The branch, master has been updated via 9cb771a pidl-python: ensure we allocate ref ptrs before use via 3319052 s4-devel: added enumprivs developer script via 057a471 s4-net: fixed docstring on spn command via d8f48c7 s4-net: added "net rodc preload" command via da366ba s4-drs: split out drs utility python functions via 502a531 s4-pyrpc: convert rpc_talloc.py test to unittest framework from d132b3f s3-build: Don't paste the summary.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 9cb771a4a05b3c204a2b0626b22a29874919b3aa Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 17:50:13 2010 +1000 pidl-python: ensure we allocate ref ptrs before use this fixes a crash on samba4.samr.python in the build farm commit 331905216a22989973d00dbc612e90ffa010ff0e Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 17:41:30 2010 +1000 s4-devel: added enumprivs developer script this enumerates all LSA privileges on a server Pair-Programmed-With: Andrew Bartlett <abart...@samba.org> commit 057a47130de16b3e8796a7d2dc92b2ceeddd8ab6 Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 17:32:48 2010 +1000 s4-net: fixed docstring on spn command Pair-Programmed-With: Andrew Bartlett <abart...@samba.org> commit d8f48c7ffc7d1abc37e1681240266240d4f69e7a Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 16:37:24 2010 +1000 s4-net: added "net rodc preload" command this command will preload the credentials for an account from the full domain controller Pair-Programmed-With: Andrew Bartlett <abart...@samba.org> commit da366ba221e326aa1a62160d38b5d2df0b0eb780 Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 14:35:30 2010 +1000 s4-drs: split out drs utility python functions these will be re-used by other net commands commit 502a5313c49baf70e49b6d200acccf2860aa8aba Author: Andrew Tridgell <tri...@samba.org> Date: Thu Aug 26 09:45:16 2010 +1000 s4-pyrpc: convert rpc_talloc.py test to unittest framework This fits in better with our test framework Pair-Programmed-With: Jelmer Vernooij <jel...@samba.org> ----------------------------------------------------------------------- Summary of changes: pidl/lib/Parse/Pidl/Samba4/Python.pm | 6 +- source4/scripting/devel/enumprivs | 58 ++++++++ source4/scripting/python/samba/drs_utils.py | 152 ++++++++++++++++++++ source4/scripting/python/samba/join.py | 150 ++----------------- source4/scripting/python/samba/netcmd/__init__.py | 2 + source4/scripting/python/samba/netcmd/rodc.py | 123 ++++++++++++++++ source4/scripting/python/samba/netcmd/spn.py | 2 +- .../python/samba/tests/dcerpc/rpc_talloc.py | 104 ++++++++------ source4/selftest/tests.sh | 2 +- 9 files changed, 416 insertions(+), 183 deletions(-) create mode 100755 source4/scripting/devel/enumprivs create mode 100644 source4/scripting/python/samba/drs_utils.py create mode 100644 source4/scripting/python/samba/netcmd/rodc.py Changeset truncated at 500 lines: diff --git a/pidl/lib/Parse/Pidl/Samba4/Python.pm b/pidl/lib/Parse/Pidl/Samba4/Python.pm index eb39718..05c11be 100644 --- a/pidl/lib/Parse/Pidl/Samba4/Python.pm +++ b/pidl/lib/Parse/Pidl/Samba4/Python.pm @@ -947,7 +947,11 @@ sub ConvertObjectFromPythonLevel($$$$$$$$$) } # if we want to handle more than one level of pointer in python interfaces # then this is where we would need to allocate it - $self->pidl("$var_name = NULL;"); + if ($l->{POINTER_TYPE} eq "ref") { + $self->pidl("$var_name = talloc_ptrtype($mem_ctx, $var_name);"); + } else { + $self->pidl("$var_name = NULL;"); + } $self->ConvertObjectFromPythonLevel($env, $mem_ctx, $mem_ref, $py_var, $e, $nl, get_value_of($var_name), $fail); if ($l->{POINTER_TYPE} ne "ref") { $self->deindent; diff --git a/source4/scripting/devel/enumprivs b/source4/scripting/devel/enumprivs new file mode 100755 index 0000000..6a04040 --- /dev/null +++ b/source4/scripting/devel/enumprivs @@ -0,0 +1,58 @@ +#!/usr/bin/env python + +# script to enumerate LSA privileges on a server + +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba +import samba.getopt as options +from samba.dcerpc import lsa, security + +def get_display_name(lsaconn, pol_handle, name): + '''get the display name for a privilege''' + string = lsa.String() + string.string = name + + (disp_names, ret_lang) = lsaconn.LookupPrivDisplayName(pol_handle, string, 0x409, 0) + return disp_names.string + + + + +########### main code ########### +if __name__ == "__main__": + parser = OptionParser("enumprivs [options] server") + sambaopts = options.SambaOptions(parser) + credopts = options.CredentialsOptionsDouble(parser) + parser.add_option_group(credopts) + + (opts, args) = parser.parse_args() + + lp = sambaopts.get_loadparm() + creds = credopts.get_credentials(lp) + + if len(args) != 1: + parser.error("You must supply a server") + + if not creds.authentication_requested(): + parser.error("You must supply credentials") + + server = args[0] + + binding_str = "ncacn_np:%s[print]" % server + + lsaconn = lsa.lsarpc(binding_str, lp, creds) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() + + pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), + objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) + + (handle, privs) = lsaconn.EnumPrivs(pol_handle, 0, 100) + for p in privs.privs: + disp_name = get_display_name(lsaconn, pol_handle, p.name.string) + print "0x%08x %31s \"%s\"" % (p.luid.low, p.name.string, disp_name) diff --git a/source4/scripting/python/samba/drs_utils.py b/source4/scripting/python/samba/drs_utils.py new file mode 100644 index 0000000..7b22a84 --- /dev/null +++ b/source4/scripting/python/samba/drs_utils.py @@ -0,0 +1,152 @@ +#!/usr/bin/env python +# +# DRS utility code +# +# Copyright Andrew Tridgell 2010 +# Copyright Andrew Bartlett 2010 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +from samba.dcerpc import drsuapi, misc +from samba.net import Net +import samba, ldb + +class drs_Replicate(): + '''DRS replication calls''' + + def __init__(self, binding_string, lp, creds, samdb): + self.drs = drsuapi.drsuapi(binding_string, lp, creds) + self.drs_handle = self.drs_DsBind() + self.net = Net(creds=creds, lp=lp) + self.samdb = samdb + self.replication_state = self.net.replicate_init(self.samdb, lp, self.drs) + + + def drs_DsBind(self): + '''make a DsBind call, returning the binding handle''' + bind_info = drsuapi.DsBindInfoCtr() + bind_info.length = 28 + bind_info.info = drsuapi.DsBindInfo28() + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7; + bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT; + (info, handle) = self.drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info) + return handle + + + def drs_get_rodc_partial_attribute_set(self): + '''get a list of attributes for RODC replication''' + partial_attribute_set = drsuapi.DsPartialAttributeSet() + partial_attribute_set.version = 1 + + attids = [] + + # the exact list of attids we send is quite critical. Note that + # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING + # to zero them out + schema_dn = self.samdb.get_schema_basedn() + res = self.samdb.search(base=schema_dn, scope=ldb.SCOPE_SUBTREE, + expression="objectClass=attributeSchema", + attrs=["lDAPDisplayName", "systemFlags", + "searchFlags"]) + + for r in res: + ldap_display_name = r["lDAPDisplayName"][0] + if "systemFlags" in r: + system_flags = r["systemFlags"][0] + if (int(system_flags) & (samba.dsdb.DS_FLAG_ATTR_NOT_REPLICATED | + samba.dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED)): + continue + search_flags = r["searchFlags"][0] + if (int(search_flags) & samba.dsdb.SEARCH_FLAG_RODC_ATTRIBUTE): + continue + attid = self.samdb.get_attid_from_lDAPDisplayName(ldap_display_name) + attids.append(int(attid)) + + # the attids do need to be sorted, or windows doesn't return + # all the attributes we need + attids.sort() + partial_attribute_set.attids = attids + partial_attribute_set.num_attids = len(attids) + return partial_attribute_set + + + def replicate(self, dn, source_dsa_invocation_id, destination_dsa_guid, + schema=False, exop=drsuapi.DRSUAPI_EXOP_NONE): + '''replicate a single DN''' + + # setup for a GetNCChanges call + req8 = drsuapi.DsGetNCChangesRequest8() + + req8.destination_dsa_guid = destination_dsa_guid + req8.source_dsa_invocation_id = source_dsa_invocation_id + req8.naming_context = drsuapi.DsReplicaObjectIdentifier() + req8.naming_context.dn = dn.decode("utf-8") + req8.highwatermark = drsuapi.DsReplicaHighWaterMark() + req8.highwatermark.tmp_highest_usn = 0 + req8.highwatermark.reserved_usn = 0 + req8.highwatermark.highest_usn = 0 + req8.uptodateness_vector = None + if exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET: + req8.replica_flags = 0 + else: + req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC | + drsuapi.DRSUAPI_DRS_PER_SYNC | + drsuapi.DRSUAPI_DRS_GET_ANC | + drsuapi.DRSUAPI_DRS_NEVER_SYNCED | + drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) + req8.max_object_count = 402 + req8.max_ndr_size = 402116 + req8.extended_op = exop + req8.fsmo_info = 0 + req8.partial_attribute_set = None + req8.partial_attribute_set_ex = None + req8.mapping_ctr.num_mappings = 0 + req8.mapping_ctr.mappings = None + + if not schema: + req8.partial_attribute_set = self.drs_get_rodc_partial_attribute_set() + + while True: + (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 8, req8) + self.net.replicate_chunk(self.replication_state, level, ctr, schema=schema) + if ctr.more_data == 0: + break + req8.highwatermark.tmp_highest_usn = ctr.new_highwatermark.tmp_highest_usn diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py index c48b53f..b0feee3 100644 --- a/source4/scripting/python/samba/join.py +++ b/source4/scripting/python/samba/join.py @@ -30,6 +30,7 @@ from samba.credentials import Credentials, DONT_USE_KERBEROS from samba.provision import secretsdb_self_join, provision, FILL_DRS, find_setup_dir from samba.net import Net import logging +from samba.drs_utils import drs_Replicate # this makes debugging easier samba.talloc_enable_null_tracking() @@ -86,121 +87,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None, res = samdb.search(base=samdb.get_default_basedn(), scope=ldb.SCOPE_BASE, attrs=["name"]) return res[0]["name"][0] - def do_DsBind(drs): - '''make a DsBind call, returning the binding handle''' - bind_info = drsuapi.DsBindInfoCtr() - bind_info.length = 28 - bind_info.info = drsuapi.DsBindInfo28() - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7; - bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT; - (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info) - return handle - - def get_rodc_partial_attribute_set(ctx): - '''get a list of attributes for RODC replication''' - partial_attribute_set = drsuapi.DsPartialAttributeSet() - partial_attribute_set.version = 1 - - ctx.attids = [] - - # the exact list of attids we send is quite critical. Note that - # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING - # to zero them out - res = ctx.local_samdb.search(base=ctx.schema_dn, scope=ldb.SCOPE_SUBTREE, - expression="objectClass=attributeSchema", - attrs=["lDAPDisplayName", "systemFlags", - "searchFlags"]) - - for r in res: - ldap_display_name = r["lDAPDisplayName"][0] - if "systemFlags" in r: - system_flags = r["systemFlags"][0] - if (int(system_flags) & (samba.dsdb.DS_FLAG_ATTR_NOT_REPLICATED | - samba.dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED)): - continue - search_flags = r["searchFlags"][0] - if (int(search_flags) & samba.dsdb.SEARCH_FLAG_RODC_ATTRIBUTE): - continue - attid = ctx.local_samdb.get_attid_from_lDAPDisplayName(ldap_display_name) - ctx.attids.append(int(attid)) - - # the attids do need to be sorted, or windows doesn't return - # all the attributes we need - ctx.attids.sort() - partial_attribute_set.attids = ctx.attids - partial_attribute_set.num_attids = len(ctx.attids) - return partial_attribute_set - - - def replicate_partition(ctx, dn, schema=False, exop=drsuapi.DRSUAPI_EXOP_NONE): - '''replicate a partition''' - - # setup for a GetNCChanges call - req8 = drsuapi.DsGetNCChangesRequest8() - - req8.destination_dsa_guid = ctx.ntds_guid - req8.source_dsa_invocation_id = misc.GUID(ctx.samdb.get_invocation_id()) - req8.naming_context = drsuapi.DsReplicaObjectIdentifier() - req8.naming_context.dn = dn.decode("utf-8") - req8.highwatermark = drsuapi.DsReplicaHighWaterMark() - req8.highwatermark.tmp_highest_usn = 0 - req8.highwatermark.reserved_usn = 0 - req8.highwatermark.highest_usn = 0 - req8.uptodateness_vector = None - if exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET: - req8.replica_flags = 0 - else: - req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC | - drsuapi.DRSUAPI_DRS_PER_SYNC | - drsuapi.DRSUAPI_DRS_GET_ANC | - drsuapi.DRSUAPI_DRS_NEVER_SYNCED | - drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) - req8.max_object_count = 402 - req8.max_ndr_size = 402116 - req8.extended_op = exop - req8.fsmo_info = 0 - req8.partial_attribute_set = None - req8.partial_attribute_set_ex = None - req8.mapping_ctr.num_mappings = 0 - req8.mapping_ctr.mappings = None - - if not schema: - req8.partial_attribute_set = get_rodc_partial_attribute_set(ctx) - - while True: - (level, ctr) = ctx.drs.DsGetNCChanges(ctx.drs_handle, 8, req8) - ctx.net.replicate_chunk(ctx.replication_state, level, ctr, schema=schema) - if ctr.more_data == 0: - break - req8.highwatermark.tmp_highest_usn = ctr.new_highwatermark.tmp_highest_usn - - def join_add_objects(ctx): '''add the various objects needed for the join''' print "Adding %s" % ctx.acct_dn @@ -317,19 +203,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None, username=ctx.samname) - def join_drs_connect(ctx): - '''connect to DRSUAPI''' - print "Doing DsBind as %s" % ctx.samname - ctx.acct_creds = Credentials() - ctx.acct_creds.guess(ctx.lp) - ctx.acct_creds.set_kerberos_state(DONT_USE_KERBEROS) - ctx.acct_creds.set_username(ctx.samname) - ctx.acct_creds.set_password(ctx.acct_pass) - - ctx.drs = drsuapi.drsuapi("ncacn_ip_tcp:%s[seal,print]" % ctx.server, ctx.lp, ctx.acct_creds) - ctx.drs_handle = do_DsBind(ctx.drs) - - def join_provision(ctx): '''provision the local SAM''' @@ -361,13 +234,21 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None, print "Starting replication" ctx.local_samdb.transaction_start() - ctx.replication_state = ctx.net.replicate_init(ctx.local_samdb, ctx.lp, ctx.drs) + source_dsa_invocation_id = misc.GUID(ctx.samdb.get_invocation_id()) + + acct_creds = Credentials() + acct_creds.guess(ctx.lp) + acct_creds.set_kerberos_state(DONT_USE_KERBEROS) + acct_creds.set_username(ctx.samname) + acct_creds.set_password(ctx.acct_pass) + + repl = drs_Replicate("ncacn_ip_tcp:%s[seal]" % ctx.server, ctx.lp, acct_creds, ctx.local_samdb) - replicate_partition(ctx, ctx.schema_dn, schema=True) - replicate_partition(ctx, ctx.config_dn) - replicate_partition(ctx, ctx.base_dn) - replicate_partition(ctx, ctx.acct_dn, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET) - replicate_partition(ctx, ctx.new_krbtgt_dn, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET) + repl.replicate(ctx.schema_dn, source_dsa_invocation_id, ctx.ntds_guid, schema=True) + repl.replicate(ctx.config_dn, source_dsa_invocation_id, ctx.ntds_guid) + repl.replicate(ctx.base_dn, source_dsa_invocation_id, ctx.ntds_guid) + repl.replicate(ctx.acct_dn, source_dsa_invocation_id, ctx.ntds_guid, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET) + repl.replicate(ctx.new_krbtgt_dn, source_dsa_invocation_id, ctx.ntds_guid, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET) print "Committing SAM database" ctx.local_samdb.transaction_commit() @@ -450,7 +331,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None, cleanup_old_join(ctx) try: join_add_objects(ctx) - join_drs_connect(ctx) join_provision(ctx) join_replicate(ctx) join_finalise(ctx) diff --git a/source4/scripting/python/samba/netcmd/__init__.py b/source4/scripting/python/samba/netcmd/__init__.py index 331c543..8044454 100644 --- a/source4/scripting/python/samba/netcmd/__init__.py +++ b/source4/scripting/python/samba/netcmd/__init__.py @@ -166,3 +166,5 @@ from samba.netcmd.group import cmd_group commands["group"] = cmd_group() from samba.netcmd.join import cmd_join commands["join"] = cmd_join() +from samba.netcmd.rodc import cmd_rodc +commands["rodc"] = cmd_rodc() diff --git a/source4/scripting/python/samba/netcmd/rodc.py b/source4/scripting/python/samba/netcmd/rodc.py new file mode 100644 index 0000000..8e3ebbf --- /dev/null +++ b/source4/scripting/python/samba/netcmd/rodc.py @@ -0,0 +1,123 @@ +#!/usr/bin/env python +# +# rodc related commands +# +# Copyright Andrew Tridgell 2010 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +from samba.netcmd import Command, CommandError, Option, SuperCommand +import samba.getopt as options +from samba.samdb import SamDB +from samba.auth import system_session +import ldb +from samba.dcerpc import misc, drsuapi +from samba.credentials import Credentials +from samba.drs_utils import drs_Replicate + +class cmd_rodc_preload(Command): + """Preload one account for an RODC""" + + synopsis = "%prog rodc preload <SID|DN|accountname>" + + takes_optiongroups = { + "sambaopts": options.SambaOptions, + "versionopts": options.VersionOptions, + "credopts": options.CredentialsOptions, + } + + takes_options = [ + Option("--server", help="DC to use", type=str), + ] + + takes_args = ["account"] + + def get_dn(self, samdb, account): + '''work out what DN they meant''' + + # we accept the account in SID, accountname or DN form + if account[0:2] == 'S-': + res = samdb.search(base="<SID=%s>" % account, + expression="objectclass=user", + scope=ldb.SCOPE_BASE, attrs=[]) + elif account.find('=') >= 0: -- Samba Shared Repository