summaryrefslogtreecommitdiff
path: root/source4/setup
AgeCommit message (Collapse)AuthorFilesLines
2009-09-07s4:pwsettings: Correct off by factor of 10 for ticks.Andrew Kroeger1-4/+4
The tick conversion math was off by a factor of 10 due to the incorrect usage of the "e" notation. The expression "XeY" means "X * (10^Y)", so the correct expression is 1e7 to get the correct adjustment for ticks.
2009-09-07s4:Foreign security principals - Fix them upMatthias Dieter Wallnöfer2-0/+31
I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-07s4:samldb - Major reworkMatthias Dieter Wallnöfer2-53/+0
This fixes up the change of the primary group of a user when using the ADUC console: - When the "primaryGroupId" attribute changes, we have to delete the "member"/"memberOf" attribute reference of the new primary group and add one for the old primary group. - Deny deletion of primary groups according to Windows Server (so we cannot have invalid "primaryGroupID" attributes in our AD). - We cannot add a primary group directly before it isn't a secondary one of a user account. - We cannot add a secondary reference ("member" attribute) when the group has been chosen as primary one. This also removes the LDB templates which are basically overhead now. This should also fix bug #6599.
2009-09-07s4:provision - Change the "provision_users.ldif" file to support the ↵Matthias Dieter Wallnöfer1-26/+35
"samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-09-07s4:setup: Remove display_specifiers.ldif.Andrew Kroeger1-482/+0
This file is no longer needed as the DisplaySpecifiers are now generated from files provided by Microsoft.
2009-09-07s4:setup: Updated comment to reflect new DisplaySpecifiers location.Andrew Kroeger1-1/+3
2009-09-07s4:setup: Change license headers to LDIF comments.Andrew Kroeger5-86/+146
The original license headers provided by Microsoft cannot be parsed as valid LDIF. Changed the license headers to be valid LDIF comments, and added a new header section detailing the exact changes that were made to the original document. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07s4:setup Add DisplaySpecifiers from Microsoft.Andrew Bartlett5-0/+148158
Like the schema, these are provided under the licence at the head of the file, which is not the GPL, but allows us to distribute them with Samba. Andrew Bartlett
2009-09-06s4:pwsettings - Introduce the LDB modify flags in the right wayMatthias Dieter Wallnöfer1-27/+8
We can't emulate them through the LDB changetype flags since they haven't the same constants! The previous behaviour led to huge problems.
2009-08-26s4:provision Ensure that @OPTIONS is mirrored into each partitionAndrew Bartlett2-3/+3
The previous patches to the provision system cut down on the number of reconnects, and disabled the partition handling for part of the process. This means we lost the setting of @OPTIONS as a replicated attribute into the partitions. Andrew Bartlett
2009-08-26s4:provison Add prefixes to ldb using same code a later modify will useAndrew Bartlett1-3/+0
This allows us to test out the code that will do the modify of the prefixMap, and to provide the bindings that may assist a future upgrade script. Andrew Bartlett
2009-08-26s4:provision Only create references to our server DN after the self joinAndrew Bartlett5-9/+29
This will ensure that the GUID can be filled in correctly, and assist us to validate DN targets in the future. Andrew Bartlett
2009-08-19we need the Deleted Objects container for replicationAndrew Tridgell1-0/+6
When objects are deleted they get renamed to this container. The container needs to exist when we provision
2009-08-17s4:python tools - Centralise the lookups for the default domain (root) in ↵Matthias Dieter Wallnöfer2-16/+7
the call "domain_dn" from SamDB
2009-08-17s4: Re-add --ldapadminpass as an option to provisionAndrew Bartlett1-0/+3
This should make setting up LDAP servers more predictable. When not specified, it is random Andrew Bartlett
2009-08-17s4:provision Fixes for Fedora DS schema mapping with full AD schemaEndi Sukma Dewata1-0/+8
2009-08-17s4:provision Rework provision-backend into provisionAndrew Bartlett7-147/+36
This removes a *lot* of duplicated code and the cause of much administrator frustration. We now handle starting and stopping the slapd (at least for the provision), and ensure that there is only one 'right' way to configure the OpenLDAP and Fedora DS backend We now run OpenLDAP in 'cn=config' mode for online configuration. To test what was the provision-backend code, a new --ldap-dryrun-mode option has been added to provision. It quits the provision just before it would start the LDAP binaries Andrew Bartlett
2009-08-17s4:setup Don't manually set @ATTRIBUTES any moreAndrew Bartlett1-32/+0
We now set these as part of the schema load, and we now load the schema before the provision loads the DB, so setting them here is pointless Andrew Bartlett
2009-08-17s4:provision Remove the ACI element from the provision templatesAndrew Bartlett4-17/+14
We need to find a better way to apply this (used in the Fedora DS LDAP backend), not by trying to tunnel this down the module stack. Andrew Bartlett
2009-08-14s4: Correct the parameter logic of the "setpassword" scriptMatthias Dieter Wallnöfer1-7/+4
Either the username or the filter are allowed. If both are given the filter is going to be used due to a higher precedence.
2009-08-11s4:pwsettings script - Fix a small glitchMatthias Dieter Wallnöfer1-5/+10
This fixes the problem with the setting and getting of the "minPwdAge" and "maxPwdAge" attributes. I wanted to handle them in days but forgot to add conversions (from "ticks" (tenth of microsecond) -> "days" and backwards).
2009-08-11s4:AD LDIFs - More refactoringMatthias Dieter Wallnöfer4-221/+167
This commit includes: - Additional static object data in SAMBA 4's AD to start supporting of - forest updates, - lost and found, - quotas on DS, - physical locations, - licensing of sites, - subnets, - policies for WMI, - DNS entries in AD - Reordering of provision*.ldif files to be able to find entries and make future additions easier - Add comments in provision*.ldif files to point out where subentries are located when they are based in other LDIFs - Removations of autogenerated "cn" attributes
2009-08-12s4:provision Allow provision-backend to not run slapd for 'make test'Andrew Bartlett2-6/+10
As the version of OpenLDAP required for Samba4 is fairly new, we don't want to make it a requirement before this python code is run in 'make test'. As such, skip over the actual starting of slapd, but check the rest runs alright (which still validates syntax and other modules). Andrew Bartlett
2009-08-12s4:provision Make the --ol-slapd paramter take the full path to slapdAndrew Bartlett1-1/+1
2009-08-12s4:provision Assume the OpenLDAP backend can find it's own modulesAndrew Bartlett1-2/+0
2009-08-12s4:provision Rework and further automate setup of OpenLDAP backendOliver Liebel2-40/+13
heres the summary of all changes/extensions: - Andrew Bartlett's patch to generate indext - Howard Chu's idea to use nosync on the DB included, but made optional - slaptest-path is not needed any more (slapd -Ttest is used instead) and is therefore removed. slapd-path is now recommended when openldap-backend is chosen. its also used for olc-conversion - slapd-detection is now always done by ldapsearch (ldb module), looking anonymous for objectClass: OpenLDAProotDSE via our ldapi_uri. - if ldapsearch was not successfull, (no slapd listening on our socket) slapd is started via special generated slapdcommand_prov (ldapi_uri only) - slapd-"provision-process" startup is done via pythons subprocess. - the slapd-provision-pid is stored under paths.ldapdir/slapd_provision_pid. - after provision-backend is finished: --- slapd.pid is compared with our stored slapd_provision_pid. if the are unique, slapd.pid will be read out, and the slapd "provison"-process will be shut down. --- proper slapd-shutdown is verified again with ldb-search -> ldapi_uri -> rootDSE. --- if the pids are different or one of the pid-files is missing, slapd will not be shut down, instead an error message is displayed to locate slapd manually --- extended help-messages (relevant to slapd) are always displayed, e.g. the commandline with which slapd has to be started when everythings finished (slapd-commandline is stored under paths.ldapdir/slapd_command_file.txt)) - upgraded the content of the mini-howto (howto-ol-backend-s4.txt)
2009-08-07s4: Add a new script for setting password properties for a domain in a ↵Matthias Dieter Wallnöfer1-0/+202
easier way
2009-08-07s4:setup Remove extra newlines that break OpenLDAP backendOliver Liebel1-2/+0
2009-08-06s4:enableaccount script: Remove a redundant lineMatthias Dieter Wallnöfer1-1/+0
2009-07-27s4:kdc Push context to hdb_samba4 by way of the 'name' of the DBAndrew Bartlett1-16/+1
This overloads the 'name' part of the keytab name to supply a context pointer, and so avoids 3 global variables! To do this, we had to stop putting the entry for kpasswd into the secrets.ldb. (I don't consider this a big loss, and any entry left there by an upgrade will be harmless). Andrew Bartlett
2009-07-27s4:setup add 'cn' attribute to Samba4 local schemaAndrew Bartlett1-0/+4
(We recently made the ms_schema.py script also add this attribute)
2009-07-20[SAMBA 4 directory] Refactoring and clean up of directory structureMatthias Dieter Wallnöfer9-81/+167
- Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-19provision: Remove unused imports.Jelmer Vernooij1-4/+0
2009-07-16s4:dsdb Handle dc/domain/forest functional levels properlyAndrew Bartlett4-8/+5
Rather than have the functional levels scattered in 4 different, unconnected locations, the provision script now sets it, and the rootdse module maintains it's copy only as a cached view onto the original values. We also use the functional level to determine if we should store AES Kerberos keys. Andrew Bartlett
2009-07-02[SAMBA 4 directory] Changes "forceLogoff" and corrects the "subRefs"Matthias Dieter Wallnöfer1-2/+4
- This changes the attribute "forceLogoff" to its' default values according to Windows Server 2003 R2 - Also this corrects the "subRefs" attribute of the base-DN which only refers to direct child partitions (and therefore not to the complete transitive closure)
2009-07-01[SAMBA 4 directory] Corrects the "systemFlags" attributesMatthias Dieter Wallnöfer7-32/+39
Set the values like Windows Server 2003 R2.
2009-07-01[SAMBA 4 directory] Adds the complete "objectclass path" to our self-created ↵Matthias Dieter Wallnöfer1-0/+4
DC object Found after some comparisons against Windows Server 2003 R2.
2009-07-01[SAMBA 4 directory] Adds the object version and "systemFlags" attribute to ↵Matthias Dieter Wallnöfer1-0/+2
the display specifiers The object version showed up in the Windows 2003 Server R2 AD. The "systemFlags" attribute has been set to the right value.
2009-06-29Correct the headers of some SAMBA 4 setup python scriptsMatthias Dieter Wallnöfer3-3/+3
2009-06-18s4: Add tests and 'must change password' flags in setpassword and newuserAndrew Bartlett2-2/+3
In particular, ensure that we can acutally change the password under these circumstances. Andrew Bartlett
2009-06-18s4:setup Add an option to 'setpassword' to force password change at next loginAndrew Bartlett2-1/+5
2009-06-12ad-schema/license.txt: Fix typo.Jelmer Vernooij1-2/+2
2009-06-12Add supportedCapabilities to our rootDSEAndrew Bartlett1-0/+3
This makes AD client tools happier, as they know they are talking to an AD server. per Bug 6229 by Matthieu Patou <mat@matws.net> Andrew Bartlett
2009-05-29s4:setup Remove generated attributes from provision_configurationAndrew Bartlett1-195/+0
Incorrectly added in 95eeef91d3ed7daf8e19029eadcc610caf26db63, and found by OpenLDAP backend tests run by Theodor Chirana <office@adaptcom.ro> Andrew Bartlett
2009-05-26s4:provision: Added ComPartitionSets entry.Andrew Kroeger1-0/+5
Without this entry, opening the COM+ tab under the properties of an OU within ADUC results in the following error: "Unable to retrieve all user properties, 0x80072030"
2009-05-26s4:Added Extended-Rights and subentries.Andrew Kroeger1-0/+881
Without these entries, using the 'Delegate Control' option in ADUC results in the following error message in the Delegation of Control Wizard: "The templates could not be applied. One or more of the templates is not applicable. Click Back and select different templates, and then try again."
2009-05-26s4:provision: Update DisplaySpecifiers (#5139).Andrew Kroeger1-0/+369
The classDisplayName attribute controls the actual text displayed to the user for the top-level menus, so added it to the existing entries. The attributeDisplayNames attribute contains both the text displayed to the user and a mapping to the internal directory attribute name for the particular field, so added these to the existing entries as well. Added new entries as appropriate to properly complete all menus and labels within ADUC.
2009-04-15Enable software rollout through ADMatthias Dieter Wallnöfer1-0/+10
This enables the sofware rollout feature in Samba4 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-04-09we should not be supplying a generated attribute in our schemaAndrew Tridgell1-13/+0
2009-04-03s4:schema Update Windows 2008 schema from Microsoft to latest versionAndrew Bartlett2-5145/+5148