source4/scripting/python/samba/schema.py

   1 #
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4 #
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
   7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; either version 3 of the License, or
  12 # (at your option) any later version.
  13 #
  14 # This program is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 # GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 """Functions for setting up a Samba Schema."""
  24
  25 from base64 import b64encode
  26 from samba import read_and_sub_file, substitute_var, check_all_substituted
  27 from samba.dcerpc import security
  28 from samba.ms_schema import read_ms_schema
  29 from samba.ndr import ndr_pack
  30 from samba.samdb import SamDB
  31 from samba import dsdb
  32 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL
  33 import os
  34
  35 def get_schema_descriptor(domain_sid):
  36     sddl = "O:SAG:SAD:AI(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c" \
  37            ";;ER)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)(OA;;CR;1131f6ad-9c07-1" \
  38            "1d1-f79f-00c04fc2dcd2;;ER)(OA;;CR;e12b56b6-0a95-11d1-adbb-00c04fd8d5cd;;SA)(O" \
  39            "A;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)(OA;;CR;1131f6aa-9c07-11d1-f79" \
  40            "f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1" \
  41            "131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04" \
  42            "fc2dcd2;;BA)(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)(OA;;CR;1131f6aa" \
  43            "-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" \
  44            ";;ED)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ad-9c07-1" \
  45            "1d1-f79f-00c04fc2dcd2;;ED)(A;;RPWPCCDCLCLORCWOWDSDDTSW;;;LA)(A;CI;RPWPCRCCLCL" \
  46            "ORCWOWDSW;;;SA)(A;CI;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)S:(O" \
  47            "U;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)(OU;SA;CR;e12b56b6-0a95-11d1" \
  48            "-adbb-00c04fd8d5cd;;WD)(AU;SA;CR;;;DU)(AU;SA;CR;;;BA)(AU;SA;WPCCDCWOWDSDDTSW;" \
  49            ";;WD)(AU;CISA;WP;;;WD)"
  50     sec = security.descriptor.from_sddl(sddl, domain_sid)
  51     return ndr_pack(sec)
  52
  53
  54 class Schema(object):
  55
  56     def __init__(self, setup_path, domain_sid, invocationid=None, schemadn=None,
  57                  serverdn=None, files=None, override_prefixmap=None, additional_prefixmap=None, am_rodc=False):
  58         """Load schema for the SamDB from the AD schema files and samba4_schema.ldif
  59
  60         :param samdb: Load a schema into a SamDB.
  61         :param setup_path: Setup path function.
  62         :param schemadn: DN of the schema
  63         :param serverdn: DN of the server
  64
  65         Returns the schema data loaded, to avoid double-parsing when then needing to add it to the db
  66         """
  67
  68         self.schemadn = schemadn
  69         self.ldb = SamDB(global_schema=False, am_rodc=am_rodc)
  70         if serverdn is not None:
  71             self.ldb.set_ntds_settings_dn("CN=NTDS Settings,%s" % serverdn)
  72         if invocationid is not None:
  73             self.ldb.set_invocation_id(invocationid)
  74
  75         self.schema_data = read_ms_schema(
  76             setup_path('ad-schema/MS-AD_Schema_2K8_R2_Attributes.txt'),
  77             setup_path('ad-schema/MS-AD_Schema_2K8_R2_Classes.txt'))
  78
  79         if files is not None:
  80             for file in files:
  81                 self.schema_data += open(file, 'r').read()
  82
  83         self.schema_data = substitute_var(self.schema_data,
  84             {"SCHEMADN": schemadn})
  85         check_all_substituted(self.schema_data)
  86
  87         self.schema_dn_modify = read_and_sub_file(
  88             setup_path("provision_schema_basedn_modify.ldif"),
  89             {"SCHEMADN": schemadn, "SERVERDN": serverdn})
  90
  91         descr = b64encode(get_schema_descriptor(domain_sid))
  92         self.schema_dn_add = read_and_sub_file(
  93             setup_path("provision_schema_basedn.ldif"),
  94             {"SCHEMADN": schemadn, "DESCRIPTOR": descr})
  95
  96         if override_prefixmap is not None:
  97             self.prefixmap_data = override_prefixmap
  98         else:
  99             self.prefixmap_data = open(setup_path("prefixMap.txt"), 'r').read()
 100
 101         if additional_prefixmap is not None:
 102             for map in additional_prefixmap:
 103                 self.prefixmap_data += "%s\n" % map
 104
 105         self.prefixmap_data = b64encode(self.prefixmap_data)
 106
 107         # We don't actually add this ldif, just parse it
 108         prefixmap_ldif = "dn: cn=schema\nprefixMap:: %s\n\n" % self.prefixmap_data
 109         self.set_from_ldif(prefixmap_ldif, self.schema_data)
 110
 111     def set_from_ldif(self, pf, df):
 112         dsdb._dsdb_set_schema_from_ldif(self.ldb, pf, df)
 113
 114     def write_to_tmp_ldb(self, schemadb_path):
 115         self.ldb.connect(url=schemadb_path)
 116         self.ldb.transaction_start()
 117         try:
 118             self.ldb.add_ldif("""dn: @ATTRIBUTES
 119 linkID: INTEGER
 120
 121 dn: @INDEXLIST
 122 @IDXATTR: linkID
 123 @IDXATTR: attributeSyntax
 124 """)
 125             # These bits of LDIF are supplied when the Schema object is created
 126             self.ldb.add_ldif(self.schema_dn_add)
 127             self.ldb.modify_ldif(self.schema_dn_modify)
 128             self.ldb.add_ldif(self.schema_data)
 129         except:
 130             self.ldb.transaction_cancel()
 131             raise
 132         else:
 133             self.ldb.transaction_commit()
 134
 135     # Return a hash with the forward attribute as a key and the back as the value
 136     def linked_attributes(self):
 137         return get_linked_attributes(self.schemadn, self.ldb)
 138
 139     def dnsyntax_attributes(self):
 140         return get_dnsyntax_attributes(self.schemadn, self.ldb)
 141
 142     def convert_to_openldap(self, target, mapping):
 143         return dsdb._dsdb_convert_schema_to_openldap(self.ldb, target, mapping)
 144
 145
 146 # Return a hash with the forward attribute as a key and the back as the value
 147 def get_linked_attributes(schemadn,schemaldb):
 148     attrs = ["linkID", "lDAPDisplayName"]
 149     res = schemaldb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=schemadn, scope=SCOPE_ONELEVEL, attrs=attrs)
 150     attributes = {}
 151     for i in range (0, len(res)):
 152         expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
 153         target = schemaldb.searchone(basedn=schemadn,
 154                                      expression=expression,
 155                                      attribute="lDAPDisplayName",
 156                                      scope=SCOPE_SUBTREE)
 157         if target is not None:
 158             attributes[str(res[i]["lDAPDisplayName"])]=str(target)
 159
 160     return attributes
 161
 162
 163 def get_dnsyntax_attributes(schemadn,schemaldb):
 164     res = schemaldb.search(
 165         expression="(&(!(linkID=*))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))",
 166         base=schemadn, scope=SCOPE_ONELEVEL,
 167         attrs=["linkID", "lDAPDisplayName"])
 168     attributes = []
 169     for i in range (0, len(res)):
 170         attributes.append(str(res[i]["lDAPDisplayName"]))
 171     return attributes
 172
 173
 174 def ldb_with_schema(setup_dir=None,
 175         schemadn="cn=schema,cn=configuration,dc=example,dc=com",
 176         serverdn="cn=server,cn=servers,cn=default-first-site-name,cn=sites,cn=cn=configuration,dc=example,dc=com",
 177         domainsid=None,
 178         override_prefixmap=None):
 179     """Load schema for the SamDB from the AD schema files and samba4_schema.ldif
 180
 181     :param setup_dir: Setup path
 182     :param schemadn: DN of the schema
 183     :param serverdn: DN of the server
 184
 185     Returns the schema data loaded as an object, with .ldb being a
 186     new ldb with the schema loaded.  This allows certain tests to
 187     operate without a remote or local schema.
 188     """
 189
 190     def setup_path(file):
 191         return os.path.join(setup_dir, file)
 192
 193     if domainsid is None:
 194         domainsid = security.random_sid()
 195     else:
 196         domainsid = security.dom_sid(domainsid)
 197     return Schema(setup_path, domainsid, schemadn=schemadn, serverdn=serverdn, override_prefixmap=override_prefixmap)