transactions).
 190
 191     :param ldb: LDB file to import into.
 192     :param ldif_path: Path to the LDIF file.
 193     :param subst_vars: Dictionary with substitution variables.
 194     """
 195     assert ldb is not None
 196     ldb.transaction_start()
 197     try:
 198         setup_add_ldif(ldb, ldif_path, subst_vars)
 199     except:
 200         ldb.transaction_cancel()
 201         raise
 202     ldb.transaction_commit()
 203
 204
 205 def setup_file(template, fname, substvars):
 206     """Setup a file in the private dir.
 207
 208     :param template: Path of the template file.
 209     :param fname: Path of the file to create.
 210     :param substvars: Substitution variables.
 211     """
 212     f = fname
 213
 214     if os.path.exists(f):
 215         os.unlink(f)
 216
 217     data = open(template, 'r').read()
 218     if substvars:
 219         data = substitute_var(data, substvars)
 220     check_all_substituted(data)
 221
 222     open(f, 'w').write(data)
 223
 224
 225 def provision_paths_from_lp(lp, dnsdomain):
 226     """Set the default paths for provisioning.
 227
 228     :param lp: Loadparm context.
 229     :param dnsdomain: DNS Domain name
 230     """
 231     paths = ProvisionPaths()
 232     paths.private_dir = lp.get("private dir")
 233     paths.keytab = "secrets.keytab"
 234     paths.dns_keytab = "dns.keytab"
 235
 236     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
 237     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
 238     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
 239     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
 240     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
 241     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
 242     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
 243     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
 244     paths.phpldapadminconfig = os.path.join(paths.private_dir,
 245                                             "phpldapadmin-config.php")
 246     paths.ldapdir = os.path.join(paths.private_dir,
 247                                  "ldap")
 248     paths.slapdconf = os.path.join(paths.ldapdir,
 249                                    "slapd.conf")
 250     paths.modulesconf = os.path.join(paths.ldapdir,
 251                                      "modules.conf")
 252     paths.memberofconf = os.path.join(paths.ldapdir,
 253                                       "memberof.conf")
 254     paths.fedoradsinf = os.path.join(paths.ldapdir,
 255                                    "fedorads.inf")
 256     paths.fedoradspartitions = os.path.join(paths.ldapdir,
 257                                             "fedorads-partitions.ldif")
 258     paths.hklm = "hklm.ldb"
 259     paths.hkcr = "hkcr.ldb"
 260     paths.hkcu = "hkcu.ldb"
 261     paths.hku = "hku.ldb"
 262     paths.hkpd = "hkpd.ldb"
 263     paths.hkpt = "hkpt.ldb"
 264
 265     paths.sysvol = lp.get("path", "sysvol")
 266
 267     paths.netlogon = lp.get("path", "netlogon")
 268
 269     return paths
 270
 271
 272 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
 273                 serverrole=None, rootdn=None, domaindn=None, configdn=None,
 274                 schemadn=None, sitename=None):
 275
 276     if hostname is None:
 277         hostname = socket.gethostname().split(".")[0].lower()
 278
 279     netbiosname = hostname.upper()
 280     if not valid_netbios_name(netbiosname):
 281         raise InvalidNetbiosName(netbiosname)
 282
 283     hostname = hostname.lower()
 284
 285     if dnsdomain is None:
 286         dnsdomain = lp.get("realm")
 287
 288     if serverrole is None:
 289         serverrole = lp.get("server role")
 290
 291     assert dnsdomain is not None
 292     realm = dnsdomain.upper()
 293
 294     if lp.get("realm").upper() != realm:
 295         raise Exception("realm '%s' must match chosen realm '%s'" %
 296                         (lp.get("realm"), realm))
 297
 298     dnsdomain = dnsdomain.lower()
 299
 300     if serverrole == "domain controller":
 301         if domain is None:
 302             domain = lp.get("workgroup")
 303         if domaindn is None:
 304             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
 305         if lp.get("workgroup").upper() != domain.upper():
 306             raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
 307                         lp.get("workgroup"), domain)
 308     else:
 309         domain = netbiosname
 310         if domaindn is None:
 311             domaindn = "CN=" + netbiosname
 312
 313     assert domain is not None
 314     domain = domain.upper()
 315     if not valid_netbios_name(domain):
 316         raise InvalidNetbiosName(domain)
 317
 318     if rootdn is None:
 319        rootdn = domaindn
 320
 321     if configdn is None:
 322         configdn = "CN=Configuration," + rootdn
 323     if schemadn is None:
 324         schemadn = "CN=Schema," + configdn
 325
 326     if sitename is None:
 327         sitename=DEFAULTSITE
 328
 329     names = ProvisionNames()
 330     names.rootdn = rootdn
 331     names.domaindn = domaindn
 332     names.configdn = configdn
 333     names.schemadn = schemadn
 334     names.ldapmanagerdn = "CN=Manager," + rootdn
 335     names.dnsdomain = dnsdomain
 336     names.domain = domain
 337     names.realm = realm
 338     names.netbiosname = netbiosname
 339     names.hostname = hostname
 340     names.sitename = sitename
 341
 342     return names
 343
 344
 345 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
 346                  targetdir):
 347     if hostname is None:
 348         hostname = socket.gethostname().split(".")[0].lower()
 349
 350     if serverrole is None:
 351         serverrole = "standalone"
 352
 353     assert serverrole in ("domain controller", "member server", "standalone")
 354     if serverrole == "domain controller":
 355         smbconfsuffix = "dc"
 356     elif serverrole == "member server":
 357         smbconfsuffix = "member"
 358     elif serverrole == "standalone":
 359         smbconfsuffix = "standalone"
 360
 361     assert domain is not None
 362     assert realm is not None
 363
 364     default_lp = param.LoadParm()
 365     #Load non-existant file
 366     default_lp.load(smbconf)
 367
 368     if targetdir is not None:
 369         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 370         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
 371
 372         default_lp.set("lock dir", os.path.abspath(targetdir))
 373     else:
 374         privatedir_line = ""
 375         lockdir_line = ""
 376
 377     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
 378     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
 379
 380     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix),
 381                smbconf, {
 382             "HOSTNAME": hostname,
 383             "DOMAIN": domain,
 384             "REALM": realm,
 385             "SERVERROLE": serverrole,
 386             "NETLOGONPATH": netlogon,
 387             "SYSVOLPATH": sysvol,
 388             "PRIVATEDIR_LINE": privatedir_line,
 389             "LOCKDIR_LINE": lockdir_line
 390             })
 391
 392
 393 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
 394                         users_gid, wheel_gid):
 395     """setup reasonable name mappings for sam names to unix names.
 396
 397     :param samdb: SamDB object.
 398     :param idmap: IDmap db object.
 399     :param sid: The domain sid.
 400     :param domaindn: The domain DN.
 401     :param root_uid: uid of the UNIX root user.
 402     :param nobody_uid: uid of the UNIX nobody user.
 403     :param users_gid: gid of the UNIX users group.
 404     :param wheel_gid: gid of the UNIX wheel group."""
 405     # add some foreign sids if they are not present already
 406     samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
 407     samdb.add_foreign(domaindn, "S-1-1-0", "World")
 408     samdb.add_foreign(domaindn, "S-1-5-2", "Network")
 409     samdb.add_foreign(domaindn, "S-1-5-18", "System")
 410     samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
 411
 412     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
 413     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
 414
 415     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
 416     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
 417
 418
 419 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
 420                            credentials, names,
 421                            serverrole, ldap_backend=None,
 422                            ldap_backend_type=None, erase=False):
 423     """Setup the partitions for the SAM database.
 424
 425     Alternatively, provision() may call this, and then populate the database.
 426
 427     :note: This will wipe the Sam Database!
 428
 429     :note: This function always removes the local SAM LDB file. The erase
 430         parameter controls whether to erase the existing data, which
 431         may not be stored locally but in LDAP.
 432     """
 433     assert session_info is not None
 434
 435     samdb = SamDB(samdb_path, session_info=session_info,
 436                   credentials=credentials, lp=lp)
 437
 438     # Wipes the database
 439     try:
 440         samdb.erase()
 441     except:
 442         os.unlink(samdb_path)
 443
 444     samdb = SamDB(samdb_path, session_info=session_info,
 445                   credentials=credentials, lp=lp)
 446
 447     #Add modules to the list to activate them by default
 448     #beware often order is important
 449     #
 450     # Some Known ordering constraints:
 451     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
 452     # - objectclass must be before password_hash, because password_hash checks
 453     #   that the objectclass is of type person (filled in by objectclass
 454     #   module when expanding the objectclass list)
 455     # - partition must be last
 456     # - each partition has its own module list then
 457     modules_list = ["rootdse",
 458                     "paged_results",
 459                     "ranged_results",
 460                     "anr",
 461                     "server_sort",
 462                     "extended_dn",
 463                     "asq",
 464                     "rdn_name",
 465                     "objectclass",
 466                     "samldb",
 467                     "kludge_acl",
 468                     "operational"]
 469     tdb_modules_list = [
 470                     "subtree_rename",
 471                     "subtree_delete",
 472                     "linked_attributes"]
 473     modules_list2 = ["show_deleted",
 474                     "partition"]
 475
 476     domaindn_ldb = "users.ldb"
 477     if ldap_backend is not None:
 478         domaindn_ldb = ldap_backend
 479     configdn_ldb = "configuration.ldb"
 480     if ldap_backend is not None:
 481         configdn_ldb = ldap_backend
 482     schemadn_ldb = "schema.ldb"
 483     if ldap_backend is not None:
 484         schema_ldb = ldap_backend
 485         schemadn_ldb = ldap_backend
 486
 487     if ldap_backend_type == "fedora-ds":
 488         backend_modules = ["nsuniqueid", "paged_searches"]
 489         # We can handle linked attributes here, as we don't have directory-side subtree operations
 490         tdb_modules_list = ["linked_attributes"]
 491     elif ldap_backend_type == "openldap":
 492         backend_modules = ["normalise", "entryuuid", "paged_searches"]
 493         # OpenLDAP handles subtree renames, so we don't want to do any of these things
 494         tdb_modules_list = None
 495     elif serverrole == "domain controller":
 496         backend_modules = ["repl_meta_data"]
 497     else:
 498         backend_modules = ["objectguid"]
 499
 500     if tdb_modules_list is None:
 501         tdb_modules_list_as_string = ""
 502     else:
 503         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
 504
 505     samdb.transaction_start()
 506     try:
 507         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
 508                 "SCHEMADN": names.schemadn,
 509                 "SCHEMADN_LDB": schemadn_ldb,
 510                 "SCHEMADN_MOD2": ",objectguid",
 511                 "CONFIGDN": names.configdn,
 512                 "CONFIGDN_LDB": configdn_ldb,
 513                 "DOMAINDN": names.domaindn,
 514                 "DOMAINDN_LDB": domaindn_ldb,
 515                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
 516                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
 517                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
 518                 "MODULES_LIST": ",".join(modules_list),
 519                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
 520                 "MODULES_LIST2": ",".join(modules_list2),
 521                 "BACKEND_MOD": ",".join(backend_modules),
 522         })
 523
 524     except:
 525         samdb.transaction_cancel()
 526         raise
 527
 528     samdb.transaction_commit()
 529
 530     samdb = SamDB(samdb_path, session_info=session_info,
 531                   credentials=credentials, lp=lp)
 532
 533     samdb.transaction_start()
 534     try:
 535         message("Setting up sam.ldb attributes")
 536         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 537
 538         message("Setting up sam.ldb rootDSE")
 539         setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn,
 540                             names.hostname, names.dnsdomain, names.realm,
 541                             names.rootdn, names.configdn, names.netbiosname,
 542                             names.sitename)
 543
 544         if erase:
 545             message("Erasing data from partitions")
 546             samdb.erase_partitions()
 547
 548     except:
 549         samdb.transaction_cancel()
 550         raise
 551
 552     samdb.transaction_commit()
 553
 554     return samdb
 555
 556
 557 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain,
 558                         netbiosname, domainsid, keytab_path, samdb_url,
 559                         dns_keytab_path, dnspass, machinepass):
 560     """Add DC-specific bits to a secrets database.
 561
 562     :param secretsdb: Ldb Handle to the secrets database
 563     :param setup_path: Setup path function
 564     :param machinepass: Machine password
 565     """
 566     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), {
 567             "MACHINEPASS_B64": b64encode(machinepass),
 568             "DOMAIN": domain,
 569             "REALM": realm,
 570             "DNSDOMAIN": dnsdomain,
 571             "DOMAINSID": str(domainsid),
 572             "SECRETS_KEYTAB": keytab_path,
 573             "NETBIOSNAME": netbiosname,
 574             "SAM_LDB": samdb_url,
 575             "DNS_KEYTAB": dns_keytab_path,
 576             "DNSPASS_B64": b64encode(dnspass),
 577             })
 578
 579
 580 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
 581     """Setup the secrets database.
 582
 583     :param path: Path to the secrets database.
 584     :param setup_path: Get the path to a setup file.
 585     :param session_info: Session info.
 586     :param credentials: Credentials
 587     :param lp: Loadparm context
 588     :return: LDB handle for the created secrets database
 589     """
 590     if os.path.exists(path):
 591         os.unlink(path)
 592     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 593                       lp=lp)
 594     secrets_ldb.erase()
 595     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
 596     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 597                       lp=lp)
 598     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
 599     return secrets_ldb
 600
 601
 602 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
 603     """Setup the templates database.
 604
 605     :param path: Path to the database.
 606     :param setup_path: Function for obtaining the path to setup files.
 607     :param session_info: Session info
 608     :param credentials: Credentials
 609     :param lp: Loadparm context
 610     """
 611     templates_ldb = SamDB(path, session_info=session_info,
 612                           credentials=credentials, lp=lp)
 613     templates_ldb.erase()
 614     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
 615
 616
 617 def setup_registry(path, setup_path, session_info, credentials, lp):
 618     """Setup the registry.
 619
 620     :param path: Path to the registry database
 621     :param setup_path: Function that returns the path to a setup.
 622     :param session_info: Session information
 623     :param credentials: Credentials
 624     :param lp: Loadparm context
 625     """
 626     reg = registry.Registry()
 627     hive = registry.open_ldb(path, session_info=session_info,
 628                          credentials=credentials, lp_ctx=lp)
 629     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
 630     provision_reg = setup_path("provision.reg")
 631     assert os.path.exists(provision_reg)
 632     reg.diff_apply(provision_reg)
 633
 634
 635 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
 636     """Setup the idmap database.
 637
 638     :param path: path to the idmap database
 639     :param setup_path: Function that returns a path to a setup file
 640     :param session_info: Session information
 641     :param credentials: Credentials
 642     :param lp: Loadparm context
 643     """
 644     if os.path.exists(path):
 645         os.unlink(path)
 646
 647     idmap_ldb = IDmapDB(path, session_info=session_info,
 648                         credentials=credentials, lp=lp)
 649
 650     idmap_ldb.erase()
 651     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
 652     return idmap_ldb
 653
 654
 655 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
 656                         dnsdomain, realm, rootdn, configdn, netbiosname,
 657                         sitename):
 658     """Setup the SamDB rootdse.
 659
 660     :param samdb: Sam Database handle
 661     :param setup_path: Obtain setup path
 662     """
 663     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
 664         "SCHEMADN": schemadn,
 665         "NETBIOSNAME": netbiosname,
 666         "DNSDOMAIN": dnsdomain,
 667         "DEFAULTSITE": sitename,
 668         "REALM": realm,
 669         "DNSNAME": "%s.%s" % (hostname, dnsdomain),
 670         "DOMAINDN": domaindn,
 671         "ROOTDN": rootdn,
 672         "CONFIGDN": configdn,
 673         "VERSION": samba.version(),
 674         })
 675
 676
 677 def setup_self_join(samdb, names,
 678                     machinepass, dnspass,
 679                     domainsid, invocationid, setup_path,
 680                     policyguid):
 681     """Join a host to its own domain."""
 682     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
 683               "CONFIGDN": names.configdn,
 684               "SCHEMADN": names.schemadn,
 685               "DOMAINDN": names.domaindn,
 686               "INVOCATIONID": invocationid,
 687               "NETBIOSNAME": names.netbiosname,
 688               "DEFAULTSITE": names.sitename,
 689               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
 690               "MACHINEPASS_B64": b64encode(machinepass),
 691               "DNSPASS_B64": b64encode(dnspass),
 692               "REALM": names.realm,
 693               "DOMAIN": names.domain,
 694               "DNSDOMAIN": names.dnsdomain})
 695     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
 696               "POLICYGUID": policyguid,
 697               "DNSDOMAIN": names.dnsdomain,
 698               "DOMAINSID": str(domainsid),
 699               "DOMAINDN": names.domaindn})
 700
 701
 702 def setup_samdb(path, setup_path, session_info, credentials, lp,
 703                 names, message,
 704                 domainsid, aci, domainguid, policyguid,
 705                 fill, adminpass, krbtgtpass,
 706                 machinepass, invocationid, dnspass,
 707                 serverrole, ldap_backend=None,
 708                 ldap_backend_type=None):
 709     """Setup a complete SAM Database.
 710
 711     :note: This will wipe the main SAM database file!
 712     """
 713
 714     erase = (fill != FILL_DRS)
 715
 716     # Also wipes the database
 717     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
 718                            credentials=credentials, session_info=session_info,
 719                            names=names,
 720                            ldap_backend=ldap_backend, serverrole=serverrole,
 721                            ldap_backend_type=ldap_backend_type, erase=erase)
 722
 723     samdb = SamDB(path, session_info=session_info,
 724                   credentials=credentials, lp=lp)
 725
 726     if fill == FILL_DRS:
 727        # We want to finish here, but setup the index before we do so
 728         message("Setting up sam.ldb index")
 729         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
 730         return samdb
 731
 732     message("Pre-loading the Samba 4 and AD schema")
 733     samdb = SamDB(path, session_info=session_info,
 734                   credentials=credentials, lp=lp)
 735     samdb.set_domain_sid(domainsid)
 736     if serverrole == "domain controller":
 737         samdb.set_invocation_id(invocationid)
 738
 739     load_schema(setup_path, samdb, names.schemadn, names.netbiosname,
 740                 names.configdn, names.sitename)
 741
 742     samdb.transaction_start()
 743
 744     try:
 745         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
 746         if serverrole == "domain controller":
 747             domain_oc = "domainDNS"
 748         else:
 749             domain_oc = "samba4LocalDomain"
 750
 751         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
 752             "DOMAINDN": names.domaindn,
 753             "ACI": aci,
 754             "DOMAIN_OC": domain_oc
 755             })
 756
 757         message("Modifying DomainDN: " + names.domaindn + "")
 758         if domainguid is not None:
 759             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
 760         else:
 761             domainguid_mod = ""
 762
 763         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
 764             "LDAPTIME": timestring(int(time.time())),
 765             "DOMAINSID": str(domainsid),
 766             "SCHEMADN": names.schemadn,
 767             "NETBIOSNAME": names.netbiosname,
 768             "DEFAULTSITE": names.sitename,
 769             "CONFIGDN": names.configdn,
 770             "POLICYGUID": policyguid,
 771             "DOMAINDN": names.domaindn,
 772             "DOMAINGUID_MOD": domainguid_mod,
 773             })
 774
 775         message("Adding configuration container (permitted to fail)")
 776         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
 777             "CONFIGDN": names.configdn,
 778             "ACI": aci,
 779             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
 780             })
 781         message("Modifying configuration container")
 782         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
 783             "CONFIGDN": names.configdn,
 784             "SCHEMADN": names.schemadn,
 785             })
 786
 787         message("Adding schema container (permitted to fail)")
 788         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
 789             "SCHEMADN": names.schemadn,
 790             "ACI": aci,
 791             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
 792             })
 793         message("Modifying schema container")
 794         setup_modify_ldif(samdb,
 795             setup_path("provision_schema_basedn_modify.ldif"), {
 796             "SCHEMADN": names.schemadn,
 797             "NETBIOSNAME": names.netbiosname,
 798             "DEFAULTSITE": names.sitename,
 799             "CONFIGDN": names.configdn,
 800             })
 801
 802         message("Setting up sam.ldb Samba4 schema")
 803         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"),
 804                        {"SCHEMADN": names.schemadn })
 805         message("Setting up sam.ldb AD schema")
 806         setup_add_ldif(samdb, setup_path("schema.ldif"),
 807                        {"SCHEMADN": names.schemadn})
 808
 809         message("Setting up sam.ldb configuration data")
 810         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
 811             "CONFIGDN": names.configdn,
 812             "NETBIOSNAME": names.netbiosname,
 813             "DEFAULTSITE": names.sitename,
 814             "DNSDOMAIN": names.dnsdomain,
 815             "DOMAIN": names.domain,
 816             "SCHEMADN": names.schemadn,
 817             "DOMAINDN": names.domaindn,
 818             })
 819
 820         message("Setting up display specifiers")
 821         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"),
 822                        {"CONFIGDN": names.configdn})
 823
 824         message("Adding users container (permitted to fail)")
 825         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
 826                 "DOMAINDN": names.domaindn})
 827         message("Modifying users container")
 828         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
 829                 "DOMAINDN": names.domaindn})
 830         message("Adding computers container (permitted to fail)")
 831         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
 832                 "DOMAINDN": names.domaindn})
 833         message("Modifying computers container")
 834         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
 835                 "DOMAINDN": names.domaindn})
 836         message("Setting up sam.ldb data")
 837         setup_add_ldif(samdb, setup_path("provision.ldif"), {
 838             "DOMAINDN": names.domaindn,
 839             "NETBIOSNAME": names.netbiosname,
 840             "DEFAULTSITE": names.sitename,
 841             "CONFIGDN": names.configdn,
 842             })
 843
 844         if fill == FILL_FULL:
 845             message("Setting up sam.ldb users and groups")
 846             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
 847                 "DOMAINDN": names.domaindn,
 848                 "DOMAINSID": str(domainsid),
 849                 "CONFIGDN": names.configdn,
 850                 "ADMINPASS_B64": b64encode(adminpass),
 851                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
 852                 })
 853
 854             if serverrole == "domain controller":
 855                 message("Setting up self join")
 856                 setup_self_join(samdb, names=names, invocationid=invocationid,
 857                                 dnspass=dnspass,
 858                                 machinepass=machinepass,
 859                                 domainsid=domainsid, policyguid=policyguid,
 860                                 setup_path=setup_path)
 861
 862     #We want to setup the index last, as adds are faster unindexed
 863         message("Setting up sam.ldb index")
 864         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
 865     except:
 866         samdb.transaction_cancel()
 867         raise
 868
 869     samdb.transaction_commit()
 870     return samdb
 871
 872
 873 FILL_FULL = "FULL"
 874 FILL_NT4SYNC = "NT4SYNC"
 875 FILL_DRS = "DRS"
 876
 877 def provision(setup_dir, message, session_info,
 878               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
 879               realm=None, rootdn=None, domaindn=None, schemadn=None,
 880               configdn=None, domain=None, hostname=None, hostip=None,
 881               hostip6=None, domainsid=None, adminpass=None, krbtgtpass=None,
 882               domainguid=None, policyguid=None, invocationid=None,
 883               machinepass=None, dnspass=None, root=None, nobody=None,
 884               nogroup=None, users=None, wheel=None, backup=None, aci=None,
 885               serverrole=None, ldap_backend=None, ldap_backend_type=None,
 886               sitename=None):
 887     """Provision samba4
 888
 889     :note: caution, this wipes all existing data!
 890     """
 891
 892     def setup_path(file):
 893         return os.path.join(setup_dir, file)
 894
 895     if domainsid is None:
 896         domainsid = security.random_sid()
 897     else:
 898         domainsid = security.Sid(domainsid)
 899
 900     if policyguid is None:
 901         policyguid = uuid.random()
 902     if adminpass is None:
 903         adminpass = misc.random_password(12)
 904     if krbtgtpass is None:
 905         krbtgtpass = misc.random_password(12)
 906     if machinepass is None:
 907         machinepass  = misc.random_password(12)
 908     if dnspass is None:
 909         dnspass = misc.random_password(12)
 910     root_uid = findnss_uid([root or "root"])
 911     nobody_uid = findnss_uid([nobody or "nobody"])
 912     users_gid = findnss_gid([users or "users"])
 913     if wheel is None:
 914         wheel_gid = findnss_gid(["wheel", "adm"])
 915     else:
 916         wheel_gid = findnss_gid([wheel])
 917     if aci is None:
 918         aci = "# no aci for local ldb"
 919
 920     if smbconf is None:
 921         os.makedirs(os.path.join(targetdir, "etc"))
 922         smbconf = os.path.join(targetdir, "etc", "smb.conf")
 923
 924     # only install a new smb.conf if there isn't one there already
 925     if not os.path.exists(smbconf):
 926         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
 927                      targetdir)
 928
 929     lp = param.LoadParm()
 930     lp.load(smbconf)
 931
 932     names = guess_names(lp=lp, hostname=hostname, domain=domain,
 933                         dnsdomain=realm, serverrole=serverrole,
 934                         sitename=sitename, rootdn=rootdn, domaindn=domaindn,
 935                         configdn=configdn, schemadn=schemadn)
 936
 937     paths = provision_paths_from_lp(lp, names.dnsdomain)
 938
 939     if hostip is None:
 940         hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 941
 942     if hostip6 is None:
 943         try:
 944             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 945         except socket.gaierror:
 946             pass
 947
 948     if serverrole is None:
 949         serverrole = lp.get("server role")
 950
 951     assert serverrole in ("domain controller", "member server", "standalone")
 952     if invocationid is None and serverrole == "domain controller":
 953         invocationid = uuid.random()
 954
 955     if not os.path.exists(paths.private_dir):
 956         os.mkdir(paths.private_dir)
 957
 958     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
 959
 960     if ldap_backend is not None:
 961         if ldap_backend == "ldapi":
 962             # provision-backend will set this path suggested slapd command line / fedorads.inf
 963             ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
 964
 965     # only install a new shares config db if there is none
 966     if not os.path.exists(paths.shareconf):
 967         message("Setting up share.ldb")
 968         share_ldb = Ldb(paths.shareconf, session_info=session_info,
 969                         credentials=credentials, lp=lp)
 970         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
 971
 972
 973     message("Setting up secrets.ldb")
 974     secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
 975                                   session_info=session_info,
 976                                   credentials=credentials, lp=lp)
 977
 978     message("Setting up the registry")
 979     setup_registry(paths.hklm, setup_path, session_info,
 980                    credentials=credentials, lp=lp)
 981
 982     message("Setting up templates db")
 983     setup_templatesdb(paths.templates, setup_path, session_info=session_info,
 984                       credentials=credentials, lp=lp)
 985
 986     message("Setting up idmap db")
 987     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
 988                           credentials=credentials, lp=lp)
 989
 990     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info,
 991                         credentials=credentials, lp=lp, names=names,
 992                         message=message,
 993                         domainsid=domainsid,
 994                         aci=aci, domainguid=domainguid, policyguid=policyguid,
 995                         fill=samdb_fill,
 996                         adminpass=adminpass, krbtgtpass=krbtgtpass,
 997                         invocationid=invocationid,
 998                         machinepass=machinepass, dnspass=dnspass,
 999                         serverrole=serverrole, ldap_backend=ldap_backend,
1000                         ldap_backend_type=ldap_backend_type)
1001
1002     if lp.get("server role") == "domain controller":
1003        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1004                                   "{" + policyguid + "}")
1005        os.makedirs(policy_path, 0755)
1006        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1007        os.makedirs(os.path.join(policy_path, "User"), 0755)
1008        if not os.path.isdir(paths.netlogon):
1009             os.makedirs(paths.netlogon, 0755)
1010        secrets_ldb = Ldb(paths.secrets, session_info=session_info,
1011                          credentials=credentials, lp=lp)
1012        secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1013                            netbiosname=names.netbiosname, domainsid=domainsid,
1014                            keytab_path=paths.keytab, samdb_url=paths.samdb,
1015                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
1016                            machinepass=machinepass, dnsdomain=names.dnsdomain)
1017
1018     if samdb_fill == FILL_FULL:
1019         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1020                             root_uid=root_uid, nobody_uid=nobody_uid,
1021                             users_gid=users_gid, wheel_gid=wheel_gid)
1022
1023         message("Setting up sam.ldb rootDSE marking as synchronized")
1024         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1025
1026         # Only make a zone file on the first DC, it should be replicated with DNS replication
1027         if serverrole == "domain controller":
1028             samdb = SamDB(paths.samdb, session_info=session_info,
1029                       credentials=credentials, lp=lp)
1030
1031             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1032             assert isinstance(domainguid, str)
1033             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1034                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1035                                        scope=SCOPE_SUBTREE)
1036             assert isinstance(hostguid, str)
1037
1038             create_zone_file(paths.dns, setup_path, samdb,
1039                              hostname=names.hostname, hostip=hostip,
1040                              hostip6=hostip6, dnsdomain=names.dnsdomain,
1041                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm,
1042                              domainguid=domainguid, hostguid=hostguid)
1043             message("Please install the zone located in %s into your DNS server" % paths.dns)
1044
1045     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path,
1046                                ldapi_url)
1047
1048     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1049
1050     message("Once the above files are installed, your server will be ready to use")
1051     message("Server Type:    %s" % serverrole)
1052     message("Hostname:       %s" % names.hostname)
1053     message("NetBIOS Domain: %s" % names.domain)
1054     message("DNS Domain:     %s" % names.dnsdomain)
1055     message("DOMAIN SID:     %s" % str(domainsid))
1056     message("Admin password: %s" % adminpass)
1057
1058     result = ProvisionResult()
1059     result.domaindn = domaindn
1060     result.paths = paths
1061     result.lp = lp
1062     result.samdb = samdb
1063     return result
1064
1065 def provision_become_dc(setup_dir=None,
1066                         smbconf=None, targetdir=None, realm=None,
1067                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1068                         domain=None, hostname=None, domainsid=None,
1069                         adminpass=None, krbtgtpass=None, domainguid=None,
1070                         policyguid=None, invocationid=None, machinepass=None,
1071                         dnspass=None, root=None, nobody=None, nogroup=None, users=None,
1072                         wheel=None, backup=None, aci=None, serverrole=None,
1073                         ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
1074
1075     def message(text):
1076         """print a message if quiet is not set."""
1077         print text
1078
1079     provision(setup_dir, message, system_session(), None,
1080               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
1081               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn,
1082               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
1083
1084
1085 def setup_db_config(setup_path, file, dbdir):
1086     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1087         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
1088     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1089         os.makedirs(os.path.join(dbdir, "tmp"), 0700);
1090
1091     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1092                {"LDAPDBDIR": dbdir})
1093
1094
1095
1096 def provision_backend(setup_dir=None, message=None,
1097                       smbconf=None, targetdir=None, realm=None,
1098                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1099                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
1100                       ldap_backend_type=None):
1101
1102     def setup_path(file):
1103         return os.path.join(setup_dir, file)
1104
1105     if hostname is None:
1106         hostname = socket.gethostname().split(".")[0].lower()
1107
1108     if root is None:
1109         root = findnss(pwd.getpwnam, ["root"])[0]
1110
1111     if smbconf is None:
1112         os.makedirs(os.path.join(targetdir, "etc"))
1113         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1114
1115     # only install a new smb.conf if there isn't one there already
1116     if not os.path.exists(smbconf):
1117         make_smbconf(smbconf, setup_path, hostname, domain, realm,
1118                               serverrole, targetdir)
1119
1120     lp = param.LoadParm()
1121     lp.load(smbconf)
1122
1123     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1124                         dnsdomain=realm, serverrole=serverrole,
1125                         rootdn=rootdn, domaindn=domaindn, configdn=configdn,
1126                         schemadn=schemadn)
1127
1128     paths = provision_paths_from_lp(lp, names.dnsdomain)
1129
1130     if not os.path.isdir(paths.ldapdir):
1131         os.makedirs(paths.ldapdir)
1132     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1133     try:
1134         os.unlink(schemadb_path)
1135     except:
1136         pass
1137
1138     schemadb = Ldb(schemadb_path, lp=lp)
1139
1140     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"),
1141                    {"SCHEMADN": names.schemadn,
1142                     "ACI": "#",
1143                     "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
1144                     })
1145     setup_modify_ldif(schemadb,
1146                       setup_path("provision_schema_basedn_modify.ldif"), \
1147                           {"SCHEMADN": names.schemadn,
1148                            "NETBIOSNAME": names.netbiosname,
1149                            "DEFAULTSITE": DEFAULTSITE,
1150                            "CONFIGDN": names.configdn,
1151                            })
1152
1153     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
1154                    {"SCHEMADN": names.schemadn })
1155     setup_add_ldif(schemadb, setup_path("schema.ldif"),
1156                    {"SCHEMADN": names.schemadn})
1157
1158     if ldap_backend_type == "fedora-ds":
1159         setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf,
1160                    {"ROOT": root,
1161                     "HOSTNAME": hostname,
1162                     "DNSDOMAIN": names.dnsdomain,
1163                     "LDAPDIR": paths.ldapdir,
1164                     "DOMAINDN": names.domaindn,
1165                     "LDAPMANAGERDN": names.ldapmanagerdn,
1166                     "LDAPMANAGERPASS": adminpass,
1167                     "SERVERPORT": ""})
1168
1169         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
1170                    {"CONFIGDN": names.configdn,
1171                     "SCHEMADN": names.schemadn,
1172                     })
1173
1174         setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
1175                    {"CONFIGDN": names.configdn,
1176                     "SCHEMADN": names.schemadn,
1177                     })
1178         mapping = "schema-map-fedora-ds-1.0"
1179         backend_schema = "99_ad.ldif"
1180     elif ldap_backend_type == "openldap":
1181         attrs = ["linkID", "lDAPDisplayName"]
1182     res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
1183
1184     memberof_config = "# Generated from schema in " + schemadb_path + "\n";
1185     refint_attributes = "";
1186     for i in range (0, len(res)):
1187             linkid = res[i]["linkID"][0]
1188             linkid = str(int(linkid) + 1)
1189             expression = "(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))"
1190             target = schemadb.searchone(basedn=names.schemadn,
1191                                         expression=expression,
1192                                         attribute="lDAPDisplayName",
1193                                         scope=SCOPE_SUBTREE);
1194             if target is not None:
1195                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0];
1196                 memberof_config = memberof_config + """overlay memberof
1197 memberof-dangling error
1198 memberof-refint TRUE
1199 memberof-group-oc top
1200 memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
1201 memberof-memberof-ad """ + target + """
1202 memberof-dangling-error 32
1203
1204 """;
1205
1206     memberof_config = memberof_config + """
1207 overlay refint
1208 refint_attributes""" + refint_attributes + "\n";
1209
1210     setup_file(setup_path("slapd.conf"), paths.slapdconf,
1211                    {"DNSDOMAIN": names.dnsdomain,
1212                     "LDAPDIR": paths.ldapdir,
1213                     "DOMAINDN": names.domaindn,
1214                     "CONFIGDN": names.configdn,
1215                     "SCHEMADN": names.schemadn,
1216                     "LDAPMANAGERDN": names.ldapmanagerdn,
1217                     "LDAPMANAGERPASS": adminpass,
1218                     "MEMBEROF_CONFIG": memberof_config})
1219     setup_file(setup_path("modules.conf"), paths.modulesconf,
1220                    {"REALM": names.realm})
1221
1222     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
1223     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
1224     setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
1225     mapping = "schema-map-openldap-2.3"
1226     backend_schema = "backend-schema.schema"
1227
1228
1229     ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1230     message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
1231
1232
1233     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
1234
1235     os.system(schema_command)
1236
1237
1238
1239 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1240     """Create a PHP LDAP admin configuration file.
1241
1242     :param path: Path to write the configuration to.
1243     :param setup_path: Function to generate setup paths.
1244     """
1245     setup_file(setup_path("phpldapadmin-config.php"), path,
1246             {"S4_LDAPI_URI": ldapi_uri})
1247
1248
1249 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
1250                   hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
1251     """Write out a DNS zone file, from the info in the current database.
1252
1253     :param path: Path of the new file.
1254     :param setup_path": Setup path function.
1255     :param samdb: SamDB object
1256     :param dnsdomain: DNS Domain name
1257     :param domaindn: DN of the Domain
1258     :param hostip: Local IPv4 IP
1259     :param hostip6: Local IPv6 IP
1260     :param hostname: Local hostname
1261     :param dnspass: Password for DNS
1262     :param realm: Realm name
1263     :param domainguid: GUID of the domain.
1264     :param hostguid: GUID of the host.
1265     """
1266     assert isinstance(domainguid, str)
1267
1268     hostip6_base_line = ""
1269     hostip6_host_line = ""
1270
1271     if hostip6 is not None:
1272         hostip6_base_line = "            IN AAAA    " + hostip6
1273         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1274
1275     setup_file(setup_path("provision.zone"), path, {
1276             "DNSPASS_B64": b64encode(dnspass),
1277             "HOSTNAME": hostname,
1278             "DNSDOMAIN": dnsdomain,
1279             "REALM": realm,
1280             "HOSTIP": hostip,
1281             "DOMAINGUID": domainguid,
1282             "DATESTRING": time.strftime("%Y%m%d%H"),
1283             "DEFAULTSITE": DEFAULTSITE,
1284             "HOSTGUID": hostguid,
1285             "HOSTIP6_BASE_LINE": hostip6_base_line,
1286             "HOSTIP6_HOST_LINE": hostip6_host_line,
1287         })
1288
1289 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
1290     """Load schema for the SamDB.
1291
1292     :param samdb: Load a schema into a SamDB.
1293     :param setup_path: Setup path function.
1294     :param schemadn: DN of the schema
1295     :param netbiosname: NetBIOS name of the host.
1296     :param configdn: DN of the configuration
1297     """
1298     schema_data = open(setup_path("schema.ldif"), 'r').read()
1299     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1300     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1301     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1302     head_data = substitute_var(head_data, {
1303                     "SCHEMADN": schemadn,
1304                     "NETBIOSNAME": netbiosname,
1305                     "CONFIGDN": configdn,
1306                     "DEFAULTSITE":sitename
1307     })
1308     samdb.attach_schema_from_ldif(head_data, schema_data)
1309