From f77c4100842f8c5357fa90822e04319810a04b8d Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Thu, 15 Jun 2006 18:04:24 +0000 Subject: r16264: Add, but do not yet enable, the partitions module. This required changes to the rootDSE module, to allow registration of partitions. In doing so I renamed the 'register' operation to 'register_control' and 'register_partition', which changed a few more modules. Due to the behaviour of certain LDAP servers, we create the baseDN entry in two parts: Firstly, we allow the admin to export a simple LDIF file to add to their server. Then we perform a modify to add the remaining attributes. To delete all users in partitions, we must now search and delete all objects in the partition, rather than a simple search from the root. Against LDAP, this might not delete all objects, so we allow this to fail. In testing, we found that the 'Domain Controllers' container was misnamed, and should be 'CN=', rather than 'OU='. To avoid the Templates being found in default searches, they have been moved to CN=Templates from CN=Templates,${BASEDN}. Andrew Bartlett (This used to be commit b49a4fbb57f10726bd288fdc9fc95c0cbbe9094a) --- source4/setup/provision | 15 ++++- source4/setup/provision.ldif | 43 ++------------ source4/setup/provision_basedn.ldif | 8 +++ source4/setup/provision_basedn_modify.ldif | 90 ++++++++++++++++++++++++++++++ source4/setup/provision_templates.ldif | 19 +++---- source4/setup/provision_users.ldif | 2 +- 6 files changed, 124 insertions(+), 53 deletions(-) create mode 100644 source4/setup/provision_basedn.ldif create mode 100644 source4/setup/provision_basedn_modify.ldif (limited to 'source4/setup') diff --git a/source4/setup/provision b/source4/setup/provision index d6497cf180..a58f4a5dce 100755 --- a/source4/setup/provision +++ b/source4/setup/provision @@ -28,7 +28,9 @@ options = GetOptions(ARGV, 'wheel=s', 'users=s', 'quiet', - 'blank'); + 'blank', + 'ldap-base', + 'ldap-backend=s'); if (options == undefined) { println("Failed to parse options"); @@ -75,6 +77,8 @@ provision [options] --users GROUPNAME choose 'users' group --quiet Be quiet --blank do not add users or groups, just the structure + --ldap-base output only an LDIF file, suitable for creating an LDAP baseDN + --ldap-backend LDAPSERVER LDAP server to use for this provision You must provide at least a realm and domain @@ -108,6 +112,7 @@ for (r in options) { } var blank = (options["blank"] != undefined); +var ldapbase = (options["ldap-base"] != undefined); if (!provision_validate(subobj, message)) { return -1; @@ -118,7 +123,11 @@ var creds = options.get_credentials(); var paths = provision_default_paths(subobj); message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM); message("Using administrator password: %s\n", subobj.ADMINPASS); -provision(subobj, message, blank, paths, system_session, creds); -provision_dns(subobj, message, paths, system_session, creds); +if (ldapbase) { + provision_ldapbase(subobj, message, paths); +} else { + provision(subobj, message, blank, paths, system_session, creds); + provision_dns(subobj, message, paths, system_session, creds); +} message("All OK\n"); return 0; diff --git a/source4/setup/provision.ldif b/source4/setup/provision.ldif index f59d92e769..c047d6d93a 100644 --- a/source4/setup/provision.ldif +++ b/source4/setup/provision.ldif @@ -1,38 +1,3 @@ -############################### -# Domain Naming Context -############################### -dn: ${BASEDN} -objectClass: top -objectClass: domain -objectClass: domainDNS -dnsDomain: ${DNSDOMAIN} -dc: ${RDN_DC} -objectGUID: ${DOMAINGUID} -creationTime: ${NTTIME} -forceLogoff: 9223372036854775808 -lockoutDuration: -18000000000 -lockOutObservationWindow: -18000000000 -lockoutThreshold: 0 -maxPwdAge: -37108517437440 -minPwdAge: 0 -minPwdLength: 7 -modifiedCountAtLastProm: 0 -nextRid: 1000 -pwdProperties: 1 -pwdHistoryLength: 24 -objectSid: ${DOMAINSID} -oEMInformation: Provisioned by Samba4: ${LDAPTIME} -serverState: 1 -nTMixedDomain: 1 -msDS-Behavior-Version: 0 -ridManagerReference: CN=RID Manager$,CN=System,${BASEDN} -uASCompat: 1 -modifiedCount: 1 -objectCategory: CN=Domain-DNS,CN=Schema,CN=Configuration,${BASEDN} -isCriticalSystemObject: TRUE -subRefs: CN=Configuration,${BASEDN} -subRefs: CN=Schema,CN=Configuration,${BASEDN} - dn: CN=Users,${BASEDN} objectClass: top objectClass: container @@ -57,15 +22,15 @@ systemFlags: 2348810240 objectCategory: CN=Container,CN=Schema,CN=Configuration,${BASEDN} isCriticalSystemObject: TRUE -dn: OU=Domain Controllers,${BASEDN} +dn: CN=Domain Controllers,${BASEDN} objectClass: top -objectClass: organizationalUnit -ou: Domain Controllers +objectClass: container +cn: Domain Controllers description: Default container for domain controllers instanceType: 4 showInAdvancedViewOnly: FALSE systemFlags: 2348810240 -objectCategory: CN=Organizational-Unit,CN=Schema,CN=Configuration,${BASEDN} +objectCategory: CN=Container,CN=Schema,CN=Configuration,${BASEDN} isCriticalSystemObject: TRUE dn: CN=ForeignSecurityPrincipals,${BASEDN} diff --git a/source4/setup/provision_basedn.ldif b/source4/setup/provision_basedn.ldif new file mode 100644 index 0000000000..4cf850e728 --- /dev/null +++ b/source4/setup/provision_basedn.ldif @@ -0,0 +1,8 @@ +################################ +## Domain Naming Context +################################ +dn: ${BASEDN} +objectClass: top +objectClass: domain +dc: ${RDN_DC} + diff --git a/source4/setup/provision_basedn_modify.ldif b/source4/setup/provision_basedn_modify.ldif new file mode 100644 index 0000000000..91a8d66f24 --- /dev/null +++ b/source4/setup/provision_basedn_modify.ldif @@ -0,0 +1,90 @@ +############################### +# Domain Naming Context +############################### +dn: ${BASEDN} +changetype: modify +replace: objectClass +objectClass: top +objectClass: domain +objectClass: domainDNS +- +replace: dnsDomain +dnsDomain: ${DNSDOMAIN} +- +replace: dc +dc: ${RDN_DC} +- +replace: objectGUID +objectGUID: ${DOMAINGUID} +- +replace: creationTime +creationTime: ${NTTIME} +- +replace: forceLogoff +forceLogoff: 9223372036854775808 +- +replace: lockoutDuration +lockoutDuration: -18000000000 +- +replace: lockOutObservationWindow +lockOutObservationWindow: -18000000000 +- +replace: lockoutThreshold +lockoutThreshold: 0 +- +replace: maxPwdAge +maxPwdAge: -37108517437440 +- +replace: minPwdAge +minPwdAge: 0 +- +replace: minPwdLength +minPwdLength: 7 +- +replace: modifiedCountAtLastProm +modifiedCountAtLastProm: 0 +- +replace: nextRid +nextRid: 1000 +- +replace: pwdProperties +pwdProperties: 1 +- +replace: pwdHistoryLength +pwdHistoryLength: 24 +- +replace: objectSid +objectSid: ${DOMAINSID} +- +replace: oEMInformation +oEMInformation: Provisioned by Samba4: ${LDAPTIME} +- +replace: serverState +serverState: 1 +- +replace: nTMixedDomain +nTMixedDomain: 1 +- +replace: msDS-Behavior-Version +msDS-Behavior-Version: 0 +- +replace: ridManagerReference +ridManagerReference: CN=RID Manager$,CN=System,${BASEDN} +- +replace: uASCompat +uASCompat: 1 +- +replace: modifiedCount +modifiedCount: 1 +- +replace: objectCategory +objectCategory: CN=Domain-DNS,CN=Schema,CN=Configuration,${BASEDN} +- +replace: isCriticalSystemObject +isCriticalSystemObject: TRUE +- +replace: subRefs +subRefs: CN=Configuration,${BASEDN} +subRefs: CN=Schema,CN=Configuration,${BASEDN} +- + diff --git a/source4/setup/provision_templates.ldif b/source4/setup/provision_templates.ldif index 11501a5b42..3b70d42520 100644 --- a/source4/setup/provision_templates.ldif +++ b/source4/setup/provision_templates.ldif @@ -1,4 +1,4 @@ -dn: CN=Templates,${BASEDN} +dn: CN=Templates objectClass: top objectClass: container cn: Templates @@ -14,7 +14,7 @@ isCriticalSystemObject: TRUE # with what classes you put them in ### -dn: CN=TemplateUser,CN=Templates,${BASEDN} +dn: CN=TemplateUser,CN=Templates objectClass: top objectClass: person objectClass: organizationalPerson @@ -36,7 +36,7 @@ logonCount: 0 sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,${BASEDN} -dn: CN=TemplateComputer,CN=Templates,${BASEDN} +dn: CN=TemplateComputer,CN=Templates objectClass: top objectClass: person objectClass: organizationalPerson @@ -58,7 +58,7 @@ logonCount: 0 sAMAccountType: 805306369 objectCategory: CN=Computer,CN=Schema,CN=Configuration,${BASEDN} -dn: CN=TemplateTrustingDomain,CN=Templates,${BASEDN} +dn: CN=TemplateTrustingDomain,CN=Templates objectClass: top objectClass: Template objectClass: userTemplate @@ -71,13 +71,12 @@ countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 -pwdLastSet: 0 primaryGroupID: 513 accountExpires: -1 logonCount: 0 sAMAccountType: 805306370 -dn: CN=TemplateGroup,CN=Templates,${BASEDN} +dn: CN=TemplateGroup,CN=Templates objectClass: top objectClass: Template objectClass: groupTemplate @@ -89,7 +88,7 @@ objectCategory: CN=Group,CN=Schema,CN=Configuration,${BASEDN} # Currently this isn't used, we don't have a way to detect it different from an incoming alias # -# dn: CN=TemplateAlias,CN=Templates,${BASEDN} +# dn: CN=TemplateAlias,CN=Templates # objectClass: top # objectClass: Template # objectClass: aliasTemplate @@ -98,7 +97,7 @@ objectCategory: CN=Group,CN=Schema,CN=Configuration,${BASEDN} # groupType: -2147483644 # sAMAccountType: 268435456 -dn: CN=TemplateForeignSecurityPrincipal,CN=Templates,${BASEDN} +dn: CN=TemplateForeignSecurityPrincipal,CN=Templates objectClass: top objectClass: Template objectClass: foreignSecurityPrincipalTemplate @@ -107,7 +106,7 @@ instanceType: 4 showInAdvancedViewOnly: TRUE objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,${BASEDN} -dn: CN=TemplateSecret,CN=Templates,${BASEDN} +dn: CN=TemplateSecret,CN=Templates objectClass: top objectClass: leaf objectClass: Template @@ -115,7 +114,7 @@ objectClass: secretTemplate cn: TemplateSecret instanceType: 4 -dn: CN=TemplateTrustedDomain,CN=Templates,${BASEDN} +dn: CN=TemplateTrustedDomain,CN=Templates objectClass: top objectClass: leaf objectClass: Template diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif index dc7bc016d5..5cd5991c41 100644 --- a/source4/setup/provision_users.ldif +++ b/source4/setup/provision_users.ldif @@ -68,7 +68,7 @@ privilege: SeNetworkLogonRight privilege: SeRemoteInteractiveLogonRight -dn: CN=${NETBIOSNAME},OU=Domain Controllers,${BASEDN} +dn: CN=${NETBIOSNAME},CN=Domain Controllers,${BASEDN} objectClass: computer cn: ${NETBIOSNAME} objectGUID: ${HOSTGUID} -- cgit