s4-samba_upgradedns: Do not set DNS account for internal server

[metze/samba/wip.git] / source4 / scripting / bin / samba_upgradedns

diff --git a/source4/scripting/bin/samba_upgradedns b/source4/scripting/bin/samba_upgradedns
index 1a42e0c8cefe7a73671cfef875969ace5554f9e2..c1220bcc264d2c242e4f091b73c057aba5a452b7 100755 (executable)
--- a/source4/scripting/bin/samba_upgradedns
+++ b/source4/scripting/bin/samba_upgradedns
@@ -26,7 +26,7 @@ import grp
 from base64 import b64encode
 import shlex
 
-sys.path.insert(0, 'bin/python')
+sys.path.insert(0, "bin/python")
 
 import ldb
 import samba
@@ -345,7 +345,7 @@ if __name__ == '__main__':
     # Create DNS partitions if missing and fill DNS information
     try:
         expression = '(|(dnsRoot=DomainDnsZones.%s)(dnsRoot=ForestDnsZones.%s))' % \
-                     (dnsdomain, dnsdomain)
+                     (dnsdomain, dnsforest)
         msg = ldbs.sam.search(base=names.configdn, scope=ldb.SCOPE_DEFAULT,
                               expression=expression, attrs=['nCName'])
         ncname = msg[0]['nCName'][0]
@@ -379,69 +379,83 @@ if __name__ == '__main__':
         msg = msgs[0]
 
         master_nclist = []
-        for nc in msg["msDS-hasMasterNCs"]:
-            master_nclist.append(nc)
+        ncs = msg.get("msDS-hasMasterNCs")
+        if ncs:
+            for nc in ncs:
+                master_nclist.append(nc)
 
         partial_nclist = []
-        for nc in msg["hasPartialReplicaNCs"]:
-            partial_nclist.append(nc)
+        ncs = msg.get("hasPartialReplicaNCs")
+        if ncs:
+            for nc in ncs:
+                partial_nclist.append(nc)
 
-        modified = False
+        modified_master = False
+        modified_partial = False
         for nc in dns_nclist:
             if nc not in master_nclist:
                 master_nclist.append(nc)
-                modified = True
+                modified_master = True
             if nc in partial_nclist:
                 partial_nclist.remove(nc)
-                modified = True
+                modified_partial = True
 
-        if modified:
+        if modified_master or modified_partial:
             logger.debug("Updating msDS-hasMasterNCs and hasPartialReplicaNCs attributes")
-            msg["msDS-hasMasterNCs"] = ldb.MessageElement(master_nclist,
-                                                          ldb.FLAG_MOD_REPLACE,
-                                                          "msDS-hasMasterNCs")
-            msg["hasPartialReplicaNCs"] = ldb.MessageElement(partial_nclist,
-                                                             ldb.FLAG_MOD_REPLACE,
-                                                             "hasPartialReplicaNCs")
-            ldbs.sam.modify(msg)
+            m = ldb.Message()
+            m.dn = msg.dn
+            if modified_master:
+                m["msDS-hasMasterNCs"] = ldb.MessageElement(master_nclist,
+                                                            ldb.FLAG_MOD_REPLACE,
+                                                            "msDS-hasMasterNCs")
+            if modified_partial:
+                if partial_nclist:
+                    m["hasPartialReplicaNCs"] = ldb.MessageElement(partial_nclist,
+                                                                   ldb.FLAG_MOD_REPLACE,
+                                                                   "hasPartialReplicaNCs")
+                else:
+                    m["hasPartialReplicaNCs"] = ldb.MessageElement(ncs,
+                                                                   ldb.FLAG_MOD_DELETE,
+                                                                   "hasPartialReplicaNCs")
+            ldbs.sam.modify(m)
     except Exception:
         raise
 
-    # Check if dns-HOSTNAME account exists and create it if required
-    try:
-        dn = 'samAccountName=dns-%s,CN=Principals' % hostname
-        msg = ldbs.secrets.search(expression='(dn=%s)' % dn, attrs=['secret'])
-        dnssecret = msg[0]['secret'][0]
-    except Exception:
-        logger.info("Adding dns-%s account" % hostname)
-
+    # Special stuff for DLZ backend
+    if opts.dns_backend == "BIND9_DLZ":
+        # Check if dns-HOSTNAME account exists and create it if required
         try:
-            msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
-                                  expression='(sAMAccountName=dns-%s)' % (hostname),
-                                  attrs=['clearTextPassword'])
-            dn = msg[0].dn
-            ldbs.sam.delete(dn)
+            dn = 'samAccountName=dns-%s,CN=Principals' % hostname
+            msg = ldbs.secrets.search(expression='(dn=%s)' % dn, attrs=['secret'])
+            dnssecret = msg[0]['secret'][0]
         except Exception:
-            pass
-
-        dnspass = samba.generate_random_password(128, 255)
-        setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
-                       "DNSDOMAIN": dnsdomain,
-                       "DOMAINDN": domaindn,
-                       "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
-                       "HOSTNAME" : hostname,
-                       "DNSNAME" : dnsname }
-                       )
-
-        secretsdb_setup_dns(ldbs.secrets, names,
-                            paths.private_dir, realm=names.realm,
-                            dnsdomain=names.dnsdomain,
-                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass)
-    else:
-        logger.info("dns-%s account already exists" % hostname)
+            logger.info("Adding dns-%s account" % hostname)
+
+            try:
+                msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
+                                      expression='(sAMAccountName=dns-%s)' % (hostname),
+                                      attrs=['clearTextPassword'])
+                dn = msg[0].dn
+                ldbs.sam.delete(dn)
+            except Exception:
+                pass
+
+            dnspass = samba.generate_random_password(128, 255)
+            setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
+                    "DNSDOMAIN": dnsdomain,
+                    "DOMAINDN": domaindn,
+                    "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
+                    "HOSTNAME" : hostname,
+                    "DNSNAME" : dnsname }
+                           )
+
+            secretsdb_setup_dns(ldbs.secrets, names,
+                                paths.private_dir, realm=names.realm,
+                                dnsdomain=names.dnsdomain,
+                                dns_keytab_path=paths.dns_keytab, dnspass=dnspass)
+        else:
+            logger.info("dns-%s account already exists" % hostname)
 
-    # Special stuff for DLZ backend
-    if opts.dns_backend == "BIND9_DLZ":
         # This forces a re-creation of dns directory and all the files within
         # It's an overkill, but it's easier to re-create a samdb copy, rather
         # than trying to fix a broken copy.