[PATCH] samba-tool throws error if there is an empty FSMO role

[Rowland Penny]

On 08/04/16 22:01, Rowland Penny wrote:
> On 08/04/16 21:30, Andrew Bartlett wrote:
>>
>>
>> All of the above is entirely possible in 'make test'. Indeed, I missed
>> it in my first search, much of that part is tested here:
>> source4/torture/drs/python/fsmo.py
>
> I have had a look, it looks like something to build on.
>
>>
>> However, all I'm asking for in this case is that you show that 'samba
>> -tool fsmo show' produces non-faulting output in all of the
>> environments we already have, and the output is reasonable. Bonus
>> points if it checks the results are correct.
>>
>
> I will try.
>
>>> Would you like to advise me just how I could that without ending up
>>> with
>>> a test that wasn't several times the size of fsmo.py and wouldn't
>>> take
>>> an excessive time to run.
>> Tests are often the same size as the code they test, and I don't expect
>> it to take more than trivial time to run.
>>
>> Have a look at timecmd.py and rodc.py.  See how they assert that the
>> command ran successfully, and see how they check for strings in the out
>> (output) and err (stderr) variables?
>>
>> That is what you need to do.  Then run that in the different
>> environments by changing source4/selftest/tests.py to run that test in
>> each of fl2000dc, fl2003dc, fl2008r2dc and vampire_dc
>
> I can only try.
>
>>
>>> I personally think that testing fsmo.py in the way you suggest is a
>>> waste of time, if everything is created correctly (by code that isn't
>>> in
>>> fsmo.py) then fsmo.py will work without my changes, but it seems that
>>> there are times when everything isn't created correctly and then
>>> fsmo.py
>>> throws an error.
>> Indeed.  This happens in the real world.  It is great that you patched
>> it - I already needed to point a client at the patch when they hit this
>> exact issue!
>
> Oh great, you will use my code, but won't put it into Samba :-D
>
>>> Tests are all well and good, but only for things that are created
>>> automatically. The code in fsmo.py shows, transfers or seizes FSMO
>>> roles, it doesn't (in the first instance) create the owners of these
>>> roles, bearing this in mind, perhaps the tests you ask for should be
>>> aimed at other code.
>>>
>>> Please bear in mind, whilst we are arguing about this, there is
>>> faulty
>>> code in fsmo.py.
>> I agree, and I would like it fixed.  I'm also trying to teach you how
>> to write tests for your code, so that it stays that way.
>
> I am a mechanic by trade, one of the first things you learn, if isn't 
> broken, you do not fix it, this is why I am finding it hard to 
> envisage the code to break something and then test for the breakage. :-)
>
>>
>> I know I'm asking you to spend non-trivial additional time on this.  I
>> realise that I'm stretching you and I know that is frustrating.
>>
>> Most of us who work on Samba find ourselves spending as much time on
>> the tests as the original code, and that has thankfully become part of
>> our culture, and what makes Samba as great as it is.
>>
>> My hope is that you can learn the art and habit of automated testing,
>> because you have shown great ability to learn the Samba craft already,
>> and it makes your patches much, much, easier to accept.
>
> OK, I understand where you are coming from and lets see where I go 
> from here, I normally just want to fix things :-)
>
> Rowland

So, I finally got time to look at this again. There are no DNS zones in 
my provisioned as a 2000 test domain and replication wasn't working, so 
I tried to demote the second DC, it wouldn't. I then tried to the demote 
with ' --remove-other-dead-server' and got this:

root at dc2000a:~# samba-tool domain demote 
--remove-other-dead-server=dc2000b -Uadministrator
Removing nTDSConnection: CN=155f1ecb-34bb-4a74-9f76-863282c3af28,CN=NTDS 
Settings,CN=DC2000A,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=test,DC=tld
Removing nTDSDSA: CN=NTDS 
Settings,CN=DC2000B,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=test,DC=tld 
(and any children)
Removing computer account: CN=DC2000B,OU=Domain 
Controllers,DC=samba,DC=test,DC=tld (and any child objects)
ERROR(ldb): uncaught exception - 
../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:3381: Failed to 
remove backlink of serverReferenceBL when deleting CN=DC2000B,OU=Domain 
Controllers,DC=samba,DC=test,DC=tld
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py", 
line 175, in _run
     return self.run(*args, **kwargs)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", 
line 720, in run
     remove_dc.remove_dc(samdb, logger, remove_other_dead_server)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/remove_dc.py", line 
423, in remove_dc
     remove_dns_account=True)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/remove_dc.py", line 
351, in offline_remove_ntds_dc
     remove_dns_account=remove_dns_account)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/remove_dc.py", line 
251, in offline_remove_server
     samdb.delete(computer_dn, ["tree_delete:0"])
A transaction is still active in ldb context [0x141be20] on 
tdb:///usr/local/samba/private/sam.ldb

I will kill the two DCs and start again, after I upgrade from 4.4.0 to 
4.4.3

Rowland