From bf4c652af7824478ca3f029cc653aace3da1022f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 3 Jan 2007 03:19:02 +0000 Subject: r20492: Add in instructions/sample LDIF to setup Fedora DS as a backend. Add a new module entrypoint to handle the new, interesting and different mappings required for Fedora DS. Andrew Bartlett (This used to be commit 600c7f1a68c175b835ce45d13794a6f66bcc8493) --- source4/dsdb/samdb/ldb_modules/entryUUID.c | 250 ++++++++++++++++++++++++++++- source4/scripting/libjs/provision.js | 1 + source4/setup/fedora-ds-init.ldif | 26 +++ source4/setup/provision | 6 +- 4 files changed, 280 insertions(+), 3 deletions(-) create mode 100644 source4/setup/fedora-ds-init.ldif diff --git a/source4/dsdb/samdb/ldb_modules/entryUUID.c b/source4/dsdb/samdb/ldb_modules/entryUUID.c index 9bd4c499fe..7cd79cb730 100644 --- a/source4/dsdb/samdb/ldb_modules/entryUUID.c +++ b/source4/dsdb/samdb/ldb_modules/entryUUID.c @@ -83,6 +83,50 @@ static struct ldb_val guid_always_string(struct ldb_module *module, TALLOC_CTX * return out; } +static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val) +{ + struct GUID guid; + NTSTATUS status = NS_GUID_from_string((char *)val->data, &guid); + struct ldb_val out = data_blob(NULL, 0); + + if (!NT_STATUS_IS_OK(status)) { + return out; + } + status = ndr_push_struct_blob(&out, ctx, &guid, + (ndr_push_flags_fn_t)ndr_push_GUID); + if (!NT_STATUS_IS_OK(status)) { + return out; + } + + return out; +} + +static struct ldb_val guid_ns_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val) +{ + NTSTATUS status; + struct ldb_val out = data_blob(NULL, 0); + if (val->length >= 32 && val->data[val->length] == '\0') { + struct GUID guid; + GUID_from_string((char *)val->data, &guid); + out = data_blob_string_const(NS_GUID_string(ctx, &guid)); + } else { + struct GUID *guid_p; + guid_p = talloc(ctx, struct GUID); + if (guid_p == NULL) { + return out; + } + status = ndr_pull_struct_blob(val, guid_p, guid_p, + (ndr_pull_flags_fn_t)ndr_pull_GUID); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(guid_p); + return out; + } + out = data_blob_string_const(NS_GUID_string(ctx, guid_p)); + talloc_free(guid_p); + } + return out; +} + /* The backend holds binary sids, so just copy them back */ static struct ldb_val val_copy(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val) { @@ -411,6 +455,154 @@ const char * const wildcard_attributes[] = { NULL }; +const struct ldb_map_attribute nsuniqueid_attributes[] = +{ + /* objectGUID */ + { + .local_name = "objectGUID", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "nsuniqueid", + .convert_local = guid_ns_string, + .convert_remote = encode_ns_guid, + }, + }, + }, + /* objectSid */ + { + .local_name = "objectSid", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "objectSid", + .convert_local = sid_always_binary, + .convert_remote = val_copy, + }, + }, + }, + { + .local_name = "whenCreated", + .type = MAP_RENAME, + .u = { + .rename = { + .remote_name = "createTimestamp" + } + } + }, + { + .local_name = "whenChanged", + .type = MAP_RENAME, + .u = { + .rename = { + .remote_name = "modifyTimestamp" + } + } + }, + { + .local_name = "sambaPassword", + .type = MAP_RENAME, + .u = { + .rename = { + .remote_name = "userPassword" + } + } + }, + { + .local_name = "allowedChildClassesEffective", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "allowedChildClassesEffective", + .convert_local = class_to_oid, + .convert_remote = class_from_oid, + }, + }, + }, + { + .local_name = "objectCategory", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "objectCategory", + .convert_local = objectCategory_always_dn, + .convert_remote = val_copy, + }, + }, + }, + { + .local_name = "distinguishedName", + .type = MAP_RENAME, + .u = { + .rename = { + .remote_name = "entryDN" + } + } + }, + { + .local_name = "groupType", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "groupType", + .convert_local = normalise_to_signed32, + .convert_remote = val_copy, + }, + } + }, + { + .local_name = "sAMAccountType", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "sAMAccountType", + .convert_local = normalise_to_signed32, + .convert_remote = val_copy, + }, + } + }, + { + .local_name = "usnChanged", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "modifyTimestamp", + .convert_local = usn_to_timestamp, + .convert_remote = timestamp_to_usn, + }, + }, + }, + { + .local_name = "usnCreated", + .type = MAP_CONVERT, + .u = { + .convert = { + .remote_name = "createTimestamp", + .convert_local = usn_to_timestamp, + .convert_remote = timestamp_to_usn, + }, + }, + }, + { + .local_name = "*", + .type = MAP_KEEP, + }, + { + .local_name = NULL, + } +}; + +/* These things do not show up in wildcard searches in OpenLDAP, but + * we need them to show up in the AD-like view */ +const char * const nsuniqueid_wildcard_attributes[] = { + "objectGUID", + "whenCreated", + "whenChanged", + "usnCreated", + "usnChanged", + NULL +}; + static struct ldb_dn *find_schema_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx) { const char *rootdse_attrs[] = {"schemaNamingContext", NULL}; @@ -582,6 +774,41 @@ static int entryUUID_init(struct ldb_module *module) return ldb_next_init(module); } +/* the context init function */ +static int nsuniqueid_init(struct ldb_module *module) +{ + int ret; + struct map_private *map_private; + struct entryUUID_private *entryUUID_private; + struct ldb_dn *schema_dn; + + ret = ldb_map_init(module, nsuniqueid_attributes, NULL, nsuniqueid_wildcard_attributes, NULL); + if (ret != LDB_SUCCESS) + return ret; + + map_private = talloc_get_type(module->private_data, struct map_private); + + entryUUID_private = talloc_zero(map_private, struct entryUUID_private); + map_private->caller_private = entryUUID_private; + + schema_dn = find_schema_dn(module->ldb, map_private); + if (!schema_dn) { + /* Perhaps no schema yet */ + return LDB_SUCCESS; + } + + ret = fetch_objectclass_schema(module->ldb, schema_dn, entryUUID_private, + &entryUUID_private->objectclass_res); + if (ret != LDB_SUCCESS) { + ldb_asprintf_errstring(module->ldb, "Failed to fetch objectClass schema elements: %s\n", ldb_errstring(module->ldb)); + return ret; + } + + ret = find_base_dns(module, entryUUID_private); + + return ldb_next_init(module); +} + static int get_seq(struct ldb_context *ldb, void *context, struct ldb_reply *ares) { @@ -678,9 +905,16 @@ static struct ldb_module_ops entryUUID_ops = { .sequence_number = entryUUID_sequence_number }; +static struct ldb_module_ops nsuniqueid_ops = { + .name = "nsuniqueid", + .init_context = nsuniqueid_init, + .sequence_number = entryUUID_sequence_number +}; + /* the init function */ int ldb_entryUUID_module_init(void) { + int ret; struct ldb_module_ops ops = ldb_map_get_ops(); entryUUID_ops.add = ops.add; entryUUID_ops.modify = ops.modify; @@ -688,5 +922,19 @@ int ldb_entryUUID_module_init(void) entryUUID_ops.rename = ops.rename; entryUUID_ops.search = ops.search; entryUUID_ops.wait = ops.wait; - return ldb_register_module(&entryUUID_ops); + ret = ldb_register_module(&entryUUID_ops); + + if (ret) { + return ret; + } + + nsuniqueid_ops.add = ops.add; + nsuniqueid_ops.modify = ops.modify; + nsuniqueid_ops.del = ops.del; + nsuniqueid_ops.rename = ops.rename; + nsuniqueid_ops.search = ops.search; + nsuniqueid_ops.wait = ops.wait; + ret = ldb_register_module(&nsuniqueid_ops); + + return ret; } diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js index c14a9da55f..96e55bc4ae 100644 --- a/source4/scripting/libjs/provision.js +++ b/source4/scripting/libjs/provision.js @@ -698,6 +698,7 @@ function provision_guess() rdn_list = split(".", subobj.DNSDOMAIN); subobj.BASEDN = "DC=" + join(",DC=", rdn_list); subobj.LDAPBACKEND = "users.ldb"; + subobj.LDAPMODULE = "entryUUID"; subobj.LDAPMODULES = "objectguid"; subobj.EXTENSIBLEOBJECT = "# no objectClass: extensibleObject for local ldb"; return subobj; diff --git a/source4/setup/fedora-ds-init.ldif b/source4/setup/fedora-ds-init.ldif new file mode 100644 index 0000000000..f7d350c550 --- /dev/null +++ b/source4/setup/fedora-ds-init.ldif @@ -0,0 +1,26 @@ +# These entries need to be added to get the container for the +# provision to be aimed at. + +dn: cn="dc=tammy,dc=abartlet,dc=net",cn=mapping tree,cn=config +objectclass: top +objectclass: extensibleObject +objectclass: nsMappingTree +nsslapd-state: backend +nsslapd-backend: UserData +cn: dc=tammy,dc=abartlet,dc=net + +dn: cn=UserData,cn=ldbm database,cn=plugins,cn=config +objectclass: extensibleObject +objectclass: nsBackendInstance +nsslapd-suffix: dc=tammy,dc=abartlet,dc=net + +# Generate 99_ad.ldif with + +# bin/ad2oLschema -I setup/fedora-ds-init.ldif --option=convert:target=fedora-ds -O /opt/fedora-ds/slapd-piglett/config/schema/99_ad.ldif -H /data/samba/samba4/prefix/private/sam.ldb +# Then install 00_staish_core.ldif 30ns-common.ldif and 99_ad.ldif +# into /opt/fedora-ds/slapd-piglett/config/schema/ +# + + +# provision with --ldap-backend=ldap://localhost:4389 --ldap-module=nsuniqueid + diff --git a/source4/setup/provision b/source4/setup/provision index 163cb93274..8912b28792 100755 --- a/source4/setup/provision +++ b/source4/setup/provision @@ -30,7 +30,8 @@ options = GetOptions(ARGV, 'quiet', 'blank', 'ldap-base', - 'ldap-backend=s'); + 'ldap-backend=s', + 'ldap-module=s'); if (options == undefined) { println("Failed to parse options"); @@ -79,6 +80,7 @@ provision [options] --blank do not add users or groups, just the structure --ldap-base output only an LDIF file, suitable for creating an LDAP baseDN --ldap-backend LDAPSERVER LDAP server to use for this provision + --ldap-module= MODULE LDB mapping module to use for the LDAP backend You must provide at least a realm and domain @@ -112,7 +114,7 @@ for (r in options) { } if (options["ldap-backend"] != undefined) { - subobj["LDAPMODULES"] = "entryUUID,paged_searches"; + subobj["LDAPMODULES"] = subobj["LDAPMODULE"] + ",paged_searches"; } var blank = (options["blank"] != undefined); -- cgit