From 54431eb9e2438a838904a6d4846c45131b937cd0 Mon Sep 17 00:00:00 2001

From: Ken Rossato <ken.rossato@redhat.com>

Date: Mon, 24 Sep 2012 19:52:09 -0400

Subject: [PATCH 4/5] Ticket #481 - expand nested posix groups

Description: Add ability to populate memberuid dynamically to

reflect nested grouping.

(cherry picked from commit b9eeb2e1a8e688dfec753e8965d0e5aeb119e638)

---

 Makefile.am                                        |    1 +

 Makefile.in                                        |    1 +

 ldap/ldif/50posix-winsync-plugin.ldif              |    1 +

 ldap/schema/60posix-winsync-plugin.ldif            |   44 +

 .../plugins/posix-winsync/posix-group-func.c       |  846 ++++++++++++++++----

 .../plugins/posix-winsync/posix-group-task.c       |  249 +++++--

 .../plugins/posix-winsync/posix-winsync-config.c   |   16 +

 ldap/servers/plugins/posix-winsync/posix-winsync.c |   72 ++-

 .../plugins/posix-winsync/posix-wsp-ident.h        |    4 +-

 9 files changed, 1008 insertions(+), 226 deletions(-)

 create mode 100644 ldap/schema/60posix-winsync-plugin.ldif

diff --git a/Makefile.am b/Makefile.am

index c5c4080..507a2d6 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -299,6 +299,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \

 	$(srcdir)/ldap/schema/50ns-value.ldif \

 	$(srcdir)/ldap/schema/50ns-web.ldif \

 	$(srcdir)/ldap/schema/60pam-plugin.ldif \

+	$(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \

 	$(srcdir)/ldap/schema/60autofs.ldif \

 	$(srcdir)/ldap/schema/60eduperson.ldif \

 	$(srcdir)/ldap/schema/60mozilla.ldif \

diff --git a/Makefile.in b/Makefile.in

index 3777829..f105932 100644

--- a/Makefile.in

+++ b/Makefile.in

@@ -1527,6 +1527,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \

 	$(srcdir)/ldap/schema/50ns-value.ldif \

 	$(srcdir)/ldap/schema/50ns-web.ldif \

 	$(srcdir)/ldap/schema/60pam-plugin.ldif \

+	$(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \

 	$(srcdir)/ldap/schema/60autofs.ldif \

 	$(srcdir)/ldap/schema/60eduperson.ldif \

 	$(srcdir)/ldap/schema/60mozilla.ldif \

diff --git a/ldap/ldif/50posix-winsync-plugin.ldif b/ldap/ldif/50posix-winsync-plugin.ldif

index de8c432..17dc243 100644

--- a/ldap/ldif/50posix-winsync-plugin.ldif

+++ b/ldap/ldif/50posix-winsync-plugin.ldif

@@ -10,6 +10,7 @@ nsslapd-pluginenabled: off

 nsslapd-plugin-depends-on-type: database

 posixWinsyncMsSFUSchema: false

 posixWinsyncMapMemberUID: true

+posixWinsyncMapNestedGrouping: false

 posixWinsyncCreateMemberOfTask: false

 posixWinsyncLowerCaseUID: false

 nsslapd-pluginprecedence: 25

diff --git a/ldap/schema/60posix-winsync-plugin.ldif b/ldap/schema/60posix-winsync-plugin.ldif

new file mode 100644

index 0000000..8d9a72e

--- /dev/null

+++ b/ldap/schema/60posix-winsync-plugin.ldif

@@ -0,0 +1,44 @@

+#

+# BEGIN COPYRIGHT BLOCK

+# This Program is free software; you can redistribute it and/or modify it under

+# the terms of the GNU General Public License as published by the Free Software

+# Foundation; version 2 of the License.

+# 

+# This Program is distributed in the hope that it will be useful, but WITHOUT

+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

+# 

+# You should have received a copy of the GNU General Public License along with

+# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple

+# Place, Suite 330, Boston, MA 02111-1307 USA.

+# 

+# In addition, as a special exception, Red Hat, Inc. gives You the additional

+# right to link the code of this Program with code not covered under the GNU

+# General Public License ("Non-GPL Code") and to distribute linked combinations

+# including the two, subject to the limitations in this paragraph. Non-GPL Code

+# permitted under this exception must only link to the code of this Program

+# through those well defined interfaces identified in the file named EXCEPTION

+# found in the source code files (the "Approved Interfaces"). The files of

+# Non-GPL Code may instantiate templates or use macros or inline functions from

+# the Approved Interfaces without causing the resulting work to be covered by

+# the GNU General Public License. Only Red Hat, Inc. may make changes or

+# additions to the list of Approved Interfaces. You must obey the GNU General

+# Public License in all respects for all of the Program code and other code used

+# in conjunction with the Program except the Non-GPL Code covered by this

+# exception. If you modify this file, you may extend this exception to your

+# version of the file, but you are not obligated to do so. If you do not wish to

+# provide this exception without modification, you must delete this exception

+# statement from your version and license this file solely under the GPL without

+# exception. 

+# 

+#  

+# Copyright (C) 2005 Red Hat, Inc.

+# All rights reserved.

+# END COPYRIGHT BLOCK

+#

+#

+# Schema for representing internal dynamically-generated group members

+#

+dn: cn=schema

+attributeTypes: ( 2.16.840.1.113730.3.1.2141 NAME 'dsOnlyMemberUid' DESC 'Elements from a memberuid attribute created to reflect dynamic group membership' SYNTAX  1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Red Hat Directory Server' )

+objectClasses: ( 2.16.840.1.113730.3.2.326 NAME 'dynamicGroup' DESC 'Group containing internal dynamically-generated members' SUP posixGroup AUXILIARY MAY ( dsOnlyMemberUid ) X-ORIGIN 'Red Hat Directory Server' )

diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c

index 1403a89..66b9272 100644

--- a/ldap/servers/plugins/posix-winsync/posix-group-func.c

+++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c

@@ -18,11 +18,14 @@

  $Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $

  */

 #include "slapi-plugin.h"

+#include "slapi-private.h"

 #include <string.h>

 #include <nspr.h>

 #include "posix-wsp-ident.h"

+#define MAX_RECURSION_DEPTH (5)

+

 Slapi_Value **

 valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */

 static PRMonitor *memberuid_operation_lock = 0;

@@ -45,58 +48,100 @@ memberUidLockInit()

     return (memberuid_operation_lock = PR_NewMonitor()) != NULL;

 }

+void

+addDynamicGroupIfNecessary(Slapi_Entry *entry, Slapi_Mods *smods) {

+    Slapi_Attr *oc_attr = NULL;

+    Slapi_Value *voc = slapi_value_new();

+

+    slapi_value_init_string(voc, "dynamicGroup");

+    slapi_entry_attr_find(entry, "objectClass", &oc_attr);

+

+    if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {

+        if (smods) {

+            slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");

+        }

+        else {

+            smods = slapi_mods_new();

+            slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");

+

+            Slapi_PBlock *mod_pb = slapi_pblock_new();

+            slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,

+                                             posix_winsync_get_plugin_identity(), 0);

+            slapi_modify_internal_pb(mod_pb);

+            slapi_pblock_destroy(mod_pb);

+

+            slapi_mods_free(&smods);

+        }

+    }

+

+    slapi_value_free(&voc;;

+}

+

+Slapi_Entry *

+getEntry(const char *udn, char **attrs)

+{

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "getEntry: search %s\n", udn);

+

+    Slapi_DN *udn_sdn = slapi_sdn_new_dn_byval(udn);

+    Slapi_Entry *result = NULL;

+    int rc = slapi_search_internal_get_entry(udn_sdn, attrs, &result, posix_winsync_get_plugin_identity());

+    slapi_sdn_free(&udn_sdn);

+

+    if (rc == 0) {

+        if (result != NULL) {

+            return result; /* Must be freed */

+        }

+        else {

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "getEntry: %s not found\n", udn);

+        }

+    }

+    else {

+        slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,

+                        "getEntry: error searching for uid: %d", rc);

+    }

+

+    return NULL;

+}

+

 /* search the user with DN udn and returns uid*/

 char *

 searchUid(const char *udn)

 {

-    Slapi_PBlock *int_search_pb = slapi_pblock_new();

-    Slapi_Entry **entries = NULL;

-    char *attrs[] = { "uid", NULL };

+    char *attrs[] = { "uid", "objectclass", NULL };

+    Slapi_Entry *entry = getEntry(udn,

+                                  /* "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", */

+                                  attrs);

     char *uid = NULL;

-    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search Uid: search %s\n", udn);

+    if (entry) {

+        Slapi_Attr *attr = NULL;

+        Slapi_Value *v = NULL;

-    slapi_search_internal_set_pb(int_search_pb, udn, LDAP_SCOPE_BASE,

-                                 "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", attrs,

-                                 0 /* attrsonly */, NULL /* controls */, NULL /* uniqueid */,

-                                 posix_winsync_get_plugin_identity(), 0 /* actions */);

-    if (slapi_search_internal_pb(int_search_pb)) {

-        /* get result and log an error */

-        int res = 0;

-        slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_RESULT, &res;;

-        slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,

-                        "searchUid: error searching for uid: %d", res);

-    } else {

-        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "searchUid: searched %s\n",

-                        udn);

-        slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);

-        if (NULL != entries && NULL != entries[0]) {

-            Slapi_Attr *attr = NULL;

-            Slapi_Value *v = NULL;

+        if (slapi_entry_attr_find(entry, "uid", &attr) == 0 && hasObjectClass(entry, "posixAccount")) {

+            slapi_attr_first_value(attr, &v);

+            uid = slapi_ch_strdup(slapi_value_get_string(v));

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "searchUid: return uid %s\n", uid);

+        } else {

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "searchUid: uid in %s not found\n", udn);

+        }

-            if (slapi_entry_attr_find(entries[0], "uid", &attr) == 0) {

-                slapi_attr_first_value(attr, &v);

-                uid = slapi_ch_strdup(slapi_value_get_string(v));

-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

-                                "searchUid: return uid %s\n", uid);

-                /* slapi_value_free(&v); */

-            } else {

-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

-                                "searchUid: uid in %s not found\n", udn);

-            }

-            slapi_free_search_results_internal(int_search_pb);

-            slapi_pblock_destroy(int_search_pb);

-            if (uid && posix_winsync_config_get_lowercase()) {

-                return slapi_dn_ignore_case(uid);

-            }

-            return uid;

+        if (uid && posix_winsync_config_get_lowercase()) {

+            uid = slapi_dn_ignore_case(uid);

         }

+

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "searchUid: About to free entry\n", udn);

+        

+        slapi_entry_free(entry);

     }

-    slapi_free_search_results_internal(int_search_pb);

-    slapi_pblock_destroy(int_search_pb);

+

     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

-                    "searchUid: posix user %s not found\n", udn);

-    return NULL;

+                    "searchUid: <==\n", udn);

+        

+    return uid;

 }

 int

@@ -152,6 +197,36 @@ uid_in_set(const char* uid, char **uids)

     return false;

 }

+int

+uid_in_valueset(const char* uid, Slapi_ValueSet *uids)

+{

+    int i;

+    Slapi_Value *v = NULL;

+

+    if (uid == NULL)

+        return false;

+    for (i = slapi_valueset_first_value(uids, &v); i != -1;

+         i = slapi_valueset_next_value(uids, i, &v)) {

+        Slapi_RDN *i_rdn = NULL;

+        char *i_uid = NULL;

+        char *t = NULL;

+

+        const char *uid_i = slapi_value_get_string(v);

+

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "uid_in_valueset: comp %s %s \n",

+                        uid, uid_i);

+        i_rdn = slapi_rdn_new_dn(uid_i);

+        if (slapi_rdn_get_first(i_rdn, &t, &i_uid) == 1) {

+            if (strncasecmp(uid, i_uid, 256) == 0) {

+                slapi_rdn_free(&i_rdn);

+                return true;

+            }

+        }

+        slapi_rdn_free(&i_rdn);

+    }

+    return false;

+}

+

 /* return 1 if smods already has the given mod - 0 otherwise */

 static int

 smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)

@@ -186,7 +261,7 @@ smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)

 }

 int

-isPosixGroup(Slapi_Entry *entry)

+hasObjectClass(Slapi_Entry *entry, const char *objectClass)

 {

     int rc = 0;

     int i;

@@ -200,7 +275,7 @@ isPosixGroup(Slapi_Entry *entry)

     }

     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

-                    "add/mod-GroupMembership scan objectclasses\n");

+                    "Scanning objectclasses\n");

     for (

         i = slapi_attr_first_value(obj_attr, &value);

@@ -209,22 +284,357 @@ isPosixGroup(Slapi_Entry *entry)

     ) {

         const char *oc = NULL;

         oc = slapi_value_get_string(value);

-        if (strncasecmp(oc, "posixGroup", 11) == 0) {

-            return 1; /* Entry has objectclass posixGroup */

+        if (strcasecmp(oc, objectClass) == 0) {

+            return 1; /* Entry has the desired objectclass */

+        }

+    }

+    

+    return 0; /* Doesn't have desired objectclass */

+}

+

+void

+posix_winsync_foreach_parent(Slapi_Entry *entry, char **attrs, plugin_search_entry_callback callback, void *callback_data)

+{

+    char *cookie = NULL;

+    Slapi_Backend *be = NULL;

+

+    const char *value = slapi_entry_get_ndn(entry);

+    size_t vallen = value ? strlen(value) : 0;

+    char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1);

+    char *filter = slapi_ch_smprintf("(uniqueMember=%s)", escape_filter_value(value, vallen, filter_escaped_value));

+    slapi_ch_free_string(&filter_escaped_value);

+

+    Slapi_PBlock *search_pb = slapi_pblock_new();

+

+    for (be = slapi_get_first_backend(&cookie); be;

+         be = slapi_get_next_backend(cookie)) {

+        const Slapi_DN *base_sdn = slapi_be_getsuffix(be, 0);

+        if (base_sdn == NULL) {

+            continue;

         }

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "posix_winsync_foreach_parent: Searching subtree %s for %s\n",

+                        slapi_sdn_get_dn(base_sdn),

+                        filter);

+        

+        slapi_search_internal_set_pb(search_pb,

+                                     slapi_sdn_get_dn(base_sdn),

+                                     LDAP_SCOPE_SUBTREE,

+                                     filter,

+                                     attrs, 0, NULL, NULL,

+                                     posix_winsync_get_plugin_identity(), 0);

+        slapi_search_internal_callback_pb(search_pb, callback_data, 0, callback, 0);        

+        

+        slapi_pblock_init(search_pb);

     }

-    return 0; /* Doesn't have objectclass "posixGroup" */

+    slapi_pblock_destroy(search_pb);

+    slapi_ch_free((void**)&cookie);

+    slapi_ch_free_string(&filter);

 }

-int

-modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)

+/* Retrieve nested membership from chains of groups.

+ * Muid_vs  in => any preexisting membership list

+ *         out => the union of the input list and the total membership

+ * Muid_nested_vs out => the members of muid_vs "out" that weren't in muid_vs "in"

+ * deletions in => Any elements to NOT consider if members of base_sdn

+ */

+void

+getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, Slapi_ValueSet *muid_nested_vs, Slapi_ValueSet *deletions, const Slapi_DN *base_sdn, int depth)

 {

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "getMembershipFromDownward: ==>\n");

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "getMembershipFromDownward: entry name: %s\n",

+                    slapi_entry_get_dn_const(entry));

+

     int rc = 0;

+    Slapi_Attr *um_attr = NULL; /* Entry attributes uniqueMember */

+    Slapi_Value *uid_value = NULL; /* uniqueMember attribute values */

+

+    if (depth >= MAX_RECURSION_DEPTH) {

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "getMembershipFromDownward: recursion limit reached: %d\n", depth);

+        return;

+    }

+

+    rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr);

+    if (rc != 0 || um_attr == NULL) {

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "getMembershipFromDownward end: attribute uniquemember not found\n");

+        return;

+    }

+

+    int i;

+    for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;

+         i = slapi_attr_next_value(um_attr, i, &uid_value)) {

+

+        char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL };

+        const char *uid_dn = slapi_value_get_string(uid_value);

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "getMembershipFromDownward: iterating uniqueMember: %s\n",

+                        uid_dn);

+        

+        if (deletions && !slapi_sdn_compare(slapi_entry_get_sdn_const(entry), base_sdn)) {

+            if (slapi_valueset_find(um_attr, deletions, uid_value)) {

+                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                                "getMembershipFromDownward: Skipping iteration because of deletion\n");

+

+                continue;

+            }

+        }

+

+        Slapi_Entry *child = getEntry(uid_dn, attrs);

+

+        if (!child) {

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "getMembershipFromDownward end: child not found: %s\n", uid_dn);

+        }

+        else {

+            /* PosixGroups except for the top one are already fully mapped out */

+            if ((!hasObjectClass(entry, "posixGroup") || depth == 0) &&

+                (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup"))) {

+

+                /* Recurse downward */

+                getMembershipFromDownward(child, muid_vs, muid_nested_vs, deletions, base_sdn, depth + 1);

+            }

+

+            if (hasObjectClass(child, "posixAccount")) {

+                Slapi_Attr *uid_attr = NULL;

+                Slapi_Value *v = NULL;

+                if (slapi_entry_attr_find(child, "uid", &uid_attr) == 0) {

+                    slapi_attr_first_value(uid_attr, &v);

+

+                    if (v && !slapi_valueset_find(uid_attr, muid_vs, v)) {                        

+                        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                                        "getMembershipFromDownward: adding member: %s\n",

+                                        slapi_value_get_string(v));

+                        slapi_valueset_add_value(muid_vs, v);

+                        slapi_valueset_add_value(muid_nested_vs, v);

+                    }

+                }

+            }

+            slapi_entry_free(child);

+        }

+    }

+

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "getMembershipFromDownward: <==\n");

+}

+

+struct propogateMembershipUpwardArgs {

+    Slapi_ValueSet *muid_vs;

+    int depth;

+};

+

+/* Forward declaration for next function */

+void propogateMembershipUpward(Slapi_Entry *, Slapi_ValueSet *, int);

+

+int

+propogateMembershipUpwardCallback(Slapi_Entry *child, void *callback_data)

+{

+    struct propogateMembershipUpwardArgs *args = (struct propogateMembershipUpwardArgs *)(callback_data);

+    propogateMembershipUpward(child, args->muid_vs, args->depth);

+    return 0;

+}

+

+void

+propogateMembershipUpward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, int depth)

+{

+    if (depth >= MAX_RECURSION_DEPTH) {

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "propogateMembershipUpward: recursion limit reached: %d\n", depth);

+        return;

+    }

+

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateMembershipUpward: ==>\n");

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateMembershipUpward: entry name: %s\n",

+                    slapi_entry_get_dn_const(entry));

+

+    Slapi_ValueSet *muid_here_vs   = NULL;

+    Slapi_ValueSet *muid_upward_vs = NULL;

+

+    /* Get the memberUids at this location, and figure out local changes to memberUid (if any)

+     *  and changes to send upward.

+     */

+    if (depth > 0 && hasObjectClass(entry, "posixGroup")) {

+        int addDynamicGroup = 0;

+        Slapi_Attr *muid_old_attr = NULL;

+        Slapi_ValueSet *muid_old_vs = NULL;

+        int rc = slapi_entry_attr_find(entry, "memberUid", &muid_old_attr);

+        if (rc != 0 || muid_old_attr == NULL) { /* Found no memberUid list, so create  */

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "propogateMembershipUpward: no attribute memberUid\n");

+            

+            /* There's no values from this entry to add */

+            muid_upward_vs = muid_vs;

+            muid_here_vs = muid_vs;

+        }

+        else {

+            /* Eliminate duplicates */

+            muid_upward_vs = slapi_valueset_new();

+            muid_here_vs = slapi_valueset_new();

+

+            slapi_valueset_set_valueset(muid_upward_vs, muid_old_vs);

+

+            slapi_attr_get_valueset(muid_old_attr, &muid_old_vs);

+            int i = 0;

+            Slapi_Value *v = NULL;

+            for (i = slapi_valueset_first_value(muid_vs, &v); i != -1;

+                 i = slapi_valueset_next_value(muid_vs, i, &v)) {

+                

+                if (!slapi_valueset_find(muid_old_attr, muid_old_vs, v)) {

+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                                    "propogateMembershipUpward: adding %s to set\n",

+                                    slapi_value_get_string(v));

+

+                    addDynamicGroup = 1;

+                    slapi_valueset_add_value(muid_here_vs, v);

+                    slapi_valueset_add_value(muid_upward_vs, v);

+                }

+            }

+        }

+

+        /* Update this group's membership */

+        slapi_entry_add_valueset(entry, "memberUid", muid_here_vs);

+        if (addDynamicGroup) {

+            addDynamicGroupIfNecessary(entry, NULL);

+            slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_here_vs);

+        }

+    }

+    else {

+        muid_upward_vs = muid_vs;

+    }

+

+    /* Find groups containing this one, recurse

+     */

+    char *attrs[] = {"memberUid", "objectClass", NULL};

+    struct propogateMembershipUpwardArgs data = {muid_upward_vs, depth + 1};

+

+    posix_winsync_foreach_parent(entry, attrs, propogateMembershipUpwardCallback, &data);

+

+/* Cleanup */

+    if (muid_here_vs && muid_here_vs != muid_vs) {

+        slapi_valueset_free(muid_here_vs); muid_here_vs = NULL;

+    }

+    if (muid_upward_vs && muid_upward_vs != muid_vs) {

+        slapi_valueset_free(muid_upward_vs); muid_upward_vs = NULL;

+    }

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateMembershipUpward: <==\n");

+}

+

+struct propogateDeletionsUpwardArgs {

+    const Slapi_DN *base_sdn;

+    Slapi_ValueSet *smod_deluids;

+    Slapi_ValueSet *del_nested_vs;

+    int depth;

+};

+

+/* Forward declaration for next function */

+void propogateDeletionsUpward(Slapi_Entry *, const Slapi_DN *, Slapi_ValueSet*, Slapi_ValueSet *, int);

+

+int

+propogateDeletionsUpwardCallback(Slapi_Entry *entry, void *callback_data)

+{

+    struct propogateDeletionsUpwardArgs *args = (struct propogateDeletionsUpwardArgs *)(callback_data);

+    propogateDeletionsUpward(entry, args->base_sdn, args->smod_deluids, args->del_nested_vs, args->depth);

+}

+

+void

+propogateDeletionsUpward(Slapi_Entry *entry, const Slapi_DN *base_sdn, Slapi_ValueSet *smod_deluids, Slapi_ValueSet *del_nested_vs, int depth)

+{

+    if (smod_deluids == NULL) return;

+

+    if (depth >= MAX_RECURSION_DEPTH) {

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "propogateDeletionsUpward: recursion limit reached: %d\n", depth);

+        return;

+    }

+

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateDeletionsUpward: ==>\n");

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateDeletionsUpward: entry name: %s\n",

+                    slapi_entry_get_dn_const(entry));

+

+    char *attrs[] = { "uniqueMember", "memberUid", "objectClass", NULL };

+    struct propogateDeletionsUpwardArgs data = {base_sdn, smod_deluids, del_nested_vs, depth + 1};

+    posix_winsync_foreach_parent(entry, attrs, propogateDeletionsUpwardCallback, &data);

+

+    Slapi_Attr *muid_attr = NULL;

+    int rc = slapi_entry_attr_find(entry, "dsOnlyMemberUid", &muid_attr);

+    

+    if (rc == 0 && muid_attr != NULL) {

+

+        Slapi_ValueSet *muid_vs = slapi_valueset_new();

+        Slapi_ValueSet *muid_nested_vs = slapi_valueset_new();

+        Slapi_ValueSet *muid_deletions_vs = slapi_valueset_new();

+

+        getMembershipFromDownward(entry, muid_vs, muid_nested_vs, smod_deluids, base_sdn, 0);

+

+        int i;

+        Slapi_Value *v;

+        for (i = slapi_attr_first_value(muid_attr, &v); i != -1;

+             i = slapi_attr_next_value(muid_attr, i, &v)) {

+            if (!slapi_valueset_find(muid_attr, muid_vs, v)) {

+                const char *uid = slapi_value_get_string(v);

+                if (depth == 0 && !uid_in_valueset(uid, smod_deluids)) {

+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                                    "propogateDeletionsUpward: Adding deletion to modlist: %s\n",

+                                    slapi_value_get_string(v));

+                    slapi_valueset_add_value(del_nested_vs, v);                    

+                }

+                else if (depth > 0) {

+                    slapi_valueset_add_value(muid_deletions_vs, v);                

+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                                    "propogateDeletionsUpward: Adding deletion to deletion list: %s\n",

+                                    slapi_value_get_string(v));

+                }

+            }

+        }

+

+        if (depth > 0) {

+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                            "propogateDeletionsUpward: executing deletion list\n");

+

+            Slapi_Mods *smods = slapi_mods_new();

+            slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "memberuid", valueset_get_valuearray(muid_deletions_vs));

+            slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "dsonlymemberuid", valueset_get_valuearray(muid_deletions_vs));

+

+            Slapi_PBlock *mod_pb = slapi_pblock_new();

+            slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,

+                                             posix_winsync_get_plugin_identity(), 0);

+            slapi_modify_internal_pb(mod_pb);

+            slapi_pblock_destroy(mod_pb);

+

+            slapi_mods_free(&smods);

+        }

+

+        slapi_valueset_free(muid_vs); muid_vs = NULL;

+        slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL;

+        slapi_valueset_free(muid_deletions_vs); muid_deletions_vs = NULL;

+    }

+

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                    "propogateDeletionsUpward: <==\n");

+}

+

+int

+modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)

+{

     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: ==>\n");

+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: Modding %s\n",

+                    slapi_entry_get_dn_const(entry));

-    if (!isPosixGroup(entry)) {

+    int posixGroup = hasObjectClass(entry, "posixGroup");

+

+    if (!(posixGroup || hasObjectClass(entry, "ntGroup"))) {

+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

+                        "modGroupMembership end: Not a posixGroup or ntGroup\n");

         return 0;

     }

@@ -232,7 +642,7 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)

     Slapi_Mod *nextMod = slapi_mod_new();

     int del_mod = 0; /* Bool: was there a delete mod? */

     char **smod_adduids = NULL;

-    char **smod_deluids = NULL;

+    Slapi_ValueSet *smod_deluids = NULL;

     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

                     "modGroupMembership: posixGroup -> look for uniquemember\n");

@@ -243,15 +653,20 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)

         if (slapi_attr_types_equivalent(slapi_mod_get_type(smod), "uniqueMember")) {

             struct berval *bv;

+            int current_del_mod = SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod));

+            if (current_del_mod) {

+                del_mod = 1;

+            }

+            

             for (bv = slapi_mod_get_first_value(smod); bv;

                  bv = slapi_mod_get_next_value(smod)) {

                 Slapi_Value *sv = slapi_value_new();

                 slapi_value_init_berval(sv, bv); /* copies bv_val */

-                if (SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod))) {

-                    del_mod = 1;

-                    slapi_ch_array_add(&smod_deluids,

-                                       slapi_ch_strdup(slapi_value_get_string(sv)));

+                if (current_del_mod) {

+                    if (!smod_deluids) smod_deluids = slapi_valueset_new();

+

+                    slapi_valueset_add_value(smod_deluids, sv);

                     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,