[Pkg-samba-maint] [samba] 17/29: s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled

[Jelmer Vernooij]

This is an automated email from the git hooks/post-receive script.

jelmer pushed a commit to branch samba_4.1
in repository samba.

commit 62075301713602612fe3eae92ce4b23e14ab8fa8
Author: Samuel Cabrero <scabrero at zentyal.com>
Date:   Thu Oct 24 17:37:06 2013 +0200

    s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled
    
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
    Autobuild-Date(master): Fri Oct 25 00:39:21 CEST 2013 on sn-devel-104
    
    (cherry picked from commit d3aee80928dc7ccde9441309bf946c2503f7714a)
    
    Part of a fix for bug # 9091 - When replicating DNS for bind9_dlz we need to
    create the server-DNS account remotely.
    
    Autobuild-User(v4-1-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-1-test): Wed Nov  6 14:28:14 CET 2013 on sn-devel-104
---
 python/samba/join.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/python/samba/join.py b/python/samba/join.py
index fcdd4ec..7d2f913 100644
--- a/python/samba/join.py
+++ b/python/samba/join.py
@@ -606,15 +606,18 @@ class dc_join(object):
                                                                  "DNSNAME" : ctx.dnshostname}))
             for changetype, msg in recs:
                 assert changetype == ldb.CHANGETYPE_NONE
+                dns_acct_dn = msg["dn"]
                 print "Adding DNS account %s with dns/ SPN" % msg["dn"]
 
                 # Remove dns password (we will set it as a modify, as we can't do clearTextPassword over LDAP)
                 del msg["clearTextPassword"]
                 # Remove isCriticalSystemObject for similar reasons, it cannot be set over LDAP
                 del msg["isCriticalSystemObject"]
+                # Disable account until password is set
+                msg["userAccountControl"] = str(samba.dsdb.UF_NORMAL_ACCOUNT |
+                                                samba.dsdb.UF_ACCOUNTDISABLE)
                 try:
                     ctx.samdb.add(msg)
-                    dns_acct_dn = msg["dn"]
                 except ldb.LdbError, (num, _):
                     if num != ldb.ERR_ENTRY_ALREADY_EXISTS:
                         raise
@@ -624,7 +627,7 @@ class dc_join(object):
             # connections which are hard to set up and otherwise refuse with
             # ERR_UNWILLING_TO_PERFORM. In this case we fall back to libnet
             # over SAMR.
-            print "Setting account password for %s" % ctx.samname
+            print "Setting account password for dns-%s" % ctx.myname
             try:
                 ctx.samdb.setpassword("(&(objectClass=user)(samAccountName=dns-%s))"
                                       % ldb.binary_encode(ctx.myname),
@@ -633,8 +636,8 @@ class dc_join(object):
                                       username=ctx.samname)
             except ldb.LdbError, (num, _):
                 if num != ldb.ERR_UNWILLING_TO_PERFORM:
-                    pass
-                ctx.net.set_password(account_name="dns-" % ctx.myname,
+                    raise
+                ctx.net.set_password(account_name="dns-%s" % ctx.myname,
                                      domain_name=ctx.domain_name,
                                      newpassword=ctx.dnspass)
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git