[SCM] Samba Shared Repository - branch master updated
Andrew Tridgell
tridge at samba.org
Thu Aug 26 06:50:29 MDT 2010
The branch, master has been updated
via 9cb771a pidl-python: ensure we allocate ref ptrs before use
via 3319052 s4-devel: added enumprivs developer script
via 057a471 s4-net: fixed docstring on spn command
via d8f48c7 s4-net: added "net rodc preload" command
via da366ba s4-drs: split out drs utility python functions
via 502a531 s4-pyrpc: convert rpc_talloc.py test to unittest framework
from d132b3f s3-build: Don't paste the summary.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 9cb771a4a05b3c204a2b0626b22a29874919b3aa
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 17:50:13 2010 +1000
pidl-python: ensure we allocate ref ptrs before use
this fixes a crash on samba4.samr.python in the build farm
commit 331905216a22989973d00dbc612e90ffa010ff0e
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 17:41:30 2010 +1000
s4-devel: added enumprivs developer script
this enumerates all LSA privileges on a server
Pair-Programmed-With: Andrew Bartlett <abartlet at samba.org>
commit 057a47130de16b3e8796a7d2dc92b2ceeddd8ab6
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 17:32:48 2010 +1000
s4-net: fixed docstring on spn command
Pair-Programmed-With: Andrew Bartlett <abartlet at samba.org>
commit d8f48c7ffc7d1abc37e1681240266240d4f69e7a
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 16:37:24 2010 +1000
s4-net: added "net rodc preload" command
this command will preload the credentials for an account from the full
domain controller
Pair-Programmed-With: Andrew Bartlett <abartlet at samba.org>
commit da366ba221e326aa1a62160d38b5d2df0b0eb780
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 14:35:30 2010 +1000
s4-drs: split out drs utility python functions
these will be re-used by other net commands
commit 502a5313c49baf70e49b6d200acccf2860aa8aba
Author: Andrew Tridgell <tridge at samba.org>
Date: Thu Aug 26 09:45:16 2010 +1000
s4-pyrpc: convert rpc_talloc.py test to unittest framework
This fits in better with our test framework
Pair-Programmed-With: Jelmer Vernooij <jelmer at samba.org>
-----------------------------------------------------------------------
Summary of changes:
pidl/lib/Parse/Pidl/Samba4/Python.pm | 6 +-
source4/scripting/devel/enumprivs | 58 ++++++++
source4/scripting/python/samba/drs_utils.py | 152 ++++++++++++++++++++
source4/scripting/python/samba/join.py | 150 ++-----------------
source4/scripting/python/samba/netcmd/__init__.py | 2 +
source4/scripting/python/samba/netcmd/rodc.py | 123 ++++++++++++++++
source4/scripting/python/samba/netcmd/spn.py | 2 +-
.../python/samba/tests/dcerpc/rpc_talloc.py | 104 ++++++++------
source4/selftest/tests.sh | 2 +-
9 files changed, 416 insertions(+), 183 deletions(-)
create mode 100755 source4/scripting/devel/enumprivs
create mode 100644 source4/scripting/python/samba/drs_utils.py
create mode 100644 source4/scripting/python/samba/netcmd/rodc.py
Changeset truncated at 500 lines:
diff --git a/pidl/lib/Parse/Pidl/Samba4/Python.pm b/pidl/lib/Parse/Pidl/Samba4/Python.pm
index eb39718..05c11be 100644
--- a/pidl/lib/Parse/Pidl/Samba4/Python.pm
+++ b/pidl/lib/Parse/Pidl/Samba4/Python.pm
@@ -947,7 +947,11 @@ sub ConvertObjectFromPythonLevel($$$$$$$$$)
}
# if we want to handle more than one level of pointer in python interfaces
# then this is where we would need to allocate it
- $self->pidl("$var_name = NULL;");
+ if ($l->{POINTER_TYPE} eq "ref") {
+ $self->pidl("$var_name = talloc_ptrtype($mem_ctx, $var_name);");
+ } else {
+ $self->pidl("$var_name = NULL;");
+ }
$self->ConvertObjectFromPythonLevel($env, $mem_ctx, $mem_ref, $py_var, $e, $nl, get_value_of($var_name), $fail);
if ($l->{POINTER_TYPE} ne "ref") {
$self->deindent;
diff --git a/source4/scripting/devel/enumprivs b/source4/scripting/devel/enumprivs
new file mode 100755
index 0000000..6a04040
--- /dev/null
+++ b/source4/scripting/devel/enumprivs
@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+
+# script to enumerate LSA privileges on a server
+
+import sys
+from optparse import OptionParser
+
+sys.path.insert(0, "bin/python")
+
+import samba
+import samba.getopt as options
+from samba.dcerpc import lsa, security
+
+def get_display_name(lsaconn, pol_handle, name):
+ '''get the display name for a privilege'''
+ string = lsa.String()
+ string.string = name
+
+ (disp_names, ret_lang) = lsaconn.LookupPrivDisplayName(pol_handle, string, 0x409, 0)
+ return disp_names.string
+
+
+
+
+########### main code ###########
+if __name__ == "__main__":
+ parser = OptionParser("enumprivs [options] server")
+ sambaopts = options.SambaOptions(parser)
+ credopts = options.CredentialsOptionsDouble(parser)
+ parser.add_option_group(credopts)
+
+ (opts, args) = parser.parse_args()
+
+ lp = sambaopts.get_loadparm()
+ creds = credopts.get_credentials(lp)
+
+ if len(args) != 1:
+ parser.error("You must supply a server")
+
+ if not creds.authentication_requested():
+ parser.error("You must supply credentials")
+
+ server = args[0]
+
+ binding_str = "ncacn_np:%s[print]" % server
+
+ lsaconn = lsa.lsarpc(binding_str, lp, creds)
+
+ objectAttr = lsa.ObjectAttribute()
+ objectAttr.sec_qos = lsa.QosInfo()
+
+ pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'),
+ objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED)
+
+ (handle, privs) = lsaconn.EnumPrivs(pol_handle, 0, 100)
+ for p in privs.privs:
+ disp_name = get_display_name(lsaconn, pol_handle, p.name.string)
+ print "0x%08x %31s \"%s\"" % (p.luid.low, p.name.string, disp_name)
diff --git a/source4/scripting/python/samba/drs_utils.py b/source4/scripting/python/samba/drs_utils.py
new file mode 100644
index 0000000..7b22a84
--- /dev/null
+++ b/source4/scripting/python/samba/drs_utils.py
@@ -0,0 +1,152 @@
+#!/usr/bin/env python
+#
+# DRS utility code
+#
+# Copyright Andrew Tridgell 2010
+# Copyright Andrew Bartlett 2010
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+from samba.dcerpc import drsuapi, misc
+from samba.net import Net
+import samba, ldb
+
+class drs_Replicate():
+ '''DRS replication calls'''
+
+ def __init__(self, binding_string, lp, creds, samdb):
+ self.drs = drsuapi.drsuapi(binding_string, lp, creds)
+ self.drs_handle = self.drs_DsBind()
+ self.net = Net(creds=creds, lp=lp)
+ self.samdb = samdb
+ self.replication_state = self.net.replicate_init(self.samdb, lp, self.drs)
+
+
+ def drs_DsBind(self):
+ '''make a DsBind call, returning the binding handle'''
+ bind_info = drsuapi.DsBindInfoCtr()
+ bind_info.length = 28
+ bind_info.info = drsuapi.DsBindInfo28()
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
+ bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
+ (info, handle) = self.drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
+ return handle
+
+
+ def drs_get_rodc_partial_attribute_set(self):
+ '''get a list of attributes for RODC replication'''
+ partial_attribute_set = drsuapi.DsPartialAttributeSet()
+ partial_attribute_set.version = 1
+
+ attids = []
+
+ # the exact list of attids we send is quite critical. Note that
+ # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING
+ # to zero them out
+ schema_dn = self.samdb.get_schema_basedn()
+ res = self.samdb.search(base=schema_dn, scope=ldb.SCOPE_SUBTREE,
+ expression="objectClass=attributeSchema",
+ attrs=["lDAPDisplayName", "systemFlags",
+ "searchFlags"])
+
+ for r in res:
+ ldap_display_name = r["lDAPDisplayName"][0]
+ if "systemFlags" in r:
+ system_flags = r["systemFlags"][0]
+ if (int(system_flags) & (samba.dsdb.DS_FLAG_ATTR_NOT_REPLICATED |
+ samba.dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED)):
+ continue
+ search_flags = r["searchFlags"][0]
+ if (int(search_flags) & samba.dsdb.SEARCH_FLAG_RODC_ATTRIBUTE):
+ continue
+ attid = self.samdb.get_attid_from_lDAPDisplayName(ldap_display_name)
+ attids.append(int(attid))
+
+ # the attids do need to be sorted, or windows doesn't return
+ # all the attributes we need
+ attids.sort()
+ partial_attribute_set.attids = attids
+ partial_attribute_set.num_attids = len(attids)
+ return partial_attribute_set
+
+
+ def replicate(self, dn, source_dsa_invocation_id, destination_dsa_guid,
+ schema=False, exop=drsuapi.DRSUAPI_EXOP_NONE):
+ '''replicate a single DN'''
+
+ # setup for a GetNCChanges call
+ req8 = drsuapi.DsGetNCChangesRequest8()
+
+ req8.destination_dsa_guid = destination_dsa_guid
+ req8.source_dsa_invocation_id = source_dsa_invocation_id
+ req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
+ req8.naming_context.dn = dn.decode("utf-8")
+ req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
+ req8.highwatermark.tmp_highest_usn = 0
+ req8.highwatermark.reserved_usn = 0
+ req8.highwatermark.highest_usn = 0
+ req8.uptodateness_vector = None
+ if exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET:
+ req8.replica_flags = 0
+ else:
+ req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
+ drsuapi.DRSUAPI_DRS_PER_SYNC |
+ drsuapi.DRSUAPI_DRS_GET_ANC |
+ drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
+ drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
+ req8.max_object_count = 402
+ req8.max_ndr_size = 402116
+ req8.extended_op = exop
+ req8.fsmo_info = 0
+ req8.partial_attribute_set = None
+ req8.partial_attribute_set_ex = None
+ req8.mapping_ctr.num_mappings = 0
+ req8.mapping_ctr.mappings = None
+
+ if not schema:
+ req8.partial_attribute_set = self.drs_get_rodc_partial_attribute_set()
+
+ while True:
+ (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 8, req8)
+ self.net.replicate_chunk(self.replication_state, level, ctr, schema=schema)
+ if ctr.more_data == 0:
+ break
+ req8.highwatermark.tmp_highest_usn = ctr.new_highwatermark.tmp_highest_usn
diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
index c48b53f..b0feee3 100644
--- a/source4/scripting/python/samba/join.py
+++ b/source4/scripting/python/samba/join.py
@@ -30,6 +30,7 @@ from samba.credentials import Credentials, DONT_USE_KERBEROS
from samba.provision import secretsdb_self_join, provision, FILL_DRS, find_setup_dir
from samba.net import Net
import logging
+from samba.drs_utils import drs_Replicate
# this makes debugging easier
samba.talloc_enable_null_tracking()
@@ -86,121 +87,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None,
res = samdb.search(base=samdb.get_default_basedn(), scope=ldb.SCOPE_BASE, attrs=["name"])
return res[0]["name"][0]
- def do_DsBind(drs):
- '''make a DsBind call, returning the binding handle'''
- bind_info = drsuapi.DsBindInfoCtr()
- bind_info.length = 28
- bind_info.info = drsuapi.DsBindInfo28()
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
- bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
- (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
- return handle
-
- def get_rodc_partial_attribute_set(ctx):
- '''get a list of attributes for RODC replication'''
- partial_attribute_set = drsuapi.DsPartialAttributeSet()
- partial_attribute_set.version = 1
-
- ctx.attids = []
-
- # the exact list of attids we send is quite critical. Note that
- # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING
- # to zero them out
- res = ctx.local_samdb.search(base=ctx.schema_dn, scope=ldb.SCOPE_SUBTREE,
- expression="objectClass=attributeSchema",
- attrs=["lDAPDisplayName", "systemFlags",
- "searchFlags"])
-
- for r in res:
- ldap_display_name = r["lDAPDisplayName"][0]
- if "systemFlags" in r:
- system_flags = r["systemFlags"][0]
- if (int(system_flags) & (samba.dsdb.DS_FLAG_ATTR_NOT_REPLICATED |
- samba.dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED)):
- continue
- search_flags = r["searchFlags"][0]
- if (int(search_flags) & samba.dsdb.SEARCH_FLAG_RODC_ATTRIBUTE):
- continue
- attid = ctx.local_samdb.get_attid_from_lDAPDisplayName(ldap_display_name)
- ctx.attids.append(int(attid))
-
- # the attids do need to be sorted, or windows doesn't return
- # all the attributes we need
- ctx.attids.sort()
- partial_attribute_set.attids = ctx.attids
- partial_attribute_set.num_attids = len(ctx.attids)
- return partial_attribute_set
-
-
- def replicate_partition(ctx, dn, schema=False, exop=drsuapi.DRSUAPI_EXOP_NONE):
- '''replicate a partition'''
-
- # setup for a GetNCChanges call
- req8 = drsuapi.DsGetNCChangesRequest8()
-
- req8.destination_dsa_guid = ctx.ntds_guid
- req8.source_dsa_invocation_id = misc.GUID(ctx.samdb.get_invocation_id())
- req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
- req8.naming_context.dn = dn.decode("utf-8")
- req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
- req8.highwatermark.tmp_highest_usn = 0
- req8.highwatermark.reserved_usn = 0
- req8.highwatermark.highest_usn = 0
- req8.uptodateness_vector = None
- if exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET:
- req8.replica_flags = 0
- else:
- req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
- drsuapi.DRSUAPI_DRS_PER_SYNC |
- drsuapi.DRSUAPI_DRS_GET_ANC |
- drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
- drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
- req8.max_object_count = 402
- req8.max_ndr_size = 402116
- req8.extended_op = exop
- req8.fsmo_info = 0
- req8.partial_attribute_set = None
- req8.partial_attribute_set_ex = None
- req8.mapping_ctr.num_mappings = 0
- req8.mapping_ctr.mappings = None
-
- if not schema:
- req8.partial_attribute_set = get_rodc_partial_attribute_set(ctx)
-
- while True:
- (level, ctr) = ctx.drs.DsGetNCChanges(ctx.drs_handle, 8, req8)
- ctx.net.replicate_chunk(ctx.replication_state, level, ctr, schema=schema)
- if ctr.more_data == 0:
- break
- req8.highwatermark.tmp_highest_usn = ctr.new_highwatermark.tmp_highest_usn
-
-
def join_add_objects(ctx):
'''add the various objects needed for the join'''
print "Adding %s" % ctx.acct_dn
@@ -317,19 +203,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None,
username=ctx.samname)
- def join_drs_connect(ctx):
- '''connect to DRSUAPI'''
- print "Doing DsBind as %s" % ctx.samname
- ctx.acct_creds = Credentials()
- ctx.acct_creds.guess(ctx.lp)
- ctx.acct_creds.set_kerberos_state(DONT_USE_KERBEROS)
- ctx.acct_creds.set_username(ctx.samname)
- ctx.acct_creds.set_password(ctx.acct_pass)
-
- ctx.drs = drsuapi.drsuapi("ncacn_ip_tcp:%s[seal,print]" % ctx.server, ctx.lp, ctx.acct_creds)
- ctx.drs_handle = do_DsBind(ctx.drs)
-
-
def join_provision(ctx):
'''provision the local SAM'''
@@ -361,13 +234,21 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None,
print "Starting replication"
ctx.local_samdb.transaction_start()
- ctx.replication_state = ctx.net.replicate_init(ctx.local_samdb, ctx.lp, ctx.drs)
+ source_dsa_invocation_id = misc.GUID(ctx.samdb.get_invocation_id())
+
+ acct_creds = Credentials()
+ acct_creds.guess(ctx.lp)
+ acct_creds.set_kerberos_state(DONT_USE_KERBEROS)
+ acct_creds.set_username(ctx.samname)
+ acct_creds.set_password(ctx.acct_pass)
+
+ repl = drs_Replicate("ncacn_ip_tcp:%s[seal]" % ctx.server, ctx.lp, acct_creds, ctx.local_samdb)
- replicate_partition(ctx, ctx.schema_dn, schema=True)
- replicate_partition(ctx, ctx.config_dn)
- replicate_partition(ctx, ctx.base_dn)
- replicate_partition(ctx, ctx.acct_dn, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET)
- replicate_partition(ctx, ctx.new_krbtgt_dn, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET)
+ repl.replicate(ctx.schema_dn, source_dsa_invocation_id, ctx.ntds_guid, schema=True)
+ repl.replicate(ctx.config_dn, source_dsa_invocation_id, ctx.ntds_guid)
+ repl.replicate(ctx.base_dn, source_dsa_invocation_id, ctx.ntds_guid)
+ repl.replicate(ctx.acct_dn, source_dsa_invocation_id, ctx.ntds_guid, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET)
+ repl.replicate(ctx.new_krbtgt_dn, source_dsa_invocation_id, ctx.ntds_guid, exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET)
print "Committing SAM database"
ctx.local_samdb.transaction_commit()
@@ -450,7 +331,6 @@ def join_rodc(server=None, creds=None, lp=None, site=None, netbios_name=None,
cleanup_old_join(ctx)
try:
join_add_objects(ctx)
- join_drs_connect(ctx)
join_provision(ctx)
join_replicate(ctx)
join_finalise(ctx)
diff --git a/source4/scripting/python/samba/netcmd/__init__.py b/source4/scripting/python/samba/netcmd/__init__.py
index 331c543..8044454 100644
--- a/source4/scripting/python/samba/netcmd/__init__.py
+++ b/source4/scripting/python/samba/netcmd/__init__.py
@@ -166,3 +166,5 @@ from samba.netcmd.group import cmd_group
commands["group"] = cmd_group()
from samba.netcmd.join import cmd_join
commands["join"] = cmd_join()
+from samba.netcmd.rodc import cmd_rodc
+commands["rodc"] = cmd_rodc()
diff --git a/source4/scripting/python/samba/netcmd/rodc.py b/source4/scripting/python/samba/netcmd/rodc.py
new file mode 100644
index 0000000..8e3ebbf
--- /dev/null
+++ b/source4/scripting/python/samba/netcmd/rodc.py
@@ -0,0 +1,123 @@
+#!/usr/bin/env python
+#
+# rodc related commands
+#
+# Copyright Andrew Tridgell 2010
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+from samba.netcmd import Command, CommandError, Option, SuperCommand
+import samba.getopt as options
+from samba.samdb import SamDB
+from samba.auth import system_session
+import ldb
+from samba.dcerpc import misc, drsuapi
+from samba.credentials import Credentials
+from samba.drs_utils import drs_Replicate
+
+class cmd_rodc_preload(Command):
+ """Preload one account for an RODC"""
+
+ synopsis = "%prog rodc preload <SID|DN|accountname>"
+
+ takes_optiongroups = {
+ "sambaopts": options.SambaOptions,
+ "versionopts": options.VersionOptions,
+ "credopts": options.CredentialsOptions,
+ }
+
+ takes_options = [
+ Option("--server", help="DC to use", type=str),
+ ]
+
+ takes_args = ["account"]
+
+ def get_dn(self, samdb, account):
+ '''work out what DN they meant'''
+
+ # we accept the account in SID, accountname or DN form
+ if account[0:2] == 'S-':
+ res = samdb.search(base="<SID=%s>" % account,
+ expression="objectclass=user",
+ scope=ldb.SCOPE_BASE, attrs=[])
+ elif account.find('=') >= 0:
--
Samba Shared Repository
More information about the samba-cvs
mailing list