[PATCH] s4-drs: replmd_delete implementation

[tridge at samba.org]

Hi Eduardo,

 > I installed W2K8 R2 and now I'm doing some deletion tests.

ok, great!

 > First of all, although I don't need this to test the deletion, I could not
 > vampire samba to the W2K8-R2's functional level? Do I need to do extra
 > steps?

what error are you getting? Are you using the vampire_ad.sh script?

It certainly works for me, although I'm using the drs-linked-attribs
branch, not the master branch at the moment (what branch are you
testing?)

 > I noticed that the script to enable Recycle Bin only works on
 > W2K8-R2's functional level.

that's right - only R2 function level supports the recycle bin

 > When Recycle Bin is deactivated, the object is transformed into a tombstone.
 > Can a tombstone be reverted to a live object?

not without losing some important attributes. That is why the recycle
bin matters - without that addition you couldn't undelete an object
without losing some important attributes.

 > When Recycle Bin is activated and after deleting an object, is it possible
 > to force the object to be transformed into a Recycled Object? I would like
 > to do this test on Windows to see the Recycled Object and confirm the
 > changes that Windows does.

I think you would need to set the times that windows keeps the object
at each stage to a very small number, and watch how they change. I
don't know of any way of forcing an object to go through the stages
more quickly. That would be a good question to ask the Microsoft
dochelp people though (please CC the cifs-protocol list if you ask).

 > How can I transform the Deleted Object back into a live object? The only way
 > is removing the isDeleted attribute and modifying the DN by hand?

I think that's right. We should probably develop some helper python
scripts to make this a bit easier - maybe in scripting/bin/objrecover?

 > The implementation of the test case should go in
 > lib/ldb/tests/python/ldap.py?

no, I think a separate test suite would be better for this. I suspect
it will grow quite large. Maybe call it
lib/ldb/tests/python/deletetest.py. It should have a similar structure
to the ldap.py tests, but separated out for AD deletion (including
recycling and tombstoning).

 > I suppose I'm going to use the ldb object's delete operation,
 > right?

yes, but also modify and rename

 > How deep the test case should test?

start simple, but I think this will probably expand into quite a
complex test suite. 

 > For example, the test should check if, after the delete operation,
 > the DN has changed to cn=oldcn\0DEL:OBJECTGUID, if all the
 > attributes that are marked to be preserved exists and the others
 > don't exist or the test just need to check if the object was moved
 > to the Deleted Objects partition and has the isDeleted attribute?

I think we need to test in quite a detailed manner, which means we
will want to create a wide variety of objects and make sure they
behave correctly. We probably also need to add methods to force the
movement of an object through the various stages of deletion so we can
force the deletion process.

 > On Monday I'm planning to start playing with python to see how I can do the
 > operations with python.

ok, enjoy!

Cheers, Tridge