summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2010-08-26 16:37:24 +1000
committerAndrew Tridgell <tridge@samba.org>2010-08-26 22:50:20 +1000
commitd8f48c7ffc7d1abc37e1681240266240d4f69e7a (patch)
treec0111bd101017526b96dd0aafdc8e7ae84b42a3f /source4
parentda366ba221e326aa1a62160d38b5d2df0b0eb780 (diff)
downloadsamba-d8f48c7ffc7d1abc37e1681240266240d4f69e7a.tar.gz
samba-d8f48c7ffc7d1abc37e1681240266240d4f69e7a.tar.bz2
samba-d8f48c7ffc7d1abc37e1681240266240d4f69e7a.zip
s4-net: added "net rodc preload" command
this command will preload the credentials for an account from the full domain controller Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
-rw-r--r--source4/scripting/python/samba/netcmd/__init__.py2
-rw-r--r--source4/scripting/python/samba/netcmd/rodc.py123
2 files changed, 125 insertions, 0 deletions
diff --git a/source4/scripting/python/samba/netcmd/__init__.py b/source4/scripting/python/samba/netcmd/__init__.py
index 331c543aab..8044454bb6 100644
--- a/source4/scripting/python/samba/netcmd/__init__.py
+++ b/source4/scripting/python/samba/netcmd/__init__.py
@@ -166,3 +166,5 @@ from samba.netcmd.group import cmd_group
commands["group"] = cmd_group()
from samba.netcmd.join import cmd_join
commands["join"] = cmd_join()
+from samba.netcmd.rodc import cmd_rodc
+commands["rodc"] = cmd_rodc()
diff --git a/source4/scripting/python/samba/netcmd/rodc.py b/source4/scripting/python/samba/netcmd/rodc.py
new file mode 100644
index 0000000000..8e3ebbf66d
--- /dev/null
+++ b/source4/scripting/python/samba/netcmd/rodc.py
@@ -0,0 +1,123 @@
+#!/usr/bin/env python
+#
+# rodc related commands
+#
+# Copyright Andrew Tridgell 2010
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+from samba.netcmd import Command, CommandError, Option, SuperCommand
+import samba.getopt as options
+from samba.samdb import SamDB
+from samba.auth import system_session
+import ldb
+from samba.dcerpc import misc, drsuapi
+from samba.credentials import Credentials
+from samba.drs_utils import drs_Replicate
+
+class cmd_rodc_preload(Command):
+ """Preload one account for an RODC"""
+
+ synopsis = "%prog rodc preload <SID|DN|accountname>"
+
+ takes_optiongroups = {
+ "sambaopts": options.SambaOptions,
+ "versionopts": options.VersionOptions,
+ "credopts": options.CredentialsOptions,
+ }
+
+ takes_options = [
+ Option("--server", help="DC to use", type=str),
+ ]
+
+ takes_args = ["account"]
+
+ def get_dn(self, samdb, account):
+ '''work out what DN they meant'''
+
+ # we accept the account in SID, accountname or DN form
+ if account[0:2] == 'S-':
+ res = samdb.search(base="<SID=%s>" % account,
+ expression="objectclass=user",
+ scope=ldb.SCOPE_BASE, attrs=[])
+ elif account.find('=') >= 0:
+ res = samdb.search(base=account,
+ expression="objectclass=user",
+ scope=ldb.SCOPE_BASE, attrs=[])
+ else:
+ res = samdb.search(expression="(&(samAccountName=%s)(objectclass=user))" % account,
+ scope=ldb.SCOPE_SUBTREE, attrs=[])
+ if len(res) != 1:
+ raise Exception("Failed to find account '%s'" % account)
+ return str(res[0]["dn"])
+
+
+ def get_dsServiceName(self, samdb):
+ res = samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
+ return res[0]["dsServiceName"][0]
+
+
+ def run(self, account, sambaopts=None,
+ credopts=None, versionopts=None, server=None):
+
+ if server is None:
+ raise Exception("You must supply a server")
+
+ lp = sambaopts.get_loadparm()
+
+ creds = credopts.get_credentials(lp)
+ if not creds.authentication_requested():
+ print "Using machine account"
+ creds.set_machine_account(lp)
+
+
+ # connect to the remote and local SAMs
+ samdb = SamDB(url="ldap://%s" % server,
+ session_info=system_session(),
+ credentials=creds, lp=lp)
+
+ local_samdb = SamDB(url=None, session_info=system_session(),
+ credentials=creds, lp=lp)
+
+ # work out the source and destination GUIDs
+ dc_ntds_dn = self.get_dsServiceName(samdb)
+ res = samdb.search(base=dc_ntds_dn, scope=ldb.SCOPE_BASE, attrs=["invocationId"])
+ source_dsa_invocation_id = misc.GUID(local_samdb.schema_format_value("objectGUID", res[0]["invocationId"][0]))
+
+ dn = self.get_dn(samdb, account)
+ print "Replicating DN %s" % dn
+
+ destination_dsa_guid = misc.GUID(local_samdb.get_ntds_GUID())
+
+ local_samdb.transaction_start()
+ repl = drs_Replicate("ncacn_ip_tcp:%s[seal,print]" % server, lp, creds, local_samdb)
+ try:
+ repl.replicate(dn, source_dsa_invocation_id, destination_dsa_guid, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET)
+ except RuntimeError, (ecode, estring):
+ if estring == 'WERR_DS_DRA_ACCESS_DENIED':
+ print "Access denied replicating DN %s" % dn
+ local_samdb.transaction_cancel()
+ # how do we fail a net command??
+ return False
+ else:
+ raise
+ local_samdb.transaction_commit()
+
+
+class cmd_rodc(SuperCommand):
+ """RODC commands"""
+
+ subcommands = {}
+ subcommands["preload"] = cmd_rodc_preload()