sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code
9bcb656bba
samba-mirror/source4/setup/provision_self_join.ldif

70 lines
2.4 KiB
Plaintext
Raw Normal View History

s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# Accounts for selfjoin (joins DC to itself)
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# Object under "Domain Controllers"
r23815: Thanks to Matthias Wallnoefer <mwallnoefer@yahoo.de> for pointing out that we had the wrong objectClass for OU=Domain Controllers,${DOMAINDN} (was CN=Domain Controllers,${DOMAINDN}) This fixes both the SAMR server and the LDIF templates. Andrew Bartlett (This used to be commit 625a9e6c041bedc93925bdebb3a60af1dbdde317)
2007-07-10 17:26:10 +04:00
dn: CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
[SAMBA 4 directory] Adds the complete "objectclass path" to our self-created DC object Found after some comparisons against Windows Server 2003 R2.
2009-06-30 15:52:39 +04:00
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
objectClass: computer
accountExpires: 9223372036854775807
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
dNSHostName: ${DNSNAME}
s4:AD content - Add the DFSR objects which exist on Windows Server >= 2008 Those replace the FRS ones.
2010-02-20 13:15:25 +03:00
# "MSDFSR-ComputerReferenceBL" doesn't exist since we still miss DFSR support
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
isCriticalSystemObject: TRUE
localPolicyFlags: 0
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
operatingSystem: Samba
s4:dsdb Handle dc/domain/forest functional levels properly Rather than have the functional levels scattered in 4 different, unconnected locations, the provision script now sets it, and the rootdse module maintains it's copy only as a cached view onto the original values. We also use the functional level to determine if we should store AES Kerberos keys. Andrew Bartlett
2009-07-14 02:15:50 +04:00
operatingSystemVersion: ${SAMBA_VERSION_STRING}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
sAMAccountName: ${NETBIOSNAME}$
s4:AD content - Add the DFSR objects which exist on Windows Server >= 2008 Those replace the FRS ones.
2010-02-20 13:15:25 +03:00
# "servicePrincipalName"s for FRS and DFSR don't exit since we still miss DFRS support
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# "servicePrincipalName"s for DNS ("ldap/../ForestDnsZones",
# "ldap/../DomainDnsZones", "DNS/..") don't exist since we don't support AD DNS
servicePrincipalName: GC/${DNSNAME}/${REALM}
servicePrincipalName: HOST/${DNSNAME}/${DOMAIN}
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
servicePrincipalName: HOST/${NETBIOSNAME}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
servicePrincipalName: HOST/${DNSNAME}
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
servicePrincipalName: HOST/${DNSNAME}/${REALM}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# "servicePrincipalName"s with GUIDs are located in
# "provision_self_join_modify.ldif"
servicePrincipalName: ldap/${DNSNAME}/${DOMAIN}
servicePrincipalName: ldap/${NETBIOSNAME}
servicePrincipalName: ldap/${DNSNAME}
servicePrincipalName: ldap/${DNSNAME}/${REALM}
userAccountControl: 532480
userPassword:: ${MACHINEPASS_B64}
s4:provision: don't use hardcoded values for 'nextRid' and 'rIDAvailablePool' On Windows dcpromo imports nextRid from the local SAM, which means it's not hardcoded to 1000. The initlal rIDAvailablePool starts at nextRid + 100. I also found that the RID Set of the local dc should be created via provision and not at runtime, when the first rid is needed. (Tested with dcpromo on w2k8r2, while disabling the DNS check box). After provision we should have this (assuming nextRid=1000): rIDAllocationPool: 1100-1599 rIDPrevAllocationPool: 1100-1599 rIDUsedPool: 0 rIDNextRID: 1100 rIDAvailablePool: 1600-1073741823 Because provision sets rIDNextRid=1100, the first created account (typically DNS related accounts) will get 1101 as rid! metze
2010-06-25 13:11:56 +04:00
objectSID: ${DOMAINSID}-${DCRID}
s4-provision: added an initial RID Set We will allocate RIDs from this set Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-05 07:20:10 +03:00
s4:provision_self_join.ldif - Adapt comment after implementation of distributed RIDs
2010-01-08 20:18:21 +03:00
# Here are missing the objects for the NTFRS subscription since we don't
# support this technique yet.
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# Objects under "Configuration/Sites/<Default sitename>/Servers"
r25299: Modify the provision script to take an additional argument: --server-role This must be set to either 'domain controller', 'domain member' or 'standalone'. The default for the provision now changes to 'standalone'. This is not because Samba4 is particularlly useful in that mode, but because we still want a positive sign from the administrator that we should advertise as a DC. We now do more to ensure the 'standalone' and 'member server' provision output is reasonable, and try not to set odd things into the database that only belong for the DC. Andrew Bartlett (This used to be commit 4cc4ed7719aff712e735628410bd3813c7d6aa40)
2007-09-22 16:57:17 +04:00
Be consistant in using ${SEVERDN}. This ensures we don't fall out of sync with the provision scripts. Andrew Bartlett (This used to be commit 566c60b4649e2b94bf467993acd4bf72c7368e5a)
2008-04-09 08:51:22 +04:00
dn: ${SERVERDN}
r25452: Move the creation of the server entry to the self join, as this makes no sense on a member server. Andrew Bartlett (This used to be commit 70467fa4c5d25b83c48dbbeb8236d5acb4550e77)
2007-10-02 01:08:53 +04:00
objectClass: top
objectClass: server
systemFlags: 1375731712
dNSHostName: ${DNSNAME}
serverReference: CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
Be consistant in using ${SEVERDN}. This ensures we don't fall out of sync with the provision scripts. Andrew Bartlett (This used to be commit 566c60b4649e2b94bf467993acd4bf72c7368e5a)
2008-04-09 08:51:22 +04:00
dn: CN=NTDS Settings,${SERVERDN}
r25452: Move the creation of the server entry to the self join, as this makes no sense on a member server. Andrew Bartlett (This used to be commit 70467fa4c5d25b83c48dbbeb8236d5acb4550e77)
2007-10-02 01:08:53 +04:00
objectClass: top
objectClass: applicationSettings
objectClass: nTDSDSA
dMDLocation: ${SCHEMADN}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
hasMasterNCs: ${CONFIGDN}
hasMasterNCs: ${SCHEMADN}
hasMasterNCs: ${DOMAINDN}
r25452: Move the creation of the server entry to the self join, as this makes no sense on a member server. Andrew Bartlett (This used to be commit 70467fa4c5d25b83c48dbbeb8236d5acb4550e77)
2007-10-02 01:08:53 +04:00
invocationId: ${INVOCATIONID}
s4:dsdb Handle dc/domain/forest functional levels properly Rather than have the functional levels scattered in 4 different, unconnected locations, the provision script now sets it, and the rootdse module maintains it's copy only as a cached view onto the original values. We also use the functional level to determine if we should store AES Kerberos keys. Andrew Bartlett
2009-07-14 02:15:50 +04:00
msDS-Behavior-Version: ${DOMAIN_CONTROLLER_FUNCTIONALITY}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
msDS-HasDomainNCs: ${DOMAINDN}
# "msDS-HasInstantiatedNCs"s for DNS don't exist since we don't support AD DNS
msDS-HasInstantiatedNCs: B:8:0000000D:${CONFIGDN}
msDS-HasInstantiatedNCs: B:8:0000000D:${SCHEMADN}
msDS-HasInstantiatedNCs: B:8:00000005:${DOMAINDN}
# "msDS-hasMasterNCs"s for DNS don't exist since we don't support AD DNS
r26298: Use metze's schema loading code to pre-initialise the schema into the samdb before we start writing entries into it. In doing so, I realised we still used 'dnsDomain', which is not part of the standard schema (now removed). We also set the 'wrong' side of the linked attributes for the masteredBy on each partition - this is now set in provision_self_join and backlinks via the linked attributes code. When we have the schema loaded, we must also have a valid domain SID loaded, so that the objectclass module works. This required some ejs glue. Andrew Bartlett (This used to be commit b0de08916e8cb59ce6a2ea94bbc9ac0679830ac1)
2007-12-05 02:40:48 +03:00
msDS-hasMasterNCs: ${CONFIGDN}
msDS-hasMasterNCs: ${SCHEMADN}
msDS-hasMasterNCs: ${DOMAINDN}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
options: 1
systemFlags: 33554432
s4: Improve provisioning: use relax control Give the possibility to specify controls when loading ldif files. Relax control is specified by default for all ldb_add_diff (request Andrew B). Set domainguid if specified at the creation of object instead of modifying afterward Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
2009-09-23 01:49:22 +04:00
${NTDSGUID}
Copy Permalink