summaryrefslogtreecommitdiff
path: root/python/samba/join.py
AgeCommit message (Collapse)AuthorFilesLines
2025-05-26python:join: Add missing wordJennifer Sutton1-1/+1
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26samba-tool: Filter confidential attributes out of backups made with the ↵Jennifer Sutton1-2/+7
‘--no-secrets’ option Without this change, ‘lab domains’ and backups intended not to contain secrets will still contain confidential information, such as BitLocker recovery data and KDS root keys. Add a new class that filters these attributes out. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26drs_utils: Split process_chunk() out into its own classJennifer Sutton1-8/+11
This makes it easier to add classes with new functionality without having to figure out how to slot them into a linear class hierarchy. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python3: Remove Python 2–only call to decode()Jennifer Sutton1-1/+1
AttributeError: 'str' object has no attribute 'decode' BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-05-26python:join: Remove unnecessary local variableJennifer Sutton1-2/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15852 Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-03-29python:join: do not suppress unexpected DNS enum errorsDouglas Bagnall1-0/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-06-12python:join: avoid useless use of py2-compat string_to_byte_arrayDouglas Bagnall1-3/+3
This was a workaround for the migration to Python 3, but is now just extra work for the computer and cognitive load for us. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-05dsdb: Remove calls to ldb.set_opaque_integer()Andrew Bartlett1-6/+6
This routine will shortly be removed, it is now replaced by an improved ldb.set_opaque() Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2023-12-15python: use python3 style super statementsRob van der Linde1-12/+12
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-15python: pep257: docstring should use double quotesRob van der Linde1-16/+16
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14python: Remove unused parameter ‘targetdir’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14python: Remove unused parameter ‘lp’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14python: Remove unused parameter ‘targetdir’Joseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14python: Remove unfinished join methodJoseph Sutton1-6/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python:join: Fix references to undefined variablesJoseph Sutton1-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove unused importsJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba: Fix code spellingAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jun 23 14:51:14 UTC 2023 on atb-devel-224
2023-05-16samba-tool domain join: Allow "ad dc functional level" to change whichAndrew Bartlett1-2/+7
level we claim to be during an AD join Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-03-22python:join: run domain adprep as part of join_provision_own_domain()Stefan Metzmacher1-1/+28
This is currently unused as we don't support more than one domain per forest, but it will help it future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Mar 22 23:05:39 UTC 2023 on atb-devel-224
2023-03-14dsdb: Avoid ERROR(ldb): uncaught exception - Deleted target CN=NTDS ↵Andrew Bartlett1-0/+19
Settings... in join "samba-tool domain join" uses the replication API in a strange way, perhaps no longer required, except that we often still have folks upgrading from very old Samba versions. When deferring the writing out to the DB of link replication to the very end, there is a greater opportunity for the deletion of an object to have been sent with the other objects, and have the link applied later. This tells the repl_meta_data code to behave as if GET_TGT had been sent at the time the link was returned, allowing a link to a deleted object to be silently discarded. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15329 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-10-21s4-join: Fix typos in recent GET_ANC patch setJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-10-04python-drs: Add client-side debug and fallback for GET_ANCAndrew Bartlett1-9/+45
Samba 4.5 and earlier will fail to do GET_ANC correctly and will not replicate non-critical parents of objects with isCriticalSystemObject=TRUE when DRSUAPI_DRS_CRITICAL_ONLY is set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15189 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-10python: Remove unnecessary 'pass' statementsJoseph Sutton1-1/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-03-30python/join: improve logging of join_replicate()Stefan Metzmacher1-2/+3
It's useful to have timestamps to see the time used for replication and committing. We also warn the user that the committing stage may take some time. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-09-21python/join: Check for correct msDS-KrbTgtLink attributeJoseph Sutton1-3/+4
Previously, the wrong case was used when checking for this attribute, which meant krbtgt accounts were not being cleaned up. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-17join: provision_fill does not return anythingGarming Sam1-7/+7
Discovered by Semmle code analysis: https://lgtm.com/projects/g/samba-team/samba Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-1/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-08pydns: rename s/CNameRecord/CNAMERecord/ for consistencyDouglas Bagnall1-2/+2
Everything else is TXTRecord, SRVRrcord, SOARecord. Making CNAME the same allows easier lookups. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-04-07provision: Decrease the length of random machine passwordsJoseph Sutton1-1/+1
The current length of 128-255 UTF-16 characters currently causes generation of crypt() passwords to typically fail. This commit decreases the length to 120 UTF-16 characters, which is the same as that used by Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14621 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-03-17py.join: remove unused untested get_naming_masterDouglas Bagnall1-14/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Mar 17 18:23:04 UTC 2021 on sn-devel-184
2020-10-02python2 reduction: Merge remaining compat code into commonDavid Mulder1-1/+1
The remaining compat code (get_string, get_bytes, cmp) are useful helper routines which we should simply merge into common (especially since there is some duplication here). Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Fri Oct 2 14:49:36 UTC 2020 on sn-devel-184
2020-08-11python compat: remove text_typeDouglas Bagnall1-2/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2020-07-17python/join: use the provided krbtgt link in cleanup_old_accountsDouglas Bagnall1-1/+1
Before we were putting it in an otherwise unused variable, and deleting the previous krbtgt_dn, if any. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org>
2020-06-23python: Correctly re-raise the LdbError if the embedded error is not ↵Andrew Bartlett1-1/+1
ldb.ERR_UNWILLING_TO_PERFORM The current code attempts a SAMR based password set for all errors, we want to continue on LDAP or local LDB (in the restore case) unless we really got the specific error given by Windows 2000. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14414 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@suse.com> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Tue Jun 23 05:07:00 UTC 2020 on sn-devel-184
2020-02-11samba-tool domain join: remove sub domain join codeGary Lockyer1-56/+0
Remove the unused sub domain join code, the option was removed by commit 5583208aed0e4647269e48aa1d3c5c48a73001ac. This commit completely removes the now unused code. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Feb 11 17:41:32 UTC 2020 on sn-devel-184
2019-07-24join: Use a specific attribute order for the DsAddEntry nTDSDSA objectTim Beale1-7/+16
Joining a Windows domain can throw an error if the HasMasterNCs attribute occurs before msDS-HasMasterNCs. This patch changes the attribute order so that msDS-HasMasterNCs is always first. Previously on python2, the dictionary hash order was arbitrary but constant. By luck, msDS-HasMasterNCs was always before HasMasterNCs, so we never noticed any problem. With python3, the dictionary hash order now changes everytime you run the command, so the order is unpredictable. To enforce a order, we can change to use an OrderedDict, which will return the keys in the order they're added. I've asked Microsoft to clarify the protocol requirement here WRT attribute order. However, in the meantime we may as well fix the problem for users. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14046 RN: When trying to join a Windows domain (with functional level 2008R2) as an AD domain controller, the 'samba-tool domain join' command could throw a python exception: 'RuntimeError ("DsAddEntry failed")'. When this problem occurred, you would also see the message "DsAddEntry failed with status WERR_ACCESS_DENIED info (8363, 'WERR_DS_NO_CROSSREF_FOR_NC')" in the command output. This issue has now been resolved. Note that this problem would only occur on Samba v4.10 when using the Python3 packages. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jul 24 04:18:21 UTC 2019 on sn-devel-184
2019-07-04domain join: enable ldb batch modeGary Lockyer1-2/+2
Enable ldb "batch_mode" transactions duting a join to improve performance. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02join subdomain: changes for --backend-store-sizeGary Lockyer1-4/+6
Pass the 'backend_store_size' parameter through to DCJoinContext. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool clone-dc-database: Add --backend-store-size optionGary Lockyer1-4/+8
Add a new "samba-tool drs clone-dc-database" option "backend-store-size". This allows the lmdb map size to be set during a clone, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>' Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain join: Add --backend-store-size optionGary Lockyer1-6/+14
Add a new "samba-tool domain join" option "backend-store-size". This allows the lmdb map size to be set during a provision, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-04python join: Set index transaction cache size.Gary Lockyer1-0/+5
The default value is too small for joining a large domain. So we specify a size of 200,000 which is suitable for domains with up to 100,000 users. At a later date this could be added as a parameter to the join, but 200,000 should be suitable for now. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Apr 4 07:45:03 UTC 2019 on sn-devel-144
2019-01-16join: Throw CommandError instead of Exception for simple errorsTim Beale1-3/+4
Throwing an exception here still dumps out the Python stack trace, which can be a little disconcerting for users. In this case, the stack trace isn't going to really help at all (the problem is pretty obvious), and it obscures the useful message explaining what went wrong. Throw a CommandError instead, which samba-tool will catch and display more nicely. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Jeremy Allison <rpenny@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Jan 16 22:11:04 CET 2019 on sn-devel-144
2019-01-16join: Fix TypeError when handling exceptionTim Beale1-1/+1
When we can't resolve a domain name, we were inadvertently throwing a TypeError whilst trying to output a helpful message. E.g. ERROR(<class 'TypeError'>): uncaught exception - 'NTSTATUSError' object does not support indexing Instead of indexing the object, we want to index the Exception.args so that we just display the string portion of the exception error. The same problem is also present for the domain trust commands. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Jeremy Allison <rpenny@samba.org>
2018-12-10PY3: net.change_password & net.set_password take string not bytesNoel Power1-1/+1
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10python/samba: PY3 Credential.set_password takes stringNoel Power1-1/+1
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-06join: Fix join large-DB timeout against WindowsTim Beale1-1/+2
The LDAP connection can also timeout when trying to join a Windows DC with a very large database. However, in this case Windows gives a slightly different error message (NT_STATUS_CONNECTION_RESET instead of NT_STATUS_CONNECTION_DISCONNECTED). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13612 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01python/join: remove unused imports and variablesDouglas Bagnall1-4/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01python join: use the sd_utils we importedDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <noel.power@suse.com>
2018-10-31netcmd: Add backend-store option to domain backup/rename cmdsTim Beale1-7/+11
Currently the online/rename backup files always use the default backend (TDB) and there is no way to change this. This patch adds the backend-store option to the backup commands so that you can create a backup with an MDB backend, if needed. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-10-18join: Sanity-check LDB connection before failed join cleanupTim Beale1-0/+4
Joining a large DB can take so long that the LDAP connection times out. The previous patch fixed the 'happy case' where the join succeeds. However, if the commit or replication fails (throwing an exception), then the cleanup code can also fail when it tries to delete objects from the remote DC. This then gives you an error pointing to cleanup_old_accounts() rather than what actually went wrong. This patch adds a sanity-check that if the join fails, that the LDB connection to the remote DC is still alive, before we start deleting objects. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13612 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 20:41:19 +0000