summaryrefslogtreecommitdiff
path: root/source4/setup
Commit message (Collapse)AuthorAgeFilesLines
...
* adprep: Add the LDF data needed to upgrade to 2012R2 schemaGarming Sam2017-12-1410-0/+5514
| | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the LDF files corresponding to the changes that the Windows Adprep.exe tool makes when upgrading a AD schema to Windows 2012R2. This is based on information Microsoft has made public on github (Schema-Updates.md - see the README.txt for more details). The LDF files 48-56 are for upgrading to Windows Server 2012, and 57-69 are for Windows Server 2012 R2. Unfortunately, the raw LDF information from Microsoft wasn't enough to get the schema working. The .diff files contain changes we needed to make on top of the raw LDF content from Microsoft. The basic steps to regenerate the .LDF files are documented in the README.txt file. The files used to generate the .LDF files are in the WindowsServerDocs/ sub-directory. (The .LDF generation is done at runtime during provision). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* schema: 2012 and 2012 R2 AD schema attributes and classesGarming Sam2017-12-144-0/+77224
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* typo: Change case to match DNGarming Sam2017-12-141-2/+2
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: make password valid in openldap provision testJamie McClymont2017-12-101-1/+1
| | | | | | | | Test was using an invalid password, which causes test failure with early password validation patch Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* samba-tool: validate password early in `domain provision`Jamie McClymont2017-12-101-1/+1
| | | | | | | | | | | | | | | | | Checks password against default quality and length standards when it is entered, allowing a second chance to enter one (if interactive), rather than running through the provisioning process and bailing on an exception Includes unit tests for the newly-added python wrapper of check_password_quality plus black-box tests for the checks in samba-tool. Breaks an openldap test which uses an invalid password. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9710 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12235 Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4:dsdb: allocate DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKS oidStefan Metzmacher2017-11-241-0/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13095 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:schema_samba4: mark DSDB_CONTROL_INVALID_NOT_IMPLEMENTED ↵Stefan Metzmacher2017-11-241-0/+1
| | | | | | | 1.3.6.1.4.1.7165.4.3.32 as allocated Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* provision: Add a fixed GUID to the samba4top objectclass definitionAndrew Bartlett2017-09-231-0/+1
| | | | | | | | | This is only used in the OpenLDAP backend and will certainly be removed before this becomes production. (a production backend will use the real AD top objectclass) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Add a test for @ATTRIBUTES and @INDEXLIST generationAndrew Bartlett2017-06-151-0/+1
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* rodc: Allow local RODC changes with version 0Garming Sam2017-04-131-0/+2
| | | | | | | | | These changes will get clobbered by RWDCs through replication. This behaviour is required for lockoutTime to enforce the password lockout locally on the RODC (and is consistent with Windows). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fix blackbox_supported_features: mkdir -p its directoryDouglas Bagnall2017-02-101-0/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Switch on the sortedLinks Flag on new databasesAndrew Bartlett2017-02-091-0/+1
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Feb 9 07:07:43 CET 2017 on sn-devel-144
* samba_dsdb: Use and maintain compatibleFeatures and requiredFeatures in ↵Andrew Bartlett2017-02-091-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @SAMBA_DSDB This will allow us to introduce new database features that are backward compatible from the point of view of older versions of Samba, but which will be damaged by modifying the database with such a version. For example, if linked attributes are stored in sorted order in 4.7, and this change, without any values in current_supportedFeatures is itself included in 4.6, then our sortedLinks are backward compatible to that release. That is with 4.6 (including this patch) which doesn't care about ordering -- but a downgraded 4.7 database used by 4.6 will be broken when later used with 4.7. If we add a 'sortedLinks' feature flag in compatibleFeatures, we can detect that. This will allow us to determine if the database still contains unsorted links, as that information allows us to make the code handling links much more efficient. We won't add the actual flag until all the code is in place. Andrew wrote the actual code and Douglas wrote the tests, and they cross-reviewed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Piar-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> selftest: check for database features flags
* python/schema: fix tests flapping due to oid collisionAndrew Bartlett2017-01-101-0/+4
| | | | | | | | | | | | | | | | These tests would sometimes fail because the randomly generated OIDs would collide. This fixes that by giving a unique OID to each attribute and class. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12507 Pair-Programmed-With: Bob Campbell <bobcampbell@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jan 10 13:44:02 CET 2017 on sn-devel-144
* ad/provision: change http://samba.org to https://www.samba.orgBjörn Jacke2016-12-092-3/+3
| | | | | | | | Signed-off-by: Bjoern Jacke <bj@sernet.de> Reviewed-by: Karolin Seeger <kseeger@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Fri Dec 9 16:57:31 CET 2016 on sn-devel-144
* ldb:controls: add LDB_CONTROL_RECALCULATE_RDN_OIDStefan Metzmacher2016-12-011-0/+1
| | | | | | | | | | | | This will be used by 'samba-tool dbcheck' to fix the rdn attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12399 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> (Patch reduced by Andrew Bartlett to only allocate the OID)
* dsdb: Add python hooks to allocate a RID set and allocate a RID poolAndrew Bartlett2016-11-041-0/+2
| | | | | | | | | This will help us to correct errors during dbcheck Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=9954
* provision: Add support for BIND 9.11.xAmitay Isaacs2016-10-281-0/+3
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12366 Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Oct 28 03:42:25 CEST 2016 on sn-devel-144
* ldb-samba: Add new extended match rule DSDB_MATCH_FOR_EXPUNGEAndrew Bartlett2016-09-011-0/+1
| | | | | | | | | | | This allows us to find links that need to be expunged without passing the whole DB up in the search response. While each message still needs to be examined, this code only has to do memory allocation for entries with links Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Move repl_schema test to a distinct OID prefixAndrew Bartlett2016-08-111-0/+2
| | | | | | | | | | We also take the chance to make it clearer that the number being passed in should be unique. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: add vanish links controlDouglas Bagnall2016-07-151-0/+1
| | | | | | | | | | | | Normally linked attributes are deleted by marking them as with RMD flags, but sometimes we want them to vanish without trace. At those times we set the DSDB_CONTROL_REPLMD_VANISH_LINKS control. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
* provision: Ignore duplicate attid and governsID checkBob Campbell2016-07-061-0/+1
| | | | | | | | | | During the provision this causes a huge performance hit as these two attributes are unindexed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
* s4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OIDStefan Metzmacher2016-06-271-0/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OIDStefan Metzmacher2016-06-271-0/+1
| | | | | | | | | | | This will be used to let the "password_hash" module know that the value of pwdLastSet was defaulted to 0 in the "samldb" module on add. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba_dnsupdate: Implement RPC <ZONE> prefix in dns_update_listAndrew Bartlett2016-06-161-0/+4
| | | | | | | | | | | This allows us to update the stub records as well as the zone itself. Based on a proposed syntax by metze. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dns_update_list: Add in NS recordsAndrew Bartlett2016-06-161-0/+3
| | | | | | | This is as suggested by metze in 4383ec5b83d12bd19749582217f082cbaa31a128 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Use random OIDs from under the Samba OID arcAndrew Bartlett2016-06-061-0/+11
| | | | | | | | | | | | | | The urgent_replication.py test used the OID of uid, and this caused other tests to fail The other random OIDs should have been from under our arc, not under iso.member-body.us We split up the range a little to avoid some of the birthday paradox, in the tests that create multiple OIDs. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz
* build:wafsamba: Install named.conf only onceThomas Nagy2015-11-161-1/+1
| | | | | | | | | | The wildcard *.conf already lists named.conf. Adding files more than once will cause unnecessary rebuilds and raise errors in later Waf versions. Signed-off-by: Thomas Nagy <tnagy@waf.io> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* dbcheck: Add explict tests for unknown and unsorted attributeID valuesAndrew Bartlett2015-08-241-0/+1
| | | | | | | | | | | | | | | | | | | | Unknown attributeID values would cause an exception previously, and unsorted attributes cause a failure to replicate with Samba 4.2. In commit 61b978872fe86906611f64430b2608f5e7ea7ad8 we started to sort these values correctly, but previous versions of Samba did not sort them correctly (we sorted high-bit-set values as negative), and then after 9c9df40220234cba973e84b4985d90da1334a1d1 we stoped accepting these. To ensure we are allowed to make this unusual change to the replPropertyMetaData, a new OID is allocated and checked for in repl_meta_data.c BUG: https://bugzilla.samba.org/show_bug.cgi?id=10973 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-setup: Add saltPrincipal to secrets_dns.ldifAndreas Schneider2015-04-241-0/+1
| | | | | | | | | | | | This adds the correct salt principal to the secretsdb so that we generate a valid keytab entries for AES and DES keys. The test doesn't fails with Heimdal cause it always uses RC4 which doesn't have a salt. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Apr 24 13:02:37 CEST 2015 on sn-devel-104
* s4-dsdb: Define internal dsdb control to mark Tombstone reanimation requestsKamen Mazdrashki2015-02-031-0/+1
| | | | | | | | | | | | | | | | Tombstone reanimation requries some special handling which is going to affect several modules. Most notably: - a bit different access checks in acl.c - restore certain attributes during modify requests in samldb.c Control added also to schema_samba4.ldif by Andrew Bartlett hence the "pair programmed with" tag. Change-Id: Ief4f7dabbbdc2570924fae48c30ac9c531a701f4 Pair-programmed-with: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Kamen Mazdrashki <kamenim@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* CVE-2014-8143:dsdb-samldb: Check for extended access rights before we allow ↵Andrew Bartlett2015-01-151-0/+1
| | | | | | | | | | | | | | | | changes to userAccountControl This requires an additional control to be used in the LSA server to add domain trust account objects. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10993 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Thu Jan 15 14:54:47 CET 2015 on sn-devel-104
* s4-dns: Add support for BIND 9.10Amitay Isaacs2014-10-251-0/+3
| | | | | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Matthieu Patou <mat@matws.net> Autobuild-User(master): Amitay Isaacs <amitay@samba.org> Autobuild-Date(master): Sat Oct 25 05:42:19 CEST 2014 on sn-devel-104
* s4-dns: Update template variables, change BIND98 --> BIND9_8Amitay Isaacs2014-10-251-4/+4
| | | | | | | This makes it easier to add suport for BIND 9.10. Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Matthieu Patou <mat@matws.net>
* selftest: Fix test samba4.blackbox.group.pyMarc Muehlfeld2014-10-231-12/+12
| | | | | | | | | | | The test created two users and in later steps it tried adding two non-existend users to groups. This fix adds now the two created accounts to the groups instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10871 Signed-off-by: Marc Muehlfeld <mmuehlfeld@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* s4:setup/dns_update_list: make use of the new substitution variablesStefan Metzmacher2014-08-261-36/+46
| | | | | | | | | | | | | | | | | | | This let us register the same names as Windows Servers. We only exception are the NS records. In future we could add them by using something like this: samba-tool dns add ${HOSTNAME} ${DNSDOMAIN} @ NS ${HOSTNAME} samba-tool dns add ${HOSTNAME} _msdcs.${DNSFOREST} @ NS ${HOSTNAME} samba-tool dns add ${HOSTNAME} ${DNSFOREST} _msdcs NS ${HOSTNAME} Bug: https://bugzilla.samba.org/show_bug.cgi?id=9831 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Aug 26 11:38:54 CEST 2014 on sn-devel-104
* selftest: make blackbox_setpassword.sh test run independentlyAndrew Bartlett2014-04-021-0/+2
| | | | | | Change-Id: I8f3cdfc2c66800f9a1e11aec4f25a42752b6b205 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* samba-tool: make provision check for bind versionGarming Sam2014-03-091-2/+2
| | | | | | | | | | | | (small corrections and TODO added following Jelmer's review by abartlet) Signed-off-by: Garming Sam <garming@catalyst.net.nz> Change-Id: Iba9a709641dad9f2ae05df0b26ac4cd2ebfc84f0 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jelmer Vernooij <jelmer@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Mar 9 02:52:50 CET 2014 on sn-devel-104
* samba-tool domain join subdomain: Rework sambadns.py to allow setup of ↵Andrew Bartlett2013-10-113-75/+16
| | | | | | | | | | | | | | DomainDNSZone only This skips handling the ForestDNSZone when we are setting up a subdomain. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Oct 11 10:27:49 CEST 2013 on sn-devel-104
* provision: Remove --username and --password options from samba-tool domain ↵Andrew Bartlett2013-10-111-1/+1
| | | | | | | | | | | | | | | provision This avoids confusion, because the LDAP backend does not use these, and they do not set the password for the administrator account either! This may break support for the 'existing' backend LDAP backend, but that is nothing more than a stub for future development anyway, and new work in this area should use EXTERNAL in any case. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-openldap: Restored openldap-related options to the provision scriptNadezhda Ivanova2013-09-261-6/+6
| | | | | | | | | | | At the moment they are only available if TEST_LDAP=yes to avoid accidental use as the openldap backend is still failing some tests Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date(master): Thu Sep 26 07:31:05 CEST 2013 on sn-devel-104
* OpenLDAP provisioning tweaksHoward Chu2013-09-184-32/+13
| | | | | | | | | | | | | Remove BerkeleyDB-specific setup. Streamline cn=samba partition initialization - allow any backend type for it. Use back-mdb instead of back-ldif for cn=samba partition Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com> Autobuild-User(master): Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date(master): Wed Sep 18 21:39:51 CEST 2013 on sn-devel-104
* Use SASL/EXTERNAL over ldapi://Howard Chu2013-09-181-0/+4
| | | | | | | | | The provision script will map the uid of the user running the script to the samba-admin LDAP DN. Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
* Fix OpenLDAP partition configsHoward Chu2013-09-171-3/+50
| | | | | | | | Update to use LMDB backend, BDB is deprecated Update to support DomainDNSZones and ForestDNSZones partitions. Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* scripting/join.py: Handle creating the dns-NAME account during a DC joinAndrew Bartlett2013-09-041-1/+1
| | | | | | | | | | This will ensure that the DLZ plugin works out of the box when joining a second Samba DC to the domain. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* provision: Rewrite named.txt to be more usefulAndrew Bartlett2013-08-291-16/+20
| | | | | | | | | | | | | We already chown the dns.keytab file, so remove the suggestion to do that, and instead explain why we can not use chroot (an often-requested feature). Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Björn Jacke <bj@sernet.de> Autobuild-User(master): Björn Jacke <bj@sernet.de> Autobuild-Date(master): Thu Aug 29 13:53:25 CEST 2013 on sn-devel-104
* selftest: Remove output directories to save disk spaceAndrew Bartlett2013-03-041-7/+11
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: Add ldapcmp to ensure upgradeprovision of a fresh DB is a no-opAndrew Bartlett2013-03-041-1/+33
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* provision: fix nTSecurityDescriptor of containers in the DnsZones (bug #9481)Stefan Metzmacher2013-01-271-0/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* provision: fix nTSecurityDescriptor attributes of CN=*,${CONFIGDN} (bug #9481)Stefan Metzmacher2013-01-273-0/+13
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>