|
39 |
import univention.debug2 as ud |
39 |
import univention.debug2 as ud |
40 |
from ldap.controls import LDAPControl |
40 |
from ldap.controls import LDAPControl |
41 |
from ldap.controls import SimplePagedResultsControl, LDAPControl |
41 |
from ldap.controls import SimplePagedResultsControl, LDAPControl |
|
|
42 |
from ldap.filter import filter_format |
42 |
from samba.dcerpc import security |
43 |
from samba.dcerpc import security |
43 |
from samba.ndr import ndr_pack, ndr_unpack |
44 |
from samba.ndr import ndr_pack, ndr_unpack |
44 |
from samba.dcerpc import misc |
45 |
from samba.dcerpc import misc |
|
2422 |
ud.debug(ud.LDAP, ud.ALL, "sync_from_ucs: addlist: %s" % addlist) |
2423 |
ud.debug(ud.LDAP, ud.ALL, "sync_from_ucs: addlist: %s" % addlist) |
2423 |
try: |
2424 |
try: |
2424 |
self.lo_s4.lo.add_ext_s(compatible_modstring(object['dn']), compatible_addlist(addlist), serverctrls=ctrls) #FIXME encoding |
2425 |
self.lo_s4.lo.add_ext_s(compatible_modstring(object['dn']), compatible_addlist(addlist), serverctrls=ctrls) #FIXME encoding |
|
|
2426 |
except ldap.ALREADY_EXISTS as ex: |
2427 |
sAMAccountName_attr_value = object['attributes'].get('sAMAccountName')[0] |
2428 |
objectSid_attr_value = object['attributes'].get('objectSid')[0] |
2429 |
objectSid = decode_sid(objectSid_attr_value) |
2430 |
if not (sAMAccountName_attr_value and objectSid): |
2431 |
raise ## unknown situation |
2432 |
filter_s4 = filter_format('(&(sAMAccountName=%s)(objectSid=%s)(isDeleted=TRUE))', (sAMAccountName_attr_value, objectSid)) |
2433 |
ud.debug(ud.LDAP, ud.WARN, "sync_from_ucs: Error during add, searching for conflicting deleted object in S4. Filter: %s" % filter_s4) |
2434 |
result = self.lo_s4.lo.search_ext_s(self.lo_s4.base, ldap.SCOPE_SUBTREE, filter_s4, ['objectClass', 'objectCategory', 'isDeleted', 'isRecycled', 'lastKnownParent'], serverctrls=[self.ctrl_show_deleted, LDAPControl(LDB_CONTROL_DOMAIN_SCOPE_OID, criticality=0)]) |
2435 |
if not result or len(result)>1: ## the latter would indicate corruption |
2436 |
ud.debug(ud.LDAP, ud.WARN,"sync_from_ucs: No conflicting object found.") |
2437 |
raise ## unknown situation |
2438 |
(deleted_object_dn, deleted_object) = result[0] |
2439 |
ud.debug(ud.LDAP, ud.WARN, "sync_from_ucs: Reanimating deleted object in S4: %s" % deleted_object_dn) |
2440 |
## Currently tombstone_reanimate.c and tests/python/tombstone_reanimation.py |
2441 |
## which implement https://msdn.microsoft.com/en-us/library/cc223467.aspx (MS-ADTS 3.1.1.5.3.7) |
2442 |
## are disabled in Samba. Workaround: |
2443 |
idx = deleted_object_dn.find('\\0ADEL:') |
2444 |
if idx == -1: |
2445 |
raise |
2446 |
reanimate_modlist = [(ldap.MOD_DELETE, 'isDeleted', ['TRUE'])] |
2447 |
reanimate_modlist.append((ldap.MOD_DELETE, 'lastKnownParent', [deleted_object['lastKnownParent'][0]])) |
2448 |
reanimate_modlist.append((ldap.MOD_DELETE, 'isRecycled', ['TRUE'])) |
2449 |
if not deleted_object.get('objectCategory'): |
2450 |
top_most_structural_objectclass = deleted_object['objectClass'][-1] |
2451 |
result = self.lo_s4.lo.search_ext_s("CN=Schema,CN=Configuration,%s" % self.lo_s4.base, ldap.SCOPE_SUBTREE, filter_format('lDAPDisplayName=%s', (top_most_structural_objectclass,)), ['defaultObjectCategory']) |
2452 |
reanimate_modlist.append((ldap.MOD_ADD, 'objectCategory', [result[0][1]['defaultObjectCategory'][0]])) |
2453 |
ud.debug(ud.LDAP, ud.ALL,"sync_from_ucs: modlist: %s" % reanimate_modlist) |
2454 |
self.lo_s4.lo.modify_ext_s(compatible_modstring(deleted_object_dn), compatible_modlist(reanimate_modlist), serverctrls=[self.ctrl_show_deleted,]) |
2455 |
ud.debug(ud.LDAP, ud.ALL, "rename_s: from %s to %s parent %s" % (deleted_object_dn, deleted_object_dn[:idx], deleted_object['lastKnownParent'][0])) |
2456 |
self.lo_s4.lo.rename_s(compatible_modstring(deleted_object_dn), deleted_object_dn[:idx], newsuperior=deleted_object['lastKnownParent'][0], delold=1) |
2457 |
## and retry |
2458 |
return self.sync_from_ucs(property_type, object, pre_mapped_ucs_dn, old_dn, old_ucs_object, new_ucs_object) |
2425 |
except: |
2459 |
except: |
2426 |
ud.debug(ud.LDAP, ud.ERROR, "sync_from_ucs: traceback during add object: %s" % object['dn']) |
2460 |
ud.debug(ud.LDAP, ud.ERROR, "sync_from_ucs: traceback during add object: %s" % object['dn']) |
2427 |
ud.debug(ud.LDAP, ud.ERROR, "sync_from_ucs: traceback due to addlist: %s" % addlist) |
2461 |
ud.debug(ud.LDAP, ud.ERROR, "sync_from_ucs: traceback due to addlist: %s" % addlist) |