1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

671 Commits

Author SHA1 Message Date
Andrew Tridgell
33347d783a s4-provision: match win2003 functional level
We are now defaulting to win2003 functional level, and see to report
the right revisions of our db and schema
2009-10-06 19:05:15 +11:00
Matthias Dieter Wallnöfer
d87cfc7cc4 s4:provision_users.ldif - Put potential primary groups in front of the file
(So they can be always found by the SAMLDB module)
2009-10-02 15:26:02 +02:00
Andrew Bartlett
984ea88156 s4:dsdb rework instanceType module - put instanceType in provision
The instanceType needs to be specified in future because that's how
the partitions are actually created.
2009-10-02 12:45:07 +02:00
Matthieu Patou
8bf517d340 s4: Improve provisioning: use relax control
Give the possibility to specify controls when loading ldif files.
  Relax control is specified by default for all ldb_add_diff (request Andrew B).
  Set domainguid if specified at the creation of object instead of modifying afterward
  Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
2009-10-02 12:45:01 +02:00
Matthias Dieter Wallnöfer
bf0855e8e3 s4:provision - Change the default forest/domain function level back to Windows 2003 Native 2009-10-02 14:22:06 +10:00
Matthias Dieter Wallnöfer
0dadb566a9 s4:pwsettings - Improve error handling and introduce "choice" type
- Improve the error handling according to Jelmer's suggestions
- Print out the error messages on "stderr"
- Add also here the "choice" type for arguments
2009-09-30 16:00:29 +02:00
Matthias Dieter Wallnöfer
cb50af5fe1 s4:provision - Lets the user choose between the supported forest/domain function levels
Adds a parameter "--function-level" which allows to specify the domain and
forest function level.
2009-09-30 16:00:07 +02:00
Andrew Kroeger
b2e8519e32 s4:provision: Show domains and forests are W2K8 DC capable.
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep"
utility is used to perform schema updates and update other attributes as
necessary.

Adding these entries provides an indication that the adprep utility has been run
with the /forestprep, /domainprep and /rodcprep arguments.  Although these
entries indicate adprep has been run, nothing has been done to verify that the
changes that the adprep utility would have made have actually been done.

The values used for the revision atttributes are as seen on a W2K8 DC (not
W2K8 R2, which will probably have higher values).
2009-09-30 15:59:38 +02:00
Andrew Kroeger
955dab0ed7 s4:provision: Update schema version number to W2K8.
We are running the W2K8 schema version, not the W2K3 version.
2009-09-30 15:59:16 +02:00
Matthias Dieter Wallnöfer
d6f69ebcc2 s4:domainlevel - General rework
- We support domain/forest function levels >= (Windows) 2003 Native -> adapt the
  domain/forest and DC function level restrictions.
- Consider also the lowest function level of a DC. The domain and forest function
  levels can never be higher than it.
- Improve the error handling by printing out messages to "stderr"
- Introduce the "choice" type for choice arguments (saves us some error handling)
2009-09-30 15:58:16 +02:00
Matthias Dieter Wallnöfer
956740aa6f s4:LDIFs - enhance the section comments 2009-09-25 10:59:13 +02:00
Nadezhda Ivanova
13b979b03d Merge branch 'master' of git://git.samba.org/samba 2009-09-21 14:26:15 -07:00
Matthias Dieter Wallnöfer
7373bb79d4 s4:samdb/tools - That should fix now the last failures 2009-09-21 13:53:47 +02:00
Matthias Dieter Wallnöfer
f0c080a484 s4:scripts - Reintroduce "-H" parameter
I removed it since on some scripts it was present, on others not - so I thought
it wouldn't be really needed. This was a bad decision (pointed out by abartlet).
So I reintroduce it on all scripts (to have consistent parameters).
2009-09-21 11:53:19 +02:00
Nadezhda Ivanova
025590e7a4 Merge branch 'master' of git://git.samba.org/samba 2009-09-20 17:43:46 -07:00
Andrew Bartlett
509a2bb97c s4:provision split provision of DNS zone and self join keytab 2009-09-20 16:29:37 -07:00
Nadezhda Ivanova
6283f2caaa Initial implementation of security descriptor creation in DS
TODO's:
ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20 15:16:17 -07:00
Matthias Dieter Wallnöfer
c1527612b9 s4:python tools - try to fix some test problems 2009-09-20 23:49:05 +02:00
Matthias Dieter Wallnöfer
10fe59bed9 s4:domainlevel - fixed another error
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a
copy of the one under the directory root object. Therefore there doesn't exist
the "Windows 2000 Mixed" forest level.
2009-09-20 21:25:49 +02:00
Matthias Dieter Wallnöfer
b8e65e6974 s4:provision_configuration - fix "sPNMappings"
I reread some docs about this attributes and it seems that this as mapping
attribute isn't host specific but in common for the whole domain. To allow
Windows DCs to join our s4 domain sooner or later we have to provide the full
attribute.
2009-09-20 11:57:54 +02:00
Matthias Dieter Wallnöfer
bb65cd4f68 s4:domainlevel - further improvements
- The tool displays now also mixed/interim domain levels and warns about them
  (s4 isn't capable to run on them)
- But it allows now also to raise/step-up from them
- It displays now also levels higher than 2008 R2 (altough we don't support them
  yet) but to be able to get a correct output
2009-09-20 11:48:26 +02:00
Matthias Dieter Wallnöfer
2b5d1dfe6b s4:provision_basedn_modify - fix the "auditPolicy" attribute
I had to think about how to encode the string 0x0001 (taken from Windows Server).
The problem is due to the "0" byte at the beginning of it. BASE64 encoding
seems a good method to do it.
2009-09-20 00:14:51 +02:00
Matthias Dieter Wallnöfer
8dffa2300b s4:provision_configuration - "sPNMappings": "http" missed on regeneration 2009-09-18 21:06:19 +02:00
Matthias Dieter Wallnöfer
2e7fc37912 s4/provision_configuration - re-add the "sPNMappings"
Accidentally removed by a previous commit.
2009-09-18 21:00:49 +02:00
Matthias Dieter Wallnöfer
72ba2fa375 s4:scripts - Cleans also the rest under the "setup" directory up
- I removed also the "-H" parameter since those scripts are all thought for the
  use on a local s4 domain controller. Another reason is also the bind as SYSTEM
  account which itself is only possible on local binds.
2009-09-18 20:45:46 +02:00
Matthias Dieter Wallnöfer
1f38aa0995 s4:various scripts under "setup" - Unification
- This unified the shape of those four scripts (comments, command sequence, call
  of SamDB)
- To consider the samdb.py changes regarding the filter: there is now always the
  possibility either to specify the username or the search filter
2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
bc2a05f001 s4:domainlevel/pwsettings - Remove unused import 2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
ac3b58b851 s4:domainlevel - fix indentations 2009-09-18 17:54:25 +02:00
Matthias Dieter Wallnöfer
752904f12c s4:domainlevel - Add a script which allows raising the domain/forest level
This simple script allows raising the domain and/or forest level for s4.
I integrated also the basic checks (since we don't perform them in LDB yet):
e.g. the forest level can't be higher than the domain level(s).
2009-09-18 17:46:16 +02:00
Matthias Dieter Wallnöfer
b15ef6d854 s4:pwsettings - Simplify the error handling a bit 2009-09-18 17:33:24 +02:00
Matthias Dieter Wallnöfer
89f5df6fa7 s4:provision - Bump down the domain and forest level to Windows 2000
- The DC level we keep on Windows Server 2008 R2 (we should call ourself
  always the newest server type)
- The domain/forest level we set to the minimum (Windows 2000 native) to
  allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed"
  mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is
  set always to 0
- I'll add a script which allows to bump the DC level (basically sets the
  "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and
  on the "DC" object)
2009-09-18 16:21:29 +02:00
Matthias Dieter Wallnöfer
fa4023d6f7 s4:provision - Some rework (continuation)
- Fix up "servicePrincipalNames" attributes on the DC object
- Add some informative comments (most in "provision_self_join.ldif")
- Add also comments where objects are missing which we may add later when we
  support the feature (mainly for FRS)
- Add "domain updates" objects also under "CN=Configuration" (they exist twice)
- Add the default services under "Services" to allow interoperability with some
  MS client tools
- Smaller changes
2009-09-17 21:19:24 +02:00
Matthias Dieter Wallnöfer
4fa327a19f s4:provision - Some rework
- Add/change "wellKnownObjects" attributes
- Order entries in "provision_basedn_modify.ldif"
- Add/change "delete entries" object under BASEDN and CONFIGDN
- Fix default version number of "Default domain policy" group policy
- Add "domain updates" objects for interoperability with MS AD maintaining tools
- Show version number in the "oEMInformation" attribute (suggested by ekacnet)
- Smaller fixups
2009-09-17 18:27:31 +02:00
Matthieu Patou
96a36bf06d s4:sites & services - Adds Intersite transport containers
This patch brings up those subcontainers and fixes up the "systemFlags" on the
"Subnet" entry.
2009-09-12 14:54:45 +02:00
Matthias Dieter Wallnöfer
77100924d9 s4:group policies - the default group policy objects are all system-critical 2009-09-12 11:13:36 +02:00
Matthias Dieter Wallnöfer
10833f641a s4:group policies - add the domain controller group policy
This patches fixes the last difference between s4 and Windows Server regarding
group policy objects: we hadn't the domain controller policy.

- Adds the domain controller policy as it is found in the "original" AD
- Adds also the right version number in the GPT.INI file for the domain group
  policy (was missing)
2009-09-11 22:41:58 +02:00
Andrew Tridgell
e4683bfb3b s4-provision: revert _gc_tcp priority
thanks to id10ts for spotting this. I was a victim of emacs zone mode,
which increaed it with each edit.
2009-09-11 23:13:39 +10:00
Andrew Tridgell
f009fa15a1 s4-provision: use DNS name, not domain name
The SPNs end in the DNS domain name
2009-09-11 17:14:01 +10:00
Andrew Tridgell
d26c42f5bf s4/provision: add the nTDSDSA GUID based DNS entries and SPNs
The DNS entries and SPNs are needed for samba<->samba DRS
replication. This patch adds them for a standalone DC configure. A
separate patch will add them for the vampire configure
2009-09-11 14:07:22 +10:00
Andrew Bartlett
bda7061334 s4:setup Updated Display Specifiers from Microsoft (with #s)
This fixes the issue with the original files that they didn't have a
leading # in front of the comments, which caused our parsing scripts
much pain.  The files are now exactly as delivered.

Andrew Bartlett
2009-09-11 07:29:57 +10:00
Andrew Kroeger
e3a2a22451 s4:pwsettings: Added blackbox tests.
The added tests include basic validation that the script runs and accepts all
custom arguments.  The tests also verify changes to the password complexity,
minimum password length, and minimum password length settings.
2009-09-10 01:09:56 +02:00
Andrew Kroeger
ebdb9da78e s4:pwsettings: Show default values in help messages. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
3cbcaa139c s4:pwsettings: Add 'default' option for password complexity. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
4b68cfe15d s4:pwsettings: Added validation.
Validate that each field is within its allowed range.  Also validate that the
maximum password age is greater than the minimum password length (if the maximum
password age is set).

I could not find these values documented anywhere in the WSPP docs.  I used the
values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs
the validation of values.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
0206b1d6f9 s4:pwsettings: Don't assume a value for pwdProperties.
If we cannot retrieve the value, do not assume a particular value.  The fact
that we could not retrieve the value indicates a larger problem that we don't
want to make worse bypossibly clearing bit fields in the pwdProperties
attribute.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
5f6ebc3483 s4:pwsettings: Run all updates as a single modify() operation.
This ensures that all changes are made, or none are made.  It also makes it
possible to do validation as we go and abort in case of an error, while always
leaving things in a consistent state.
2009-09-10 01:09:53 +02:00
Andrew Kroeger
e71383eed7 s4:pwsettings: Added --quiet option.
Also changed all non-error status output to use the message() function, which
respects the --quiet option.
2009-09-10 01:09:52 +02:00
Endi Sukma Dewata
b1dabb1133 s4: Use SASL authentication against Fedora DS.
1. During instance creation the provisioning script will import the SASL
   mapping for samba-admin. It's done here due to missing config schema
   preventing adding the mapping via ldapi.

2. After that it will use ldif2db to import the cn=samba-admin user as
   the target of SASL mapping.

3. Then it will start FDS and continue to do provisioning using the
   Directory Manager with simple bind.

4. The SASL credentials will be stored in secrets.ldb, so when Samba
   server runs later it will use the SASL credentials.

5. After the provisioning is done (just before stopping the slapd)
   it will use the DM over direct ldapi to delete the default SASL
   mappings included automatically by FDS, leaving just the new
   samba-admin mapping.

6. Also before stopping slapd it will use the DM over direct ldapi to
   set the ACL on the root entries of the user, configuration, and
   schema partitions. The ACL will give samba-admin the full access
   to these partitions.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-10 09:52:22 +10:00
Andrew Kroeger
41ce496691 s4:pwsettings: Correct off by factor of 10 for ticks.
The tick conversion math was off by a factor of 10 due to the incorrect usage of
the "e" notation.  The expression "XeY" means "X * (10^Y)", so the correct
expression is 1e7 to get the correct adjustment for ticks.
2009-09-07 12:29:35 +02:00
Matthias Dieter Wallnöfer
90d6829f8a s4:Foreign security principals - Fix them up
I fixed them up to match with Windows Server 2003. I don't think that the
creation of them in the provision script is needed so I put them in the
"provision_users.ldif" file.
2009-09-07 08:37:25 +02:00
Matthias Dieter Wallnöfer
5f2832a5dc s4:samldb - Major rework
This fixes up the change of the primary group of a user when using the ADUC
console:
- When the "primaryGroupId" attribute changes, we have to delete the
  "member"/"memberOf" attribute reference of the new primary group and add one
  for the old primary group.
- Deny deletion of primary groups according to Windows Server (so we cannot
  have invalid "primaryGroupID" attributes in our AD).
- We cannot add a primary group directly before it isn't a secondary one of a
  user account.
- We cannot add a secondary reference ("member" attribute) when the group has
  been chosen as primary one.

This also removes the LDB templates which are basically overhead now.

This should also fix bug #6599.
2009-09-07 08:37:24 +02:00
Matthias Dieter Wallnöfer
931aa4e8bd s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes
The "provision_users.ldif" file needs some rework to pass against the changed
and improved "samldb" module (see next commit).
2009-09-07 08:37:23 +02:00
Andrew Kroeger
9cf2d053cd s4:setup: Remove display_specifiers.ldif.
This file is no longer needed as the DisplaySpecifiers are now generated from
files provided by Microsoft.
2009-09-07 11:18:18 +10:00
Andrew Kroeger
76f23f0b46 s4:setup: Updated comment to reflect new DisplaySpecifiers location. 2009-09-07 11:18:18 +10:00
Andrew Kroeger
65130fa021 s4:setup: Change license headers to LDIF comments.
The original license headers provided by Microsoft cannot be parsed as valid
LDIF.

Changed the license headers to be valid LDIF comments, and added a new header
section detailing the exact changes that were made to the original document.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07 11:18:17 +10:00
Andrew Bartlett
cf1da4309c s4:setup Add DisplaySpecifiers from Microsoft.
Like the schema, these are provided under the licence at the head of
the file, which is not the GPL, but allows us to distribute them with
Samba.

Andrew Bartlett
2009-09-07 11:18:03 +10:00
Matthias Dieter Wallnöfer
89d40419d5 s4:pwsettings - Introduce the LDB modify flags in the right way
We can't emulate them through the LDB changetype flags since they haven't the
same constants! The previous behaviour led to huge problems.
2009-09-06 12:29:31 +02:00
Andrew Bartlett
1a97bd915d s4:provision Ensure that @OPTIONS is mirrored into each partition
The previous patches to the provision system cut down on the number of
reconnects, and disabled the partition handling for part of the
process.  This means we lost the setting of @OPTIONS as a replicated
attribute into the partitions.

Andrew Bartlett
2009-08-26 17:37:01 +10:00
Andrew Bartlett
a1da91174b s4:provison Add prefixes to ldb using same code a later modify will use
This allows us to test out the code that will do the modify of the
prefixMap, and to provide the bindings that may assist a future
upgrade script.

Andrew Bartlett
2009-08-26 13:49:10 +10:00
Andrew Bartlett
b9ec6bb1eb s4:provision Only create references to our server DN after the self join
This will ensure that the GUID can be filled in correctly, and assist
us to validate DN targets in the future.

Andrew Bartlett
2009-08-26 13:48:35 +10:00
Andrew Tridgell
e38f38fe48 we need the Deleted Objects container for replication
When objects are deleted they get renamed to this container. The
container needs to exist when we provision
2009-08-19 15:51:07 +10:00
Matthias Dieter Wallnöfer
0a5ea25d21 s4:python tools - Centralise the lookups for the default domain (root) in the call "domain_dn" from SamDB 2009-08-17 11:58:39 +02:00
Andrew Bartlett
e7bae2eb0a s4: Re-add --ldapadminpass as an option to provision
This should make setting up LDAP servers more predictable.

When not specified, it is random

Andrew Bartlett
2009-08-17 09:51:00 +10:00
Endi Sukma Dewata
a6c9233a12 s4:provision Fixes for Fedora DS schema mapping with full AD schema 2009-08-17 09:50:59 +10:00
Andrew Bartlett
f87811f6b3 s4:provision Rework provision-backend into provision
This removes a *lot* of duplicated code and the cause of much
administrator frustration.  We now handle starting and stopping the
slapd (at least for the provision), and ensure that there is only one
'right' way to configure the OpenLDAP and Fedora DS backend

We now run OpenLDAP in 'cn=config' mode for online configuration.

To test what was the provision-backend code, a new --ldap-dryrun-mode
option has been added to provision.  It quits the provision just
before it would start the LDAP binaries

Andrew Bartlett
2009-08-17 09:50:58 +10:00
Andrew Bartlett
a58b4f8cc2 s4:setup Don't manually set @ATTRIBUTES any more
We now set these as part of the schema load, and we now load the
schema before the provision loads the DB, so setting them here is
pointless

Andrew Bartlett
2009-08-17 09:50:57 +10:00
Andrew Bartlett
e1e99a7c7b s4:provision Remove the ACI element from the provision templates
We need to find a better way to apply this (used in the Fedora DS LDAP
backend), not by trying to tunnel this down the module stack.

Andrew Bartlett
2009-08-17 09:50:56 +10:00
Matthias Dieter Wallnöfer
639c9ccb93 s4: Correct the parameter logic of the "setpassword" script
Either the username or the filter are allowed. If both are given the filter is
going to be used due to a higher precedence.
2009-08-14 00:14:15 +02:00
Matthias Dieter Wallnöfer
fe767d4b70 s4:pwsettings script - Fix a small glitch
This fixes the problem with the setting and getting of the "minPwdAge" and
"maxPwdAge" attributes. I wanted to handle them in days but forgot to add
conversions (from "ticks" (tenth of microsecond) -> "days" and backwards).
2009-08-11 12:59:15 +02:00
Matthias Dieter Wallnöfer
c73984a5c9 s4:AD LDIFs - More refactoring
This commit includes:
- Additional static object data in SAMBA 4's AD to start supporting of
  - forest updates, - lost and found, - quotas on DS, - physical locations,
  - licensing of sites, - subnets, - policies for WMI, - DNS entries in AD
- Reordering of provision*.ldif files to be able to find entries and make future
  additions easier
- Add comments in provision*.ldif files to point out where subentries are located
  when they are based in other LDIFs
- Removations of autogenerated "cn" attributes
2009-08-11 12:59:13 +02:00
Andrew Bartlett
7bc566a882 s4:provision Allow provision-backend to not run slapd for 'make test'
As the version of OpenLDAP required for Samba4 is fairly new, we don't
want to make it a requirement before this python code is run in 'make
test'.

As such, skip over the actual starting of slapd, but check the rest
runs alright (which still validates syntax and other modules).

Andrew Bartlett
2009-08-12 11:09:50 +10:00
Andrew Bartlett
6dc41bf27c s4:provision Make the --ol-slapd paramter take the full path to slapd 2009-08-12 10:01:48 +10:00
Andrew Bartlett
f0decfe5c2 s4:provision Assume the OpenLDAP backend can find it's own modules 2009-08-12 10:01:48 +10:00
Oliver Liebel
28bcdf5266 s4:provision Rework and further automate setup of OpenLDAP backend
heres the summary of all changes/extensions:

- Andrew Bartlett's patch to generate indext
- Howard Chu's idea to use nosync on the DB included, but made optional

- slaptest-path is not needed any more (slapd -Ttest is used instead)
and is therefore removed. slapd-path is now recommended when
openldap-backend is chosen.
its also used for olc-conversion

- slapd-detection is now always done by ldapsearch (ldb module),
looking anonymous for objectClass: OpenLDAProotDSE via our ldapi_uri.

- if ldapsearch was not successfull, (no slapd listening on our socket)
slapd is
started via special generated slapdcommand_prov  (ldapi_uri only)

- slapd-"provision-process" startup is done via pythons subprocess.

- the slapd-provision-pid is stored under paths.ldapdir/slapd_provision_pid.

- after provision-backend is finished:
--- slapd.pid is compared with our stored slapd_provision_pid.
if the are unique, slapd.pid will be read out, and the
slapd "provison"-process will be shut down.
--- proper slapd-shutdown is verified again with ldb-search -> ldapi_uri
-> rootDSE.
--- if the pids are different or one of the pid-files is missing, slapd
will not be shut down,
instead an error message is displayed to locate slapd manually
--- extended help-messages (relevant to slapd) are always displayed,
e.g. the commandline with which slapd has to be started when everythings
finished
(slapd-commandline is stored under paths.ldapdir/slapd_command_file.txt))

- upgraded the content of the mini-howto (howto-ol-backend-s4.txt)
2009-08-12 10:01:48 +10:00
Matthias Dieter Wallnöfer
aa6dc21fa3 s4: Add a new script for setting password properties for a domain in a easier way 2009-08-07 17:21:58 +02:00
Oliver Liebel
11ff224e13 s4:setup Remove extra newlines that break OpenLDAP backend 2009-08-07 12:38:51 +10:00
Matthias Dieter Wallnöfer
1ce36ed747 s4:enableaccount script: Remove a redundant line 2009-08-06 12:34:56 +02:00
Andrew Bartlett
56f4516399 s4:kdc Push context to hdb_samba4 by way of the 'name' of the DB
This overloads the 'name' part of the keytab name to supply a context
pointer, and so avoids 3 global variables!

To do this, we had to stop putting the entry for kpasswd into the
secrets.ldb.  (I don't consider this a big loss, and any entry left
there by an upgrade will be harmless).

Andrew Bartlett
2009-07-27 22:41:42 +10:00
Andrew Bartlett
b50ab318c1 s4:setup add 'cn' attribute to Samba4 local schema
(We recently made the ms_schema.py script also add this attribute)
2009-07-27 22:41:42 +10:00
Matthias Dieter Wallnöfer
2fc5331e5c [SAMBA 4 directory] Refactoring and clean up of directory structure
- Adds more system objects which make sense to have them in SAMBA 4 also to
  have them when we add more and more services related to the directory (volume
  support, DFS, replication service, COM...)
- Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes
  are set correctly on each object
2009-07-20 14:21:09 +10:00
Jelmer Vernooij
7a765b65b7 provision: Remove unused imports. 2009-07-19 13:19:54 +02:00
Andrew Bartlett
271b5af92e s4:dsdb Handle dc/domain/forest functional levels properly
Rather than have the functional levels scattered in 4 different,
unconnected locations, the provision script now sets it, and the
rootdse module maintains it's copy only as a cached view onto the
original values.

We also use the functional level to determine if we should store AES
Kerberos keys.

Andrew Bartlett
2009-07-16 09:23:35 +10:00
Matthias Dieter Wallnöfer
5049f61f39 [SAMBA 4 directory] Changes "forceLogoff" and corrects the "subRefs"
- This changes the attribute "forceLogoff" to its' default
  values according to Windows Server 2003 R2
- Also this corrects the "subRefs" attribute of the base-DN which only refers
  to direct child partitions (and therefore not to the complete transitive closure)
2009-07-02 11:21:02 +10:00
Matthias Dieter Wallnöfer
b31f1e6d5b [SAMBA 4 directory] Corrects the "systemFlags" attributes
Set the values like Windows Server 2003 R2.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
d4a969530d [SAMBA 4 directory] Adds the complete "objectclass path" to our self-created DC object
Found after some comparisons against Windows Server 2003 R2.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
3e3c08c7a6 [SAMBA 4 directory] Adds the object version and "systemFlags" attribute to the display specifiers
The object version showed up in the Windows 2003 Server R2 AD.
The "systemFlags" attribute has been set to the right value.
2009-07-01 14:50:42 +10:00
Matthias Dieter Wallnöfer
2d9b51c2a8 Correct the headers of some SAMBA 4 setup python scripts 2009-06-29 13:39:55 +10:00
Andrew Bartlett
1e6fb7d730 s4: Add tests and 'must change password' flags in setpassword and newuser
In particular, ensure that we can acutally change the password under
these circumstances.

Andrew Bartlett
2009-06-18 13:49:30 +10:00
Andrew Bartlett
2afc6df9b4 s4:setup Add an option to 'setpassword' to force password change at next login 2009-06-18 13:49:30 +10:00
Jelmer Vernooij
c418af2456 ad-schema/license.txt: Fix typo. 2009-06-12 14:14:27 +02:00
Andrew Bartlett
4c1a7d7556 Add supportedCapabilities to our rootDSE
This makes AD client tools happier, as they know they are talking to
an AD server.

per Bug 6229 by Matthieu Patou <mat@matws.net>

Andrew Bartlett
2009-06-12 07:51:43 +10:00
Andrew Bartlett
d409a12ccd s4:setup Remove generated attributes from provision_configuration
Incorrectly added in 95eeef91d3, and
found by OpenLDAP backend tests run by Theodor Chirana <office@adaptcom.ro>

Andrew Bartlett
2009-05-29 12:15:28 +10:00
Andrew Kroeger
c80c3b5edd s4:provision: Added ComPartitionSets entry.
Without this entry, opening the COM+ tab under the properties of an OU within
ADUC results in the following error:

"Unable to retrieve all user properties, 0x80072030"
2009-05-26 14:17:22 +10:00
Andrew Kroeger
95eeef91d3 s4:Added Extended-Rights and subentries.
Without these entries, using the 'Delegate Control' option in ADUC results in
the following error message in the Delegation of Control Wizard:

"The templates could not be applied.  One or more of the templates is not
applicable.  Click Back and select different templates, and then try again."
2009-05-26 14:17:12 +10:00
Andrew Kroeger
d402866e31 s4:provision: Update DisplaySpecifiers (#5139).
The classDisplayName attribute controls the actual text displayed to the user
for the top-level menus, so added it to the existing entries.

The attributeDisplayNames attribute contains both the text displayed to the
user and a mapping to the internal directory attribute name for the particular
field, so added these to the existing entries as well.

Added new entries as appropriate to properly complete all menus and labels
within ADUC.
2009-05-26 14:16:05 +10:00
Matthias Dieter Wallnöfer
92d321006d Enable software rollout through AD
This enables the sofware rollout feature in Samba4

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-04-15 12:27:02 +10:00
Andrew Tridgell
26f5225ae2 we should not be supplying a generated attribute in our schema 2009-04-09 13:46:35 +10:00
Andrew Bartlett
354ba5e2e3 s4:schema Update Windows 2008 schema from Microsoft to latest version 2009-04-03 08:18:14 +11:00
Andrew Bartlett
c7ed9bc477 Remove minschema generated schema - we now generate from setup/ad-schema/ 2009-04-03 08:15:25 +11:00
Andrew Bartlett
1a17fcdf66 Add parentGUID as an allowed attribute in samba4Top
This is required to get provision against OpenLDAP working again
2009-04-03 08:14:42 +11:00
Andrew Bartlett
27c6eca04c Merge branch 'master' of ssh://git.samba.org/data/git/samba into wspp-schema 2009-03-20 13:22:08 +11:00
Andrew Tridgell
a1ebb85020 added support for parentGUID
This is made up of 4 parts:

  1) change our schema to include the parentGUID attribute type

  2) in the add hook in the objectclass module, get the objectGUID of
  the parent and add it to the message as parentGUID

  3) in the rename hook in the objectclass module, get the objectGUID
  of the new parent, and insert an async modify request after the
  renmam is done

  4) added a simple test suite
2009-03-17 14:18:53 +11:00
Andrew Bartlett
8249383efb Add the new, updated AD schema file from Microsoft
Also remove the copy of the licence text from licence.txt, to ensure
we don't get variations between the copies.

Andrew Bartlett
2009-02-25 10:40:42 +11:00
Oliver Liebel
503d15e8df Updates to the recent cn=config support for the OpenLDAP backend
- removed workaround for olcSyncprovConfig - creation (works perfect now
with 2.4.15, release was today)
- added 1 message-helpline, which is displayed when running
provision-backend with olc and/or mmr setup
- corrected 1 wrong slapcommand-helpline
- slapd.conf is removed now in case of olc-setup
- added 1 copyright-line to provision.py and provision-backend

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-02-25 10:39:35 +11:00
Oliver Liebel
31f2cddcf5 Added mmr and olc to the OpenLDAP backend provisioning-scripts
These extensions add mmr (multi-master-replication) and olc
(openldap-online-configuration) capabilities to the
provisioning-scripts (provision-backend and provision.py), for use
with the openldap-backend (only versions >=2.4.15!).

Changes / additions made to the provision-backend  -script:
added new command-line-options:
--ol-mmr-urls=<list of whitespace separated ldap-urls> for use with mmr
(can be combined with --ol-olc=yes),
--ol-olc=[yes/no] (activate automatic conversion from static slapd.conf
to olc),
--ol-slaptest=<path to slaptest binary> (needed in conjunction with
--ol-olc=yes)

Changes / additions made to the provision.py -script: added
extensions, that will automatically generate the chosen mmr and/or olc
setup for the openldap backend, according to the to chosen parameters
set in the provision-backend script

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-02-24 21:34:44 +11:00
Jelmer Vernooij
53b59aa2cf Use convenience function for finding setup_dir based on location of
python module.
2009-02-11 18:44:57 +01:00
Jelmer Vernooij
71221fded4 --interactive doesn't take any argument. 2009-02-11 16:58:00 +01:00
Jelmer Vernooij
e4801a426a Use script path to find the setup directory. 2009-01-21 14:26:06 +01:00
Jelmer Vernooij
b876478219 Make sure server_role gets initialized in backend provisioning code -
fixes test.
2009-01-19 21:14:37 +01:00
Andrew Bartlett
b7cafb9842 Don't give fatal python errors when guessing the realm 2009-01-19 12:16:24 +11:00
Jelmer Vernooij
f69ac13987 Add copyright headers. 2009-01-16 15:50:58 +01:00
Jelmer Vernooij
de7dc2cec0 Merge branch 'master' of ssh://git.samba.org/data/git/samba 2009-01-05 14:02:30 +01:00
Andrew Bartlett
d22adc14a9 More work to have OpenLDAP accept the full AD schema
We need to avoid handling DN+Binary and DN+String with the refint
module for now, as this is a currently unsupported syntax.

Also rename entryTTL to avoid a conflict with the operational
attribute of the same name.

Andrew Bartlett
2009-01-05 12:38:47 +11:00
Jelmer Vernooij
ca05542d3d Use fqdn rather than gethostname when guessing realm. 2009-01-05 00:27:49 +01:00
Jelmer Vernooij
2227860a79 Fix more tests, improve repr() functions for various Python types. 2008-12-21 23:05:35 +01:00
Jelmer Vernooij
a32194033a Move tests for ParamFile. 2008-12-21 16:39:17 +01:00
Jelmer Vernooij
6efb7ff981 Fix various Python-related bugs. 2008-12-21 07:34:27 +01:00
Andrew Bartlett
f210fbe68b Corrections to Microsoft's schema and the OpenLDAP mapping file 2008-12-20 16:43:48 +11:00
Jelmer Vernooij
5076c64d43 Merge branch 'master' of ssh://git.samba.org/data/git/samba 2008-12-19 21:47:45 +01:00
Jelmer Vernooij
6998ef4fe0 Avoid use of parentheses in Python import statements, as it's not supported by Python2.3. 2008-12-19 21:47:31 +01:00
Sreepathi Pai
43f232fcc9 Fix errors in MS-AD_Schema_Attributes_v20080618.txt
- Remove spurious line breaks
 - Add missing attributeId from docs
 - Remove incorrect multiple values of systemFlags
 - Fix duplicate attributeId
 - Fix schemaIdGuid syntax

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2008-12-19 10:56:09 +11:00
Stefan (metze) Metzmacher
a937a68826 Here's the prefixMap from w2k8.
We need to move 1.3.6.1.4.1.7165.4.1 and 1.3.6.1.4.1.7165.4.2 to the
end...(if we still need them, which we should avoid)

metze

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2008-12-19 10:55:56 +11:00
Andrew Bartlett
f52fc2f90e Move aggregate schema stub to it's own file
This should make it easier to import just the schema entries from the
WSPP docs.

Andrew Bartlett
2008-12-19 09:51:42 +11:00
Andrew Bartlett
ebe1e923c8 s4:provision: use extended_dn_out_ldb or extended_dn_out_dereference depending on the backend
This just changes the existing stratagy of loading different modules
for the OpenLDAP backend to also include extended_dn_out_*

When we provision the OpenLDAP backend, we make sure to include the
'deref' overlay (which must be made available by the OpenLDAP build)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-17 12:29:28 +11:00
Andrew Bartlett
74f304ec30 s4:setup: fix cut-n-paste error Builtin-Domain => Samba4-Local-Domain
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-17 12:29:27 +11:00
Andrew Bartlett
f0418a1600 s4:setup: don't set objectCategory: CN=Domain-DNS,${SCHEMADN}
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-17 12:29:27 +11:00
Jelmer Vernooij
b09d2edf26 s4/provision: Upper case default realm, use only first part of realm as default domain name. 2008-12-16 16:17:30 +01:00
Jelmer Vernooij
52571a0333 Add interactive flag to setup/provision (also the default when no arguments are given). 2008-12-11 18:51:28 +01:00
Andrew Bartlett
cbe6e2a776 Add AD schema from Microsoft's WSPP documentation.
This schema is *NOT* licenced under a standard Free Software licence,
but does provide us the freedoms we need to use the schema, and the
requirement to distribute as 'part of an implemenation' is similar to
common Free font licences that are accepted by major linux distributions.

Andrew Bartlett
2008-12-10 17:54:06 +11:00
Andrew Bartlett
6c298c06f3 Don't treat the DN+binary syntax as a DN.
This should fix the OpenLDAP backend
2008-12-02 14:22:24 +11:00
Jelmer Vernooij
af216fdfc8 Don't create LanMan Directory Replication Service key (bug 4934). 2008-10-30 23:39:38 +01:00
Andrew Bartlett
3038bc484e Mark clearTextPassword as a privilaged attribute 2008-10-20 20:07:09 +11:00
Jelmer Vernooij
e549759efe Fix blackbox tests on IPv6-only hosts. 2008-10-20 10:18:02 +02:00
Simo Sorce
2deeb99fff Transform the sequence_number operation into a normal extended operation as it should always have been. Make it also async so that it is not a special case. 2008-10-16 12:55:30 -04:00
Stefan Metzmacher
05994005a3 s4:setup: add wellknownObjects to the domain object
metze
2008-10-02 18:56:09 +02:00
Andrew Tridgell
f84093df86 Merge branch 'master' of ssh://git.samba.org/data/git/samba 2008-09-30 13:02:09 -07:00
Andrew Bartlett
15b6861981 Use the new 'samba4' name for our internal hdb plugin. 2008-09-29 22:34:35 -07:00
Andrew Tridgell
750a848d0d added some more well known SIDs - thanks to the WSPP LSAT test suite 2008-09-29 16:01:07 -07:00
Stefan Metzmacher
ee2bcfacdf s4:dsdb: passdown DSDB_CONTROL_REPLICATED_UPDATE_OID for replicated updates
We need to make sure replicated updates are handled differently
in some situations, e.g. we should bypass the schema checks.

metze
2008-09-29 04:15:11 +02:00
Andrew Bartlett
ef9169bfa6 Make it clear that the MMR password can differ from the admin passsword
In the future, we might simply randomly generate this, or allow the
admin to specify it seperate to the admin password.  However, both are
highly sensitive, as they imply read access to the krbtgt.

Andrew Bartlett
(This used to be commit 57d19ad002)
2008-09-08 15:09:06 +10:00
Oliver Liebel
b76f383eef Use DIGEST-MD5 authentication for OpenLDAP replication
This avoids passing rootdn passwords or replicated data in cleartext
across the network.

Signed-of-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 67373c143a)
2008-09-08 14:39:54 +10:00
Andrew Bartlett
3eb6f79a02 Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into trusted-domains
(This used to be commit a057c3ed9d)
2008-09-08 12:54:13 +10:00
Oliver Liebel
86d5c3b069 Remove <tab> in OpenLDAP MMR config
Signed-of-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 80f31c3272)
2008-09-06 13:12:19 +10:00
Andrew Tridgell
9817f3d785 Add a setexpiry operation in samdb.py
This makes it easy to set the expiry (or no expiry) for a samdb user
(This used to be commit 25171f18a4)
2008-08-30 07:32:44 +10:00
Andrew Tridgell
a5f4ffe042 added a simple script for setting password expiry
(This used to be commit cf37126ac7)
2008-08-30 07:23:06 +10:00
Andrew Tridgell
91d6cdd89a now that ldap integers are 32 bit, we need to put the right 32 bit
value in for group type to avoid sign extension, otherwise we don't
find the builtin groups
(This used to be commit 9b55863939)
2008-08-22 21:26:32 +10:00
Andrew Bartlett
8237c0ba83 The index handling is now configured from the schema load, not by a
template.

Andrew Bartlett
(This used to be commit b36c6a21ad)
2008-08-21 12:59:16 +10:00
Andrew Bartlett
6e5f2454ac Apply attributes (and their syntax) from the schema into ldb
This changes the @ATTRIBUTES record to be for bootstrapping only,
before we find the schema.

Andrew Bartlett
(This used to be commit 358477fcc0)
2008-08-20 15:46:46 +10:00
Andrew Bartlett
41493cbe68 Update OpenLDAP MMR configuration per comments by Oliver Liebel
<oliver@itc.li>

This changes the RIDs to be <serverID><DBID>, to ease later debugging.

The need to specify the port on the MMR URLs is now included in the
help.

Andrew Bartlett
(This used to be commit a5cbe8c09c)
2008-08-20 12:21:36 +10:00
Andrew Bartlett
b33f4541f6 Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
(This used to be commit fc6b4f03eb)
2008-08-19 14:11:51 +10:00
Andrew Bartlett
7ef21658fb Fix up new OpenLDAP MMR code.
This changes the MMR password from hard-coded value of 'linux',
adds tests and fixes the Fedora DS backend.

Currently the MMR password matches the admin password, but we can
change this to be another random value if required.

Also require the port to be specified on the command line, so we don't
hard-code a port of 9000.

Andrew Bartlett
(This used to be commit 08257c6d6c)
2008-08-19 14:10:14 +10:00
Oliver Liebel
805dd85291 Generate Multi-Master Replication configuration for OpenLDAP
This patches provision-backend and the related scripts to generate the
correct configuration blobs for N-way multi-master replication using
OpenLDAP.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(This used to be commit 6ed0b3f247)
2008-08-19 12:03:04 +10:00
Andrew Bartlett
47d80366be Fix templates.ldb reprovision handling.
This sets the attributes in a seperate transaction, and allows a
forced delete of the whole file.

Andrew Bartlett
(This used to be commit 423db2468b)
2008-08-19 11:43:41 +10:00
Andrew Bartlett
46c94dd8b2 Merge the two attribute syntax tables.
This merges the table once found in the oLschema2ldif tool (and moved
many times) with the table used for DRSUAPI.

The OpenLDAP schema map has been updated, to ensure that despite a
number of attributes being declared as OIDs, they are actually used as
strings (as they are actually LDAP class/attribute names).

Andrew Bartlett
(This used to be commit 61f2958c84)
2008-08-18 10:16:45 +10:00
Andrew Bartlett
16112762e7 Generate the subSchema in cn=Aggregate
This reads the schema from the in-memory structure, when the magic
attributes are requested.  The code is a modified version of that used
in the ad2oLschema tool (now shared).

The schema_fsmo module handles the insertion of the generated result.

As such, this commit also removes these entries from the setup/schema.ldif

Metze's previous stub of this functionality is also removed.

Andrew Bartlett
(This used to be commit c7c32ec7b4)
2008-08-15 20:40:57 +10:00
Jelmer Vernooij
47124efe42 Add helper object Hostconfig to make it easier to get to e.g. the
SAM database.
(This used to be commit be75b2a36e)
2008-08-01 21:12:37 +02:00
Andrew Bartlett
ea7f2fedea Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
(This used to be commit ae311d89d2)
2008-07-23 16:20:17 +10:00
Andrew Bartlett
e0bd9e82ea Explain where some other OIDs are allocated.
This is an odd place for an OID registry - we perhaps need a central
wiki page.

Andrew Bartlett
(This used to be commit 1c90997397)
2008-07-23 13:49:00 +10:00
Matthias Dieter Wallnöfer
fb3e663678 Improve DNS and Group poicy configurations.
- fixes bug #4813 (simplify DNS setup)
  - This reworks the named.conf to be a fully fledged include
  - This also moves the documentation into named.txt
 - improves bug #4900 (Group policy support in Samba)
   - by creating an empty GPT.INI
 - fixes bug #5582 (DNS: Enhanced zone file)
   - This is now closer to the zone file AD creates

committed by Andrew Bartlett
(This used to be commit 74d684f6b3)
2008-07-22 11:06:47 +10:00
Andrew Bartlett
706140a1dc Make invalid 'member' detection work again.
This defines a rootdn globally, and due to OpenLDAP bugs, gives it
manage access to the whole database.  This makes the memberOf module
able to validate the links again, now we have database ACLs.

Andrew Bartlett
(This used to be commit 9fe3e9f09f)
2008-07-21 09:36:24 +10:00
Andrew Bartlett
3408a2d18f Make a seperate template for the refint configuration too
(This used to be commit d2a527acc5)
2008-07-18 18:58:56 +10:00
Andrew Bartlett
cfc2063f23 Put the memberof template into a seperate setup/ file.
Set a memberof-dn in a fruitless attempt to fix the ACL problem I'm
having with OpenLDAP

Andrew Bartlett
(This used to be commit 6d6e03834a)
2008-07-18 18:44:07 +10:00
Andrew Bartlett
831bd55fb0 Lock down the LDAP backend - only samba may read or write
(This used to be commit a3912801fb)
2008-07-15 22:07:45 +10:00
Andrew Bartlett
0f1eea2672 Rework provision to handle both simple and SASL binds.
Fedora DS is still setup for simple binds only, at this point.
(it also fails on other issues).

Andrew Bartlett
(This used to be commit b24c572d5a)
2008-07-15 15:46:32 +10:00
Andrew Bartlett
a6b842f963 Connect to the LDAP backend with SASL credentials.
This reworks our LDAP backend code to move from anonymous access to a
shared-secret SASL-protected connection.  (SASL selects NTLM or
DIGEST-MD5 on my system).

To get this working, we must pre-populate the LDAP backend with a DN
to store ths SASL secret on, and we use back-ldif for this.

This gives us a reasonable basis to deploy a replicated OpenLDAP
backend solution.

Andrew Bartlett
(This used to be commit cd0745253c)
2008-07-15 15:15:12 +10:00
Andrew Bartlett
44ea6a26fd rename sambaPassword -> userPassword.
This attribute is used in a very similar way (virtual attribute
updating the password) in AD on Win2003, so eliminate the difference.

This should not cause a problem for on-disk passwords, as by default
we do not store the plaintext at all.

Andrew Bartlett
(This used to be commit 1cf0d75149)
2008-07-12 15:26:42 +10:00
Andrew Bartlett
a5e3c5e236 Avoid the use of extensibleObject in ldap mapping backend.
Instead of extensibleObject, we use the new (more correct) ad2oLschema
tool, and a new objectClass called 'samba4Top', which we add and
remove in the same way we did extensibleObject.

Andrew Bartlett
(This used to be commit 5ab20aa8b4)
2008-07-10 17:54:43 +10:00
Andrew Bartlett
9ea25cacf1 Add a blackbox test for the provision-backend script.
This test (as most tests do :-) found a few bugs, also fixed in this
commit.

Andrew Bartlett
(This used to be commit d96a6482da)
2008-06-19 11:05:20 +10:00
Jelmer Vernooij
31a2a98d83 Remove unused import, function.
(This used to be commit f134a701e7)
2008-06-11 00:10:43 +02:00
Andrew Tridgell
aa35cef57f setpassword should be executable
(This used to be commit b8f2e6321d)
2008-06-03 09:36:46 +10:00
Andrew Bartlett
b34bc408e7 Don't pass an smb.conf to provision tests.
These tests will create their own smb.conf in their prefix anyway.

Andrew Bartlett
(This used to be commit c0322e8e27)
2008-05-30 14:36:24 +10:00
Andrew Bartlett
617ef56aa3 Remove extra spaces on prefixMap input and output.
Metze requested that the format not include spaces, and the input parser
already expects this.

Andrew Bartlett
(This used to be commit 3b1f5d1036)
2008-05-29 20:16:18 +10:00
Andrew Bartlett
b7c8e020a6 Print prefixMap in a human-readable format.
This should allow the prefixMap to be edited, until we find the right
way to autogenerate it.

Andrew Bartlett
(This used to be commit 24ae9a55ec)
2008-05-29 18:38:17 +10:00
Jelmer Vernooij
4b701a265f Fix imports for provision-backend.
This needs a blackbox test...
(This used to be commit 268c1de095)
2008-05-23 04:31:10 +02:00
Andrew Kroeger
8172f3eb22 GPO: Do not provision Default Domain Policy as initially enforced. (bz #5480)
This only solves part of bz #5480.  The settings for Enforced & Link Enabled
now match the default settings of a Windows DC, but they are still "locked"
and cannot be changed via the GUI.
(This used to be commit 761e667e45)
2008-05-21 21:14:06 -05:00
Andrew Kroeger
6576a022b8 enableaccount: Use correct command name in usage output.
(This used to be commit 4ca8f32a37)
2008-05-21 20:46:15 -05:00
Andrew Kroeger
bf3f3af926 provision: Generate krb5.conf template separate from named.conf template.
(This used to be commit ebf130e9e5)
2008-05-21 20:46:15 -05:00
Jelmer Vernooij
84a3290c8f Fix python imports.
(This used to be commit 4532066656)
2008-05-22 01:47:36 +02:00
Jelmer Vernooij
7e33677047 use one blackbox script per executable.
(This used to be commit cd8c822678)
2008-05-22 01:47:22 +02:00
Jelmer Vernooij
49706ab19b Move more modules inside of the samba package.
(This used to be commit 9b39e99f48)
2008-05-21 23:59:34 +02:00
Jelmer Vernooij
1929675813 Fix reference to removed smbpython.
(This used to be commit 58f956dc45)
2008-05-21 15:39:00 +02:00
Andrew Bartlett
40ff67e454 Merge branch 'v4-0-local' of git://git.id10ts.net/samba into 4-0-local
(This used to be commit 0e429dd1fb)
2008-05-21 14:34:43 +10:00
Andrew Bartlett
343fea32cc Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
Fix config.mk due to changing syntax.

Conflicts:

	source/libcli/config.mk
	source/nbt_server/config.mk
(This used to be commit 6a1c76f29f)
2008-05-20 08:03:35 +10:00
Andrew Kroeger
25ea110c38 provision: Create instructions for enabling DNS GSS-TSIG updates.
Added code to the python provisioning to create the named.conf file that was
previously generated by the EJS provisioning.

Updated the named.conf template to provide the additional details necessary
to get things working.
(This used to be commit 0b7a6bfcba)
2008-05-18 01:54:57 -05:00
Andrew Kroeger
18aa2d58ed provision: Allow DNS GSS-TSIG updates to work.
This change ensures the KVNO of the principal in secrets.ldb (which is also
exported to the dns.keytab) matches the KVNO associated with the "dns" user.
Without explicitly setting msDS-KeyVersionNumber, the KVNO exported into the
dns.keytab was 0.

KVNO needs to be > 0, as the client libs (at least MIT libs on Fedora)
consider KVNO == 0 as a sign to ignore that particular key.
(This used to be commit 572efc8e65)
2008-05-18 01:54:56 -05:00
Jelmer Vernooij
4accab35c6 Merge branch 'nosmbpython' into v4-0-test
(This used to be commit 9683f7434c)
2008-05-12 03:54:53 +02:00
Andrew Bartlett
ff7c537e27 Remove JavaScript provision-backend script
The library it relied on has already been removed.

Andrew Bartlett
(This used to be commit 97427731a5)
2008-05-12 09:46:50 +10:00
Jelmer Vernooij
0be941a383 Remove python extension from upgrade script.
(This used to be commit 5268649b7e)
2008-05-11 14:32:06 +02:00
Jelmer Vernooij
47d2218922 Set sys.path for running inside source tree.
(This used to be commit b507109bb6)
2008-05-11 05:45:49 +02:00
Jelmer Vernooij
babdcc6135 Use system python rather than smbpython.
(This used to be commit d3df51cd01)
2008-05-11 05:29:20 +02:00
Andrew Bartlett
0d1fe706e3 Remove vampire.py as the 'net' binary is the right interface.
As some future point we might get these scripting interfaces into
better shape, and provide a python interface to this functionality
again.

Andrew Bartlett
(This used to be commit 717dcb2c54)
2008-04-25 09:25:14 +01:00
Andrew Tridgell
6a40411fcc change the default idmap range to 3M -> 4M
This gives us a lot more headroom, and means that we have a lower
chance of running into real local users
(This used to be commit b2dac6645c)
2008-04-18 15:41:54 +02:00
Andrew Tridgell
b967afca64 Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-test
(This used to be commit e891157b4e)
2008-04-15 09:54:41 +02:00
Andrew Tridgell
9cd04363f5 make the SMB2 negotiated read and write size settable in smb.conf
parametic options:

  smb2:max read size = NNN  
  smb2:max write size = NNN

The defaults are 65536, which is what Vista sets, and what we
previously set
(This used to be commit 9e60164cae)
2008-04-14 19:09:57 +02:00
Andrew Bartlett
5a37b3fc5d Fix newuser and setpassword scripts, and port to idmap.
The new idmap world does not use the unixUser any more, so we need to
set up the entry (if wanted) in the idmap database.  Users without a
backing unix user will get an allocated uid by idmap later.

Andrew Bartlett
(This used to be commit 8bd8bc1475)
2008-04-14 11:51:02 +02:00
Andrew Bartlett
6b013c90fd Actually test the different 'fill levels' in the provision process.
This should cover a few more codepaths in the provision script.

Andrew Bartlett
(This used to be commit 75c8dc6c6f)
2008-04-11 19:38:36 +10:00
Andrew Bartlett
e8a3621a8f Be consistant in using ${SEVERDN}.
This ensures we don't fall out of sync with the provision scripts.

Andrew Bartlett
(This used to be commit 566c60b464)
2008-04-09 14:51:22 +10:00
Andrew Bartlett
b2805c50ee Re-add support for the --ldap-backend-port option to provision-backend
This option allows Fedora DS multi-master replication to work.  I've
tried to update the wiki and scripts to the largely consistant with
each other.

Andrew Bartlett
(This used to be commit 42393c8307)
2008-04-08 17:28:25 +10:00
Andrew Bartlett
c764791100 Clean up provision and rootdse module to hard-code less stuff.
In particular, allow for the server DN to be in a different site
(possible outcome of a DRS replication).

Andrew Bartlett
(This used to be commit 9ee4e39fe1)
2008-04-04 12:25:19 +11:00
Andrew Bartlett
67bf4bab3d Fix conflicts in setup/provision script.
(This used to be commit 696b58f5dd)
2008-04-02 12:31:24 +11:00