1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

935 Commits

Author SHA1 Message Date
Andrew Tridgell
5e8cb67605 s4-provision: fixed eadb automatic and manual setting in provision
we should not set posix:eadb in lp in the acl native test code

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-26 03:08:21 +01:00
Andrew Bartlett
5d65025fde s4-setup correct the require BIND version for Dynamic DNS 2010-11-24 17:48:04 +11:00
Matthias Dieter Wallnöfer
d218472310 s4:provision_rootdse_add.ldif - add all possible LDAP policy values but outcommented for the moment
It would be nice if someone could activate them as needed.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Nov 21 14:41:53 CET 2010 on sn-devel-104
2010-11-21 14:41:53 +01:00
Andrew Tridgell
1645190b1c s4-provision: don't test for xattrs if posix:eadb is set
when it is set in smb.conf or on the command line, obey the setting
and don't try to test for system xattr support
2010-11-17 23:55:39 +11:00
Andrew Tridgell
333975d84f s4-provision: setup posix:eadb using lp.set()
this allows it to override a setting made during the automatic testing
of xattr support
2010-11-17 23:55:39 +11:00
Andrew Tridgell
d7ea449049 s4-provision: don't try to autodetect xattr is posix:eadb is set
when posix:eadb is set then we know we should be using an eadb
2010-11-17 23:55:39 +11:00
Andrew Tridgell
1887ce87e4 s4-provision: use the command line lp in provision
this ensures that provision options are stored in the generated
smb.conf
2010-11-17 23:55:38 +11:00
Andrew Bartlett
ebd8e66ed0 samba-tool Add test for --store-plaintext
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Nov 16 06:29:04 UTC 2010 on sn-devel-104
2010-11-16 06:29:04 +00:00
Matthias Dieter Wallnöfer
3c8283da41 s4:provision_self_join.ldif - the object SID in AD is called "objectSid"
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Tue Nov  9 13:18:29 UTC 2010 on sn-devel-104
2010-11-09 13:18:29 +00:00
Matthias Dieter Wallnöfer
bd5039546e s4:provision - switch to "clearTextPassword" for setting passwords
This is the default password set/change attribute for s4 specific purposes
(otherwise in respect to Windows it's "unicodePwd"). We move away from
"userPassword" since on Windows it's not activated by default - and s4 will
follow soon.
2010-11-09 13:22:00 +01:00
Matthias Dieter Wallnöfer
05d7524736 s4:setup/spn_update_list - the DNS SPN is only used in DNS mode
Not all DCs are automatically DNS servers.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Mon Nov  1 12:20:36 UTC 2010 on sn-devel-104
2010-11-01 12:20:36 +00:00
Matthias Dieter Wallnöfer
7578e04fb8 s4:provision - adapt the "provision" so that SIDs are only set on entry creation
SID modifications are denied.
2010-11-01 12:25:24 +01:00
Matthias Dieter Wallnöfer
572774a7a0 s4:provision - remove the "servicePrincipalName" creation on the DC object
This is now done by the "samba_spnupdate" script.
2010-10-31 18:44:07 +00:00
Matthias Dieter Wallnöfer
01e7cc607c s4:setup/spn_update_list - reorder and update with other SPNs 2010-10-31 18:44:06 +00:00
Kai Blin
b73a05e4e1 s4 net: rename to samba-tool in order to not clash with s3 net
Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Thu Oct 28 07:25:16 UTC 2010 on sn-devel-104
2010-10-28 07:25:16 +00:00
Matthias Dieter Wallnöfer
8c4d023cc9 s4:setup/schema_samba4.ldif - this control isn't used anymore
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Wed Oct 27 16:32:28 UTC 2010 on sn-devel-104
2010-10-27 16:32:28 +00:00
Matthias Dieter Wallnöfer
6e407a3c1c s4:provision_*_references.ldif - "add" and do not "replace" the "wellKnownObjects"
This is the correct AD operation in this case. Multi-valued replaces are
generally denied most of the time.
2010-10-25 12:51:52 +02:00
Matthias Dieter Wallnöfer
8b9a08e10f s4:provision.py - add the correct "CN=Sites" security descriptor
This should help to fix bug #7403.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sat Oct 23 20:16:59 UTC 2010 on sn-devel-104
2010-10-23 20:16:59 +00:00
Matthias Dieter Wallnöfer
f9a6ff482c s4/ldb:introduce the LDB_CONTROL_PROVISION_OID control
This control is exactly thought for the actions which previously were performed
using the RELAX one.

We agreed that the RELAX control will only remain for interactions with OpenLDAP.
2010-10-23 16:37:29 +02:00
Matthias Dieter Wallnöfer
89c42a96fc ldb:rename LDB_CONTROL_BYPASSOPERATIONAL_OID into LDB_CONTROL_BYPASS_OPERATIONAL_OID
It's nicer to have this consistent with "BYPASS_PASSWORD_HASH".
2010-10-23 16:37:29 +02:00
Andrew Bartlett
f9c7365e53 s4-provisionbackend Allow a fixed URI to be specified for LDAP backend
This is added to make the 'existing' LDAP backend class more useful,
and to allow debuging of our OpenLDAP backend class with wireshark, by
forcing the traffic over loopback TCP, which is much easier to sniff.

Andrew Bartlett
2010-10-19 18:57:06 +11:00
Andrew Bartlett
ce01e36d8c s4-openldap-backend Don't set 'dbnosync' on cn=config
This isn't valid in current OpenLDAP versions.

Andrew Bartlett
2010-10-18 11:13:04 +00:00
Andrew Bartlett
ba9e787c7d s4-provision Use --ldap-backend-nosync rather than just --nosync
For some reason we had both options, and --ldap-backend-nosync is
the better name.

Andrew Bartlett
2010-10-18 11:13:04 +00:00
Matthias Dieter Wallnöfer
5cb99aa81a s4:setup/provision_self_join.ldif - let the samldb LDB module fill in "isCriticalSystemObject"
It recognizes it now automatically.
2010-10-13 13:35:21 +00:00
Matthieu Patou
6633a7b379 unit tests: do some cleanup after tests
fix

Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Mon Oct 11 14:29:10 UTC 2010 on sn-devel-104
2010-10-11 14:29:10 +00:00
Andrew Tridgell
c24240bcd2 waf: fixed some python3.x portability issues
these have crept into the tree over time. Maybe we should add testing
of a range of python versions to autobuild?
2010-10-06 11:13:05 +00:00
Matthias Dieter Wallnöfer
0fb9671a01 s4:setup/provision_rootdse_add.ldif - provide informations in the right order
Doesn't change much - but nicer to read.

Btw: is the testdata/samba3 stuff still needed ("provision_samba3sam.ldif"...)?
It seems a bit outdated.
2010-10-05 16:06:05 +00:00
Wilco Baan Hofman
927e4db090 Fix .reg file format parsing.
* multiline data
 * doublequoted value name
 * handle windows format CRLF

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
2010-10-03 15:31:37 +02:00
Matthias Dieter Wallnöfer
a01467913a s4:schema_samba4.ldif - update allocated controls list
This needs always to be done after a control allocation otherwise we end up in
double-allocations and unexpected behaviour.
2010-10-03 12:05:13 +02:00
Jelmer Vernooij
fbee3586fd selftest: Let selftest provide the tempdir, rather than creating it as sideeffect of tests.py. 2010-10-01 01:31:06 +00:00
Andrew Tridgell
cc288603ce s4-provision: simplify our generated krb5.conf
we don't want to force the KDC to be ourselves, we should
be using DNS to find a live KDC. Also remove some other options and
allow the krb5 lib to use defaults.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-28 19:25:51 -07:00
Andrew Tridgell
c7f6ab890e s4-provision: fixed the authority response for our SOA record
some clients rely on this being the hostname, not the domain

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Tue Sep 28 06:39:19 UTC 2010 on sn-devel-104
2010-09-28 06:39:19 +00:00
Matthieu Patou
a8f8f277ff s4 provision: start with gpo of version 0 and be consistent between different policies 2010-09-26 06:22:43 +04:00
Andrew Tridgell
e8fec1d3c6 s4-dns: the DNS/${HOSTNAME} SPN should be on the DNS account only 2010-09-26 01:21:50 +00:00
Andrew Tridgell
b8444b64a3 s4-provision: switch to dns-HOSTNAME instead of dns
We now use a host specific account name for the DNS account, which is
the account used for dynamic DNS updates. We also setup the
servicePrincipalName for automatic update, and add both DNS/${DNSDOMAIN}
and DNS/${DNSNAME} for compatibility with both the old and new SPNs

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-26 01:21:49 +00:00
Andrew Bartlett
c9b19d9b69 s4-kerberos Rework keytab handling to export servicePrincipalName entries
This creates keytab entries with all the servicePrincipalNames listed
in the secrets.ldb entry.

Andrew Bartlett
2010-09-24 15:07:56 +10:00
Matthias Dieter Wallnöfer
76c346dfc1 s4:provision - rootdse - remove static "ldapServiceName" attribute
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24 09:25:43 +10:00
Matthias Dieter Wallnöfer
ccc67a03d6 s4:provision - rootdse - remove static "dnsHostName" attribute
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24 09:25:43 +10:00
Matthias Dieter Wallnöfer
5f60f5e5e7 s4:provision - rootdse - remove the static attribute "serverName"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24 09:25:43 +10:00
Matthias Dieter Wallnöfer
4fd8ce42ce s4:setup/provision_self_join.ldif - now the samldb LDB module detects automatically that this is a DC account 2010-09-12 19:23:06 +02:00
Stefan Metzmacher
0ad2890c4e s4:provision: remember the setup directory if it wasn't the default
This fixes make test without a make install.

metze
2010-09-10 17:21:31 +02:00
Andrew Bartlett
22d5a96550 s4-setup Make krb5.conf use DNS by default
We set up our DNS pretty well these days, and I think the previous setting
was only there because Andrew Kroeger copied this out of our selftest code
in bf3f3af926.

Andrew Bartlett
2010-09-09 21:39:24 +10:00
Jelmer Vernooij
3c58fb27b0 setup: Use standard octal ints rather than harcoding. 2010-09-08 22:11:55 +02:00
Matthieu Patou
2cadfe8f2a unit tests: debug to ease locating pb, remove dir if exists to avoid error 2010-08-19 15:59:05 +04:00
Matthias Dieter Wallnöfer
bbb9dc806e s4:DSDB - rename the "DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID"
Rename it to "DSDB_CONTROL_PASSWORD_CHANGE_OID". This control will afterwards
contain a record with the specified old password as NT and/or LM hash.
2010-08-17 18:45:32 +02:00
Stefan Metzmacher
76e5d41d6a s4:blackbox/newuser: use test specific user names
As this test doesn't delete the user accounts at the end,
we should use test specific user names. That lowers the
chance of conflicts with other tests.

metze
2010-07-31 11:35:31 +02:00
Matthieu Patou
d861ebbd81 s4 dsdb: create a new control: changereplmetadata
This control is designed to allow replmetadata to be specified

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-07-15 22:08:20 +10:00
Stefan Metzmacher
23f810041b s4:provision: remove --policy-guid and --policy-guid-dc cmdline options
metze
2010-07-10 11:18:19 +02:00
Matthieu Patou
e962e7e956 s4 unittests: remove the provision directory before (re)generating 2010-07-10 11:18:18 +02:00
Matthieu Patou
cad04dabbb s4 net: Add spn module to list/add/remove spn on objects
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2010-07-10 11:18:17 +02:00
Stefan Metzmacher
6d7b9648e5 s4:dsdb: allocate DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID
When importing users from Samba3 we need to control all values.

metze
2010-07-05 18:00:14 +02:00
Matthias Dieter Wallnöfer
43b0c314d8 s4:setup/provision_basedn_modify.ldif - set "minPwdAge" to the right value
Now we should have fixed all password related tests to cooperate with this value
2010-07-03 11:38:54 +02:00
Stefan Metzmacher
50da834f13 s4:provision: add entries for root dns servers
metze
2010-06-26 09:50:56 +02:00
Stefan Metzmacher
6ab234cec9 s4:provision: move Samba4 specific DNS stuff to its own file
metze
2010-06-26 09:50:56 +02:00
Stefan Metzmacher
c6b21931c6 s4:provision: add --next-rid option
Make it possible to provision a domain with a given next rid counter.
This will be useful for upgrades, where we want to import users
with already given SIDs.

metze
2010-06-26 09:50:55 +02:00
Stefan Metzmacher
712a149802 s4:provision: don't use hardcoded values for 'nextRid' and 'rIDAvailablePool'
On Windows dcpromo imports nextRid from the local SAM,
which means it's not hardcoded to 1000.

The initlal rIDAvailablePool starts at nextRid + 100.

I also found that the RID Set of the local dc
should be created via provision and not at runtime,
when the first rid is needed.
(Tested with dcpromo on w2k8r2, while disabling the DNS
 check box).

After provision we should have this (assuming nextRid=1000):

rIDAllocationPool: 1100-1599
rIDPrevAllocationPool: 1100-1599
rIDUsedPool: 0
rIDNextRID: 1100

rIDAvailablePool: 1600-1073741823

Because provision sets rIDNextRid=1100, the first created account
(typically DNS related accounts) will get 1101 as rid!

metze
2010-06-26 09:50:54 +02:00
Matthias Dieter Wallnöfer
8ad01613f6 Revert "s4:provision.ldif - fix the number of available RIDs"
This reverts commit 41cdcd54b7.

As per request of metze revert this (cause written on the mailing list).
2010-06-24 15:13:40 +02:00
Matthias Dieter Wallnöfer
41cdcd54b7 s4:provision.ldif - fix the number of available RIDs
There should be 4611686014132422209 and not 4611686014132422109.
2010-06-24 10:04:53 +02:00
Matthias Dieter Wallnöfer
fec489bd87 s4:provision.ldif - this Win2003 revision level seems always to be "9" on Windows Server 2008 machines 2010-06-24 10:04:53 +02:00
Matthias Dieter Wallnöfer
64e19ef9fb s4:provision_users.ldif - change a group description to be correct 2010-06-24 10:04:52 +02:00
Matthias Dieter Wallnöfer
e88f37daa0 s4:setup/provision.reg - raise version to Windows Server 2008 R2 2010-06-24 10:04:50 +02:00
Jelmer Vernooij
237ab66f6c selftest: Use scripted testparm. 2010-06-20 14:14:47 +02:00
Lukasz Zalewski
e55c012acc make test modules for net group set of commands and modification to the newuser to include additional parameters
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
2010-06-20 01:29:03 +02:00
Matthieu Patou
3ebe560622 ldb: add a new control bypassioperationnal
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
2010-06-20 00:43:08 +02:00
Andrew Bartlett
d523e946b1 s4:provision Add import for DS_DOMAIN_FUNCTION_2000 2010-06-16 09:57:51 +10:00
Andrew Bartlett
814cb8895d s4:provision Allow functional level 2000 to be chosen 2010-06-16 09:57:51 +10:00
Andrew Bartlett
ecfce7365c s4:dsdb Add control for signaling between repl_meta_data and linked_attributes
This control will allow the linked_attributes module to know if
repl_meta_data has already handled the creation of forward and back
links.

Andrew Bartlett
2010-06-16 09:57:51 +10:00
Andrew Kroeger
352fb5c7e4 s4:provision: Make gc._msdcs DNS entries A/AAAA records
When adding an additional DC as a GC server, the new DC attempts to register its
own gc._msdcs records.  If the existing gc._msdcs record is a CNAME, BIND fails
the update with the message "attempt to add non-CNAME alongside CNAME ignored",
and the new DC is not registered as a GC server.

The A & AAAA record types for gc._msdcs have been verified against the DNS
server of a W2K8 DC.
2010-06-14 12:14:46 +02:00
Matthias Dieter Wallnöfer
4b6ce8efc0 s4:fix allocated control OIDs for "password_hash" LDB module
The password hash module controls overlapped others. Sorry, but the
"schema_samba4.ldif" hasn't been kept up-to-date.
2010-06-13 18:35:19 +02:00
Jelmer Vernooij
74ed48aa1c Friendlier message. 2010-06-13 18:19:03 +02:00
Jelmer Vernooij
d9d0d54475 upgradeprovision: Use logging infrastructure. 2010-06-13 18:19:03 +02:00
Jelmer Vernooij
956a256faa s4-python: Start using standard python logging infrastructure rather
than simple messaging callbacks.
2010-06-13 18:19:03 +02:00
Matthias Dieter Wallnöfer
b8ea2e0757 s4:provision - fix typo in substitution variable 2010-06-06 20:42:19 +02:00
Matthias Dieter Wallnöfer
40ced1a3be s4:setup/*.ldif - remove unneeded "cn" attributes
Should be generated automatically
2010-05-24 14:01:05 +02:00
Matthias Dieter Wallnöfer
38e9a7f577 s4:domain functional level - it is also specified in the domain object under partitions
Discovered by the "ldapcmp" tool
2010-05-13 15:14:06 +02:00
Matthias Dieter Wallnöfer
92aa194145 s4:provision_configuration.ldif - add more extended rights objects 2010-05-13 15:06:35 +02:00
Matthias Dieter Wallnöfer
9005227e72 s4:provision_users.ldif - fix up and reorder the well-known security principals 2010-05-13 14:51:10 +02:00
Matthias Dieter Wallnöfer
c715f6d3f9 s4:provision_configuration.ldif - add more Windows 2008 forest operations 2010-05-13 14:47:32 +02:00
Matthias Dieter Wallnöfer
eaea676916 s4:provision_configuration.ldif - the revision level of "Windows2003Update" should obviously be 10
Compared against my Windows Server 2008 and Zahari's output.
2010-05-13 14:47:31 +02:00
Matthias Dieter Wallnöfer
025eaceb5c s4:provision_configuration.ldif - "CN=94fdebc6-8eeb-4640-80de-ec52b9ca17fa" operation is of version 3 2010-05-13 14:47:30 +02:00
Matthias Dieter Wallnöfer
47818b19fc s4:provision*.ldif - always set the "msDS-NcType" attribute correctly 2010-05-13 14:47:30 +02:00
Matthias Dieter Wallnöfer
1885327b30 s4:provision_configuration.ldif - set the right schedule on the default site in the NTDS site settings 2010-05-13 14:47:29 +02:00
Matthias Dieter Wallnöfer
8acd8b97a6 s4:provision_configuration.ldif - The "NTDS Quotas" object is system-critical 2010-05-13 14:47:29 +02:00
Matthias Dieter Wallnöfer
79ac53eb3b s4:provision_configuration.ldif - "sites" object
- The default site doesn't contain a licensing object
- Adequate two other values (a "showInAdvancedViewOnly" and a "systemFlags" one)
2010-05-13 14:10:02 +02:00
Matthias Dieter Wallnöfer
f57bcc92b5 s4:provision.ldif - add IP security objects as they exist on Windows Server 2010-05-13 13:03:47 +02:00
Matthias Dieter Wallnöfer
44e05dfb73 s4:provision.ldif - add more Windows 2008 domain operations 2010-05-13 13:03:46 +02:00
Matthias Dieter Wallnöfer
cc2bd1f777 s4:provision_users.ldif - On Windows Server >= 2008 security principal S-1-5-20 doesn't exist anymore 2010-05-13 13:03:45 +02:00
Matthias Dieter Wallnöfer
350c61922e s4:provision.ldif - "passwordSettingsContainer" add "showInAdvancedViewOnly" 2010-05-13 13:03:44 +02:00
Matthias Dieter Wallnöfer
bbb5825a6f s4:provision.ldif - fix up "NTDS Quotas" "systemFlags" 2010-05-13 13:03:43 +02:00
Matthias Dieter Wallnöfer
b2bd02e11e s4:provision_users.ldif - fix up Administrator's "userAccountControl" 2010-05-13 13:03:43 +02:00
Matthias Dieter Wallnöfer
8c796715c1 s4:provision_basedn_modify.ldif - fix up "maxPwdAge" 2010-05-13 13:03:31 +02:00
Matthias Dieter Wallnöfer
5e4d91f7aa s4:provision_users.ldif - Fix typos in user/group objects 2010-05-13 11:17:52 +02:00
Matthias Dieter Wallnöfer
726fb35f9f s4:dsdb: add new controls
- Add a new control for getting status informations (domain informations,
  password change status) directly from the module
- Add a new control for allowing direct hash changes
- Introduce an addtional control "change_old password checked" for the password
2010-05-10 17:54:15 +02:00
Stefan Metzmacher
1913e03bd4 s4:setup: mark DSDB_CONTROL_DN_STORAGE_FORMAT_OID 1.3.6.1.4.1.7165.4.3.4 as allocated
metze
2010-05-10 17:54:15 +02:00
Stefan Metzmacher
6ee53309a1 s4:blackbox password tests - more complex passwords 2010-05-10 12:20:26 +02:00
Matthias Dieter Wallnöfer
e4ce727c8d s3:provision_basedn_modify.ldif - add "msDS-NcType" attribute and fix comments 2010-05-10 09:21:17 +02:00
Marcel Ritter
e6f59613fe Install spn_update_list to setup/ dir
Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2010-04-27 21:05:00 +02:00
Andrew Tridgell
fa26383884 s4-dsdb: added samba_spnupdate
this script adds all our required servicePrincipalName entries at
runtime. The admin can add more entries to spn_update_list as needed
2010-04-27 19:27:18 +10:00
Andrew Tridgell
570c89287e s4-dns: explain what the file is for 2010-04-27 19:27:18 +10:00
Andrew Tridgell
be35a40e03 s4-dns: fixed dc.dc duplication in DNS update list 2010-04-27 11:01:23 +10:00
Andrew Bartlett
bd08249d68 s4:provision Remove moduleload for 'hdb' (wrong name).
The backends are not normally modules anyway
2010-04-22 19:55:06 +10:00
Andrew Bartlett
e11f92ba73 s4:provision Make OpenLDAP backend more robust
With the extra moduleload lines (which succeed if it's already
staticly linked), we now work with OpenLDAP overlays as modules.

Andrew Bartlett
2010-04-22 18:37:19 +10:00
Andrew Bartlett
466fbe278a s4:provison Pass nosync in for the OpenLDAP cn=config too 2010-04-22 18:37:19 +10:00
Andrew Bartlett
cbb818222a s4:OpenLDAP-backend Use the new rdnval module in OpenLDAP
This is rather than rdn_name, which tries to do the job on the client
side.  We need to leave this module in the stack for Fedora DS (and of
course the LDB backend).

Andrew Bartlett
2010-04-22 18:37:18 +10:00
Andrew Bartlett
a50f6aad85 s4:provision Use more reasonable values for DB_CONFIG
With the OpenLDAP backend, the old DB_CONFIG caused OpenLDAP to abort
on startup, and was very inefficient.  This new one, kindly supplied
by Matthew Backes <mbackes@symas.com> uses a more reasonable set of
buffer sizes.

Andrew Bartlett
2010-04-22 18:37:18 +10:00
Andrew Tridgell
5e695dec2a s4-upgradeprovision: fixed --realm option duplicate in upgrade_from_s3 2010-04-21 13:35:56 +10:00
Andrew Tridgell
8fdfcde56c s4-provision: cope with --realm being in getopt.py
we still need to allow for interactive querying of the realm

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-04-21 13:35:56 +10:00
Matthieu Patou
b8d6f1ce89 s4 provision: Remove hard coded ACL for GPO objects
It is no longer needed to hard code ACL for GPO object as we have now code
that calculate ACL from defaultSecurityDescriptor and inheritance correctly.

In fact the resulting ACL returned by this hard coded value is a bit wrong as
some ACE are duplicated.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
2010-04-15 18:45:40 +02:00
Stefan Metzmacher
f1ecdb980b s4:setup/wscript_build: install dns_update_list into ${SETUPDIR}
metze
2010-04-15 18:37:40 +02:00
Jelmer Vernooij
dd4ef4e106 s4-python: More cleanups. 2010-04-08 23:20:36 +02:00
Jelmer Vernooij
d7a46ee129 s4-python: Simplify code, improve formatting. 2010-04-08 23:20:36 +02:00
Thomas Nagy
7f3116a63d build: allow the waf build to work with python 3.0 and 3.1
Python 3.x is a bit fussier about print statements and indentation.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-04-08 07:46:39 +10:00
Andrew Tridgell
f9eae32f4b s4-waf: mark the wscript files as python so vim/emacs knows how to highlight them 2010-04-06 20:27:11 +10:00
Andrew Tridgell
bd7bf0e1a9 s4-waf: install the rest of our python files 2010-04-06 20:27:10 +10:00
Andrew Tridgell
a2a4fee8c6 s4-waf: forgot these files 2010-04-06 20:27:09 +10:00
Jelmer Vernooij
31a517e172 s4-python: Move dsdb constants to a separate python module. 2010-04-04 00:14:23 +02:00
Andrew Tridgell
088096d1ba python: use '#!/usr/bin/env python' to cope with varying install locations
this should be much more portable
2010-03-25 14:37:19 +11:00
Oliver Liebel
752b2206cb Fixed --ol-mmr-url helpline
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-03-18 11:27:57 +11:00
Oliver Liebel
947560fe37 Fixed OL-MMR make test
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-03-18 11:27:51 +11:00
Matthias Dieter Wallnöfer
5e06110bc1 Reintroduce "s4:provision Improve the handling of provision errors""
This mainly reverts commit f0bc02d74c.

Jelmer pointed out a way how we can achieve the same error handling with an
older syntax also on Python 2.4+.
2010-03-14 10:34:26 +01:00
Matthias Dieter Wallnöfer
f0bc02d74c Revert "s4:provision Improve the handling of provision errors"
This reverts partially commit 027123199e.

Andrew, this is not Python 2.4+ compatible
2010-03-13 12:37:45 +01:00
Endi S. Dewata
ade93755d5 s4:provision - Updated FDS schema mapping. 2010-03-11 15:30:25 +11:00
Andrew Bartlett
027123199e s4:provision Improve the handling of provision errors
The backtraces were too confusing for our users, and didn't tell them
what to do to fix the problem.  By printing the string (rather than a
backtrace), and including in the error what to do, and what file to
remove, we give them a chance.

Andrew Bartlett
2010-03-11 15:28:53 +11:00
Matthias Dieter Wallnöfer
73e7aa863b s4:provision.reg - call us Windows 2008 from the current version point of view 2010-03-06 18:51:41 +01:00
Endi S. Dewata
c54699faf2 s4:provision - Moved default FDS SASL mappings deletion from post_setup() to init().
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-03-02 14:07:15 +11:00
Endi S. Dewata
02533c9f1b s4:provision - Use netbios name for FDS instance name.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-03-02 14:07:01 +11:00
Matthias Dieter Wallnöfer
2caa2a045d s4:provision.zone - fix port of "_ldap._tcp.gc._msdcs" 2010-02-26 21:00:10 +01:00
Andrew Tridgell
336ebeabad s4-provision: added dns_update_list
This contains the list of DNS names we should have as a DC
2010-02-26 14:27:39 +11:00
Andrew Tridgell
c796b6c52e s4-provision: fixed port number for gc ldap DNS SRV entry
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-26 13:59:17 +11:00
Andrew Tridgell
9a72806dc9 Revert "s4:AD content - adequate some revision levels to match Windows Server 2008"
This reverts commit 973ea19867.

This change breaks DRS dcpromo.
2010-02-26 13:22:12 +11:00
Matthias Dieter Wallnöfer
017e401ded s4:AD content - Implement the new password settings container 2010-02-21 21:19:57 +01:00
Matthias Dieter Wallnöfer
973ea19867 s4:AD content - adequate some revision levels to match Windows Server 2008 2010-02-21 21:19:56 +01:00
Matthias Dieter Wallnöfer
e592deeb1a s4:AD content - Add the DFSR objects which exist on Windows Server >= 2008
Those replace the FRS ones.
2010-02-21 21:19:56 +01:00
Eduardo Lima
9c46f425a2 s4-drs: enable the recyclebin optional feature
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-02-16 00:12:09 +11:00
Andrew Tridgell
4aaa7fe43b s4-provision: fixed --function-level option to provision
we need the DS_DOMAIN_* levels imported
2010-02-12 01:08:11 +11:00
Andrew Tridgell
c986bfb22e s4-provision: pre-create a named.conf.update file
The named.conf.update file will be filled in at runtime by Samba to 
contain the list of bind9 grant rules for granting DNS dynamic update
permissions on the domain.
2010-02-11 21:04:12 +11:00
Andrew Tridgell
5a72eca574 s4-provision: move zone file to dns subdirectory
This allows the permissions to be correctly set for bind to write to
a journal file. It also sets the right group ownership and permissions
on the files that bind needs to access.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-11 21:04:11 +11:00
Andrew Bartlett
f299fe565a s4:provision Just 'do the right thing' with empty smb.conf files
For some reason, JHT keeps on creating an empty smb.conf file,
expecting it to be the same as a non-existant one.  It is easier to
just realise what he meant.

Andrew Bartlett
2010-02-10 16:18:21 +11:00
Jelmer Vernooij
0b7910b8bf upgrade_from_s3: Remove unused imports. 2010-01-25 15:18:01 +01:00
Endi S. Dewata
d69d07ce62 s4-provision: Added msDS-NcType into samba4Top object class
Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
2010-01-23 22:41:28 +01:00
Endi S. Dewata
ce709389e6 s4-provision: Disable populating FDS during instance creation.
Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
2010-01-23 22:40:51 +01:00
Matthieu Patou
c637c52876 provision: use message and do not display warning if the user choosed delibarately posix:eadb 2010-01-21 07:11:17 +13:00
Matthieu Patou
d4514a6539 provision: introduce use-xattr parameter for defining where to store attributes
This option allow simple user (non root) to invoke provision without facing an error
  while insuring that ACL on shared files will always be set
2010-01-21 07:11:17 +13:00
Matthieu Patou
e78626dc2e s4: Set acls correctly on all sysvol and scripts shares 2010-01-21 07:11:15 +13:00
Matthieu Patou
028c9b1c15 s4: regroup gpo modification in one function, set acl on files accordingly with ACL in LDAP 2010-01-21 07:11:14 +13:00
Andrew Tridgell
84b47d3334 s4-provision: added w2k8r2 ldap capabilities 2010-01-16 14:10:44 +11:00
Andrew Tridgell
a9808ae83d s4-provision: added "check-names ignore;" to allow for _msdcs A records 2010-01-16 14:10:44 +11:00
Matthias Dieter Wallnöfer
b1d2bb3e51 s4:provision_users.ldif - Add a comment that some objects under "Users" are now located elsewhere
This is needed due to the new RID/SID distribution system
2010-01-14 10:58:08 +01:00
Matthias Dieter Wallnöfer
face5d3030 s4:provision_users.ldif - Add objects for IIS
Some WSPP locations point out that beginning with Windows Server 2008 they're
also per default present.

Compared against Windows Server 2008
2010-01-14 10:58:08 +01:00
Matthias Dieter Wallnöfer
9ac39b659f s4:provision_users.ldif - Add additional BUILTIN objects
Compared against Windows Server 2008
2010-01-14 10:58:08 +01:00
Matthias Dieter Wallnöfer
2a05dd6fcc s4:provision_users.ldif - add the restant part of the objects needing for RODC support
RODC = Read Only Domain Controllers

Compared against Windows Server 2008
2010-01-14 10:58:07 +01:00
Matthias Dieter Wallnöfer
71357053bb s4:provision_users.ldif - Fix up errors on existing entries
Compared against Windows Server 2008
2010-01-14 10:58:07 +01:00
Matthias Dieter Wallnöfer
81053e9124 s4:provision_users.ldif - Simple reordering
Sorted according the SID - easier for later enhancements.
2010-01-14 10:58:07 +01:00
Matthias Dieter Wallnöfer
a0d7f3e344 s4:provision_users.ldif - Remove system objects from the wrong place
Objects like the "Cryptographic Operators", "Event Log Readers" don't belong
here but into the builtin domain.
2010-01-14 10:58:06 +01:00
Andrew Tridgell
73422e7dd8 Revert "s4:provision_users.ldif - Import all essential groups for Windows Server 2008 mode"
This reverts commit 5c174c68cc.

This series of commits broke 'make test'.

Matthias, please make sure you run a _full_ make test before every
push.
2010-01-11 10:08:30 +11:00
Andrew Tridgell
3af84c1cde Revert "s4:provision_users.ldif - Remove foreign security principal S-1-5-17 for now"
This reverts commit 61dfd3dc1d.

This series of commits broke 'make test'.

Matthias, please make sure you run a _full_ make test before every
push.
2010-01-11 10:07:53 +11:00
Andrew Tridgell
306de3051d Revert "s4:provision_users.ldif - Fix memberships regarding the denied password RODC replication group"
This reverts commit 9ee895fcf6.

This series of commits broke 'make test'.

Matthias, please make sure you run a _full_ make test before every
push.
2010-01-11 10:06:58 +11:00
Andrew Tridgell
aa4501538a Revert "s4:provision_users.ldif - Add objects for IIS"
This reverts commit 91e2100287.

This series of commits broke 'make test'.

Matthias, please make sure you run a _full_ make test before every
push.
2010-01-11 10:05:50 +11:00
Matthias Dieter Wallnöfer
91e2100287 s4:provision_users.ldif - Add objects for IIS
Some WSPP locations point out that they're defacto-standards for Windows Server deployments starting with 2008. So we should add them to s4 too.
2010-01-10 22:48:05 +01:00
Matthias Dieter Wallnöfer
e72787f0af s4:provision_self_join_modify.ldif - Point out that account "dns" is s4 specific 2010-01-10 22:48:04 +01:00
Matthias Dieter Wallnöfer
9ee895fcf6 s4:provision_users.ldif - Fix memberships regarding the denied password RODC replication group 2010-01-10 22:48:04 +01:00
Matthias Dieter Wallnöfer
61dfd3dc1d s4:provision_users.ldif - Remove foreign security principal S-1-5-17 for now
This belongs to the AD IIS stuff where I don't know yet if we should import it.
2010-01-10 11:07:16 +01:00
Matthias Dieter Wallnöfer
5c174c68cc s4:provision_users.ldif - Import all essential groups for Windows Server 2008 mode
Additionally I had to fix some bugs (especially wrong "groupTypes") and
reordered the objects using the SID (this is easier when enhancing the file).
2010-01-10 10:50:46 +01:00
Matthias Dieter Wallnöfer
fca0c4de2a s4:provision_self_join.ldif - Adapt comment after implementation of distributed RIDs 2010-01-08 18:18:21 +01:00
Andrew Tridgell
ad11deb9bd s4-schema: fixes for W2K8-R2 schema
The schema from WSPP had a number of typos that prevented it from
working. These changes allow it to work with Samba, and allow w2k8r2
to run DCPROMO against Samba successfully

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:54 +11:00
Andrew Tridgell
ebec49965b s4-schema: added msDS-NcType to schema container
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:53 +11:00
Andrew Tridgell
ce21151d22 s4-schema: fixed attributes of aggregate schema
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:53 +11:00
Andrew Tridgell
9d296e6776 s4-provision: added W2K8-R2 schema as provided by WSPP 2010-01-08 18:24:52 +11:00
Andrew Tridgell
42f0bdae69 s4-provision: RID 1000 is consumed by the machine account 2010-01-08 13:03:03 +11:00
Andrew Tridgell
b1f97b7e60 s4-dsdb: added an extended operation for allocating a new RID pool
This will be called by getncchanges when a client asks for a
DRSUAPI_EXOP_FSMO_RID_ALLOC operation

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:03:02 +11:00
Andrew Tridgell
53d10d139e s4-provision: don't hard wire the creation of the RID Set object
We now create it automatically in the samldb module when the first
user is created. 

The creation of the dns user also had to move to the _modify.ldif as
it now relies on the fSMO role being setup for the RID Manager

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:03:00 +11:00
Andrew Tridgell
5eb3b919c5 s4-provision: the DC object itself needs a fixed objectSID
We can't allocate a objectSID until we have rIDSetReferences, but that
is in the DC object, so we have to force the objectSID of the DC

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:02:58 +11:00
Andrew Tridgell
a1362492ab s4-provision: added an initial RID Set
We will allocate RIDs from this set

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:02:58 +11:00
Jelmer Vernooij
9e5ef916d4 net: Move 'newuser' to 'net newuser'
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:27 +11:00
Jelmer Vernooij
73594c248f net: Fix tests and documentation of setexpiry.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:25 +11:00
Jelmer Vernooij
345b25d059 net: Move setexpiry to 'net setexpiry'
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:24 +11:00
Jelmer Vernooij
b531696a5b net: Move 'setpassword' to 'net setpassword'.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:22 +11:00
Jelmer Vernooij
e60a40e287 s4/net: Add domainlevel subcommand. 2009-12-29 16:26:20 +01:00
Jelmer Vernooij
eaf4a9afb2 s4/net: Make pwsettings a net subcommand. 2009-12-29 16:26:19 +01:00
Endi Sukma Dewata
f871de7def s4:provision - Remap conflicting thumbnailPhoto and thumbnailLogo OID's. 2009-12-15 10:04:04 +11:00
Andrew Bartlett
a88f086d96 s4:setup Adjust upgradeprovision blackbox test now we don't have --targetdir 2009-12-01 12:17:56 +11:00
Matthias Dieter Wallnöfer
b973c50836 s4:upgrade_from_s3 - Move it back to "setup"
Suggested by Jelmer
2009-11-28 19:25:12 +01:00
Matthias Dieter Wallnöfer
f0686645a9 s4:setup/provision - Rework
- Revert change in "ask" - was previously correct
- Readd accidentally removed checks for non-null realm and domainname
- On interactive mode perform only one "ask" call per question
- Inform the user about the unset administrator password
2009-11-28 18:59:33 +01:00
Matthieu Patou
db41a0afc6 s4: fix SD update and password change in upgrade script
- reserve a new Samba OID for recalculate SD control
- fix the update SD function
- fix handling of kvno in the update_machine_account_password function
- fix handling of handles in RPC winreg server

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-11-28 09:56:06 +11:00
Matthias Dieter Wallnöfer
6b835b0691 s4:setup/provision - make the interactive mode work again 2009-11-27 13:02:31 +01:00
Matthias Dieter Wallnöfer
fd313282a2 s4:upgrade script - rename it to "upgrade_from_s3" and do some rework
- Give a better name to the script
- Move it to the location where also "upgradeprovision" resides
- Fix up trailing whitespaces and tabs
2009-11-27 12:26:11 +01:00
Andrew Bartlett
731f560ecb s4:upgradeprovision add 'exit $failed' to blackbox test 2009-11-27 16:05:05 +11:00
Andrew Bartlett
6f0f82f7ed s4:selftest Add tests for upgradeprovision 2009-11-27 16:05:05 +11:00
Andrew Bartlett
5ea6f79775 s4:provision Don't bother with a template for the LDAP backend startup script. 2009-11-24 11:04:31 +11:00
Andrew Bartlett
625856f2cf s4:provision Move secrets.ldb over to .c file module lists, like sam.ldb 2009-11-24 10:41:45 +11:00
Andrew Bartlett
90d739990a s4:provision Remove 'operational' from secrets.ldb module list 2009-11-24 10:39:09 +11:00
Andrew Bartlett
401ba9c9cf s4:dsdb Move module configuration from each ldb into samba_dsdb.c
This makes getting the module order correct, the obligation of Samba4
developers, and not system administrators.  In particular, once an ldb
is updated to use only the 'samba_dsdb' module, no further changes to the
ldb should be required when upgrading to later Samba4 versions.

(thanks to metze for the suggestion of samba_dsdb as a long-term
stable name for the module)

Andrew Bartlett
2009-11-23 14:15:07 +01:00
Andrew Bartlett
e297af00fa s4:provision Simplify the module list
This makes the member server much more like the DC, the objectGUID
module replaces the repl_meta_data module.

We also generally rework the construction of the list, building a full
list in python, and then transforming it into a string, rather than
playing string concatonation games

Andrew Bartlett
2009-11-23 14:15:06 +01:00
Matthias Dieter Wallnöfer
5c6c2619fb s4:provision_users.ldif - Descriptions generally begin with a majuscle 2009-11-17 19:46:59 +01:00
Andrew Bartlett
5c3ef6dbae s4:provision Split up reference creation, load schema earlier in the stack
The schema needs to be loaded above the extended_dn_out modules as
otherwise we don't get an extended DN in the search results.

The reference split is to ensure we create references after the
objects they reference exist.

Andrew Bartlett
2009-11-17 10:38:04 +11:00
Andrew Bartlett
41ce3dc0c3 s4:dsdb Add 'dsdb_flags' to dsdb_module_search() to enable often-used features
These flags, also on dsdb_module_search_dn() allow us to add commonly
set controls to this pre-packaged blocking search, without rebuilding
the whole function in each caller.

Andrew Bartlett
2009-11-17 10:38:01 +11:00
Endi S. Dewata
8e5f5e3f05 s4:provision - Removed dependency on full Samba 3 schema from FDS 2009-11-16 07:57:40 +11:00
Nadezhda Ivanova
b8ecf39d9f Added security descriptor for the domain NC to provisioning.
Necessary for correct descriptor inheritance. Based on the default state
of a single DC. Will be modified later when we support multiple DCs.
2009-11-04 15:58:54 +02:00
Andrew Bartlett
350e963545 s4:provision Rework provision to always have a ProvisionBackend
Rather than treat the LDAP backend as a special case, treat all
backends the same, with different callbacks.

Andrew Bartlett
2009-11-02 16:36:54 +11:00
Endi S. Dewata
e035433bab s4 - SID allocation using FDS DNA plugin 2009-11-02 16:36:54 +11:00
Endi S. Dewata
bf01937549 s4:dsdb - Store SID as string in FDS. 2009-11-02 16:36:54 +11:00
Endi S. Dewata
8097280b46 s4 - Mapped AD schema to existing FDS schema. 2009-11-02 16:36:53 +11:00
Andrew Bartlett
a84abe7053 s4:setup Mark 'cn' in secrets as case insensitive
While this does not matter very much, others may later expect 'cn' to be case
insensitive.

Andrew Bartlett
2009-10-23 15:42:04 +11:00
Matthias Dieter Wallnöfer
33f3d54de4 s4:provision - rework the "guess_names" and "make_smbconf" method
- Cleans it up from unnecessary "lower()/upper()" and parameters which can be
  derived through "lp" calls.
- Substitute the "HOSTNAME" caption in the "smb.conf" templates with
  "NETBIOS_NAME" which fits better.
- Now the "realm" and "domain" parameter of the provision are totally case
  insensitive and the script itself up/downcases them appropriately depending
  on the use (e.g. "realm" upcase for KERBEROS, lowcase for DNS domainname).
2009-10-21 23:43:04 +02:00
Andrew Bartlett
18035251ad s4:provision Test ability to set GUIDs from provision command line 2009-10-21 22:43:52 +11:00
Andrew Bartlett
d3b50ec33f s4:provison Allow the NTDS guid on the command line (for testing)
This allows a blackbox test to confirm this can be set.

Andrew Bartlett
2009-10-21 22:43:52 +11:00
Andrew Bartlett
d4048b2e17 s4:provision Set @OPTIONS in the provision_init.ldif
The new partitions code knows to copy these items in when creating a
new parition, so we can set it from the start.

Andrew Bartlett
2009-10-21 22:43:50 +11:00
Andrew Bartlett
c59f00805c s4:dsdb Rework modules create new partitions at runtime
This is done by passing an extended operation to the partitions module
to extend the @PARTITION record and to extend the in-memory list of
partitions.

This also splits things up into module parts that belong above and below
repl_meta_data

Also slit the partitions module into two files due to the complexity
of the code

Andrew Barltett
2009-10-21 22:43:50 +11:00
Andrew Tridgell
96a41581e6 s4-idmap: the idmap database should be indexed 2009-10-19 20:31:40 +11:00
Andrew Tridgell
8c7a81408a s4-schema: We should not need Samba4TopExtra now
The last attribute this contained was 'privilege' which is now gone
2009-10-17 13:01:03 +11:00
Andrew Tridgell
f794e8d43d s4-provision: added the default privileges db
privileges are now stored in a separate database
2009-10-17 13:01:02 +11:00
Andrew Tridgell
cc3e1d9022 s4-provision: removed the old privilege attributes
Our schema is getting a bit cleaner :-)
2009-10-17 13:01:02 +11:00
Endi S. Dewata
cf77bf3382 s4:provision - replaced linked_attributes with FDS plugins
When FDS is used as a backend, Samba should not use the
linked_attributes LDB module, but instead use the built-in
DS plugins for attribute linking, indexing, and referential
integrity.
2009-10-16 14:08:11 +02:00
Andrew Bartlett
1dfa2ed423 s4:provision Remove all references to samba4LocalDomain
This was a bad idea all along, as Simo said at the time.  With the
full MS schema and enforcement of it, it is an even worse idea.

This fixes the provision of the member server in 'make test'

Andrew Bartlett
2009-10-12 16:50:49 +11:00
Andrew Tridgell
33347d783a s4-provision: match win2003 functional level
We are now defaulting to win2003 functional level, and see to report
the right revisions of our db and schema
2009-10-06 19:05:15 +11:00
Matthias Dieter Wallnöfer
d87cfc7cc4 s4:provision_users.ldif - Put potential primary groups in front of the file
(So they can be always found by the SAMLDB module)
2009-10-02 15:26:02 +02:00
Andrew Bartlett
984ea88156 s4:dsdb rework instanceType module - put instanceType in provision
The instanceType needs to be specified in future because that's how
the partitions are actually created.
2009-10-02 12:45:07 +02:00
Matthieu Patou
8bf517d340 s4: Improve provisioning: use relax control
Give the possibility to specify controls when loading ldif files.
  Relax control is specified by default for all ldb_add_diff (request Andrew B).
  Set domainguid if specified at the creation of object instead of modifying afterward
  Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
2009-10-02 12:45:01 +02:00
Matthias Dieter Wallnöfer
bf0855e8e3 s4:provision - Change the default forest/domain function level back to Windows 2003 Native 2009-10-02 14:22:06 +10:00
Matthias Dieter Wallnöfer
0dadb566a9 s4:pwsettings - Improve error handling and introduce "choice" type
- Improve the error handling according to Jelmer's suggestions
- Print out the error messages on "stderr"
- Add also here the "choice" type for arguments
2009-09-30 16:00:29 +02:00
Matthias Dieter Wallnöfer
cb50af5fe1 s4:provision - Lets the user choose between the supported forest/domain function levels
Adds a parameter "--function-level" which allows to specify the domain and
forest function level.
2009-09-30 16:00:07 +02:00
Andrew Kroeger
b2e8519e32 s4:provision: Show domains and forests are W2K8 DC capable.
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep"
utility is used to perform schema updates and update other attributes as
necessary.

Adding these entries provides an indication that the adprep utility has been run
with the /forestprep, /domainprep and /rodcprep arguments.  Although these
entries indicate adprep has been run, nothing has been done to verify that the
changes that the adprep utility would have made have actually been done.

The values used for the revision atttributes are as seen on a W2K8 DC (not
W2K8 R2, which will probably have higher values).
2009-09-30 15:59:38 +02:00
Andrew Kroeger
955dab0ed7 s4:provision: Update schema version number to W2K8.
We are running the W2K8 schema version, not the W2K3 version.
2009-09-30 15:59:16 +02:00
Matthias Dieter Wallnöfer
d6f69ebcc2 s4:domainlevel - General rework
- We support domain/forest function levels >= (Windows) 2003 Native -> adapt the
  domain/forest and DC function level restrictions.
- Consider also the lowest function level of a DC. The domain and forest function
  levels can never be higher than it.
- Improve the error handling by printing out messages to "stderr"
- Introduce the "choice" type for choice arguments (saves us some error handling)
2009-09-30 15:58:16 +02:00
Matthias Dieter Wallnöfer
956740aa6f s4:LDIFs - enhance the section comments 2009-09-25 10:59:13 +02:00
Nadezhda Ivanova
13b979b03d Merge branch 'master' of git://git.samba.org/samba 2009-09-21 14:26:15 -07:00
Matthias Dieter Wallnöfer
7373bb79d4 s4:samdb/tools - That should fix now the last failures 2009-09-21 13:53:47 +02:00
Matthias Dieter Wallnöfer
f0c080a484 s4:scripts - Reintroduce "-H" parameter
I removed it since on some scripts it was present, on others not - so I thought
it wouldn't be really needed. This was a bad decision (pointed out by abartlet).
So I reintroduce it on all scripts (to have consistent parameters).
2009-09-21 11:53:19 +02:00
Nadezhda Ivanova
025590e7a4 Merge branch 'master' of git://git.samba.org/samba 2009-09-20 17:43:46 -07:00
Andrew Bartlett
509a2bb97c s4:provision split provision of DNS zone and self join keytab 2009-09-20 16:29:37 -07:00
Nadezhda Ivanova
6283f2caaa Initial implementation of security descriptor creation in DS
TODO's:
ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20 15:16:17 -07:00
Matthias Dieter Wallnöfer
c1527612b9 s4:python tools - try to fix some test problems 2009-09-20 23:49:05 +02:00
Matthias Dieter Wallnöfer
10fe59bed9 s4:domainlevel - fixed another error
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a
copy of the one under the directory root object. Therefore there doesn't exist
the "Windows 2000 Mixed" forest level.
2009-09-20 21:25:49 +02:00
Matthias Dieter Wallnöfer
b8e65e6974 s4:provision_configuration - fix "sPNMappings"
I reread some docs about this attributes and it seems that this as mapping
attribute isn't host specific but in common for the whole domain. To allow
Windows DCs to join our s4 domain sooner or later we have to provide the full
attribute.
2009-09-20 11:57:54 +02:00
Matthias Dieter Wallnöfer
bb65cd4f68 s4:domainlevel - further improvements
- The tool displays now also mixed/interim domain levels and warns about them
  (s4 isn't capable to run on them)
- But it allows now also to raise/step-up from them
- It displays now also levels higher than 2008 R2 (altough we don't support them
  yet) but to be able to get a correct output
2009-09-20 11:48:26 +02:00
Matthias Dieter Wallnöfer
2b5d1dfe6b s4:provision_basedn_modify - fix the "auditPolicy" attribute
I had to think about how to encode the string 0x0001 (taken from Windows Server).
The problem is due to the "0" byte at the beginning of it. BASE64 encoding
seems a good method to do it.
2009-09-20 00:14:51 +02:00
Matthias Dieter Wallnöfer
8dffa2300b s4:provision_configuration - "sPNMappings": "http" missed on regeneration 2009-09-18 21:06:19 +02:00
Matthias Dieter Wallnöfer
2e7fc37912 s4/provision_configuration - re-add the "sPNMappings"
Accidentally removed by a previous commit.
2009-09-18 21:00:49 +02:00
Matthias Dieter Wallnöfer
72ba2fa375 s4:scripts - Cleans also the rest under the "setup" directory up
- I removed also the "-H" parameter since those scripts are all thought for the
  use on a local s4 domain controller. Another reason is also the bind as SYSTEM
  account which itself is only possible on local binds.
2009-09-18 20:45:46 +02:00
Matthias Dieter Wallnöfer
1f38aa0995 s4:various scripts under "setup" - Unification
- This unified the shape of those four scripts (comments, command sequence, call
  of SamDB)
- To consider the samdb.py changes regarding the filter: there is now always the
  possibility either to specify the username or the search filter
2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
bc2a05f001 s4:domainlevel/pwsettings - Remove unused import 2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
ac3b58b851 s4:domainlevel - fix indentations 2009-09-18 17:54:25 +02:00
Matthias Dieter Wallnöfer
752904f12c s4:domainlevel - Add a script which allows raising the domain/forest level
This simple script allows raising the domain and/or forest level for s4.
I integrated also the basic checks (since we don't perform them in LDB yet):
e.g. the forest level can't be higher than the domain level(s).
2009-09-18 17:46:16 +02:00
Matthias Dieter Wallnöfer
b15ef6d854 s4:pwsettings - Simplify the error handling a bit 2009-09-18 17:33:24 +02:00
Matthias Dieter Wallnöfer
89f5df6fa7 s4:provision - Bump down the domain and forest level to Windows 2000
- The DC level we keep on Windows Server 2008 R2 (we should call ourself
  always the newest server type)
- The domain/forest level we set to the minimum (Windows 2000 native) to
  allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed"
  mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is
  set always to 0
- I'll add a script which allows to bump the DC level (basically sets the
  "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and
  on the "DC" object)
2009-09-18 16:21:29 +02:00
Matthias Dieter Wallnöfer
fa4023d6f7 s4:provision - Some rework (continuation)
- Fix up "servicePrincipalNames" attributes on the DC object
- Add some informative comments (most in "provision_self_join.ldif")
- Add also comments where objects are missing which we may add later when we
  support the feature (mainly for FRS)
- Add "domain updates" objects also under "CN=Configuration" (they exist twice)
- Add the default services under "Services" to allow interoperability with some
  MS client tools
- Smaller changes
2009-09-17 21:19:24 +02:00
Matthias Dieter Wallnöfer
4fa327a19f s4:provision - Some rework
- Add/change "wellKnownObjects" attributes
- Order entries in "provision_basedn_modify.ldif"
- Add/change "delete entries" object under BASEDN and CONFIGDN
- Fix default version number of "Default domain policy" group policy
- Add "domain updates" objects for interoperability with MS AD maintaining tools
- Show version number in the "oEMInformation" attribute (suggested by ekacnet)
- Smaller fixups
2009-09-17 18:27:31 +02:00
Matthieu Patou
96a36bf06d s4:sites & services - Adds Intersite transport containers
This patch brings up those subcontainers and fixes up the "systemFlags" on the
"Subnet" entry.
2009-09-12 14:54:45 +02:00
Matthias Dieter Wallnöfer
77100924d9 s4:group policies - the default group policy objects are all system-critical 2009-09-12 11:13:36 +02:00
Matthias Dieter Wallnöfer
10833f641a s4:group policies - add the domain controller group policy
This patches fixes the last difference between s4 and Windows Server regarding
group policy objects: we hadn't the domain controller policy.

- Adds the domain controller policy as it is found in the "original" AD
- Adds also the right version number in the GPT.INI file for the domain group
  policy (was missing)
2009-09-11 22:41:58 +02:00