samba.git/python/samba/join.py, branch talloc-2.3.1

join: Use a specific attribute order for the DsAddEntry nTDSDSA object

2019-07-24T04:18:21+00:00

Joining a Windows domain can throw an error if the HasMasterNCs
attribute occurs before msDS-HasMasterNCs. This patch changes the
attribute order so that msDS-HasMasterNCs is always first.

Previously on python2, the dictionary hash order was arbitrary but
constant. By luck, msDS-HasMasterNCs was always before HasMasterNCs, so
we never noticed any problem. With python3, the dictionary hash order
now changes everytime you run the command, so the order is
unpredictable.

To enforce a order, we can change to use an OrderedDict, which will
return the keys in the order they're added.

I've asked Microsoft to clarify the protocol requirement here WRT
attribute order. However, in the meantime we may as well fix the problem
for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14046
RN: When trying to join a Windows domain (with functional level 2008R2)
as an AD domain controller, the 'samba-tool domain join' command could
throw a python exception: 'RuntimeError ("DsAddEntry failed")'. When
this problem occurred, you would also see the message "DsAddEntry failed
with status WERR_ACCESS_DENIED info (8363, 'WERR_DS_NO_CROSSREF_FOR_NC')"
in the command output. This issue has now been resolved. Note that this
problem would only occur on Samba v4.10 when using the Python3 packages.

Signed-off-by: Tim Beale 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed Jul 24 04:18:21 UTC 2019 on sn-devel-184

domain join: enable ldb batch mode

2019-07-04T10:02:23+00:00

Enable ldb "batch_mode" transactions duting a join to improve
performance.

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

join subdomain: changes for --backend-store-size

2019-07-02T02:23:09+00:00

Pass the 'backend_store_size' parameter through to DCJoinContext.

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

samba-tool clone-dc-database: Add --backend-store-size option

2019-07-02T02:23:09+00:00

Add a new "samba-tool drs clone-dc-database" option "backend-store-size".
This allows the lmdb map size to be set during a clone, instead of
hard-wiring it to 8Gb.

Signed-off-by: Gary Lockyer '
Reviewed-by: Andrew Bartlett

samba-tool domain join: Add --backend-store-size option

2019-07-02T02:23:09+00:00

Add a new "samba-tool domain join" option "backend-store-size".
This allows the lmdb map size to be set during a provision, instead of
hard-wiring it to 8Gb.

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

python join: Set index transaction cache size.

2019-04-04T07:45:03+00:00

The default value is too small for joining a large domain.  So we specify a
size of 200,000 which is suitable for domains with up to 100,000 users.

At a later date this could be added as a parameter to the join, but
200,000 should be suitable for now.

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu Apr  4 07:45:03 UTC 2019 on sn-devel-144

join: Throw CommandError instead of Exception for simple errors

2019-01-16T21:11:04+00:00

Throwing an exception here still dumps out the Python stack trace, which
can be a little disconcerting for users.

In this case, the stack trace isn't going to really help at all (the
problem is pretty obvious), and it obscures the useful message
explaining what went wrong.

Throw a CommandError instead, which samba-tool will catch and display
more nicely.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747

Signed-off-by: Tim Beale 
Reviewed-by: Rowland Penny 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Wed Jan 16 22:11:04 CET 2019 on sn-devel-144

join: Fix TypeError when handling exception

2019-01-16T17:51:27+00:00

When we can't resolve a domain name, we were inadvertently throwing a
TypeError whilst trying to output a helpful message. E.g.

ERROR(): uncaught exception - 'NTSTATUSError' object
does not support indexing

Instead of indexing the object, we want to index the Exception.args so
that we just display the string portion of the exception error.

The same problem is also present for the domain trust commands.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747

Signed-off-by: Tim Beale 
Reviewed-by: Rowland Penny 
Reviewed-by: Jeremy Allison

PY3: net.change_password & net.set_password take string not bytes

2018-12-10T09:38:21+00:00

Signed-off-by: Noel Power 
Reviewed-by: Andrew Bartlett

python/samba: PY3 Credential.set_password takes string

2018-12-10T09:38:21+00:00

Signed-off-by: Noel Power 
Reviewed-by: Andrew Bartlett