summaryrefslogtreecommitdiff
path: root/source4/setup
Commit message (Collapse)AuthorAgeFilesLines
* s4:dsdb: add DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SID oidStefan Metzmacher2018-11-051-0/+1
| | | | | | | | | | This will be used to fix missing <SID=> components in future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit bb9c9e49a5e82f19626cb1b12ec9189fff5114e8)
* schema_samba4.ldif: add allocation of DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAMEStefan Metzmacher2018-11-051-0/+1
| | | | | | | | | This was already allocated in source4/dsdb/samdb/samdb.h with commit 22208f52e6096fbe9413b8ff339d9446851e0874. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 0189f23f5bda263c7462366ee16b2fe4bcda0119)
* CVE-2018-1057: s4:dsdb/samdb: define ↵Ralph Boehme2018-03-131-0/+1
| | | | | | | | | | | | | DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID control Will be used to pass "user password change" vs "password reset" from the ACL to the password_hash module, ensuring both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* WindowsServerDocs: Update README for clarityGarming Sam2017-12-201-10/+18
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Forest-Wide-Updates.md: Include the description of forest wide updatesGarming Sam2017-12-203-0/+114
| | | | | | | | | | This is sourced from the WindowsServerDocs repository on Github under an MIT/CC 4.0 attribution license. A huge thanks is required for these being provided and the work done in the process, as they mean a lot less work for us to repeat. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* WindowsServerDocs: Update README to get rid of the references to ./gen/Garming Sam2017-12-201-6/+6
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* 2008R2: Missing operation (77) for ActiveDirectoryUpdate version 5 (FL)Garming Sam2017-12-201-0/+9
| | | | | | | | | | | | Operation 77: {82112ba0-7e4c-4a44-89d9-d46c9612bf91} - Create the CN=PSPs,CN=System object Referenced in the page 'Windows Server 2008R2: Domain-Wide Updates': https://technet.microsoft.com/en-us/library/dd378973(v=ws.10).aspx Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* 2008R2: Missing operation (75, 76) for ActiveDirectoryUpdate version 5 (FL)Garming Sam2017-12-202-0/+16
| | | | | | | | | | | | | | | | Operation 75 {5e1574f6-55df-493e-a6-71-aa-ef-fc-a6-a1-00} - Create the CN=Managed Service Accounts object Operation 76 {d262aae8-41f7-48ed-9f-35-56-bb-b6-77-57-3d} - Add otherWellKnownObject link for CN=Managed Service Accounts Referenced in the page 'Windows Server 2008R2: Domain-Wide Updates': https://technet.microsoft.com/en-us/library/dd378973(v=ws.10).aspx Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* wscript: Install missing .ldf filesGarming Sam2017-12-201-0/+1
| | | | | | | | With the update to the newer version of the 2008 R2 schemas, the files were not available on install. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* provision: Changes to support encrypted_secrets moduleGary Lockyer2017-12-181-0/+1
| | | | | | | | | | | Changes to provision and join to create a database with encrypted_secrets enabled and a key file generated. Also adds the --plaintext-secrets option to join and provision commands to allow the creation of unencrypted databases. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* schema: 2008R2 AD schema attributes and classesAndrew Bartlett2017-12-142-0/+34859
| | | | | | | | | | Obtained under the Open Protocols Specifications licence from https://www.microsoft.com/en-us/download/details.aspx?id=23782 These are more complete than the version we have had in the tree until now. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* schema: 2016 AD schema attributes and classesAndrew Bartlett2017-12-142-0/+39943
| | | | | | | | Obtained under the Open Protocols Specifications licence from https://www.microsoft.com/en-us/download/details.aspx?id=23782 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: RODC revision level should be at 2Garming Sam2017-12-142-1/+7
| | | | | | | | | | | | | | | | This number had been mistakenly updated alongside the standard forest updates revision. This version number appears to be independent of the other revision levels. Also add the change to a new .ldf file, which can be used to apply the schema change to an existing Samba 4.7 (or earlier) instance. Update the provision/upgrade test to do just this (otherwise it complains about differences between a new provision and an older Samba 4.0.0 instance). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* schema: Some 2012 objects were missing systemflagsGarming Sam2017-12-142-0/+6
| | | | | | | | | | | | | The adprep LDIF files were adding the systemFlags, but they weren't present in the 2012 schema files. This is not just a Microsoft documentation problem - the difference was present when doing a provision of a 2012 Windows server vs using Adprep.exe to upgrade an older Windows server. Samba might as well use the correct systemFlags right from the start. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* schema: Add option of specifying the base schema for a provisionTim Beale2017-12-141-1/+1
| | | | | | | | | | Add the ability to override the base schema files being used for the new provision, e.g. instead of using the default supported schema, the code can now potentially specify an older or newer schema to use. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* 2008R2: Missing flags on optional features container for objectVersion 45Andrew Bartlett2017-12-141-0/+10
| | | | | | | | | To match Windows 2008R2, this should have the same flags as the recycle bin enabled feature. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* 2008R2: Missing extended rights for objectVersion 45Andrew Bartlett2017-12-142-0/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | We appear to have been missing some extended rights from 2008R2. These were added in samba by the extended-rights.ldif On Windows this was in Sch45.ldf (triggered by adprep schema updates). We add these changes to adprep/samba-4.7-missing-for-schema-45.ldif, which can be used to apply the changes to an existing Samba instance. This is not extracted from the Sch45.ldf file provided by Microsoft but is instead extracted using ldapcmp against a Samba install running the new extended-rights.ldif. Finally, these schema changes mean that the upgradeprovision test starts failing. This is because it's using an old 4.0.0 schema (that doesn't have these schema changes), but it's comparing it against a fresh provision (which does have the changes). We can avoid this failure by using the 'samba-tool domain schemaupgrade' to bring the old 4.0.0 schema in line with a fresh provision. Note that the 'upgradeprovision --full' test doesn't need this change as it seems to more aggressively copy over any schema differences with a fresh provision. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* schema: Re-work extended rights handling in provision (prep for 2012R2)Andrew Bartlett2017-12-142-679/+503
| | | | | | | | | | | | | | | | | | | | Add the changes needed to provision a 2012 DC (mostly this just affects the Extended Rights objects) by moving to the new extended-rights.ldif The localizationDisplayId is not documented in MS-ATDS so these values are moved to provision_configuation_modify.ldif and applied after the display-specifiers.ldif We don't enable the 2012R2 mode yet. The ${INC2012} variable just gets replaced with '#' so the lines get commented out and not applied. This approach allows us to support provisioning both a 2008R2 DC or a 2012R2 DC (so that we can test we can upgrade a 2008 DC to 2012). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Make clarifying header an LDIF comment in extended-rights.ldifAndrew Bartlett2017-12-141-7/+21
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Align displayName of Property Sets with MS-ADTS 3.1.1.2.3.3Andrew Bartlett2017-12-141-8/+8
| | | | | | | This gives some better names than what the CN of the object was. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Fill in a nicer displayName for Extended RightsAndrew Bartlett2017-12-141-71/+71
| | | | | | | We replace all the hyphens with a space. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Fill in validAccesses in extended-rights.ldif for Property SetsAndrew Bartlett2017-12-141-0/+15
| | | | | | | | | | | A Property Right has the value of RIGHT_DS_READ_PROPERTY|RIGHT_DS_WRITE_PROPERTY which is 48 (0x30) per 5.1.3.2 Access Rights. The property Sets are listed in MS-ATDS 3.1.1.2.3.3 and can also be found by looking at the attributeSecurityGuid on the schema objects. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Fill in validAccesses in extended-rights.ldif for Validated WritesAndrew Bartlett2017-12-141-0/+3
| | | | | | | | MS-ATDS 5.1.3.2.2 Validated Writes specifies the value of RIGHT_DS_WRITE_PROPERTY_EXTENDED which is 8 (0x08) per 5.1.3.2 Access Rights. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Fill in validAccesses in extended-rights.ldif for Control Access ↵Andrew Bartlett2017-12-141-0/+54
| | | | | | | | | | Rights MS-ATDS 5.1.3.2.1 Control Access Rights specifies the value of RIGHT_DS_CONTROL_ACCESS which is 256 (0x100) per 5.1.3.2 Access Rights. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Align extended-rights.ldif with the adprep LDIF for 2012R2Andrew Bartlett2017-12-141-75/+100
| | | | | | | | This removes the additional rights for 2016 and flags the 2012R2 changes to allow the same file to be used to produce a 2008R2 or 2012R2 domain Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Reformat appliesTo in Extended Rights into LDIFAndrew Bartlett2017-12-141-134/+102
| | | | | | | | | We remove comments about Schema 45 and earlier as this is the base level that Samba supports. A future commit will move to a machine-parsable flag for the 2012 schema and remove the 2016 elements. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Remove section numbers from extended rights, replace with dnAndrew Bartlett2017-12-141-246/+407
| | | | | | | | This makes this file more like LDIF so we can process it automatically as well as use it as a text document. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* provision: Import extended rights schema from MS-ADTS v47.0Andrew Bartlett2017-12-141-0/+595
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* adprep: Add the LDF data needed to upgrade to 2012R2 schemaGarming Sam2017-12-1410-0/+5514
| | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the LDF files corresponding to the changes that the Windows Adprep.exe tool makes when upgrading a AD schema to Windows 2012R2. This is based on information Microsoft has made public on github (Schema-Updates.md - see the README.txt for more details). The LDF files 48-56 are for upgrading to Windows Server 2012, and 57-69 are for Windows Server 2012 R2. Unfortunately, the raw LDF information from Microsoft wasn't enough to get the schema working. The .diff files contain changes we needed to make on top of the raw LDF content from Microsoft. The basic steps to regenerate the .LDF files are documented in the README.txt file. The files used to generate the .LDF files are in the WindowsServerDocs/ sub-directory. (The .LDF generation is done at runtime during provision). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* schema: 2012 and 2012 R2 AD schema attributes and classesGarming Sam2017-12-144-0/+77224
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* typo: Change case to match DNGarming Sam2017-12-141-2/+2
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: make password valid in openldap provision testJamie McClymont2017-12-101-1/+1
| | | | | | | | Test was using an invalid password, which causes test failure with early password validation patch Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* samba-tool: validate password early in `domain provision`Jamie McClymont2017-12-101-1/+1
| | | | | | | | | | | | | | | | | Checks password against default quality and length standards when it is entered, allowing a second chance to enter one (if interactive), rather than running through the provisioning process and bailing on an exception Includes unit tests for the newly-added python wrapper of check_password_quality plus black-box tests for the checks in samba-tool. Breaks an openldap test which uses an invalid password. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9710 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12235 Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4:dsdb: allocate DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKS oidStefan Metzmacher2017-11-241-0/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13095 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:schema_samba4: mark DSDB_CONTROL_INVALID_NOT_IMPLEMENTED ↵Stefan Metzmacher2017-11-241-0/+1
| | | | | | | 1.3.6.1.4.1.7165.4.3.32 as allocated Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* provision: Add a fixed GUID to the samba4top objectclass definitionAndrew Bartlett2017-09-231-0/+1
| | | | | | | | | This is only used in the OpenLDAP backend and will certainly be removed before this becomes production. (a production backend will use the real AD top objectclass) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Add a test for @ATTRIBUTES and @INDEXLIST generationAndrew Bartlett2017-06-151-0/+1
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* rodc: Allow local RODC changes with version 0Garming Sam2017-04-131-0/+2
| | | | | | | | | These changes will get clobbered by RWDCs through replication. This behaviour is required for lockoutTime to enforce the password lockout locally on the RODC (and is consistent with Windows). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fix blackbox_supported_features: mkdir -p its directoryDouglas Bagnall2017-02-101-0/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Switch on the sortedLinks Flag on new databasesAndrew Bartlett2017-02-091-0/+1
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Feb 9 07:07:43 CET 2017 on sn-devel-144
* samba_dsdb: Use and maintain compatibleFeatures and requiredFeatures in ↵Andrew Bartlett2017-02-091-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @SAMBA_DSDB This will allow us to introduce new database features that are backward compatible from the point of view of older versions of Samba, but which will be damaged by modifying the database with such a version. For example, if linked attributes are stored in sorted order in 4.7, and this change, without any values in current_supportedFeatures is itself included in 4.6, then our sortedLinks are backward compatible to that release. That is with 4.6 (including this patch) which doesn't care about ordering -- but a downgraded 4.7 database used by 4.6 will be broken when later used with 4.7. If we add a 'sortedLinks' feature flag in compatibleFeatures, we can detect that. This will allow us to determine if the database still contains unsorted links, as that information allows us to make the code handling links much more efficient. We won't add the actual flag until all the code is in place. Andrew wrote the actual code and Douglas wrote the tests, and they cross-reviewed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Piar-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> selftest: check for database features flags
* python/schema: fix tests flapping due to oid collisionAndrew Bartlett2017-01-101-0/+4
| | | | | | | | | | | | | | | | These tests would sometimes fail because the randomly generated OIDs would collide. This fixes that by giving a unique OID to each attribute and class. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12507 Pair-Programmed-With: Bob Campbell <bobcampbell@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jan 10 13:44:02 CET 2017 on sn-devel-144
* ad/provision: change http://samba.org to https://www.samba.orgBjörn Jacke2016-12-092-3/+3
| | | | | | | | Signed-off-by: Bjoern Jacke <bj@sernet.de> Reviewed-by: Karolin Seeger <kseeger@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Fri Dec 9 16:57:31 CET 2016 on sn-devel-144
* ldb:controls: add LDB_CONTROL_RECALCULATE_RDN_OIDStefan Metzmacher2016-12-011-0/+1
| | | | | | | | | | | | This will be used by 'samba-tool dbcheck' to fix the rdn attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12399 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> (Patch reduced by Andrew Bartlett to only allocate the OID)
* dsdb: Add python hooks to allocate a RID set and allocate a RID poolAndrew Bartlett2016-11-041-0/+2
| | | | | | | | | This will help us to correct errors during dbcheck Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=9954
* provision: Add support for BIND 9.11.xAmitay Isaacs2016-10-281-0/+3
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12366 Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Oct 28 03:42:25 CEST 2016 on sn-devel-144
* ldb-samba: Add new extended match rule DSDB_MATCH_FOR_EXPUNGEAndrew Bartlett2016-09-011-0/+1
| | | | | | | | | | | This allows us to find links that need to be expunged without passing the whole DB up in the search response. While each message still needs to be examined, this code only has to do memory allocation for entries with links Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Move repl_schema test to a distinct OID prefixAndrew Bartlett2016-08-111-0/+2
| | | | | | | | | | We also take the chance to make it clearer that the number being passed in should be unique. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: add vanish links controlDouglas Bagnall2016-07-151-0/+1
| | | | | | | | | | | | Normally linked attributes are deleted by marking them as with RMD flags, but sometimes we want them to vanish without trace. At those times we set the DSDB_CONTROL_REPLMD_VANISH_LINKS control. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
* provision: Ignore duplicate attid and governsID checkBob Campbell2016-07-061-0/+1
| | | | | | | | | | During the provision this causes a huge performance hit as these two attributes are unindexed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
View Lorry Controller Status