[Samba] [PATCH] Re: Samba 4.1.17 classic update w/LDAP - parsing error

[Andrew Bartlett]

On Sat, 2015-10-31 at 10:45 +0000, Rowland Penny wrote:
> On 31/10/15 08:51, Andrew Bartlett wrote:
> > On Wed, 2015-10-28 at 14:35 +0100, Mgr. Peter Tuharsky wrote:
> > > Hallo,
> > > 
> > > I have two news. The first one: the patch probably works. Second:
> > > there
> > > is another bug.
> > > 
> > > When I encountered the bug again after patching, I have raised
> > > debug
> > > level and figured out that the problem is with user "guest" - he
> > > was
> > > in
> > > our old domain, however samba-tool probably creates him
> > > automatically
> > > and then couldn't import him.
> > > 
> > > So, please fix the tool so that it ignores such user, or update
> > > the
> > > DOCS
> > > so that forbidden users are known for admin before attempting the
> > > classicupdate.
> > > 
> > > The import FINALLY works with patched 4.3.1. But when I tested
> > > again
> > > with 4.1.17, it ends up with the bug. So the patch seems working
> > > for
> > > its
> > > purpose, but there is the bug with guest user and that needs to
> > > get
> > > fixed.
> > You are welcome to apply for an account to change the wiki page:
> > 
> > 
> > https://wiki.samba.org/index.php/Samba4/samba-tool/domain/classicup
> > grad
> > e/HOWTO#Preparations
> > 
> > Thanks!
> > 
> > Andrew Bartlett
> 
> Rather than adding something to the wiki, how about adding something 
> like this to upgrade.py:
> 
>              if username.lower() == 'guest':
>                  logger.warn("You have a user '%s' in your existing 
> directory, \
> this will be replaced by the builtin user 'Guest") %
> (userdata[username])
> 
> I 'think' what happened was the upgrade ran the intial provision and 
> this created the builtin user 'Guest' and then when the upgrade tried
> to 
> add the user 'guest', this failed because it already existed.

The number of potential conflicts here seems endless, I would rather
not list them by hand in the code.  We can either have it print a
message based on a set-intersection with a search just after the
provision, and/or we can improve how the 'add' errors are presented to
make them clearer.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba