Rev 11881: Convert ldap provision code to perl. in
file:///home/jelmer/bzr.samba/SAMBA_4_0/
Jelmer Vernooij
jelmer at samba.org
Tue Apr 17 00:13:44 GMT 2007
At file:///home/jelmer/bzr.samba/SAMBA_4_0/
------------------------------------------------------------
revno: 11881
revision-id: jelmer at samba.org-20070417001333-mff8mosr6a5i3sb3
parent: jelmer at samba.org-20070416233038-0aom9b19fkyfq6j7
committer: Jelmer Vernooij <jelmer at samba.org>
branch nick: SAMBA_4_0
timestamp: Tue 2007-04-17 02:13:33 +0200
message:
Convert ldap provision code to perl.
removed:
source/script/tests/mk-fedora-ds.sh svn-v2:21069 at 0c0555d6-39d7-0310-84fc-f1cc0bd64818-branches%2fSAMBA_4_0-source%2fscript%2ftests%2fmk%2dfedora%2dds.sh
source/script/tests/mk-openldap.sh svn-v2:21069 at 0c0555d6-39d7-0310-84fc-f1cc0bd64818-branches%2fSAMBA_4_0-source%2fscript%2ftests%2fmk%2dopenldap.sh
modified:
source/script/tests/Samba4.pm svn-v2:21707 at 0c0555d6-39d7-0310-84fc-f1cc0bd64818-branches%2fSAMBA_4_0-source%2fscript%2ftests%2fSamba4.pm
=== removed file 'source/script/tests/mk-fedora-ds.sh'
--- a/source/script/tests/mk-fedora-ds.sh 2007-04-16 20:35:19 +0000
+++ b/source/script/tests/mk-fedora-ds.sh 1970-01-01 00:00:00 +0000
@@ -1,90 +0,0 @@
-FEDORA_DS_INF=$LDAPDIR/fedorads.inf
-FEDORA_DS_INITIAL_LDIF=$LDAPDIR/fedorads-initial.ldif
-
-echo "FEDORA_DS_LOGLEVEL=0"
-
-#Make the subdirectory be as fedora DS would expect
-FEDORA_DS_DIR=$LDAPDIR/slapd-samba4
-echo FEDORA_DS_DIR=$FEDORA_DS_DIR
-
-echo "FEDORA_DS_PIDFILE=$FEDORA_DS_DIR/logs/slapd-samba4.pid"
-
-cat >$FEDORA_DS_INF <<EOF
-[General]
-SuiteSpotUserID = $ROOT
-FullMachineName= localhost
-ServerRoot= $LDAPDIR
-
-[slapd]
-ldapifilepath=$LDAPDIR/ldapi
-Suffix= $BASEDN
-RootDN= cn=Manager,$BASEDN
-RootDNPwd= $PASSWORD
-ServerIdentifier= samba4
-InstallLdifFile=$FEDORA_DS_INITIAL_LDIF
-
-inst_dir= $FEDORA_DS_DIR
-config_dir= $FEDORA_DS_DIR
-schema_dir= $FEDORA_DS_DIR/schema
-lock_dir= $FEDORA_DS_DIR/lock
-log_dir= $FEDORA_DS_DIR/logs
-run_dir= $FEDORA_DS_DIR/logs
-db_dir= $FEDORA_DS_DIR/db
-bak_dir= $FEDORA_DS_DIR/bak
-tmp_dir= $FEDORA_DS_DIR/tmp
-ldif_dir= $FEDORA_DS_DIR/ldif
-cert_dir= $FEDORA_DS_DIR
-
-start_server= 0
-
-EOF
-
-cat >$FEDORA_DS_INITIAL_LDIF<<EOF
-# These entries need to be added to get the container for the
-# provision to be aimed at.
-
-dn: cn="dc=$BASEDN",cn=mapping tree,cn=config
-objectclass: top
-objectclass: extensibleObject
-objectclass: nsMappingTree
-nsslapd-state: backend
-nsslapd-backend: userData
-cn: $BASEDN
-
-dn: cn=userData,cn=ldbm database,cn=plugins,cn=config
-objectclass: extensibleObject
-objectclass: nsBackendInstance
-nsslapd-suffix: $BASEDN
-
-EOF
-
-perl $FEDORA_DS_PREFIX/bin/ds_newinst.pl $FEDORA_DS_INF >&2 || exit 1;
-
-(
- cd $FEDORA_DS_DIR/schema
- ls | grep -v ^00core | xargs rm
-)
-
-cat >>$FEDORA_DS_DIR/dse.ldif<<EOF
-dn: cn=bitwise,cn=plugins,cn=config
-objectClass: top
-objectClass: nsSlapdPlugin
-objectClass: extensibleObject
-cn: bitwise
-nsslapd-pluginPath: $FEDORA_DS_PREFIX/lib/fedora-ds/plugins/libbitwise-plugin.so
-nsslapd-pluginInitfunc: bitwise_init
-nsslapd-pluginType: matchingRule
-nsslapd-pluginEnabled: on
-nsslapd-pluginId: bitwise
-nsslapd-pluginVersion: 1.1.0a3
-nsslapd-pluginVendor: Fedora Project
-nsslapd-pluginDescription: Allow bitwise matching rules
-
-EOF
-
-$srcdir/bin/ad2oLschema $CONFIGURATION -H $PRIVATEDIR/sam.ldb --option=convert:target=fedora-ds -I $srcdir/setup/schema-map-fedora-ds-1.0 -O $FEDORA_DS_DIR/schema/99_ad.ldif >&2
-
-#it is easier to base64 encode this than correctly escape it:
-# (targetattr = "*") (version 3.0;acl "full access to all by all";allow (all)(userdn = "ldap:///anyone");)
-echo "PROVISION_ACI=--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK"
-
=== removed file 'source/script/tests/mk-openldap.sh'
--- a/source/script/tests/mk-openldap.sh 2007-04-16 20:35:19 +0000
+++ b/source/script/tests/mk-openldap.sh 1970-01-01 00:00:00 +0000
@@ -1,124 +0,0 @@
-SLAPD_CONF=$LDAPDIR/slapd.conf
-export SLAPD_CONF
-echo "SLAPD_CONF=$SLAPD_CONF"
-
-echo "OPENLDAP_LOGLEVEL=0"
-OPENLDAP_PIDFILE=$PIDDIR/slapd.pid
-echo "OPENLDAP_PIDFILE=$OPENLDAP_PIDFILE"
-
-cat >$SLAPD_CONF <<EOF
-loglevel 0
-
-include $LDAPDIR/ad.schema
-
-pidfile $OPENLDAP_PIDFILE
-argsfile $LDAPDIR/slapd.args
-sasl-realm $DNSNAME
-access to * by * write
-
-allow update_anon
-
-authz-regexp
- uid=([^,]*),cn=$DNSNAME,cn=digest-md5,cn=auth
- ldap:///$BASEDN??sub?(samAccountName=\$1)
-
-authz-regexp
- uid=([^,]*),cn=([^,]*),cn=digest-md5,cn=auth
- ldap:///$BASEDN??sub?(samAccountName=\$1)
-
-include $LDAPDIR/modules.conf
-
-defaultsearchbase "$BASEDN"
-
-backend bdb
-database bdb
-suffix "$BASEDN"
-rootdn "cn=Manager,$BASEDN"
-rootpw $PASSWORD
-directory $LDAPDIR/db
-index objectClass eq
-index samAccountName eq
-index name eq
-index objectSid eq
-index objectCategory eq
-index member eq
-index uidNumber eq
-index gidNumber eq
-index unixName eq
-index privilege eq
-index nCName eq pres
-index lDAPDisplayName eq
-index subClassOf eq
-index dnsRoot eq
-index nETBIOSName eq pres
-
-#syncprov is stable in OpenLDAP 2.3, and available in 2.2.
-#We only need this for the contextCSN attribute anyway....
-overlay syncprov
-syncprov-checkpoint 100 10
-syncprov-sessionlog 100
-
-EOF
-
-cat > $LDAPDIR/db/DB_CONFIG <<EOF
-#
- # Set the database in memory cache size.
- #
- set_cachesize 0 524288 0
-
-
- #
- # Set database flags (this is a test environment, we don't need to fsync()).
- #
- set_flags DB_TXN_NOSYNC
-
- #
- # Set log values.
- #
- set_lg_regionmax 104857
- set_lg_max 1048576
- set_lg_bsize 209715
- set_lg_dir $LDAPDIR/db/bdb-logs
-
-
- #
- # Set temporary file creation directory.
- #
- set_tmp_dir $LDAPDIR/db/tmp
-EOF
-
-#This uses the provision we just did, to read out the schema
-$srcdir/bin/ad2oLschema $CONFIGURATION -H $PRIVATEDIR/sam.ldb -I $srcdir/setup/schema-map-openldap-2.3 -O $LDAPDIR/ad.schema >&2
-
-#Now create an LDAP baseDN
-$srcdir/bin/smbscript $srcdir/setup/provision $PROVISION_OPTIONS --ldap-base >&2
-
-OLDPATH=$PATH
-PATH=/usr/local/sbin:/usr/sbin:/sbin:$PATH
-export PATH
-
-MODCONF=$LDAPDIR/modules.conf
-rm -f $MODCONF
-touch $MODCONF
-
-slaptest -u -f $SLAPD_CONF >&2 || {
- # echo "enabling slapd modules" >&2
- cat > $MODCONF <<EOF
-modulepath /usr/lib/ldap
-moduleload back_bdb
-moduleload syncprov
-EOF
-}
-
-if slaptest -u -f $SLAPD_CONF; then
- slapadd -f $SLAPD_CONF < $PRIVATEDIR/$DNSNAME.ldif >/dev/null || {
- echo "slapadd failed" >&2
- }
-
- slaptest -f $SLAPD_CONF >/dev/null || {
- echo "slaptest after database load failed" >&2
- }
-fi
-
-PATH=$OLDPATH
-export PATH
=== modified file 'source/script/tests/Samba4.pm'
--- a/source/script/tests/Samba4.pm 2007-04-16 23:30:38 +0000
+++ b/source/script/tests/Samba4.pm 2007-04-17 00:13:33 +0000
@@ -32,11 +32,11 @@
# running slapd in the background means it stays in the same process group, so it can be
# killed by timelimit
if ($self->{ldap} eq "fedora") {
- system("$ENV{FEDORA_DS_PREFIX}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d$env_vars->{FEDORA_DS_LOGLEVEL} -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &");
+ system("$ENV{FEDORA_DS_PREFIX}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d0 -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &");
} elsif ($self->{ldap} eq "openldap") {
my $oldpath = $ENV{PATH};
$ENV{PATH} = "/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}";
- system("slapd -d$env_vars->{OPENLDAP_LOGLEVEL} -f $conf -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &");
+ system("slapd -d0 -f $conf -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &");
$ENV{PATH} = $oldpath;
}
while (system("$self->{bindir}/ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
@@ -164,6 +164,227 @@
");
}
+sub mk_fedora($$$$$$)
+{
+ my ($self, $ldapdir, $basedn, $root, $password, $privatedir, $configuration) = @_;
+
+ my $fedora_ds_inf = "$ldapdir/fedorads.inf";
+ my $fedora_ds_initial_ldif = "$ldapdir/fedorads-initial.ldif";
+
+ #Make the subdirectory be as fedora DS would expect
+ my $fedora_ds_dir = "$ldapdir/slapd-samba4";
+
+ my $pidfile = "$fedora_ds_dir/logs/slapd-samba4.pid";
+
+ open(CONF, ">$fedora_ds_inf");
+ print CONF "
+[General]
+SuiteSpotUserID = $root
+fullMachineName= localhost
+ServerRoot= $ldapdir
+
+[slapd]
+ldapifilepath=$ldapdir/ldapi
+Suffix= $basedn
+rootDN= cn=Manager,$basedn
+rootDNPwd= $password
+serverIdentifier= samba4
+InstallLdifFile=$fedora_ds_initial_ldif
+
+inst_dir= $fedora_ds_dir
+config_dir= $fedora_ds_dir
+schema_dir= $fedora_ds_dir/schema
+lock_dir= $fedora_ds_dir/lock
+log_dir= $fedora_ds_dir/logs
+run_dir= $fedora_ds_dir/logs
+db_dir= $fedora_ds_dir/db
+bak_dir= $fedora_ds_dir/bak
+tmp_dir= $fedora_ds_dir/tmp
+ldif_dir= $fedora_ds_dir/ldif
+cert_dir= $fedora_ds_dir
+
+start_server= 0
+";
+ close(CONF);
+
+ open(CONF, ">$fedora_ds_initial_ldif");
+ print "
+# These entries need to be added to get the container for the
+# provision to be aimed at.
+
+dn: cn=\"dc=$basedn\",cn=mapping tree,cn=config
+objectclass: top
+objectclass: extensibleObject
+objectclass: nsMappingTree
+nsslapd-state: backend
+nsslapd-backend: userData
+cn: $basedn
+
+dn: cn=userData,cn=ldbm database,cn=plugins,cn=config
+objectclass: extensibleObject
+objectclass: nsBackendInstance
+nsslapd-suffix: $basedn
+";
+ close(CONF);
+
+ system("perl $ENV{FEDORA_DS_PREFIX}/bin/ds_newinst.pl $fedora_ds_inf >&2") == 0 or return 0;
+
+ unlink(<$fedora_ds_dir/schema/00core.*>);
+
+ open(LDIF, ">$fedora_ds_dir/dse.ldif");
+ print LDIF "
+dn: cn=bitwise,cn=plugins,cn=config
+objectClass: top
+objectClass: nsSlapdPlugin
+objectClass: extensibleObject
+cn: bitwise
+nsslapd-pluginPath: $ENV{FEDORA_DS_PREFIX}/lib/fedora-ds/plugins/libbitwise-plugin.so
+nsslapd-pluginInitfunc: bitwise_init
+nsslapd-pluginType: matchingRule
+nsslapd-pluginEnabled: on
+nsslapd-pluginId: bitwise
+nsslapd-pluginVersion: 1.1.0a3
+nsslapd-pluginVendor: Fedora Project
+nsslapd-pluginDescription: Allow bitwise matching rules
+";
+ close(CONF);
+
+ system("$self->{bindir}/ad2oLschema $configuration -H $privatedir/sam.ldb --option=convert:target=fedora-ds -I $self->{setupdir}/schema-map-fedora-ds-1.0 -O $fedora_ds_dir/schema/99_ad.ldif >&2");
+
+ return ($fedora_ds_dir, $pidfile);
+}
+
+sub mk_openldap($$$$$$$$)
+{
+ my ($self, $ldapdir, $basedn, $password, $privatedir, $dnsname, $configuration, $provision_options) = @_;
+
+ my $slapd_conf = "$ldapdir/slapd.conf";
+ my $pidfile = "$ldapdir/slapd.pid";
+ my $modconf = "$ldapdir/modules.conf";
+
+ mkdir($_) foreach ($ldapdir, "$ldapdir/db", "$ldapdir/db/bdb-logs",
+ "$ldapdir/db/tmp");
+
+ open(CONF, ">$slapd_conf");
+ print CONF "
+loglevel 0
+
+include $ldapdir/ad.schema
+
+pidfile $pidfile
+argsfile $ldapdir/slapd.args
+sasl-realm $dnsname
+access to * by * write
+
+allow update_anon
+
+authz-regexp
+ uid=([^,]*),cn=$dnsname,cn=digest-md5,cn=auth
+ ldap:///$basedn??sub?(samAccountName=\$1)
+
+authz-regexp
+ uid=([^,]*),cn=([^,]*),cn=digest-md5,cn=auth
+ ldap:///$basedn??sub?(samAccountName=\$1)
+
+include $modconf
+
+defaultsearchbase \"$basedn\"
+
+backend bdb
+database bdb
+suffix \"$basedn\"
+rootdn \"cn=Manager,$basedn\"
+rootpw $password
+directory \$ldapdir/db
+index objectClass eq
+index samAccountName eq
+index name eq
+index objectSid eq
+index objectCategory eq
+index member eq
+index uidNumber eq
+index gidNumber eq
+index unixName eq
+index privilege eq
+index nCName eq pres
+index lDAPDisplayName eq
+index subClassOf eq
+index dnsRoot eq
+index nETBIOSName eq pres
+
+#syncprov is stable in OpenLDAP 2.3, and available in 2.2.
+#We only need this for the contextCSN attribute anyway....
+overlay syncprov
+syncprov-checkpoint 100 10
+syncprov-sessionlog 100
+";
+
+ close(CONF);
+
+ open(CONF, ">$ldapdir/db/DB_CONFIG");
+ print CONF "
+#
+ # Set the database in memory cache size.
+ #
+ set_cachesize 0 524288 0
+
+
+ #
+ # Set database flags (this is a test environment, we don't need to fsync()).
+ #
+ set_flags DB_TXN_NOSYNC
+
+ #
+ # Set log values.
+ #
+ set_lg_regionmax 104857
+ set_lg_max 1048576
+ set_lg_bsize 209715
+ set_lg_dir $ldapdir/db/bdb-logs
+
+
+ #
+ # Set temporary file creation directory.
+ #
+ set_tmp_dir $ldapdir/db/tmp
+ ";
+ close(CONF);
+
+ #This uses the provision we just did, to read out the schema
+ system("$self->{bindir}/ad2oLschema $configuration -H $privatedir/sam.ldb -I $self->{setupdir}/schema-map-openldap-2.3 -O $ldapdir/ad.schema >&2");
+
+ #Now create an LDAP baseDN
+ system("$self->{bindir}/smbscript $self->{setupdir}/provision $provision_options --ldap-base >&2");
+
+ my $oldpath = $ENV{PATH};
+ $ENV{PATH} = "/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}";
+
+ unlink($modconf);
+ open(CONF, ">$modconf"); close(CONF);
+
+ if (system("slaptest -u -f $slapd_conf >&2") != 0) {
+ open(CONF, ">modconf");
+ # enable slapd modules
+ print "
+modulepath /usr/lib/ldap
+moduleload back_bdb
+moduleload syncprov
+";
+ close(CONF);
+ }
+
+ if (system("slaptest -u -f $slapd_conf") == 0) {
+ system("slapadd -f $slapd_conf < $privatedir/$dnsname.ldif >/dev/null") == 0 or die("slapadd failed");
+ }
+
+ system("slaptest -f $slapd_conf >/dev/null") == 0 or
+ die ("slaptest after database load failed");
+
+ $ENV{PATH} = $oldpath;
+
+ return $pidfile;
+}
+
sub provision($$$$$)
{
my ($self, $prefix, $server_role, $domain, $netbiosname) = @_;
@@ -324,19 +545,8 @@
my $ldap_uri= "$ldapdir/ldapi";
$ldap_uri =~ s|/|%2F|g;
$ldap_uri = "ldapi://$ldap_uri";
- my $provision_aci = ""; # FIXME
-
- if (not defined($self->{ldap})) {
- } elsif ($self->{ldap} eq "openldap") {
- mkdir($_) foreach ($ldapdir, "$ldapdir/db", "$ldapdir/db/bdb-logs",
- "$ldapdir/db/tmp");
- system("$RealBin/mk-openldap.sh") == 0 or die("Unable to create openldap directories");
- } elsif ($self->{ldap} eq "fedora") {
- system("$RealBin/mk-fedora-ds.sh") == 0 or die("Unable to create fedora ds directories");
- push (@provision_options, "--ldap-module=nsuniqueid");
- }
-
- return {
+
+ my $ret = {
KRB5_CONFIG => $krb5_config,
PIDDIR => $piddir,
SERVER => $server,
@@ -347,11 +557,22 @@
REALM => $realm,
PASSWORD => $password,
LDAPDIR => $ldapdir,
- PROVISION_OPTIONS => join(' ', @provision_options),
WINBINDD_SOCKET_DIR => $winbindd_socket_dir,
NCALRPCDIR => $ncalrpcdir,
CONFIGURATION => $configuration
};
+
+ if (not defined($self->{ldap})) {
+ } elsif ($self->{ldap} eq "openldap") {
+ $ret->{OPENLDAP_PIDFILE} = $self->mk_openldap($ldapdir, $basedn, $password, $privatedir, $dnsname, $configuration, join(' ', @provision_options)) or die("Unable to create openldap directories");
+ } elsif ($self->{ldap} eq "fedora") {
+ ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora($ldapdir, $basedn, $root, $password, $privatedir, $configuration) or die("Unable to create fedora ds directories");
+ push (@provision_options, "--ldap-module=nsuniqueid");
+ }
+
+ $ret->{PROVISION_OPTIONS} = join(' ', @provision_options);
+
+ return $ret;
}
sub provision_member($$$)
@@ -390,8 +611,16 @@
sub provision_ldap($$)
{
my ($self, $envvars) = @_;
- system("$self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$envvars->{PROVISION_ACI}\" --ldap-backend=$envvars->{LDAP_URI}") and
- die("LDAP PROVISIONING failed: $self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$envvars->{PROVISION_ACI}\" --ldap-backend=$envvars->{LDAP_URI}");
+ my $provision_aci = "";
+
+ if ($self->{ldap} eq "fedora") {
+ #it is easier to base64 encode this than correctly escape it:
+ # (targetattr = "*") (version 3.0;acl "full access to all by all";allow (all)(userdn = "ldap:///anyone");)
+ $provision_aci = "--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK";
+ }
+
+ system("$self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$provision_aci\" --ldap-backend=$envvars->{LDAP_URI}") and
+ die("LDAP PROVISIONING failed: $self->{bindir}/smbscript $self->{setupdir}/provision $envvars->{PROVISION_OPTIONS} \"$provision_aci\" --ldap-backend=$envvars->{LDAP_URI}");
}
sub teardown_env($$)
More information about the samba-cvs
mailing list