Upgrade provision-backend to python.

This required a large rework of the provision code, so as to move much
of the 'guess' logic into subprocedures, rather than just inline in
the provision code.

Andrew Bartlett

source/scripting/python/samba/provision.py

@@ -66,7 +66,27 @@ class ProvisionPaths:
         self.dns = None
         self.winsdb = None
         self.private_dir = None
-
+        self.ldapdir = None
+        self.slapdconf = None
+        self.modulesconf = None
+        self.memberofconf = None
+        self.fedoradsinf = None
+        self.fedoradspartitions = None
+ 
+class ProvisionNames:
+    def __init__(self):
+        self.rootdn = None
+        self.domaindn = None
+        self.configdn = None
+        self.schemadn = None
+        self.ldapmanagerdn = None
+        self.dnsdomain = None
+        self.realm = None
+        self.netbiosname = None
+        self.domain = None
+        self.hostname = None
+        self.sitename = None
+    
 class ProvisionResult:
     def __init__(self):
         self.paths = None
@@ -218,6 +238,18 @@ def provision_paths_from_lp(lp, dnsdomain):
     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
                                             "phpldapadmin-config.php")
+    paths.ldapdir = os.path.join(paths.private_dir, 
+                                 "ldap")
+    paths.slapdconf = os.path.join(paths.ldapdir, 
+                                   "slapd.conf")
+    paths.modulesconf = os.path.join(paths.ldapdir, 
+                                     "modules.conf")
+    paths.memberofconf = os.path.join(paths.ldapdir, 
+                                      "memberof.conf")
+    paths.fedoradsinf = os.path.join(paths.ldapdir, 
+                                   "fedorads.inf")
+    paths.fedoradspartitions = os.path.join(paths.ldapdir, 
+                                            "fedorads-partitions.ldif")
     paths.hklm = "hklm.ldb"
     paths.hkcr = "hkcr.ldb"
     paths.hkcu = "hkcu.ldb"
@@ -225,16 +257,142 @@ def provision_paths_from_lp(lp, dnsdomain):
     paths.hkpd = "hkpd.ldb"
     paths.hkpt = "hkpt.ldb"
 
-    paths.sysvol = lp.get("sysvol", "path")
+    paths.sysvol = lp.get("path", "sysvol")
-    if paths.sysvol is None:
-        paths.sysvol = os.path.join(lp.get("lock dir"), "sysvol")
 
-    paths.netlogon = lp.get("netlogon", "path")
+    paths.netlogon = lp.get("path", "netlogon")
-    if paths.netlogon is None:
-        paths.netlogon = os.path.join(os.path.join(paths.sysvol, "scripts"))
 
     return paths
 
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
+              rootdn=None, domaindn=None, configdn=None, schemadn=None, sitename=None):
+
+    if hostname is None:
+        hostname = gethostname().split(".")[0].lower()
+
+    netbiosname = hostname.upper()
+    if not valid_netbios_name(netbiosname):
+        raise InvalidNetbiosName(netbiosname)
+
+    hostname = hostname.lower()
+
+    if dnsdomain is None:
+        dnsdomain = lp.get("realm")
+
+    if serverrole is None:
+        serverrole = lp.get("server role")
+
+    assert dnsdomain is not None
+    realm = dnsdomain.upper()
+
+    if lp.get("realm").upper() != realm:
+        raise Exception("realm '%s' in %s must match chosen realm '%s'" %
+                        (lp.get("realm"), smbconf, realm))
+    
+    dnsdomain = dnsdomain.lower()
+
+    if (serverrole == "domain controller"):
+        if domain is None:
+            domain = lp.get("workgroup")
+        if domaindn is None:
+            domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
+        if lp.get("workgroup").upper() != domain.upper():
+            raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
+                        lp.get("workgroup"), domain)
+    else:
+        domain = netbiosname
+        if domaindn is None:
+            domaindn = "CN=" + netbiosname
+        
+    assert domain is not None
+    domain = domain.upper()
+    if not valid_netbios_name(domain):
+        raise InvalidNetbiosName(domain)
+        
+    if rootdn is None:
+       rootdn = domaindn
+       
+    if configdn is None:
+        configdn = "CN=Configuration," + rootdn
+    if schemadn is None:
+        schemadn = "CN=Schema," + configdn
+
+    if sitename is None:
+        sitename=DEFAULTSITE
+
+    names = ProvisionNames()
+    names.rootdn = rootdn
+    names.domaindn = domaindn
+    names.configdn = configdn
+    names.schemadn = schemadn
+    names.ldapmanagerdn = "CN=Manager," + rootdn
+    names.dnsdomain = dnsdomain
+    names.domain = domain
+    names.realm = realm
+    names.netbiosname = netbiosname
+    names.hostname = hostname
+    names.sitename = sitename
+    
+    return names
+    
+
+def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir):
+    if targetdir is not None:
+        if not os.path.exists(targetdir):
+            os.mkdir(targetdir)
+        if not os.path.exists(os.path.join(targetdir, "etc")):
+           os.mkdir(os.path.join(targetdir, "etc"))
+
+        smbconf = os.path.join(targetdir, "etc", "smb.conf")
+
+    # only install a new smb.conf if there isn't one there already
+
+    if not os.path.exists(smbconf):
+        if hostname is None:
+            hostname = gethostname().split(".")[0].lower()
+
+        if serverrole is None:
+            serverrole = "standalone"
+
+        assert serverrole in ("domain controller", "member server", "standalone")
+        if serverrole == "domain controller":
+            smbconfsuffix = "dc"
+        elif serverrole == "member server":
+            smbconfsuffix = "member"
+        elif serverrole == "standalone":
+            smbconfsuffix = "standalone"
+
+        assert domain is not None
+        assert realm is not None
+
+        default_lp = param.LoadParm()
+        #Load non-existant file
+        default_lp.load(smbconf)
+        
+        if targetdir is not None:
+            privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
+            lockdir_line = "lock dir = " + os.path.abspath(targetdir)
+
+            default_lp.set("lock dir", os.path.abspath(targetdir))
+            
+        sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
+        netlogon = os.path.join(sysvol, realm.lower(), "scripts")
+
+        setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
+                   smbconf, {
+                "HOSTNAME": hostname,
+                "DOMAIN": domain,
+                "REALM": realm,
+                "SERVERROLE": serverrole,
+                "NETLOGONPATH": netlogon,
+                "SYSVOLPATH": sysvol,
+                "PRIVATEDIR_LINE": privatedir_line,
+                "LOCKDIR_LINE": lockdir_line
+                })
+
+    lp = param.LoadParm()
+    lp.load(smbconf)
+
+    return lp
 
 def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
                         wheel, backup):
@@ -277,9 +435,8 @@ def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users,
 
 
 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
-                           credentials, configdn, schemadn, domaindn, 
+                           credentials, names,
-                           hostname, netbiosname, dnsdomain, realm, 
+                           serverrole, ldap_backend=None, 
-                           rootdn, serverrole, sitename, ldap_backend=None, 
                            ldap_backend_type=None, erase=False):
     """Setup the partitions for the SAM database. 
     
@@ -366,12 +523,12 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
     samdb.transaction_start()
     try:
         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
-                "SCHEMADN": schemadn, 
+                "SCHEMADN": names.schemadn, 
                 "SCHEMADN_LDB": schemadn_ldb,
                 "SCHEMADN_MOD2": ",objectguid",
-                "CONFIGDN": configdn,
+                "CONFIGDN": names.configdn,
                 "CONFIGDN_LDB": configdn_ldb,
-                "DOMAINDN": domaindn,
+                "DOMAINDN": names.domaindn,
                 "DOMAINDN_LDB": domaindn_ldb,
                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
@@ -397,9 +554,9 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 
         message("Setting up sam.ldb rootDSE")
-        setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
+        setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn, names.hostname, 
-                            dnsdomain, realm, rootdn, configdn, netbiosname,
+                            names.dnsdomain, names.realm, names.rootdn, names.configdn, names.netbiosname,
-                            sitename)
+                            names.sitename)
 
         if erase:
             message("Erasing data from partitions")
@@ -532,10 +689,10 @@ def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
         })
         
 
-def setup_self_join(samdb, configdn, schemadn, domaindn, 
+def setup_self_join(samdb, names,
-                    netbiosname, hostname, dnsdomain, machinepass, dnspass, 
+                    machinepass, dnspass, 
-                    realm, domainname, domainsid, invocationid, setup_path,
+                    domainsid, invocationid, setup_path,
-                    policyguid, sitename, hostguid=None):
+                    policyguid, hostguid=None):
     """Join a host to its own domain."""
     if hostguid is not None:
         hostguid_add = "objectGUID: %s" % hostguid
@@ -543,33 +700,32 @@ def setup_self_join(samdb, configdn, schemadn, domaindn,
         hostguid_add = ""
 
     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
-              "CONFIGDN": configdn, 
+              "CONFIGDN": names.configdn, 
-              "SCHEMADN": schemadn,
+              "SCHEMADN": names.schemadn,
-              "DOMAINDN": domaindn,
+              "DOMAINDN": names.domaindn,
               "INVOCATIONID": invocationid,
-              "NETBIOSNAME": netbiosname,
+              "NETBIOSNAME": names.netbiosname,
-              "DEFAULTSITE": sitename,
+              "DEFAULTSITE": names.sitename,
-              "DNSNAME": "%s.%s" % (hostname, dnsdomain),
+              "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
               "MACHINEPASS_B64": b64encode(machinepass),
               "DNSPASS_B64": b64encode(dnspass),
-              "REALM": realm,
+              "REALM": names.realm,
-              "DOMAIN": domainname,
+              "DOMAIN": names.domain,
               "HOSTGUID_ADD": hostguid_add,
-              "DNSDOMAIN": dnsdomain})
+              "DNSDOMAIN": names.dnsdomain})
     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
               "POLICYGUID": policyguid,
-              "DNSDOMAIN": dnsdomain,
+              "DNSDOMAIN": names.dnsdomain,
               "DOMAINSID": str(domainsid),
-              "DOMAINDN": domaindn})
+              "DOMAINDN": names.domaindn})
 
 
 def setup_samdb(path, setup_path, session_info, credentials, lp, 
-                schemadn, configdn, domaindn, dnsdomain, realm, 
+                names, message, 
-                netbiosname, message, hostname, rootdn, 
                 domainsid, aci, domainguid, policyguid, 
-                domainname, fill, adminpass, krbtgtpass, 
+                fill, adminpass, krbtgtpass, 
                 machinepass, hostguid, invocationid, dnspass,
-                serverrole, sitename, ldap_backend=None, 
+                serverrole, ldap_backend=None, 
                 ldap_backend_type=None):
     """Setup a complete SAM Database.
     
@@ -579,14 +735,11 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
     erase = (fill != FILL_DRS)
 
     # Also wipes the database
-    setup_samdb_partitions(path, setup_path, schemadn=schemadn, configdn=configdn, 
+    setup_samdb_partitions(path, setup_path, message=message, lp=lp,
-                           domaindn=domaindn, message=message, lp=lp,
                            credentials=credentials, session_info=session_info,
-                           hostname=hostname, netbiosname=netbiosname, 
+                           names=names, 
-                           dnsdomain=dnsdomain, realm=realm, rootdn=rootdn,
                            ldap_backend=ldap_backend, serverrole=serverrole,
-                           ldap_backend_type=ldap_backend_type, erase=erase,
+                           ldap_backend_type=ldap_backend_type, erase=erase)
-                           sitename=sitename)
 
     samdb = SamDB(path, session_info=session_info, 
                   credentials=credentials, lp=lp)
@@ -604,18 +757,18 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
     if serverrole == "domain controller":
         samdb.set_invocation_id(invocationid)
 
-    load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename)
+    load_schema(setup_path, samdb, names.schemadn, names.netbiosname, names.configdn, names.sitename)
 
     samdb.transaction_start()
         
     try:
-        message("Adding DomainDN: %s (permitted to fail)" % domaindn)
+        message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
-            "DOMAINDN": domaindn,
+            "DOMAINDN": names.domaindn,
             "ACI": aci,
             })
 
-        message("Modifying DomainDN: " + domaindn + "")
+        message("Modifying DomainDN: " + names.domaindn + "")
         if domainguid is not None:
             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
         else:
@@ -624,104 +777,102 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
             "LDAPTIME": timestring(int(time.time())),
             "DOMAINSID": str(domainsid),
-            "SCHEMADN": schemadn, 
+            "SCHEMADN": names.schemadn, 
-            "NETBIOSNAME": netbiosname,
+            "NETBIOSNAME": names.netbiosname,
-            "DEFAULTSITE": sitename,
+            "DEFAULTSITE": names.sitename,
-            "CONFIGDN": configdn,
+            "CONFIGDN": names.configdn,
             "POLICYGUID": policyguid,
-            "DOMAINDN": domaindn,
+            "DOMAINDN": names.domaindn,
             "DOMAINGUID_MOD": domainguid_mod,
             })
 
         message("Adding configuration container (permitted to fail)")
         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
-            "CONFIGDN": configdn, 
+            "CONFIGDN": names.configdn, 
             "ACI": aci,
             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
             })
         message("Modifying configuration container")
         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
-            "CONFIGDN": configdn, 
+            "CONFIGDN": names.configdn, 
-            "SCHEMADN": schemadn,
+            "SCHEMADN": names.schemadn,
             })
 
         message("Adding schema container (permitted to fail)")
         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
-            "SCHEMADN": schemadn,
+            "SCHEMADN": names.schemadn,
             "ACI": aci,
             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
             })
         message("Modifying schema container")
         setup_modify_ldif(samdb, 
             setup_path("provision_schema_basedn_modify.ldif"), {
-            "SCHEMADN": schemadn,
+            "SCHEMADN": names.schemadn,
-            "NETBIOSNAME": netbiosname,
+            "NETBIOSNAME": names.netbiosname,
-            "DEFAULTSITE": sitename,
+            "DEFAULTSITE": names.sitename,
-            "CONFIGDN": configdn,
+            "CONFIGDN": names.configdn,
             })
 
         message("Setting up sam.ldb Samba4 schema")
         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"), 
-                       {"SCHEMADN": schemadn })
+                       {"SCHEMADN": names.schemadn })
         message("Setting up sam.ldb AD schema")
         setup_add_ldif(samdb, setup_path("schema.ldif"), 
-                       {"SCHEMADN": schemadn})
+                       {"SCHEMADN": names.schemadn})
 
         message("Setting up sam.ldb configuration data")
         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
-            "CONFIGDN": configdn,
+            "CONFIGDN": names.configdn,
-            "NETBIOSNAME": netbiosname,
+            "NETBIOSNAME": names.netbiosname,
-            "DEFAULTSITE": sitename,
+            "DEFAULTSITE": names.sitename,
-            "DNSDOMAIN": dnsdomain,
+            "DNSDOMAIN": names.dnsdomain,
-            "DOMAIN": domainname,
+            "DOMAIN": names.domain,
-            "SCHEMADN": schemadn,
+            "SCHEMADN": names.schemadn,
-            "DOMAINDN": domaindn,
+            "DOMAINDN": names.domaindn,
             })
 
         message("Setting up display specifiers")
         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"), 
-                       {"CONFIGDN": configdn})
+                       {"CONFIGDN": names.configdn})
 
         message("Adding users container (permitted to fail)")
         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
-            "DOMAINDN": domaindn})
+                "DOMAINDN": names.domaindn})
         message("Modifying users container")
         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
-            "DOMAINDN": domaindn})
+                "DOMAINDN": names.domaindn})
         message("Adding computers container (permitted to fail)")
         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
-            "DOMAINDN": domaindn})
+                "DOMAINDN": names.domaindn})
         message("Modifying computers container")
         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
-            "DOMAINDN": domaindn})
+                "DOMAINDN": names.domaindn})
         message("Setting up sam.ldb data")
         setup_add_ldif(samdb, setup_path("provision.ldif"), {
-            "DOMAINDN": domaindn,
+            "DOMAINDN": names.domaindn,
-            "NETBIOSNAME": netbiosname,
+            "NETBIOSNAME": names.netbiosname,
-            "DEFAULTSITE": sitename,
+            "DEFAULTSITE": names.sitename,
-            "CONFIGDN": configdn,
+            "CONFIGDN": names.configdn,
             })
 
         if fill == FILL_FULL:
             message("Setting up sam.ldb users and groups")
             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
-                "DOMAINDN": domaindn,
+                "DOMAINDN": names.domaindn,
                 "DOMAINSID": str(domainsid),
-                "CONFIGDN": configdn,
+                "CONFIGDN": names.configdn,
                 "ADMINPASS_B64": b64encode(adminpass),
                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
                 })
 
             if serverrole == "domain controller":
                 message("Setting up self join")
-                setup_self_join(samdb, configdn=configdn, schemadn=schemadn, 
+                setup_self_join(samdb, names=names, invocationid=invocationid, 
-                                domaindn=domaindn, invocationid=invocationid, 
+                                dnspass=dnspass,  
-                                dnspass=dnspass, netbiosname=netbiosname, 
+                                machinepass=machinepass, 
-                                dnsdomain=dnsdomain, realm=realm, 
-                                machinepass=machinepass, domainname=domainname, 
                                 domainsid=domainsid, policyguid=policyguid,
-                                hostname=hostname, hostguid=hostguid, 
+                                hostguid=hostguid, 
-                                setup_path=setup_path, sitename=sitename)
+                                setup_path=setup_path)
 
     #We want to setup the index last, as adds are faster unindexed
         message("Setting up sam.ldb index")
@@ -746,7 +897,7 @@ def provision(setup_dir, message, session_info,
               policyguid=None, invocationid=None, machinepass=None, 
               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
               wheel=None, backup=None, aci=None, serverrole=None, 
-              ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
+              ldap_backend=None, ldap_backend_type=None, sitename=None):
     """Provision samba4
     
     :note: caution, this wipes all existing data!
@@ -785,129 +936,37 @@ def provision(setup_dir, message, session_info,
         backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
     if aci is None:
         aci = "# no aci for local ldb"
-    if hostname is None:
+
-        hostname = gethostname().split(".")[0].lower()
+    lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
+
+    names = guess_names(lp=lp, hostname=hostname, domain=domain, 
+                        dnsdomain=realm, serverrole=serverrole, sitename=sitename,
+                        rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
+
+    paths = provision_paths_from_lp(lp, names.dnsdomain)
 
     if hostip is None:
-        hostip = gethostbyname(hostname)
+        hostip = gethostbyname(names.hostname)
-
-    netbiosname = hostname.upper()
-    if not valid_netbios_name(netbiosname):
-        raise InvalidNetbiosName(netbiosname)
-
-    if targetdir is not None:
-        if not os.path.exists(targetdir):
-            os.mkdir(targetdir)
-        if not os.path.exists(os.path.join(targetdir, "etc")):
-           os.mkdir(os.path.join(targetdir, "etc"))
-
-        smbconf = os.path.join(targetdir, os.path.join("etc", "smb.conf"))
-
-    # only install a new smb.conf if there isn't one there already
-
-    if not os.path.exists(smbconf):
-        message("Setting up smb.conf")
-        if serverrole is None:
-            serverrole = "standalone"
-
-        assert serverrole in ("domain controller", "member server", "standalone")
-        if serverrole == "domain controller":
-            smbconfsuffix = "dc"
-        elif serverrole == "member server":
-            smbconfsuffix = "member"
-        elif serverrole == "standalone":
-            smbconfsuffix = "standalone"
-
-        assert domain is not None
-        assert realm is not None
-
-        default_lp = param.LoadParm()
-        #Load non-existant file
-        default_lp.load(smbconf)
-        
-        if targetdir is not None:
-            privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
-            lockdir_line = "lock dir = " + os.path.abspath(targetdir)
-
-            default_lp.set("lock dir", os.path.abspath(targetdir))
-            
-        sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
-        netlogon = os.path.join(os.path.join(sysvol, "scripts"))
-
-        setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
-                   smbconf, {
-                "HOSTNAME": hostname,
-                "DOMAIN": domain,
-                "REALM": realm,
-                "SERVERROLE": serverrole,
-                "NETLOGONPATH": netlogon,
-                "SYSVOLPATH": sysvol,
-                "PRIVATEDIR_LINE": privatedir_line,
-                "LOCKDIR_LINE": lockdir_line
-                })
-
-    lp = param.LoadParm()
-    lp.load(smbconf)
 
     if serverrole is None:
         serverrole = lp.get("server role")
+
     assert serverrole in ("domain controller", "member server", "standalone")
     if invocationid is None and serverrole == "domain controller":
         invocationid = uuid.random()
 
-    if realm is None:
+    if not os.path.exists(paths.private_dir):
-        realm = lp.get("realm")
+        os.mkdir(paths.private_dir)
-
-    assert realm is not None
-    realm = realm.upper()
-
-    if lp.get("realm").upper() != realm.upper():
-        raise Exception("realm '%s' in %s must match chosen realm '%s'" %
-                        (lp.get("realm"), smbconf, realm))
-    
-    dnsdomain = realm.lower()
-
-    paths = provision_paths_from_lp(lp, dnsdomain)
-
-    if targetdir is not None:
-        if not os.path.exists(paths.private_dir):
-            os.mkdir(paths.private_dir)
 
     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
     
-    if ldap_backend == "ldapi":
+    if ldap_backend is not None:
-        # provision-backend will set this path suggested slapd command line / fedorads.inf
+        if ldap_backend == "ldapi":
-        ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+            # provision-backend will set this path suggested slapd command line / fedorads.inf
-
+            ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
-    if serverrole == "domain controller":
+             
-        if domaindn is None:
-            domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
-        if domain is None:
-            domain = lp.get("workgroup")
-    
-        if lp.get("workgroup").upper() != domain.upper():
-            raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
-                lp.get("workgroup"), domain)
-
-        assert domain is not None
-        domain = domain.upper()
-        if not valid_netbios_name(domain):
-            raise InvalidNetbiosName(domain)
-    else:
-        if domaindn is None:
-            domaindn = "CN=" + netbiosname
-        domain = netbiosname
-    
-    if rootdn is None:
-       rootdn = domaindn
-       
-    if configdn is None:
-        configdn = "CN=Configuration," + rootdn
-    if schemadn is None:
-        schemadn = "CN=Schema," + configdn
-
     message("set DOMAIN SID: %s" % str(domainsid))
-    message("Provisioning for %s in realm %s" % (domain, realm))
+    message("Provisioning for %s in realm %s" % (names.domain, realm))
     message("Using administrator password: %s" % adminpass)
 
     # only install a new shares config db if there is none
@@ -936,21 +995,19 @@ def provision(setup_dir, message, session_info,
                   credentials=credentials, lp=lp)
 
     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
-                        credentials=credentials, lp=lp, schemadn=schemadn, 
+                        credentials=credentials, lp=lp, names=names,
-                        configdn=configdn, domaindn=domaindn,
+                        message=message, 
-                        dnsdomain=dnsdomain, netbiosname=netbiosname, 
+                        domainsid=domainsid, 
-                        realm=realm, message=message, hostname=hostname, 
-                        rootdn=rootdn, domainsid=domainsid, 
                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
-                        domainname=domain, fill=samdb_fill, 
+                        fill=samdb_fill, 
                         adminpass=adminpass, krbtgtpass=krbtgtpass,
                         hostguid=hostguid, invocationid=invocationid, 
                         machinepass=machinepass, dnspass=dnspass,
                         serverrole=serverrole, ldap_backend=ldap_backend, 
-                        ldap_backend_type=ldap_backend_type, sitename=sitename)
+                        ldap_backend_type=ldap_backend_type)
 
     if lp.get("server role") == "domain controller":
-       policy_path = os.path.join(paths.sysvol, dnsdomain, "Policies", 
+       policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
                                   "{" + policyguid + "}")
        os.makedirs(policy_path, 0755)
        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
@@ -959,14 +1016,14 @@ def provision(setup_dir, message, session_info,
             os.makedirs(paths.netlogon, 0755)
        secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
                          credentials=credentials, lp=lp)
-       secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=realm,
+       secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
-                           netbiosname=netbiosname, domainsid=domainsid, 
+                           netbiosname=names.netbiosname, domainsid=domainsid, 
                            keytab_path=paths.keytab, samdb_url=paths.samdb, 
                            dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
-                           machinepass=machinepass, dnsdomain=dnsdomain)
+                           machinepass=machinepass, dnsdomain=names.dnsdomain)
 
     if samdb_fill == FILL_FULL:
-        setup_name_mappings(samdb, str(domainsid), domaindn, root=root, 
+        setup_name_mappings(samdb, str(domainsid), names.domaindn, root=root, 
                             nobody=nobody, nogroup=nogroup, wheel=wheel, 
                             users=users, backup=backup)
    
@@ -981,14 +1038,14 @@ def provision(setup_dir, message, session_info,
             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
             assert isinstance(domainguid, str)
             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
-                                       expression="(&(objectClass=computer)(cn=%s))" % hostname,
+                                       expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
                                        scope=SCOPE_SUBTREE)
             assert isinstance(hostguid, str)
             
-            message("Setting up DNS zone: %s" % dnsdomain)
+            message("Setting up DNS zone: %s" % names.dnsdomain)
             create_zone_file(paths.dns, setup_path, samdb, 
-                             hostname=hostname, hostip=hostip, dnsdomain=dnsdomain,
+                             hostname=names.hostname, hostip=hostip, dnsdomain=names.dnsdomain,
-                             domaindn=domaindn, dnspass=dnspass, realm=realm, 
+                             domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
                              domainguid=domainguid, hostguid=hostguid)
             message("Please install the zone located in %s into your DNS server" % paths.dns)
             
@@ -1025,6 +1082,150 @@ def provision_become_dc(setup_dir=None,
               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
     
 
+def setup_db_config(setup_path, file, dbdir):
+    if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
+        os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
+    if not os.path.isdir(os.path.join(dbdir, "tmp")):
+        os.makedirs(os.path.join(dbdir, "tmp"), 0700);
+    
+    setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
+               {"LDAPDBDIR": dbdir})
+    
+
+
+def provision_backend(setup_dir=None, message=None,
+                      smbconf=None, targetdir=None, realm=None, 
+                      rootdn=None, domaindn=None, schemadn=None, configdn=None,
+                      domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
+                      ldap_backend_type=None):
+
+    def setup_path(file):
+        return os.path.join(setup_dir, file)
+
+    if hostname is None:
+        hostname = gethostname().split(".")[0].lower()
+
+    if root is None:
+        root = findnss(pwd.getpwnam, ["root"])[0]
+
+    lp = load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole, targetdir)
+
+    names = guess_names(lp=lp, hostname=hostname, domain=domain, 
+                        dnsdomain=realm, serverrole=serverrole, 
+                        rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn)
+
+    paths = provision_paths_from_lp(lp, names.dnsdomain)
+
+    if not os.path.isdir(paths.ldapdir):
+        os.makedirs(paths.ldapdir)
+    schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
+    try:
+        os.unlink(schemadb_path)
+    except:
+        pass
+
+    schemadb = Ldb(schemadb_path, lp=lp)
+ 
+    setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"), 
+                   {"SCHEMADN": names.schemadn,
+                    "ACI": "#",
+                    "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
+                    })
+    setup_modify_ldif(schemadb, 
+                      setup_path("provision_schema_basedn_modify.ldif"), \
+                          {"SCHEMADN": names.schemadn,
+                           "NETBIOSNAME": names.netbiosname,
+                           "DEFAULTSITE": DEFAULTSITE,
+                           "CONFIGDN": names.configdn,
+                           })
+    
+    setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
+                   {"SCHEMADN": names.schemadn })
+    setup_add_ldif(schemadb, setup_path("schema.ldif"), 
+                   {"SCHEMADN": names.schemadn})
+
+    if ldap_backend_type == "fedora-ds":
+        setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf, 
+                   {"ROOT": root,
+                    "HOSTNAME": hostname,
+                    "DNSDOMAIN": names.dnsdomain,
+                    "LDAPDIR": paths.ldapdir,
+                    "DOMAINDN": names.domaindn,
+                    "LDAPMANAGERDN": names.ldapmanagerdn,
+                    "LDAPMANAGERPASS": adminpass, 
+                    "SERVERPORT": ""})
+        
+        setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
+                   {"CONFIGDN": names.configdn,
+                    "SCHEMADN": names.schemadn,
+                    })
+        
+        setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
+                   {"CONFIGDN": names.configdn,
+                    "SCHEMADN": names.schemadn,
+                    })
+        mapping = "schema-map-fedora-ds-1.0"
+        backend_schema = "99_ad.ldif"
+    elif ldap_backend_type == "openldap":
+        setup_file(setup_path("slapd.conf"), paths.slapdconf,
+                   {"DNSDOMAIN": names.dnsdomain,
+                    "LDAPDIR": paths.ldapdir,
+                    "DOMAINDN": names.domaindn,
+                    "CONFIGDN": names.configdn,
+                    "SCHEMADN": names.schemadn,
+                    "LDAPMANAGERDN": names.ldapmanagerdn,
+                    "LDAPMANAGERPASS": adminpass})
+        setup_file(setup_path("modules.conf"), paths.modulesconf,
+                   {"REALM": names.realm})
+        
+        setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
+        setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
+        setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
+        mapping = "schema-map-openldap-2.3"
+        backend_schema = "backend-schema.schema"
+        
+        attrs = ["linkID", "lDAPDisplayName"]
+	res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
+
+ 	memberof_config = "# This is a generated file, do not edit!\n";
+	refint_attributes = "";
+	for i in range (0, len(res)):
+            linkid = res[i]["linkID"][0]
+            linkid = str(int(linkid) + 1)
+            target = schemadb.searchone(basedn=names.schemadn, 
+                                        expression="(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))", 
+                                        attribute="lDAPDisplayName");
+            if target is not None:
+                refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"];
+                memberof_config = memberof_config + """overlay memberof
+memberof-dangling error
+memberof-refint TRUE
+memberof-group-oc top
+memberof-member-ad """ + res[i]["lDAPDisplayName"] + """
+memberof-memberof-ad """ + target + """
+memberof-dangling-error 32
+
+""";
+
+	memberof_config = memberof_config + """
+overlay refint
+refint_attributes""" + refint_attributes + "\n";
+	
+        if os.path.exists(paths.memberofconf):
+            os.unlink(paths.memberof.conf)
+
+            open(paths.memberofconf, 'w').write(memberof_config)
+
+        ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+        message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
+                
+
+    schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
+
+    os.system(schema_command)
+
+
+
 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
     """Create a PHP LDAP admin configuration file.
 

source/setup/provision-backend

@@ -1,189 +1,98 @@
-#!/bin/sh
+#!/usr/bin/python
-exec smbscript "$0" ${1+"$@"}
+#
-/*
+# Unix SMB/CIFS implementation.
-	provision a Samba4 server
+# provision a Samba4 server
-	Copyright Andrew Tridgell 2005
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
-	Released under the GNU GPL v2 or later
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
-*/
+#
+# Based on the original in EJS:
+# Copyright (C) Andrew Tridgell 2005
+#   
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#   
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#   
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
 
-options = GetOptions(ARGV,
+import getopt
-		"POPT_AUTOHELP",
+import optparse
-		"POPT_COMMON_SAMBA",
+import os, sys
-		"POPT_COMMON_VERSION",
-		"POPT_COMMON_CREDENTIALS",
-		'realm=s',
-		'host-name=s',
-		'ldap-manager-pass=s',
-		'root=s',
-		'quiet',
-		'ldap-backend-type=s',
-                'ldap-backend-port=i');
 
-if (options == undefined) {
+import samba
-   println("Failed to parse options");
+import param
-   return -1;
-}
 
-sys = sys_init();
+from auth import system_session
+import samba.getopt as options
+from samba.provision import (provision_backend)
 
-libinclude("base.js");
+parser = optparse.OptionParser("provision [options]")
-libinclude("provision.js");
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+parser.add_option("--setupdir", type="string", metavar="DIR", 
+		help="directory with setup files")
+parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
+parser.add_option("--domain", type="string", metavar="DOMAIN",
+				  help="set domain")
+parser.add_option("--host-name", type="string", metavar="HOSTNAME", 
+		help="set hostname")
+parser.add_option("--adminpass", type="string", metavar="PASSWORD", 
+		help="choose admin password (otherwise random)")
+parser.add_option("--root", type="string", metavar="USERNAME", 
+		help="choose 'root' unix username")
+parser.add_option("--quiet", help="Be quiet", action="store_true")
+parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", 
+		help="LDB mapping module to use for the LDAP backend",
+		choices=["fedora-ds", "openldap"])
+parser.add_option("--server-role", type="choice", metavar="ROLE",
+		  choices=["domain controller", "dc", "member server", "member", "standalone"],
+		help="Set server role to provision for (default standalone)")
+parser.add_option("--targetdir", type="string", metavar="DIR", 
+		          help="Set target directory")
 
-/*
+opts = parser.parse_args()[0]
-  print a message if quiet is not set
-*/
-function message()
-{
-	if (options["quiet"] == undefined) {
-		print(vsprintf(arguments));
-	}
-}
 
-/*
+def message(text):
- show some help
+	"""print a message if quiet is not set."""
-*/
+	if not opts.quiet:
-function ShowHelp()
+		print text
-{
-	print("
-Samba4 provisioning
 
-provision [options]
+if opts.realm is None or opts.domain is None:
- --realm	REALM		set realm
+	if opts.realm is None:
- --host-name	HOSTNAME	set hostname
+		print >>sys.stderr, "No realm set"
- --ldap-manager-pass	PASSWORD	choose LDAP Manager password (otherwise random)
+	if opts.domain is None:
- --root         USERNAME	choose 'root' unix username
+		print >>sys.stderr, "No domain set"
- --quiet			Be quiet
+	parser.print_usage()
- --ldap-backend-type LDAPSERVER Select either \"openldap\" or \"fedora-ds\" as a target to configure
+	sys.exit(1)
- --ldap-backend-port PORT       Select the TCP port (if any) that the LDAP backend should listen on (Fedora DS only)
-You must provide at least a realm and ldap-backend-type
 
-");
+smbconf = sambaopts.get_loadparm().configfile()
-	exit(1);
-}
 
-if (options['host-name'] == undefined) {
+if opts.server_role == "dc":
-	options['host-name'] = hostname();
+	server_role = "domain controller"
-}
+elif opts.server_role == "member":
+	server_role = "member server"
+else:
+        server_role = opts.server_role
 
-/*
+setup_dir = opts.setupdir
-   main program
+if setup_dir is None:
-*/
+	setup_dir = "setup"
-if (options["realm"] == undefined ||
-    options["ldap-backend-type"] == undefined ||
-    options["host-name"] == undefined) {
-	ShowHelp();
-}
 
-/* cope with an initially blank smb.conf */
+provision_backend(setup_dir=setup_dir, message=message, smbconf=smbconf, targetdir=opts.targetdir,
-var lp = loadparm_init();
+          realm=opts.realm, domain=opts.domain,
-lp.set("realm", options.realm);
+          hostname=opts.host_name,
-lp.reload();
+          adminpass=opts.adminpass,
+          root=opts.root, serverrole=server_role, 
+          ldap_backend_type=opts.ldap_backend_type)
 
-var subobj = provision_guess();
+message("All OK")
-for (r in options) {
-	var key = strupper(join("", split("-", r)));
-	subobj[key] = options[r];
-}
-
-
-
-var paths = provision_default_paths(subobj);
-provision_fix_subobj(subobj, paths);
-message("Provisioning LDAP backend for %s in realm %s into %s\n", subobj.HOSTNAME, subobj.REALM, subobj.LDAPDIR);
-message("Using %s password: %s\n", subobj.LDAPMANAGERDN, subobj.LDAPMANAGERPASS);
-var tmp_schema_ldb = subobj.LDAPDIR + "/schema-tmp.ldb";
-sys.mkdir(subobj.LDAPDIR, 0700);
-
-provision_schema(subobj, message, tmp_schema_ldb, paths);
-
-var mapping;
-var backend_schema;
-var slapd_command;
-if (options["ldap-backend-type"] == "fedora-ds") {
-	mapping = "schema-map-fedora-ds-1.0";
-	backend_schema = "99_ad.ldif";
-	if (options["ldap-backend-port"] != undefined) {
-		message("Will listen on TCP port " + options["ldap-backend-port"] + "\n");
-		subobj.SERVERPORT="ServerPort = " + options["ldap-backend-port"];
-	} else {
-		message("Will listen on LDAPI only\n");
-		subobj.SERVERPORT="";
-	}
-	setup_file("fedorads.inf", message, subobj.LDAPDIR + "/fedorads.inf", subobj);
-	setup_file("fedorads-partitions.ldif", message, subobj.LDAPDIR + "/fedorads-partitions.ldif", subobj);
-
-	slapd_command = "(see documentation)";
-} else if (options["ldap-backend-type"] == "openldap") {
-	mapping = "schema-map-openldap-2.3";
-	backend_schema = "backend-schema.schema";
-	setup_file("slapd.conf", message, subobj.LDAPDIR + "/slapd.conf", subobj);
-	setup_file("modules.conf", message, subobj.LDAPDIR + "/modules.conf", subobj);
-	sys.mkdir(subobj.LDAPDIR + "/db", 0700);
-	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/user";
-	sys.mkdir(subobj.LDAPDBDIR, 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
-	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
-	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/config";
-	sys.mkdir(subobj.LDAPDBDIR, 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
-	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
-	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/schema";
-	sys.mkdir(subobj.LDAPDBDIR, 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
-	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
-	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
-	if (options["ldap-backend-port"] != undefined) {
-		message("\nStart slapd with: \n");
-		slapd_command = "slapd -f " + subobj.LDAPDIR + "/slapd.conf -h \"ldap://0.0.0.0:" + options["ldap-backend-port"] + " " + subobj.LDAPI_URI "\"";
-	} else {
-		slapd_command = "slapd -f " + subobj.LDAPDIR + "/slapd.conf -h " + subobj.LDAPI_URI;
-	}
-
-	var ldb = ldb_init();
-	ldb.filename = tmp_schema_ldb;
-
-	var connect_ok = ldb.connect(ldb.filename);
-	assert(connect_ok);
-	var attrs = new Array("linkID", "lDAPDisplayName");
-	var res = ldb.search("(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", subobj.SCHEMADN, ldb.SCOPE_SUBTREE, attrs);
-	assert(res.error == 0);
-	var memberof_config = "";
-	var refint_attributes = "";
-	for (i=0; i < res.msgs.length; i++) {
-searchone(ldb, subobj.DOMAINDN, "(&(objectClass=computer)(cn=" + subobj.NETBIOSNAME + "))", "objectGUID");
-		var target = searchone(ldb, subobj.SCHEMADN, "(&(objectclass=attributeSchema)(linkID=" + (res.msgs[i].linkID + 1) + "))", "lDAPDisplayName");
-		if (target != undefined) {
-			refint_attributes = refint_attributes + " " + target + " " + res.msgs[i].lDAPDisplayName;
-			memberof_config = memberof_config + "overlay memberof
-memberof-dangling error
-memberof-refint TRUE
-memberof-group-oc top
-memberof-member-ad " + res.msgs[i].lDAPDisplayName + "
-memberof-memberof-ad " + target + "
-memberof-dangling-error 32
-
-";
-		}
-	}
-
-	memberof_config = memberof_config + "
-overlay refint
-refint_attributes" + refint_attributes + "
-";
-	
-	ok = sys.file_save(subobj.LDAPDIR + "/memberof.conf", memberof_config);
-	if (!ok) {
-		message("failed to create file: " + f + "\n");
-		assert(ok);
-	}
-
-}
-var schema_command = "ad2oLschema --option=convert:target=" + options["ldap-backend-type"] + " -I " + lp.get("setup directory") + "/" + mapping + " -H tdb://" + tmp_schema_ldb + " -O " + subobj.LDAPDIR + "/" + backend_schema;
-
-message("\nCreate a suitable schema file with:\n%s\n", schema_command);
-message("\nStart slapd with: \n%s\n", slapd_command);
-
-message("All OK\n");
-return 0;

source/setup/provision-backend.js

@@ -0,0 +1,188 @@
+#!/bin/sh
+exec smbscript "$0" ${1+"$@"}
+/*
+	provision a Samba4 server
+	Copyright Andrew Tridgell 2005
+	Released under the GNU GPL v2 or later
+*/
+
+options = GetOptions(ARGV,
+		"POPT_AUTOHELP",
+		"POPT_COMMON_SAMBA",
+		"POPT_COMMON_VERSION",
+		"POPT_COMMON_CREDENTIALS",
+		'realm=s',
+		'host-name=s',
+		'ldap-manager-pass=s',
+		'root=s',
+		'quiet',
+		'ldap-backend-type=s',
+                'ldap-backend-port=i');
+
+if (options == undefined) {
+   println("Failed to parse options");
+   return -1;
+}
+
+sys = sys_init();
+
+libinclude("base.js");
+libinclude("provision.js");
+
+/*
+  print a message if quiet is not set
+*/
+function message()
+{
+	if (options["quiet"] == undefined) {
+		print(vsprintf(arguments));
+	}
+}
+
+/*
+ show some help
+*/
+function ShowHelp()
+{
+	print("
+Samba4 provisioning
+
+provision [options]
+ --realm	REALM		set realm
+ --host-name	HOSTNAME	set hostname
+ --ldap-manager-pass	PASSWORD	choose LDAP Manager password (otherwise random)
+ --root         USERNAME	choose 'root' unix username
+ --quiet			Be quiet
+ --ldap-backend-type LDAPSERVER Select either \"openldap\" or \"fedora-ds\" as a target to configure
+ --ldap-backend-port PORT       Select the TCP port (if any) that the LDAP backend should listen on (Fedora DS only)
+You must provide at least a realm and ldap-backend-type
+
+");
+	exit(1);
+}
+
+if (options['host-name'] == undefined) {
+	options['host-name'] = hostname();
+}
+
+/*
+   main program
+*/
+if (options["realm"] == undefined ||
+    options["ldap-backend-type"] == undefined ||
+    options["host-name"] == undefined) {
+	ShowHelp();
+}
+
+/* cope with an initially blank smb.conf */
+var lp = loadparm_init();
+lp.set("realm", options.realm);
+lp.reload();
+
+var subobj = provision_guess();
+for (r in options) {
+	var key = strupper(join("", split("-", r)));
+	subobj[key] = options[r];
+}
+
+
+
+var paths = provision_default_paths(subobj);
+provision_fix_subobj(subobj, paths);
+message("Provisioning LDAP backend for %s in realm %s into %s\n", subobj.HOSTNAME, subobj.REALM, subobj.LDAPDIR);
+message("Using %s password: %s\n", subobj.LDAPMANAGERDN, subobj.LDAPMANAGERPASS);
+var tmp_schema_ldb = subobj.LDAPDIR + "/schema-tmp.ldb";
+sys.mkdir(subobj.LDAPDIR, 0700);
+
+provision_schema(subobj, message, tmp_schema_ldb, paths);
+
+var mapping;
+var backend_schema;
+var slapd_command;
+if (options["ldap-backend-type"] == "fedora-ds") {
+	mapping = "schema-map-fedora-ds-1.0";
+	backend_schema = "99_ad.ldif";
+	if (options["ldap-backend-port"] != undefined) {
+		message("Will listen on TCP port " + options["ldap-backend-port"] + "\n");
+		subobj.SERVERPORT="ServerPort = " + options["ldap-backend-port"];
+	} else {
+		message("Will listen on LDAPI only\n");
+		subobj.SERVERPORT="";
+	}
+	setup_file("fedorads.inf", message, subobj.LDAPDIR + "/fedorads.inf", subobj);
+	setup_file("fedorads-partitions.ldif", message, subobj.LDAPDIR + "/fedorads-partitions.ldif", subobj);
+
+	slapd_command = "(see documentation)";
+} else if (options["ldap-backend-type"] == "openldap") {
+	mapping = "schema-map-openldap-2.3";
+	backend_schema = "backend-schema.schema";
+	setup_file("slapd.conf", message, subobj.LDAPDIR + "/slapd.conf", subobj);
+	setup_file("modules.conf", message, subobj.LDAPDIR + "/modules.conf", subobj);
+	sys.mkdir(subobj.LDAPDIR + "/db", 0700);
+	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/user";
+	sys.mkdir(subobj.LDAPDBDIR, 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
+	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
+	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/config";
+	sys.mkdir(subobj.LDAPDBDIR, 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
+	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
+	subobj.LDAPDBDIR = subobj.LDAPDIR + "/db/schema";
+	sys.mkdir(subobj.LDAPDBDIR, 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/tmp", 0700);
+	sys.mkdir(subobj.LDAPDBDIR + "/bdb-logs", 0700);
+	setup_file("DB_CONFIG", message, subobj.LDAPDBDIR + "/DB_CONFIG", subobj);
+	if (options["ldap-backend-port"] != undefined) {
+		message("\nStart slapd with: \n");
+		slapd_command = "slapd -f " + subobj.LDAPDIR + "/slapd.conf -h \"ldap://0.0.0.0:" + options["ldap-backend-port"] + " " + subobj.LDAPI_URI "\"";
+	} else {
+		slapd_command = "slapd -f " + subobj.LDAPDIR + "/slapd.conf -h " + subobj.LDAPI_URI;
+	}
+
+	var ldb = ldb_init();
+	ldb.filename = tmp_schema_ldb;
+
+	var connect_ok = ldb.connect(ldb.filename);
+	assert(connect_ok);
+	var attrs = new Array("linkID", "lDAPDisplayName");
+	var res = ldb.search("(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", subobj.SCHEMADN, ldb.SCOPE_SUBTREE, attrs);
+	assert(res.error == 0);
+	var memberof_config = "";
+	var refint_attributes = "";
+	for (i=0; i < res.msgs.length; i++) {
+		var target = searchone(ldb, subobj.SCHEMADN, "(&(objectclass=attributeSchema)(linkID=" + (res.msgs[i].linkID + 1) + "))", "lDAPDisplayName");
+		if (target != undefined) {
+			refint_attributes = refint_attributes + " " + target + " " + res.msgs[i].lDAPDisplayName;
+			memberof_config = memberof_config + "overlay memberof
+memberof-dangling error
+memberof-refint TRUE
+memberof-group-oc top
+memberof-member-ad " + res.msgs[i].lDAPDisplayName + "
+memberof-memberof-ad " + target + "
+memberof-dangling-error 32
+
+";
+		}
+	}
+
+	memberof_config = memberof_config + "
+overlay refint
+refint_attributes" + refint_attributes + "
+";
+	
+	ok = sys.file_save(subobj.LDAPDIR + "/memberof.conf", memberof_config);
+	if (!ok) {
+		message("failed to create file: " + f + "\n");
+		assert(ok);
+	}
+
+}
+var schema_command = "ad2oLschema --option=convert:target=" + options["ldap-backend-type"] + " -I " + lp.get("setup directory") + "/" + mapping + " -H tdb://" + tmp_schema_ldb + " -O " + subobj.LDAPDIR + "/" + backend_schema;
+
+message("\nCreate a suitable schema file with:\n%s\n", schema_command);
+message("\nStart slapd with: \n%s\n", slapd_command);
+
+message("All OK\n");
+return 0;