145 lines
3.8 KiB
Bash
Executable File
145 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
log() {
|
|
printf '[preview-ad] %s\n' "$*"
|
|
}
|
|
|
|
require_env() {
|
|
local name=$1
|
|
if [[ -z ${!name:-} ]]; then
|
|
printf '[preview-ad] ERROR: missing %s\n' "$name" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
for name in AD_REALM AD_DOMAIN AD_DNS_DOMAIN AD_BASE_DN AD_ADMIN_PASSWORD \
|
|
AD_USER_PASSWORD AD_WEB_ADMIN_USER AD_WEB_ADMIN_PASSWORD \
|
|
DEV_CA_IP DEV_BACKUP_IP DEV_FILESERVER_IP; do
|
|
require_env "$name"
|
|
done
|
|
|
|
if [[ ! -s /var/lib/samba/private/sam.ldb ]]; then
|
|
log "Provisioning disposable ${AD_REALM} domain"
|
|
rm -f /etc/samba/smb.conf
|
|
samba-tool domain provision \
|
|
--server-role=dc \
|
|
--use-rfc2307 \
|
|
--dns-backend=SAMBA_INTERNAL \
|
|
--realm="$AD_REALM" \
|
|
--domain="$AD_DOMAIN" \
|
|
--adminpass="$AD_ADMIN_PASSWORD"
|
|
fi
|
|
|
|
ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf
|
|
|
|
log 'Starting Samba AD DC'
|
|
samba -i --no-process-group &
|
|
samba_pid=$!
|
|
|
|
stop_samba() {
|
|
kill "$samba_pid" >/dev/null 2>&1 || true
|
|
wait "$samba_pid" 2>/dev/null || true
|
|
}
|
|
trap stop_samba EXIT INT TERM HUP
|
|
|
|
ready=0
|
|
for _ in $(seq 1 90); do
|
|
if samba-tool domain info 127.0.0.1 >/dev/null 2>&1; then
|
|
ready=1
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
if [[ $ready != 1 ]]; then
|
|
printf '[preview-ad] ERROR: domain controller did not become ready\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
ensure_user() {
|
|
local user=$1
|
|
local password=$2
|
|
local given=$3
|
|
local surname=$4
|
|
if ! samba-tool user show "$user" >/dev/null 2>&1; then
|
|
samba-tool user create "$user" "$password" \
|
|
--given-name="$given" --surname="$surname" >/dev/null
|
|
fi
|
|
}
|
|
|
|
ensure_group() {
|
|
local group=$1
|
|
if ! samba-tool group show "$group" >/dev/null 2>&1; then
|
|
samba-tool group add "$group" >/dev/null
|
|
fi
|
|
}
|
|
|
|
add_members() {
|
|
local group=$1
|
|
local members=$2
|
|
samba-tool group addmembers "$group" "$members" >/dev/null 2>&1 || true
|
|
}
|
|
|
|
set_display_name() {
|
|
local group=$1
|
|
local display_name=$2
|
|
ldbmodify -H /var/lib/samba/private/sam.ldb >/dev/null <<EOF
|
|
dn: CN=${group},CN=Users,${AD_BASE_DN}
|
|
changetype: modify
|
|
replace: displayName
|
|
displayName: ${display_name}
|
|
EOF
|
|
}
|
|
|
|
log 'Seeding users and nested file-share groups'
|
|
ensure_user alice "$AD_USER_PASSWORD" Alice Adams
|
|
ensure_user bob "$AD_USER_PASSWORD" Bob Brown
|
|
ensure_user carol "$AD_USER_PASSWORD" Carol Clark
|
|
ensure_user dave "$AD_USER_PASSWORD" Dave Davis
|
|
ensure_user eve "$AD_USER_PASSWORD" Eve Evans
|
|
ensure_user frank "$AD_USER_PASSWORD" Frank Foster
|
|
ensure_user "$AD_WEB_ADMIN_USER" "$AD_WEB_ADMIN_PASSWORD" Preview Administrator
|
|
ensure_user report_svc "$AD_USER_PASSWORD" Report Service
|
|
|
|
for group in Finance_Analysts Engineering_Leads FS_Finance FS_Engineering FS_Projects; do
|
|
ensure_group "$group"
|
|
done
|
|
|
|
set_display_name Finance_Analysts 'Finance Analysts'
|
|
set_display_name Engineering_Leads 'Engineering Leads'
|
|
set_display_name FS_Finance Finance
|
|
set_display_name FS_Engineering Engineering
|
|
set_display_name FS_Projects Projects
|
|
|
|
add_members Finance_Analysts alice
|
|
add_members FS_Finance 'Finance_Analysts,bob,report_svc'
|
|
add_members Engineering_Leads carol
|
|
add_members FS_Engineering 'Engineering_Leads,dave'
|
|
add_members FS_Projects 'FS_Finance,FS_Engineering,eve'
|
|
add_members FS_Projects 'Domain Users'
|
|
add_members 'Domain Admins' "$AD_WEB_ADMIN_USER"
|
|
|
|
add_dns_record() {
|
|
local name=$1
|
|
local address=$2
|
|
samba-tool dns add 127.0.0.1 "$AD_DNS_DOMAIN" "$name" A "$address" \
|
|
-U "Administrator%${AD_ADMIN_PASSWORD}" >/dev/null 2>&1 || true
|
|
}
|
|
|
|
add_dns_record ca "$DEV_CA_IP"
|
|
add_dns_record backup "$DEV_BACKUP_IP"
|
|
add_dns_record files "$DEV_FILESERVER_IP"
|
|
|
|
domain_sid=$(ldbsearch -H /var/lib/samba/private/sam.ldb \
|
|
-b "$AD_BASE_DN" -s base objectSid 2>/dev/null \
|
|
| sed -n 's/^objectSid: //p' | head -n1)
|
|
if [[ -z $domain_sid ]]; then
|
|
printf '[preview-ad] ERROR: unable to determine domain SID\n' >&2
|
|
exit 1
|
|
fi
|
|
printf '%s\n' "$domain_sid" > /run/domain-sid
|
|
touch /run/preview-ready
|
|
log "Ready: ${AD_DOMAIN} (${domain_sid})"
|
|
|
|
wait "$samba_pid"
|