1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

671 Commits

Author SHA1 Message Date
Andrew Tridgell
ad11deb9bd s4-schema: fixes for W2K8-R2 schema
The schema from WSPP had a number of typos that prevented it from
working. These changes allow it to work with Samba, and allow w2k8r2
to run DCPROMO against Samba successfully

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:54 +11:00
Andrew Tridgell
ebec49965b s4-schema: added msDS-NcType to schema container
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:53 +11:00
Andrew Tridgell
ce21151d22 s4-schema: fixed attributes of aggregate schema
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 18:24:53 +11:00
Andrew Tridgell
9d296e6776 s4-provision: added W2K8-R2 schema as provided by WSPP 2010-01-08 18:24:52 +11:00
Andrew Tridgell
42f0bdae69 s4-provision: RID 1000 is consumed by the machine account 2010-01-08 13:03:03 +11:00
Andrew Tridgell
b1f97b7e60 s4-dsdb: added an extended operation for allocating a new RID pool
This will be called by getncchanges when a client asks for a
DRSUAPI_EXOP_FSMO_RID_ALLOC operation

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:03:02 +11:00
Andrew Tridgell
53d10d139e s4-provision: don't hard wire the creation of the RID Set object
We now create it automatically in the samldb module when the first
user is created. 

The creation of the dns user also had to move to the _modify.ldif as
it now relies on the fSMO role being setup for the RID Manager

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:03:00 +11:00
Andrew Tridgell
5eb3b919c5 s4-provision: the DC object itself needs a fixed objectSID
We can't allocate a objectSID until we have rIDSetReferences, but that
is in the DC object, so we have to force the objectSID of the DC

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:02:58 +11:00
Andrew Tridgell
a1362492ab s4-provision: added an initial RID Set
We will allocate RIDs from this set

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:02:58 +11:00
Jelmer Vernooij
9e5ef916d4 net: Move 'newuser' to 'net newuser'
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:27 +11:00
Jelmer Vernooij
73594c248f net: Fix tests and documentation of setexpiry.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:25 +11:00
Jelmer Vernooij
345b25d059 net: Move setexpiry to 'net setexpiry'
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:24 +11:00
Jelmer Vernooij
b531696a5b net: Move 'setpassword' to 'net setpassword'.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:22 +11:00
Jelmer Vernooij
e60a40e287 s4/net: Add domainlevel subcommand. 2009-12-29 16:26:20 +01:00
Jelmer Vernooij
eaf4a9afb2 s4/net: Make pwsettings a net subcommand. 2009-12-29 16:26:19 +01:00
Endi Sukma Dewata
f871de7def s4:provision - Remap conflicting thumbnailPhoto and thumbnailLogo OID's. 2009-12-15 10:04:04 +11:00
Andrew Bartlett
a88f086d96 s4:setup Adjust upgradeprovision blackbox test now we don't have --targetdir 2009-12-01 12:17:56 +11:00
Matthias Dieter Wallnöfer
b973c50836 s4:upgrade_from_s3 - Move it back to "setup"
Suggested by Jelmer
2009-11-28 19:25:12 +01:00
Matthias Dieter Wallnöfer
f0686645a9 s4:setup/provision - Rework
- Revert change in "ask" - was previously correct
- Readd accidentally removed checks for non-null realm and domainname
- On interactive mode perform only one "ask" call per question
- Inform the user about the unset administrator password
2009-11-28 18:59:33 +01:00
Matthieu Patou
db41a0afc6 s4: fix SD update and password change in upgrade script
- reserve a new Samba OID for recalculate SD control
- fix the update SD function
- fix handling of kvno in the update_machine_account_password function
- fix handling of handles in RPC winreg server

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-11-28 09:56:06 +11:00
Matthias Dieter Wallnöfer
6b835b0691 s4:setup/provision - make the interactive mode work again 2009-11-27 13:02:31 +01:00
Matthias Dieter Wallnöfer
fd313282a2 s4:upgrade script - rename it to "upgrade_from_s3" and do some rework
- Give a better name to the script
- Move it to the location where also "upgradeprovision" resides
- Fix up trailing whitespaces and tabs
2009-11-27 12:26:11 +01:00
Andrew Bartlett
731f560ecb s4:upgradeprovision add 'exit $failed' to blackbox test 2009-11-27 16:05:05 +11:00
Andrew Bartlett
6f0f82f7ed s4:selftest Add tests for upgradeprovision 2009-11-27 16:05:05 +11:00
Andrew Bartlett
5ea6f79775 s4:provision Don't bother with a template for the LDAP backend startup script. 2009-11-24 11:04:31 +11:00
Andrew Bartlett
625856f2cf s4:provision Move secrets.ldb over to .c file module lists, like sam.ldb 2009-11-24 10:41:45 +11:00
Andrew Bartlett
90d739990a s4:provision Remove 'operational' from secrets.ldb module list 2009-11-24 10:39:09 +11:00
Andrew Bartlett
401ba9c9cf s4:dsdb Move module configuration from each ldb into samba_dsdb.c
This makes getting the module order correct, the obligation of Samba4
developers, and not system administrators.  In particular, once an ldb
is updated to use only the 'samba_dsdb' module, no further changes to the
ldb should be required when upgrading to later Samba4 versions.

(thanks to metze for the suggestion of samba_dsdb as a long-term
stable name for the module)

Andrew Bartlett
2009-11-23 14:15:07 +01:00
Andrew Bartlett
e297af00fa s4:provision Simplify the module list
This makes the member server much more like the DC, the objectGUID
module replaces the repl_meta_data module.

We also generally rework the construction of the list, building a full
list in python, and then transforming it into a string, rather than
playing string concatonation games

Andrew Bartlett
2009-11-23 14:15:06 +01:00
Matthias Dieter Wallnöfer
5c6c2619fb s4:provision_users.ldif - Descriptions generally begin with a majuscle 2009-11-17 19:46:59 +01:00
Andrew Bartlett
5c3ef6dbae s4:provision Split up reference creation, load schema earlier in the stack
The schema needs to be loaded above the extended_dn_out modules as
otherwise we don't get an extended DN in the search results.

The reference split is to ensure we create references after the
objects they reference exist.

Andrew Bartlett
2009-11-17 10:38:04 +11:00
Andrew Bartlett
41ce3dc0c3 s4:dsdb Add 'dsdb_flags' to dsdb_module_search() to enable often-used features
These flags, also on dsdb_module_search_dn() allow us to add commonly
set controls to this pre-packaged blocking search, without rebuilding
the whole function in each caller.

Andrew Bartlett
2009-11-17 10:38:01 +11:00
Endi S. Dewata
8e5f5e3f05 s4:provision - Removed dependency on full Samba 3 schema from FDS 2009-11-16 07:57:40 +11:00
Nadezhda Ivanova
b8ecf39d9f Added security descriptor for the domain NC to provisioning.
Necessary for correct descriptor inheritance. Based on the default state
of a single DC. Will be modified later when we support multiple DCs.
2009-11-04 15:58:54 +02:00
Andrew Bartlett
350e963545 s4:provision Rework provision to always have a ProvisionBackend
Rather than treat the LDAP backend as a special case, treat all
backends the same, with different callbacks.

Andrew Bartlett
2009-11-02 16:36:54 +11:00
Endi S. Dewata
e035433bab s4 - SID allocation using FDS DNA plugin 2009-11-02 16:36:54 +11:00
Endi S. Dewata
bf01937549 s4:dsdb - Store SID as string in FDS. 2009-11-02 16:36:54 +11:00
Endi S. Dewata
8097280b46 s4 - Mapped AD schema to existing FDS schema. 2009-11-02 16:36:53 +11:00
Andrew Bartlett
a84abe7053 s4:setup Mark 'cn' in secrets as case insensitive
While this does not matter very much, others may later expect 'cn' to be case
insensitive.

Andrew Bartlett
2009-10-23 15:42:04 +11:00
Matthias Dieter Wallnöfer
33f3d54de4 s4:provision - rework the "guess_names" and "make_smbconf" method
- Cleans it up from unnecessary "lower()/upper()" and parameters which can be
  derived through "lp" calls.
- Substitute the "HOSTNAME" caption in the "smb.conf" templates with
  "NETBIOS_NAME" which fits better.
- Now the "realm" and "domain" parameter of the provision are totally case
  insensitive and the script itself up/downcases them appropriately depending
  on the use (e.g. "realm" upcase for KERBEROS, lowcase for DNS domainname).
2009-10-21 23:43:04 +02:00
Andrew Bartlett
18035251ad s4:provision Test ability to set GUIDs from provision command line 2009-10-21 22:43:52 +11:00
Andrew Bartlett
d3b50ec33f s4:provison Allow the NTDS guid on the command line (for testing)
This allows a blackbox test to confirm this can be set.

Andrew Bartlett
2009-10-21 22:43:52 +11:00
Andrew Bartlett
d4048b2e17 s4:provision Set @OPTIONS in the provision_init.ldif
The new partitions code knows to copy these items in when creating a
new parition, so we can set it from the start.

Andrew Bartlett
2009-10-21 22:43:50 +11:00
Andrew Bartlett
c59f00805c s4:dsdb Rework modules create new partitions at runtime
This is done by passing an extended operation to the partitions module
to extend the @PARTITION record and to extend the in-memory list of
partitions.

This also splits things up into module parts that belong above and below
repl_meta_data

Also slit the partitions module into two files due to the complexity
of the code

Andrew Barltett
2009-10-21 22:43:50 +11:00
Andrew Tridgell
96a41581e6 s4-idmap: the idmap database should be indexed 2009-10-19 20:31:40 +11:00
Andrew Tridgell
8c7a81408a s4-schema: We should not need Samba4TopExtra now
The last attribute this contained was 'privilege' which is now gone
2009-10-17 13:01:03 +11:00
Andrew Tridgell
f794e8d43d s4-provision: added the default privileges db
privileges are now stored in a separate database
2009-10-17 13:01:02 +11:00
Andrew Tridgell
cc3e1d9022 s4-provision: removed the old privilege attributes
Our schema is getting a bit cleaner :-)
2009-10-17 13:01:02 +11:00
Endi S. Dewata
cf77bf3382 s4:provision - replaced linked_attributes with FDS plugins
When FDS is used as a backend, Samba should not use the
linked_attributes LDB module, but instead use the built-in
DS plugins for attribute linking, indexing, and referential
integrity.
2009-10-16 14:08:11 +02:00
Andrew Bartlett
1dfa2ed423 s4:provision Remove all references to samba4LocalDomain
This was a bad idea all along, as Simo said at the time.  With the
full MS schema and enforcement of it, it is an even worse idea.

This fixes the provision of the member server in 'make test'

Andrew Bartlett
2009-10-12 16:50:49 +11:00
Andrew Tridgell
33347d783a s4-provision: match win2003 functional level
We are now defaulting to win2003 functional level, and see to report
the right revisions of our db and schema
2009-10-06 19:05:15 +11:00
Matthias Dieter Wallnöfer
d87cfc7cc4 s4:provision_users.ldif - Put potential primary groups in front of the file
(So they can be always found by the SAMLDB module)
2009-10-02 15:26:02 +02:00
Andrew Bartlett
984ea88156 s4:dsdb rework instanceType module - put instanceType in provision
The instanceType needs to be specified in future because that's how
the partitions are actually created.
2009-10-02 12:45:07 +02:00
Matthieu Patou
8bf517d340 s4: Improve provisioning: use relax control
Give the possibility to specify controls when loading ldif files.
  Relax control is specified by default for all ldb_add_diff (request Andrew B).
  Set domainguid if specified at the creation of object instead of modifying afterward
  Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
2009-10-02 12:45:01 +02:00
Matthias Dieter Wallnöfer
bf0855e8e3 s4:provision - Change the default forest/domain function level back to Windows 2003 Native 2009-10-02 14:22:06 +10:00
Matthias Dieter Wallnöfer
0dadb566a9 s4:pwsettings - Improve error handling and introduce "choice" type
- Improve the error handling according to Jelmer's suggestions
- Print out the error messages on "stderr"
- Add also here the "choice" type for arguments
2009-09-30 16:00:29 +02:00
Matthias Dieter Wallnöfer
cb50af5fe1 s4:provision - Lets the user choose between the supported forest/domain function levels
Adds a parameter "--function-level" which allows to specify the domain and
forest function level.
2009-09-30 16:00:07 +02:00
Andrew Kroeger
b2e8519e32 s4:provision: Show domains and forests are W2K8 DC capable.
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep"
utility is used to perform schema updates and update other attributes as
necessary.

Adding these entries provides an indication that the adprep utility has been run
with the /forestprep, /domainprep and /rodcprep arguments.  Although these
entries indicate adprep has been run, nothing has been done to verify that the
changes that the adprep utility would have made have actually been done.

The values used for the revision atttributes are as seen on a W2K8 DC (not
W2K8 R2, which will probably have higher values).
2009-09-30 15:59:38 +02:00
Andrew Kroeger
955dab0ed7 s4:provision: Update schema version number to W2K8.
We are running the W2K8 schema version, not the W2K3 version.
2009-09-30 15:59:16 +02:00
Matthias Dieter Wallnöfer
d6f69ebcc2 s4:domainlevel - General rework
- We support domain/forest function levels >= (Windows) 2003 Native -> adapt the
  domain/forest and DC function level restrictions.
- Consider also the lowest function level of a DC. The domain and forest function
  levels can never be higher than it.
- Improve the error handling by printing out messages to "stderr"
- Introduce the "choice" type for choice arguments (saves us some error handling)
2009-09-30 15:58:16 +02:00
Matthias Dieter Wallnöfer
956740aa6f s4:LDIFs - enhance the section comments 2009-09-25 10:59:13 +02:00
Nadezhda Ivanova
13b979b03d Merge branch 'master' of git://git.samba.org/samba 2009-09-21 14:26:15 -07:00
Matthias Dieter Wallnöfer
7373bb79d4 s4:samdb/tools - That should fix now the last failures 2009-09-21 13:53:47 +02:00
Matthias Dieter Wallnöfer
f0c080a484 s4:scripts - Reintroduce "-H" parameter
I removed it since on some scripts it was present, on others not - so I thought
it wouldn't be really needed. This was a bad decision (pointed out by abartlet).
So I reintroduce it on all scripts (to have consistent parameters).
2009-09-21 11:53:19 +02:00
Nadezhda Ivanova
025590e7a4 Merge branch 'master' of git://git.samba.org/samba 2009-09-20 17:43:46 -07:00
Andrew Bartlett
509a2bb97c s4:provision split provision of DNS zone and self join keytab 2009-09-20 16:29:37 -07:00
Nadezhda Ivanova
6283f2caaa Initial implementation of security descriptor creation in DS
TODO's:
ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20 15:16:17 -07:00
Matthias Dieter Wallnöfer
c1527612b9 s4:python tools - try to fix some test problems 2009-09-20 23:49:05 +02:00
Matthias Dieter Wallnöfer
10fe59bed9 s4:domainlevel - fixed another error
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a
copy of the one under the directory root object. Therefore there doesn't exist
the "Windows 2000 Mixed" forest level.
2009-09-20 21:25:49 +02:00
Matthias Dieter Wallnöfer
b8e65e6974 s4:provision_configuration - fix "sPNMappings"
I reread some docs about this attributes and it seems that this as mapping
attribute isn't host specific but in common for the whole domain. To allow
Windows DCs to join our s4 domain sooner or later we have to provide the full
attribute.
2009-09-20 11:57:54 +02:00
Matthias Dieter Wallnöfer
bb65cd4f68 s4:domainlevel - further improvements
- The tool displays now also mixed/interim domain levels and warns about them
  (s4 isn't capable to run on them)
- But it allows now also to raise/step-up from them
- It displays now also levels higher than 2008 R2 (altough we don't support them
  yet) but to be able to get a correct output
2009-09-20 11:48:26 +02:00
Matthias Dieter Wallnöfer
2b5d1dfe6b s4:provision_basedn_modify - fix the "auditPolicy" attribute
I had to think about how to encode the string 0x0001 (taken from Windows Server).
The problem is due to the "0" byte at the beginning of it. BASE64 encoding
seems a good method to do it.
2009-09-20 00:14:51 +02:00
Matthias Dieter Wallnöfer
8dffa2300b s4:provision_configuration - "sPNMappings": "http" missed on regeneration 2009-09-18 21:06:19 +02:00
Matthias Dieter Wallnöfer
2e7fc37912 s4/provision_configuration - re-add the "sPNMappings"
Accidentally removed by a previous commit.
2009-09-18 21:00:49 +02:00
Matthias Dieter Wallnöfer
72ba2fa375 s4:scripts - Cleans also the rest under the "setup" directory up
- I removed also the "-H" parameter since those scripts are all thought for the
  use on a local s4 domain controller. Another reason is also the bind as SYSTEM
  account which itself is only possible on local binds.
2009-09-18 20:45:46 +02:00
Matthias Dieter Wallnöfer
1f38aa0995 s4:various scripts under "setup" - Unification
- This unified the shape of those four scripts (comments, command sequence, call
  of SamDB)
- To consider the samdb.py changes regarding the filter: there is now always the
  possibility either to specify the username or the search filter
2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
bc2a05f001 s4:domainlevel/pwsettings - Remove unused import 2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
ac3b58b851 s4:domainlevel - fix indentations 2009-09-18 17:54:25 +02:00
Matthias Dieter Wallnöfer
752904f12c s4:domainlevel - Add a script which allows raising the domain/forest level
This simple script allows raising the domain and/or forest level for s4.
I integrated also the basic checks (since we don't perform them in LDB yet):
e.g. the forest level can't be higher than the domain level(s).
2009-09-18 17:46:16 +02:00
Matthias Dieter Wallnöfer
b15ef6d854 s4:pwsettings - Simplify the error handling a bit 2009-09-18 17:33:24 +02:00
Matthias Dieter Wallnöfer
89f5df6fa7 s4:provision - Bump down the domain and forest level to Windows 2000
- The DC level we keep on Windows Server 2008 R2 (we should call ourself
  always the newest server type)
- The domain/forest level we set to the minimum (Windows 2000 native) to
  allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed"
  mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is
  set always to 0
- I'll add a script which allows to bump the DC level (basically sets the
  "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and
  on the "DC" object)
2009-09-18 16:21:29 +02:00
Matthias Dieter Wallnöfer
fa4023d6f7 s4:provision - Some rework (continuation)
- Fix up "servicePrincipalNames" attributes on the DC object
- Add some informative comments (most in "provision_self_join.ldif")
- Add also comments where objects are missing which we may add later when we
  support the feature (mainly for FRS)
- Add "domain updates" objects also under "CN=Configuration" (they exist twice)
- Add the default services under "Services" to allow interoperability with some
  MS client tools
- Smaller changes
2009-09-17 21:19:24 +02:00
Matthias Dieter Wallnöfer
4fa327a19f s4:provision - Some rework
- Add/change "wellKnownObjects" attributes
- Order entries in "provision_basedn_modify.ldif"
- Add/change "delete entries" object under BASEDN and CONFIGDN
- Fix default version number of "Default domain policy" group policy
- Add "domain updates" objects for interoperability with MS AD maintaining tools
- Show version number in the "oEMInformation" attribute (suggested by ekacnet)
- Smaller fixups
2009-09-17 18:27:31 +02:00
Matthieu Patou
96a36bf06d s4:sites & services - Adds Intersite transport containers
This patch brings up those subcontainers and fixes up the "systemFlags" on the
"Subnet" entry.
2009-09-12 14:54:45 +02:00
Matthias Dieter Wallnöfer
77100924d9 s4:group policies - the default group policy objects are all system-critical 2009-09-12 11:13:36 +02:00
Matthias Dieter Wallnöfer
10833f641a s4:group policies - add the domain controller group policy
This patches fixes the last difference between s4 and Windows Server regarding
group policy objects: we hadn't the domain controller policy.

- Adds the domain controller policy as it is found in the "original" AD
- Adds also the right version number in the GPT.INI file for the domain group
  policy (was missing)
2009-09-11 22:41:58 +02:00
Andrew Tridgell
e4683bfb3b s4-provision: revert _gc_tcp priority
thanks to id10ts for spotting this. I was a victim of emacs zone mode,
which increaed it with each edit.
2009-09-11 23:13:39 +10:00
Andrew Tridgell
f009fa15a1 s4-provision: use DNS name, not domain name
The SPNs end in the DNS domain name
2009-09-11 17:14:01 +10:00
Andrew Tridgell
d26c42f5bf s4/provision: add the nTDSDSA GUID based DNS entries and SPNs
The DNS entries and SPNs are needed for samba<->samba DRS
replication. This patch adds them for a standalone DC configure. A
separate patch will add them for the vampire configure
2009-09-11 14:07:22 +10:00
Andrew Bartlett
bda7061334 s4:setup Updated Display Specifiers from Microsoft (with #s)
This fixes the issue with the original files that they didn't have a
leading # in front of the comments, which caused our parsing scripts
much pain.  The files are now exactly as delivered.

Andrew Bartlett
2009-09-11 07:29:57 +10:00
Andrew Kroeger
e3a2a22451 s4:pwsettings: Added blackbox tests.
The added tests include basic validation that the script runs and accepts all
custom arguments.  The tests also verify changes to the password complexity,
minimum password length, and minimum password length settings.
2009-09-10 01:09:56 +02:00
Andrew Kroeger
ebdb9da78e s4:pwsettings: Show default values in help messages. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
3cbcaa139c s4:pwsettings: Add 'default' option for password complexity. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
4b68cfe15d s4:pwsettings: Added validation.
Validate that each field is within its allowed range.  Also validate that the
maximum password age is greater than the minimum password length (if the maximum
password age is set).

I could not find these values documented anywhere in the WSPP docs.  I used the
values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs
the validation of values.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
0206b1d6f9 s4:pwsettings: Don't assume a value for pwdProperties.
If we cannot retrieve the value, do not assume a particular value.  The fact
that we could not retrieve the value indicates a larger problem that we don't
want to make worse bypossibly clearing bit fields in the pwdProperties
attribute.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
5f6ebc3483 s4:pwsettings: Run all updates as a single modify() operation.
This ensures that all changes are made, or none are made.  It also makes it
possible to do validation as we go and abort in case of an error, while always
leaving things in a consistent state.
2009-09-10 01:09:53 +02:00
Andrew Kroeger
e71383eed7 s4:pwsettings: Added --quiet option.
Also changed all non-error status output to use the message() function, which
respects the --quiet option.
2009-09-10 01:09:52 +02:00
Endi Sukma Dewata
b1dabb1133 s4: Use SASL authentication against Fedora DS.
1. During instance creation the provisioning script will import the SASL
   mapping for samba-admin. It's done here due to missing config schema
   preventing adding the mapping via ldapi.

2. After that it will use ldif2db to import the cn=samba-admin user as
   the target of SASL mapping.

3. Then it will start FDS and continue to do provisioning using the
   Directory Manager with simple bind.

4. The SASL credentials will be stored in secrets.ldb, so when Samba
   server runs later it will use the SASL credentials.

5. After the provisioning is done (just before stopping the slapd)
   it will use the DM over direct ldapi to delete the default SASL
   mappings included automatically by FDS, leaving just the new
   samba-admin mapping.

6. Also before stopping slapd it will use the DM over direct ldapi to
   set the ACL on the root entries of the user, configuration, and
   schema partitions. The ACL will give samba-admin the full access
   to these partitions.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-10 09:52:22 +10:00
Andrew Kroeger
41ce496691 s4:pwsettings: Correct off by factor of 10 for ticks.
The tick conversion math was off by a factor of 10 due to the incorrect usage of
the "e" notation.  The expression "XeY" means "X * (10^Y)", so the correct
expression is 1e7 to get the correct adjustment for ticks.
2009-09-07 12:29:35 +02:00
Matthias Dieter Wallnöfer
90d6829f8a s4:Foreign security principals - Fix them up
I fixed them up to match with Windows Server 2003. I don't think that the
creation of them in the provision script is needed so I put them in the
"provision_users.ldif" file.
2009-09-07 08:37:25 +02:00
Matthias Dieter Wallnöfer
5f2832a5dc s4:samldb - Major rework
This fixes up the change of the primary group of a user when using the ADUC
console:
- When the "primaryGroupId" attribute changes, we have to delete the
  "member"/"memberOf" attribute reference of the new primary group and add one
  for the old primary group.
- Deny deletion of primary groups according to Windows Server (so we cannot
  have invalid "primaryGroupID" attributes in our AD).
- We cannot add a primary group directly before it isn't a secondary one of a
  user account.
- We cannot add a secondary reference ("member" attribute) when the group has
  been chosen as primary one.

This also removes the LDB templates which are basically overhead now.

This should also fix bug #6599.
2009-09-07 08:37:24 +02:00
Matthias Dieter Wallnöfer
931aa4e8bd s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes
The "provision_users.ldif" file needs some rework to pass against the changed
and improved "samldb" module (see next commit).
2009-09-07 08:37:23 +02:00
Andrew Kroeger
9cf2d053cd s4:setup: Remove display_specifiers.ldif.
This file is no longer needed as the DisplaySpecifiers are now generated from
files provided by Microsoft.
2009-09-07 11:18:18 +10:00
Andrew Kroeger
76f23f0b46 s4:setup: Updated comment to reflect new DisplaySpecifiers location. 2009-09-07 11:18:18 +10:00
Andrew Kroeger
65130fa021 s4:setup: Change license headers to LDIF comments.
The original license headers provided by Microsoft cannot be parsed as valid
LDIF.

Changed the license headers to be valid LDIF comments, and added a new header
section detailing the exact changes that were made to the original document.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07 11:18:17 +10:00
Andrew Bartlett
cf1da4309c s4:setup Add DisplaySpecifiers from Microsoft.
Like the schema, these are provided under the licence at the head of
the file, which is not the GPL, but allows us to distribute them with
Samba.

Andrew Bartlett
2009-09-07 11:18:03 +10:00
Matthias Dieter Wallnöfer
89d40419d5 s4:pwsettings - Introduce the LDB modify flags in the right way
We can't emulate them through the LDB changetype flags since they haven't the
same constants! The previous behaviour led to huge problems.
2009-09-06 12:29:31 +02:00
Andrew Bartlett
1a97bd915d s4:provision Ensure that @OPTIONS is mirrored into each partition
The previous patches to the provision system cut down on the number of
reconnects, and disabled the partition handling for part of the
process.  This means we lost the setting of @OPTIONS as a replicated
attribute into the partitions.

Andrew Bartlett
2009-08-26 17:37:01 +10:00
Andrew Bartlett
a1da91174b s4:provison Add prefixes to ldb using same code a later modify will use
This allows us to test out the code that will do the modify of the
prefixMap, and to provide the bindings that may assist a future
upgrade script.

Andrew Bartlett
2009-08-26 13:49:10 +10:00
Andrew Bartlett
b9ec6bb1eb s4:provision Only create references to our server DN after the self join
This will ensure that the GUID can be filled in correctly, and assist
us to validate DN targets in the future.

Andrew Bartlett
2009-08-26 13:48:35 +10:00
Andrew Tridgell
e38f38fe48 we need the Deleted Objects container for replication
When objects are deleted they get renamed to this container. The
container needs to exist when we provision
2009-08-19 15:51:07 +10:00
Matthias Dieter Wallnöfer
0a5ea25d21 s4:python tools - Centralise the lookups for the default domain (root) in the call "domain_dn" from SamDB 2009-08-17 11:58:39 +02:00
Andrew Bartlett
e7bae2eb0a s4: Re-add --ldapadminpass as an option to provision
This should make setting up LDAP servers more predictable.

When not specified, it is random

Andrew Bartlett
2009-08-17 09:51:00 +10:00
Endi Sukma Dewata
a6c9233a12 s4:provision Fixes for Fedora DS schema mapping with full AD schema 2009-08-17 09:50:59 +10:00
Andrew Bartlett
f87811f6b3 s4:provision Rework provision-backend into provision
This removes a *lot* of duplicated code and the cause of much
administrator frustration.  We now handle starting and stopping the
slapd (at least for the provision), and ensure that there is only one
'right' way to configure the OpenLDAP and Fedora DS backend

We now run OpenLDAP in 'cn=config' mode for online configuration.

To test what was the provision-backend code, a new --ldap-dryrun-mode
option has been added to provision.  It quits the provision just
before it would start the LDAP binaries

Andrew Bartlett
2009-08-17 09:50:58 +10:00
Andrew Bartlett
a58b4f8cc2 s4:setup Don't manually set @ATTRIBUTES any more
We now set these as part of the schema load, and we now load the
schema before the provision loads the DB, so setting them here is
pointless

Andrew Bartlett
2009-08-17 09:50:57 +10:00
Andrew Bartlett
e1e99a7c7b s4:provision Remove the ACI element from the provision templates
We need to find a better way to apply this (used in the Fedora DS LDAP
backend), not by trying to tunnel this down the module stack.

Andrew Bartlett
2009-08-17 09:50:56 +10:00
Matthias Dieter Wallnöfer
639c9ccb93 s4: Correct the parameter logic of the "setpassword" script
Either the username or the filter are allowed. If both are given the filter is
going to be used due to a higher precedence.
2009-08-14 00:14:15 +02:00
Matthias Dieter Wallnöfer
fe767d4b70 s4:pwsettings script - Fix a small glitch
This fixes the problem with the setting and getting of the "minPwdAge" and
"maxPwdAge" attributes. I wanted to handle them in days but forgot to add
conversions (from "ticks" (tenth of microsecond) -> "days" and backwards).
2009-08-11 12:59:15 +02:00
Matthias Dieter Wallnöfer
c73984a5c9 s4:AD LDIFs - More refactoring
This commit includes:
- Additional static object data in SAMBA 4's AD to start supporting of
  - forest updates, - lost and found, - quotas on DS, - physical locations,
  - licensing of sites, - subnets, - policies for WMI, - DNS entries in AD
- Reordering of provision*.ldif files to be able to find entries and make future
  additions easier
- Add comments in provision*.ldif files to point out where subentries are located
  when they are based in other LDIFs
- Removations of autogenerated "cn" attributes
2009-08-11 12:59:13 +02:00
Andrew Bartlett
7bc566a882 s4:provision Allow provision-backend to not run slapd for 'make test'
As the version of OpenLDAP required for Samba4 is fairly new, we don't
want to make it a requirement before this python code is run in 'make
test'.

As such, skip over the actual starting of slapd, but check the rest
runs alright (which still validates syntax and other modules).

Andrew Bartlett
2009-08-12 11:09:50 +10:00
Andrew Bartlett
6dc41bf27c s4:provision Make the --ol-slapd paramter take the full path to slapd 2009-08-12 10:01:48 +10:00
Andrew Bartlett
f0decfe5c2 s4:provision Assume the OpenLDAP backend can find it's own modules 2009-08-12 10:01:48 +10:00
Oliver Liebel
28bcdf5266 s4:provision Rework and further automate setup of OpenLDAP backend
heres the summary of all changes/extensions:

- Andrew Bartlett's patch to generate indext
- Howard Chu's idea to use nosync on the DB included, but made optional

- slaptest-path is not needed any more (slapd -Ttest is used instead)
and is therefore removed. slapd-path is now recommended when
openldap-backend is chosen.
its also used for olc-conversion

- slapd-detection is now always done by ldapsearch (ldb module),
looking anonymous for objectClass: OpenLDAProotDSE via our ldapi_uri.

- if ldapsearch was not successfull, (no slapd listening on our socket)
slapd is
started via special generated slapdcommand_prov  (ldapi_uri only)

- slapd-"provision-process" startup is done via pythons subprocess.

- the slapd-provision-pid is stored under paths.ldapdir/slapd_provision_pid.

- after provision-backend is finished:
--- slapd.pid is compared with our stored slapd_provision_pid.
if the are unique, slapd.pid will be read out, and the
slapd "provison"-process will be shut down.
--- proper slapd-shutdown is verified again with ldb-search -> ldapi_uri
-> rootDSE.
--- if the pids are different or one of the pid-files is missing, slapd
will not be shut down,
instead an error message is displayed to locate slapd manually
--- extended help-messages (relevant to slapd) are always displayed,
e.g. the commandline with which slapd has to be started when everythings
finished
(slapd-commandline is stored under paths.ldapdir/slapd_command_file.txt))

- upgraded the content of the mini-howto (howto-ol-backend-s4.txt)
2009-08-12 10:01:48 +10:00
Matthias Dieter Wallnöfer
aa6dc21fa3 s4: Add a new script for setting password properties for a domain in a easier way 2009-08-07 17:21:58 +02:00
Oliver Liebel
11ff224e13 s4:setup Remove extra newlines that break OpenLDAP backend 2009-08-07 12:38:51 +10:00
Matthias Dieter Wallnöfer
1ce36ed747 s4:enableaccount script: Remove a redundant line 2009-08-06 12:34:56 +02:00
Andrew Bartlett
56f4516399 s4:kdc Push context to hdb_samba4 by way of the 'name' of the DB
This overloads the 'name' part of the keytab name to supply a context
pointer, and so avoids 3 global variables!

To do this, we had to stop putting the entry for kpasswd into the
secrets.ldb.  (I don't consider this a big loss, and any entry left
there by an upgrade will be harmless).

Andrew Bartlett
2009-07-27 22:41:42 +10:00
Andrew Bartlett
b50ab318c1 s4:setup add 'cn' attribute to Samba4 local schema
(We recently made the ms_schema.py script also add this attribute)
2009-07-27 22:41:42 +10:00
Matthias Dieter Wallnöfer
2fc5331e5c [SAMBA 4 directory] Refactoring and clean up of directory structure
- Adds more system objects which make sense to have them in SAMBA 4 also to
  have them when we add more and more services related to the directory (volume
  support, DFS, replication service, COM...)
- Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes
  are set correctly on each object
2009-07-20 14:21:09 +10:00
Jelmer Vernooij
7a765b65b7 provision: Remove unused imports. 2009-07-19 13:19:54 +02:00
Andrew Bartlett
271b5af92e s4:dsdb Handle dc/domain/forest functional levels properly
Rather than have the functional levels scattered in 4 different,
unconnected locations, the provision script now sets it, and the
rootdse module maintains it's copy only as a cached view onto the
original values.

We also use the functional level to determine if we should store AES
Kerberos keys.

Andrew Bartlett
2009-07-16 09:23:35 +10:00
Matthias Dieter Wallnöfer
5049f61f39 [SAMBA 4 directory] Changes "forceLogoff" and corrects the "subRefs"
- This changes the attribute "forceLogoff" to its' default
  values according to Windows Server 2003 R2
- Also this corrects the "subRefs" attribute of the base-DN which only refers
  to direct child partitions (and therefore not to the complete transitive closure)
2009-07-02 11:21:02 +10:00
Matthias Dieter Wallnöfer
b31f1e6d5b [SAMBA 4 directory] Corrects the "systemFlags" attributes
Set the values like Windows Server 2003 R2.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
d4a969530d [SAMBA 4 directory] Adds the complete "objectclass path" to our self-created DC object
Found after some comparisons against Windows Server 2003 R2.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
3e3c08c7a6 [SAMBA 4 directory] Adds the object version and "systemFlags" attribute to the display specifiers
The object version showed up in the Windows 2003 Server R2 AD.
The "systemFlags" attribute has been set to the right value.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
2d9b51c2a8 Correct the headers of some SAMBA 4 setup python scripts 2009-06-29 13:39:55 +10:00
Andrew Bartlett
1e6fb7d730 s4: Add tests and 'must change password' flags in setpassword and newuser
In particular, ensure that we can acutally change the password under
these circumstances.

Andrew Bartlett
2009-06-18 13:49:30 +10:00
Andrew Bartlett
2afc6df9b4 s4:setup Add an option to 'setpassword' to force password change at next login 2009-06-18 13:49:30 +10:00
Jelmer Vernooij
c418af2456 ad-schema/license.txt: Fix typo. 2009-06-12 14:14:27 +02:00
Andrew Bartlett
4c1a7d7556 Add supportedCapabilities to our rootDSE
This makes AD client tools happier, as they know they are talking to
an AD server.

per Bug 6229 by Matthieu Patou <mat@matws.net>

Andrew Bartlett
2009-06-12 07:51:43 +10:00
Andrew Bartlett
d409a12ccd s4:setup Remove generated attributes from provision_configuration
Incorrectly added in 95eeef91d3, and
found by OpenLDAP backend tests run by Theodor Chirana <office@adaptcom.ro>

Andrew Bartlett
2009-05-29 12:15:28 +10:00
Andrew Kroeger
c80c3b5edd s4:provision: Added ComPartitionSets entry.
Without this entry, opening the COM+ tab under the properties of an OU within
ADUC results in the following error:

"Unable to retrieve all user properties, 0x80072030"
2009-05-26 14:17:22 +10:00
Andrew Kroeger
95eeef91d3 s4:Added Extended-Rights and subentries.
Without these entries, using the 'Delegate Control' option in ADUC results in
the following error message in the Delegation of Control Wizard:

"The templates could not be applied.  One or more of the templates is not
applicable.  Click Back and select different templates, and then try again."
2009-05-26 14:17:12 +10:00
Andrew Kroeger
d402866e31 s4:provision: Update DisplaySpecifiers (#5139).
The classDisplayName attribute controls the actual text displayed to the user
for the top-level menus, so added it to the existing entries.

The attributeDisplayNames attribute contains both the text displayed to the
user and a mapping to the internal directory attribute name for the particular
field, so added these to the existing entries as well.

Added new entries as appropriate to properly complete all menus and labels
within ADUC.
2009-05-26 14:16:05 +10:00
Matthias Dieter Wallnöfer
92d321006d Enable software rollout through AD
This enables the sofware rollout feature in Samba4

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-04-15 12:27:02 +10:00
Andrew Tridgell
26f5225ae2 we should not be supplying a generated attribute in our schema 2009-04-09 13:46:35 +10:00
Andrew Bartlett
354ba5e2e3 s4:schema Update Windows 2008 schema from Microsoft to latest version 2009-04-03 08:18:14 +11:00
Andrew Bartlett
c7ed9bc477 Remove minschema generated schema - we now generate from setup/ad-schema/ 2009-04-03 08:15:25 +11:00
Andrew Bartlett
1a17fcdf66 Add parentGUID as an allowed attribute in samba4Top
This is required to get provision against OpenLDAP working again
2009-04-03 08:14:42 +11:00