summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xsource4/scripting/bin/upgradeprovision18
-rwxr-xr-xsource4/scripting/python/samba/upgradehelpers.py24
2 files changed, 38 insertions, 4 deletions
diff --git a/source4/scripting/bin/upgradeprovision b/source4/scripting/bin/upgradeprovision
index f90443318a..a478856165 100755
--- a/source4/scripting/bin/upgradeprovision
+++ b/source4/scripting/bin/upgradeprovision
@@ -56,7 +56,7 @@ from samba.upgradehelpers import (dn_sort, get_paths, newprovision,
update_secrets, CHANGE, ERROR, SIMPLE,
CHANGEALL, GUESS, CHANGESD, PROVISION,
updateOEMInfo, getOEMInfo, update_gpo,
- delta_update_basesamdb)
+ delta_update_basesamdb, update_policyids)
replace=2**FLAG_MOD_REPLACE
add=2**FLAG_MOD_ADD
@@ -1432,8 +1432,8 @@ if __name__ == '__main__':
# 11) B
simple_update_basesamdb(newpaths, paths, names)
ldbs = get_ldbs(paths, creds, session, lp)
- ldbs.startTransactions()
removeProvisionUSN(ldbs.sam)
+ ldbs.startTransactions()
# 12)
schema = Schema(setup_path, names.domainsid, schemadn=str(names.schemadn),
@@ -1497,10 +1497,20 @@ if __name__ == '__main__':
# 22)
if lastProvisionUSNs != None:
updateProvisionUSN(ldbs.sam, minUSN, maxUSN)
+ if opts.full and (names.policyid == None or names.policyid_dc == None):
+ update_policyids(names, ldbs.sam)
if opts.full or opts.resetfileacl:
- update_gpo(paths, ldbs.sam, names, lp, message, 1)
+ try:
+ update_gpo(paths, ldbs.sam, names, lp, message, 1)
+ except ProvisioningError, e:
+ message(ERROR, "The policy for domain controller is missing," \
+ " you should restart upgradeprovision with --full")
else:
- update_gpo(paths, ldbs.sam, names, lp, message, 0)
+ try:
+ update_gpo(paths, ldbs.sam, names, lp, message, 0)
+ except ProvisioningError, e:
+ message(ERROR, "The policy for domain controller is missing," \
+ " you should restart upgradeprovision with --full")
ldbs.groupedCommit()
new_ldbs.groupedCommit()
message(SIMPLE, "Upgrade finished !")
diff --git a/source4/scripting/python/samba/upgradehelpers.py b/source4/scripting/python/samba/upgradehelpers.py
index 78e23a2f87..4cb84ba54f 100755
--- a/source4/scripting/python/samba/upgradehelpers.py
+++ b/source4/scripting/python/samba/upgradehelpers.py
@@ -187,6 +187,26 @@ def get_paths(param, targetdir=None, smbconf=None):
paths = provision_paths_from_lp(lp, lp.get("realm"))
return paths
+def update_policyids(names, samdb):
+ """Update policy ids that could have changed after sam update
+
+ :param names: List of key provision parameters
+ :param samdb: An Ldb object conntected with the sam DB
+ """
+ # policy guid
+ res = samdb.search(expression="(displayName=Default Domain Policy)",
+ base="CN=Policies,CN=System," + str(names.rootdn),
+ scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
+ names.policyid = str(res[0]["cn"]).replace("{","").replace("}","")
+ # dc policy guid
+ res2 = samdb.search(expression="(displayName=Default Domain Controllers" \
+ " Policy)",
+ base="CN=Policies,CN=System," + str(names.rootdn),
+ scope=SCOPE_ONELEVEL, attrs=["cn","displayName"])
+ if len(res2) == 1:
+ names.policyid_dc = str(res2[0]["cn"]).replace("{","").replace("}","")
+ else:
+ names.policyid_dc = None
def find_provision_key_parameters(samdb, secretsdb, idmapdb, paths, smbconf, lp):
"""Get key provision parameters (realm, domain, ...) from a given provision
@@ -562,6 +582,8 @@ def update_secrets(newsecrets_ldb, secrets_ldb, messagefunc):
for att in hashAttrNotCopied.keys():
delta.remove(att)
for att in delta:
+ if att == "msDS-KeyVersionNumber":
+ delta.remove(att)
if att != "dn":
messagefunc(CHANGE,
"Adding/Changing attribute %s to %s" % \
@@ -632,6 +654,8 @@ def update_gpo(paths, samdb, names, lp, message, force=0):
if not os.path.isdir(dir):
create_gpo_struct(dir)
+ if names.policyid_dc == None:
+ raise ProvisioningError("Policy ID for Domain controller is missing")
dir = getpolicypath(paths.sysvol, names.dnsdomain, names.policyid_dc)
if not os.path.isdir(dir):
create_gpo_struct(dir)