Add Domain Controller

.package/setup.sh

@@ -79,3 +79,9 @@ if [ ! -d "certs" ]; then
 else
     echo "Directory already exists: certs"
 fi
+
+# HOST_MACHINE_NAME
+if ! get_env_var "HOST_MACHINE_NAME"; then
+    host_machine_name=$(hostname)
+    add_env_var "HOST_MACHINE_NAME" "$host_machine_name"
+fi

app/alembic/versions/8164b4a9e1f1_add_ou_computers.py

@@ -29,6 +29,7 @@
 _OU_COMPUTERS_DATA = {
     "name": COMPUTERS,
     "object_class": "organizationalUnit",
+    "is_system": True,
     "attributes": {"objectClass": ["top", "container"]},
     "children": [],
 }
@@ -61,7 +62,6 @@ async def _create_ou_computers(connection: AsyncConnection) -> None:  # noqa: AR
 
         await setup_gateway.create_dir(
             _OU_COMPUTERS_DATA,
-            is_system=True,
             domain=domain_dir,
             parent=domain_dir,
         )

app/alembic/versions/ebf19750805e_add_domain_controllers_ou.py

@@ -0,0 +1,102 @@
+"""Add OU 'Domain Controllers' if it does not exist.
+
+Revision ID: ebf19750805e
+Revises: 2dadf40c026a
+Create Date: 2026-02-17 08:52:28.048004
+
+"""
+
+from alembic import op
+from dishka import AsyncContainer, Scope
+from sqlalchemy import delete, exists, select
+from sqlalchemy.ext.asyncio import AsyncConnection, AsyncSession
+
+from constants import DOMAIN_CONTROLLERS_OU_NAME
+from entities import Directory
+from ldap_protocol.auth.setup_gateway import SetupGateway
+from ldap_protocol.roles.role_use_case import RoleUseCase
+from ldap_protocol.utils.queries import get_base_directories
+from repo.pg.tables import queryable_attr as qa
+
+# revision identifiers, used by Alembic.
+revision: None | str = "ebf19750805e"
+down_revision: None | str = "2dadf40c026a"
+branch_labels: None | list[str] = None
+depends_on: None | list[str] = None
+
+
+_OU_DOMAIN_CONTROLLERS_DATA = {
+    "name": DOMAIN_CONTROLLERS_OU_NAME,
+    "object_class": "organizationalUnit",
+    "is_system": True,
+    "attributes": {"objectClass": ["top", "container"]},
+    "children": [],
+}
+
+
+def upgrade(container: AsyncContainer) -> None:
+    """Upgrade."""
+
+    async def _create_domain_controllers_ou(
+        connection: AsyncConnection,  # noqa: ARG001
+    ) -> None:
+        async with container(scope=Scope.REQUEST) as cnt:
+            session = await cnt.get(AsyncSession)
+            setup_gateway = await cnt.get(SetupGateway)
+            role_use_case = await cnt.get(RoleUseCase)
+
+        base_directories = await get_base_directories(session)
+        if not base_directories:
+            return
+        domain_dir = base_directories[0]
+
+        exists_dc_ou = await session.scalar(
+            select(
+                exists(Directory)
+                .where(qa(Directory.name) == DOMAIN_CONTROLLERS_OU_NAME),
+            ),
+        )  # fmt: skip
+        if exists_dc_ou:
+            return
+
+        await setup_gateway.create_dir(
+            _OU_DOMAIN_CONTROLLERS_DATA,
+            domain=domain_dir,
+            parent=domain_dir,
+        )
+
+        dc_ou = await session.scalar(
+            select(Directory).where(
+                qa(Directory.name) == DOMAIN_CONTROLLERS_OU_NAME,
+            ),
+        )
+        if not dc_ou:
+            raise Exception("Domain Controllers OU was not created")
+
+        await role_use_case.inherit_parent_aces(
+            parent_directory=domain_dir,
+            directory=dc_ou,
+        )
+
+        await session.commit()
+
+    op.run_async(_create_domain_controllers_ou)
+
+
+def downgrade(container: AsyncContainer) -> None:
+    """Downgrade."""
+
+    async def _delete_domain_controllers_ou(
+        connection: AsyncConnection,  # noqa: ARG001
+    ) -> None:
+        async with container(scope=Scope.REQUEST) as cnt:
+            session = await cnt.get(AsyncSession)
+
+        await session.execute(
+            delete(Directory).where(
+                qa(Directory.name) == DOMAIN_CONTROLLERS_OU_NAME,
+            ),
+        )
+        await session.commit()
+
+    op.run_async(_delete_domain_controllers_ou)

app/config.py

@@ -36,6 +36,7 @@ class Settings(BaseModel):
     """Settigns with database dsn."""
 
     DOMAIN: str
+    HOST_MACHINE_NAME: str
 
     DEBUG: bool = False
     AUTO_RELOAD: bool = False
@@ -47,6 +48,7 @@ class Settings(BaseModel):
     GLOBAL_LDAP_TLS_PORT: int = 3269
     USE_CORE_TLS: bool = False
     LDAP_LOAD_SSL_CERT: bool = False
+    DEFAULT_NAMESERVER: str
 
     TCP_PACKET_SIZE: int = 1024
     COROUTINES_NUM_PER_CLIENT: int = 3

app/constants.py

@@ -11,6 +11,7 @@
 GROUPS_CONTAINER_NAME = "Groups"
 COMPUTERS_CONTAINER_NAME = "Computers"
 USERS_CONTAINER_NAME = "Users"
+DOMAIN_CONTROLLERS_OU_NAME = "Domain Controllers"
 
 READ_ONLY_GROUP_NAME = "read-only"
 
@@ -295,6 +296,7 @@ class EntityTypeData(TypedDict):
     {
         "name": GROUPS_CONTAINER_NAME,
         "object_class": "container",
+        "is_system": True,
         "attributes": {
             "objectClass": ["top"],
             "sAMAccountName": ["groups"],
@@ -303,6 +305,7 @@ class EntityTypeData(TypedDict):
             {
                 "name": DOMAIN_ADMIN_GROUP_NAME,
                 "object_class": "group",
+                "is_system": True,
                 "attributes": {
                     "objectClass": ["top", "posixGroup"],
                     "groupType": ["-2147483646"],
@@ -318,6 +321,7 @@ class EntityTypeData(TypedDict):
             {
                 "name": DOMAIN_USERS_GROUP_NAME,
                 "object_class": "group",
+                "is_system": True,
                 "attributes": {
                     "objectClass": ["top", "posixGroup"],
                     "groupType": ["-2147483646"],
@@ -333,6 +337,7 @@ class EntityTypeData(TypedDict):
             {
                 "name": READ_ONLY_GROUP_NAME,
                 "object_class": "group",
+                "is_system": True,
                 "attributes": {
                     "objectClass": ["top", "posixGroup"],
                     "groupType": ["-2147483646"],
@@ -348,6 +353,7 @@ class EntityTypeData(TypedDict):
             {
                 "name": DOMAIN_COMPUTERS_GROUP_NAME,
                 "object_class": "group",
+                "is_system": True,
                 "attributes": {
                     "objectClass": ["top", "posixGroup"],
                     "groupType": ["-2147483646"],
@@ -365,6 +371,7 @@ class EntityTypeData(TypedDict):
     {
         "name": COMPUTERS_CONTAINER_NAME,
         "object_class": "container",
+        "is_system": True,
         "attributes": {"objectClass": ["top"]},
         "children": [],
     },

app/extra/scripts/add_domain_controller.py

@@ -0,0 +1,147 @@
+"""Add domain controller.
+
+Copyright (c) 2026 MultiFactor
+License: https://github.com/MultiDirectoryLab/MultiDirectory/blob/main/LICENSE
+"""
+
+from loguru import logger
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from config import Settings
+from constants import DOMAIN_CONTROLLERS_OU_NAME
+from entities import Attribute, Directory
+from enums import SamAccountTypeCodes
+from ldap_protocol.ldap_schema.entity_type_dao import EntityTypeDAO
+from ldap_protocol.objects import UserAccountControlFlag
+from ldap_protocol.roles.role_use_case import RoleUseCase
+from ldap_protocol.utils.helpers import create_object_sid
+from ldap_protocol.utils.queries import get_base_directories
+from repo.pg.tables import queryable_attr as qa
+
+
+async def _add_domain_controller(
+    session: AsyncSession,
+    role_use_case: RoleUseCase,
+    entity_type_dao: EntityTypeDAO,
+    settings: Settings,
+    domain: Directory,
+    dc_ou_dir: Directory,
+) -> None:
+    dc_directory = Directory(
+        object_class="",
+        name=settings.HOST_MACHINE_NAME,
+        is_system=False,
+    )
+    dc_directory.create_path(dc_ou_dir)
+    session.add(dc_directory)
+    await session.flush()
+
+    dc_directory.parent_id = dc_ou_dir.id
+    dc_directory.object_sid = create_object_sid(domain, dc_directory.id)
+    await session.flush()
+
+    attributes = [
+        Attribute(
+            name="objectClass",
+            value="top",
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="objectClass",
+            value="computer",
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="sAMAccountName",
+            value=settings.HOST_MACHINE_NAME,
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="userAccountControl",
+            value=str(
+                UserAccountControlFlag.SERVER_TRUST_ACCOUNT,
+            ),
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="sAMAccountType",
+            value=str(SamAccountTypeCodes.SAM_MACHINE_ACCOUNT),
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="ipHostNumber",
+            value=settings.DEFAULT_NAMESERVER,
+            directory_id=dc_directory.id,
+        ),
+        Attribute(
+            name="cn",
+            value=settings.HOST_MACHINE_NAME,
+            directory_id=dc_directory.id,
+        ),
+    ]
+
+    session.add_all(attributes)
+    await session.flush()
+
+    await role_use_case.inherit_parent_aces(
+        parent_directory=dc_ou_dir,
+        directory=dc_directory,
+    )
+    await entity_type_dao.attach_entity_type_to_directory(
+        directory=dc_directory,
+        is_system_entity_type=False,
+        object_class_names={"top", "computer"},
+    )
+    await session.flush()
+
+
+async def add_domain_controller(
+    session: AsyncSession,
+    settings: Settings,
+    role_use_case: RoleUseCase,
+    entity_type_dao: EntityTypeDAO,
+) -> None:
+    logger.info("Adding domain controller.")
+
+    domains = await get_base_directories(session)
+    if not domains:
+        logger.debug("Cannot get base directory")
+        return
+
+    domain_controllers_ou = await session.scalar(
+        select(Directory).where(
+            qa(Directory.name) == DOMAIN_CONTROLLERS_OU_NAME,
+        ),
+    )
+
+    if not domain_controllers_ou:
+        logger.debug("Domain controllers OU does not exist.")
+        return
+
+    domain_controller = await session.scalar(
+        select(qa(Directory.id).distinct())
+        .join(qa(Directory.attributes))
+        .where(
+            qa(Directory.parent_id) == domain_controllers_ou.id,
+            qa(Attribute.name) == "ipHostNumber",
+            qa(Attribute.value) == settings.DEFAULT_NAMESERVER,
+        ),
+    )
+
+    if domain_controller:
+        logger.debug("Domain controllers already exists")
+        return
+
+    await _add_domain_controller(
+        session=session,
+        role_use_case=role_use_case,
+        entity_type_dao=entity_type_dao,
+        settings=settings,
+        domain=domains[0],
+        dc_ou_dir=domain_controllers_ou,
+    )
+
+    logger.debug("Domain controller added.")
+
+    await session.commit()

app/ldap_protocol/auth/setup_gateway.py

@@ -60,7 +60,6 @@ async def setup_enviroment(
         self,
         *,
         data: list,
-        is_system: bool,
         dn: str = "multifactor.dev",
     ) -> None:
         """Create directories and users for enviroment."""
@@ -110,7 +109,6 @@ async def setup_enviroment(
             for unit in data:
                 await self.create_dir(
                     unit,
-                    is_system=is_system,
                     domain=domain,
                     parent=domain,
                 )
@@ -125,13 +123,12 @@ async def setup_enviroment(
     async def create_dir(
         self,
         data: dict,
-        is_system: bool,
         domain: Directory,
         parent: Directory | None = None,
     ) -> None:
         """Create data recursively."""
         dir_ = Directory(
-            is_system=is_system,
+            is_system=data["is_system"],
             object_class=data["object_class"],
             name=data["name"],
         )
@@ -228,7 +225,6 @@ async def create_dir(
             for n_data in data["children"]:
                 await self.create_dir(
                     n_data,
-                    is_system=is_system,
                     domain=domain,
                     parent=dir_,
                 )