1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

251 Commits

Author SHA1 Message Date
Andrew Bartlett
03f178a728 r26424: Patch and hits from Howard Chu <hyc@symas.com> for our automated setup
of OpenLDAP.

This makes it consistant with the Fedora DS setup, and doesn't mix
both hdb and bdb.

Andrew Bartlett
(This used to be commit 1ffada95d2)
2007-12-21 05:49:51 +01:00
Jelmer Vernooij
1a562591ec r26370: Import upgrade script in Python.
(This used to be commit 277f216524)
2007-12-21 05:49:07 +01:00
Jelmer Vernooij
c926cddfad r26366: Import provision scripts in Python.
(This used to be commit 090c799f98)
2007-12-21 05:49:06 +01:00
Andrew Bartlett
8edcbc8474 r26305: Update template files and testsuite to try and work with current
openldap, and fully support different LDAP server locations.

Andrew Bartlett
(This used to be commit a00bb94253)
2007-12-21 05:48:19 +01:00
Andrew Bartlett
f5860b5a85 r26298: Use metze's schema loading code to pre-initialise the schema into the
samdb before we start writing entries into it.

In doing so, I realised we still used 'dnsDomain', which is not part
of the standard schema (now removed).

We also set the 'wrong' side of the linked attributes for the
masteredBy on each partition - this is now set in provision_self_join
and backlinks via the linked attributes code.

When we have the schema loaded, we must also have a valid domain SID
loaded, so that the objectclass module works.  This required some ejs
glue.

Andrew Bartlett
(This used to be commit b0de08916e)
2007-12-21 05:48:15 +01:00
Andrew Bartlett
a2a4aba5fd r26245: Make it easier to handle the LDAP backend, with it's differing needs,
by seperating the modules list into parts.  That way, we can remove
the modules that the backend will provide.

Andrew Bartlett
(This used to be commit d67e5c7896)
2007-12-21 05:47:24 +01:00
Andrew Bartlett
adef944c43 r26137: Rename the entryUUID module to better match it's purpose: being a
simple ldap mapping (a complex mapping will follow).

Fix the module to handle 'name' better, rather than using the 'name'
attribute built into OpenLDAP, rename to samba4RDN.  We need to see if
this can be handled in the backend.

Also rename the functions and inernal module name to entryuuid for
consistancy.

Andrew Bartlett
(This used to be commit a7be80766f)
2007-12-21 05:46:19 +01:00
Andrew Bartlett
bd6a651b38 r25960: Enable checks on the validity of the search base on sam.ldb in Samba4.
Remove bogus check to return NO_SUCH_ENTRY in ldap_backend.c, as this
error is now correctly emited from ldb.

Andrew Bartlett
(This used to be commit ed57862b90)
2007-12-21 05:45:19 +01:00
Andrew Bartlett
3f2ca10d2d r25940: Rework the samldb and templates handling.
Templates just don't belong in the sam.ldb, as they don't obey any of
the other rules.  This moves them to a seperate templates.ldb.

In samldb, this patch reworks the duplicate SID and Name detection
code, to use ldb_search_exp_fmt() rather than gendb_search.  This
returns far more useful errors, which we now handle and report better.

The call to samdb_search_for_parent_domain() has been moved in samldb,
to allow both the account and SID uniqueness checks to be in the same
domain.  This function also returns better errors.

dcesrv_drsuapi.c is updated for the new prototype of
samdb_search_for_parent_domain()

Andrew Bartlett
(This used to be commit f1ab90c88c)
2007-12-21 05:45:10 +01:00
Andrew Bartlett
716391f106 r25921: Now also listen on ldapi by default in the LDAP server
Create a phpLDAPadmin configuration file example to use ldapi to talk
to Samba4

Andrew Bartlett
(This used to be commit 54f4c8ba61)
2007-12-21 05:45:03 +01:00
Andrew Bartlett
27c9f6c235 r25891: Test that we get the correct return value when we attempt to reference
invalid entries with a linked attribute.

Make Samba4 pass that test, by fixing a silly bug in the
linked_attributes module.  (By passing down the 'original' request
structure, tdb would override our handle, and therefore we would never
be called for the 'wait', which collects the errors).

Fix up the provision templates to handle the newly required
referential integrity.

Andrew Bartlett
(This used to be commit 0377d85bbd)
2007-12-21 05:44:41 +01:00
Andrew Bartlett
47f6988c6d r25753: Move cn=rootdse to @ROOTDSE to avoid being caught up in schema restrictions.
Andrew Bartlett
(This used to be commit f3390c9054)
2007-12-21 05:43:45 +01:00
Andrew Bartlett
7c721a1f49 r25747: Implement linked attributes, for add operations.
Much more work is still required here, particularly to handle this
better during the provision, and to handle modifies and deletes, but
this is a start.

Andrew Bartlett
(This used to be commit 2ba99d58e9)
2007-12-21 05:43:41 +01:00
Andrew Bartlett
5c4a4b4566 r25616: Fedora DS now has a way to install the schema and extra configuration
as part of the setup inf file.

Andrew Bartlett
(This used to be commit 6c8987464e)
2007-12-21 05:42:54 +01:00
Andrew Bartlett
999d47e41e r25452: Move the creation of the server entry to the self join, as this makes
no sense on a member server.

Andrew Bartlett
(This used to be commit 70467fa4c5)
2007-10-10 15:07:37 -05:00
Andrew Bartlett
43890c4c58 r25451: Rework the display of provision options to use printf syntax, and
avoid %s in the substituted strings from becoming a problem.

Andrew Bartlett
(This used to be commit 3c4f107239)
2007-10-10 15:07:37 -05:00
Andrew Bartlett
b6678a276c r25450: Make it easier to test with a particular version of OpenLDAP, by
setting OPENLDAP_PATH, move to using hdb as the backend (allows
subtree renames), and re-enable the --quiet option.

Andrew Bartlett
(This used to be commit a186a0fa68)
2007-10-10 15:07:37 -05:00
Andrew Bartlett
2606996653 r25354: Thanks to Amin Azez <azez@ufomechanic.net> for finally getting me to
fix a provision without an smb.conf already setup.

Andrew Bartlett
(This used to be commit a00044d229)
2007-10-10 15:07:16 -05:00
Andrew Bartlett
e12730322c r25303: Print out the options the provision script generated. This should
help users produce predictable setups.

Andrew Bartlett
(This used to be commit 9789bd3c0a)
2007-10-10 15:07:10 -05:00
Andrew Bartlett
ee257e902a r25299: Modify the provision script to take an additional argument: --server-role
This must be set to either 'domain controller', 'domain member' or 'standalone'.

The default for the provision now changes to 'standalone'.

This is not because Samba4 is particularlly useful in that mode, but
because we still want a positive sign from the administrator that we
should advertise as a DC.

We now do more to ensure the 'standalone' and 'member server'
provision output is reasonable, and try not to set odd things into the
database that only belong for the DC.

Andrew Bartlett
(This used to be commit 4cc4ed7719)
2007-10-10 15:07:09 -05:00
Andrew Bartlett
09a5ef1384 r25203: Don't use subclasses in Samba4, as we always fill out the full
objectClass list.

Andrew Bartlett
(This used to be commit e882dcb7aa)
2007-10-10 15:06:51 -05:00
Andrew Bartlett
8294016a1b r24914: In response to bug #4892 by Matthias Wallnöfer <mwallnoefer@yahoo.de>,
allow the objectclass module to reconstruct the objectclass hierarchy,
rather than using templates.

The issue being fixed in particular is that 'top' was not being set on
containers.

This should ensure we do this right for all objects.

Andrew Bartlett
(This used to be commit d17a0058ba)
2007-10-10 15:03:37 -05:00
Andrew Bartlett
d14a29fb74 r24913: Fix typo
(This used to be commit 4634bb282b)
2007-10-10 15:03:37 -05:00
Andrew Bartlett
ced6fc995f r24911: Make better use of substituted variables in example named.conf
Andrew Bartlett
(This used to be commit 9f18a97117)
2007-10-10 15:03:36 -05:00
Andrew Bartlett
b4aa01dcd1 r24909: Patch from Andrew Kroeger <andrew@sprocks.gotdns.com> on the slow road
to working GSS-TSIG DDNS.

Andrew Bartlett
(This used to be commit 99f832e7ed)
2007-10-10 15:03:36 -05:00
Andrew Bartlett
f681306335 r24760: Ensure we base64 encode any password being put into LDIF, to avoid
provision failures when some of the random password values are illigal
LDIF.

Andrew Bartlett
(This used to be commit 876003f6c6)
2007-10-10 15:03:05 -05:00
Andrew Bartlett
73388ce54c r24729: First try and publishing a DNS service account, for folks to play with.
The keytab in dns.keytab should (I hope) do the job.

Andrew Bartlett
(This used to be commit af4d331eef)
2007-10-10 15:02:58 -05:00
Jelmer Vernooij
349cc1e14b r24704: Fix bug in the registry patch code.. all the more proves this code needs tests.
(This used to be commit aa98d21957)
2007-10-10 15:02:51 -05:00
Jelmer Vernooij
2edf63b6d6 r24703: Use standard registry diff files when provisioning rather than
LDIF files for the registry files.
(This used to be commit 67ad556b73)
2007-10-10 15:02:50 -05:00
Andrew Bartlett
4b31fd4409 r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de>
with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>.

The changes to samldb_fill_foreignSecurityPrincipal_object() look much
larger then they are: We just skip all the objectSid generation if the
SID is supplied.

By providing a few more objects, standard dialogs on the clients are
better behaved, for these 'well known' users.

Andrew Bartlett
(This used to be commit 35ee4aee71)
2007-10-10 15:02:48 -05:00
Andrew Bartlett
ebce7a586b r24694: Remove objectCategory entries from the setup templates. These can be
autogenerated by the objectclass module when the the entries are
added.

Andrew Bartlett
(This used to be commit 79e13349f0)
2007-10-10 15:02:48 -05:00
Jelmer Vernooij
b409d4120f r24667: Finally merge the registry improvements that Wilco Baan Hofman and I have
been working on for at least half a year now. Contains the following
improvements:

 * proper layering (finally!) for the registry library. Distinction is
   now made between 'real' backends (local, remote, wine, etc) and
   the low-level hive backends (regf, creg, ldb, ...) that are only used
   by the local registry backend
 * tests for all important hive and registry operations
 * re-enable RPC-WINREG tests (still needs more work though, as
							   some return values aren't checked yet)
 * write support for REGF files
 * dir backend now supports setting/reading values, creating keys
 * support for storing security descriptors
 * remove CREG backend as it was incomplete, didn't match the data model
   and wasn't used at all anyway
 * support for parsing ADM files as used by the policy editor (see lib/policy)
 * support for parsing PREG files (format used by .POL files)
 * new streaming interface for registry diffs (improves speed and memory usage
	for regdiff/regpatch significantly)

   ... and fixes a large number of bugs in the registry code
(This used to be commit 7a1eec6358)
2007-10-10 15:02:34 -05:00
Simo Sorce
7663475111 r24651: Allow dynamic updates for the domain controller over its own name
(This used to be commit ce9b643411)
2007-10-10 15:02:32 -05:00
Simo Sorce
61582b5d8a r24650: Some more instructions to have make GSS-TSIG work
(This used to be commit 98350b35ab)
2007-10-10 15:02:32 -05:00
Andrew Bartlett
2da0be9d5e r24640: Add a suggested BIND configuration snippit, to help with DNS configuration.
When we sort out GSS-TSIG on the server, we can expand this to have
the 'right stuff'.

Andrew Bartlett
(This used to be commit 8f02ade1b2)
2007-10-10 15:02:28 -05:00
Andrew Bartlett
ae7819d715 r24262: Set the objectCategory by default in the objectclass module, rather than using templates.
Modify the samba3sam test to be less fussy, and not use the
objectclass module (which requires proper schema stuff now).

Andrew Bartlett
(This used to be commit 53c248c264)
2007-10-10 15:01:32 -05:00
Andrew Bartlett
4e697b288b r24060: Fix bug #4806 by Matthias Wallnöfer <mwallnoefer@yahoo.de>: We need to
include the attribute allowedChildClassesEffective for MMC to allow
the creation of containers.

This may need further refinement, but it seems to work for now.

Andrew Bartlett
(This used to be commit d053b8e218)
2007-10-10 15:01:21 -05:00
Andrew Bartlett
10f6e16573 r23859: Work to have Group Policy work 'out of the box' in Samba4.
This involves creating the SYSVOL and NETLOGON shares at provision
time, and creating the right subdirectories.

This also changes the behaviour of lp.get("foo") in ejs - we now
return undefined, rather than syntax error, if the parameter doesn't
exist (perhaps because the share isn't defined).

Andrew Bartlett
(This used to be commit 45cadf3bc0)
2007-10-10 15:01:05 -05:00
Andrew Bartlett
1cc770fc58 r23815: Thanks to Matthias Wallnoefer <mwallnoefer@yahoo.de> for pointing out
that we had the wrong objectClass for OU=Domain
Controllers,${DOMAINDN} (was CN=Domain Controllers,${DOMAINDN})

This fixes both the SAMR server and the LDIF templates.

Andrew Bartlett
(This used to be commit 625a9e6c04)
2007-10-10 14:59:22 -05:00
Andrew Bartlett
967866f170 r23720: Allow the member server to work against an LDAP Backend. Another case
where LDB isn't as strict as OpenLDAP, the self join record contains
duplicate servicePrincipalNames once the DNS name and domain name are
made equal.  (Easier to just skip the useless self-join).

Andrew Bartlett
(This used to be commit 49ff929be6)
2007-10-10 14:59:08 -05:00
Andrew Bartlett
90b49dc520 r23717: We need to remove the _ in LDAP_MANAGERPASS for the
--ldap-manager-pass= option to work.

Andrew Bartlett
(This used to be commit fbcb1ec141)
2007-10-10 14:59:07 -05:00
Andrew Bartlett
97172e1120 r23716: Clarify LDAP Manager DN and fix slapd startup syntax.
Andrew Bartlett
(This used to be commit 17dad5d8c3)
2007-10-10 14:59:06 -05:00
Andrew Bartlett
c37cfae81e r23715: Make the provision-backend script print out the exact commands to run,
to set up the LDAP backend.

Andrew Bartlett
(This used to be commit cc7900210a)
2007-10-10 14:59:06 -05:00
Andrew Bartlett
3a78f7323a r23703: Start to get Samba4 to again work with LDAP backends, after I turned
on metze's schema work.

Andrew Bartlett
(This used to be commit 3111bbdf64)
2007-10-10 14:59:06 -05:00
Andrew Bartlett
e9d19477e4 r23560: - Activate metze's schema modules (from metze's schema-loading-13 patch).
- samba3sam.js: rework the samba3sam test to not use objectCategory,
  as it's has special rules (dnsName a simple match)
- ldap.js: Test the ordering of the objectClass attributes for the baseDN
- schema_init.c: Load the mayContain and mustContain (and system...) attributes when
  reading the schema from ldb
- To make the schema load not suck in terms of performance, write the
  schema into a static global variable
- ldif_handlers.c: Match objectCategory for equality and canonicolisation
  based on the loaded schema, not simple tring manipuation
- ldb_msg.c: don't duplicate attributes when adding attributes to a list
- kludge_acl.c: return allowedAttributesEffective based on schema results
  and privilages

Andrew Bartlett
(This used to be commit dcff83ebe4)
2007-10-10 14:53:27 -05:00
Günther Deschner
b3f3a4b529 r23559: After running testprogs/ejs/minschema.js update schema.ldif (on abartlet's
request).

Guenther
(This used to be commit 5410b23ea6)
2007-10-10 14:53:27 -05:00
Andrew Bartlett
e6aecd8b91 r23235: Don't do a seperate LDAP provision step. Instead, everything we need
(including the config files) is created by provision-backend.

Andrew Bartlett
(This used to be commit 6d4d90399f)
2007-10-10 14:53:05 -05:00
Andrew Bartlett
66d0f5c7a3 r23232: Add in some extra files required by the new provision-backend.
(sorry for breaking the build)

Andrew Bartlett
(This used to be commit 0108334fe3)
2007-10-10 14:53:04 -05:00
Stefan Metzmacher
9f6c762b0a r23205: abartlet please commit the correct content ...
this just fixes make install

metze
(This used to be commit 236da2cb3d)
2007-10-10 14:53:03 -05:00
Andrew Bartlett
86a4886e39 r23189: Work towards a totally scripted setup of LDAP backends, so others can
easily try this out.

I also intend to use this for the selftest, but I'm chasing issues
with the OpenlDAP (but not Fedora DS) backend.

Andrew Bartlett
(This used to be commit 0f457b1d2e)
2007-10-10 14:53:02 -05:00