[SCM] Samba Shared Repository - branch master updated
Matthieu Patou
mat at samba.org
Mon Dec 5 11:57:02 MST 2011
The branch, master has been updated
via 5bfd625 s4-drs: do not try to contact for replication servers that are not anymore in reps*
via 059523e s4-resolver: do not use all the A and AAAA records, those after a NS are not the one we want to use
via 2f8a84b s4-drs: mark WERR_DS_DRA_BUSY as a non error in DsReplicaUpdateRefs
via 105d388 s4: add blackbox test for the demote function
via a8c89fa samba-tool: refuse to demote if the current DC has still roles
via f44e1a7 samba-tool: add a function to cleanly demote a DC
via fc42b0a s4-python: factorize the definition of get_dsServiceName
via 093dac4 s4-python: externalize some function to the drs_utils module so that they can be reused
via 9e3ee2b s4-python: rename conflicting variable with the import option
from 372dd3b tdb2: tlist: remove type arg from tlist_top(), tlist_tail()
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 5bfd6251eb22ff701184a95649822a73cf4d157b
Author: Matthieu Patou <mat at matws.net>
Date: Mon Nov 28 00:28:44 2011 +0100
s4-drs: do not try to contact for replication servers that are not anymore in reps*
Servers connection can be removed from repsTo and respFrom either due to
DC demote or topology change by the KCC, if a server is removed from the
reps* it must be effectivly removed from the list of server that we will
contact for getNcChanges and for replicaSync.
Autobuild-User: Matthieu Patou <mat at samba.org>
Autobuild-Date: Mon Dec 5 19:56:09 CET 2011 on sn-devel-104
commit 059523e2036d8a2215fd4ea59047e2d9dacce062
Author: Matthieu Patou <mat at matws.net>
Date: Mon Nov 21 23:37:03 2011 +0100
s4-resolver: do not use all the A and AAAA records, those after a NS are not the one we want to use
commit 2f8a84bb7b430c68c06f4121df6905b163f7ae71
Author: Matthieu Patou <mat at matws.net>
Date: Sun Nov 27 12:24:23 2011 +0100
s4-drs: mark WERR_DS_DRA_BUSY as a non error in DsReplicaUpdateRefs
commit 105d388c9bfd542755cfe46adff337a6333f54e8
Author: Matthieu Patou <mat at matws.net>
Date: Mon Dec 5 00:43:09 2011 +0100
s4: add blackbox test for the demote function
commit a8c89fa7d2720f58bc7ce0cf0e1c92255331a733
Author: Matthieu Patou <mat at matws.net>
Date: Sun Dec 4 23:19:55 2011 +0100
samba-tool: refuse to demote if the current DC has still roles
commit f44e1a753a9dc489ded1d2e49c83c865124462f1
Author: Matthieu Patou <mat at matws.net>
Date: Sun Dec 4 23:00:57 2011 +0100
samba-tool: add a function to cleanly demote a DC
samba-tool domain demote allow the local DC to properly demote against
Microsoft and Samba DC.
commit fc42b0ab4135295fd23af5ab0cc0b410655bc376
Author: Matthieu Patou <mat at matws.net>
Date: Sun Dec 4 14:23:34 2011 +0100
s4-python: factorize the definition of get_dsServiceName
commit 093dac43312c97a90b68f18ccc80716db84c25f5
Author: Matthieu Patou <mat at matws.net>
Date: Mon Nov 28 20:48:59 2011 +0100
s4-python: externalize some function to the drs_utils module so that they can be reused
commit 9e3ee2bf6acd919bd9efa057b3ebedc86f439259
Author: Matthieu Patou <mat at matws.net>
Date: Mon Nov 28 19:31:57 2011 +0100
s4-python: rename conflicting variable with the import option
-----------------------------------------------------------------------
Summary of changes:
source4/dsdb/repl/drepl_out_helpers.c | 24 ++-
source4/dsdb/repl/drepl_partitions.c | 46 ++++-
source4/libcli/resolve/dns_ex.c | 16 ++
source4/scripting/python/samba/drs_utils.py | 77 +++++++
source4/scripting/python/samba/join.py | 6 +-
source4/scripting/python/samba/netcmd/domain.py | 245 ++++++++++++++++++++++-
source4/scripting/python/samba/netcmd/drs.py | 47 ++---
source4/scripting/python/samba/netcmd/rodc.py | 7 +-
source4/scripting/python/samba/samdb.py | 10 +
source4/selftest/tests.py | 2 +
source4/utils/tests/test_demote.sh | 38 ++++
11 files changed, 464 insertions(+), 54 deletions(-)
create mode 100755 source4/utils/tests/test_demote.sh
Changeset truncated at 500 lines:
diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c
index 71d2c3b..16825d4 100644
--- a/source4/dsdb/repl/drepl_out_helpers.c
+++ b/source4/dsdb/repl/drepl_out_helpers.c
@@ -827,8 +827,28 @@ static void dreplsrv_update_refs_done(struct tevent_req *subreq)
nt_errstr(status),
r->in.req.req1.dest_dsa_dns_name,
r->in.req.req1.naming_context->dn));
- tevent_req_nterror(req, status);
- return;
+ /*
+ * TODO we are currently not sending the
+ * DsReplicaUpdateRefs at the correct moment,
+ * we do it just after a GetNcChanges which is
+ * not always correct.
+ * Especially when another DC is trying to demote
+ * it will sends us a DsReplicaSync that will trigger a getNcChanges
+ * this call will succeed but the DsRecplicaUpdateRefs that we send
+ * just after will not because the DC is in a demote state and
+ * will reply us a WERR_DS_DRA_BUSY, this error will cause us to
+ * answer to the DsReplicaSync with a non OK status, the other DC
+ * will stop the demote due to this error.
+ * In order to cope with this we will for the moment concider
+ * a DS_DRA_BUSY not as an error.
+ * It's not ideal but it should not have a too huge impact for
+ * running production as this error otherwise never happen and
+ * due to the fact the send a DsReplicaUpdateRefs after each getNcChanges
+ */
+ if (!W_ERROR_EQUAL(r->out.result, WERR_DS_DRA_BUSY)) {
+ tevent_req_nterror(req, status);
+ return;
+ }
}
DEBUG(4,("UpdateRefs OK for %s %s\n",
diff --git a/source4/dsdb/repl/drepl_partitions.c b/source4/dsdb/repl/drepl_partitions.c
index 927dc68..de5d007 100644
--- a/source4/dsdb/repl/drepl_partitions.c
+++ b/source4/dsdb/repl/drepl_partitions.c
@@ -376,6 +376,7 @@ static WERROR dreplsrv_partition_add_source_dsa(struct dreplsrv_service *s,
struct dreplsrv_partition *p,
struct dreplsrv_partition_source_dsa **listp,
struct dreplsrv_partition_source_dsa *check_list,
+ struct dreplsrv_partition_source_dsa **oldlist,
const struct ldb_val *val)
{
WERROR status;
@@ -413,14 +414,16 @@ static WERROR dreplsrv_partition_add_source_dsa(struct dreplsrv_service *s,
}
/* re-use an existing source if found */
- for (s2=*listp; s2; s2=s2->next) {
+ for (s2=*oldlist; s2; s2=s2->next) {
if (GUID_compare(&s2->repsFrom1->source_dsa_obj_guid,
&source->repsFrom1->source_dsa_obj_guid) == 0) {
talloc_free(s2->repsFrom1->other_info);
*s2->repsFrom1 = *source->repsFrom1;
talloc_steal(s2, s2->repsFrom1->other_info);
talloc_free(source);
- return WERR_OK;
+ source = s2;
+ DLIST_REMOVE(*oldlist, s2);
+ break;
}
}
@@ -566,6 +569,7 @@ static WERROR dreplsrv_refresh_partition(struct dreplsrv_service *s,
NULL
};
struct ldb_dn *dn;
+ struct dreplsrv_partition_source_dsa *src, *oldsources, *oldnotifies;
DEBUG(4, ("dreplsrv_refresh_partition(%s)\n",
ldb_dn_get_linearized(p->dn)));
@@ -607,22 +611,52 @@ static WERROR dreplsrv_refresh_partition(struct dreplsrv_service *s,
status = WERR_OK;
+ oldsources = p->sources;
+ p->sources = NULL;
if (r != NULL && (orf_el = ldb_msg_find_element(r->msgs[0], "repsFrom"))) {
for (i=0; i < orf_el->num_values; i++) {
- status = dreplsrv_partition_add_source_dsa(s, p, &p->sources,
- NULL, &orf_el->values[i]);
+ status = dreplsrv_partition_add_source_dsa(s, p, &p->sources,
+ NULL, &oldsources,
+ &orf_el->values[i]);
W_ERROR_NOT_OK_GOTO_DONE(status);
}
+ } else {
+ if (r != NULL && p->sources) {
+ DEBUG(0, ("repsFrom do not exists or is empty\n"));
+ }
}
+ oldnotifies = p->notifies;
+ p->notifies = NULL;
if (r != NULL && (orf_el = ldb_msg_find_element(r->msgs[0], "repsTo"))) {
for (i=0; i < orf_el->num_values; i++) {
- status = dreplsrv_partition_add_source_dsa(s, p, &p->notifies,
- p->sources, &orf_el->values[i]);
+ status = dreplsrv_partition_add_source_dsa(s, p, &p->notifies,
+ p->sources,
+ &oldnotifies,
+ &orf_el->values[i]);
W_ERROR_NOT_OK_GOTO_DONE(status);
}
}
+ if (oldsources) {
+ src = oldsources;
+ while(src) {
+ struct dreplsrv_partition_source_dsa *tmp = src->next;
+ talloc_free(src);
+ src = tmp;
+ }
+ }
+
+
+ if (oldnotifies) {
+ src = oldnotifies;
+ while(src) {
+ struct dreplsrv_partition_source_dsa *tmp = src->next;
+ talloc_free(src);
+ src = tmp;
+ }
+ }
+
done:
talloc_free(mem_ctx);
return status;
diff --git a/source4/libcli/resolve/dns_ex.c b/source4/libcli/resolve/dns_ex.c
index 20f2c0c..9467521 100644
--- a/source4/libcli/resolve/dns_ex.c
+++ b/source4/libcli/resolve/dns_ex.c
@@ -89,6 +89,14 @@ static uint32_t count_dns_rr(struct rk_resource_record *head, unsigned record_ty
continue;
}
+ if (rr->type == rk_ns_t_ns) {
+ /*
+ * Record that will follow will be related to the NS
+ * not what we are really interested with.
+ * It's a good idea not to count them
+ */
+ break;
+ }
/* we are only interested by requested record */
if (rr->type != record_type) {
continue;
@@ -234,6 +242,14 @@ static struct dns_records_container get_a_aaaa_records(TALLOC_CTX *mem_ctx,
continue;
}
+ if (rr->type == rk_ns_t_ns) {
+ /*
+ * After the record for NS will come the A or AAAA
+ * record of the NS.
+ */
+ break;
+ }
+
/* we are only interested in A and AAAA records */
if (rr->type != rk_ns_t_a && rr->type != rk_ns_t_aaaa) {
continue;
diff --git a/source4/scripting/python/samba/drs_utils.py b/source4/scripting/python/samba/drs_utils.py
index fbcbf2f..9aacfbc 100644
--- a/source4/scripting/python/samba/drs_utils.py
+++ b/source4/scripting/python/samba/drs_utils.py
@@ -24,6 +24,83 @@ from samba.net import Net
import samba, ldb
+class drsException:
+ """Base element for drs errors"""
+
+ def __init__(self, value):
+ self.value = value
+
+ def __str__(self):
+ return "drsException: " + self.value
+
+
+def drsuapi_connect(server, lp, creds):
+ """
+ make a DRSUAPI connection to the server
+ :param server: the name of the server to connect to
+ :param lp: a samba line parameter object
+ :param creds: credential used for the connection
+ :return: A tuple with the drsuapi bind object, the drsuapi handle
+ and the supported extensions.
+ :raise drsException: if the connection fails
+ """
+
+ binding_options = "seal"
+ if int(lp.get("log level")) >= 5:
+ binding_options += ",print"
+ binding_string = "ncacn_ip_tcp:%s[%s]" % (server, binding_options)
+ try:
+ drsuapiBind = drsuapi.drsuapi(binding_string, lp, creds)
+ (drsuapiHandle, bindSupportedExtensions) = drs_DsBind(drsuapiBind)
+ except Exception, e:
+ raise drsException("DRS connection to %s failed: %s" % (server, e))
+
+ return (drsuapiBind, drsuapiHandle, bindSupportedExtensions)
+
+def sendDsReplicaSync(drsuapiBind, drsuapi_handle, source_dsa_guid, naming_context, req_option):
+ """
+ :param drsuapiBind: a drsuapi Bind object
+ :param drsuapi_handle: a drsuapi hanle on the drsuapi connection
+ :param source_dsa_guid: the guid of the source dsa for the replication
+ :param naming_context: the DN of the naming context to replicate
+ :param req_options: replication options for the DsReplicaSync call
+ :raise drsException: if any error occur while sending and receiving the reply
+ for the dsReplicaSync
+ """
+
+ nc = drsuapi.DsReplicaObjectIdentifier()
+ nc.dn = naming_context
+
+ req1 = drsuapi.DsReplicaSyncRequest1()
+ req1.naming_context = nc;
+ req1.options = req_option
+ req1.source_dsa_guid = misc.GUID(source_dsa_guid)
+
+ try:
+ drsuapiBind.DsReplicaSync(drsuapi_handle, 1, req1)
+ except Exception, estr:
+ raise drsException("DsReplicaSync failed %s" % estr)
+
+def sendRemoveDsServer(drsuapiBind, drsuapi_handle, server_dsa_dn, domain):
+ """
+ :param drsuapiBind: a drsuapi Bind object
+ :param drsuapi_handle: a drsuapi hanle on the drsuapi connection
+ :param server_dsa_dn: a DN object of the server's dsa that we want to demote
+ :param domain: a DN object of the server's domain
+ :raise drsException: if any error occur while sending and receiving the reply
+ for the DsRemoveDSServer
+ """
+
+ try:
+ req1 = drsuapi.DsRemoveDSServerRequest1()
+ req1.server_dn = str(server_dsa_dn)
+ req1.domain_dn = str(domain)
+ req1.commit = 1
+
+ drsuapiBind.DsRemoveDSServer(drsuapi_handle, 1, req1)
+ except Exception, estr:
+ raise drsException("DsRemoveDSServer failed %s" % estr)
+
def drs_DsBind(drs):
'''make a DsBind call, returning the binding handle'''
bind_info = drsuapi.DsBindInfoCtr()
diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
index 5f546a1..b46b4d8 100644
--- a/source4/scripting/python/samba/join.py
+++ b/source4/scripting/python/samba/join.py
@@ -87,7 +87,7 @@ class dc_join(object):
ctx.forest_domain_name = ctx.get_forest_domain_name()
ctx.invocation_id = misc.GUID(str(uuid.uuid4()))
- ctx.dc_ntds_dn = ctx.get_dsServiceName()
+ ctx.dc_ntds_dn = ctx.samdb.get_dsServiceName()
ctx.dc_dnsHostName = ctx.get_dnsHostName()
ctx.behavior_version = ctx.get_behavior_version()
@@ -207,10 +207,6 @@ class dc_join(object):
return ctx.cldap_ret.pdc_dns_name
- def get_dsServiceName(ctx):
- res = ctx.samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
- return res[0]["dsServiceName"][0]
-
def get_behavior_version(ctx):
res = ctx.samdb.search(base=ctx.base_dn, scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
if "msDS-Behavior-Version" in res[0]:
diff --git a/source4/scripting/python/samba/netcmd/domain.py b/source4/scripting/python/samba/netcmd/domain.py
index bd73b6c..6c2ebfa 100644
--- a/source4/scripting/python/samba/netcmd/domain.py
+++ b/source4/scripting/python/samba/netcmd/domain.py
@@ -6,6 +6,7 @@
# Copyright Andrew Kroeger 2009
# Copyright Jelmer Vernooij 2009
# Copyright Giampaolo Lauria 2011
+# Copyright Matthieu Patou <mat at matws.net> 2011
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -25,15 +26,16 @@
import samba.getopt as options
import ldb
+import string
import os
import tempfile
import logging
-from samba import Ldb
from samba.net import Net, LIBNET_JOIN_AUTOMATIC
import samba.ntacls
from samba.join import join_RODC, join_DC, join_subdomain
from samba.auth import system_session
from samba.samdb import SamDB
+from samba.dcerpc import drsuapi
from samba.dcerpc.samr import DOMAIN_PASSWORD_COMPLEX, DOMAIN_PASSWORD_STORE_CLEARTEXT
from samba.netcmd import (
Command,
@@ -45,6 +47,10 @@ from samba.netcmd.common import netcmd_get_domain_infos_via_cldap
from samba.samba3 import Samba3
from samba.samba3 import param as s3param
from samba.upgrade import upgrade_from_samba3
+from samba.drs_utils import (
+ sendDsReplicaSync, drsuapi_connect, drsException,
+ sendRemoveDsServer)
+
from samba.dsdb import (
DS_DOMAIN_FUNCTION_2000,
@@ -52,6 +58,11 @@ from samba.dsdb import (
DS_DOMAIN_FUNCTION_2003_MIXED,
DS_DOMAIN_FUNCTION_2008,
DS_DOMAIN_FUNCTION_2008_R2,
+ DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL,
+ DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL,
+ UF_WORKSTATION_TRUST_ACCOUNT,
+ UF_SERVER_TRUST_ACCOUNT,
+ UF_TRUSTED_FOR_DELEGATION
)
def get_testparm_var(testparm, smbconf, varname):
@@ -169,6 +180,237 @@ class cmd_domain_join(Command):
+class cmd_domain_demote(Command):
+ """Demote ourselves from the role of Domain Controller"""
+
+ synopsis = "%prog [options]"
+
+ takes_options = [
+ Option("--server", help="DC to force replication before demote", type=str),
+ Option("--targetdir", help="where provision is stored", type=str),
+ ]
+
+
+ def run(self, sambaopts=None, credopts=None,
+ versionopts=None, server=None, targetdir=None):
+ lp = sambaopts.get_loadparm()
+ creds = credopts.get_credentials(lp)
+ net = Net(creds, lp, server=credopts.ipaddress)
+
+ netbios_name = lp.get("netbios name")
+ samdb = SamDB(session_info=system_session(), credentials=creds, lp=lp)
+ if not server:
+ res = samdb.search(expression='(&(objectClass=computer)(serverReferenceBL=*))', attrs=["dnsHostName", "name"])
+ if (len(res) == 0):
+ raise CommandError("Unable to search for servers")
+
+ if (len(res) == 1):
+ raise CommandError("You are the latest server in the domain")
+
+ server = None
+ for e in res:
+ if str(e["name"]).lower() != netbios_name.lower():
+ server = e["dnsHostName"]
+ break
+
+ ntds_guid = samdb.get_ntds_GUID()
+ msg = samdb.search(base=str(samdb.get_config_basedn()), scope=ldb.SCOPE_SUBTREE,
+ expression="(objectGUID=%s)" % ntds_guid,
+ attrs=['options'])
+ if len(msg) == 0 or "options" not in msg[0]:
+ raise CommandError("Failed to find options on %s" % ntds_guid)
+
+ ntds_dn = msg[0].dn
+ dsa_options = int(str(msg[0]['options']))
+
+ res = samdb.search(expression="(fSMORoleOwner=%s)" % str(ntds_dn),
+ controls=["search_options:1:2"])
+
+ if len(res) != 0:
+ raise CommandError("Current DC is still the owner of %d role(s), use the role command to transfer roles to another DC")
+
+ print "Using %s as partner server for the demotion" % server
+ (drsuapiBind, drsuapi_handle, supportedExtensions) = drsuapi_connect(server, lp, creds)
+
+
+
+
+ print "Desactivating inbound replication"
+
+ nmsg = ldb.Message()
+ nmsg.dn = msg[0].dn
+
+ dsa_options |= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+
+ if not (dsa_options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) and not samdb.am_rodc():
+
+ print "Asking partner server %s to synchronize from us" % server
+ for part in (samdb.get_schema_basedn(),
+ samdb.get_config_basedn(),
+ samdb.get_root_basedn()):
+ try:
+ sendDsReplicaSync(drsuapiBind, drsuapi_handle, ntds_guid, str(part), drsuapi.DRSUAPI_DRS_WRIT_REP)
+ except drsException, e:
+ print "Error while demoting, re-enabling inbound replication"
+ dsa_options ^= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+ raise CommandError("Error while sending a DsReplicaSync for partion %s" % str(part), e)
+ try:
+ remote_samdb = SamDB(url="ldap://%s" % server,
+ session_info=system_session(),
+ credentials=creds, lp=lp)
+
+ print "Changing userControl and container"
+ res = remote_samdb.search(base=str(remote_samdb.get_root_basedn()),
+ expression="(&(objectClass=user)(sAMAccountName=%s$))" %
+ netbios_name.upper(),
+ attrs=["userAccountControl"])
+ dc_dn = res[0].dn
+ uac = int(str(res[0]["userAccountControl"]))
+
+ except Exception, e:
+ print "Error while demoting, re-enabling inbound replication"
+ dsa_options ^= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+ raise CommandError("Error while changing account control", e)
+
+ if (len(res) != 1):
+ print "Error while demoting, re-enabling inbound replication"
+ dsa_options ^= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+ raise CommandError("Unable to find object with samaccountName = %s$"
+ " in the remote dc" % netbios_name.upper())
+
+ olduac = uac
+
+ uac ^= (UF_SERVER_TRUST_ACCOUNT|UF_TRUSTED_FOR_DELEGATION)
+ uac |= UF_WORKSTATION_TRUST_ACCOUNT
+
+ msg = ldb.Message()
+ msg.dn = dc_dn
+
+ msg["userAccountControl"] = ldb.MessageElement("%d" % uac,
+ ldb.FLAG_MOD_REPLACE,
+ "userAccountControl")
+ try:
+ remote_samdb.modify(msg)
+ except Exception, e:
+ print "Error while demoting, re-enabling inbound replication"
+ dsa_options ^= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+
+ raise CommandError("Error while changing account control", e)
+
+ parent = msg.dn.parent()
+ rdn = str(res[0].dn)
+ rdn = string.replace(rdn, ",%s" % str(parent), "")
+ # Let's move to the Computer container
+ i = 0
+ newrdn = rdn
+
+ computer_dn = ldb.Dn(remote_samdb, "CN=Computers,%s" % str(remote_samdb.get_root_basedn()))
+ res = remote_samdb.search(base=computer_dn, expression=rdn, scope=ldb.SCOPE_ONELEVEL)
+
+ if (len(res) != 0):
+ res = remote_samdb.search(base=computer_dn, expression="%s-%d" % (rdn, i),
+ scope=ldb.SCOPE_ONELEVEL)
+ while(len(res) != 0 and i < 100):
+ i = i + 1
+ res = remote_samdb.search(base=computer_dn, expression="%s-%d" % (rdn, i),
+ scope=ldb.SCOPE_ONELEVEL)
+
+ if i == 100:
+ print "Error while demoting, re-enabling inbound replication"
+ dsa_options ^= DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL
+ nmsg["options"] = ldb.MessageElement(str(dsa_options), ldb.FLAG_MOD_REPLACE, "options")
+ samdb.modify(nmsg)
+
+ msg = ldb.Message()
+ msg.dn = dc_dn
+
+ msg["userAccountControl"] = ldb.MessageElement("%d" % uac,
+ ldb.FLAG_MOD_REPLACE,
+ "userAccountControl")
+
+ remote_samdb.modify(msg)
+
+ raise CommandError("Unable to find a slot for renaming %s,"
+ " all names from %s-1 to %s-%d seemed used" %
+ (str(dc_dn), rdn, rdn, i - 9))
+
+ newrdn = "%s-%d" % (rdn, i)
+
--
Samba Shared Repository
More information about the samba-cvs
mailing list