s4-net: added initial implemention of RODC join

This does the join using python code

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

2 files changed, 311 insertions, 6 deletions

diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
new file mode 100644
index 0000000000..6eda582769
--- /dev/null
+++ b/source4/scripting/python/samba/join.py
@@ -0,0 +1,289 @@
+#!/usr/bin/env python
+#
+# python join code
+# Copyright Andrew Tridgell 2010
+# Copyright Andrew Bartlett 2010
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import samba.getopt as options
+from samba.auth import system_session
+from samba.samdb import SamDB
+from samba import gensec
+import ldb, samba
+from samba.ndr import ndr_pack, ndr_unpack, ndr_print
+from samba.dcerpc import security
+from samba.dcerpc import drsuapi, misc, netlogon
+from samba.credentials import Credentials, DONT_USE_KERBEROS
+from samba.provision import secretsdb_self_join
+
+def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None):
+    """join as a RODC"""
+
+    if server is None:
+        raise Exception("You must supply a server for a RODC join")
+
+    def del_noerror(samdb, dn):
+        try:
+            samdb.delete(dn)
+            print "Deleted %s" % dn
+        except:
+            pass
+
+    def cleanup_old_join(samdb, acct_dn, server_dn, ntds_dn,
+                         krbtgt_dn, connection_dn, topology_dn):
+        try:
+            # find the krbtgt link
+            res = samdb.search(base=acct_dn, scope=ldb.SCOPE_BASE, attrs=["msDS-krbTgtLink"])
+            del_noerror(samdb, acct_dn)
+            del_noerror(samdb, connection_dn)
+            del_noerror(samdb, krbtgt_dn)
+            del_noerror(samdb, ntds_dn)
+            del_noerror(samdb, server_dn)
+            del_noerror(samdb, topology_dn)
+            new_krbtgt_dn = res[0]["msDS-Krbtgtlink"][0]
+            del_noerror(samdb, new_krbtgt_dn)
+        except:
+            pass
+
+    def get_dsServiceName(samdb):
+        res = samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
+        return res[0]["dsServiceName"][0]
+
+    def get_dnsHostName(samdb):
+        res = samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dnsHostName"])
+        return res[0]["dnsHostName"][0]
+
+    def get_mysid(samdb):
+        res = samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["tokenGroups"])
+        binsid = res[0]["tokenGroups"][0]
+        return samdb.schema_format_value("objectSID", binsid)
+
+    def do_DsBind(drs):
+        '''make a DsBind call, returning the binding handle'''
+        bind_info = drsuapi.DsBindInfoCtr()
+        bind_info.length = 28
+        bind_info.info = drsuapi.DsBindInfo28()
+        bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
+	bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
+        (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
+        return handle
+
+
+    creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL)
+
+    samdb = SamDB(url="ldap://%s" % server,
+                  session_info=system_session(),
+                  credentials=creds, lp=lp)
+
+    myname = netbios_name
+    samname = "%s$" % myname
+    base_dn = str(samdb.get_default_basedn())
+    domsid = samdb.get_domain_sid()
+    dc_ntds_dn = get_dsServiceName(samdb)
+    dc_dnsHostName = get_dnsHostName(samdb)
+    acct_pass = samba.generate_random_password(12, 32)
+    mysid = get_mysid(samdb)
+
+    # work out the DNs of all the objects we will be adding
+    admin_dn = "<SID=%s>" % mysid
+    krbtgt_dn = "CN=krbtgt_%s,CN=Users,%s" % (myname, base_dn)
+    server_dn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (myname, site, samdb.get_config_basedn())
+    ntds_dn = "CN=NTDS Settings,%s" % server_dn
+    connection_dn = "CN=RODC Connection (FRS),%s" % ntds_dn
+    topology_dn = "CN=%s,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,%s" % (myname, base_dn)
+
+    never_reveal_sid = "%s-572" % domsid;
+    reveal_sid = "%s-571" % domsid;
+
+    dnsdomain = ldb.Dn(samdb, base_dn).canonical_str().split('/')[0]
+    dnshostname = "%s.%s" % (myname, dnsdomain)
+
+    acct_dn = "CN=%s,OU=Domain Controllers,%s" % (myname, base_dn)
+
+    cleanup_old_join(samdb, acct_dn, server_dn, ntds_dn,
+                          krbtgt_dn, connection_dn, topology_dn)
+
+    print "Adding %s" % acct_dn
+    rec = {
+        "dn" : acct_dn,
+        "objectClass": "computer",
+        "displayname": samname,
+        "samaccountname" : samname,
+        "useraccountcontrol" : "83890176",
+        "managedby" : admin_dn,
+        "dnshostname" : dnshostname,
+        "msDS-NeverRevealGroup" : "<SID=%s>" % never_reveal_sid,
+        "msDS-RevealOnDemandGroup" : "<SID=%s>" % reveal_sid}
+    samdb.add(rec)
+
+    print "Adding %s" % krbtgt_dn
+    rec = {
+        "dn" : krbtgt_dn,
+        "objectclass" : "user",
+        "useraccountcontrol" : "514",
+        "showinadvancedviewonly" : "TRUE",
+        "description" : "tricky account"}
+    samdb.add(rec, ["rodc_join:1:1"])
+
+    # now we need to search for the samAccountName attribute on the krbtgt DN,
+    # as this will have been magically set to the krbtgt number
+    res = samdb.search(base=krbtgt_dn, scope=ldb.SCOPE_BASE, attrs=["samAccountName"])
+    krbtgt_name = res[0]["samAccountName"][0]
+
+    print "Got krbtgt_name=%s" % krbtgt_name
+
+    m = ldb.Message()
+    m.dn = ldb.Dn(samdb, acct_dn)
+    m["msDS-krbTgtLink"] = ldb.MessageElement(krbtgt_dn,
+                                              ldb.FLAG_MOD_REPLACE, "msDS-krbTgtLink")
+    samdb.modify(m)
+
+    new_krbtgt_dn = "CN=%s,CN=Users,%s" % (krbtgt_name, base_dn)
+    print "Renaming %s to %s" % (krbtgt_dn, new_krbtgt_dn)
+    samdb.rename(krbtgt_dn, new_krbtgt_dn)
+
+    print "Adding %s" % server_dn
+    rec = {
+        "dn": server_dn,
+        "objectclass" : "server",
+        "systemFlags" : "1375731712",
+        "serverReference" : acct_dn,
+        "dnsHostName" : dnshostname}
+    samdb.add(rec)
+
+    print "Adding %s" % ntds_dn
+    rec = {
+        "dn" : ntds_dn,
+        "objectclass" : "nTDSDSA",
+        "objectCategory" : "CN=NTDS-DSA-RO,%s" % samdb.get_schema_basedn(),
+        "systemFlags" : "33554432",
+        "dMDLocation" : str(samdb.get_schema_basedn()),
+        "options" : "37",
+        "msDS-Behavior-Version" : "4",
+        "msDS-HasDomainNCs" : str(samdb.get_default_basedn()),
+        "msDS-HasFullReplicaNCs" : [ str(samdb.get_default_basedn()),
+                                     str(samdb.get_config_basedn()),
+                                     str(samdb.get_schema_basedn()) ]}
+    samdb.add(rec, ["rodc_join:1:1"])
+
+    print "Adding %s" % connection_dn
+    rec = {
+        "dn" : connection_dn,
+        "objectclass" : "nTDSConnection",
+        "enabledconnection" : "TRUE",
+        "options" : "65",
+        "fromServer" : dc_ntds_dn}
+    samdb.add(rec)
+
+    print "Adding %s" % topology_dn
+    rec = {
+        "dn" : topology_dn,
+        "objectclass" : "msDFSR-Member",
+        "msDFSR-ComputerReference" : acct_dn,
+        "serverReference" : ntds_dn}
+    samdb.add(rec)
+
+    print "Adding HOST SPNs to %s" % acct_dn
+    m = ldb.Message()
+    m.dn = ldb.Dn(samdb, acct_dn)
+    SPNs = [ "HOST/%s" % myname,
+             "HOST/%s" % dnshostname ]
+    m["servicePrincipalName"] = ldb.MessageElement(SPNs,
+                                                   ldb.FLAG_MOD_ADD,
+                                                   "servicePrincipalName")
+    samdb.modify(m)
+
+    print "Adding RestrictedKrbHost SPNs to %s" % acct_dn
+    m = ldb.Message()
+    m.dn = ldb.Dn(samdb, acct_dn)
+    SPNs = [ "RestrictedKrbHost/%s" % myname,
+             "RestrictedKrbHost/%s" % dnshostname ]
+    m["servicePrincipalName"] = ldb.MessageElement(SPNs,
+                                                   ldb.FLAG_MOD_ADD,
+                                                   "servicePrincipalName")
+    samdb.modify(m)
+
+    print "Setting account password for %s" % samname
+    samdb.setpassword("(&(objectClass=user)(sAMAccountName=%s))" % samname,
+                           acct_pass,
+                           force_change_at_next_login=False,
+                           username=samname)
+
+    print "Enabling account %s" % acct_dn
+    # weird, its already enabled, but w2k8r2 disables then re-enables again
+    m = ldb.Message()
+    m.dn = ldb.Dn(samdb, acct_dn)
+    m["userAccountControl"] = ldb.MessageElement("83890178",
+                                                 ldb.FLAG_MOD_REPLACE,
+                                                 "userAccountControl")
+    samdb.modify(m)
+
+    m["userAccountControl"] = ldb.MessageElement("83890176",
+                                                 ldb.FLAG_MOD_REPLACE,
+                                                 "userAccountControl")
+    samdb.modify(m)
+
+    print "Doing DsBind as %s" % samname
+
+    acct_creds = Credentials()
+    acct_creds.guess(lp)
+    acct_creds.set_kerberos_state(DONT_USE_KERBEROS)
+    acct_creds.set_username(samname)
+    acct_creds.set_password(acct_pass)
+
+    drs = drsuapi.drsuapi("ncacn_ip_tcp:w2k8[seal,print]", lp, acct_creds)
+    drs_handle = do_DsBind(drs)
+    print "DRS Handle: %s" % drs_handle
+
+    print "Calling DsRGetDCNameEx2"
+    netr = netlogon.netlogon("ncacn_np:w2k8[print]", lp, acct_creds)
+    dcname = netr.netr_DsRGetDCNameEx2(server_unc=dc_dnsHostName.decode("utf-8"),
+                                            client_account=None,
+                                            mask=0,
+                                            domain_name=dnsdomain.decode("utf-8"),
+                                            domain_guid=None, site_name=None, flags=0x40001020)
+
+    print "Calling secrets self join"
+    secretsdb_self_join()
+
+    print "Note: RODC join is a work in progress - replication not done"
+    #print ndr_print(dcname)
diff --git a/source4/scripting/python/samba/netcmd/join.py b/source4/scripting/python/samba/netcmd/join.py
index 4f04b77abf..23ae412df5 100644
--- a/source4/scripting/python/samba/netcmd/join.py
+++ b/source4/scripting/python/samba/netcmd/join.py
@@ -21,14 +21,14 @@
 import samba.getopt as options
 
 from samba.net import Net, LIBNET_JOIN_AUTOMATIC
-from samba.netcmd import Command, CommandError
+from samba.netcmd import Command, CommandError, Option
 from samba.dcerpc.misc import SEC_CHAN_WKSTA, SEC_CHAN_BDC
-
+from samba.join import join_rodc
 
 class cmd_join(Command):
     """Joins domain as either member or backup domain controller [server connection needed]"""
 
-    synopsis = "%prog join <domain> [BDC | MEMBER] [options]"
+    synopsis = "%prog join <domain> [BDC | MEMBER | RODC] [options]"
 
     takes_optiongroups = {
         "sambaopts": options.SambaOptions,
@@ -36,13 +36,23 @@ class cmd_join(Command):
         "credopts": options.CredentialsOptions,
     }
 
+    takes_options = [
+        Option("--server", help="DC to join", type=str),
+        Option("--site", help="site to join", type=str),
+        ]
+
     takes_args = ["domain", "role?"]
 
     def run(self, domain, role=None, sambaopts=None, credopts=None,
-            versionopts=None):
+            versionopts=None, server=None, site=None):
         lp = sambaopts.get_loadparm()
         creds = credopts.get_credentials(lp)
         net = Net(creds, lp)
+
+        if site is None:
+            site = "Default-First-Site-Name"
+
+        netbios_name = lp.get("netbios name")
         
         if role is None:
             secure_channel_type = SEC_CHAN_WKSTA
@@ -50,10 +60,16 @@ class cmd_join(Command):
             secure_channel_type = SEC_CHAN_BDC
         elif role == "MEMBER":
             secure_channel_type = SEC_CHAN_WKSTA
+        elif role == "RODC":
+            join_rodc(server=server, creds=creds, lp=lp,
+                      site=site, netbios_name=netbios_name)
+            return
         else:
-            raise CommandError("Invalid role %s (possible values: MEMBER, BDC)" % role)
+            raise CommandError("Invalid role %s (possible values: MEMBER, BDC, RODC)" % role)
 
         (join_password, sid, domain_name) = net.join(domain,
-            lp.get("netbios name"), secure_channel_type, LIBNET_JOIN_AUTOMATIC)
+                                                     netbios_name,
+                                                     secure_channel_type,
+                                                     LIBNET_JOIN_AUTOMATIC)
 
         self.outf.write("Joined domain %s (%s)\n" % (domain_name, sid))