python/samba/forest_update.py

   1 # Samba4 Forest update checker
   2 #
   3 # Copyright (C) Andrew Bartlett <abarlet@samba.org> 2017
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 import ldb
  20 import samba
  21 from samba import sd_utils
  22 from samba.dcerpc import security
  23 from samba.provision.common import setup_path
  24 from samba.dsdb import (
  25     DS_DOMAIN_FUNCTION_2008,
  26     DS_DOMAIN_FUNCTION_2008_R2,
  27     DS_DOMAIN_FUNCTION_2012,
  28     DS_DOMAIN_FUNCTION_2012_R2,
  29     DS_DOMAIN_FUNCTION_2016,
  30 )
  31
  32 MIN_UPDATE = 11
  33 MAX_UPDATE = 142
  34
  35 update_map = {
  36     # Missing updates from 2008
  37     11: "27a03717-5963-48fc-ba6f-69faa33e70ed",
  38     12: "3467dae5-dedd-4648-9066-f48ac186b20a",
  39     13: "33b7ee33-1386-47cf-baa1-b03e06473253",
  40     14: "e9ee8d55-c2fb-4723-a333-c80ff4dfbf45",
  41     15: "ccfae63a-7fb5-454c-83ab-0e8e1214974e",
  42     16: "ad3c7909-b154-4c16-8bf7-2c3a7870bb3d",
  43     17: "26ad2ebf-f8f5-44a4-b97c-a616c8b9d09a",
  44     18: "4444c516-f43a-4c12-9c4b-b5c064941d61",
  45     19: "436a1a4b-f41a-46e6-ac86-427720ef29f3",
  46     20: "b2b7fb45-f50d-41bc-a73b-8f580f3b636a",
  47     21: "1bdf6366-c3db-4d0b-b8cb-f99ba9bce20f",
  48     22: "63c0f51a-067c-4640-8a4f-044fb33f1049",
  49     23: "dae441c0-366e-482e-98d9-60a99a1898cc",
  50     24: "7dd09ca6-f0d6-43bf-b7f8-ef348f435617",
  51     25: "6b800a81-affe-4a15-8e41-6ea0c7aa89e4",
  52     26: "dd07182c-3174-4c95-902a-d64fee285bbf",
  53     27: "ffa5ee3c-1405-476d-b344-7ad37d69cc25",
  54     28: "099f1587-af70-49c6-ab6c-7b3e82be0fe2",
  55     29: "1a3f6b15-55f2-4752-ba27-3d38a8232c4d",
  56     30: "dee21a17-4e8e-4f40-a58c-c0c009b685a7",
  57     31: "9bd98bb4-4047-4de5-bf4c-7bd1d0f6d21d",
  58     32: "3fe80fbf-bf39-4773-b5bd-3e5767a30d2d",
  59     33: "f02915e2-9141-4f73-b8e7-2804662782da",
  60     34: "39902c52-ef24-4b4b-8033-2c9dfdd173a2",
  61     35: "20bf09b4-6d0b-4cd1-9c09-4231edf1209b",
  62     36: "94f238bb-831c-11d6-977b-00c04f613221",
  63     37: "94f238bc-831c-11d6-977b-00c04f613221",
  64     38: "94f238bd-831c-11d6-977b-00c04f613221",
  65     39: "94f238be-831c-11d6-977b-00c04f613221",
  66     40: "94f238bf-831c-11d6-977b-00c04f613221",
  67     41: "94f238c0-831c-11d6-977b-00c04f613221",
  68     42: "eda27b47-e610-11d6-9793-00c04f613221",
  69     43: "eda27b48-e610-11d6-9793-00c04f613221",
  70     44: "eda27b49-e610-11d6-9793-00c04f613221",
  71     45: "eda27b4a-e610-11d6-9793-00c04f613221",
  72     46: "26d9c510-e61a-11d6-9793-00c04f613221",
  73     47: "26d9c511-e61a-11d6-9793-00c04f613221",
  74     48: "ea08c04c-f474-4212-b19e-5e754f9210d4",
  75     49: "4c0672a2-437c-4944-b953-5db8f111d665",
  76     50: "4c022fd1-adab-4d84-a7f1-9580f03da856",
  77     51: "c03b1f37-c240-4910-93c8-1544a452b4b5",
  78     52: "560cf82d-9572-48a3-9024-6f2b56f1f866",
  79     53: "abd97102-88dd-4013-a009-0e2c2f967ff6",
  80     54: "134428a8-0043-48a6-bcda-63310d9ec4dd",
  81     55: "d668ad1f-cedd-4565-ab02-9385926ce4f5",
  82     56: "8f86b825-c322-4101-adc4-579f12d445db",
  83     57: "9fea28ff-387f-4d57-866d-3893c50f373f",
  84     58: "782370ce-3d38-438d-8b0c-464220a3039d",
  85     59: "002fb291-0d00-4b0c-8c00-fe7f50ce6f8d",
  86     60: "dcb3c95d-deb7-4c51-ad13-43a7d5d06fc7",
  87     61: "ef010a1e-bd88-48c8-a7af-2affd250d77d",
  88     62: "bd3413c0-9559-469b-9f3d-51d7faabd81a",
  89     63: "f814097b-3e3d-49ba-8a3a-092c25085f06",
  90     64: "6eb8eaf9-3403-4ba5-8b4b-ce349a4680ad",
  91     65: "07e57d28-ad40-44fc-8334-8a0dc119b3f4",
  92     66: "6fd48655-1698-497a-ac8d-8267ce01c80b",
  93     67: "10338d31-2423-4dff-b4b5-ef025144b01f",
  94     68: "a96e2ed5-7a7c-4d5c-9d5d-965eca0051da",
  95     69: "613bd063-e8e9-4a62-8f4c-cda566f7eb6f",
  96     70: "2a858903-5696-4364-b4e5-4cac027ca7a6",
  97     71: "0fc5a978-0059-4b0a-9dc2-9896e8e389a1",
  98     72: "4d753a29-26ac-4d1a-bc80-311f947e4f0a",
  99     73: "3b3adbdb-4485-4559-aed8-9811c4bf90e4",
 100     74: "56040c71-fe93-4037-8fe9-1a4d1a283009",
 101     75: "caa2bfad-0cca-483b-8d00-347f943292a8",
 102     76: "2b9e0609-6d75-498a-9727-c9fcc93f0e42",
 103     77: "96541a16-910a-4b66-acde-720a0dff03c7",
 104     78: "429a6334-1a00-4515-bf48-676deb55954a",
 105     # Windows Server 2008 R2 - version 5
 106     79: "21ae657c-6649-43c4-bbb3-7f184fdf58c1",
 107     80: "dca8f425-baae-47cd-b424-e3f6c76ed08b",
 108     81: "a662b036-dbbe-4166-b4ba-21abea17f9cc",
 109     82: "9d17b863-18c3-497d-9bde-45ddb95fcb65",
 110     83: "11c39bed-4bee-45f5-b195-8da0e05b573a",
 111     # Windows Server 2012 - version 11
 112     84: "4664e973-cb20-4def-b3d5-559d6fe123e0",
 113     85: "2972d92d-a07a-44ac-9cb0-bf243356f345",
 114     86: "09a49cb3-6c54-4b83-ab20-8370838ba149",
 115     87: "77283e65-ce02-4dc3-8c1e-bf99b22527c2",
 116     88: "0afb7f53-96bd-404b-a659-89e65c269420",
 117     89: "c7f717ef-fdbe-4b4b-8dfc-fa8b839fbcfa",
 118     90: "00232167-f3a4-43c6-b503-9acb7a81b01c",
 119     91: "73a9515b-511c-44d2-822b-444a33d3bd33",
 120     92: "e0c60003-2ed7-4fd3-8659-7655a7e79397",
 121     93: "ed0c8cca-80ab-4b6b-ac5a-59b1d317e11f",
 122     94: "b6a6c19a-afc9-476b-8994-61f5b14b3f05",
 123     95: "defc28cd-6cb6-4479-8bcb-aabfb41e9713",
 124     96: "d6bd96d4-e66b-4a38-9c6b-e976ff58c56d",
 125     97: "bb8efc40-3090-4fa2-8a3f-7cd1d380e695",
 126     98: "2d6abe1b-4326-489e-920c-76d5337d2dc5",
 127     99: "6b13dfb5-cecc-4fb8-b28d-0505cea24175",
 128     100: "92e73422-c68b-46c9-b0d5-b55f9c741410",
 129     101: "c0ad80b4-8e84-4cc4-9163-2f84649bcc42",
 130     102: "992fe1d0-6591-4f24-a163-c820fcb7f308",
 131     103: "ede85f96-7061-47bf-b11b-0c0d999595b5",
 132     104: "ee0f3271-eb51-414a-bdac-8f9ba6397a39",
 133     105: "587d52e0-507e-440e-9d67-e6129f33bb68",
 134     106: "ce24f0f6-237e-43d6-ac04-1e918ab04aac",
 135     107: "7f77d431-dd6a-434f-ae4d-ce82928e498f",
 136     108: "ba14e1f6-7cd1-4739-804f-57d0ea74edf4",
 137     109: "156ffa2a-e07c-46fb-a5c4-fbd84a4e5cce",
 138     110: "7771d7dd-2231-4470-aa74-84a6f56fc3b6",
 139     111: "49b2ae86-839a-4ea0-81fe-9171c1b98e83",
 140     112: "1b1de989-57ec-4e96-b933-8279a8119da4",
 141     113: "281c63f0-2c9a-4cce-9256-a238c23c0db9",
 142     114: "4c47881a-f15a-4f6c-9f49-2742f7a11f4b",
 143     115: "2aea2dc6-d1d3-4f0c-9994-66c1da21de0f",
 144     116: "ae78240c-43b9-499e-ae65-2b6e0f0e202a",
 145     117: "261b5bba-3438-4d5c-a3e9-7b871e5f57f0",
 146     118: "3fb79c05-8ea1-438c-8c7a-81f213aa61c2",
 147     119: "0b2be39a-d463-4c23-8290-32186759d3b1",
 148     120: "f0842b44-bc03-46a1-a860-006e8527fccd",
 149     121: "93efec15-4dd9-4850-bc86-a1f2c8e2ebb9",
 150     122: "9e108d96-672f-40f0-b6bd-69ee1f0b7ac4",
 151     123: "1e269508-f862-4c4a-b01f-420d26c4ff8c",
 152     125: "e1ab17ed-5efb-4691-ad2d-0424592c5755",
 153     126: "0e848bd4-7c70-48f2-b8fc-00fbaa82e360",
 154     127: "016f23f7-077d-41fa-a356-de7cfdb01797",
 155     128: "49c140db-2de3-44c2-a99a-bab2e6d2ba81",
 156     129: "e0b11c80-62c5-47f7-ad0d-3734a71b8312",
 157     130: "2ada1a2d-b02f-4731-b4fe-59f955e24f71",
 158     # Windows Server 2012 R2 - version 15
 159     131: "b83818c1-01a6-4f39-91b7-a3bb581c3ae3",
 160     132: "bbbb9db0-4009-4368-8c40-6674e980d3c3",
 161     133: "f754861c-3692-4a7b-b2c2-d0fa28ed0b0b",
 162     134: "d32f499f-3026-4af0-a5bd-13fe5a331bd2",
 163     135: "38618886-98ee-4e42-8cf1-d9a2cd9edf8b",
 164     # Windows Server 2016 - version 16
 165     136: "328092fb-16e7-4453-9ab8-7592db56e9c4",
 166     137: "3a1c887f-df0a-489f-b3f2-2d0409095f6e",
 167     138: "232e831f-f988-4444-8e3e-8a352e2fd411",
 168     139: "ddddcf0c-bec9-4a5a-ae86-3cfe6cc6e110",
 169     140: "a0a45aac-5550-42df-bb6a-3cc5c46b52f2",
 170     141: "3e7645f3-3ea5-4567-b35a-87630449c70c",
 171     142: "e634067b-e2c4-4d79-b6e8-73c619324d5e",
 172 }
 173
 174 functional_level_to_max_update = {
 175     DS_DOMAIN_FUNCTION_2008: 78,
 176     DS_DOMAIN_FUNCTION_2008_R2: 83,
 177     DS_DOMAIN_FUNCTION_2012: 130,
 178     DS_DOMAIN_FUNCTION_2012_R2: 135,
 179     DS_DOMAIN_FUNCTION_2016: 142,
 180 }
 181
 182 functional_level_to_version = {
 183     DS_DOMAIN_FUNCTION_2008: 2,
 184     DS_DOMAIN_FUNCTION_2008_R2: 5,
 185     DS_DOMAIN_FUNCTION_2012: 11,
 186     DS_DOMAIN_FUNCTION_2012_R2: 15,
 187     DS_DOMAIN_FUNCTION_2016: 16,
 188 }
 189
 190 # Documentation says that this update was deprecated
 191 missing_updates = [124]
 192
 193
 194 class ForestUpdateException(Exception):
 195     pass
 196
 197
 198 class ForestUpdate(object):
 199     """Check and update a SAM database for forest updates"""
 200
 201     def __init__(self, samdb, verbose=False, fix=False,
 202                  add_update_container=True):
 203         """
 204         :param samdb: LDB database
 205         :param verbose: Show the ldif changes
 206         :param fix: Apply the update if the container is missing
 207         :param add_update_container: Add the container at the end of the change
 208         :raise ForestUpdateException:
 209         """
 210         from samba.ms_forest_updates_markdown import read_ms_markdown
 211
 212         self.samdb = samdb
 213         self.fix = fix
 214         self.verbose = verbose
 215         self.add_update_container = add_update_container
 216         # TODO In future we should check for inconsistencies when it claims it has been done
 217         self.check_update_applied = False
 218
 219         self.config_dn = self.samdb.get_config_basedn()
 220         self.domain_dn = self.samdb.domain_dn()
 221         self.schema_dn = self.samdb.get_schema_basedn()
 222
 223         self.sd_utils = sd_utils.SDUtils(samdb)
 224         self.domain_sid = security.dom_sid(samdb.get_domain_sid())
 225
 226         self.forestupdate_container = self.samdb.get_config_basedn()
 227         try:
 228             self.forestupdate_container.add_child("CN=Operations,CN=ForestUpdates")
 229         except ldb.LdbError:
 230             raise ForestUpdateException("Failed to add forest update container child")
 231
 232         self.revision_object = self.samdb.get_config_basedn()
 233         try:
 234             self.revision_object.add_child("CN=ActiveDirectoryUpdate,CN=ForestUpdates")
 235         except ldb.LdbError:
 236             raise ForestUpdateException("Failed to add revision object child")
 237
 238         # Store the result of parsing the markdown in a dictionary
 239         self.stored_ldif = {}
 240         read_ms_markdown(setup_path("adprep/WindowsServerDocs/Forest-Wide-Updates.md"),
 241                          out_dict=self.stored_ldif)
 242
 243     def check_updates_functional_level(self, functional_level,
 244                                        old_functional_level=None,
 245                                        update_revision=False):
 246         """
 247         Apply all updates for a given old and new functional level
 248         :param functional_level: constant
 249         :param old_functional_level: constant
 250         :param update_revision: modify the stored version
 251         :raise ForestUpdateException:
 252         """
 253         res = self.samdb.search(base=self.revision_object,
 254                                 attrs=["revision"], scope=ldb.SCOPE_BASE)
 255
 256         expected_update = functional_level_to_max_update[functional_level]
 257
 258         if old_functional_level:
 259             min_update = functional_level_to_max_update[old_functional_level]
 260             min_update += 1
 261         else:
 262             min_update = MIN_UPDATE
 263
 264         self.check_updates_range(min_update, expected_update)
 265
 266         expected_version = functional_level_to_version[functional_level]
 267         found_version = int(res[0]['revision'][0])
 268         if update_revision and found_version < expected_version:
 269             if not self.fix:
 270                 raise ForestUpdateException("Revision is not high enough. Fix is set to False."
 271                                             "\nExpected: %dGot: %d" % (expected_version,
 272                                                                        found_version))
 273             self.samdb.modify_ldif("""dn: %s
 274 changetype: modify
 275 replace: revision
 276 revision: %d
 277  """ % (str(self.revision_object), expected_version))
 278
 279     def check_updates_iterator(self, iterator):
 280         """
 281         Apply a list of updates which must be within the valid range of updates
 282         :param iterator: Iterable specifying integer update numbers to apply
 283         :raise ForestUpdateException:
 284         """
 285         for op in iterator:
 286             if op < MIN_UPDATE or op > MAX_UPDATE:
 287                 raise ForestUpdateException("Update number invalid.")
 288
 289             if 84 <= op <= 87:
 290                 self.operation_ldif(op)
 291             elif 91 <= op <= 126:
 292                 self.operation_ldif(op)
 293             elif 131 <= op <= 134:
 294                 self.operation_ldif(op)
 295             elif 136 <= op <= 142:
 296                 self.operation_ldif(op)
 297             else:
 298                 # No LDIF file exists for the change
 299                 getattr(self, "operation_%d" % op)(op)
 300
 301     def check_updates_range(self, start=0, end=0):
 302         """
 303         Apply a range of updates which must be within the valid range of updates
 304         :param start: integer update to begin
 305         :param end: integer update to end (inclusive)
 306         :raise ForestUpdateException:
 307         """
 308         op = start
 309         if start < MIN_UPDATE or start > end or end > MAX_UPDATE:
 310             raise ForestUpdateException("Update number invalid.")
 311         while op <= end:
 312             if op in missing_updates:
 313                 pass
 314             elif 84 <= op <= 87:
 315                 self.operation_ldif(op)
 316             elif 91 <= op <= 126:
 317                 self.operation_ldif(op)
 318             elif 131 <= op <= 134:
 319                 self.operation_ldif(op)
 320             elif 136 <= op <= 142:
 321                 self.operation_ldif(op)
 322             else:
 323                 # No LDIF file exists for the change
 324                 getattr(self, "operation_%d" % op)(op)
 325
 326             op += 1
 327
 328     def update_exists(self, op):
 329         """
 330         :param op: Integer update number
 331         :return: True if update exists else False
 332         """
 333         update_dn = "CN=%s,%s" % (update_map[op], self.forestupdate_container)
 334         try:
 335             res = self.samdb.search(base=update_dn,
 336                                     scope=ldb.SCOPE_BASE,
 337                                     attrs=[])
 338         except ldb.LdbError as e:
 339             (num, msg) = e.args
 340             if num != ldb.ERR_NO_SUCH_OBJECT:
 341                 raise
 342             return False
 343
 344         assert len(res) == 1
 345         print("Skip Forest Update %u: %s" % (op, update_map[op]))
 346         return True
 347
 348     def update_add(self, op):
 349         """
 350         Add the corresponding container object for the given update
 351         :param op: Integer update
 352         """
 353         self.samdb.add_ldif("""dn: CN=%s,%s
 354 objectClass: container
 355 """ % (update_map[op], str(self.forestupdate_container)))
 356         print("Applied Forest Update %u: %s" % (op, update_map[op]))
 357
 358     def operation_ldif(self, op):
 359         if self.update_exists(op):
 360             # Assume we have applied it (we have no double checks for these)
 361             return True
 362
 363         guid = update_map[op]
 364         if guid in self.stored_ldif:
 365             ldif = self.stored_ldif[guid]
 366         elif guid.lower() in self.stored_ldif:
 367             ldif = self.stored_ldif[guid.lower()]
 368         elif guid.upper() in self.stored_ldif:
 369             ldif = self.stored_ldif[guid.upper()]
 370         else:
 371             raise ForestUpdateException("OPERATION %d: ldif for %s not found" %
 372                                         (op, guid))
 373
 374         sub_ldif = samba.substitute_var(ldif, {"CONFIG_DN":
 375                                                str(self.config_dn),
 376                                                "FOREST_ROOT_DOMAIN":
 377                                                str(self.domain_dn),
 378                                                "SCHEMA_DN":
 379                                                str(self.schema_dn)})
 380         if self.verbose:
 381             print("UPDATE (LDIF) ------ OPERATION %d" % op)
 382             print(sub_ldif)
 383
 384         try:
 385             self.samdb.modify_ldif(sub_ldif)
 386         except ldb.LdbError as e:
 387             (num, msg) = e.args
 388             if num != ldb.ERR_ATTRIBUTE_OR_VALUE_EXISTS:
 389                 raise e
 390             pass
 391
 392         if self.add_update_container:
 393             self.update_add(op)
 394
 395     def raise_if_not_fix(self, op):
 396         """
 397         Raises an exception if not set to fix.
 398         :param op: Integer operation
 399         :raise ForestUpdateException:
 400         """
 401         if not self.fix:
 402             raise ForestUpdateException("Missing operation %d. Fix is currently set to False" % op)
 403
 404     #
 405     # Created a new object CN=Sam-Domain in the Schema partition
 406     #
 407     # Created the following access control entry (ACE) to grant Write Property
 408     # to Principal Self on the object: ...
 409     #
 410     def operation_88(self, op):
 411         if self.update_exists(op):
 412             return
 413         self.raise_if_not_fix(op)
 414
 415         ace = "(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)"
 416
 417         schema_dn = ldb.Dn(self.samdb, "CN=Sam-Domain,%s" % str(self.schema_dn))
 418
 419         self.sd_utils.update_aces_in_dacl(schema_dn,
 420                                           sddl_attr="defaultSecurityDescriptor",
 421                                           add_aces=[ace])
 422
 423         if self.add_update_container:
 424             self.update_add(op)
 425
 426     #
 427     # Created a new object CN=Domain-DNS in the Schema partition
 428     #
 429     # Created the following access control entry (ACE) to grant Write Property
 430     # to Principal Self on the object: ...
 431     #
 432     def operation_89(self, op):
 433         if self.update_exists(op):
 434             return
 435         self.raise_if_not_fix(op)
 436
 437         ace = "(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)"
 438
 439         schema_dn = ldb.Dn(self.samdb, "CN=Domain-DNS,%s" % str(self.schema_dn))
 440
 441         self.sd_utils.update_aces_in_dacl(schema_dn,
 442                                           sddl_attr="defaultSecurityDescriptor",
 443                                           add_aces=[ace])
 444
 445         if self.add_update_container:
 446             self.update_add(op)
 447
 448     # Update display specifiers
 449     def operation_90(self, op):
 450         if self.add_update_container and not self.update_exists(op):
 451             self.update_add(op)
 452
 453     # Update display specifiers
 454     def operation_127(self, op):
 455         if self.add_update_container and not self.update_exists(op):
 456             self.update_add(op)
 457
 458     # Update appears to already be applied in documentation
 459     def operation_128(self, op):
 460         if self.add_update_container and not self.update_exists(op):
 461             self.update_add(op)
 462
 463     # Grant ACE (OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS) to samDomain
 464     def operation_129(self, op):
 465         if self.update_exists(op):
 466             return
 467         self.raise_if_not_fix(op)
 468
 469         ace = "(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)"
 470
 471         schema_dn = ldb.Dn(self.samdb, "CN=Sam-Domain,%s" % str(self.schema_dn))
 472
 473         self.sd_utils.update_aces_in_dacl(schema_dn,
 474                                           sddl_attr="defaultSecurityDescriptor",
 475                                           add_aces=[ace])
 476
 477         if self.add_update_container:
 478             self.update_add(op)
 479
 480     # Grant ACE (OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS) to domainDNS
 481     def operation_130(self, op):
 482         if self.update_exists(op):
 483             return
 484         self.raise_if_not_fix(op)
 485
 486         ace = "(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)"
 487
 488         schema_dn = ldb.Dn(self.samdb, "CN=Domain-DNS,%s" % str(self.schema_dn))
 489
 490         self.sd_utils.update_aces_in_dacl(schema_dn,
 491                                           sddl_attr="defaultSecurityDescriptor",
 492                                           add_aces=[ace])
 493
 494         if self.add_update_container:
 495             self.update_add(op)
 496
 497     # Set msDS-ClaimIsValueSpaceRestricted on ad://ext/AuthenticationSilo to FALSE
 498     def operation_135(self, op):
 499         if self.update_exists(op):
 500             return
 501         self.raise_if_not_fix(op)
 502
 503         self.samdb.modify_ldif("""dn: CN=ad://ext/AuthenticationSilo,CN=Claim Types,CN=Claims Configuration,CN=Services,%s
 504 changetype: modify
 505 replace: msDS-ClaimIsValueSpaceRestricted
 506 msDS-ClaimIsValueSpaceRestricted: FALSE
 507 """ % self.config_dn,
 508                                controls=["relax:0", "provision:0"])
 509
 510         if self.add_update_container:
 511             self.update_add(op)
 512
 513     #
 514     # THE FOLLOWING ARE MISSING UPDATES FROM 2008 + 2008 R2
 515     #
 516
 517     def operation_11(self, op):
 518         if self.add_update_container and not self.update_exists(op):
 519             self.update_add(op)
 520
 521     def operation_54(self, op):
 522         if self.add_update_container and not self.update_exists(op):
 523             self.update_add(op)
 524
 525     def operation_79(self, op):
 526         if self.add_update_container and not self.update_exists(op):
 527             self.update_add(op)
 528
 529     def operation_80(self, op):
 530         if self.add_update_container and not self.update_exists(op):
 531             self.update_add(op)
 532
 533     def operation_81(self, op):
 534         if self.add_update_container and not self.update_exists(op):
 535             self.update_add(op)
 536
 537     def operation_82(self, op):
 538         if self.add_update_container and not self.update_exists(op):
 539             self.update_add(op)
 540
 541     def operation_83(self, op):
 542         if self.add_update_container and not self.update_exists(op):
 543             self.update_add(op)