mirror of
https://github.com/samba-team/samba.git
synced 2025-08-04 08:22:08 +03:00
Added mmr and olc to the OpenLDAP backend provisioning-scripts
These extensions add mmr (multi-master-replication) and olc (openldap-online-configuration) capabilities to the provisioning-scripts (provision-backend and provision.py), for use with the openldap-backend (only versions >=2.4.15!). Changes / additions made to the provision-backend -script: added new command-line-options: --ol-mmr-urls=<list of whitespace separated ldap-urls> for use with mmr (can be combined with --ol-olc=yes), --ol-olc=[yes/no] (activate automatic conversion from static slapd.conf to olc), --ol-slaptest=<path to slaptest binary> (needed in conjunction with --ol-olc=yes) Changes / additions made to the provision.py -script: added extensions, that will automatically generate the chosen mmr and/or olc setup for the openldap backend, according to the to chosen parameters set in the provision-backend script Signed-off-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Oliver Liebel
committed by
Andrew Bartlett
Andrew Bartlett
parent
00173c6ce6
commit
31f2cddcf5
@ -26,6 +26,7 @@
|
||||
|
||||
from base64 import b64encode
|
||||
import os
|
||||
import sys
|
||||
import pwd
|
||||
import grp
|
||||
import time
|
||||
@ -96,6 +97,11 @@ class ProvisionPaths(object):
|
||||
self.olmmron = None
|
||||
self.olmmrserveridsconf = None
|
||||
self.olmmrsyncreplconf = None
|
||||
self.olcdir = None
|
||||
self.olslaptest = None
|
||||
self.olcseedldif = None
|
||||
self.olcsyncprovdir = None
|
||||
self.olcsyncprovfile = None
|
||||
|
||||
|
||||
class ProvisionNames(object):
|
||||
@ -268,6 +274,14 @@ def provision_paths_from_lp(lp, dnsdomain):
|
||||
"mmr_serverids.conf")
|
||||
paths.olmmrsyncreplconf = os.path.join(paths.ldapdir,
|
||||
"mmr_syncrepl.conf")
|
||||
paths.olcdir = os.path.join(paths.ldapdir,
|
||||
"slapd.d")
|
||||
paths.olcseedldif = os.path.join(paths.ldapdir,
|
||||
"olc_seed.ldif")
|
||||
paths.olcsyncprovdir = os.path.join(paths.olcdir,
|
||||
"cn=config/olcDatabase={0}config")
|
||||
paths.olcsyncprovfile = os.path.join(paths.olcsyncprovdir,
|
||||
"olcOverlay={0}syncprov.ldif")
|
||||
paths.hklm = "hklm.ldb"
|
||||
paths.hkcr = "hkcr.ldb"
|
||||
paths.hkcu = "hkcu.ldb"
|
||||
@ -1178,7 +1192,7 @@ def provision_backend(setup_dir=None, message=None,
|
||||
rootdn=None, domaindn=None, schemadn=None, configdn=None,
|
||||
domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
|
||||
ldap_backend_type=None, ldap_backend_port=None,
|
||||
ol_mmr_urls=None):
|
||||
ol_mmr_urls=None,ol_olc=None,ol_slaptest=None):
|
||||
|
||||
def setup_path(file):
|
||||
return os.path.join(setup_dir, file)
|
||||
@ -1205,6 +1219,19 @@ def provision_backend(setup_dir=None, message=None,
|
||||
make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
|
||||
targetdir)
|
||||
|
||||
# openldap-online-configuration: validation of olc and slaptest
|
||||
if ol_olc == "yes" and ol_slaptest is None:
|
||||
sys.exit("Warning: OpenLDAP-Online-Configuration cant be setup without path to slaptest-Binary!")
|
||||
|
||||
if ol_olc == "yes" and ol_slaptest is not None:
|
||||
ol_slaptest = ol_slaptest + "/slaptest"
|
||||
if not os.path.exists(ol_slaptest):
|
||||
message (ol_slaptest)
|
||||
sys.exit("Warning: Given Path to slaptest-Binary does not exist!")
|
||||
###
|
||||
|
||||
|
||||
|
||||
lp = param.LoadParm()
|
||||
lp.load(smbconf)
|
||||
|
||||
@ -1307,6 +1334,7 @@ def provision_backend(setup_dir=None, message=None,
|
||||
mmr_syncrepl_config_config = ""
|
||||
mmr_syncrepl_user_config = ""
|
||||
|
||||
|
||||
if ol_mmr_urls is not None:
|
||||
# For now, make these equal
|
||||
mmr_pass = adminpass
|
||||
@ -1345,7 +1373,49 @@ def provision_backend(setup_dir=None, message=None,
|
||||
"MMRDN": names.domaindn,
|
||||
"LDAPSERVER" : url,
|
||||
"MMR_PASSWORD": mmr_pass })
|
||||
# olc = yes?
|
||||
olc_config_pass = ""
|
||||
olc_config_acl = ""
|
||||
olc_syncrepl_config = ""
|
||||
olc_mmr_config = ""
|
||||
if ol_olc == "yes":
|
||||
olc_config_pass += read_and_sub_file(setup_path("olc_pass.conf"),
|
||||
{ "OLC_PW": adminpass })
|
||||
olc_config_acl += read_and_sub_file(setup_path("olc_acl.conf"),{})
|
||||
|
||||
# if olc = yes + mmr = yes, generate cn=config-replication directives
|
||||
# and olc_seed.lif for the other mmr-servers
|
||||
if ol_olc == "yes" and ol_mmr_urls is not None:
|
||||
serverid=0
|
||||
olc_serverids_config = ""
|
||||
olc_syncrepl_config = ""
|
||||
olc_syncrepl_seed_config = ""
|
||||
olc_mmr_config = ""
|
||||
olc_mmr_config += read_and_sub_file(setup_path("olc_mmr.conf"),{})
|
||||
rid=1000
|
||||
for url in url_list:
|
||||
serverid=serverid+1
|
||||
olc_serverids_config += read_and_sub_file(setup_path("olc_serverid.conf"),
|
||||
{ "SERVERID" : str(serverid),
|
||||
"LDAPSERVER" : url })
|
||||
|
||||
rid=rid+1
|
||||
olc_syncrepl_config += read_and_sub_file(setup_path("olc_syncrepl.conf"),
|
||||
{ "RID" : str(rid),
|
||||
"LDAPSERVER" : url,
|
||||
"MMR_PASSWORD": adminpass})
|
||||
|
||||
olc_syncrepl_seed_config += read_and_sub_file(setup_path("olc_syncrepl_seed.conf"),
|
||||
{ "RID" : str(rid),
|
||||
"LDAPSERVER" : url})
|
||||
|
||||
setup_file(setup_path("olc_seed.ldif"), paths.olcseedldif,
|
||||
{"OLC_SERVER_ID_CONF": olc_serverids_config,
|
||||
"OLC_PW": adminpass,
|
||||
"OLC_SYNCREPL_CONF": olc_syncrepl_seed_config})
|
||||
|
||||
|
||||
# end olc
|
||||
|
||||
setup_file(setup_path("slapd.conf"), paths.slapdconf,
|
||||
{"DNSDOMAIN": names.dnsdomain,
|
||||
@ -1360,6 +1430,10 @@ def provision_backend(setup_dir=None, message=None,
|
||||
"MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
|
||||
"MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
|
||||
"MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
|
||||
"OLC_CONFIG_PASS": olc_config_pass,
|
||||
"OLC_SYNCREPL_CONFIG": olc_syncrepl_config,
|
||||
"OLC_CONFIG_ACL": olc_config_acl,
|
||||
"OLC_MMR_CONFIG": olc_mmr_config,
|
||||
"REFINT_CONFIG": refint_config})
|
||||
setup_file(setup_path("modules.conf"), paths.modulesconf,
|
||||
{"REALM": names.realm})
|
||||
@ -1389,7 +1463,6 @@ def provision_backend(setup_dir=None, message=None,
|
||||
"LDAPTIME": timestring(int(time.time()))} )
|
||||
|
||||
|
||||
|
||||
mapping = "schema-map-openldap-2.3"
|
||||
backend_schema = "backend-schema.schema"
|
||||
|
||||
@ -1399,8 +1472,19 @@ def provision_backend(setup_dir=None, message=None,
|
||||
else:
|
||||
server_port_string = ""
|
||||
|
||||
if ol_olc != "yes" and ol_mmr_urls is None:
|
||||
slapdcommand="Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
|
||||
|
||||
if ol_olc == "yes" and ol_mmr_urls is None:
|
||||
slapdcommand="Start slapd with: slapd -F " + paths.olcdir + " -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
|
||||
|
||||
if ol_olc != "yes" and ol_mmr_urls is not None:
|
||||
slapdcommand="Start slapd with: slapd -F " + paths.ldapdir + "/slapd.conf -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
|
||||
|
||||
if ol_olc == "yes" and ol_mmr_urls is not None:
|
||||
slapdcommand="Start slapd with: slapd -F " + paths.olcdir + " -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
|
||||
|
||||
|
||||
ldapuser = "--username=samba-admin"
|
||||
|
||||
|
||||
@ -1437,6 +1521,27 @@ def provision_backend(setup_dir=None, message=None,
|
||||
message("Run provision with: " + " ".join(args))
|
||||
|
||||
|
||||
# if --ol-olc=yes, generate online-configuration in ../private/ldap/slapd.d
|
||||
if ol_olc == "yes":
|
||||
if not os.path.isdir(paths.olcdir):
|
||||
os.makedirs(paths.olcdir, 0770)
|
||||
paths.olslaptest = str(ol_slaptest)
|
||||
olc_command = paths.olslaptest + " -f" + paths.slapdconf + " -F" + paths.olcdir + " >/dev/null 2>&1"
|
||||
os.system(olc_command)
|
||||
#os.remove(paths.slapdconf)
|
||||
# use line below for debugging during olc-conversion with slaptest
|
||||
#olc_command = paths.olslaptest + " -f" + paths.slapdconf + " -F" + paths.olcdir"
|
||||
|
||||
# workaround, if overlay syncprov is was not created properly during conversion to cn=config.
|
||||
# otherwise, cn=config won't be replicated
|
||||
if ol_olc == "yes" and ol_mmr_urls is not None:
|
||||
if not os.path.exists(paths.olcsyncprovdir):
|
||||
os.makedirs(paths.olcsyncprovdir, 0770)
|
||||
setup_file(setup_path("olcOverlay={0}syncprov.ldif"),
|
||||
os.path.join(paths.olcsyncprovdir, "olcOverlay={0}syncprov.ldif"), {})
|
||||
|
||||
|
||||
|
||||
def create_phpldapadmin_config(path, setup_path, ldapi_uri):
|
||||
"""Create a PHP LDAP admin configuration file.
|
||||
|
||||
|
||||
@ -1,17 +1,6 @@
|
||||
#
|
||||
# Set the database in memory cache size.
|
||||
#
|
||||
set_cachesize 0 524288 0
|
||||
|
||||
#
|
||||
# Set log values.
|
||||
#
|
||||
set_lg_regionmax 104857
|
||||
set_lg_max 1048576
|
||||
set_lg_bsize 209715
|
||||
set_lg_dir ${LDAPDBDIR}/bdb-logs
|
||||
|
||||
#
|
||||
# Set temporary file creation directory.
|
||||
#
|
||||
set_tmp_dir ${LDAPDBDIR}/tmp
|
||||
|
||||
@ -1,2 +1 @@
|
||||
# Generated from template mmr_serverids.conf
|
||||
ServerID ${SERVERID} "${LDAPSERVER}"
|
||||
|
||||
11
source4/setup/olcOverlay={0}syncprov.ldif
Normal file
11
source4/setup/olcOverlay={0}syncprov.ldif
Normal file
@ -0,0 +1,11 @@
|
||||
dn: olcOverlay={0}syncprov
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcSyncProvConfig
|
||||
olcOverlay: {0}syncprov
|
||||
structuralObjectClass: olcSyncProvConfig
|
||||
entryUUID: 41df5aca-785a-102d-9077-999999999999
|
||||
creatorsName: cn=config
|
||||
createTimestamp: 20090116201111Z
|
||||
entryCSN: 20090116201111.111111Z#000000#000#000000
|
||||
modifiersName: cn=config
|
||||
modifyTimestamp: 20090116201111Z
|
||||
4
source4/setup/olc_acl.conf
Normal file
4
source4/setup/olc_acl.conf
Normal file
@ -0,0 +1,4 @@
|
||||
access to dn.sub="cn=config"
|
||||
by dn="cn=samba-admin,cn=samba" write
|
||||
by dn="cn=replicator,cn=samba" read
|
||||
|
||||
3
source4/setup/olc_mmr.conf
Normal file
3
source4/setup/olc_mmr.conf
Normal file
@ -0,0 +1,3 @@
|
||||
overlay syncprov
|
||||
MirrorMode on
|
||||
|
||||
3
source4/setup/olc_pass.conf
Normal file
3
source4/setup/olc_pass.conf
Normal file
@ -0,0 +1,3 @@
|
||||
database config
|
||||
rootdn cn=config
|
||||
|
||||
16
source4/setup/olc_seed.ldif
Normal file
16
source4/setup/olc_seed.ldif
Normal file
@ -0,0 +1,16 @@
|
||||
dn: cn=config
|
||||
objectClass: olcGlobal
|
||||
cn: config
|
||||
${OLC_SERVER_ID_CONF}
|
||||
|
||||
dn: olcDatabase={0}config,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
olcDatabase: {0}config
|
||||
olcRootDN: cn=config
|
||||
olcRootPW: ${OLC_PW}
|
||||
${OLC_SYNCREPL_CONF}olcMirrorMode: TRUE
|
||||
|
||||
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
|
||||
objectClass: olcSyncProvConfig
|
||||
olcOverlay: syncprov
|
||||
|
||||
1
source4/setup/olc_serverid.conf
Normal file
1
source4/setup/olc_serverid.conf
Normal file
@ -0,0 +1 @@
|
||||
olcServerID: ${SERVERID} "${LDAPSERVER}"
|
||||
13
source4/setup/olc_syncrepl.conf
Normal file
13
source4/setup/olc_syncrepl.conf
Normal file
@ -0,0 +1,13 @@
|
||||
# Generated from template olc_syncrepl.conf
|
||||
|
||||
syncrepl rid=${RID}
|
||||
provider="${LDAPSERVER}"
|
||||
searchbase="cn=config"
|
||||
filter="(!(olcDatabase={0}config))"
|
||||
type=refreshAndPersist
|
||||
retry="10 +"
|
||||
bindmethod=sasl
|
||||
saslmech=DIGEST-MD5
|
||||
authcid="replicator"
|
||||
credentials="${MMR_PASSWORD}"
|
||||
|
||||
5
source4/setup/olc_syncrepl_seed.conf
Normal file
5
source4/setup/olc_syncrepl_seed.conf
Normal file
@ -0,0 +1,5 @@
|
||||
olcSyncRepl: rid=${RID} provider="${LDAPSERVER}"
|
||||
binddn="cn=config" bindmethod=sasl saslmech=DIGEST-MD5
|
||||
authcid="replicator" credentials="linux"
|
||||
searchbase="cn=config" filter="(!(olcDatabase={0}config))"
|
||||
type=refreshAndPersist retry="10 +"
|
||||
@ -65,8 +65,12 @@ parser.add_option("--server-role", type="choice", metavar="ROLE",
|
||||
parser.add_option("--targetdir", type="string", metavar="DIR",
|
||||
help="Set target directory")
|
||||
parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
|
||||
help="List of LDAP-URLS [ ldap://<FQDN>:port/ (where port != 389) ] separated with whitespaces for use with OpenLDAP-MMR")
|
||||
|
||||
help="List of LDAP-URLS [ ldap://<FQDN>:port/ (where port != 389) ] separated with whitespaces for use with OpenLDAP-MMR (Multi-Master-Replication)")
|
||||
parser.add_option("--ol-olc", type="choice", metavar="OPENLDAP-OLC",
|
||||
help="To setup OpenLDAP-Backend with Online-Configuration [slapd.d] choose 'yes'",
|
||||
choices=["yes", "no"])
|
||||
parser.add_option("--ol-slaptest", type="string", metavar="SLAPTEST-PATH",
|
||||
help="Path to slaptest-binary [e.g.:'/usr/local/sbin']. Only for use with --ol-olc='yes'")
|
||||
|
||||
opts = parser.parse_args()[0]
|
||||
|
||||
@ -103,5 +107,7 @@ provision_backend(setup_dir=setup_dir, message=message, smbconf=smbconf, targetd
|
||||
root=opts.root, serverrole=server_role,
|
||||
ldap_backend_type=opts.ldap_backend_type,
|
||||
ldap_backend_port=opts.ldap_backend_port,
|
||||
ol_mmr_urls=opts.ol_mmr_urls)
|
||||
ol_mmr_urls=opts.ol_mmr_urls,
|
||||
ol_olc=opts.ol_olc,
|
||||
ol_slaptest=opts.ol_slaptest)
|
||||
|
||||
|
||||
@ -7,7 +7,6 @@ sizelimit unlimited
|
||||
|
||||
${MMR_SERVERIDS_CONFIG}
|
||||
|
||||
|
||||
include ${LDAPDIR}/backend-schema.schema
|
||||
|
||||
pidfile ${LDAPDIR}/slapd.pid
|
||||
@ -62,6 +61,13 @@ suffix cn=Samba
|
||||
directory ${LDAPDIR}/db/samba
|
||||
rootdn cn=Manager,cn=Samba
|
||||
|
||||
########################################
|
||||
## olc - configuration ###
|
||||
${OLC_CONFIG_PASS}
|
||||
${OLC_SYNCREPL_CONFIG}
|
||||
${OLC_MMR_CONFIG}
|
||||
${OLC_CONFIG_ACL}
|
||||
|
||||
########################################
|
||||
### cn=schema ###
|
||||
database hdb
|
||||
@ -78,10 +84,10 @@ index cn eq
|
||||
index entryUUID,entryCSN eq
|
||||
|
||||
#syncprov is stable in OpenLDAP 2.3, and available in 2.2.
|
||||
#We only need this for the contextCSN attribute anyway....
|
||||
#We need this for the contextCSN attribute and mmr.
|
||||
overlay syncprov
|
||||
syncprov-sessionlog 100
|
||||
# syncprov-checkpoint 100 10
|
||||
syncprov-checkpoint 100 10
|
||||
|
||||
|
||||
### Multimaster-Replication of cn=schema Subcontext ###
|
||||
@ -107,10 +113,10 @@ index cn eq
|
||||
index entryUUID,entryCSN eq
|
||||
|
||||
#syncprov is stable in OpenLDAP 2.3, and available in 2.2.
|
||||
#We only need this for the contextCSN attribute anyway....
|
||||
#We need this for the contextCSN attribute and mmr.
|
||||
overlay syncprov
|
||||
syncprov-sessionlog 100
|
||||
# syncprov-checkpoint 100 10
|
||||
syncprov-checkpoint 100 10
|
||||
|
||||
### Multimaster-Replication of cn=config Subcontext ###
|
||||
${MMR_SYNCREPL_CONFIG_CONFIG}
|
||||
@ -139,10 +145,10 @@ index cn eq
|
||||
index entryUUID,entryCSN eq
|
||||
|
||||
#syncprov is stable in OpenLDAP 2.3, and available in 2.2.
|
||||
#We only need this for the contextCSN attribute anyway....
|
||||
#We need this for the contextCSN attribute and mmr.
|
||||
overlay syncprov
|
||||
syncprov-sessionlog 100
|
||||
# syncprov-checkpoint 100 10
|
||||
syncprov-checkpoint 100 10
|
||||
|
||||
### Multimaster-Replication of cn=user/base-dn context ###
|
||||
${MMR_SYNCREPL_USER_CONFIG}
|
||||
|
||||
Reference in New Issue
Block a user