memberof.c

/* memberof.c - back-reference for group membership */
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 2005-2007 Pierangelo Masarati <ando@sys-net.it>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */
/* ACKNOWLEDGMENTS:
 * This work was initially developed by Pierangelo Masarati for inclusion
 * in OpenLDAP Software, sponsored by SysNet s.r.l.
 */

#include "portable.h"

#ifdef SLAPD_OVER_MEMBEROF

#include <stdio.h>

#include "ac/string.h"
#include "ac/socket.h"

#include "slap.h"
#include "config.h"
#include "lutil.h"

/*
 *	Glossary:
 *
 *		GROUP		a group object (an entry with GROUP_OC
 *				objectClass)
 *		MEMBER		a member object (an entry whose DN is
 *				listed as MEMBER_AT value of a GROUP)
 *		GROUP_OC	the objectClass of the group object
 *				(default: groupOfNames)
 *		MEMBER_AT	the membership attribute, DN-valued;
 *				note: nameAndOptionalUID is tolerated
 *				as soon as the optionalUID is absent
 *				(default: member)
 *		MEMBER_OF	reverse membership attribute
 *				(default: memberOf)
 *
 * 	- add:
 *		- if the entry that is being added is a GROUP,
 *		  the MEMBER_AT defined as values of the add operation
 *		  get the MEMBER_OF value directly from the request.
 *
 *		  if configured to do so, the MEMBER objects do not exist,
 *		  and no relax control is issued, either:
 *			- fail
 *			- drop non-existing members
 *		  (by default: don't muck with values)
 *
 *		- if (configured to do so,) the referenced GROUP exists,
 *		  the relax control is set and the user has
 *		  "manage" privileges, allow to add MEMBER_OF values to
 *		  generic entries.
 *
 *	- modify:
 *		- if the entry being modified is a GROUP_OC and the 
 *		  MEMBER_AT attribute is modified, the MEMBER_OF value
 *		  of the (existing) MEMBER_AT entries that are affected
 *		  is modified according to the request:
 *			- if a MEMBER is removed from the group,
 *			  delete the corresponding MEMBER_OF
 *			- if a MEMBER is added to a group,
 *			  add the corresponding MEMBER_OF
 *
 *		  We need to determine, from the database, if it is
 *		  a GROUP_OC, and we need to check, from the
 *		  modification list, if the MEMBER_AT attribute is being
 *		  affected, and what MEMBER_AT values are affected.
 *
 *		  if configured to do so, the entries corresponding to
 *		  the MEMBER_AT values do not exist, and no relax control
 *		  is issued, either:
 *			- fail
 *			- drop non-existing members
 *		  (by default: don't muck with values)
 *
 *		- if configured to do so, the referenced GROUP exists,
 *		  (the relax control is set) and the user has
 *		  "manage" privileges, allow to add MEMBER_OF values to
 *		  generic entries; the change is NOT automatically reflected
 *		  in the MEMBER attribute of the GROUP referenced
 *		  by the value of MEMBER_OF; a separate modification,
 *		  with or without relax control, needs to be performed.
 *
 *	- modrdn:
 *		- if the entry being renamed is a GROUP, the MEMBER_OF
 *		  value of the (existing) MEMBER objects is modified
 *		  accordingly based on the newDN of the GROUP.
 *
 *		  We need to determine, from the database, if it is
 *		  a GROUP; the list of MEMBER objects is obtained from
 *		  the database.
 *
 *		  Non-existing MEMBER objects are ignored, since the
 *		  MEMBER_AT is not being addressed by the operation.
 *
 *		- if the entry being renamed has the MEMBER_OF attribute,
 *		  the corresponding MEMBER value must be modified in the
 *		  respective group entries.
 *		
 *
 *	- delete:
 *		- if the entry being deleted is a GROUP, the (existing)
 *		  MEMBER objects are modified accordingly; a copy of the 
 *		  values of the MEMBER_AT is saved and, if the delete 
 *		  succeeds, the MEMBER_OF value of the (existing) MEMBER
 *		  objects is deleted.
 *
 *		  We need to determine, from the database, if it is
 *		  a GROUP.
 *
 *		  Non-existing MEMBER objects are ignored, since the entry
 *		  is being deleted.
 *
 *		- if the entry being deleted has the MEMBER_OF attribute,
 *		  the corresponding value of the MEMBER_AT must be deleted
 *		  from the respective GROUP entries.
 */

#define	SLAPD_MEMBEROF_ATTR	"memberOf"

static AttributeDescription	*ad_member;
static AttributeDescription	*ad_memberOf;

static ObjectClass			*oc_group;

static slap_overinst		memberof;

typedef struct memberof_t {
	struct berval		mo_dn;
	struct berval		mo_ndn;

	ObjectClass		*mo_oc_group;
	AttributeDescription	*mo_ad_member;
	AttributeDescription	*mo_ad_memberof;
	
	struct berval		mo_groupFilterstr;
	AttributeAssertion	mo_groupAVA;
	Filter			mo_groupFilter;

	struct berval		mo_memberFilterstr;
	Filter			mo_memberFilter;

	unsigned		mo_flags;
#define	MEMBEROF_NONE		0x00U
#define	MEMBEROF_FDANGLING_DROP	0x01U
#define	MEMBEROF_FDANGLING_ERROR	0x02U
#define	MEMBEROF_FDANGLING_MASK	(MEMBEROF_FDANGLING_DROP|MEMBEROF_FDANGLING_ERROR)
#define	MEMBEROF_FREFINT	0x04U
#define	MEMBEROF_FREVERSE	0x08U

	ber_int_t		mo_dangling_err;

#define MEMBEROF_CHK(mo,f) \
	(((mo)->mo_flags & (f)) == (f))
#define MEMBEROF_DANGLING_CHECK(mo) \
	((mo)->mo_flags & MEMBEROF_FDANGLING_MASK)
#define MEMBEROF_DANGLING_DROP(mo) \
	MEMBEROF_CHK((mo),MEMBEROF_FDANGLING_DROP)
#define MEMBEROF_DANGLING_ERROR(mo) \
	MEMBEROF_CHK((mo),MEMBEROF_FDANGLING_ERROR)
#define MEMBEROF_REFINT(mo) \
	MEMBEROF_CHK((mo),MEMBEROF_FREFINT)
#define MEMBEROF_REVERSE(mo) \
	MEMBEROF_CHK((mo),MEMBEROF_FREVERSE)
} memberof_t;

typedef enum memberof_is_t {
	MEMBEROF_IS_NONE = 0x00,
	MEMBEROF_IS_GROUP = 0x01,
	MEMBEROF_IS_MEMBER = 0x02,
	MEMBEROF_IS_BOTH = (MEMBEROF_IS_GROUP|MEMBEROF_IS_MEMBER)
} memberof_is_t;

typedef struct memberof_cookie_t {
	AttributeDescription	*ad;
	BerVarray		vals;
	int			foundit;
} memberof_cookie_t;

typedef struct memberof_cbinfo_t {
	slap_overinst *on;
	BerVarray member;
	BerVarray memberof;
	memberof_is_t what;
} memberof_cbinfo_t;

static void
memberof_set_backend( Operation *op_target, Operation *op, slap_overinst *on )
{
    BackendInfo *bi = op->o_bd->bd_info;

    if ( bi->bi_type == memberof.on_bi.bi_type )
        op_target->o_bd->bd_info = (BackendInfo *)on->on_info;
}

static int
memberof_isGroupOrMember_cb( Operation *op, SlapReply *rs )
{
	if ( rs->sr_type == REP_SEARCH ) {
		memberof_cookie_t	*mc;

		mc = (memberof_cookie_t *)op->o_callback->sc_private;
		mc->foundit = 1;
	}

	return 0;
}

/*
 * callback for internal search that saves the member attribute values
 * of groups being deleted.
 */
static int
memberof_saveMember_cb( Operation *op, SlapReply *rs )
{
	if ( rs->sr_type == REP_SEARCH ) {
		memberof_cookie_t	*mc;
		Attribute		*a;

		mc = (memberof_cookie_t *)op->o_callback->sc_private;
		mc->foundit = 1;

		assert( rs->sr_entry != NULL );
		assert( rs->sr_entry->e_attrs != NULL );

		a = attr_find( rs->sr_entry->e_attrs, mc->ad );
		if ( a != NULL ) {
			ber_bvarray_dup_x( &mc->vals, a->a_nvals, op->o_tmpmemctx );

			assert( attr_find( a->a_next, mc->ad ) == NULL );
		}
	}

	return 0;
}

/*
 * the delete hook performs an internal search that saves the member
 * attribute values of groups being deleted.
 */
static int
memberof_isGroupOrMember( Operation *op, memberof_cbinfo_t *mci )
{
	slap_overinst		*on = mci->on;
	memberof_t		*mo = (memberof_t *)on->on_bi.bi_private;

	Operation		op2 = *op;
	slap_callback		cb = { 0 };
	BackendInfo	*bi = op->o_bd->bd_info;
	AttributeName		an[ 2 ];

	memberof_is_t		iswhat = MEMBEROF_IS_NONE;
	memberof_cookie_t	mc;

	assert( mci->what != MEMBEROF_IS_NONE );

	cb.sc_private = &mc;
	if ( op->o_tag == LDAP_REQ_DELETE ) {
		cb.sc_response = memberof_saveMember_cb;

	} else {
		cb.sc_response = memberof_isGroupOrMember_cb;
	}

	op2.o_tag = LDAP_REQ_SEARCH;
	op2.o_callback = &cb;
	op2.o_dn = op->o_bd->be_rootdn;
	op2.o_ndn = op->o_bd->be_rootndn;

	op2.ors_scope = LDAP_SCOPE_BASE;
	op2.ors_deref = LDAP_DEREF_NEVER;
	BER_BVZERO( &an[ 1 ].an_name );
	op2.ors_attrs = an;
	op2.ors_attrsonly = 0;
	op2.ors_limit = NULL;
	op2.ors_slimit = 1;
	op2.ors_tlimit = SLAP_NO_LIMIT;

	if ( mci->what & MEMBEROF_IS_GROUP ) {
		SlapReply	rs2 = { REP_RESULT };

		mc.ad = mo->mo_ad_member;
		mc.foundit = 0;
		mc.vals = NULL;
		an[ 0 ].an_desc = mo->mo_ad_member;
		an[ 0 ].an_name = an[ 0 ].an_desc->ad_cname;
		op2.ors_filterstr = mo->mo_groupFilterstr;
		op2.ors_filter = &mo->mo_groupFilter;
		op2.o_do_not_cache = 1;	/* internal search, don't log */

		memberof_set_backend( &op2, op, on );
		(void)op->o_bd->be_search( &op2, &rs2 );
		op2.o_bd->bd_info = bi;

		if ( mc.foundit ) {
			iswhat |= MEMBEROF_IS_GROUP;
			if ( mc.vals ) mci->member = mc.vals;

		}
	}

	if ( mci->what & MEMBEROF_IS_MEMBER ) {
		SlapReply	rs2 = { REP_RESULT };

		mc.ad = mo->mo_ad_memberof;
		mc.foundit = 0;
		mc.vals = NULL;
		an[ 0 ].an_desc = mo->mo_ad_memberof;
		an[ 0 ].an_name = an[ 0 ].an_desc->ad_cname;
		op2.ors_filterstr = mo->mo_memberFilterstr;
		op2.ors_filter = &mo->mo_memberFilter;
		op2.o_do_not_cache = 1;	/* internal search, don't log */

		memberof_set_backend( &op2, op, on );
		(void)op->o_bd->be_search( &op2, &rs2 );
		op2.o_bd->bd_info = bi;

		if ( mc.foundit ) {
			iswhat |= MEMBEROF_IS_MEMBER;
			if ( mc.vals ) mci->memberof = mc.vals;

		}
	}

	mci->what = iswhat;

	return LDAP_SUCCESS;
}

/*
 * response callback that adds memberof values when a group is modified.
 */
static void
memberof_value_modify(
	Operation		*op,
	struct berval		*ndn,
	AttributeDescription	*ad,
	struct berval		*old_dn,
	struct berval		*old_ndn,
	struct berval		*new_dn,
	struct berval		*new_ndn )
{
	memberof_cbinfo_t *mci = op->o_callback->sc_private;
	slap_overinst	*on = mci->on;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	Operation	op2 = *op;
	unsigned long opid = op->o_opid;
	SlapReply	rs2 = { REP_RESULT };
	slap_callback	cb = { NULL, slap_null_cb, NULL, NULL };
	Modifications	mod[ 2 ] = { { { 0 } } }, *ml;
	struct berval	values[ 4 ], nvalues[ 4 ];
	int		mcnt = 0;

	if ( old_ndn != NULL && new_ndn != NULL &&
		ber_bvcmp( old_ndn, new_ndn ) == 0 ) {
	    /* DNs compare equal, it's a noop */
	    return;
	}

	op2.o_tag = LDAP_REQ_MODIFY;

	op2.o_req_dn = *ndn;
	op2.o_req_ndn = *ndn;

	op2.o_callback = &cb;
	op2.o_dn = op->o_bd->be_rootdn;
	op2.o_ndn = op->o_bd->be_rootndn;
	op2.orm_modlist = NULL;

	/* Internal ops, never replicate these */
	op2.o_opid = 0;		/* shared with op, saved above */
	op2.orm_no_opattrs = 1;
	op2.o_dont_replicate = 1;

	if ( !BER_BVISNULL( &mo->mo_ndn ) ) {
		ml = &mod[ mcnt ];
		ml->sml_numvals = 1;
		ml->sml_values = &values[ 0 ];
		ml->sml_values[ 0 ] = mo->mo_dn;
		BER_BVZERO( &ml->sml_values[ 1 ] );
		ml->sml_nvalues = &nvalues[ 0 ];
		ml->sml_nvalues[ 0 ] = mo->mo_ndn;
		BER_BVZERO( &ml->sml_nvalues[ 1 ] );
		ml->sml_desc = slap_schema.si_ad_modifiersName;
		ml->sml_type = ml->sml_desc->ad_cname;
		ml->sml_op = LDAP_MOD_REPLACE;
		ml->sml_flags = SLAP_MOD_INTERNAL;
		ml->sml_next = op2.orm_modlist;
		op2.orm_modlist = ml;

		mcnt++;
	}

	ml = &mod[ mcnt ];
	ml->sml_numvals = 1;
	ml->sml_values = &values[ 2 ];
	BER_BVZERO( &ml->sml_values[ 1 ] );
	ml->sml_nvalues = &nvalues[ 2 ];
	BER_BVZERO( &ml->sml_nvalues[ 1 ] );
	ml->sml_desc = ad;
	ml->sml_type = ml->sml_desc->ad_cname;
	ml->sml_flags = SLAP_MOD_INTERNAL;
	ml->sml_next = op2.orm_modlist;
	op2.orm_modlist = ml;

	if ( new_ndn != NULL ) {
		BackendInfo *bi = op2.o_bd->bd_info;
		OpExtra	oex;

		assert( !BER_BVISNULL( new_dn ) );
		assert( !BER_BVISNULL( new_ndn ) );

		ml = &mod[ mcnt ];
		ml->sml_op = LDAP_MOD_ADD;

		ml->sml_values[ 0 ] = *new_dn;
		ml->sml_nvalues[ 0 ] = *new_ndn;

		oex.oe_key = (void *)&memberof;
		LDAP_SLIST_INSERT_HEAD(&op2.o_extra, &oex, oe_next);
		memberof_set_backend( &op2, op, on );
		(void)op->o_bd->be_modify( &op2, &rs2 );
		op2.o_bd->bd_info = bi;
		LDAP_SLIST_REMOVE(&op2.o_extra, &oex, OpExtra, oe_next);
		if ( rs2.sr_err != LDAP_SUCCESS ) {
			Debug(LDAP_DEBUG_ANY,
			      "%s: memberof_value_modify DN=\"%s\" add %s=\"%s\" failed err=%d\n",
			      op->o_log_prefix, op2.o_req_dn.bv_val,
			      ad->ad_cname.bv_val, new_dn->bv_val, rs2.sr_err );
		}

		assert( op2.orm_modlist == &mod[ mcnt ] );
		assert( mcnt == 0 || op2.orm_modlist->sml_next == &mod[ 0 ] );
		ml = op2.orm_modlist->sml_next;
		if ( mcnt == 1 ) {
			assert( ml == &mod[ 0 ] );
			ml = ml->sml_next;
		}
		if ( ml != NULL ) {
			slap_mods_free( ml, 1 );
		}

		mod[ 0 ].sml_next = NULL;
	}

	if ( old_ndn != NULL ) {
		BackendInfo *bi = op2.o_bd->bd_info;
		OpExtra	oex;

		assert( !BER_BVISNULL( old_dn ) );
		assert( !BER_BVISNULL( old_ndn ) );

		ml = &mod[ mcnt ];
		ml->sml_op = LDAP_MOD_DELETE;

		ml->sml_values[ 0 ] = *old_dn;
		ml->sml_nvalues[ 0 ] = *old_ndn;

		oex.oe_key = (void *)&memberof;
		LDAP_SLIST_INSERT_HEAD(&op2.o_extra, &oex, oe_next);
		memberof_set_backend( &op2, op, on );
		(void)op->o_bd->be_modify( &op2, &rs2 );
		op2.o_bd->bd_info = bi;
		LDAP_SLIST_REMOVE(&op2.o_extra, &oex, OpExtra, oe_next);
		if ( rs2.sr_err != LDAP_SUCCESS ) {
			Debug(LDAP_DEBUG_ANY,
			      "%s: memberof_value_modify DN=\"%s\" delete %s=\"%s\" failed err=%d\n",
			      op->o_log_prefix, op2.o_req_dn.bv_val,
			      ad->ad_cname.bv_val, old_dn->bv_val, rs2.sr_err );
		}

		assert( op2.orm_modlist == &mod[ mcnt ] );
		ml = op2.orm_modlist->sml_next;
		if ( mcnt == 1 ) {
			assert( ml == &mod[ 0 ] );
			ml = ml->sml_next;
		}
		if ( ml != NULL ) {
			slap_mods_free( ml, 1 );
		}
	}
	/* restore original opid */
	op->o_opid = opid;

	/* FIXME: if old_group_ndn doesn't exist, both delete __and__
	 * add will fail; better split in two operations, although
	 * not optimal in terms of performance.  At least it would
	 * move towards self-repairing capabilities. */
}

static int
memberof_cleanup( Operation *op, SlapReply *rs )
{
	slap_callback *sc = op->o_callback;
	memberof_cbinfo_t *mci = sc->sc_private;

	op->o_callback = sc->sc_next;
	if ( mci->memberof )
		ber_bvarray_free_x( mci->memberof, op->o_tmpmemctx );
	if ( mci->member )
		ber_bvarray_free_x( mci->member, op->o_tmpmemctx );
	op->o_tmpfree( sc, op->o_tmpmemctx );
	return 0;
}

static int memberof_res_add( Operation *op, SlapReply *rs );
static int memberof_res_delete( Operation *op, SlapReply *rs );
static int memberof_res_modify( Operation *op, SlapReply *rs );
static int memberof_res_modrdn( Operation *op, SlapReply *rs );

static int
memberof_op_add( Operation *op, SlapReply *rs )
{
	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	Attribute	**ap, **map = NULL;
	int		rc = SLAP_CB_CONTINUE;
	int		i;
	struct berval	save_dn, save_ndn;
	slap_callback *sc;
	memberof_cbinfo_t *mci;
	OpExtra		*oex;

	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
		if ( oex->oe_key == (void *)&memberof )
			return SLAP_CB_CONTINUE;
	}

	if ( op->ora_e->e_attrs == NULL ) {
		/* FIXME: global overlay; need to deal with */
		Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
			"consistency checks not implemented when overlay "
			"is instantiated as global.\n",
			op->o_log_prefix, op->o_req_dn.bv_val );
		return SLAP_CB_CONTINUE;
	}

	if ( MEMBEROF_REVERSE( mo ) ) {
		for ( ap = &op->ora_e->e_attrs; *ap; ap = &(*ap)->a_next ) {
			Attribute	*a = *ap;

			if ( a->a_desc == mo->mo_ad_memberof ) {
				map = ap;
				break;
			}
		}
	}

	save_dn = op->o_dn;
	save_ndn = op->o_ndn;

	if ( MEMBEROF_DANGLING_CHECK( mo )
			&& !get_relax( op )
			&& is_entry_objectclass_or_sub( op->ora_e, mo->mo_oc_group ) )
	{
		op->o_dn = op->o_bd->be_rootdn;
		op->o_ndn = op->o_bd->be_rootndn;
		op->o_bd->bd_info = (BackendInfo *)on->on_info;

		for ( ap = &op->ora_e->e_attrs; *ap; ) {
			Attribute	*a = *ap;

			if ( !is_ad_subtype( a->a_desc, mo->mo_ad_member ) ) {
				ap = &a->a_next;
				continue;
			}

			assert( a->a_nvals != NULL );

			for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
				Entry		*e = NULL;

				/* ITS#6670 Ignore member pointing to this entry */
				if ( dn_match( &a->a_nvals[i], &save_ndn ))
					continue;

				rc = be_entry_get_rw( op, &a->a_nvals[ i ],
						NULL, NULL, 0, &e );
				if ( rc == LDAP_SUCCESS ) {
					be_entry_release_r( op, e );
					continue;
				}

				if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
					rc = rs->sr_err = mo->mo_dangling_err;
					rs->sr_text = "adding non-existing object "
						"as group member";
					send_ldap_result( op, rs );
					goto done;
				}

				if ( MEMBEROF_DANGLING_DROP( mo ) ) {
					int	j;
	
					Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
						"member=\"%s\" does not exist (stripping...)\n",
						op->o_log_prefix, op->ora_e->e_name.bv_val,
						a->a_vals[ i ].bv_val );
	
					for ( j = i + 1; !BER_BVISNULL( &a->a_nvals[ j ] ); j++ );
					ber_memfree( a->a_vals[ i ].bv_val );
					BER_BVZERO( &a->a_vals[ i ] );
					if ( a->a_nvals != a->a_vals ) {
						ber_memfree( a->a_nvals[ i ].bv_val );
						BER_BVZERO( &a->a_nvals[ i ] );
					}
					a->a_numvals--;
					if ( j - i == 1 ) {
						break;
					}
		
					AC_MEMCPY( &a->a_vals[ i ], &a->a_vals[ i + 1 ],
						sizeof( struct berval ) * ( j - i ) );
					if ( a->a_nvals != a->a_vals ) {
						AC_MEMCPY( &a->a_nvals[ i ], &a->a_nvals[ i + 1 ],
							sizeof( struct berval ) * ( j - i ) );
					}
					i--;
				}
			}

			/* If all values have been removed,
			 * remove the attribute itself. */
			if ( BER_BVISNULL( &a->a_nvals[ 0 ] ) ) {
				*ap = a->a_next;
				attr_free( a );
	
			} else {
				ap = &a->a_next;
			}
		}
		op->o_dn = save_dn;
		op->o_ndn = save_ndn;
		op->o_bd->bd_info = (BackendInfo *)on;
	}

	if ( map != NULL ) {
		Attribute		*a = *map;
		AccessControlState	acl_state = ACL_STATE_INIT;

		for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
			Entry		*e;

			op->o_bd->bd_info = (BackendInfo *)on->on_info;
			/* access is checked with the original identity */
			rc = access_allowed( op, op->ora_e, mo->mo_ad_memberof,
					&a->a_nvals[ i ], ACL_WADD,
					&acl_state );
			if ( rc == 0 ) {
				rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
				rs->sr_text = NULL;
				send_ldap_result( op, rs );
				goto done;
			}
			/* ITS#6670 Ignore member pointing to this entry */
			if ( dn_match( &a->a_nvals[i], &save_ndn ))
				continue;

			rc = be_entry_get_rw( op, &a->a_nvals[ i ],
					NULL, NULL, 0, &e );
			op->o_bd->bd_info = (BackendInfo *)on;
			if ( rc != LDAP_SUCCESS ) {
				if ( get_relax( op ) ) {
					continue;
				}

				if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
					rc = rs->sr_err = mo->mo_dangling_err;
					rs->sr_text = "adding non-existing object "
						"as memberof";
					send_ldap_result( op, rs );
					goto done;
				}

				if ( MEMBEROF_DANGLING_DROP( mo ) ) {
					int	j;
	
					Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
						"memberof=\"%s\" does not exist (stripping...)\n",
						op->o_log_prefix, op->ora_e->e_name.bv_val,
						a->a_nvals[ i ].bv_val );
	
					for ( j = i + 1; !BER_BVISNULL( &a->a_nvals[ j ] ); j++ );
					ber_memfree( a->a_vals[ i ].bv_val );
					BER_BVZERO( &a->a_vals[ i ] );
					if ( a->a_nvals != a->a_vals ) {
						ber_memfree( a->a_nvals[ i ].bv_val );
						BER_BVZERO( &a->a_nvals[ i ] );
					}
					if ( j - i == 1 ) {
						break;
					}
		
					AC_MEMCPY( &a->a_vals[ i ], &a->a_vals[ i + 1 ],
						sizeof( struct berval ) * ( j - i ) );
					if ( a->a_nvals != a->a_vals ) {
						AC_MEMCPY( &a->a_nvals[ i ], &a->a_nvals[ i + 1 ],
							sizeof( struct berval ) * ( j - i ) );
					}
					i--;
				}
				
				continue;
			}

			/* access is checked with the original identity */
			op->o_bd->bd_info = (BackendInfo *)on->on_info;
			rc = access_allowed( op, e, mo->mo_ad_member,
					&op->o_req_ndn, ACL_WADD, NULL );
			be_entry_release_r( op, e );
			op->o_bd->bd_info = (BackendInfo *)on;

			if ( !rc ) {
				rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
				rs->sr_text = "insufficient access to object referenced by memberof";
				send_ldap_result( op, rs );
				goto done;
			}
		}

		if ( BER_BVISNULL( &a->a_nvals[ 0 ] ) ) {
			*map = a->a_next;
			attr_free( a );
		}
	}

	rc = SLAP_CB_CONTINUE;

	sc = op->o_tmpalloc( sizeof(slap_callback)+sizeof(*mci), op->o_tmpmemctx );
	sc->sc_private = sc+1;
	sc->sc_response = memberof_res_add;
	sc->sc_cleanup = memberof_cleanup;
	sc->sc_writewait = 0;
	mci = sc->sc_private;
	mci->on = on;
	mci->member = NULL;
	mci->memberof = NULL;
	sc->sc_next = op->o_callback;
	op->o_callback = sc;

done:;
	op->o_dn = save_dn;
	op->o_ndn = save_ndn;
	op->o_bd->bd_info = (BackendInfo *)on;

	return rc;
}

static int
memberof_op_delete( Operation *op, SlapReply *rs )
{
	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	slap_callback *sc;
	memberof_cbinfo_t *mci;
	OpExtra		*oex;

	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
		if ( oex->oe_key == (void *)&memberof )
			return SLAP_CB_CONTINUE;
	}

	sc = op->o_tmpalloc( sizeof(slap_callback)+sizeof(*mci), op->o_tmpmemctx );
	sc->sc_private = sc+1;
	sc->sc_response = memberof_res_delete;
	sc->sc_cleanup = memberof_cleanup;
	sc->sc_writewait = 0;
	mci = sc->sc_private;
	mci->on = on;
	mci->member = NULL;
	mci->memberof = NULL;
	mci->what = MEMBEROF_IS_GROUP;
	if ( MEMBEROF_REFINT( mo ) ) {
		mci->what = MEMBEROF_IS_BOTH;
	}

	memberof_isGroupOrMember( op, mci );

	sc->sc_next = op->o_callback;
	op->o_callback = sc;

	return SLAP_CB_CONTINUE;
}

static int
memberof_op_modify( Operation *op, SlapReply *rs )
{
	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	Modifications	**mlp, **mmlp = NULL;
	int		rc = SLAP_CB_CONTINUE, save_member = 0;
	struct berval	save_dn, save_ndn;
	slap_callback *sc;
	memberof_cbinfo_t *mci, mcis;
	OpExtra		*oex;

	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
		if ( oex->oe_key == (void *)&memberof )
			return SLAP_CB_CONTINUE;
	}

	if ( MEMBEROF_REVERSE( mo ) ) {
		for ( mlp = &op->orm_modlist; *mlp; mlp = &(*mlp)->sml_next ) {
			Modifications	*ml = *mlp;

			if ( ml->sml_desc == mo->mo_ad_memberof ) {
				mmlp = mlp;
				break;
			}
		}
	}

	save_dn = op->o_dn;
	save_ndn = op->o_ndn;
	mcis.on = on;
	mcis.what = MEMBEROF_IS_GROUP;

	if ( memberof_isGroupOrMember( op, &mcis ) == LDAP_SUCCESS
		&& ( mcis.what & MEMBEROF_IS_GROUP ) )
	{
		Modifications *ml;

		for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
			if ( ml->sml_desc == mo->mo_ad_member ) {
				switch ( ml->sml_op ) {
				case LDAP_MOD_DELETE:
				case LDAP_MOD_REPLACE:
				case SLAP_MOD_SOFTDEL: /* ITS#7487: can be used by syncrepl (in mirror mode?) */
					save_member = 1;
					break;
				}
			}
		}


		if ( MEMBEROF_DANGLING_CHECK( mo )
				&& !get_relax( op ) )
		{
			op->o_dn = op->o_bd->be_rootdn;
			op->o_ndn = op->o_bd->be_rootndn;
			op->o_bd->bd_info = (BackendInfo *)on->on_info;
		
			assert( op->orm_modlist != NULL );
		
			for ( mlp = &op->orm_modlist; *mlp; ) {
				Modifications	*ml = *mlp;
				int		i;
		
				if ( !is_ad_subtype( ml->sml_desc, mo->mo_ad_member ) ) {
					mlp = &ml->sml_next;
					continue;
				}
		
				switch ( ml->sml_op ) {
				case LDAP_MOD_DELETE:
				case SLAP_MOD_SOFTDEL: /* ITS#7487: can be used by syncrepl (in mirror mode?) */
					/* we don't care about cancellations: if the value
					 * exists, fine; if it doesn't, we let the underlying
					 * database fail as appropriate; */
					mlp = &ml->sml_next;
					break;
		
				case LDAP_MOD_REPLACE:
 					/* Handle this just like a delete (see above) */
 					if ( !ml->sml_values ) {
 						mlp = &ml->sml_next;
 						break;
 					}
 
				case LDAP_MOD_ADD:
				case SLAP_MOD_SOFTADD: /* ITS#7487 */
				case SLAP_MOD_ADD_IF_NOT_PRESENT: /* ITS#7487 */
					/* NOTE: right now, the attributeType we use
					 * for member must have a normalized value */
					assert( ml->sml_nvalues != NULL );
		
					for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
						Entry		*e;
		
						/* ITS#6670 Ignore member pointing to this entry */
						if ( dn_match( &ml->sml_nvalues[i], &save_ndn ))
							continue;

						if ( be_entry_get_rw( op, &ml->sml_nvalues[ i ],
								NULL, NULL, 0, &e ) == LDAP_SUCCESS )
						{
							be_entry_release_r( op, e );
							continue;
						}
		
						if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
							rc = rs->sr_err = mo->mo_dangling_err;
							rs->sr_text = "adding non-existing object "
								"as group member";
							send_ldap_result( op, rs );
							goto done;
						}
		
						if ( MEMBEROF_DANGLING_DROP( mo ) ) {
							int	j;
		
							Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
								"member=\"%s\" does not exist (stripping...)\n",
								op->o_log_prefix, op->o_req_dn.bv_val,
								ml->sml_nvalues[ i ].bv_val );
		
							for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
							ber_memfree( ml->sml_values[ i ].bv_val );
							BER_BVZERO( &ml->sml_values[ i ] );
							ber_memfree( ml->sml_nvalues[ i ].bv_val );
							BER_BVZERO( &ml->sml_nvalues[ i ] );
							ml->sml_numvals--;
							if ( j - i == 1 ) {
								break;
							}
		
							AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
								sizeof( struct berval ) * ( j - i ) );
							AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
								sizeof( struct berval ) * ( j - i ) );
							i--;
						}
					}
		
					if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
						*mlp = ml->sml_next;
						slap_mod_free( &ml->sml_mod, 0 );
						free( ml );
		
					} else {
						mlp = &ml->sml_next;
					}
		
					break;
		
				default:
					assert( 0 );
				}
			}
		}
	}
	
	if ( mmlp != NULL ) {
		Modifications	*ml = *mmlp;
		int		i;
		Entry		*target;

		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		rc = be_entry_get_rw( op, &op->o_req_ndn,
				NULL, NULL, 0, &target );
		op->o_bd->bd_info = (BackendInfo *)on;
		if ( rc != LDAP_SUCCESS ) {
			rc = rs->sr_err = LDAP_NO_SUCH_OBJECT;
			send_ldap_result( op, rs );
			goto done;
		}

		switch ( ml->sml_op ) {
		case LDAP_MOD_DELETE:
		case SLAP_MOD_SOFTDEL: /* ITS#7487: can be used by syncrepl (in mirror mode?) */
			if ( ml->sml_nvalues != NULL ) {
				AccessControlState	acl_state = ACL_STATE_INIT;

				for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
					Entry		*e;

					op->o_bd->bd_info = (BackendInfo *)on->on_info;
					/* access is checked with the original identity */
					rc = access_allowed( op, target,
							mo->mo_ad_memberof,
							&ml->sml_nvalues[ i ],
							ACL_WDEL,
							&acl_state );
					if ( rc == 0 ) {
						rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
						rs->sr_text = NULL;
						send_ldap_result( op, rs );
						goto done2;
					}

					rc = be_entry_get_rw( op, &ml->sml_nvalues[ i ],
							NULL, NULL, 0, &e );
					op->o_bd->bd_info = (BackendInfo *)on;
					if ( rc != LDAP_SUCCESS ) {
						if ( get_relax( op ) ) {
							continue;
						}

						if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
							rc = rs->sr_err = mo->mo_dangling_err;
							rs->sr_text = "deleting non-existing object "
								"as memberof";
							send_ldap_result( op, rs );
							goto done2;
						}

						if ( MEMBEROF_DANGLING_DROP( mo ) ) {
							int	j;
	
							Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
								"memberof=\"%s\" does not exist (stripping...)\n",
								op->o_log_prefix, op->o_req_ndn.bv_val,
								ml->sml_nvalues[ i ].bv_val );
	
							for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
							ber_memfree( ml->sml_values[ i ].bv_val );
							BER_BVZERO( &ml->sml_values[ i ] );
							if ( ml->sml_nvalues != ml->sml_values ) {
								ber_memfree( ml->sml_nvalues[ i ].bv_val );
								BER_BVZERO( &ml->sml_nvalues[ i ] );
							}
							ml->sml_numvals--;
							if ( j - i == 1 ) {
								break;
							}
		
							AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
								sizeof( struct berval ) * ( j - i ) );
							if ( ml->sml_nvalues != ml->sml_values ) {
								AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
									sizeof( struct berval ) * ( j - i ) );
							}
							i--;
						}

						continue;
					}

					/* access is checked with the original identity */
					op->o_bd->bd_info = (BackendInfo *)on->on_info;
					rc = access_allowed( op, e, mo->mo_ad_member,
							&op->o_req_ndn,
							ACL_WDEL, NULL );
					be_entry_release_r( op, e );
					op->o_bd->bd_info = (BackendInfo *)on;

					if ( !rc ) {
						rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
						rs->sr_text = "insufficient access to object referenced by memberof";
						send_ldap_result( op, rs );
						goto done;
					}
				}

				if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
					*mmlp = ml->sml_next;
					slap_mod_free( &ml->sml_mod, 0 );
					free( ml );
				}

				break;
			}
			/* fall thru */

		case LDAP_MOD_REPLACE:

			op->o_bd->bd_info = (BackendInfo *)on->on_info;
			/* access is checked with the original identity */
			rc = access_allowed( op, target,
					mo->mo_ad_memberof,
					NULL,
					ACL_WDEL, NULL );
			op->o_bd->bd_info = (BackendInfo *)on;
			if ( rc == 0 ) {
				rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
				rs->sr_text = NULL;
				send_ldap_result( op, rs );
				goto done2;
			}

			if ( ml->sml_op == LDAP_MOD_DELETE || ml->sml_op == SLAP_MOD_SOFTDEL || !ml->sml_values ) {
				break;
			}
			/* fall thru */

		case LDAP_MOD_ADD:
		case SLAP_MOD_SOFTADD: /* ITS#7487 */
		case SLAP_MOD_ADD_IF_NOT_PRESENT: /* ITS#7487 */
			{
			AccessControlState	acl_state = ACL_STATE_INIT;

			for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
				Entry		*e;

				op->o_bd->bd_info = (BackendInfo *)on->on_info;
				/* access is checked with the original identity */
				rc = access_allowed( op, target,
						mo->mo_ad_memberof,
						&ml->sml_nvalues[ i ],
						ACL_WADD,
						&acl_state );
				if ( rc == 0 ) {
					rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
					rs->sr_text = NULL;
					send_ldap_result( op, rs );
					goto done2;
				}

				/* ITS#6670 Ignore member pointing to this entry */
				if ( dn_match( &ml->sml_nvalues[i], &save_ndn ))
					continue;

				rc = be_entry_get_rw( op, &ml->sml_nvalues[ i ],
						NULL, NULL, 0, &e );
				op->o_bd->bd_info = (BackendInfo *)on;
				if ( rc != LDAP_SUCCESS ) {
					if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
						rc = rs->sr_err = mo->mo_dangling_err;
						rs->sr_text = "adding non-existing object "
							"as memberof";
						send_ldap_result( op, rs );
						goto done2;
					}

					if ( MEMBEROF_DANGLING_DROP( mo ) ) {
						int	j;

						Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
							"memberof=\"%s\" does not exist (stripping...)\n",
							op->o_log_prefix, op->o_req_ndn.bv_val,
							ml->sml_nvalues[ i ].bv_val );

						for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
						ber_memfree( ml->sml_values[ i ].bv_val );
						BER_BVZERO( &ml->sml_values[ i ] );
						if ( ml->sml_nvalues != ml->sml_values ) {
							ber_memfree( ml->sml_nvalues[ i ].bv_val );
							BER_BVZERO( &ml->sml_nvalues[ i ] );
						}
						ml->sml_numvals--;
						if ( j - i == 1 ) {
							break;
						}
	
						AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
							sizeof( struct berval ) * ( j - i ) );
						if ( ml->sml_nvalues != ml->sml_values ) {
							AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
								sizeof( struct berval ) * ( j - i ) );
						}
						i--;
					}

					continue;
				}

				/* access is checked with the original identity */
				op->o_bd->bd_info = (BackendInfo *)on->on_info;
				rc = access_allowed( op, e, mo->mo_ad_member,
						&op->o_req_ndn,
						ACL_WDEL, NULL );
				be_entry_release_r( op, e );
				op->o_bd->bd_info = (BackendInfo *)on;

				if ( !rc ) {
					rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
					rs->sr_text = "insufficient access to object referenced by memberof";
					send_ldap_result( op, rs );
					goto done;
				}
			}

			if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
				*mmlp = ml->sml_next;
				slap_mod_free( &ml->sml_mod, 0 );
				free( ml );
			}

			} break;

		default:
			assert( 0 );
		}

done2:;
		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		be_entry_release_r( op, target );
		op->o_bd->bd_info = (BackendInfo *)on;
	}

	sc = op->o_tmpalloc( sizeof(slap_callback)+sizeof(*mci), op->o_tmpmemctx );
	sc->sc_private = sc+1;
	sc->sc_response = memberof_res_modify;
	sc->sc_cleanup = memberof_cleanup;
	sc->sc_writewait = 0;
	mci = sc->sc_private;
	mci->on = on;
	mci->member = NULL;
	mci->memberof = NULL;
	mci->what = mcis.what;

	if ( save_member ) {
		op->o_dn = op->o_bd->be_rootdn;
		op->o_ndn = op->o_bd->be_rootndn;
		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		rc = backend_attribute( op, NULL, &op->o_req_ndn,
				mo->mo_ad_member, &mci->member, ACL_READ );
		op->o_bd->bd_info = (BackendInfo *)on;
	}

	sc->sc_next = op->o_callback;
	op->o_callback = sc;

	rc = SLAP_CB_CONTINUE;

done:;
	op->o_dn = save_dn;
	op->o_ndn = save_ndn;
	op->o_bd->bd_info = (BackendInfo *)on;

	return rc;
}

static int
memberof_op_modrdn( Operation *op, SlapReply *rs )
{
	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
	slap_callback *sc;
	memberof_cbinfo_t *mci;
	OpExtra		*oex;

	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
		if ( oex->oe_key == (void *)&memberof )
			return SLAP_CB_CONTINUE;
	}

	sc = op->o_tmpalloc( sizeof(slap_callback)+sizeof(*mci), op->o_tmpmemctx );
	sc->sc_private = sc+1;
	sc->sc_response = memberof_res_modrdn;
	sc->sc_cleanup = memberof_cleanup;
	sc->sc_writewait = 0;
	mci = sc->sc_private;
	mci->on = on;
	mci->member = NULL;
	mci->memberof = NULL;

	sc->sc_next = op->o_callback;
	op->o_callback = sc;

	return SLAP_CB_CONTINUE;
}

/*
 * response callback that adds memberof values when a group is added.
 */
static int
memberof_res_add( Operation *op, SlapReply *rs )
{
	memberof_cbinfo_t *mci = op->o_callback->sc_private;
	slap_overinst	*on = mci->on;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	int		i;

	if ( rs->sr_err != LDAP_SUCCESS ) {
		return SLAP_CB_CONTINUE;
	}

	if ( MEMBEROF_REVERSE( mo ) ) {
		Attribute	*ma;

		ma = attr_find( op->ora_e->e_attrs, mo->mo_ad_memberof );
		if ( ma != NULL ) {
			/* relax is required to allow to add
			 * a non-existing member */
			op->o_relax = SLAP_CONTROL_CRITICAL;

			for ( i = 0; !BER_BVISNULL( &ma->a_nvals[ i ] ); i++ ) {
		
				/* ITS#6670 Ignore member pointing to this entry */
				if ( dn_match( &ma->a_nvals[i], &op->o_req_ndn ))
					continue;

				/* the modification is attempted
				 * with the original identity */
				memberof_value_modify( op,
					&ma->a_nvals[ i ], mo->mo_ad_member,
					NULL, NULL, &op->o_req_dn, &op->o_req_ndn );
			}
		}
	}

	if ( is_entry_objectclass_or_sub( op->ora_e, mo->mo_oc_group ) ) {
		Attribute	*a;

		for ( a = attrs_find( op->ora_e->e_attrs, mo->mo_ad_member );
				a != NULL;
				a = attrs_find( a->a_next, mo->mo_ad_member ) )
		{
			for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
				/* ITS#6670 Ignore member pointing to this entry */
				if ( dn_match( &a->a_nvals[i], &op->o_req_ndn ))
					continue;

				memberof_value_modify( op,
						&a->a_nvals[ i ],
						mo->mo_ad_memberof,
						NULL, NULL,
						&op->o_req_dn,
						&op->o_req_ndn );
			}
		}
	}

	return SLAP_CB_CONTINUE;
}

/*
 * response callback that deletes memberof values when a group is deleted.
 */
static int
memberof_res_delete( Operation *op, SlapReply *rs )
{
	memberof_cbinfo_t *mci = op->o_callback->sc_private;
	slap_overinst	*on = mci->on;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

 	BerVarray	vals;
	int		i;

	if ( rs->sr_err != LDAP_SUCCESS ) {
		return SLAP_CB_CONTINUE;
	}

	vals = mci->member;
	if ( vals != NULL ) {
		for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
			memberof_value_modify( op,
					&vals[ i ], mo->mo_ad_memberof,
					&op->o_req_dn, &op->o_req_ndn,
					NULL, NULL );
		}
	}

	if ( MEMBEROF_REFINT( mo ) ) {
		vals = mci->memberof;
		if ( vals != NULL ) {
			for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
				memberof_value_modify( op,
						&vals[ i ], mo->mo_ad_member,
						&op->o_req_dn, &op->o_req_ndn,
						NULL, NULL );
			}
		}
	}

	return SLAP_CB_CONTINUE;
}

/*
 * response callback that adds/deletes memberof values when a group
 * is modified.
 */
static int
memberof_res_modify( Operation *op, SlapReply *rs )
{
	memberof_cbinfo_t *mci = op->o_callback->sc_private;
	slap_overinst	*on = mci->on;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	int		i, rc;
	Modifications	*ml, *mml = NULL;
	BerVarray	vals;

	if ( rs->sr_err != LDAP_SUCCESS ) {
		return SLAP_CB_CONTINUE;
	}

	if ( MEMBEROF_REVERSE( mo ) ) {
		for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
			if ( ml->sml_desc == mo->mo_ad_memberof ) {
				mml = ml;
				break;
			}
		}
	}

	if ( mml != NULL ) {
		BerVarray	vals = mml->sml_nvalues;

		switch ( mml->sml_op ) {
		case LDAP_MOD_DELETE:
		case SLAP_MOD_SOFTDEL: /* ITS#7487: can be used by syncrepl (in mirror mode?) */
			if ( vals != NULL ) {
				for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
					memberof_value_modify( op,
							&vals[ i ], mo->mo_ad_member,
							&op->o_req_dn, &op->o_req_ndn,
							NULL, NULL );
				}
				break;
			}
			/* fall thru */

		case LDAP_MOD_REPLACE:
			/* delete all ... */
			op->o_bd->bd_info = (BackendInfo *)on->on_info;
			rc = backend_attribute( op, NULL, &op->o_req_ndn,
					mo->mo_ad_memberof, &vals, ACL_READ );
			op->o_bd->bd_info = (BackendInfo *)on;
			if ( rc == LDAP_SUCCESS ) {
				for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
					memberof_value_modify( op,
							&vals[ i ], mo->mo_ad_member,
							&op->o_req_dn, &op->o_req_ndn,
							NULL, NULL );
				}
				ber_bvarray_free_x( vals, op->o_tmpmemctx );
			}

			if ( ml->sml_op == LDAP_MOD_DELETE || !mml->sml_values ) {
				break;
			}
			/* fall thru */

		case LDAP_MOD_ADD:
		case SLAP_MOD_SOFTADD: /* ITS#7487 */
		case SLAP_MOD_ADD_IF_NOT_PRESENT: /* ITS#7487 */
			assert( vals != NULL );

			for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
				memberof_value_modify( op,
						&vals[ i ], mo->mo_ad_member,
						NULL, NULL,
						&op->o_req_dn, &op->o_req_ndn );
			}
			break;

		default:
			assert( 0 );
		}
	}

	if ( mci->what & MEMBEROF_IS_GROUP )
	{
		for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
			if ( ml->sml_desc != mo->mo_ad_member ) {
				continue;
			}

			switch ( ml->sml_op ) {
			case LDAP_MOD_DELETE:
			case SLAP_MOD_SOFTDEL: /* ITS#7487: can be used by syncrepl (in mirror mode?) */
				vals = ml->sml_nvalues;
				if ( vals != NULL ) {
					for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
						memberof_value_modify( op,
								&vals[ i ], mo->mo_ad_memberof,
								&op->o_req_dn, &op->o_req_ndn,
								NULL, NULL );
					}
					break;
				}
				/* fall thru */
	
			case LDAP_MOD_REPLACE:
				vals = mci->member;

				/* delete all ... */
				if ( vals != NULL ) {
					for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
						memberof_value_modify( op,
								&vals[ i ], mo->mo_ad_memberof,
								&op->o_req_dn, &op->o_req_ndn,
								NULL, NULL );
					}
				}
	
				if ( ml->sml_op == LDAP_MOD_DELETE || ml->sml_op == SLAP_MOD_SOFTDEL || !ml->sml_values ) {
					break;
				}
				/* fall thru */
	
			case LDAP_MOD_ADD:
			case SLAP_MOD_SOFTADD: /* ITS#7487 */
			case SLAP_MOD_ADD_IF_NOT_PRESENT : /* ITS#7487 */
				assert( ml->sml_nvalues != NULL );
				vals = ml->sml_nvalues;
				for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
					memberof_value_modify( op,
							&vals[ i ], mo->mo_ad_memberof,
							NULL, NULL,
							&op->o_req_dn, &op->o_req_ndn );
				}
				break;
	
			default:
				assert( 0 );
			}
		}
	}

	return SLAP_CB_CONTINUE;
}

/*
 * response callback that adds/deletes member values when a group member
 * is renamed.
 */
static int
memberof_res_modrdn( Operation *op, SlapReply *rs )
{
	memberof_cbinfo_t *mci = op->o_callback->sc_private;
	slap_overinst	*on = mci->on;
	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;

	struct berval	newPDN, newDN = BER_BVNULL, newPNDN, newNDN;
	int		i, rc;
	BerVarray	vals;

	struct berval	save_dn, save_ndn;

	if ( rs->sr_err != LDAP_SUCCESS ) {
		return SLAP_CB_CONTINUE;
	}

	mci->what = MEMBEROF_IS_GROUP;
	if ( MEMBEROF_REFINT( mo ) ) {
		mci->what |= MEMBEROF_IS_MEMBER;
	}

	if ( op->orr_nnewSup ) {
		newPNDN = *op->orr_nnewSup;

	} else {
		dnParent( &op->o_req_ndn, &newPNDN );
	}

	build_new_dn( &newNDN, &newPNDN, &op->orr_nnewrdn, op->o_tmpmemctx ); 

	save_dn = op->o_req_dn;
	save_ndn = op->o_req_ndn;

	op->o_req_dn = newNDN;
	op->o_req_ndn = newNDN;
	rc = memberof_isGroupOrMember( op, mci );
	op->o_req_dn = save_dn;
	op->o_req_ndn = save_ndn;

	if ( rc != LDAP_SUCCESS || mci->what == MEMBEROF_IS_NONE ) {
		goto done;
	}

	if ( op->orr_newSup ) {
		newPDN = *op->orr_newSup;

	} else {
		dnParent( &op->o_req_dn, &newPDN );
	}

	build_new_dn( &newDN, &newPDN, &op->orr_newrdn, op->o_tmpmemctx ); 

	if ( mci->what & MEMBEROF_IS_GROUP ) {
		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		rc = backend_attribute( op, NULL, &newNDN,
				mo->mo_ad_member, &vals, ACL_READ );
		op->o_bd->bd_info = (BackendInfo *)on;

		if ( rc == LDAP_SUCCESS ) {
			for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
				memberof_value_modify( op,
						&vals[ i ], mo->mo_ad_memberof,
						&op->o_req_dn, &op->o_req_ndn,
						&newDN, &newNDN );
			}
			ber_bvarray_free_x( vals, op->o_tmpmemctx );
		}
	}

	if ( MEMBEROF_REFINT( mo ) && ( mci->what & MEMBEROF_IS_MEMBER ) ) {
		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		rc = backend_attribute( op, NULL, &newNDN,
				mo->mo_ad_memberof, &vals, ACL_READ );
		op->o_bd->bd_info = (BackendInfo *)on;

		if ( rc == LDAP_SUCCESS ) {
			for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
				memberof_value_modify( op,
						&vals[ i ], mo->mo_ad_member,
						&op->o_req_dn, &op->o_req_ndn,
						&newDN, &newNDN );
			}
			ber_bvarray_free_x( vals, op->o_tmpmemctx );
		}
	}

done:;
	if ( !BER_BVISNULL( &newDN ) ) {
		op->o_tmpfree( newDN.bv_val, op->o_tmpmemctx );
	}
	op->o_tmpfree( newNDN.bv_val, op->o_tmpmemctx );

	return SLAP_CB_CONTINUE;
}


static int
memberof_db_init(
	BackendDB	*be,
	ConfigReply	*cr )
{
	slap_overinst	*on = (slap_overinst *)be->bd_info;