#!/bin/bash
#
# Create Well Known SIDs missing in UCS@school
#
# Copyright 2013-2018 Univention GmbH
#
# http://www.univention.de/
#
# All rights reserved.
#
# The source code of this program is made available
# under the terms of the GNU Affero General Public License version 3
# (GNU AGPL V3) as published by the Free Software Foundation.
#
# Binary versions of this program provided by Univention to you as
# well as other copyrighted, protected or trademarked materials like
# Logos, graphics, fonts, specific documentations and configurations,
# cryptographic keys etc. are subject to a license agreement between
# you and Univention and not subject to the GNU AGPL V3.
#
# In the case you use this program under the terms of the GNU AGPL V3,
# the program is provided in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License with the Debian GNU/Linux or Univention distribution in file
# /usr/share/common-licenses/AGPL-3; if not, see
# <http://www.gnu.org/licenses/>.

. /usr/share/univention-lib/all.sh
. /usr/share/univention-samba4/lib/all.sh

eval "$(univention-config-registry shell)"

# samba4 allowed on this system?
if is_ucr_true samba4/disabled; then
	echo "WARNING: samba4 on this system is not allowed."
	echo "         The samba4 join stops here. To rerun the"
	echo "         join script, use "
	echo "         -> univention-run-join-scripts"
	exit 0
fi

# parse credentials
extract_binddn_bindpwd_bindpwdfile_dcaccount_from_args "$@"

_create_group_with_special_sid()
{
	local name="$1"
	local sid="$2"
	local position="$3"
	local ldif

	shift 3
	
	group_dn="$(univention-ldapsearch "(&(objectClass=univentionGroup)(cn=$name))" | ldapsearch-wrapper | sed -ne 's|dn: ||p')"

	if [ -z "$group_dn" ]; then

		udm groups/group create "$@" --ignore_exists --option=posix \
				--position "$position,$ldap_base" \
				--set name="$name"

		ldif="dn: cn=$name,$position,$ldap_base
changetype: modify
add: objectClass
objectClass: sambaGroupMapping
-
add: sambaSID
sambaSID: $sid
-
replace: univentionObjectFlag
univentionObjectFlag: hidden
-
add: univentionGroupType
univentionGroupType: -2147483643
-
add: sambaGroupType
sambaGroupType: 5"

		if is_ucr_true directory/manager/samba3/legacy && univention_samba4_is_ucr_false connector/s4/mapping/sid; then
			ldif="$ldif
-
add: univentionSamba4SID
univentionSamba4SID: $sid
"
		fi

		echo "$ldif" | ldapmodify -x -h "$ldap_master" -p "${ldap_master_port:-7389}" -D "$binddn" -y "$bindpwdfile"
		
		if [ "$name" = "Authenticated Users" ]; then
			udm groups/group modify "$@" --dn "cn=$name,$position,$ldap_base" \
				--append nestedGroup="cn=DC Slave Hosts,cn=groups,$ldap_base" \
				--append nestedGroup="cn=Windows Hosts,cn=groups,$ldap_base"
		fi
	fi
}


_create_default_s4_groups ()
{
	udm container/cn create "$@" --set name=Builtin --ignore_exists || die

	_create_group_with_special_sid "Network Configuration Operators" "S-1-5-32-556" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Read-Only Domain Controllers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Members of this group are Read-Only Domain Controllers in the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483646" \
		--set sambaRID="521" ||die

	_create_group_with_special_sid "Remote Desktop Users" "S-1-5-32-555" "cn=Builtin" "$@"

	_create_group_with_special_sid "Distributed COM Users" "S-1-5-32-562" "cn=Builtin" "$@"

	_create_group_with_special_sid "Pre-Windows 2000 Compatible Access" "S-1-5-32-554" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="RAS and IAS Servers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Servers in this group can access remote access properties of users" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483644" \
		--set sambaRID="553" ||die

	udm groups/group create "$@" --set name="Enterprise Admins" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--append users="uid=administrator,cn=users,$ldap_base" \
		--set description="Designated administrators of the enterprise" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483640" \
		--set sambaRID="519" ||die

	_create_group_with_special_sid "Account Operators" "S-1-5-32-548" "cn=Builtin" "$@"

	_create_group_with_special_sid "Terminal Server License Servers" "S-1-5-32-561" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Domain Controllers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="All domain controllers in the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483646" \
		--set sambaRID="516" ||die

	udm groups/group modify "$@" --dn "cn=Domain Controllers,cn=groups,$ldap_base" \
		--append hosts="$ldap_hostdn"

	_create_group_with_special_sid "Server Operators" "S-1-5-32-549" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Cert Publishers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Members of this group are permitted to publish certificates to the directory" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483644" \
		--set sambaRID="517" ||die

	udm groups/group create "$@" --set name="DnsUpdateProxy" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers)." \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483646" \
		--set sambaRID="1102" ||die

	_create_group_with_special_sid "Performance Monitor Users" "S-1-5-32-558" "cn=Builtin" "$@"

	_create_group_with_special_sid "Guests" "S-1-5-32-546" "cn=Builtin" "$@"

	_create_group_with_special_sid "Certificate Service DCOM Access" "S-1-5-32-574" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Schema Admins" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--append users="uid=administrator,cn=users,$ldap_base" \
		--set description="Designated administrators of the schema" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483640" \
		--set sambaRID="518" ||die

	udm groups/group create "$@" --set name="Enterprise Read-Only Domain Controllers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Members of this group are Read-Only Domain Controllers in the enterprise" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483640" \
		--set sambaRID="498" ||die

	_create_group_with_special_sid "Replicator" "S-1-5-32-552" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Domain Computers" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="All workstations and servers joined to the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483646" \
		--set sambaRID="515" ||die

	udm groups/group create "$@" --set name="DnsAdmins" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="DNS Administrators Group" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483644" \
		--set sambaRID="1101" ||die

	_create_group_with_special_sid "Windows Authorization Access Group" "S-1-5-32-560" "cn=Builtin" "$@"

	_create_group_with_special_sid "Incoming Forest Trust Builders" "S-1-5-32-557" "cn=Builtin" "$@"

	_create_group_with_special_sid "Event Log Readers" "S-1-5-32-573" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Group Policy Creator Owners" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Members in this group can modify group policy for the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483646" \
		--set sambaRID="520" ||die

	_create_group_with_special_sid "Performance Log Users" "S-1-5-32-559" "cn=Builtin" "$@"

	_create_group_with_special_sid "Administrators" "S-1-5-32-544" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Allowed RODC Password Replication Group" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--set description="Members in this group can have their passwords replicated to all read-only domain controllers in the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483644" \
		--set sambaRID="571" ||die

	_create_group_with_special_sid "Users" "S-1-5-32-545" "cn=Builtin" "$@"

	_create_group_with_special_sid "Backup Operators" "S-1-5-32-551" "cn=Builtin" "$@"

	_create_group_with_special_sid "IIS_IUSRS" "S-1-5-32-568" "cn=Builtin" "$@"

	udm groups/group create "$@" --set name="Denied RODC Password Replication Group" \
		--ignore_exists \
		--position "cn=groups,$ldap_base" \
		--append users="uid=krbtgt,cn=users,$ldap_base" \
		--append nestedGroup="cn=read-only domain controllers,cn=groups,$ldap_base" \
		--append nestedGroup="cn=group policy creator owners,cn=groups,$ldap_base" \
		--append nestedGroup="cn=domain admins,cn=groups,$ldap_base" \
		--append nestedGroup="cn=cert publishers,cn=groups,$ldap_base" \
		--append nestedGroup="cn=enterprise admins,cn=groups,$ldap_base" \
		--append nestedGroup="cn=schema admins,cn=groups,$ldap_base" \
		--append nestedGroup="cn=domain controllers,cn=groups,$ldap_base" \
		--set description="Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain" \
		--set sambaGroupType="2" \
		--set adGroupType="-2147483644" \
		--set sambaRID="572" ||die

	_create_group_with_special_sid "Cryptographic Operators" "S-1-5-32-569" "cn=Builtin" "$@"
}

_create_default_s4_groups "$@"
