s4-s3upgrade: Try harder to get group memberships on upgrade

[samba.git] / source4 / scripting / python / samba / upgrade.py

diff --git a/source4/scripting/python/samba/upgrade.py b/source4/scripting/python/samba/upgrade.py
index 850035b9e938108888961686505fc85dba306969..ce9683e1274bb07abf22d3ec794bb8075cfa0cdf 100644 (file)
--- a/source4/scripting/python/samba/upgrade.py
+++ b/source4/scripting/python/samba/upgrade.py
@@ -65,7 +65,7 @@ def import_sam_policy(samdb, policy, logger):
         'minPwdAge')
 
     max_pw_age_unix = policy['maximum password age']
-    if max_pw_age_unix == -1:
+    if max_pw_age_unix == -1 or max_pw_age_unix == 0:
         max_pw_age_nt = -0x8000000000000000
     else:
         max_pw_age_nt = int(-max_pw_age_unix * (1e7 * 60 * 60 * 24))
@@ -534,13 +534,21 @@ def upgrade_from_samba3(samba3, logger, targetdir, session_info=None, useeadb=Fa
 
         # Get members for each group/alias
         if group.sid_name_use == lsa.SID_NAME_ALIAS:
-            members = s3db.enum_aliasmem(group.sid)
+            try:
+                members = s3db.enum_aliasmem(group.sid)
+                groupmembers[str(group.sid)] = members
+            except passdb.error, e:
+                logger.warn("Ignoring group '%s' %s listed but then not found: %s",
+                            group.nt_name, group.sid, e)
+                continue
         elif group.sid_name_use == lsa.SID_NAME_DOM_GRP:
             try:
                 members = s3db.enum_group_members(group.sid)
-            except passdb.error:
+                groupmembers[str(group.sid)] = members
+            except passdb.error, e:
+                logger.warn("Ignoring group '%s' %s listed but then not found: %s",
+                            group.nt_name, group.sid, e)
                 continue
-            groupmembers[group.nt_name] = members
         elif group.sid_name_use == lsa.SID_NAME_WKN_GRP:
             (group_dom_sid, rid) = group.sid.split()
             if (group_dom_sid != security.dom_sid(security.SID_BUILTIN)):
@@ -548,10 +556,16 @@ def upgrade_from_samba3(samba3, logger, targetdir, session_info=None, useeadb=Fa
                             group.nt_name)
                 continue
             # A number of buggy databases mix up well known groups and aliases.
-            members = s3db.enum_aliasmem(group.sid)
+            try:
+                members = s3db.enum_aliasmem(group.sid)
+                groupmembers[str(group.sid)] = members
+            except passdb.error, e:
+                logger.warn("Ignoring group '%s' %s listed but then not found: %s",
+                            group.nt_name, group.sid, e)
+                continue
         else:
-            logger.warn("Ignoring group '%s' with sid_name_use=%d",
-                        group.nt_name, group.sid_name_use)
+            logger.warn("Ignoring group '%s' %s with sid_name_use=%d",
+                        group.nt_name, group.sid, group.sid_name_use)
             continue
 
     # Export users from old passdb backend
@@ -603,6 +617,19 @@ Please fix this account before attempting to upgrade again
         if username.lower() == 'administrator':
             admin_user = username
 
+        try:
+            group_memberships = s3db.enum_group_memberships(user);
+            for group in group_memberships:
+                if str(group) in groupmembers:
+                    if user.user_sid not in groupmembers[str(group)]:
+                        groupmembers[str(group)].append(user.user_sid)
+                else:
+                    groupmembers[str(group)] = [user.user_sid];
+        except passdb.error, e:
+            logger.warn("Ignoring group memberships of '%s' %s: %s",
+                        username, user.user_sid, e)
+
+
     logger.info("Next rid = %d", next_rid)
 
     # Check for same username/groupname
@@ -643,6 +670,7 @@ Please fix this account before attempting to upgrade again
                        hostname=netbiosname.lower(), machinepass=machinepass,
                        serverrole=serverrole, samdb_fill=FILL_FULL,
                        useeadb=useeadb, dns_backend=dns_backend)
+    result.report_logger(logger)
 
     # Import WINS database
     logger.info("Importing WINS database")
@@ -693,8 +721,8 @@ Please fix this account before attempting to upgrade again
 
     logger.info("Adding users to groups")
     for g in grouplist:
-        if g.nt_name in groupmembers:
-            add_users_to_group(result.samdb, g, groupmembers[g.nt_name], logger)
+        if str(g.sid) in groupmembers:
+            add_users_to_group(result.samdb, g, groupmembers[str(g.sid)], logger)
 
     # Set password for administrator
     if admin_user: