<h2>Editing File: /lib/python3.6/site-packages/ipaclient/install/ipa_client_samba.py</h2><form method='post'><textarea name='content' class='file-edit'>#
# Copyright (C) 2019  FreeIPA Contributors see COPYING for license
#
# Configure the Samba suite to operate as domain member in IPA domain

from __future__ import print_function

import logging
import os
import gssapi
from urllib.parse import urlsplit
from optparse import OptionParser  # pylint: disable=deprecated-module
from contextlib import contextmanager

from ipaclient import discovery
from ipaclient.install.client import (
    CLIENT_NOT_CONFIGURED,
    CLIENT_ALREADY_CONFIGURED,
)
from ipalib import api, errors
from ipalib.install import sysrestore
from ipalib.util import check_client_configuration
from ipalib.request import context
from ipapython import ipautil
from ipapython.errors import SetseboolError
from ipapython.ipa_log_manager import standard_logging_setup
from ipapython.dnsutil import DNSName
from ipaplatform.tasks import tasks
from ipaplatform.paths import paths
from ipaplatform.constants import constants
from ipaplatform import services
from ipapython.admintool import ScriptError
from samba import generate_random_password

logger = logging.getLogger(os.path.basename(__file__))
logger.setLevel(logging.DEBUG)


@contextmanager
def use_api_as_principal(principal, keytab):
    with ipautil.private_ccache() as ccache_file:
        try:
            old_principal = getattr(context, &quot;principal&quot;, None)
            name = gssapi.Name(principal, gssapi.NameType.kerberos_principal)
            store = {&quot;ccache&quot;: ccache_file, &quot;client_keytab&quot;: keytab}
            gssapi.Credentials(name=name, usage=&quot;initiate&quot;, store=store)
            # Finalize API when TGT obtained using host keytab exists
            if not api.isdone(&quot;finalize&quot;):
                api.finalize()

            # Now we have a TGT, connect to IPA
            try:
                if api.Backend.rpcclient.isconnected():
                    api.Backend.rpcclient.disconnect()
                api.Backend.rpcclient.connect()

                yield
            except gssapi.exceptions.GSSError as e:
                raise Exception(
                    &quot;Unable to bind to IPA server. Error initializing &quot;
                    &quot;principal %s in %s: %s&quot; % (principal, keytab, str(e))
                )
        finally:
            if api.Backend.rpcclient.isconnected():
                api.Backend.rpcclient.disconnect()
            setattr(context, &quot;principal&quot;, old_principal)


def parse_options():
    usage = &quot;%prog [options]\n&quot;
    parser = OptionParser(usage=usage)
    parser.add_option(
        &quot;--server&quot;,
        dest=&quot;server&quot;,
        help=&quot;FQDN of IPA server to connect to&quot;,
    )
    parser.add_option(
        &quot;--netbios-name&quot;,
        dest=&quot;netbiosname&quot;,
        help=&quot;NetBIOS name of this machine&quot;,
        default=None,
    )
    parser.add_option(
        &quot;--no-homes&quot;,
        dest=&quot;no_homes&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;Do not add [homes] share to the generated Samba configuration&quot;,
    )
    parser.add_option(
        &quot;--no-nfs&quot;,
        dest=&quot;no_nfs&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;Do not allow NFS integration (SELinux booleans)&quot;,
    )
    parser.add_option(
        &quot;--force&quot;,
        dest=&quot;force&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;force installation by redoing all steps&quot;,
    )
    parser.add_option(
        &quot;-d&quot;,
        &quot;--debug&quot;,
        dest=&quot;debug&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;print debugging information&quot;,
    )
    parser.add_option(
        &quot;-U&quot;,
        &quot;--unattended&quot;,
        dest=&quot;unattended&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;unattended installation never prompts the user&quot;,
    )
    parser.add_option(
        &quot;--uninstall&quot;,
        dest=&quot;uninstall&quot;,
        action=&quot;store_true&quot;,
        default=False,
        help=&quot;Revert configuration and remove SMB service&quot;,
    )

    options, args = parser.parse_args()
    return options, args


domain_information_template = &quot;&quot;&quot;
 Domain name: {domain_name}
NetBIOS name: {netbios_name}
         SID: {domain_sid}
    ID range: {range_id_min} - {range_id_max}
&quot;&quot;&quot;


def pretty_print_domain_information(info):
    result = []
    for domain in info:
        result.append(domain_information_template.format(**domain))
    return &quot;\n&quot;.join(result)


trust_keymap = {
    &quot;netbios_name&quot;: &quot;ipantflatname&quot;,
    &quot;domain_sid&quot;: &quot;ipantsecurityidentifier&quot;,
    &quot;domain_name&quot;: &quot;cn&quot;,
}


trust_keymap_trustdomain = {
    &quot;netbios_name&quot;: &quot;ipantflatname&quot;,
    &quot;domain_sid&quot;: &quot;ipanttrusteddomainsid&quot;,
    &quot;domain_name&quot;: &quot;cn&quot;,
}


def retrieve_domain_information(api):
    # Pull down default domain configuration
    # IPA master might be missing freeipa-server-trust-ad package
    # or `ipa-adtrust-install` was never run. In such case return
    # empty list to report an error
    try:
        tc_command = api.Command.trustconfig_show
    except AttributeError:
        return []
    try:
        result = tc_command()[&quot;result&quot;]
    except errors.PublicError:
        return []

    l_domain = dict()
    for key, val in trust_keymap.items():
        l_domain[key] = result.get(val, [None])[0]

    # Pull down ID range and other details of our domain
    #
    # TODO: make clear how to handle multiple ID ranges for ipa-local range
    # In Samba only one range can belong to the same idmap domain,
    # otherwise winbindd's _wbint_Sids2UnixIDs function will not be able
    # to accept that a mapped Unix ID belongs to the specified domain
    idrange_local = &quot;{realm}_id_range&quot;.format(realm=api.env.realm)
    result = api.Command.idrange_show(idrange_local)[&quot;result&quot;]
    l_domain[&quot;range_id_min&quot;] = int(result[&quot;ipabaseid&quot;][0])
    l_domain[&quot;range_id_max&quot;] = (
        int(result[&quot;ipabaseid&quot;][0]) + int(result[&quot;ipaidrangesize&quot;][0]) - 1
    )

    domains = [l_domain]

    # Retrieve list of trusted domains, if they exist
    #
    # We flatten the whole trust list because it should be non-overlapping
    result = api.Command.trust_find()[&quot;result&quot;]
    for forest in result:
        r = api.Command.trustdomain_find(forest[&quot;cn&quot;][0], all=True, raw=True)[
            &quot;result&quot;
        ]
        # We don't need to process forest root info separately
        # as trustdomain_find() returns it as well
        for dom in r:
            r_dom = dict()
            for key in trust_keymap:
                r_dom[key] = dom.get(trust_keymap_trustdomain[key], [None])[0]

            r_idrange_name = &quot;{realm}_id_range&quot;.format(
                realm=r_dom[&quot;domain_name&quot;].upper()
            )

            # TODO: support ipa-ad-trust-posix range as well
            r_idrange = api.Command.idrange_show(r_idrange_name)[&quot;result&quot;]
            r_dom[&quot;range_id_min&quot;] = int(r_idrange[&quot;ipabaseid&quot;][0])
            r_dom[&quot;range_id_max&quot;] = (
                int(r_idrange[&quot;ipabaseid&quot;][0]) +
                int(r_idrange[&quot;ipaidrangesize&quot;][0]) - 1
            )
            domains.append(r_dom)
    return domains


smb_conf_template = &quot;&quot;&quot;
[global]
    # Limit number of forked processes to avoid SMBLoris attack
    max smbd processes = 1000
    # Use dedicated Samba keytab. The key there must be synchronized
    # with Samba tdb databases or nothing will work
    dedicated keytab file = FILE:${samba_keytab}
    kerberos method = dedicated keytab
    # Set up logging per machine and Samba process
    log file = /var/log/samba/log.%m
    log level = 1
    # We force 'member server' role to allow winbind automatically
    # discover what is supported by the domain controller side
    server role = member server
    realm = ${realm}
    netbios name = ${machine_name}
    workgroup = ${netbios_name}
    # Local writable range for IDs not coming from IPA or trusted domains
    idmap config * : range = 0 - 0
    idmap config * : backend = tdb
&quot;&quot;&quot;

idmap_conf_domain_snippet = &quot;&quot;&quot;
    idmap config ${netbios_name} : range = ${range_id_min} - ${range_id_max}
    idmap config ${netbios_name} : backend = sss
&quot;&quot;&quot;

homes_conf_snippet = &quot;&quot;&quot;
# Default homes share
[homes]
    read only = no
&quot;&quot;&quot;


def configure_smb_conf(fstore, statestore, options, domains):
    sub_dict = {
        &quot;samba_keytab&quot;: paths.SAMBA_KEYTAB,
        &quot;realm&quot;: api.env.realm,
        &quot;machine_name&quot;: options.netbiosname,
    }

    # First domain in the list is ours, pull our domain name from there
    sub_dict[&quot;netbios_name&quot;] = domains[0][&quot;netbios_name&quot;]

    # Construct elements of smb.conf by pre-rendering idmap configuration
    template = [smb_conf_template]
    for dom in domains:
        template.extend([ipautil.template_str(idmap_conf_domain_snippet, dom)])

    # Add default homes share so that users can log into Samba
    if not options.no_homes:
        template.extend([homes_conf_snippet])

    fstore.backup_file(paths.SMB_CONF)
    with open(paths.SMB_CONF, &quot;w&quot;) as f:
        f.write(ipautil.template_str(&quot;\n&quot;.join(template), sub_dict))
    tasks.restore_context(paths.SMB_CONF)


def generate_smb_machine_account(fstore, statestore, options, domain):
    # Ideally, we should be using generate_random_machine_password()
    # from samba but it uses munged UTF-16 which is not decodable
    # by the code called from 'net changesecretpw -f'. Thus, we'd limit
    # password to ASCII only.
    return generate_random_password(128, 255)


def retrieve_service_principal(
    fstore, statestore, options, domain, principal, password
):
    # Use explicit encryption types. SMB service must have arcfour-hmac
    # generated to allow domain member to authenticate to the domain controller
    args = [
        paths.IPA_GETKEYTAB,
        &quot;-p&quot;,
        principal,
        &quot;-k&quot;,
        paths.SAMBA_KEYTAB,
        &quot;-P&quot;,
        &quot;-e&quot;,
        &quot;aes128-cts-hmac-sha1-96,aes256-cts-hmac-sha1-96,arcfour-hmac&quot;,
    ]
    try:
        ipautil.run(args, stdin=password + &quot;\n&quot; + password, encoding=&quot;utf-8&quot;)
    except ipautil.CalledProcessError as e:
        logger.error(
            &quot;Cannot set machine account password at IPA DC. Error: %s&quot;,
            e,
        )
        raise

    # Once we fetched the keytab, we also need to set ipaNTHash attribute
    # Use ipa-pwd-extop plugin to regenerate it from the Kerberos key
    value = &quot;ipaNTHash=MagicRegen&quot;
    try:
        api.Command.service_mod(principal, addattr=value)
    except errors.PublicError as e:
        logger.error(
            &quot;Cannot update %s principal NT hash value due to an error: %s&quot;,
            principal,
            e,
        )
        raise


def populate_samba_databases(fstore, statestore, options, domain, password):
    # First, set domain SID in Samba
    args = [paths.NET, &quot;setdomainsid&quot;, domain[&quot;domain_sid&quot;]]
    try:
        ipautil.run(args)
    except ipautil.CalledProcessError as e:
        logger.error(&quot;Cannot set domain SID in Samba. Error: %s&quot;, e)
        raise

    # Next, make sure we can set machine account credentials
    # the workaround with tdbtool is temporary until 'net' utility
    # will not provide us a way to perform 'offline join' procedure
    secrets_key = &quot;SECRETS/MACHINE_LAST_CHANGE_TIME/{}&quot;.format(
        domain[&quot;netbios_name&quot;]
    )
    args = [paths.TDBTOOL, paths.SECRETS_TDB, &quot;store&quot;, secrets_key, &quot;2\\00&quot;]
    try:
        ipautil.run(args)
    except ipautil.CalledProcessError as e:
        logger.error(
            &quot;Cannot prepare machine account creds in Samba. Error: %s&quot;, e,
        )
        raise

    secrets_key = &quot;SECRETS/MACHINE_PASSWORD/{}&quot;.format(domain[&quot;netbios_name&quot;])
    args = [paths.TDBTOOL, paths.SECRETS_TDB, &quot;store&quot;, secrets_key, &quot;2\\00&quot;]
    try:
        ipautil.run(args)
    except ipautil.CalledProcessError as e:
        logger.error(
            &quot;Cannot prepare machine account creds in Samba. Error: %s&quot;, e,
        )
        raise

    # Finally, set actual machine account's password
    args = [paths.NET, &quot;changesecretpw&quot;, &quot;-f&quot;]
    try:
        ipautil.run(args, stdin=password, encoding=&quot;utf-8&quot;)
    except ipautil.CalledProcessError as e:
        logger.error(
            &quot;Cannot set machine account creds in Samba. Error: %s&quot;, e,
        )
        raise


def configure_default_groupmap(fstore, statestore, options, domain):
    args = [
        paths.NET,
        &quot;groupmap&quot;,
        &quot;add&quot;,
        &quot;sid=S-1-5-32-546&quot;,
        &quot;unixgroup=nobody&quot;,
        &quot;type=builtin&quot;,
    ]

    logger.info(&quot;Map BUILTIN\\Guests to a group 'nobody'&quot;)
    try:
        ipautil.run(args)
    except ipautil.CalledProcessError as e:
        if &quot;already mapped to SID S-1-5-32-546&quot; not in e.stdout:
            logger.error(
                'Cannot map BUILTIN\\Guests to a group &quot;nobody&quot;. Error: %s',
                e
            )
            raise


def set_selinux_booleans(booleans, statestore, backup=True):
    def default_backup_func(name, value):
        statestore.backup_state(&quot;selinux&quot;, name, value)

    backup_func = default_backup_func if backup else None
    try:
        tasks.set_selinux_booleans(booleans, backup_func=backup_func)
    except SetseboolError as e:
        print(&quot;WARNING: &quot; + str(e))
        logger.info(&quot;WARNING: %s&quot;, e)


def harden_configuration(fstore, statestore, options, domain):
    # Add default homes share so that users can log into Samba
    if not options.no_homes:
        set_selinux_booleans(
            constants.SELINUX_BOOLEAN_SMBSERVICE[&quot;share_home_dirs&quot;], statestore
        )
    # Allow Samba to access NFS-shared content
    if not options.no_nfs:
        set_selinux_booleans(
            constants.SELINUX_BOOLEAN_SMBSERVICE[&quot;reshare_nfs_with_samba&quot;],
            statestore,
        )


def uninstall(fstore, statestore, options):
    # Shut down Samba services and disable them
    smb = services.service(&quot;smb&quot;, api)
    winbind = services.service(&quot;winbind&quot;, api)
    for svc in (smb, winbind):
        if svc.is_running():
            svc.stop()
        svc.disable()

    # Restore the state of affected selinux booleans
    boolean_states = {}
    for usecase in constants.SELINUX_BOOLEAN_SMBSERVICE:
        for name in usecase:
            boolean_states[name] = statestore.restore_state(&quot;selinux&quot;, name)

    if boolean_states:
        set_selinux_booleans(boolean_states, statestore, backup=False)

    # Remove samba's credentials cache
    ipautil.remove_ccache(ccache_path=paths.KRB5CC_SAMBA)

    # Remove samba's configuration file
    if fstore.has_file(paths.SMB_CONF):
        ipautil.remove_file(paths.SMB_CONF)
        fstore.restore_file(paths.SMB_CONF)

    # Remove samba's persistent and temporary tdb files
    # in /var/lib/samba and /var/lib/samba/private
    for smbpath in (paths.SAMBA_DIR,
                    os.path.join(paths.SAMBA_DIR, &quot;private&quot;),
                    os.path.join(paths.SAMBA_DIR, &quot;lock&quot;)):
        tdb_files = [
            os.path.join(smbpath, tdb_file)
            for tdb_file in os.listdir(smbpath)
            if tdb_file.endswith(&quot;.tdb&quot;)
        ]
        for tdb_file in tdb_files:
            ipautil.remove_file(tdb_file)

    # Remove our keys from samba's keytab
    if os.path.exists(paths.SAMBA_KEYTAB):
        try:
            ipautil.run(
                [
                    paths.IPA_RMKEYTAB,
                    &quot;--principal&quot;,
                    api.env.smb_princ,
                    &quot;-k&quot;,
                    paths.SAMBA_KEYTAB,
                ]
            )
        except ipautil.CalledProcessError as e:
            if e.returncode != 5:
                logger.critical(&quot;Failed to remove old key for %s&quot;,
                                api.env.smb_princ)

    with use_api_as_principal(api.env.host_princ, paths.KRB5_KEYTAB):
        try:
            api.Command.service_del(api.env.smb_princ)
        except errors.VersionError as e:
            print(&quot;This client is incompatible: &quot; + str(e))
        except errors.NotFound:
            logger.debug(&quot;No SMB service principal exists, OK to proceed&quot;)
        except errors.PublicError as e:
            logger.error(
                &quot;Cannot connect to the server due to &quot;
                &quot;a generic error: %s&quot;, e,
            )


def run():
    try:
        check_client_configuration()
    except ScriptError as e:
        print(e.msg)
        return e.rval

    fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
    statestore = sysrestore.StateFile(paths.IPA_CLIENT_SYSRESTORE)

    options, _args = parse_options()

    logfile = paths.IPACLIENTSAMBA_INSTALL_LOG
    if options.uninstall:
        logfile = paths.IPACLIENTSAMBA_UNINSTALL_LOG

    standard_logging_setup(
        logfile,
        verbose=False,
        debug=options.debug,
        filemode=&quot;a&quot;,
        console_format=&quot;%(message)s&quot;,
    )

    cfg = dict(
        context=&quot;cli_installer&quot;,
        confdir=paths.ETC_IPA,
        in_server=False,
        debug=options.debug,
        verbose=0,
    )

    # Bootstrap API early so that env object is available
    api.bootstrap(**cfg)

    local_config = dict(
        host_princ=str(&quot;host/%s@%s&quot; % (api.env.host, api.env.realm)),
        smb_princ=str(&quot;cifs/%s@%s&quot; % (api.env.host, api.env.realm)),
    )

    # Until api.finalize() is called, we can add our own configuration
    api.env._merge(**local_config)

    if options.uninstall:
        if statestore.has_state(&quot;domain_member&quot;):
            uninstall(fstore, statestore, options)
            try:
                keys = (
                    &quot;configured&quot;, &quot;hardening&quot;, &quot;groupmap&quot;, &quot;tdb&quot;,
                    &quot;service.principal&quot;, &quot;smb.conf&quot;
                )
                for key in keys:
                    statestore.delete_state(&quot;domain_member&quot;, key)
            except Exception as e:
                print(
                    &quot;Error: Failed to remove the domain_member statestores: &quot;
                    &quot;%s&quot; % e
                )
                return 1
            else:
                print(
                    &quot;Samba configuration is reverted. &quot;
                    &quot;However, Samba databases were fully cleaned and &quot;
                    &quot;old configuration file will not be usable anymore.&quot;
                )
        else:
            print(&quot;Samba domain member is not configured yet&quot;)
        return 0

    ca_cert_path = None
    if os.path.exists(paths.IPA_CA_CRT):
        ca_cert_path = paths.IPA_CA_CRT

    if statestore.has_state(&quot;domain_member&quot;) and not options.force:
        print(&quot;Samba domain member is already configured&quot;)
        return CLIENT_ALREADY_CONFIGURED

    if not os.path.exists(paths.SMBD):
        print(&quot;Samba suite is not installed&quot;)
        return CLIENT_NOT_CONFIGURED

    autodiscover = False
    ds = discovery.IPADiscovery()
    if not options.server:
        print(&quot;Searching for IPA server...&quot;)
        ret = ds.search(ca_cert_path=ca_cert_path)
        logger.debug(&quot;Executing DNS discovery&quot;)
        if ret == discovery.NO_LDAP_SERVER:
            logger.debug(&quot;Autodiscovery did not find LDAP server&quot;)
            s = urlsplit(api.env.xmlrpc_uri)
            server = [s.netloc]
            logger.debug(&quot;Setting server to %s&quot;, s.netloc)
        else:
            autodiscover = True
            if not ds.servers:
                print(
                    &quot;Autodiscovery was successful but didn't return a server&quot;
                )
                return 1
            logger.debug(
                &quot;Autodiscovery success, possible servers %s&quot;,
                &quot;,&quot;.join(ds.servers),
            )
            server = ds.servers[0]
    else:
        server = options.server
        logger.debug(&quot;Verifying that %s is an IPA server&quot;, server)
        ldapret = ds.ipacheckldap(server, api.env.realm, ca_cert_path)
        if ldapret[0] == discovery.NO_ACCESS_TO_LDAP:
            print(&quot;Anonymous access to the LDAP server is disabled.&quot;)
            print(&quot;Proceeding without strict verification.&quot;)
            print(
                &quot;Note: This is not an error if anonymous access has been &quot;
                &quot;explicitly restricted.&quot;
            )
        elif ldapret[0] == discovery.NO_TLS_LDAP:
            logger.warning(&quot;Unencrypted access to LDAP is not supported.&quot;)
        elif ldapret[0] != 0:
            print(&quot;Unable to confirm that %s is an IPA server&quot; % server)
            return 1

    if not autodiscover:
        print(&quot;IPA server: %s&quot; % server)
        logger.debug(&quot;Using fixed server %s&quot;, server)
    else:
        print(&quot;IPA server: DNS discovery&quot;)
        logger.info(&quot;Configured to use DNS discovery&quot;)

    if api.env.host == server:
        logger.error(
            &quot;Cannot run on IPA master. &quot;
            &quot;Cannot configure Samba as a domain member on a domain &quot;
            &quot;controller. Please use ipa-adtrust-install for that!&quot;
        )
        return 1

    if not options.netbiosname:
        options.netbiosname = DNSName.from_text(api.env.host)[0].decode()
    options.netbiosname = options.netbiosname.upper()

    with use_api_as_principal(api.env.host_princ, paths.KRB5_KEYTAB):
        try:
            # Try to access 'service_add_smb' command, if it throws
            # AttributeError exception, the IPA server doesn't support
            # setting up Samba as a domain member.
            service_add_smb = api.Command.service_add_smb

            # Now try to see if SMB principal already exists
            api.Command.service_show(api.env.smb_princ)

            # If no exception was raised, the object exists.
            # We cannot continue because we would break existing configuration
            print(
                &quot;WARNING: SMB service principal %s already exists. &quot;
                &quot;Please remove it before proceeding.&quot; % (api.env.smb_princ)
            )
            if not options.force:
                return 1
            # For --force, we should then delete cifs/.. service object
            api.Command.service_del(api.env.smb_princ)
        except AttributeError:
            logger.error(
                &quot;Chosen IPA master %s does not have support to &quot;
                &quot;set up Samba domain members&quot;, server,
            )
            return 1
        except errors.VersionError as e:
            print(&quot;This client is incompatible: &quot; + str(e))
            return 1
        except errors.NotFound:
            logger.debug(&quot;No SMB service principal exists, OK to proceed&quot;)
        except errors.PublicError as e:
            logger.error(
                &quot;Cannot connect to the server due to &quot;
                &quot;a generic error: %s&quot;, e,
            )
            return 1

        # At this point we have proper setup:
        # - we connected to IPA API end-point as a host principal
        # - no cifs/... principal exists so we can create it
        print(&quot;Chosen IPA master: %s&quot; % server)
        print(&quot;SMB principal to be created: %s&quot; % api.env.smb_princ)
        print(&quot;NetBIOS name to be used: %s&quot; % options.netbiosname)
        logger.info(&quot;Chosen IPA master: %s&quot;, server)
        logger.info(&quot;SMB principal to be created: %s&quot;, api.env.smb_princ)
        logger.info(&quot;NetBIOS name to be used: %s&quot;, options.netbiosname)

        # 1. Pull down ID range and other details of known domains
        domains = retrieve_domain_information(api)
        if len(domains) == 0:
            # logger.error() produces both log file and stderr output
            logger.error(&quot;No configured trust controller detected &quot;
                         &quot;on IPA masters. Use ipa-adtrust-install on an IPA &quot;
                         &quot;master to configure trust controller role.&quot;)
            return 1

        str_info = pretty_print_domain_information(domains)
        logger.info(&quot;Discovered domains to use:\n%s&quot;, str_info)
        print(&quot;Discovered domains to use:\n%s&quot; % str_info)

        if not options.unattended and not ipautil.user_input(
            &quot;Continue to configure the system with these values?&quot;, False
        ):
            print(&quot;Installation aborted&quot;)
            return 1

        # 2. Create SMB service principal, if we are here, the command exists
        if (
            not statestore.get_state(&quot;domain_member&quot;, &quot;service.principal&quot;) or
            options.force
        ):
            service_add_smb(api.env.host, options.netbiosname)
            statestore.backup_state(
                &quot;domain_member&quot;, &quot;service.principal&quot;, &quot;configured&quot;
            )

        # 3. Generate machine account password for reuse
        password = generate_smb_machine_account(
            fstore, statestore, options, domains[0]
        )

        # 4. Now that we have all domains retrieved, we can generate smb.conf
        if (
            not statestore.get_state(&quot;domain_member&quot;, &quot;smb.conf&quot;) or
            options.force
        ):
            configure_smb_conf(fstore, statestore, options, domains)
            statestore.backup_state(&quot;domain_member&quot;, &quot;smb.conf&quot;, &quot;configured&quot;)

        # 5. Create SMB service
        if statestore.get_state(&quot;domain_member&quot;,
                                &quot;service.principal&quot;) == &quot;configured&quot;:
            retrieve_service_principal(
                fstore, statestore, options, domains[0],
                api.env.smb_princ, password
            )
            statestore.backup_state(
                &quot;domain_member&quot;, &quot;service.principal&quot;, &quot;configured&quot;
            )

        # 6. Configure databases to contain proper details
        if not statestore.get_state(&quot;domain_member&quot;, &quot;tdb&quot;) or options.force:
            populate_samba_databases(
                fstore, statestore, options, domains[0], password
            )
            statestore.backup_state(&quot;domain_member&quot;, &quot;tdb&quot;, &quot;configured&quot;)

        # 7. Configure default group mapping
        if (
            not statestore.get_state(&quot;domain_member&quot;, &quot;groupmap&quot;) or
            options.force
        ):
            configure_default_groupmap(fstore, statestore, options, domains[0])
            statestore.backup_state(&quot;domain_member&quot;, &quot;groupmap&quot;, &quot;configured&quot;)

        # 8. Enable SELinux policies
        if (
            not statestore.get_state(&quot;domain_member&quot;, &quot;hardening&quot;) or
            options.force
        ):
            harden_configuration(fstore, statestore, options, domains[0])
            statestore.backup_state(&quot;domain_member&quot;, &quot;hardening&quot;, &quot;configured&quot;)

        # 9. Finally, store the state of upgrade
        statestore.backup_state(&quot;domain_member&quot;, &quot;configured&quot;, True)

        # Suggest service start only after validating smb.conf
        print(
            &quot;Samba domain member is configured. &quot;
            &quot;Please check configuration at %s and &quot;
            &quot;start smb and winbind services&quot; % paths.SMB_CONF
        )
        logger.info(
            &quot;Samba domain member is configured. &quot;
            &quot;Please check configuration at %s and &quot;
            &quot;start smb and winbind services&quot;,
            paths.SMB_CONF,
        )

    return 0
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Flib%2Fpython3.6%2Fsite-packages%2Fipaclient%2Finstall'>Back to Directory</a>