summaryrefslogtreecommitdiff
path: root/python/samba/join.py
AgeCommit message (Collapse)AuthorFilesLines
2020-10-02python2 reduction: Merge remaining compat code into commonDavid Mulder1-1/+1
The remaining compat code (get_string, get_bytes, cmp) are useful helper routines which we should simply merge into common (especially since there is some duplication here). Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Fri Oct 2 14:49:36 UTC 2020 on sn-devel-184
2020-08-11python compat: remove text_typeDouglas Bagnall1-2/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-07-17python/join: use the provided krbtgt link in cleanup_old_accountsDouglas Bagnall1-1/+1
Before we were putting it in an otherwise unused variable, and deleting the previous krbtgt_dn, if any. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2020-06-23python: Correctly re-raise the LdbError if the embedded error is not ↵Andrew Bartlett1-1/+1
ldb.ERR_UNWILLING_TO_PERFORM The current code attempts a SAMR based password set for all errors, we want to continue on LDAP or local LDB (in the restore case) unless we really got the specific error given by Windows 2000. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14414 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@suse.com> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Tue Jun 23 05:07:00 UTC 2020 on sn-devel-184
2020-02-11samba-tool domain join: remove sub domain join codeGary Lockyer1-56/+0
Remove the unused sub domain join code, the option was removed by commit 5583208aed0e4647269e48aa1d3c5c48a73001ac. This commit completely removes the now unused code. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Feb 11 17:41:32 UTC 2020 on sn-devel-184
2019-07-24join: Use a specific attribute order for the DsAddEntry nTDSDSA objectTim Beale1-7/+16
Joining a Windows domain can throw an error if the HasMasterNCs attribute occurs before msDS-HasMasterNCs. This patch changes the attribute order so that msDS-HasMasterNCs is always first. Previously on python2, the dictionary hash order was arbitrary but constant. By luck, msDS-HasMasterNCs was always before HasMasterNCs, so we never noticed any problem. With python3, the dictionary hash order now changes everytime you run the command, so the order is unpredictable. To enforce a order, we can change to use an OrderedDict, which will return the keys in the order they're added. I've asked Microsoft to clarify the protocol requirement here WRT attribute order. However, in the meantime we may as well fix the problem for users. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14046 RN: When trying to join a Windows domain (with functional level 2008R2) as an AD domain controller, the 'samba-tool domain join' command could throw a python exception: 'RuntimeError ("DsAddEntry failed")'. When this problem occurred, you would also see the message "DsAddEntry failed with status WERR_ACCESS_DENIED info (8363, 'WERR_DS_NO_CROSSREF_FOR_NC')" in the command output. This issue has now been resolved. Note that this problem would only occur on Samba v4.10 when using the Python3 packages. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jul 24 04:18:21 UTC 2019 on sn-devel-184
2019-07-04domain join: enable ldb batch modeGary Lockyer1-2/+2
Enable ldb "batch_mode" transactions duting a join to improve performance. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02join subdomain: changes for --backend-store-sizeGary Lockyer1-4/+6
Pass the 'backend_store_size' parameter through to DCJoinContext. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool clone-dc-database: Add --backend-store-size optionGary Lockyer1-4/+8
Add a new "samba-tool drs clone-dc-database" option "backend-store-size". This allows the lmdb map size to be set during a clone, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>' Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain join: Add --backend-store-size optionGary Lockyer1-6/+14
Add a new "samba-tool domain join" option "backend-store-size". This allows the lmdb map size to be set during a provision, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-04python join: Set index transaction cache size.Gary Lockyer1-0/+5
The default value is too small for joining a large domain. So we specify a size of 200,000 which is suitable for domains with up to 100,000 users. At a later date this could be added as a parameter to the join, but 200,000 should be suitable for now. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Apr 4 07:45:03 UTC 2019 on sn-devel-144
2019-01-16join: Throw CommandError instead of Exception for simple errorsTim Beale1-3/+4
Throwing an exception here still dumps out the Python stack trace, which can be a little disconcerting for users. In this case, the stack trace isn't going to really help at all (the problem is pretty obvious), and it obscures the useful message explaining what went wrong. Throw a CommandError instead, which samba-tool will catch and display more nicely. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Jeremy Allison <rpenny@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Jan 16 22:11:04 CET 2019 on sn-devel-144
2019-01-16join: Fix TypeError when handling exceptionTim Beale1-1/+1
When we can't resolve a domain name, we were inadvertently throwing a TypeError whilst trying to output a helpful message. E.g. ERROR(<class 'TypeError'>): uncaught exception - 'NTSTATUSError' object does not support indexing Instead of indexing the object, we want to index the Exception.args so that we just display the string portion of the exception error. The same problem is also present for the domain trust commands. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Jeremy Allison <rpenny@samba.org>
2018-12-10PY3: net.change_password & net.set_password take string not bytesNoel Power1-1/+1
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10python/samba: PY3 Credential.set_password takes stringNoel Power1-1/+1
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-06join: Fix join large-DB timeout against WindowsTim Beale1-1/+2
The LDAP connection can also timeout when trying to join a Windows DC with a very large database. However, in this case Windows gives a slightly different error message (NT_STATUS_CONNECTION_RESET instead of NT_STATUS_CONNECTION_DISCONNECTED). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13612 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01python/join: remove unused imports and variablesDouglas Bagnall1-4/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01python join: use the sd_utils we importedDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <noel.power@suse.com>
2018-10-31netcmd: Add backend-store option to domain backup/rename cmdsTim Beale1-7/+11
Currently the online/rename backup files always use the default backend (TDB) and there is no way to change this. This patch adds the backend-store option to the backup commands so that you can create a backup with an MDB backend, if needed. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-10-18join: Sanity-check LDB connection before failed join cleanupTim Beale1-0/+4
Joining a large DB can take so long that the LDAP connection times out. The previous patch fixed the 'happy case' where the join succeeds. However, if the commit or replication fails (throwing an exception), then the cleanup code can also fail when it tries to delete objects from the remote DC. This then gives you an error pointing to cleanup_old_accounts() rather than what actually went wrong. This patch adds a sanity-check that if the join fails, that the LDB connection to the remote DC is still alive, before we start deleting objects. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13612 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-10-18join: Avoid searching for more than strictly required during sanity checkAndrew Bartlett1-3/+3
We check for the default base DN as this does require authentication, but we do not need to search for more than just that (so use SCOPE_BASE) and we need no attributes, so ask for none Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-10-18join: LDAP connection to remote DC can timeout in large joinTim Beale1-0/+21
When joining a very large domain (e.g. 100K users), the replication can take so long that the LDAP connection to the remote DC times out. This patch avoids the problem by adding in a sanity-check after the replication finishes that the LDB connection is still alive. If not, then we reconnect. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13612 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-26join: Support site detection when --server is specifiedTim Beale1-3/+18
When a new DC is joined to the domain, samba-tool would automatically detect an appropriate site for the new DC. However, it only did this if the --server option wasn't specified. The new DC's site got automatically updated as part of the finddc() work, however, this step gets skipped if we already know the server DC to join to. In other words, if Default-First-Site-Name doesn't exist and you specify --server in the join, then you have to also specify --site manually, otherwise the command fails. This is precisely what's happening in the join_ldapcmp.sh test, now that the backupfromdc testenv no longer has the Default-First-Site-Name present. This patch adds a new find_dc_site() function which uses the same net.finddc() API (except based on the server-address rather than domain-name). Assigning DEFAULTSITE has been moved so that it only gets done if finddc() can't determine the site. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-26join: Avoid duplicating "Default-First-Site-Name" stringTim Beale1-2/+3
The provision code already defines "Default-First-Site-Name" so we might as well reuse it. The join.py already uses a suitable default, so assigning the default in the domain netcmd code is unnecessary. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-15s4/torture/drs/python: py2/py3 compat changes for samba4.drs.repl_rodcNoel Power1-1/+2
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-15fallout from py_dsdb_DsReplicaAttribute to -> bytesNoel Power1-0/+2
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-06PEP8: fix E127: continuation line over-indented for visual indentJoe Guo1-7/+7
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-06PEP8: fix E122: continuation line missing indentation or outdentedJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-03python/samba: changes to make samba.tests.samba_tool.join run under py3Noel Power1-3/+3
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-24PEP8: better formatting of (CONST1|CONST2)Douglas Bagnall1-1/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-24PEP8: fix E713: test for membership should be 'not in'Joe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E711: comparison to None should be 'if cond is not None:'Joe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E502: the backslash is redundant between bracketsJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E401: multiple imports on one lineJoe Guo1-1/+4
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E303: too many blank lines (2)Joe Guo1-13/+0
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E302: expected 2 blank lines, found 1Joe Guo1-0/+3
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E227: missing whitespace around bitwise or shift operatorJoe Guo1-2/+2
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E203: whitespace before ':'Joe Guo1-46/+46
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E202: whitespace before ')'Joe Guo1-5/+5
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E201: whitespace after '('Joe Guo1-6/+6
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E128: continuation line under-indented for visual indentJoe Guo1-49/+49
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E127: continuation line over-indented for visual indentJoe Guo1-8/+8
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E124: closing bracket does not match visual indentationJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E123: closing bracket does not match indentation of opening ↵Joe Guo1-2/+2
bracket's line Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-07-05join: Add more framework for renaming a domainTim Beale1-3/+97
Add a DCCloneContext subclass which will rename the DB objects as they get cloned. This uses the drs_ReplicateRenamer class added to drs_utils in an earlier patch. Where the drs_Replicate object currently gets created has been split out into a simple new function, which we can then override in the rename case. The other important difference is overriding the provision step, so that we use the new domain-DN/realm when setting up the initial SAM DB (and smb.conf, secrets.ldb, etc). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-07-03netcmd: domain backup restore commandAaron Haslett1-13/+25
Add a command option that restores a backup file. This is only intended for recovering from a catastrophic failure of the domain. The old domain DCs are removed from the DB and a new DC is added. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-03netcmd: domain backup online commandAaron Haslett1-0/+1
This adds a samba-tool command that can be run against a remote DC to produce a backup-file for the current domain. The backup stores similar info to what a new DC would get if it joined the network. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-03join: Remove unnecessary clone_only flagTim Beale1-5/+7
For the clone-only case, we have been avoiding a block of code in the DCJoinContext's __init__(). The main reason we do this is because the netbios_name is None for clones, and this block of code tries to derive a bunch of values based on the netbios_name (otherwise, a few lines into this block, it tries to do NoneType.lower(), which Python doesn't like very much). This code is not particularly clone-specific - it is just never going to work if the netbios_name is None. So we can change the conditional check, which allows us to get rid of the clone_only flag. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Tue Jul 3 08:12:10 CEST 2018 on sn-devel-144
2018-07-03join: Refactor clone_only case to simplify codeTim Beale1-49/+75
Currently for DC clones, we create a regular DCJoinContext, se a 'clone_only' flag, and then make lots of special checks for this flag throughout the code. Instead, we can use inheritance to create a DCCloneContext sub-class, and put the specialization there. This means we can remove all the 'clone_only' checks from the code. The only 2 methods that really differ are do_join() and join_finalize(), and these don't share much code at all. (To avoid duplication, I split the first part of do_join() into a new build_nc_lists() function, but this is a pretty trivial code move). We still pass the clone_only flag into the __init__() as there's still one case where we want to avoid doing work in the case of the clone. For clarity, I'll refactor this in a subsequent patch. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-03join: Rename dc_join() so it looks like an objectTim Beale1-12/+17
dc_join() is creating an object, but it currently looks like it's just a function call. Rename it to look more object-like. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 05:39:26 +0000