At file:///home/jelmer/bzr.samba/SAMBA_4_0/ ------------------------------------------------------------ revno: 11881 revision-id: [EMAIL PROTECTED] parent: [EMAIL PROTECTED] committer: Jelmer Vernooij <[EMAIL PROTECTED]> branch nick: SAMBA_4_0 timestamp: Tue 2007-04-17 02:13:33 +0200 message: Convert ldap provision code to perl. removed: source/script/tests/mk-fedora-ds.sh svn-v2:[EMAIL PROTECTED] source/script/tests/mk-openldap.sh svn-v2:[EMAIL PROTECTED] modified: source/script/tests/Samba4.pm svn-v2:[EMAIL PROTECTED] === removed file 'source/script/tests/mk-fedora-ds.sh' --- a/source/script/tests/mk-fedora-ds.sh 2007-04-16 20:35:19 +0000 +++ b/source/script/tests/mk-fedora-ds.sh 1970-01-01 00:00:00 +0000 @@ -1,90 +0,0 @@ -FEDORA_DS_INF=$LDAPDIR/fedorads.inf -FEDORA_DS_INITIAL_LDIF=$LDAPDIR/fedorads-initial.ldif - -echo "FEDORA_DS_LOGLEVEL=0" - -#Make the subdirectory be as fedora DS would expect -FEDORA_DS_DIR=$LDAPDIR/slapd-samba4 -echo FEDORA_DS_DIR=$FEDORA_DS_DIR - -echo "FEDORA_DS_PIDFILE=$FEDORA_DS_DIR/logs/slapd-samba4.pid" - -cat >$FEDORA_DS_INF <<EOF -[General] -SuiteSpotUserID = $ROOT -FullMachineName= localhost -ServerRoot= $LDAPDIR - -[slapd] -ldapifilepath=$LDAPDIR/ldapi -Suffix= $BASEDN -RootDN= cn=Manager,$BASEDN -RootDNPwd= $PASSWORD -ServerIdentifier= samba4 -InstallLdifFile=$FEDORA_DS_INITIAL_LDIF - -inst_dir= $FEDORA_DS_DIR -config_dir= $FEDORA_DS_DIR -schema_dir= $FEDORA_DS_DIR/schema -lock_dir= $FEDORA_DS_DIR/lock -log_dir= $FEDORA_DS_DIR/logs -run_dir= $FEDORA_DS_DIR/logs -db_dir= $FEDORA_DS_DIR/db -bak_dir= $FEDORA_DS_DIR/bak -tmp_dir= $FEDORA_DS_DIR/tmp -ldif_dir= $FEDORA_DS_DIR/ldif -cert_dir= $FEDORA_DS_DIR - -start_server= 0 - -EOF - -cat >$FEDORA_DS_INITIAL_LDIF<<EOF -# These entries need to be added to get the container for the -# provision to be aimed at. - -dn: cn="dc=$BASEDN",cn=mapping tree,cn=config -objectclass: top -objectclass: extensibleObject -objectclass: nsMappingTree -nsslapd-state: backend -nsslapd-backend: userData -cn: $BASEDN - -dn: cn=userData,cn=ldbm database,cn=plugins,cn=config -objectclass: extensibleObject -objectclass: nsBackendInstance -nsslapd-suffix: $BASEDN - -EOF - -perl $FEDORA_DS_PREFIX/bin/ds_newinst.pl $FEDORA_DS_INF >&2 || exit 1; - -( - cd $FEDORA_DS_DIR/schema - ls | grep -v ^00core | xargs rm -) - -cat >>$FEDORA_DS_DIR/dse.ldif<<EOF -dn: cn=bitwise,cn=plugins,cn=config -objectClass: top -objectClass: nsSlapdPlugin -objectClass: extensibleObject -cn: bitwise -nsslapd-pluginPath: $FEDORA_DS_PREFIX/lib/fedora-ds/plugins/libbitwise-plugin.so -nsslapd-pluginInitfunc: bitwise_init -nsslapd-pluginType: matchingRule -nsslapd-pluginEnabled: on -nsslapd-pluginId: bitwise -nsslapd-pluginVersion: 1.1.0a3 -nsslapd-pluginVendor: Fedora Project -nsslapd-pluginDescription: Allow bitwise matching rules - -EOF - -$srcdir/bin/ad2oLschema $CONFIGURATION -H $PRIVATEDIR/sam.ldb --option=convert:target=fedora-ds -I $srcdir/setup/schema-map-fedora-ds-1.0 -O $FEDORA_DS_DIR/schema/99_ad.ldif >&2 - -#it is easier to base64 encode this than correctly escape it: -# (targetattr = "*") (version 3.0;acl "full access to all by all";allow (all)(userdn = "ldap:///anyone";);) -echo "PROVISION_ACI=--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK" -
=== removed file 'source/script/tests/mk-openldap.sh' --- a/source/script/tests/mk-openldap.sh 2007-04-16 20:35:19 +0000 +++ b/source/script/tests/mk-openldap.sh 1970-01-01 00:00:00 +0000 @@ -1,124 +0,0 @@ -SLAPD_CONF=$LDAPDIR/slapd.conf -export SLAPD_CONF -echo "SLAPD_CONF=$SLAPD_CONF" - -echo "OPENLDAP_LOGLEVEL=0" -OPENLDAP_PIDFILE=$PIDDIR/slapd.pid -echo "OPENLDAP_PIDFILE=$OPENLDAP_PIDFILE" - -cat >$SLAPD_CONF <<EOF -loglevel 0 - -include $LDAPDIR/ad.schema - -pidfile $OPENLDAP_PIDFILE -argsfile $LDAPDIR/slapd.args -sasl-realm $DNSNAME -access to * by * write - -allow update_anon - -authz-regexp - uid=([^,]*),cn=$DNSNAME,cn=digest-md5,cn=auth - ldap:///$BASEDN??sub?(samAccountName=\$1) - -authz-regexp - uid=([^,]*),cn=([^,]*),cn=digest-md5,cn=auth - ldap:///$BASEDN??sub?(samAccountName=\$1) - -include $LDAPDIR/modules.conf - -defaultsearchbase "$BASEDN" - -backend bdb -database bdb -suffix "$BASEDN" -rootdn "cn=Manager,$BASEDN" -rootpw $PASSWORD -directory $LDAPDIR/db -index objectClass eq -index samAccountName eq -index name eq -index objectSid eq -index objectCategory eq -index member eq -index uidNumber eq -index gidNumber eq -index unixName eq -index privilege eq -index nCName eq pres -index lDAPDisplayName eq -index subClassOf eq -index dnsRoot eq -index nETBIOSName eq pres - -#syncprov is stable in OpenLDAP 2.3, and available in 2.2. -#We only need this for the contextCSN attribute anyway.... -overlay syncprov -syncprov-checkpoint 100 10 -syncprov-sessionlog 100 - -EOF - -cat > $LDAPDIR/db/DB_CONFIG <<EOF -# - # Set the database in memory cache size. - # - set_cachesize 0 524288 0 - - - # - # Set database flags (this is a test environment, we don't need to fsync()). - # - set_flags DB_TXN_NOSYNC - - # - # Set log values. - # - set_lg_regionmax 104857 - set_lg_max 1048576 - set_lg_bsize 209715 - set_lg_dir $LDAPDIR/db/bdb-logs - - - # - # Set temporary file creation directory. - # - set_tmp_dir $LDAPDIR/db/tmp -EOF - -#This uses the provision we just did, to read out the schema -$srcdir/bin/ad2oLschema $CONFIGURATION -H $PRIVATEDIR/sam.ldb -I $srcdir/setup/schema-map-openldap-2.3 -O $LDAPDIR/ad.schema >&2 - -#Now create an LDAP baseDN -$srcdir/bin/smbscript $srcdir/setup/provision $PROVISION_OPTIONS --ldap-base >&2 - -OLDPATH=$PATH -PATH=/usr/local/sbin:/usr/sbin:/sbin:$PATH -export PATH - -MODCONF=$LDAPDIR/modules.conf -rm -f $MODCONF -touch $MODCONF - -slaptest -u -f $SLAPD_CONF >&2 || { - # echo "enabling slapd modules" >&2 - cat > $MODCONF <<EOF -modulepath /usr/lib/ldap -moduleload back_bdb -moduleload syncprov -EOF -} - -if slaptest -u -f $SLAPD_CONF; then - slapadd -f $SLAPD_CONF < $PRIVATEDIR/$DNSNAME.ldif >/dev/null || { - echo "slapadd failed" >&2 - } - - slaptest -f $SLAPD_CONF >/dev/null || { - echo "slaptest after database load failed" >&2 - } -fi - -PATH=$OLDPATH -export PATH === modified file 'source/script/tests/Samba4.pm' --- a/source/script/tests/Samba4.pm 2007-04-16 23:30:38 +0000 +++ b/source/script/tests/Samba4.pm 2007-04-17 00:13:33 +0000 @@ -32,11 +32,11 @@ # running slapd in the background means it stays in the same process group, so it can be # killed by timelimit if ($self->{ldap} eq "fedora") { - system("$ENV{FEDORA_DS_PREFIX}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d$env_vars->{FEDORA_DS_LOGLEVEL} -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &"); + system("$ENV{FEDORA_DS_PREFIX}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d0 -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &"); } elsif ($self->{ldap} eq "openldap") { my $oldpath = $ENV{PATH}; $ENV{PATH} = "/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}"; - system("slapd -d$env_vars->{OPENLDAP_LOGLEVEL} -f $conf -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &"); + system("slapd -d0 -f $conf -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &"); $ENV{PATH} = $oldpath; } while (system("$self->{bindir}/ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) { @@ -164,6 +164,227 @@ "); } +sub mk_fedora($$$$$$) +{ + my ($self, $ldapdir, $basedn, $root, $password, $privatedir, $configuration) = @_; + + my $fedora_ds_inf = "$ldapdir/fedorads.inf"; + my $fedora_ds_initial_ldif = "$ldapdir/fedorads-initial.ldif"; + + #Make the subdirectory be as fedora DS would expect + my $fedora_ds_dir = "$ldapdir/slapd-samba4"; + + my $pidfile = "$fedora_ds_dir/logs/slapd-samba4.pid"; + + open(CONF, ">$fedora_ds_inf"); + print CONF " +[General] +SuiteSpotUserID = $root +fullMachineName= localhost +ServerRoot= $ldapdir + +[slapd] +ldapifilepath=$ldapdir/ldapi +Suffix= $basedn +rootDN= cn=Manager,$basedn +rootDNPwd= $password +serverIdentifier= samba4 +InstallLdifFile=$fedora_ds_initial_ldif + +inst_dir= $fedora_ds_dir +config_dir= $fedora_ds_dir +schema_dir= $fedora_ds_dir/schema +lock_dir= $fedora_ds_dir/lock +log_dir= $fedora_ds_dir/logs +run_dir= $fedora_ds_dir/logs +db_dir= $fedora_ds_dir/db +bak_dir= $fedora_ds_dir/bak +tmp_dir= $fedora_ds_dir/tmp +ldif_dir= $fedora_ds_dir/ldif +cert_dir= $fedora_ds_dir + +start_server= 0 +"; + close(CONF); + + open(CONF, ">$fedora_ds_initial_ldif"); + print " +# These entries need to be added to get the container for the +# provision to be aimed at. + +dn: cn=\"dc=$basedn\",cn=mapping tree,cn=config +objectclass: top +objectclass: extensibleObject +objectclass: nsMappingTree +nsslapd-state: backend +nsslapd-backend: userData +cn: $basedn + +dn: cn=userData,cn=ldbm database,cn=plugins,cn=config +objectclass: extensibleObject +objectclass: nsBackendInstance +nsslapd-suffix: $basedn +"; + close(CONF); + + system("perl $ENV{FEDORA_DS_PREFIX}/bin/ds_newinst.pl $fedora_ds_inf >&2") == 0 or return 0; + + unlink(<$fedora_ds_dir/schema/00core.*>); + + open(LDIF, ">$fedora_ds_dir/dse.ldif"); + print LDIF " +dn: cn=bitwise,cn=plugins,cn=config +objectClass: top +objectClass: nsSlapdPlugin +objectClass: extensibleObject +cn: bitwise +nsslapd-pluginPath: $ENV{FEDORA_DS_PREFIX}/lib/fedora-ds/plugins/libbitwise-plugin.so +nsslapd-pluginInitfunc: bitwise_init +nsslapd-pluginType: matchingRule +nsslapd-pluginEnabled: on +nsslapd-pluginId: bitwise +nsslapd-pluginVersion: 1.1.0a3 +nsslapd-pluginVendor: Fedora Project +nsslapd-pluginDescription: Allow bitwise matching rules +"; + close(CONF); + + system("$self->{bindir}/ad2oLschema $configuration -H $privatedir/sam.ldb --option=convert:target=fedora-ds -I $self->{setupdir}/schema-map-fedora-ds-1.0 -O $fedora_ds_dir/schema/99_ad.ldif >&2"); + + return ($fedora_ds_dir, $pidfile); +} + +sub mk_openldap($$$$$$$$) +{ + my ($self, $ldapdir, $basedn, $password, $privatedir, $dnsname, $configuration, $provision_options) = @_; + + my $slapd_conf = "$ldapdir/slapd.conf"; + my $pidfile = "$ldapdir/slapd.pid"; + my $modconf = "$ldapdir/modules.conf"; + + mkdir($_) foreach ($ldapdir, "$ldapdir/db", "$ldapdir/db/bdb-logs", + "$ldapdir/db/tmp"); + + open(CONF, ">$slapd_conf"); + print CONF " +loglevel 0 + +include $ldapdir/ad.schema + +pidfile $pidfile +argsfile $ldapdir/slapd.args +sasl-realm $dnsname +access to * by * write + +allow update_anon + +authz-regexp + uid=([^,]*),cn=$dnsname,cn=digest-md5,cn=auth + ldap:///$basedn??sub?(samAccountName=\$1) + +authz-regexp + uid=([^,]*),cn=([^,]*),cn=digest-md5,cn=auth + ldap:///$basedn??sub?(samAccountName=\$1) + +include $modconf + +defaultsearchbase \"$basedn\" + +backend bdb +database bdb +suffix \"$basedn\" +rootdn \"cn=Manager,$basedn\" +rootpw $password +directory \$ldapdir/db +index objectClass eq +index samAccountName eq +index name eq +index objectSid eq +index objectCategory eq +index member eq +index uidNumber eq +index gidNumber eq +index unixName eq +index privilege eq +index nCName eq pres +index lDAPDisplayName eq +index subClassOf eq +index dnsRoot eq +index nETBIOSName eq pres + +#syncprov is stable in OpenLDAP 2.3, and available in 2.2. +#We only need this for the contextCSN attribute anyway.... +overlay syncprov +syncprov-checkpoint 100 10 +syncprov-sessionlog 100 +"; + + close(CONF); + + open(CONF, ">$ldapdir/db/DB_CONFIG"); + print CONF " +# + # Set the database in memory cache size. + # + set_cachesize 0 524288 0 + + + # + # Set database flags (this is a test environment, we don't need to fsync()). + # + set_flags DB_TXN_NOSYNC + + # + # Set log values. + # + set_lg_regionmax 104857 + set_lg_max 1048576 + set_lg_bsize 209715 + set_lg_dir $ldapdir/db/bdb-logs + + + # + # Set temporary file creation directory. + # + set_tmp_dir $ldapdir/db/tmp + "; + close(CONF); + + #This uses the provision we just did, to read out the schema + system("$self->{bindir}/ad2oLschema $configuration -H $privatedir/sam.ldb -I $self->{setupdir}/schema-map-openldap-2.3 -O $ldapdir/ad.schema >&2"); + + #Now create an LDAP baseDN + system("$self->{bindir}/smbscript $self->{setupdir}/provision $provision_options --ldap-base >&2"); + + my $oldpath = $ENV{PATH}; + $ENV{PATH} = "/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}"; + + unlink($modconf); + open(CONF, ">$modconf"); close(CONF); + + if (system("slaptest -u -f $slapd_conf >&2") != 0) { + open(CONF, ">modconf"); + # enable slapd modules + print " +modulepath /usr/lib/ldap +moduleload back_bdb +moduleload syncprov +"; + close(CONF); + } + + if (system("slaptest -u -f $slapd_conf") == 0) { + system("slapadd -f $slapd_conf < $privatedir/$dnsname.ldif >/dev/null") == 0 or die("slapadd failed"); + } + + system("slaptest -f $slapd_conf >/dev/null") == 0 or + die ("slaptest after database load failed"); + + $ENV{PATH} = $oldpath; + + return $pidfile; +} + sub provision($$$$$) { my ($self, $prefix, $server_role, $domain, $netbiosname) = @_; @@ -324,19 +545,8 @@ my $ldap_uri= "$ldapdir/ldapi"; $ldap_uri =~ s|/|%2F|g; $ldap_uri = "ldapi://$ldap_uri"; - my $provision_aci = ""; # FIXME - - if (not defined($self->{ldap})) { - } elsif ($self->{ldap} eq "openldap") { - mkdir($_) foreach ($ldapdir, "$ldapdir/db", "$ldapdir/db/bdb-logs", - "$ldapdir/db/tmp"); - system("$RealBin/mk-openldap.sh") == 0 or die("Unable to create openldap directories"); - } elsif ($self->{ldap} eq "fedora") { - system("$RealBin/mk-fedora-ds.sh") == 0 or die("Unable to create fedora ds directories"); - push (@provision_options, "--ldap-module=nsuniqueid"); - } - - return { + + my $ret = { KRB5_CONFIG => $krb5_config, PIDDIR => $piddir, SERVER => $server, @@ -347,11 +557,22 @@ REALM => $realm, PASSWORD => $password, LDAPDIR => $ldapdir, - PROVISION_OPTIONS => join(' ', @provision_options), WINBINDD_SOCKET_DIR => $winbindd_socket_dir, NCALRPCDIR => $ncalrpcdir, CONFIGURATION => $configuration }; + + if (not defined($self->{ldap})) { + } elsif ($self->{ldap} eq "openldap") { + $ret->{OPENLDAP_PIDFILE} = $self->mk_openldap($ldapdir, $basedn, $password, $privatedir, $dnsname, $configuration, join(' ', @provision_options)) or die("Unable to create openldap directories"); + } elsif ($self->{ldap} eq "fedora") { + ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora($ldapdir, $basedn, $root, $password, $privatedir, $configuration) or die("Unable to create fedora ds directories"); + push (@provision_options, "--ldap-module=nsuniqueid"); + } + + $ret->{PROVISION_OPTIONS} = join(' ', @provision_options); + + return $ret; } sub provision_member($$$) @@ -390,8 +611,16 @@ sub provision_ldap($$) { my ($self, $envvars) = @_; - system("$self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$envvars->{PROVISION_ACI}\" --ldap-backend=$envvars->{LDAP_URI}") and - die("LDAP PROVISIONING failed: $self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$envvars->{PROVISION_ACI}\" --ldap-backend=$envvars->{LDAP_URI}"); + my $provision_aci = ""; + + if ($self->{ldap} eq "fedora") { + #it is easier to base64 encode this than correctly escape it: + # (targetattr = "*") (version 3.0;acl "full access to all by all";allow (all)(userdn = "ldap:///anyone";);) + $provision_aci = "--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK"; + } + + system("$self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$provision_aci\" --ldap-backend=$envvars->{LDAP_URI}") and + die("LDAP PROVISIONING failed: $self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$provision_aci\" --ldap-backend=$envvars->{LDAP_URI}"); } sub teardown_env($$)
