Imported Upstream version 4.6.2

daemons/ipa-slapi-plugins/Makefile.am

@@ -0,0 +1,27 @@
+NULL =
+
+SUBDIRS =			\
+	libotp			\
+	ipa-cldap		\
+	ipa-dns			\
+	ipa-enrollment		\
+	ipa-lockout		\
+	ipa-modrdn		\
+	ipa-otp-counter		\
+	ipa-otp-lasttoken	\
+	ipa-pwd-extop		\
+	ipa-extdom-extop	\
+	ipa-uuid		\
+	ipa-version		\
+	ipa-winsync		\
+	ipa-sidgen		\
+	ipa-range-check		\
+	topology		\
+	$(NULL)
+
+noinst_HEADERS =		\
+	common/util.h
+
+EXTRA_DIST =			\
+	README			\
+	$(NULL)

daemons/ipa-slapi-plugins/Makefile.in

@@ -0,0 +1,757 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \
+	$(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+SOURCES =
+DIST_SOURCES =
+RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
+	ctags-recursive dvi-recursive html-recursive info-recursive \
+	install-data-recursive install-dvi-recursive \
+	install-exec-recursive install-html-recursive \
+	install-info-recursive install-pdf-recursive \
+	install-ps-recursive install-recursive installcheck-recursive \
+	installdirs-recursive pdf-recursive ps-recursive \
+	tags-recursive uninstall-recursive
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+HEADERS = $(noinst_HEADERS)
+RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive	\
+  distclean-recursive maintainer-clean-recursive
+am__recursive_targets = \
+  $(RECURSIVE_TARGETS) \
+  $(RECURSIVE_CLEAN_TARGETS) \
+  $(am__extra_recursive_targets)
+AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
+	distdir
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+DIST_SUBDIRS = $(SUBDIRS)
+am__DIST_COMMON = $(srcdir)/Makefile.in README
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+am__relativize = \
+  dir0=`pwd`; \
+  sed_first='s,^\([^/]*\)/.*$$,\1,'; \
+  sed_rest='s,^[^/]*/*,,'; \
+  sed_last='s,^.*/\([^/]*\)$$,\1,'; \
+  sed_butlast='s,/*[^/]*$$,,'; \
+  while test -n "$$dir1"; do \
+    first=`echo "$$dir1" | sed -e "$$sed_first"`; \
+    if test "$$first" != "."; then \
+      if test "$$first" = ".."; then \
+        dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
+        dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
+      else \
+        first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
+        if test "$$first2" = "$$first"; then \
+          dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
+        else \
+          dir2="../$$dir2"; \
+        fi; \
+        dir0="$$dir0"/"$$first"; \
+      fi; \
+    fi; \
+    dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
+  done; \
+  reldir="$$dir2"
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+SUBDIRS = \
+	libotp			\
+	ipa-cldap		\
+	ipa-dns			\
+	ipa-enrollment		\
+	ipa-lockout		\
+	ipa-modrdn		\
+	ipa-otp-counter		\
+	ipa-otp-lasttoken	\
+	ipa-pwd-extop		\
+	ipa-extdom-extop	\
+	ipa-uuid		\
+	ipa-version		\
+	ipa-winsync		\
+	ipa-sidgen		\
+	ipa-range-check		\
+	topology		\
+	$(NULL)
+
+noinst_HEADERS = \
+	common/util.h
+
+EXTRA_DIST = \
+	README			\
+	$(NULL)
+
+all: all-recursive
+
+.SUFFIXES:
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+
+# This directory's subdirectories are mostly independent; you can cd
+# into them and run 'make' without going through this Makefile.
+# To change the values of 'make' variables: instead of editing Makefiles,
+# (1) if the variable is set in 'config.status', edit 'config.status'
+#     (which will cause the Makefiles to be regenerated when you run 'make');
+# (2) otherwise, pass the desired values on the 'make' command line.
+$(am__recursive_targets):
+	@fail=; \
+	if $(am__make_keepgoing); then \
+	  failcom='fail=yes'; \
+	else \
+	  failcom='exit 1'; \
+	fi; \
+	dot_seen=no; \
+	target=`echo $@ | sed s/-recursive//`; \
+	case "$@" in \
+	  distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
+	  *) list='$(SUBDIRS)' ;; \
+	esac; \
+	for subdir in $$list; do \
+	  echo "Making $$target in $$subdir"; \
+	  if test "$$subdir" = "."; then \
+	    dot_seen=yes; \
+	    local_target="$$target-am"; \
+	  else \
+	    local_target="$$target"; \
+	  fi; \
+	  ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+	  || eval $$failcom; \
+	done; \
+	if test "$$dot_seen" = "no"; then \
+	  $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
+	fi; test -z "$$fail"
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-recursive
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
+	  include_option=--etags-include; \
+	  empty_fix=.; \
+	else \
+	  include_option=--include; \
+	  empty_fix=; \
+	fi; \
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    test ! -f $$subdir/TAGS || \
+	      set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
+	  fi; \
+	done; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-recursive
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-recursive
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+	@list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    $(am__make_dryrun) \
+	      || test -d "$(distdir)/$$subdir" \
+	      || $(MKDIR_P) "$(distdir)/$$subdir" \
+	      || exit 1; \
+	    dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
+	    $(am__relativize); \
+	    new_distdir=$$reldir; \
+	    dir1=$$subdir; dir2="$(top_distdir)"; \
+	    $(am__relativize); \
+	    new_top_distdir=$$reldir; \
+	    echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
+	    echo "     am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
+	    ($(am__cd) $$subdir && \
+	      $(MAKE) $(AM_MAKEFLAGS) \
+	        top_distdir="$$new_top_distdir" \
+	        distdir="$$new_distdir" \
+		am__remove_distdir=: \
+		am__skip_length_check=: \
+		am__skip_mode_fix=: \
+	        distdir) \
+	      || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-recursive
+all-am: Makefile $(HEADERS)
+installdirs: installdirs-recursive
+installdirs-am:
+install: install-recursive
+install-exec: install-exec-recursive
+install-data: install-data-recursive
+uninstall: uninstall-recursive
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-recursive
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-recursive
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-recursive
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic distclean-tags
+
+dvi: dvi-recursive
+
+dvi-am:
+
+html: html-recursive
+
+html-am:
+
+info: info-recursive
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-recursive
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-recursive
+
+install-html-am:
+
+install-info: install-info-recursive
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-recursive
+
+install-pdf-am:
+
+install-ps: install-ps-recursive
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-recursive
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-recursive
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-recursive
+
+pdf-am:
+
+ps: ps-recursive
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: $(am__recursive_targets) install-am install-strip
+
+.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
+	check-am clean clean-generic clean-libtool cscopelist-am ctags \
+	ctags-am distclean distclean-generic distclean-libtool \
+	distclean-tags distdir dvi dvi-am html html-am info info-am \
+	install install-am install-data install-data-am install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am install-man \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-strip installcheck installcheck-am installdirs \
+	installdirs-am maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
+	ps ps-am tags tags-am uninstall uninstall-am
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/common/util.h

@@ -0,0 +1,73 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Copyright (C) 2010 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#define EOK 0
+#define EFAIL -1
+
+#include <stdint.h>
+#ifndef discard_const
+#define discard_const(ptr) ((void *)((uintptr_t)(ptr)))
+#endif
+
+#define log_func discard_const(__func__)
+
+#define LOG_PLUGIN_NAME(NAME, fmt, ...) \
+    slapi_log_error(SLAPI_LOG_PLUGIN, \
+                    NAME, \
+                    fmt, ##__VA_ARGS__)
+
+#define LOG(fmt, ...) \
+    LOG_PLUGIN_NAME(IPA_PLUGIN_NAME, fmt, ##__VA_ARGS__)
+
+#define LOG_CONFIG_NAME(NAME, fmt, ...) \
+    slapi_log_error(SLAPI_LOG_CONFIG, \
+                    NAME, \
+                    fmt, ##__VA_ARGS__)
+
+#define LOG_CONFIG(fmt, ...) \
+    LOG_CONFIG_NAME(IPA_PLUGIN_NAME, fmt, ##__VA_ARGS__)
+
+#define LOG_FATAL(fmt, ...) \
+    slapi_log_error(SLAPI_LOG_FATAL, log_func, \
+                    "[file %s, line %d]: " fmt, \
+                    __FILE__, __LINE__, ##__VA_ARGS__)
+
+#define LOG_TRACE(fmt, ...) \
+    slapi_log_error(SLAPI_LOG_TRACE, log_func, fmt, ##__VA_ARGS__)
+
+#define LOG_OOM() LOG_FATAL("Out of Memory!\n")

daemons/ipa-slapi-plugins/ipa-cldap/Makefile.am

@@ -0,0 +1,64 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NDRNBT_CFLAGS)					\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 			\
+	libipa_cldap.la			\
+	$(NULL)
+
+libipa_cldap_la_SOURCES = 		\
+	ipa_cldap_netlogon.c		\
+	ipa_cldap_worker.c		\
+	ipa_cldap.c			\
+	ipa_cldap.h			\
+	$(NULL)
+
+libipa_cldap_la_LDFLAGS = -avoid-version
+
+libipa_cldap_la_LIBADD = 		\
+	$(LDAP_LIBS)			\
+	$(NDRNBT_LIBS)			\
+	$(NULL)
+
+if HAVE_CMOCKA
+TESTS = ipa_cldap_tests
+check_PROGRAMS = ipa_cldap_tests
+endif
+
+ipa_cldap_tests_SOURCES =	\
+	ipa_cldap_tests.c	\
+	ipa_cldap_netlogon.c	\
+	$(NULL)
+ipa_cldap_tests_CFLAGS = $(CMOCKA_FLAGS)
+ipa_cldap_tests_LDFLAGS =	\
+	-rpath $(shell pkg-config --libs-only-L dirsrv | sed -e 's/-L//')	\
+	$(NULL)
+ipa_cldap_tests_LDADD =	\
+	$(CMOCKA_LIBS)	\
+	$(NDRNBT_LIBS)	\
+	$(DIRSRV_LIBS)	\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	ipa-cldap-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-cldap/ipa-cldap-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=ipa_cldap,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: ipa_cldap
+nsslapd-pluginpath: libipa_cldap
+nsslapd-plugininitfunc: ipa_cldap_init
+nsslapd-plugintype: postoperation
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_cldap_init
+nsslapd-pluginversion: @PACKAGE_VERSION@
+nsslapd-pluginvendor: RedHat
+nsslapd-plugindescription: CLDAP Server to interoperate with AD
+nsslapd-plugin-depends-on-type: database
+nsslapd-basedn: $SUFFIX

daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.c

@@ -0,0 +1,243 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "ipa_cldap.h"
+#include "util.h"
+
+Slapi_PluginDesc ipa_cldap_desc = {
+    IPA_CLDAP_PLUGIN_NAME,
+    "FreeIPA project",
+    "FreeIPA/3.0",
+    IPA_CLDAP_PLUGIN_DESC
+};
+
+static int ipa_cldap_start(Slapi_PBlock *pb)
+{
+    struct ipa_cldap_ctx *ctx;
+    int ret;
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret) {
+        LOG_FATAL("No plugin context ?!\n");
+        return -1;
+    }
+
+    ret = pthread_create(&ctx->tid, NULL, ipa_cldap_worker, ctx);
+    if (ret) {
+        LOG_FATAL("Failed to create worker thread\n");
+        return -1;
+    }
+
+    LOG("Plugin statrup completed.\n");
+
+    return 0;
+}
+
+static int ipa_cldap_stop(Slapi_PBlock *pb)
+{
+    struct ipa_cldap_ctx *ctx;
+    void *retval;
+    int ret;
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret) {
+        LOG_FATAL("No plugin context ?!\n");
+        return -1;
+    }
+
+    /* send stop signal to terminate worker thread */
+    do {
+        ret = write(ctx->stopfd[1], "", 1);
+    } while (ret == -1 && errno == EINTR);
+    close(ctx->stopfd[1]);
+
+    ret = pthread_join(ctx->tid, &retval);
+    if (ret) {
+        LOG_FATAL("Failed to stop worker thread\n");
+        return -1;
+    }
+
+    LOG("Plugin shutdown completed.\n");
+
+    return 0;
+}
+
+static int ipa_cldap_init_service(Slapi_PBlock *pb,
+                                  struct ipa_cldap_ctx **cldap_ctx)
+{
+    struct ipa_cldap_ctx *ctx;
+    struct sockaddr_in6 addr;
+    Slapi_Entry *e;
+    int flags;
+    int val;
+    int ret;
+
+    ctx = calloc(1, sizeof(struct ipa_cldap_ctx));
+    if (!ctx) {
+        return ENOMEM;
+    }
+    ctx->sd = -1;
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ctx->plugin_id);
+    if ((ret != 0) || (NULL == ctx->plugin_id)) {
+        LOG_FATAL("Could not get identity or identity was NULL\n");
+        if (ret == 0) {
+            ret = -1;
+        }
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &e);
+    if (!e) {
+        LOG_FATAL("Plugin configuration not found!\n");
+        ret = -1;
+        goto done;
+    }
+
+    ctx->base_dn = slapi_entry_attr_get_charptr(e, "nsslapd-basedn");
+    if (!ctx->base_dn) {
+        LOG_FATAL("Plugin configuration not found!\n");
+        ret = -1;
+        goto done;
+    }
+
+    /* create a stop pipe so the main DS thread can interrupt the poll()
+     * of the worker thread at any time and cause the worker thread to
+     * immediately exit without waiting for timeouts or such */
+    ret = pipe(ctx->stopfd);
+    if (ret != 0) {
+        LOG_FATAL("Failed to stop pipe\n");
+        ret = EIO;
+        goto done;
+    }
+
+    ctx->sd = socket(PF_INET6, SOCK_DGRAM, 0);
+    if (ctx->sd == -1) {
+        LOG_FATAL("Failed to create IPv6 socket: IPv6 support in kernel "
+                  "is required\n");
+        ret = EIO;
+        goto done;
+    }
+
+    val = 1;
+    ret = setsockopt(ctx->sd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
+    if (ret == -1) {
+        ret = errno;
+        LOG("Failed to make socket immediately reusable (%d, %s)\n",
+            ret, strerror(ret));
+    }
+
+    memset(&addr, 0, sizeof(addr));
+    addr.sin6_family = AF_INET6;
+    addr.sin6_port = htons(CLDAP_PORT);
+
+    ret = bind(ctx->sd, (struct sockaddr *)&addr, sizeof(addr));
+    if (ret == -1) {
+        ret = errno;
+        LOG_FATAL("Failed to bind socket (%d, %s)\n", ret, strerror(ret));
+        goto done;
+    }
+
+    flags = fcntl(ctx->sd, F_GETFL);
+    if ((flags & O_NONBLOCK) == 0) {
+        ret = fcntl(ctx->sd, F_SETFL, flags | O_NONBLOCK);
+        if (ret == -1) {
+            ret = errno;
+            LOG_FATAL("Failed to set socket to non-blocking\n");
+            goto done;
+        }
+    }
+
+done:
+    if (ret) {
+        if (ctx->sd != -1) {
+            close(ctx->sd);
+        }
+        free(ctx);
+    } else {
+        *cldap_ctx = ctx;
+    }
+    return ret;
+}
+
+static int ipa_cldap_post_init(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+/* Initialization function */
+int ipa_cldap_init(Slapi_PBlock *pb)
+{
+    struct ipa_cldap_ctx *cldap_ctx = NULL;
+    int ret;
+
+    ret = ipa_cldap_init_service(pb, &cldap_ctx);
+    if (ret) {
+        LOG_FATAL("Failed to initialize CLDAP Plugin\n");
+        /* do not cause DS to stop, simply do nothing */
+        return 0;
+    }
+
+    /* Register the plug-in */
+    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03);
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, &ipa_cldap_desc);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, &ipa_cldap_start);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, &ipa_cldap_stop);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, cldap_ctx);
+    }
+    if (ret) {
+        LOG_FATAL("Failed to initialize plug-in\n" );
+        return -1;
+    }
+
+    slapi_register_plugin("postoperation", 1,
+                          "ipa_cldap_post_init",
+                          ipa_cldap_post_init,
+                          "CLDAP post ops", NULL,
+                          cldap_ctx->plugin_id);
+
+    return 0;
+}

daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.h

@@ -0,0 +1,109 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <pthread.h>
+#include <dirsrv/slapi-plugin.h>
+#include <talloc.h>
+#include "util.h"
+
+#define IPA_CLDAP_PLUGIN_NAME "CLDAP Server"
+#define IPA_CLDAP_PLUGIN_DESC "MS/AD introperable CLDAP server"
+
+#define IPA_PLUGIN_NAME IPA_CLDAP_PLUGIN_NAME
+#define CLDAP_PORT 389
+#define MAX_DG_SIZE 4096
+#define NETBIOS_NAME_MAX 15
+
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 64
+#endif
+
+struct ipa_cldap_ctx {
+    Slapi_ComponentId *plugin_id;
+    pthread_t tid;
+    char *base_dn;
+    int stopfd[2];
+    int sd;
+};
+
+struct kvp {
+    struct berval attr;
+    struct berval value;
+};
+
+struct kvp_list {
+    struct kvp *pairs;
+    int allocated;
+    int top;
+};
+
+struct ipa_cldap_req {
+    int fd;
+
+    struct sockaddr_storage ss;
+    socklen_t ss_len;
+
+    char dgram[MAX_DG_SIZE];
+    size_t dgsize;
+
+    ber_int_t id;
+
+    /* filter members */
+    struct kvp_list kvps;
+};
+
+/*void *ipa_cldap_worker(struct ipa_cldap_ctx *ctx);*/
+void *ipa_cldap_worker(void *arg);
+
+int ipa_cldap_netlogon(struct ipa_cldap_ctx *ctx,
+                       struct ipa_cldap_req *req,
+                       struct berval *reply);
+
+char *make_netbios_name(TALLOC_CTX *mem_ctx, const char *s);

daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_netlogon.c

@@ -0,0 +1,366 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "ipa_cldap.h"
+#include <endian.h>
+#include <talloc.h>
+#include <ctype.h>
+#include "gen_ndr/ndr_nbt.h"
+#include "gen_ndr/netlogon.h"
+
+static int string_to_guid(char *str, struct GUID *guid)
+{
+    unsigned int time_low;
+    unsigned int time_mid;
+    unsigned int time_hi;
+    unsigned int seq[2];
+    unsigned int node[6];
+    int ret;
+
+    ret = sscanf(str, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+                 &time_low, &time_mid, &time_hi, &seq[0], &seq[1],
+                 &node[0], &node[1], &node[2], &node[3], &node[4], &node[5]);
+    if (ret != 11) {
+        return EINVAL;
+    }
+
+    guid->time_low = time_low;
+    guid->time_mid = time_mid;
+    guid->time_hi_and_version = time_hi;
+    guid->clock_seq[0] = seq[0];
+    guid->clock_seq[1] = seq[1];
+    guid->node[0] = node[0];
+    guid->node[1] = node[1];
+    guid->node[2] = node[2];
+    guid->node[3] = node[3];
+    guid->node[4] = node[4];
+    guid->node[5] = node[5];
+
+    return 0;
+}
+
+static int ipa_cldap_get_domain_entry(struct ipa_cldap_ctx *ctx,
+                                      char **domain,
+                                      char **guid, char **sid, char **name)
+{
+    Slapi_PBlock *pb;
+    Slapi_Entry **e = NULL;
+    const char *filter = "objectclass=ipaNTDomainAttrs";
+    int ret;
+
+    pb = slapi_pblock_new();
+    if (!pb) {
+        return ENOMEM;
+    }
+
+    slapi_search_internal_set_pb(pb, ctx->base_dn,
+                                 LDAP_SCOPE_SUBTREE, filter,
+                                 NULL, 0, NULL, NULL, ctx->plugin_id, 0);
+
+    slapi_search_internal_pb(pb);
+    slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret);
+
+    if (ret) {
+        ret = ENOENT;
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &e);
+    if (!e || !e[0] || e[1]) {
+        /* no matches or too many matches */
+        ret = ENOENT;
+        goto done;
+    }
+
+    *guid = slapi_entry_attr_get_charptr(e[0], "ipaNTDomainGUID");
+    *sid = slapi_entry_attr_get_charptr(e[0], "ipaNTSecurityIdentifier");
+    *name = slapi_entry_attr_get_charptr(e[0], "ipaNTFlatName");
+    *domain = slapi_entry_attr_get_charptr(e[0], "cn");
+
+    ret = 0;
+
+done:
+    slapi_free_search_results_internal(pb);
+    slapi_pblock_destroy(pb);
+    return ret;
+}
+
+char *make_netbios_name(TALLOC_CTX *mem_ctx, const char *s)
+{
+    char *nb_name;
+    const char *p;
+    size_t c = 0;
+
+    if (s == NULL) {
+        return NULL;
+    }
+
+    nb_name = talloc_zero_size(mem_ctx, NETBIOS_NAME_MAX + 1);
+    if (nb_name == NULL) {
+        return NULL;
+    }
+
+    for (p = s; *p && c < NETBIOS_NAME_MAX; p++) {
+        /* Create the NetBIOS name from the first segment of the hostname */
+        if (*p == '.') {
+            break;
+        } else if (isalnum(*p)) {
+            nb_name[c++] = toupper(*p);
+        }
+    }
+
+    if (*nb_name == '\0') {
+        talloc_free(nb_name);
+        return NULL;
+    }
+
+    return nb_name;
+}
+
+#define NETLOGON_SAM_LOGON_RESPONSE_EX_pusher \
+            (ndr_push_flags_fn_t)ndr_push_NETLOGON_SAM_LOGON_RESPONSE_EX_with_flags
+
+static int ipa_cldap_encode_netlogon(char *fq_hostname, char *domain,
+                                     char *guid, char *sid, char *name,
+                                     uint32_t ntver, struct berval *reply)
+{
+    struct NETLOGON_SAM_LOGON_RESPONSE_EX *nlr;
+    enum ndr_err_code ndr_err;
+    DATA_BLOB blob;
+    int ret;
+
+    nlr = talloc_zero(NULL, struct NETLOGON_SAM_LOGON_RESPONSE_EX);
+    if (!nlr) {
+        return ENOMEM;
+    }
+
+    if (!(ntver & (NETLOGON_NT_VERSION_5EX|NETLOGON_NT_VERSION_5EX_WITH_IP))) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    nlr->command = LOGON_SAM_LOGON_RESPONSE_EX;
+    /* nlr->sbz */
+    nlr->server_type = DS_SERVER_PDC |
+                        DS_SERVER_GC |
+                        DS_SERVER_LDAP |
+                        DS_SERVER_DS |
+                        DS_SERVER_KDC |
+                        DS_SERVER_TIMESERV |
+                        DS_SERVER_CLOSEST |
+                        DS_SERVER_WRITABLE |
+                        DS_SERVER_GOOD_TIMESERV;
+    string_to_guid(guid, &nlr->domain_uuid);
+    nlr->forest = domain;
+    nlr->dns_domain = domain;
+    nlr->pdc_dns_name = fq_hostname;
+    nlr->domain_name = name;
+
+    nlr->pdc_name = make_netbios_name(nlr, fq_hostname);
+    nlr->user_name = "";
+    nlr->server_site = "Default-First-Site-Name";
+    nlr->client_site = "Default-First-Site-Name";
+    /* nlr->sockaddr_size (filled in by ndr_push) */
+
+    nlr->nt_version = NETLOGON_NT_VERSION_5EX|NETLOGON_NT_VERSION_1;
+    if (ntver & NETLOGON_NT_VERSION_5EX_WITH_IP) {
+        nlr->nt_version |= NETLOGON_NT_VERSION_5EX_WITH_IP;
+        nlr->sockaddr.sockaddr_family = 2;
+        nlr->sockaddr.pdc_ip = "127.0.0.1";
+        nlr->sockaddr.remaining.length = 8;
+        nlr->sockaddr.remaining.data = talloc_zero_size(nlr, 8);
+    }
+
+    /* nlr->next_closest_site */
+    nlr->lmnt_token = 0xFFFF;
+    nlr->lm20_token = 0xFFFF;
+
+    ndr_err = ndr_push_struct_blob(&blob, nlr, nlr,
+                                   NETLOGON_SAM_LOGON_RESPONSE_EX_pusher);
+    if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        ret = EFAULT;
+        goto done;
+    }
+
+    reply->bv_val = malloc(blob.length);
+    if (!reply->bv_val) {
+        ret = ENOMEM;
+        goto done;
+    }
+    memcpy(reply->bv_val, blob.data, blob.length);
+    reply->bv_len = blob.length;
+    ret = 0;
+
+done:
+    talloc_free(nlr);
+    return ret;
+}
+
+int ipa_cldap_netlogon(struct ipa_cldap_ctx *ctx,
+                       struct ipa_cldap_req *req,
+                       struct berval *reply)
+{
+    char hostname[MAXHOSTNAMELEN + 1]; /* NOTE: lenght hardcoded in kernel */
+    char *domain = NULL;
+    char *our_domain = NULL;
+    char *guid = NULL;
+    char *sid = NULL;
+    char *name = NULL;
+    uint32_t ntver = 0;
+    uint32_t t;
+    char *dot;
+    int ret;
+    int len;
+    int i;
+
+    /* determine request type */
+
+    for (i = 0; i < req->kvps.top; i++) {
+        if (strncasecmp("DnsDomain",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* remove trailing dot if any */
+            len = req->kvps.pairs[i].value.bv_len;
+            if (req->kvps.pairs[i].value.bv_val[len-1] == '.') {
+                len--;
+            }
+            domain = strndup(req->kvps.pairs[i].value.bv_val, len);
+            if (!domain) {
+                ret = ENOMEM;
+                goto done;
+            }
+            continue;
+        }
+        if (strncasecmp("Host",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* we ignore Host for now */
+            continue;
+        }
+        if (strncasecmp("DomainGUID",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* we ignore DomainGUID for now */
+            continue;
+        }
+        if (strncasecmp("DomainSID",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* we ignore DomainSID for now */
+            continue;
+        }
+        if (strncasecmp("User",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* we ignore User for now */
+            continue;
+        }
+        if (strncasecmp("AAC",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            /* we ignore AAC for now */
+            continue;
+        }
+        if (strncasecmp("NTver",
+                        req->kvps.pairs[i].attr.bv_val,
+                        req->kvps.pairs[i].attr.bv_len) == 0) {
+            if (req->kvps.pairs[i].value.bv_len != 4) {
+                ret = EINVAL;
+                goto done;
+            }
+            memcpy(&t, req->kvps.pairs[i].value.bv_val, 4);
+            ntver = le32toh(t);
+            continue;
+        }
+        LOG_TRACE("Unknown filter attribute: %s\n",
+                  req->kvps.pairs[i].attr.bv_val);
+    }
+
+    if (!ntver) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = gethostname(hostname, MAXHOSTNAMELEN);
+    if (ret == -1) {
+        ret = errno;
+        goto done;
+    }
+    /* Make double sure it is terminated */
+    hostname[MAXHOSTNAMELEN] = '\0';
+    dot = strchr(hostname, '.');
+    if (!dot) {
+        /* this name is not fully qualified, therefore invalid */
+        ret = EINVAL;
+        goto done;
+    }
+
+    /* FIXME: we support only NETLOGON_NT_VERSION_5EX for now */
+    if (!(ntver & NETLOGON_NT_VERSION_5EX)) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = ipa_cldap_get_domain_entry(ctx, &our_domain, &guid, &sid, &name);
+    if (ret) {
+        goto done;
+    }
+
+    /* If a domain is provided, check it is our own.
+     * If no domain is provided the client is asking for our own domain. */
+    if (domain) {
+        ret = strcasecmp(domain, our_domain);
+        if (ret != 0) {
+            ret = EINVAL;
+            goto done;
+        }
+    }
+
+    ret = ipa_cldap_encode_netlogon(hostname, our_domain,
+                                    guid, sid, name,
+                                    ntver, reply);
+
+done:
+    free(domain);
+    slapi_ch_free_string(&our_domain);
+    slapi_ch_free_string(&guid);
+    slapi_ch_free_string(&sid);
+    slapi_ch_free_string(&name);
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_tests.c

@@ -0,0 +1,68 @@
+/*
+    Authors:
+        Sumit Bose <sbose@redhat.com>
+
+    Copyright (C) 2014 Red Hat
+
+    Tests for FreeIPA CLDAP plugin
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include "ipa_cldap.h"
+
+void test_make_netbios_name(void **state)
+{
+    char *r;
+    size_t c;
+
+    struct test_data {
+        char *i;
+        char *o;
+    } d[] = {
+        {"abc", "ABC"},
+        {"long-host-name-12345", "LONGHOSTNAME123"},
+        {"abc.def.123", "ABC"},
+        {"####", NULL},
+        {NULL, NULL}
+    };
+
+    r = make_netbios_name(NULL, NULL);
+    assert_null(r);
+
+    for (c = 0; d[c].i != NULL; c++) {
+        r = make_netbios_name(NULL, d[c].i);
+        if (d[c].o != NULL) {
+            assert_string_equal(r, d[c].o);
+        } else {
+            assert_null(r);
+        }
+    }
+}
+
+int main(int argc, const char *argv[])
+{
+
+    const struct CMUnitTest tests[] = {
+        cmocka_unit_test(test_make_netbios_name),
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}
+

daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c

@@ -0,0 +1,363 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "ipa_cldap.h"
+#include <poll.h>
+#include <lber.h>
+
+/* pre allocate some space for answers, default to increment 3 at a time */
+static int ipa_cldap_more_kvps(struct kvp_list *kvps)
+{
+    struct kvp *pairs;
+
+    if (kvps->allocated - kvps->top > 0) {
+        return 0;
+    }
+
+    pairs = realloc(kvps->pairs, (kvps->allocated + 3) * sizeof(struct kvp));
+    if (!pairs) {
+        return ENOMEM;
+    }
+    kvps->pairs = pairs;
+    kvps->allocated += 3;
+
+    return 0;
+}
+
+static void ipa_cldap_free_kvps(struct kvp_list *kvps)
+{
+    free(kvps->pairs);
+    kvps->pairs = NULL;
+    kvps->allocated = 0;
+    kvps->top = 0;
+}
+
+static int ipa_cldap_get_kvp(BerElement *be, struct kvp_list *kvps)
+{
+    ber_tag_t tag;
+    int ret;
+
+    ret = ipa_cldap_more_kvps(kvps);
+    if (ret) {
+        return ret;
+    }
+
+    tag = ber_scanf(be, "{mm}",
+                    &(kvps->pairs[kvps->top].attr),
+                    &(kvps->pairs[kvps->top].value));
+    if (tag == LBER_ERROR) {
+        LOG_TRACE("Invalid filter\n");
+        ret = EINVAL;
+    } else {
+        kvps->top++;
+    }
+
+    return ret;
+}
+
+static int ipa_cldap_get_tree(BerElement *be, struct kvp_list *kvps)
+{
+    ber_tag_t tag;
+    ber_tag_t len;
+    char *cookie;
+    int ret;
+
+    tag = ber_peek_tag(be, &len);
+    if (tag == LDAP_FILTER_EQUALITY) {
+        /* Special case of a single clause filter, eg. (NtVer=\06\00\00\00) */
+        ret = ipa_cldap_get_kvp(be, kvps);
+        if (ret == 0) {
+            return 0;
+        }
+    }
+
+    tag = ber_first_element(be, &len, &cookie);
+    while (tag != LBER_DEFAULT) {
+        tag = ber_peek_tag(be, &len);
+        switch (tag) {
+        case LDAP_FILTER_EQUALITY:
+            ret = ipa_cldap_get_kvp(be, kvps);
+            break;
+        case LDAP_FILTER_AND:
+            ret = ipa_cldap_get_tree(be, kvps);
+            break;
+        default:
+            LOG_TRACE("Unsupported filter\n");
+            ret = EINVAL;
+            break;
+        }
+
+        if (ret) {
+            return ret;
+        }
+
+        tag = ber_next_element(be, &len, cookie);
+    }
+
+    return 0;
+}
+
+static int ipa_cldap_decode(struct ipa_cldap_req *req)
+{
+    struct berval bv;
+    BerElement *be;
+    ber_tag_t tag;
+    ber_len_t len;
+    ber_int_t scope;
+    ber_int_t deref;
+    ber_int_t sizelimit;
+    ber_int_t timelimit;
+    ber_int_t typesonly;
+    struct berval base;
+    struct berval attr;
+    int ret = EINVAL;
+
+    bv.bv_val = req->dgram;
+    bv.bv_len = req->dgsize;
+
+    be = ber_alloc_t(0);
+    if (!be) {
+        LOG_FATAL("Out of memory!\n");
+        goto done;
+    }
+
+    ber_init2(be, &bv, 0);
+
+    tag = ber_skip_tag(be, &len);
+    if (tag != LDAP_TAG_MESSAGE) {
+        LOG_TRACE("Invalid message (%d)\n", (int)tag);
+        goto done;
+    }
+
+    tag = ber_get_int(be, &req->id);
+    if (tag != LDAP_TAG_MSGID) {
+        LOG_TRACE("Failed to get id\n");
+        goto done;
+    }
+
+    tag = ber_peek_tag(be, &len);
+    if (tag != LDAP_REQ_SEARCH) {
+        LOG_TRACE("Unexpected message type (%d)\n", (int)tag);
+        goto done;
+    }
+
+    tag = ber_scanf(be, "{meeiib",
+                    &base, &scope, &deref, &sizelimit, &timelimit, &typesonly);
+    if (tag == LBER_ERROR) {
+        LOG_TRACE("Failed to parse message\n");
+        goto done;
+    }
+
+    if ((base.bv_len != 0) ||
+        (scope != 0) ||
+        (typesonly != 0)){
+        LOG_TRACE("Unexpected request\n");
+        goto done;
+    }
+
+    ret = ipa_cldap_get_tree(be, &req->kvps);
+    if (ret) {
+        LOG_TRACE("Failed to parse filter\n");
+        goto done;
+    }
+
+    tag = ber_scanf(be, "{m}}", &attr);
+    if (tag == LBER_ERROR) {
+        LOG_TRACE("Failed to parse message\n");
+        goto done;
+    }
+
+    if (strncasecmp(attr.bv_val, "netlogon", attr.bv_len) != 0) {
+        LOG_TRACE("Unexpected request\n");
+        goto done;
+    }
+
+done:
+    ber_free(be, 0);
+    return ret;
+}
+
+static void ipa_cldap_respond(struct ipa_cldap_ctx *ctx,
+                              struct ipa_cldap_req *req,
+                              struct berval *nbtblob)
+{
+    struct berval *bv = NULL;
+    BerElement *be;
+    int ret;
+
+    be = ber_alloc_t(0);
+    if (!be) {
+        LOG_OOM();
+        return;
+    }
+
+    if (nbtblob->bv_len != 0) {
+        /* result */
+        ret = ber_printf(be, "{it{s{{s[O]}}}}", req->id,
+                         LDAP_RES_SEARCH_ENTRY, "", "netlogon", nbtblob);
+        if (ret == LBER_ERROR) {
+            LOG("Failed to encode CLDAP reply\n");
+            goto done;
+        }
+    }
+    /* done */
+    /* As per MS-ADTS 6.3.3.3 always return SUCCESS even for invalid filters */
+    ret = ber_printf(be, "{it{ess}}", req->id,
+                         LDAP_RES_SEARCH_RESULT, 0, "", "");
+    if (ret == LBER_ERROR) {
+        LOG("Failed to encode CLDAP reply\n");
+        goto done;
+    }
+    /* get data blob */
+    ret = ber_flatten(be, &bv);
+    if (ret == LBER_ERROR) {
+        LOG("Failed to encode CLDAP reply\n");
+        goto done;
+    }
+
+    ret = sendto(ctx->sd, bv->bv_val, bv->bv_len, 0,
+                 (struct sockaddr *)&req->ss, req->ss_len);
+    if (ret == -1) {
+        LOG("Failed to send CLDAP reply (%d, %s)\n", errno, strerror(errno));
+    }
+
+done:
+    ber_bvfree(bv);
+    ber_free(be, 1);
+}
+
+static void ipa_cldap_process(struct ipa_cldap_ctx *ctx,
+                              struct ipa_cldap_req *req)
+{
+    struct berval reply;
+    int ret;
+
+    ret = ipa_cldap_decode(req);
+    if (ret) {
+        goto done;
+    }
+
+    LOG_TRACE("CLDAP Request received");
+
+    ret = ipa_cldap_netlogon(ctx, req, &reply);
+
+done:
+    if (ret != 0) {
+        /* bad request, or internal error, return empty reply */
+        /* as Windows does per MS-ADTS 6.3.3.3 */
+        memset(&reply, 0, sizeof(struct berval));
+    }
+
+    ipa_cldap_respond(ctx, req, &reply);
+
+    ipa_cldap_free_kvps(&req->kvps);
+    free(req);
+    return;
+}
+
+static struct ipa_cldap_req *ipa_cldap_recv_dgram(struct ipa_cldap_ctx *ctx)
+{
+    struct ipa_cldap_req *req;
+
+    req = calloc(1, sizeof(struct ipa_cldap_req));
+    if (!req) {
+        LOG("Failed to allocate memory for req");
+        return NULL;
+    }
+
+    req->fd = ctx->sd;
+    req->ss_len = sizeof(struct sockaddr_storage);
+
+    req->dgsize = recvfrom(req->fd, req->dgram, MAX_DG_SIZE, 0,
+                           (struct sockaddr *)&req->ss, &req->ss_len);
+    if (req->dgsize == -1) {
+        LOG_TRACE("Failed to get datagram\n");
+        free(req);
+        return NULL;
+    }
+
+    return req;
+}
+
+void *ipa_cldap_worker(void *arg)
+{
+    struct ipa_cldap_req *req;
+    struct pollfd fds[2];
+    bool stop = false;
+    struct ipa_cldap_ctx *ctx = (struct ipa_cldap_ctx *) arg;
+    int ret;
+
+    while (!stop) {
+
+        fds[0].fd = ctx->stopfd[0];
+        fds[0].events = POLLIN;
+        fds[0].revents = 0;
+        fds[1].fd = ctx->sd;
+        fds[1].events = POLLIN;
+        fds[1].revents = 0;
+
+        /* wait until a request comes in */
+        ret = poll(fds, 2, -1);
+        if (ret == -1) {
+            if (errno != EINTR) {
+                LOG_FATAL("poll() failed with [%d, %s]. Can't continue.\n",
+                          errno, strerror(errno));
+                stop = true;
+            }
+        }
+        if (ret <= 0) {
+            continue;
+        }
+
+        /* got a stop signal, exit the loop */
+        if (fds[0].revents & POLLIN) {
+            stop = true;
+            continue;
+        }
+
+        /* got a CLDAP packet, handle it */
+        if (fds[1].revents & POLLIN) {
+            req = ipa_cldap_recv_dgram(ctx);
+            if (req) {
+                ipa_cldap_process(ctx, req);
+            }
+        }
+    }
+    return NULL;
+}

daemons/ipa-slapi-plugins/ipa-dns/Makefile.am

@@ -0,0 +1,40 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_dns.la		\
+	$(NULL)
+
+libipa_dns_la_SOURCES = 	\
+	ipa_dns.c		\
+	$(NULL)
+
+libipa_dns_la_LDFLAGS = -avoid-version
+
+libipa_dns_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =          \
+    ipa-dns-conf.ldif \
+    $(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-dns/Makefile.in

@@ -0,0 +1,816 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-dns
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_dns_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_dns_la_OBJECTS = ipa_dns.lo $(am__objects_1)
+libipa_dns_la_OBJECTS = $(am_libipa_dns_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_dns_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(libipa_dns_la_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_dns_la_SOURCES)
+DIST_SOURCES = $(libipa_dns_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_dns.la		\
+	$(NULL)
+
+libipa_dns_la_SOURCES = \
+	ipa_dns.c		\
+	$(NULL)
+
+libipa_dns_la_LDFLAGS = -avoid-version
+libipa_dns_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+    ipa-dns-conf.ldif \
+    $(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-dns/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-dns/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_dns.la: $(libipa_dns_la_OBJECTS) $(libipa_dns_la_DEPENDENCIES) $(EXTRA_libipa_dns_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_dns_la_LINK) -rpath $(plugindir) $(libipa_dns_la_OBJECTS) $(libipa_dns_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_dns.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-dns/ipa-dns-conf.ldif

@@ -0,0 +1,15 @@
+dn: cn=IPA DNS,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsslapdPlugin
+objectclass: extensibleObject
+cn: IPA DNS
+nsslapd-plugindescription: IPA DNS support plugin
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_dns
+nsslapd-plugininitfunc: ipadns_init
+nsslapd-pluginpath: libipa_dns.so
+nsslapd-plugintype: preoperation
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-pluginversion: 1.0
+nsslapd-plugin-depends-on-type: database

daemons/ipa-slapi-plugins/ipa-dns/ipa_dns.c

@@ -0,0 +1,229 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * original authors of 389 example ldap/servers/slapd/test-plugins/testpreop.c
+ * Petr Spacek <pspacek@redhat.com>
+ *
+ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+
+/*
+ * This is 389 DS plug-in with supporting functions for IPA-integrated DNS.
+ *
+ * To test this plug-in, stop the server, edit the dse.ldif file
+ * (in the <server_root>/slapd-<server_id>/config directory)
+ * and add the following lines before restarting the server:
+ *
+ * dn: cn=IPA DNS,cn=plugins,cn=config
+ * objectClass: top
+ * objectClass: nsslapdPlugin
+ * objectClass: extensibleObject
+ * cn: IPA DNS
+ * nsslapd-pluginDescription: IPA DNS support plugin
+ * nsslapd-pluginEnabled: on
+ * nsslapd-pluginId: ipa_dns
+ * nsslapd-pluginInitfunc: ipadns_init
+ * nsslapd-pluginPath: libipa_dns.so
+ * nsslapd-pluginType: preoperation
+ * nsslapd-pluginVendor: Red Hat, Inc.
+ * nsslapd-pluginVersion: 1.0
+ * nsslapd-plugin-depends-on-type: database
+ */
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include "slapi-plugin.h"
+#include "util.h"
+
+#define IPA_PLUGIN_NAME "ipa_dns"
+#define IPADNS_CLASS_ZONE "idnsZone"
+#define IPADNS_ATTR_SERIAL "idnsSOASerial"
+#define IPADNS_DEFAULT_SERIAL "1"
+
+#define EFALSE 0
+#define ETRUE 1
+
+Slapi_PluginDesc ipadns_desc = { IPA_PLUGIN_NAME, "Red Hat, Inc.", "1.0",
+				"IPA DNS support plugin" };
+
+/* Global variable with "constant" = IPADNS_ZONE_SERIAL. */
+Slapi_Value *value_zone = NULL;
+
+/**
+ * Determine if given entry represents IPA DNS zone.
+ *
+ * \return \c 0 when objectClass idnsZone is not present in the entry.
+ * \return \c 1 when objectClass idnsZone is present in the entry.
+ * \return \c -1 when some error occurred.
+ */
+int
+ipadns_entry_iszone( Slapi_Entry *entry ) {
+	Slapi_Attr *obj_class = NULL;
+	Slapi_Value *value = NULL;
+	char *dn = NULL;
+	int hint = 0;
+
+	dn = slapi_entry_get_dn( entry );
+
+	if ( slapi_entry_attr_find( entry, SLAPI_ATTR_OBJECTCLASS, &obj_class )
+	    != 0) {
+		LOG( "Object without objectClass encountered: entry '%s'\n",
+		    dn );
+		return EFAIL;
+	}
+
+	if ( slapi_attr_first_value( obj_class, &value ) != 0 ) {
+		LOG( "Cannot iterate over objectClass values in entry '%s'\n",
+		    dn );
+		return EOK;
+	}
+
+	do {
+		if ( slapi_value_compare( obj_class, value, value_zone ) == 0 )
+			return ETRUE; /* Entry is a DNS zone */
+
+		hint = slapi_attr_next_value( obj_class, hint, &value );
+	} while ( hint != -1 );
+
+	return EFALSE; /* Entry is not a DNS zone */
+}
+
+/**
+ * The server calls this plug-in function before executing LDAP ADD operation.
+ *
+ * ipadns_add function adds default value to idnsSOAserial attribute
+ * in idnsZone objects if the attribute is not present.
+ *
+ * Default value is added only to objects coming from other servers
+ * via replication.
+ */
+int
+ipadns_add( Slapi_PBlock *pb )
+{
+	Slapi_Entry	*e = NULL;
+	Slapi_Attr	*a = NULL;
+	char 		*dn = NULL;
+	int		cnt;
+	int 		ret;
+	int		is_repl_op;
+
+	if ( slapi_pblock_get( pb, SLAPI_IS_REPLICATED_OPERATION,
+			      &is_repl_op ) != 0 ) {
+		LOG_FATAL( "slapi_pblock_get SLAPI_IS_REPLICATED_OPERATION "
+			  "failed!?\n" );
+		return EFAIL;
+	}
+
+	/* Mangle only ADDs coming from replication. */
+	if ( !is_repl_op )
+		return EOK;
+
+	/* Get the entry that is about to be added. */
+	if ( slapi_pblock_get( pb, SLAPI_ADD_ENTRY, &e ) != 0 ) {
+		LOG( "Could not get entry\n" );
+		return EFAIL;
+	}
+	dn = slapi_entry_get_dn( e );
+
+	/* Do nothing if entry doesn't represent IPA DNS zone. */
+	ret = ipadns_entry_iszone( e );
+	if ( ret == EFALSE )
+		return EOK;
+	else if ( ret == EFAIL ) {
+		LOG( "Could not check objectClasses in entry '%s'\n", dn );
+		return EFAIL; /* TODO: Should I return OK to not block DS? */
+	}
+
+	/* Do nothing if the entry already has idnsSOASerial attribute set
+	 * and a value is present. */
+	if ( slapi_entry_attr_find( e, IPADNS_ATTR_SERIAL, &a ) == 0 ) {
+		if ( slapi_attr_get_numvalues( a, &cnt ) != 0 ) {
+			LOG( "Could not get value count for attribute '%s' "
+			     "in entry '%s'\n", IPADNS_ATTR_SERIAL, dn );
+			return EFAIL;
+		} else if ( cnt != 0 ) {
+			return EOK;
+		}
+	}
+
+	if ( slapi_entry_add_string( e, IPADNS_ATTR_SERIAL,
+				    IPADNS_DEFAULT_SERIAL ) != 0 ) {
+		LOG( "Could not add default SOA serial to entry '%s'\n", dn );
+		return EFAIL;
+	}
+
+	return EOK; /* allow the operation to continue */
+}
+
+static int
+ipadns_close( Slapi_PBlock *pb )
+{
+	( void ) pb;
+	if ( value_zone )
+		slapi_value_free( &value_zone );
+
+	return EOK;
+}
+
+/* Initialization function. */
+#ifdef _WIN32
+__declspec(dllexport)
+#endif
+int
+ipadns_init( Slapi_PBlock *pb )
+{
+	/* Register the two pre-operation plug-in functions,
+	   and specify the server plug-in version. */
+	if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
+	    SLAPI_PLUGIN_VERSION_03 ) != 0 ||
+	    slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
+	    (void *)&ipadns_desc ) != 0 ||
+	    slapi_pblock_set( pb, SLAPI_PLUGIN_CLOSE_FN,
+	    (void *) ipadns_close ) != 0 ||
+	    slapi_pblock_set( pb, SLAPI_PLUGIN_PRE_ADD_FN,
+	    (void *) ipadns_add ) != 0 ) {
+		LOG_FATAL( "Failed to set version and function\n" );
+		return EFAIL;
+	}
+
+	value_zone = slapi_value_new_string( IPADNS_CLASS_ZONE );
+
+	return EOK;
+}

daemons/ipa-slapi-plugins/ipa-enrollment/Makefile.am

@@ -0,0 +1,41 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(KRB5_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 			\
+	libipa_enrollment_extop.la	\
+	$(NULL)
+
+libipa_enrollment_extop_la_SOURCES = 	\
+	ipa_enrollment.c		\
+	$(NULL)
+
+libipa_enrollment_extop_la_LDFLAGS = -avoid-version
+
+libipa_enrollment_extop_la_LIBADD = 	\
+	$(LDAP_LIBS)			\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	enrollment-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-enrollment/Makefile.in

@@ -0,0 +1,820 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-enrollment
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_enrollment_extop_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_enrollment_extop_la_OBJECTS = ipa_enrollment.lo \
+	$(am__objects_1)
+libipa_enrollment_extop_la_OBJECTS =  \
+	$(am_libipa_enrollment_extop_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_enrollment_extop_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_enrollment_extop_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_enrollment_extop_la_SOURCES)
+DIST_SOURCES = $(libipa_enrollment_extop_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(KRB5_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_enrollment_extop.la	\
+	$(NULL)
+
+libipa_enrollment_extop_la_SOURCES = \
+	ipa_enrollment.c		\
+	$(NULL)
+
+libipa_enrollment_extop_la_LDFLAGS = -avoid-version
+libipa_enrollment_extop_la_LIBADD = \
+	$(LDAP_LIBS)			\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	enrollment-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-enrollment/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-enrollment/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_enrollment_extop.la: $(libipa_enrollment_extop_la_OBJECTS) $(libipa_enrollment_extop_la_DEPENDENCIES) $(EXTRA_libipa_enrollment_extop_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_enrollment_extop_la_LINK) -rpath $(plugindir) $(libipa_enrollment_extop_la_OBJECTS) $(libipa_enrollment_extop_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_enrollment.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-enrollment/enrollment-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=ipa_enrollment_extop,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: ipa_enrollment_extop
+nsslapd-pluginpath: libipa_enrollment_extop
+nsslapd-plugininitfunc: ipaenrollment_init
+nsslapd-plugintype: extendedop
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_enrollment_extop
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: RedHat
+nsslapd-plugindescription: Enroll hosts into the IPA domain
+nsslapd-plugin-depends-on-type: database
+nsslapd-realmTree: $SUFFIX

daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c

@@ -0,0 +1,480 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Copyright (C) 2005 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+/*
+ * Enroll a host into the IPA domain.
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <dirsrv/slapi-plugin.h>
+#include <krb5.h>
+
+#include "util.h"
+
+#define IPA_PLUGIN_NAME "ipa-enrollment"
+
+/* OID of the extended operation handled by this plug-in */
+#define JOIN_OID    "2.16.840.1.113730.3.8.10.3"
+
+Slapi_PluginDesc pdesc = {
+    IPA_PLUGIN_NAME,
+    "IPA Project",
+    "IPA/2.0",
+    "IPA Enrollment Extended Operation plugin"
+};
+
+static char *ipaenrollment_oid_list[] = {
+        JOIN_OID,
+        NULL
+};
+
+static char *ipaenrollment_name_list[] = {
+        "Enrollment Extended Operation",
+        NULL
+};
+
+static void *ipaenrollment_plugin_id;
+
+static char *realm;
+static const char *ipa_realm_dn;
+
+static int
+ipaenrollement_secure(Slapi_PBlock *pb, char **errMesg)
+{
+    int ssf;
+    int rc = LDAP_SUCCESS;
+
+    LOG_TRACE("=> ipaenrollment_secure\n");
+
+    /* Allow enrollment on all connections with a Security Strength
+     * Factor (SSF) higher than 1 */
+    if (slapi_pblock_get(pb, SLAPI_OPERATION_SSF, &ssf) != 0) {
+        LOG_TRACE("Could not get SSF from connection\n");
+        *errMesg = "Operation requires a secure connection.\n";
+        rc = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    if (NULL == realm) {
+        *errMesg = "Kerberos realm is not set.\n";
+        LOG_FATAL("%s", *errMesg);
+        rc = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    if (ssf <= 1) {
+        *errMesg = "Operation requires a secure connection.\n";
+        rc = LDAP_CONFIDENTIALITY_REQUIRED;
+        goto done;
+    }
+
+done:
+    LOG_TRACE("<= ipaenrollment_secure\n");
+    return rc;
+
+}
+
+/* The extop call passes in the FQDN of the host to enroll.
+ * We take that and set the krbPrincipalName and add the appropriate
+ * objectclasses, then return krbPrincipalName. The caller should take
+ * this and pass it to ipa-getkeytab to generate the keytab.
+ *
+ * The password for the entry is removed by ipa-getkeytab.
+ */
+static int
+ipa_join(Slapi_PBlock *pb)
+{
+    char *bindDN = NULL;
+    char *errMesg = NULL;
+    struct berval *extop_value = NULL;
+    Slapi_PBlock *pbte = NULL;
+    Slapi_PBlock *pbtm = NULL;
+    Slapi_Entry *targetEntry=NULL;
+    Slapi_DN *sdn;
+    Slapi_Backend *be;
+    Slapi_Entry **es = NULL;
+    int rc=0, ret=0, res, i;
+    int is_root=0;
+    char *krbLastPwdChange = NULL;
+    char *fqdn = NULL;
+    Slapi_Mods *smods;
+    char *attrlist[] = {"fqdn", "krbPrincipalKey", "krbLastPwdChange", "krbPrincipalName", NULL };
+    char * filter;
+
+    int scope = LDAP_SCOPE_SUBTREE;
+    char *principal = NULL;
+    char *princ_canonical = NULL;
+    struct berval retbval;
+
+    if (NULL == realm) {
+        errMesg = "Kerberos realm is not set.\n";
+        LOG_FATAL("%s", errMesg);
+        rc = LDAP_OPERATIONS_ERROR;
+        goto free_and_return;
+    }
+
+    /* Get Bind DN */
+    slapi_pblock_get(pb, SLAPI_CONN_DN, &bindDN);
+
+     /* If the connection is bound anonymously we must refuse to process
+      * this operation.
+      */
+    if (bindDN == NULL || *bindDN == '\0') {
+        /* Refuse the operation because they're bound anonymously */
+        errMesg = "Anonymous Binds are not allowed.\n";
+        rc = LDAP_INSUFFICIENT_ACCESS;
+        goto free_and_return;
+    }
+
+    /* Get the ber value of the extended operation */
+    slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
+
+    /* We are passed in the FQDN of the host to enroll. Do an internal
+     * search and pull that entry.
+     */
+    filter = slapi_ch_smprintf("(fqdn=%s)", extop_value->bv_val);
+    pbte = slapi_pblock_new();
+    slapi_search_internal_set_pb(pbte,
+            ipa_realm_dn, scope, filter, attrlist, 0,
+            NULL, /* Controls */
+            NULL, /* UniqueID */
+            ipaenrollment_plugin_id,
+            0); /* Flags */
+
+    /* do search the tree */
+    ret = slapi_search_internal_pb(pbte);
+    slapi_pblock_get(pbte, SLAPI_PLUGIN_INTOP_RESULT, &res);
+    if (ret == -1 || res != LDAP_SUCCESS) {
+        LOG_TRACE("Search for host failed, err (%d)\n", res?res:ret);
+        errMesg = "Host not found (search failed).\n";
+        rc = LDAP_NO_SUCH_OBJECT;
+        goto free_and_return;
+    }
+
+    /* get entries */
+    slapi_pblock_get(pbte, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &es);
+    if (!es) {
+        LOG_TRACE("No entries ?!");
+        errMesg = "Host not found (no result returned).\n";
+        rc = LDAP_NO_SUCH_OBJECT;
+        goto free_and_return;
+    }
+
+    /* count entries */
+    for (i = 0; es[i]; i++) /* count */ ;
+
+    /* if there is none or more than one, freak out */
+    if (i != 1) {
+        LOG_TRACE("Too many entries, or entry no found (%d)", i);
+        if (i == 0)
+            errMesg = "Host not found.\n";
+        else
+            errMesg = "Host not found (too many entries).\n";
+        rc = LDAP_NO_SUCH_OBJECT;
+        goto free_and_return;
+    }
+    targetEntry = es[0];
+
+    /* Is this host already enrolled? */
+    krbLastPwdChange = slapi_entry_attr_get_charptr(targetEntry, "krbLastPwdChange");
+    if (NULL != krbLastPwdChange) {
+        LOG_TRACE("Host already enrolled");
+        errMesg = "Host already enrolled.\n";
+        rc = LDAP_OPERATIONS_ERROR;
+        goto free_and_return;
+    }
+
+    /* First thing to do is to ask access control if the bound identity has
+     * rights to modify the userpassword attribute on this entry. If not,
+     * then we fail immediately with insufficient access. This means that
+     * we don't leak any useful information to the client such as current
+     * password wrong, etc.
+     */
+
+    is_root = slapi_dn_isroot(bindDN);
+    if (slapi_pblock_set(pb, SLAPI_REQUESTOR_ISROOT, &is_root)) {
+        LOG_FATAL("slapi_pblock_set failed!\n");
+        rc = LDAP_OPERATIONS_ERROR;
+        goto free_and_return;
+    }
+
+    /* In order to perform the access control check,
+     * we need to select a backend (even though
+     * we don't actually need it otherwise).
+     */
+    sdn = slapi_sdn_new_dn_byval(bindDN);
+    be = slapi_be_select(sdn);
+    if (slapi_pblock_set(pb, SLAPI_BACKEND, be)) {
+        LOG_FATAL("slapi_pblock_set failed!\n");
+        rc = LDAP_OPERATIONS_ERROR;
+        goto free_and_return;
+    }
+
+    /* Access Strategy:
+     * If the user has WRITE-ONLY access, a new keytab is set on the entry.
+     */
+
+    ret = slapi_access_allowed(pb, targetEntry, "krbPrincipalKey", NULL, SLAPI_ACL_WRITE);
+    if (ret != LDAP_SUCCESS) {
+        errMesg = "Insufficient access rights\n";
+        rc = LDAP_INSUFFICIENT_ACCESS;
+        goto free_and_return;
+    }
+
+    /* If a principal is already set return the name */
+    principal = slapi_entry_attr_get_charptr(targetEntry, "krbPrincipalName");
+    if (NULL != principal)
+        goto done;
+
+    /* Add the elements needed for enrollment */
+    smods = slapi_mods_new();
+    fqdn = slapi_entry_attr_get_charptr(targetEntry, "fqdn");
+    principal = slapi_ch_smprintf("host/%s@%s", fqdn, realm);
+    slapi_mods_add_string(smods, LDAP_MOD_ADD, "krbPrincipalName", principal);
+    slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "krbPrincipalAux");
+
+    /* check for krbCanonicalName attribute. If not present, set it to same
+     * value as krbPrincipalName*/
+    princ_canonical = slapi_entry_attr_get_charptr(targetEntry,
+                                                   "krbCanonicalName");
+
+    if (NULL == princ_canonical) {
+        slapi_mods_add_string(smods, LDAP_MOD_ADD, "krbCanonicalName",
+                              principal);
+    }
+
+    pbtm = slapi_pblock_new();
+    slapi_modify_internal_set_pb (pbtm, slapi_entry_get_dn_const(targetEntry),
+        slapi_mods_get_ldapmods_byref(smods),
+        NULL, /* Controls */
+        NULL, /* UniqueID */
+        ipaenrollment_plugin_id, /* PluginID */
+        0); /* Flags */
+
+    rc = slapi_modify_internal_pb (pbtm);
+    if (rc) {
+        LOG_TRACE("WARNING: modify error %d on entry '%s'\n",
+                  rc, slapi_entry_get_dn_const(targetEntry));
+    } else {
+        slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+
+        if (rc != LDAP_SUCCESS){
+            LOG_TRACE("WARNING: modify error %d on entry '%s'\n",
+                      rc, slapi_entry_get_dn_const(targetEntry));
+        } else {
+            LOG_TRACE("<= apply mods: Successful\n");
+        }
+    }
+
+done:
+    /* Return the krbprincipalname */
+    retbval.bv_val = principal;
+    retbval.bv_len = strlen(principal);
+
+    ret = slapi_pblock_set(pb, SLAPI_EXT_OP_RET_OID, JOIN_OID);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_EXT_OP_RET_VALUE, &retbval);
+    if (ret) {
+        errMesg = "Could not set return values";
+        LOG("%s\n", errMesg);
+        rc = SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
+    }
+
+    /* Free anything that we allocated above */
+free_and_return:
+
+    if (pbte) {
+        slapi_free_search_results_internal(pbte);
+        slapi_pblock_destroy(pbte);
+    }
+    if (pbtm) {
+        slapi_pblock_destroy(pbtm);
+    }
+
+    if (krbLastPwdChange) slapi_ch_free_string(&krbLastPwdChange);
+
+    LOG("%s", errMesg ? errMesg : "success\n");
+    slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
+
+    free(principal);
+
+    if (princ_canonical) {
+        free(princ_canonical);
+    }
+
+    return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
+}
+
+/* Extended operation plug-in */
+static int
+ipaenrollment_extop(Slapi_PBlock *pb)
+{
+    char *oid;
+    char *errMesg = NULL;
+    int rc, ret;
+
+    LOG_TRACE("=> ipaenrollment_extop\n");
+
+    rc = ipaenrollement_secure(pb, &errMesg);
+    if (rc) {
+        goto free_and_return;
+    }
+
+    /* Get the OID and the value included in the request */
+    if (slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_OID, &oid ) != 0) {
+        errMesg = "Could not get OID and value from request.\n";
+        rc = LDAP_OPERATIONS_ERROR;
+        LOG("%s", errMesg);
+        goto free_and_return;
+    }
+
+    if (strcasecmp(oid, JOIN_OID) == 0) {
+        ret = ipa_join(pb);
+        return ret;
+    }
+
+    errMesg = "Request OID does not match supported OIDs.\n";
+    rc = LDAP_OPERATIONS_ERROR;
+
+free_and_return:
+    LOG("%s", errMesg);
+    slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
+
+    return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
+}
+
+static int
+ipaenrollment_start(Slapi_PBlock *pb)
+{
+    krb5_error_code krberr;
+    krb5_context krbctx;
+    char *config_dn = NULL;
+    char *partition_dn = NULL;
+    Slapi_Entry *config_entry = NULL;
+    int ret = LDAP_SUCCESS;
+    Slapi_DN *sdn;
+    int rc = 0;
+
+    krberr = krb5_init_context(&krbctx);
+    if (krberr) {
+        LOG_FATAL("krb5_init_context failed\n");
+        /* Yes, we failed, but it is because /etc/krb5.conf doesn't exist
+         * or is misconfigured. Start up in a degraded mode.
+         */
+        goto done;
+    }
+
+    krberr = krb5_get_default_realm(krbctx, &realm);
+    if (krberr) {
+        realm = NULL;
+        LOG_FATAL("Failed to get default realm?!\n");
+        goto done;
+    }
+
+    if (slapi_pblock_get(pb, SLAPI_TARGET_DN, &config_dn) != 0) {
+        LOG_FATAL("No config DN?\n");
+        goto done;
+    }
+    sdn = slapi_sdn_new_dn_byref(config_dn);
+    if ((rc = slapi_search_internal_get_entry(sdn, NULL, &config_entry,
+                                ipaenrollment_plugin_id)) != LDAP_SUCCESS ){
+        LOG_TRACE("ipaenrollment_start: No such entry-(%s), err (%d)\n",
+                  config_dn, rc);
+    }
+    slapi_sdn_free(&sdn);
+
+    partition_dn = slapi_entry_attr_get_charptr(config_entry, "nsslapd-realmtree");
+    if (!partition_dn) {
+        LOG_FATAL("Missing partition configuration entry (nsslapd-realmTree)!\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ipa_realm_dn = slapi_ch_smprintf("cn=computers,cn=accounts,%s", partition_dn);
+    slapi_ch_free_string(&partition_dn);
+    if (!ipa_realm_dn) {
+        LOG_FATAL("Out of memory ?\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+done:
+    if (krbctx) krb5_free_context(krbctx);
+    if (config_entry) slapi_entry_free(config_entry);
+
+    return ret;
+}
+
+int
+ipaenrollment_init(Slapi_PBlock *pb)
+{
+    int ret;
+
+    /* Get the arguments appended to the plugin extendedop directive
+     * in the plugin entry.  The first argument
+     * (after the standard arguments for the directive) should
+     * contain the OID of the extended op.
+    */
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ipaenrollment_plugin_id);
+    if ((ret != 0) || (NULL == ipaenrollment_plugin_id)) {
+        LOG("Could not get identity or identity was NULL\n");
+        return -1;
+    }
+
+    LOG("Registering plug-in for extended op.\n");
+
+    /* Register the plug-in function as an extended operation
+       plug-in function. */
+    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, (void *)ipaenrollment_start);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, ipaenrollment_oid_list);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_NAMELIST, ipaenrollment_name_list);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_FN, (void *)ipaenrollment_extop);
+
+    if (ret) {
+        LOG("Failed to set plug-in version, function, and OID.\n");
+        return -1;
+    }
+
+    return 0;
+}

daemons/ipa-slapi-plugins/ipa-extdom-extop/Makefile.am

@@ -0,0 +1,84 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(SSSNSSIDMAP_CFLAGS)					\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 			\
+	libipa_extdom_extop.la	\
+	$(NULL)
+
+libipa_extdom_extop_la_SOURCES = 	\
+	ipa_extdom.h			\
+	ipa_extdom_extop.c		\
+	ipa_extdom_common.c		\
+	back_extdom.h			\
+	$(NULL)
+
+libipa_extdom_extop_la_LDFLAGS = -avoid-version
+
+libipa_extdom_extop_la_LIBADD = 	\
+	$(LDAP_LIBS)			\
+	$(SSSNSSIDMAP_LIBS)		\
+	$(NULL)
+
+# We have two backends for nss operations:
+# (1) directly loading nss_sss.so.2
+# (2) using timeout-enabled API from libsss_nss_idmap
+# We prefer (2) if available
+if USE_SSS_NSS_TIMEOUT
+libipa_extdom_extop_la_SOURCES += back_extdom_sss_idmap.c
+else
+libipa_extdom_extop_la_SOURCES += back_extdom_nss_sss.c
+endif
+
+
+TESTS =
+check_PROGRAMS =
+
+if HAVE_CMOCKA
+TESTS += extdom_cmocka_tests
+check_PROGRAMS += extdom_cmocka_tests
+endif
+
+extdom_cmocka_tests_SOURCES = 		\
+	ipa_extdom_cmocka_tests.c	\
+	ipa_extdom_common.c		\
+	back_extdom_nss_sss.c		\
+	$(NULL)
+extdom_cmocka_tests_CFLAGS = $(CMOCKA_CFLAGS)
+extdom_cmocka_tests_LDFLAGS = 	\
+	-rpath $(shell pkg-config --libs-only-L dirsrv | sed -e 's/-L//') \
+	$(NULL)
+extdom_cmocka_tests_LDADD = 	\
+	$(CMOCKA_LIBS)		\
+	$(LDAP_LIBS)		\
+	$(DIRSRV_LIBS)		\
+	$(SSSNSSIDMAP_LIBS)	\
+	-ldl			\
+	$(NULL)
+
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =				\
+	ipa-extdom-extop-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	README			\
+	test_data		\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-extdom-extop/back_extdom.h

@@ -0,0 +1,79 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * This Program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this Program; if not, write to the
+ *
+ *   Free Software Foundation, Inc.
+ *   59 Temple Place, Suite 330
+ *   Boston, MA 02111-1307 USA
+ *
+ */
+
+#ifndef BACK_EXTDOM_H
+#define BACK_EXTDOM_H
+#include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
+
+/* Possible results of lookup using a nss_* function.
+ * Note: don't include nss.h as its path gets overriden by NSS library */
+enum nss_status {
+    NSS_STATUS_TRYAGAIN = -2,
+    NSS_STATUS_UNAVAIL,
+    NSS_STATUS_NOTFOUND,
+    NSS_STATUS_SUCCESS,
+    NSS_STATUS_RETURN
+};
+
+/* NSS backend operations implemented using either nss_sss.so.2 or libsss_nss_idmap API */
+struct nss_ops_ctx;
+
+int back_extdom_init_context(struct nss_ops_ctx **nss_context);
+void back_extdom_free_context(struct nss_ops_ctx **nss_context);
+void back_extdom_set_timeout(struct nss_ops_ctx *nss_context,
+                             unsigned int timeout);
+void back_extdom_evict_user(struct nss_ops_ctx *nss_context,
+                            const char *name);
+void back_extdom_evict_group(struct nss_ops_ctx *nss_context,
+                             const char *name);
+
+enum nss_status back_extdom_getpwnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno);
+
+enum nss_status back_extdom_getpwuid(struct nss_ops_ctx *nss_context,
+                                     uid_t uid, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno);
+
+enum nss_status back_extdom_getgrnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno);
+
+enum nss_status back_extdom_getgrgid(struct nss_ops_ctx *nss_context,
+                                     gid_t gid, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno);
+
+enum nss_status back_extdom_getgrouplist(struct nss_ops_ctx *nss_context,
+                                         const char *name, gid_t group,
+                                         gid_t *groups, int *ngroups,
+                                         int *lerrno);
+
+#endif /* BACK_EXTDOM_H */

daemons/ipa-slapi-plugins/ipa-extdom-extop/back_extdom_nss_sss.c

@@ -0,0 +1,276 @@
+/*
+ * Copyright 2013-2017 Red Hat, Inc.
+ *
+ * This Program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this Program; if not, write to the
+ *
+ *   Free Software Foundation, Inc.
+ *   59 Temple Place, Suite 330
+ *   Boston, MA 02111-1307 USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <pwd.h>
+#include <grp.h>
+#include <sys/param.h>
+#include "back_extdom.h"
+
+struct nss_ops_ctx {
+    void *dl_handle;
+    long int initgroups_start;
+
+    enum nss_status (*getpwnam_r)(const char *name, struct passwd *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getpwuid_r)(uid_t uid, struct passwd *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getgrnam_r)(const char *name, struct group *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getgrgid_r)(gid_t gid, struct group *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*initgroups_dyn)(const char *user, gid_t group,
+                                      long int *start, long int *size,
+                                      gid_t **groups, long int limit,
+                                      int *errnop);
+};
+
+void back_extdom_free_context(struct nss_ops_ctx **nss_context)
+{
+    if ((nss_context == NULL) || (*nss_context == NULL)) {
+        return;
+    }
+
+    if ((*nss_context)->dl_handle != NULL) {
+        dlclose((*nss_context)->dl_handle);
+    }
+
+    free((*nss_context));
+    *nss_context = NULL;
+}
+
+int back_extdom_init_context(struct nss_ops_ctx **nss_context)
+{
+    struct nss_ops_ctx *ctx = NULL;
+
+    if (nss_context == NULL) {
+        return EINVAL;
+    }
+
+    ctx = calloc(1, sizeof(struct nss_ops_ctx));
+    if (ctx == NULL) {
+        return ENOMEM;
+    }
+    *nss_context = ctx;
+
+    ctx->dl_handle = dlopen("libnss_sss.so.2", RTLD_NOW);
+    if (ctx->dl_handle == NULL) {
+        goto fail;
+    }
+
+    ctx->getpwnam_r = dlsym(ctx->dl_handle, "_nss_sss_getpwnam_r");
+    if (ctx->getpwnam_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getpwuid_r = dlsym(ctx->dl_handle, "_nss_sss_getpwuid_r");
+    if (ctx->getpwuid_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getgrnam_r = dlsym(ctx->dl_handle, "_nss_sss_getgrnam_r");
+    if (ctx->getgrnam_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getgrgid_r = dlsym(ctx->dl_handle, "_nss_sss_getgrgid_r");
+    if (ctx->getgrgid_r == NULL) {
+        goto fail;
+    }
+
+    ctx->initgroups_dyn = dlsym(ctx->dl_handle, "_nss_sss_initgroups_dyn");
+    if (ctx->initgroups_dyn == NULL) {
+        goto fail;
+    }
+
+    return 0;
+
+fail:
+    back_extdom_free_context(nss_context);
+
+    return EINVAL;
+}
+
+
+/* Following three functions cannot be implemented with nss_sss.so.2
+ * As result, we simply do nothing here */
+
+void back_extdom_set_timeout(struct nss_ops_ctx *nss_context,
+                             unsigned int timeout) {
+        /* no operation */
+}
+
+void back_extdom_evict_user(struct nss_ops_ctx *nss_context,
+                            const char *name) {
+        /* no operation */
+}
+
+void back_extdom_evict_group(struct nss_ops_ctx *nss_context,
+                             const char *name) {
+        /* no operation */
+}
+
+enum nss_status back_extdom_getpwnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno) {
+    enum nss_status ret;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = nss_context->getpwnam_r(name, pwd,
+                                  buffer, buflen,
+                                  lerrno);
+
+    if ((ret == NSS_STATUS_SUCCESS) && (result != NULL)) {
+        *result = pwd;
+        *lerrno = 0;
+    }
+
+    return ret;
+}
+
+enum nss_status back_extdom_getpwuid(struct nss_ops_ctx *nss_context,
+                                     uid_t uid, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno) {
+    enum nss_status ret;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = nss_context->getpwuid_r(uid, pwd,
+                                  buffer, buflen,
+                                  lerrno);
+
+    if ((ret == NSS_STATUS_SUCCESS) && (result != NULL)) {
+        *result = pwd;
+        *lerrno = 0;
+    }
+
+    return ret;
+}
+
+enum nss_status back_extdom_getgrnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno) {
+    enum nss_status ret;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = nss_context->getgrnam_r(name, grp,
+                                  buffer, buflen,
+                                  lerrno);
+
+    if ((ret == NSS_STATUS_SUCCESS) && (result != NULL)) {
+        *result = grp;
+        *lerrno = 0;
+    }
+
+    return ret;
+}
+
+enum nss_status back_extdom_getgrgid(struct nss_ops_ctx *nss_context,
+                                     gid_t gid, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno) {
+
+    enum nss_status ret;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = nss_context->getgrgid_r(gid, grp,
+                                  buffer, buflen,
+                                  lerrno);
+
+    if ((ret == NSS_STATUS_SUCCESS) && (result != NULL)) {
+        *result = grp;
+        *lerrno = 0;
+    }
+
+    return ret;
+}
+
+enum nss_status back_extdom_getgrouplist(struct nss_ops_ctx *nss_context,
+                                         const char *name, gid_t group,
+                                         gid_t *groups, int *ngroups,
+                                         int *lerrno) {
+
+    enum nss_status ret = NSS_STATUS_UNAVAIL;
+    long int tsize = MAX (1, *ngroups);
+    gid_t *newgroups = NULL;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    newgroups = (gid_t *) calloc (tsize, sizeof (gid_t));
+    if (newgroups == NULL) {
+        *lerrno = ENOMEM;
+        return NSS_STATUS_TRYAGAIN;
+    }
+
+    newgroups[0] = group;
+    nss_context->initgroups_start = 1;
+
+    ret = nss_context->initgroups_dyn(name, group,
+                                      &nss_context->initgroups_start,
+                                      &tsize, &newgroups,
+                                      -1, lerrno);
+
+    (void) memcpy(groups, newgroups,
+                  MIN(*ngroups, nss_context->initgroups_start) * sizeof(gid_t));
+    free(newgroups);
+
+    if (*ngroups < nss_context->initgroups_start) {
+        ret = NSS_STATUS_TRYAGAIN;
+        *lerrno = ERANGE;
+    }
+
+    *ngroups = (int) nss_context->initgroups_start;
+
+    nss_context->initgroups_start = 0;
+
+    return ret;
+}
+

daemons/ipa-slapi-plugins/ipa-extdom-extop/back_extdom_sss_idmap.c

@@ -0,0 +1,260 @@
+/*
+ * Copyright 2013-2017 Red Hat, Inc.
+ *
+ * This Program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this Program; if not, write to the
+ *
+ *   Free Software Foundation, Inc.
+ *   59 Temple Place, Suite 330
+ *   Boston, MA 02111-1307 USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pwd.h>
+#include <grp.h>
+#include "back_extdom.h"
+
+/* SSSD only exposes *_timeout() variants if the following symbol is defined */
+#define IPA_389DS_PLUGIN_HELPER_CALLS
+#include <sss_nss_idmap.h>
+
+struct nss_ops_ctx {
+    unsigned int timeout;
+};
+
+static enum nss_status __convert_sss_nss2nss_status(int errcode) {
+    switch(errcode) {
+    case 0:
+        return NSS_STATUS_SUCCESS;
+    case ENOENT:
+        return NSS_STATUS_NOTFOUND;
+    case ETIME:
+        /* fall-through */
+    case ERANGE:
+        return NSS_STATUS_TRYAGAIN;
+    case ETIMEDOUT:
+        /* fall-through */
+    default:
+        return NSS_STATUS_UNAVAIL;
+    }
+    return NSS_STATUS_UNAVAIL;
+}
+
+int back_extdom_init_context(struct nss_ops_ctx **nss_context)
+{
+    struct nss_ops_ctx *ctx = NULL;
+
+    if (nss_context == NULL) {
+        return EINVAL;
+    }
+
+    ctx = calloc(1, sizeof(struct nss_ops_ctx));
+
+    if (ctx == NULL) {
+        return ENOMEM;
+    }
+    *nss_context = ctx;
+    return 0;
+}
+
+void back_extdom_free_context(struct nss_ops_ctx **nss_context)
+{
+    if ((nss_context == NULL) || (*nss_context == NULL)) {
+        return;
+    }
+
+    free((*nss_context));
+    *nss_context = NULL;
+}
+
+
+void back_extdom_set_timeout(struct nss_ops_ctx *nss_context,
+                             unsigned int timeout) {
+    if (nss_context == NULL) {
+        return;
+    }
+
+    nss_context->timeout = timeout;
+}
+
+void back_extdom_evict_user(struct nss_ops_ctx *nss_context,
+                            const char *name) {
+    if (nss_context == NULL) {
+        return;
+    }
+
+    (void) sss_nss_getpwnam_timeout(name, NULL,
+                                    NULL, 0,
+                                    NULL,
+                                    SSS_NSS_EX_FLAG_INVALIDATE_CACHE,
+                                    nss_context->timeout);
+}
+
+void back_extdom_evict_group(struct nss_ops_ctx *nss_context,
+                             const char *name) {
+    if (nss_context == NULL) {
+            return;
+    }
+
+    (void) sss_nss_getgrnam_timeout(name, NULL,
+                                    NULL, 0,
+                                    NULL,
+                                    SSS_NSS_EX_FLAG_INVALIDATE_CACHE,
+                                    nss_context->timeout);
+}
+
+enum nss_status back_extdom_getpwnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno) {
+    int ret = 0;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = sss_nss_getpwnam_timeout(name, pwd,
+                                   buffer, buflen,
+                                   result,
+                                   SSS_NSS_EX_FLAG_NO_FLAGS,
+                                   nss_context->timeout);
+
+    /* SSSD uses the same infrastructure to handle sss_nss_get* calls
+     * as nss_sss.so.2 module where 'int *errno' is passed to the helper
+     * but writes down errno into return code so we propagate it in case
+     * of error and translate the return code */
+    if (lerrno != NULL) {
+        *lerrno = ret;
+    }
+    return __convert_sss_nss2nss_status(ret);
+}
+
+enum nss_status back_extdom_getpwuid(struct nss_ops_ctx *nss_context,
+                                     uid_t uid, struct passwd *pwd,
+                                     char *buffer, size_t buflen,
+                                     struct passwd **result,
+                                     int *lerrno) {
+
+    int ret = 0;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = sss_nss_getpwuid_timeout(uid, pwd,
+                                   buffer, buflen,
+                                   result,
+                                   SSS_NSS_EX_FLAG_NO_FLAGS,
+                                   nss_context->timeout);
+
+    /* SSSD uses the same infrastructure to handle sss_nss_get* calls
+     * as nss_sss.so.2 module where 'int *errno' is passed to the helper
+     * but writes down errno into return code so we propagate it in case
+     * of error and translate the return code */
+    if (lerrno != NULL) {
+        *lerrno = ret;
+    }
+    return __convert_sss_nss2nss_status(ret);
+}
+
+enum nss_status back_extdom_getgrnam(struct nss_ops_ctx *nss_context,
+                                     const char *name, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno) {
+
+    int ret = 0;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = sss_nss_getgrnam_timeout(name, grp,
+                                   buffer, buflen,
+                                   result,
+                                   SSS_NSS_EX_FLAG_NO_FLAGS,
+                                   nss_context->timeout);
+
+    /* SSSD uses the same infrastructure to handle sss_nss_get* calls
+     * as nss_sss.so.2 module where 'int *errno' is passed to the helper
+     * but writes down errno into return code so we propagate it in case
+     * of error and translate the return code */
+    if (lerrno != NULL) {
+        *lerrno = ret;
+    }
+    return __convert_sss_nss2nss_status(ret);
+}
+
+enum nss_status back_extdom_getgrgid(struct nss_ops_ctx *nss_context,
+                                     gid_t gid, struct group *grp,
+                                     char *buffer, size_t buflen,
+                                     struct group **result,
+                                     int *lerrno) {
+
+    int ret = 0;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = sss_nss_getgrgid_timeout(gid, grp,
+                                   buffer, buflen,
+                                   result,
+                                   SSS_NSS_EX_FLAG_NO_FLAGS,
+                                   nss_context->timeout);
+
+    /* SSSD uses the same infrastructure to handle sss_nss_get* calls
+     * as nss_sss.so.2 module where 'int *errno' is passed to the helper
+     * but writes down errno into return code so we propagate it in case
+     * of error and translate the return code */
+    if (lerrno != NULL) {
+        *lerrno = ret;
+    }
+    return __convert_sss_nss2nss_status(ret);
+}
+
+enum nss_status back_extdom_getgrouplist(struct nss_ops_ctx *nss_context,
+                                         const char *name, gid_t group,
+                                         gid_t *groups, int *ngroups,
+                                         int *lerrno) {
+    int ret = 0;
+
+    if (nss_context == NULL) {
+        return NSS_STATUS_UNAVAIL;
+    }
+
+    ret = sss_nss_getgrouplist_timeout(name, group,
+                                       groups, ngroups,
+                                       SSS_NSS_EX_FLAG_NO_FLAGS,
+                                       nss_context->timeout);
+
+    /* SSSD uses the same infrastructure to handle sss_nss_get* calls
+     * as nss_sss.so.2 module where 'int *errno' is passed to the helper
+     * but writes down errno into return code so we propagate it in case
+     * of error and translate the return code */
+    if (lerrno != NULL) {
+        *lerrno = ret;
+    }
+    return __convert_sss_nss2nss_status(ret);
+}
+

daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa-extdom-extop-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=ipa_extdom_extop,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: ipa_extdom_extop
+nsslapd-pluginpath: libipa_extdom_extop
+nsslapd-plugininitfunc: ipa_extdom_init
+nsslapd-plugintype: extendedop
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_extdom_extop
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: RedHat
+nsslapd-plugindescription: Support resolving IDs in trusted domains to names and back
+nsslapd-plugin-depends-on-type: database
+nsslapd-basedn: $SUFFIX

daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom.h

@@ -0,0 +1,209 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <pwd.h>
+#include <grp.h>
+
+#include <dirsrv/slapi-plugin.h>
+#include <lber.h>
+#include <time.h>
+
+#include <sss_nss_idmap.h>
+
+#define EXOP_EXTDOM_OID "2.16.840.1.113730.3.8.10.4"
+#define EXOP_EXTDOM_V1_OID "2.16.840.1.113730.3.8.10.4.1"
+
+#define IPA_EXTDOM_PLUGIN_NAME   "ipa-extdom-extop"
+#define IPA_EXTDOM_FEATURE_DESC  "IPA trusted domain ID mapper"
+#define IPA_EXTDOM_PLUGIN_DESC   "Support resolving IDs in trusted domains to names and back"
+
+#define IPA_PLUGIN_NAME IPA_EXTDOM_PLUGIN_NAME
+
+enum extdom_version {
+    EXTDOM_V0 = 0,
+    EXTDOM_V1
+};
+
+enum input_types {
+    INP_SID = 1,
+    INP_NAME,
+    INP_POSIX_UID,
+    INP_POSIX_GID,
+    INP_CERT
+};
+
+enum request_types {
+    REQ_SIMPLE = 1,
+    REQ_FULL,
+    REQ_FULL_WITH_GROUPS
+};
+
+enum response_types {
+    RESP_SID = 1,
+    RESP_NAME,
+    RESP_USER,
+    RESP_GROUP,
+    RESP_USER_GROUPLIST,
+    RESP_GROUP_MEMBERS,
+    RESP_NAME_LIST
+};
+
+struct extdom_req {
+    enum input_types input_type;
+    enum request_types request_type;
+    union {
+        char *sid;
+        struct {
+            char *domain_name;
+            char *object_name;
+        } name;
+        struct {
+            char *domain_name;
+            uid_t uid;
+        } posix_uid;
+        struct {
+            char *domain_name;
+            gid_t gid;
+        } posix_gid;
+        char *cert;
+    } data;
+    char *err_msg;
+};
+
+struct extdom_res {
+    enum response_types response_type;
+    union {
+        char *sid;
+        struct {
+            char *domain_name;
+            char *object_name;
+        } name;
+        struct {
+            char *domain_name;
+            char *user_name;
+            uid_t uid;
+            gid_t gid;
+            char *gecos;
+            char *home;
+            char *shell;
+            size_t ngroups;
+            char **groups;
+        } user;
+        struct {
+            char *domain_name;
+            char *group_name;
+            gid_t gid;
+            size_t nmembers;
+            char **members;
+        } group;
+    } data;
+};
+
+struct nss_ops_ctx;
+
+struct ipa_extdom_ctx {
+    Slapi_ComponentId *plugin_id;
+    char *base_dn;
+    size_t max_nss_buf_size;
+    struct nss_ops_ctx *nss_ctx;
+};
+
+struct domain_info {
+    char *flat_name;
+    char *sid;
+    char *guid;
+};
+
+struct pwd_grp {
+    enum sss_id_type id_type;
+    union {
+        struct passwd pwd;
+        struct group grp;
+    } data;
+    int ngroups;
+    gid_t *groups;
+};
+
+int parse_request_data(struct berval *req_val, struct extdom_req **_req);
+void free_req_data(struct extdom_req *req);
+int check_request(struct extdom_req *req, enum extdom_version version);
+int handle_request(struct ipa_extdom_ctx *ctx, struct extdom_req *req,
+                   struct berval **berval);
+int pack_response(struct extdom_res *res, struct berval **ret_val);
+int get_buffer(size_t *_buf_len, char **_buf);
+int getpwnam_r_wrapper(struct ipa_extdom_ctx *ctx, const char *name,
+                       struct passwd *pwd, char **_buf, size_t *_buf_len);
+int getpwuid_r_wrapper(struct ipa_extdom_ctx *ctx, uid_t uid,
+                       struct passwd *pwd, char **_buf, size_t *_buf_len);
+int getgrnam_r_wrapper(struct ipa_extdom_ctx *ctx, const char *name,
+                       struct group *grp, char **_buf, size_t *_buf_len);
+int getgrgid_r_wrapper(struct ipa_extdom_ctx *ctx, gid_t gid,
+                       struct group *grp, char **_buf, size_t *_buf_len);
+int get_user_grouplist(struct ipa_extdom_ctx *ctx, const char *name, gid_t gid,
+                       size_t *_ngroups, gid_t **_groups);
+int pack_ber_sid(const char *sid, struct berval **berval);
+int pack_ber_name(const char *domain_name, const char *name,
+                  struct berval **berval);
+int pack_ber_user(struct ipa_extdom_ctx *ctx,
+                  enum response_types response_type,
+                  const char *domain_name, const char *user_name,
+                  uid_t uid, gid_t gid,
+                  const char *gecos, const char *homedir,
+                  const char *shell, struct sss_nss_kv *kv_list,
+                  struct berval **berval);
+int pack_ber_group(enum response_types response_type,
+                   const char *domain_name, const char *group_name,
+                   gid_t gid, char **members, struct sss_nss_kv *kv_list,
+                   struct berval **berval);
+void set_err_msg(struct extdom_req *req, const char *format, ...);

daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_cmocka_tests.c

@@ -0,0 +1,631 @@
+/*
+    Authors:
+        Sumit Bose <sbose@redhat.com>
+
+    Copyright (C) 2015 Red Hat
+
+    Extdom tests
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include <sys/types.h>
+#include <pwd.h>
+
+
+#include "ipa_extdom.h"
+#include "back_extdom.h"
+#include <stdio.h>
+#include <dlfcn.h>
+
+#define MAX_BUF (1024*1024*1024)
+struct test_data {
+    struct extdom_req *req;
+    struct ipa_extdom_ctx *ctx;
+};
+
+/*
+ * redefine logging for mocks
+ */
+#ifdef __GNUC__
+    __attribute__((format(printf, 3, 4)))
+#endif
+int slapi_log_error(int loglevel, char *subsystem, char *fmt, ...)
+{
+    va_list ap;
+    va_start(ap, fmt);
+    vprint_error(fmt, ap);
+    va_end(ap);
+    return 0;
+}
+
+
+/*
+ * We cannot run cmocka tests against SSSD as that would require to set up SSSD
+ * and the rest of environment. Instead, we compile cmocka tests against
+ * back_extdom_nss_sss.c and re-define context initialization to use
+ * nsswrapper with our test data.
+ *
+ * This means we have to keep struct nss_ops_ctx definition in sync with tests!
+ */
+
+struct nss_ops_ctx {
+    void *dl_handle;
+    long int initgroups_start;
+
+    enum nss_status (*getpwnam_r)(const char *name, struct passwd *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getpwuid_r)(uid_t uid, struct passwd *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getgrnam_r)(const char *name, struct group *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*getgrgid_r)(gid_t gid, struct group *result,
+                                  char *buffer, size_t buflen, int *errnop);
+    enum nss_status (*initgroups_dyn)(const char *user, gid_t group,
+                                      long int *start, long int *size,
+                                      gid_t **groups, long int limit,
+                                      int *errnop);
+};
+
+int cmocka_extdom_init_context(struct nss_ops_ctx **nss_context)
+{
+    struct nss_ops_ctx *ctx = NULL;
+
+    if (nss_context == NULL) {
+        return -1;
+    }
+
+    ctx = calloc(1, sizeof(struct nss_ops_ctx));
+
+    if (ctx == NULL) {
+        return ENOMEM;
+    }
+    *nss_context = ctx;
+
+    ctx->dl_handle = dlopen("libnss_files.so.2", RTLD_NOW);
+    if (ctx->dl_handle == NULL) {
+        goto fail;
+    }
+
+    ctx->getpwnam_r = dlsym(ctx->dl_handle, "_nss_files_getpwnam_r");
+    if (ctx->getpwnam_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getpwuid_r = dlsym(ctx->dl_handle, "_nss_files_getpwuid_r");
+    if (ctx->getpwuid_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getgrnam_r = dlsym(ctx->dl_handle, "_nss_files_getgrnam_r");
+    if (ctx->getgrnam_r == NULL) {
+        goto fail;
+    }
+
+    ctx->getgrgid_r = dlsym(ctx->dl_handle, "_nss_files_getgrgid_r");
+    if (ctx->getgrgid_r == NULL) {
+        goto fail;
+    }
+
+    ctx->initgroups_dyn = dlsym(ctx->dl_handle, "_nss_files_initgroups_dyn");
+    if (ctx->initgroups_dyn == NULL) {
+        goto fail;
+    }
+
+    return 0;
+
+fail:
+    back_extdom_free_context(nss_context);
+
+    return -1;
+}
+
+struct {
+    const char *o, *n;
+} path_table[] = {
+    { .o = "/etc/passwd", .n = "./test_data/passwd"},
+    { .o = "/etc/group",  .n = "./test_data/group"},
+    { .o = NULL, .n = NULL}};
+
+FILE *(*original_fopen)(const char*, const char*) = NULL;
+
+FILE *fopen(const char *path, const char *mode) {
+    const char *_path = NULL;
+
+    /* Do not handle before-main() cases */
+    if (original_fopen == NULL) {
+        return NULL;
+    }
+    for(int i=0; path_table[i].o != NULL; i++) {
+        if (strcmp(path, path_table[i].o) == 0) {
+                _path = path_table[i].n;
+                break;
+        }
+    }
+    return (*original_fopen)(_path ? _path : path, mode);
+}
+
+/* Attempt to initialize original_fopen before main()
+ * There is no explicit order when all initializers are called,
+ * so we might still be late here compared to a code in a shared
+ * library initializer, like libselinux */
+void redefined_fopen_ctor (void) __attribute__ ((constructor));
+void redefined_fopen_ctor(void) {
+    original_fopen = dlsym(RTLD_NEXT, "fopen");
+}
+
+void test_getpwnam_r_wrapper(void **state)
+{
+    int ret;
+    struct passwd pwd;
+    char *buf;
+    size_t buf_len, max_big_buf_len;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getpwnam_r_wrapper(test_data->ctx,
+                             "non_exisiting_user", &pwd,
+                             &buf, &buf_len);
+    assert_int_equal(ret, ENOENT);
+
+    ret = getpwnam_r_wrapper(test_data->ctx,
+                             "user", &pwd, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(pwd.pw_name, "user");
+    assert_string_equal(pwd.pw_passwd, "x");
+    assert_int_equal(pwd.pw_uid, 12345);
+    assert_int_equal(pwd.pw_gid, 23456);
+    assert_string_equal(pwd.pw_gecos, "gecos");
+    assert_string_equal(pwd.pw_dir, "/home/user");
+    assert_string_equal(pwd.pw_shell, "/bin/shell");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getpwnam_r_wrapper(test_data->ctx,
+                             "user_big", &pwd, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(pwd.pw_name, "user_big");
+    assert_string_equal(pwd.pw_passwd, "x");
+    assert_int_equal(pwd.pw_uid, 12346);
+    assert_int_equal(pwd.pw_gid, 23457);
+    assert_int_equal(strlen(pwd.pw_gecos), 4000 * strlen("gecos"));
+    assert_string_equal(pwd.pw_dir, "/home/user_big");
+    assert_string_equal(pwd.pw_shell, "/bin/shell");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    max_big_buf_len = test_data->ctx->max_nss_buf_size;
+    test_data->ctx->max_nss_buf_size = 1024;
+    ret = getpwnam_r_wrapper(test_data->ctx,
+                             "user_big", &pwd, &buf, &buf_len);
+    test_data->ctx->max_nss_buf_size = max_big_buf_len;
+    assert_int_equal(ret, ERANGE);
+    free(buf);
+}
+
+void test_getpwuid_r_wrapper(void **state)
+{
+    int ret;
+    struct passwd pwd;
+    char *buf;
+    size_t buf_len, max_big_buf_len;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getpwuid_r_wrapper(test_data->ctx, 99999, &pwd, &buf, &buf_len);
+    assert_int_equal(ret, ENOENT);
+
+    ret = getpwuid_r_wrapper(test_data->ctx, 12345, &pwd, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(pwd.pw_name, "user");
+    assert_string_equal(pwd.pw_passwd, "x");
+    assert_int_equal(pwd.pw_uid, 12345);
+    assert_int_equal(pwd.pw_gid, 23456);
+    assert_string_equal(pwd.pw_gecos, "gecos");
+    assert_string_equal(pwd.pw_dir, "/home/user");
+    assert_string_equal(pwd.pw_shell, "/bin/shell");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getpwuid_r_wrapper(test_data->ctx, 12346, &pwd, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(pwd.pw_name, "user_big");
+    assert_string_equal(pwd.pw_passwd, "x");
+    assert_int_equal(pwd.pw_uid, 12346);
+    assert_int_equal(pwd.pw_gid, 23457);
+    assert_int_equal(strlen(pwd.pw_gecos), 4000 * strlen("gecos"));
+    assert_string_equal(pwd.pw_dir, "/home/user_big");
+    assert_string_equal(pwd.pw_shell, "/bin/shell");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    max_big_buf_len = test_data->ctx->max_nss_buf_size;
+    test_data->ctx->max_nss_buf_size = 1024;
+    ret = getpwuid_r_wrapper(test_data->ctx, 12346, &pwd, &buf, &buf_len);
+    test_data->ctx->max_nss_buf_size = max_big_buf_len;
+    assert_int_equal(ret, ERANGE);
+    free(buf);
+}
+
+void test_getgrnam_r_wrapper(void **state)
+{
+    int ret;
+    struct group grp;
+    char *buf;
+    size_t buf_len, max_big_buf_len;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getgrnam_r_wrapper(test_data->ctx,
+                             "non_exisiting_group", &grp, &buf, &buf_len);
+    assert_int_equal(ret, ENOENT);
+
+    ret = getgrnam_r_wrapper(test_data->ctx, "group", &grp, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(grp.gr_name, "group");
+    assert_string_equal(grp.gr_passwd, "x");
+    assert_int_equal(grp.gr_gid, 11111);
+    assert_string_equal(grp.gr_mem[0], "member0001");
+    assert_string_equal(grp.gr_mem[1], "member0002");
+    assert_null(grp.gr_mem[2]);
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getgrnam_r_wrapper(test_data->ctx, "group_big", &grp, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(grp.gr_name, "group_big");
+    assert_string_equal(grp.gr_passwd, "x");
+    assert_int_equal(grp.gr_gid, 22222);
+    assert_string_equal(grp.gr_mem[0], "member0001");
+    assert_string_equal(grp.gr_mem[1], "member0002");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    max_big_buf_len = test_data->ctx->max_nss_buf_size;
+    test_data->ctx->max_nss_buf_size = 1024;
+    ret = getgrnam_r_wrapper(test_data->ctx, "group_big", &grp, &buf, &buf_len);
+    test_data->ctx->max_nss_buf_size = max_big_buf_len;
+    assert_int_equal(ret, ERANGE);
+    free(buf);
+}
+
+void test_getgrgid_r_wrapper(void **state)
+{
+    int ret;
+    struct group grp;
+    char *buf;
+    size_t buf_len, max_big_buf_len;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getgrgid_r_wrapper(test_data->ctx, 99999, &grp, &buf, &buf_len);
+    assert_int_equal(ret, ENOENT);
+
+    ret = getgrgid_r_wrapper(test_data->ctx, 11111, &grp, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(grp.gr_name, "group");
+    assert_string_equal(grp.gr_passwd, "x");
+    assert_int_equal(grp.gr_gid, 11111);
+    assert_string_equal(grp.gr_mem[0], "member0001");
+    assert_string_equal(grp.gr_mem[1], "member0002");
+    assert_null(grp.gr_mem[2]);
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    ret = getgrgid_r_wrapper(test_data->ctx, 22222, &grp, &buf, &buf_len);
+    assert_int_equal(ret, 0);
+    assert_string_equal(grp.gr_name, "group_big");
+    assert_string_equal(grp.gr_passwd, "x");
+    assert_int_equal(grp.gr_gid, 22222);
+    assert_string_equal(grp.gr_mem[0], "member0001");
+    assert_string_equal(grp.gr_mem[1], "member0002");
+    free(buf);
+
+    ret = get_buffer(&buf_len, &buf);
+    assert_int_equal(ret, 0);
+
+    max_big_buf_len = test_data->ctx->max_nss_buf_size;
+    test_data->ctx->max_nss_buf_size = 1024;
+    ret = getgrgid_r_wrapper(test_data->ctx, 22222, &grp, &buf, &buf_len);
+    test_data->ctx->max_nss_buf_size = max_big_buf_len;
+    assert_int_equal(ret, ERANGE);
+    free(buf);
+}
+
+void test_get_user_grouplist(void **state)
+{
+    int ret;
+    size_t ngroups;
+    gid_t *groups;
+    size_t c;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    /* This is a bit odd behaviour of getgrouplist() it does not check if the
+     * user exists, only if memberships of the user can be found. */
+    ret = get_user_grouplist(test_data->ctx,
+                             "non_exisiting_user", 23456, &ngroups, &groups);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(ngroups, 1);
+    assert_int_equal(groups[0], 23456);
+    free(groups);
+
+    ret = get_user_grouplist(test_data->ctx,
+                             "member0001", 23456, &ngroups, &groups);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(ngroups, 3);
+    assert_int_equal(groups[0], 23456);
+    assert_int_equal(groups[1], 11111);
+    assert_int_equal(groups[2], 22222);
+    free(groups);
+
+    ret = get_user_grouplist(test_data->ctx,
+                             "member0003", 23456, &ngroups, &groups);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(ngroups, 2);
+    assert_int_equal(groups[0], 23456);
+    assert_int_equal(groups[1], 22222);
+    free(groups);
+
+    ret = get_user_grouplist(test_data->ctx,
+                             "user_big", 23456, &ngroups, &groups);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(ngroups, 1001);
+    assert_int_equal(groups[0], 23456);
+    for (c = 1; c < ngroups; c++) {
+        assert_int_equal(groups[c], 29999 + c);
+    }
+    free(groups);
+}
+
+static int  extdom_req_setup(void **state)
+{
+    struct test_data *test_data;
+
+    test_data = calloc(sizeof(struct test_data), 1);
+    assert_non_null(test_data);
+
+    test_data->req = calloc(sizeof(struct extdom_req), 1);
+    assert_non_null(test_data->req);
+
+    test_data->ctx = calloc(sizeof(struct ipa_extdom_ctx), 1);
+    assert_non_null(test_data->ctx);
+
+    test_data->ctx->max_nss_buf_size = MAX_BUF;
+
+    assert_int_equal(cmocka_extdom_init_context(&test_data->ctx->nss_ctx), 0);
+    assert_non_null(test_data->ctx->nss_ctx);
+
+    back_extdom_set_timeout(test_data->ctx->nss_ctx, 10000);
+    *state = test_data;
+
+    return 0;
+}
+
+static int  extdom_req_teardown(void **state)
+{
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+
+    free_req_data(test_data->req);
+    back_extdom_free_context(&test_data->ctx->nss_ctx);
+    free(test_data->ctx);
+    free(test_data);
+
+    return 0;
+}
+
+void test_set_err_msg(void **state)
+{
+    struct extdom_req *req;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+    req = test_data->req;
+
+    assert_null(req->err_msg);
+
+    set_err_msg(NULL, NULL);
+    assert_null(req->err_msg);
+
+    set_err_msg(req, NULL);
+    assert_null(req->err_msg);
+
+    set_err_msg(req, "Test [%s][%d].", "ABCD", 1234);
+    assert_non_null(req->err_msg);
+    assert_string_equal(req->err_msg, "Test [ABCD][1234].");
+
+    set_err_msg(req, "2nd Test [%s][%d].", "ABCD", 1234);
+    assert_non_null(req->err_msg);
+    assert_string_equal(req->err_msg, "Test [ABCD][1234].");
+}
+
+#define TEST_SID "S-1-2-3-4"
+#define TEST_DOMAIN_NAME "DOMAIN"
+
+char res_sid[] = {0x30, 0x0e, 0x0a, 0x01, 0x01, 0x04, 0x09, 0x53, 0x2d, 0x31, \
+                  0x2d, 0x32, 0x2d, 0x33, 0x2d, 0x34};
+char res_nam[] = {0x30, 0x13, 0x0a, 0x01, 0x02, 0x30, 0x0e, 0x04, 0x06, 0x44, \
+                  0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x04, 0x04, 0x74, 0x65, 0x73, \
+                  0x74};
+char res_uid[] = {0x30, 0x1c, 0x0a, 0x01, 0x03, 0x30, 0x17, 0x04, 0x06, 0x44, \
+                  0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x04, 0x04, 0x74, 0x65, 0x73, \
+                  0x74, 0x02, 0x02, 0x30, 0x39, 0x02, 0x03, 0x00, 0xd4, 0x31};
+char res_gid[] = {0x30, 0x1e, 0x0a, 0x01, 0x04, 0x30, 0x19, 0x04, 0x06, 0x44, \
+                  0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x04, 0x0a, 0x74, 0x65, 0x73, \
+                  0x74, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x02, 0x03, 0x00, \
+                  0xd4, 0x31};
+
+void test_encode(void **state)
+{
+    int ret;
+    struct berval *resp_val;
+    struct ipa_extdom_ctx *ctx;
+    struct test_data *test_data;
+
+    test_data = (struct test_data *) *state;
+    ctx = test_data->ctx;
+
+    ctx->max_nss_buf_size = (128*1024*1024);
+
+    ret = pack_ber_sid(TEST_SID, &resp_val);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(sizeof(res_sid), resp_val->bv_len);
+    assert_memory_equal(res_sid, resp_val->bv_val, resp_val->bv_len);
+    ber_bvfree(resp_val);
+
+    ret = pack_ber_name(TEST_DOMAIN_NAME, "test", &resp_val);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(sizeof(res_nam), resp_val->bv_len);
+    assert_memory_equal(res_nam, resp_val->bv_val, resp_val->bv_len);
+    ber_bvfree(resp_val);
+
+    ret = pack_ber_user(ctx, RESP_USER, TEST_DOMAIN_NAME, "test", 12345, 54321,
+                        NULL, NULL, NULL, NULL, &resp_val);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(sizeof(res_uid), resp_val->bv_len);
+    assert_memory_equal(res_uid, resp_val->bv_val, resp_val->bv_len);
+    ber_bvfree(resp_val);
+
+    ret = pack_ber_group(RESP_GROUP, TEST_DOMAIN_NAME, "test_group", 54321,
+                         NULL, NULL, &resp_val);
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(sizeof(res_gid), resp_val->bv_len);
+    assert_memory_equal(res_gid, resp_val->bv_val, resp_val->bv_len);
+    ber_bvfree(resp_val);
+}
+
+char req_sid[] = {0x30, 0x11, 0x0a, 0x01, 0x01, 0x0a, 0x01, 0x01, 0x04, 0x09, \
+                  0x53, 0x2d, 0x31, 0x2d, 0x32, 0x2d, 0x33, 0x2d, 0x34};
+char req_nam[] = {0x30, 0x16, 0x0a, 0x01, 0x02, 0x0a, 0x01, 0x01, 0x30, 0x0e, \
+                  0x04, 0x06, 0x44, 0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x04, 0x04, \
+                  0x74, 0x65, 0x73, 0x74};
+char req_uid[] = {0x30, 0x14, 0x0a, 0x01, 0x03, 0x0a, 0x01, 0x01, 0x30, 0x0c, \
+                  0x04, 0x06, 0x44, 0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x02, 0x02, \
+                  0x30, 0x39};
+char req_gid[] = {0x30, 0x15, 0x0a, 0x01, 0x04, 0x0a, 0x01, 0x01, 0x30, 0x0d, \
+                  0x04, 0x06, 0x44, 0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x02, 0x03, \
+                  0x00, 0xd4, 0x31};
+
+void test_decode(void **state)
+{
+    struct berval req_val;
+    struct extdom_req *req;
+    int ret;
+
+    req_val.bv_val = req_sid;
+    req_val.bv_len = sizeof(req_sid);
+
+    ret = parse_request_data(&req_val, &req);
+
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(req->input_type, INP_SID);
+    assert_int_equal(req->request_type, REQ_SIMPLE);
+    assert_string_equal(req->data.sid, "S-1-2-3-4");
+    free_req_data(req);
+
+    req_val.bv_val = req_nam;
+    req_val.bv_len = sizeof(req_nam);
+
+    ret = parse_request_data(&req_val, &req);
+
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(req->input_type, INP_NAME);
+    assert_int_equal(req->request_type, REQ_SIMPLE);
+    assert_string_equal(req->data.name.domain_name, "DOMAIN");
+    assert_string_equal(req->data.name.object_name, "test");
+    free_req_data(req);
+
+    req_val.bv_val = req_uid;
+    req_val.bv_len = sizeof(req_uid);
+
+    ret = parse_request_data(&req_val, &req);
+
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(req->input_type, INP_POSIX_UID);
+    assert_int_equal(req->request_type, REQ_SIMPLE);
+    assert_string_equal(req->data.posix_uid.domain_name, "DOMAIN");
+    assert_int_equal(req->data.posix_uid.uid, 12345);
+    free_req_data(req);
+
+    req_val.bv_val = req_gid;
+    req_val.bv_len = sizeof(req_gid);
+
+    ret = parse_request_data(&req_val, &req);
+
+    assert_int_equal(ret, LDAP_SUCCESS);
+    assert_int_equal(req->input_type, INP_POSIX_GID);
+    assert_int_equal(req->request_type, REQ_SIMPLE);
+    assert_string_equal(req->data.posix_gid.domain_name, "DOMAIN");
+    assert_int_equal(req->data.posix_gid.gid, 54321);
+    free_req_data(req);
+}
+
+int main(int argc, const char *argv[])
+{
+    const struct CMUnitTest tests[] = {
+        cmocka_unit_test(test_getpwnam_r_wrapper),
+        cmocka_unit_test(test_getpwuid_r_wrapper),
+        cmocka_unit_test(test_getgrnam_r_wrapper),
+        cmocka_unit_test(test_getgrgid_r_wrapper),
+        cmocka_unit_test(test_get_user_grouplist),
+        cmocka_unit_test_setup_teardown(test_set_err_msg,
+                                        extdom_req_setup, extdom_req_teardown),
+        cmocka_unit_test_setup_teardown(test_encode,
+                                        extdom_req_setup, extdom_req_teardown),
+        cmocka_unit_test(test_decode),
+    };
+
+    assert_non_null(original_fopen);
+    return cmocka_run_group_tests(tests, extdom_req_setup, extdom_req_teardown);
+}

daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c

@@ -0,0 +1,275 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "ipa_extdom.h"
+#include "back_extdom.h"
+#include "util.h"
+
+#define DEFAULT_MAX_NSS_BUFFER (128*1024*1024)
+#define DEFAULT_MAX_NSS_TIMEOUT (10*1000)
+
+Slapi_PluginDesc ipa_extdom_plugin_desc = {
+    IPA_EXTDOM_FEATURE_DESC,
+    "FreeIPA project",
+    "FreeIPA/1.0",
+    IPA_EXTDOM_PLUGIN_DESC
+};
+
+static char *ipa_extdom_oid_list[] = {
+    EXOP_EXTDOM_OID,
+    EXOP_EXTDOM_V1_OID,
+    NULL
+};
+
+static char *ipa_extdom_name_list[] = {
+    IPA_EXTDOM_PLUGIN_DESC,
+    NULL
+};
+
+static int ipa_extdom_start(Slapi_PBlock *pb)
+{
+    return LDAP_SUCCESS;
+}
+
+static int ipa_extdom_extop(Slapi_PBlock *pb)
+{
+    char *oid = NULL;
+    char *err_msg = NULL;
+    int rc;
+    int ret;
+    struct berval *req_val = NULL;
+    struct berval *ret_val = NULL;
+    struct extdom_req *req = NULL;
+    struct ipa_extdom_ctx *ctx;
+    enum extdom_version version;
+
+    ret = slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_OID, &oid);
+    if (ret != 0) {
+        rc = LDAP_OPERATIONS_ERROR;
+        err_msg = "Could not get OID value from request.\n";
+        goto done;
+    }
+    LOG("Received extended operation request with OID %s\n", oid);
+
+    if (strcasecmp(oid, EXOP_EXTDOM_OID) == 0) {
+        version = EXTDOM_V0;
+    } else if (strcasecmp(oid, EXOP_EXTDOM_V1_OID) == 0) {
+        version = EXTDOM_V1;
+    } else {
+        return SLAPI_PLUGIN_EXTENDED_NOT_HANDLED;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &req_val);
+    if (ret != 0) {
+        rc = LDAP_UNWILLING_TO_PERFORM;
+        err_msg = "Missing request data.\n";
+        goto done;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret != 0) {
+        rc = LDAP_OPERATIONS_ERROR;
+        err_msg = "Missing plugin context.\n";
+        goto done;
+    }
+
+    ret = parse_request_data(req_val, &req);
+    if (ret != LDAP_SUCCESS) {
+        rc = LDAP_UNWILLING_TO_PERFORM;
+        err_msg = "Cannot parse request data.\n";
+        goto done;
+    }
+
+    ret = check_request(req, version);
+    if (ret != LDAP_SUCCESS) {
+        rc = LDAP_UNWILLING_TO_PERFORM;
+        err_msg = "Error in request data.\n";
+        goto done;
+    }
+
+    ret = handle_request(ctx, req, &ret_val);
+    if (ret != LDAP_SUCCESS) {
+        if (ret == LDAP_NO_SUCH_OBJECT) {
+            rc = LDAP_NO_SUCH_OBJECT;
+        } else {
+            rc = LDAP_OPERATIONS_ERROR;
+            err_msg = "Failed to handle the request.\n";
+        }
+        goto done;
+    }
+
+    ret = slapi_pblock_set(pb, SLAPI_EXT_OP_RET_OID, oid);
+    if (ret != 0) {
+        rc = LDAP_OPERATIONS_ERROR;
+        err_msg = "Failed to set the OID for the response.\n";
+        goto done;
+    }
+
+    ret = slapi_pblock_set( pb, SLAPI_EXT_OP_RET_VALUE, ret_val);
+    if (ret != 0) {
+        rc = LDAP_OPERATIONS_ERROR;
+        err_msg = "Failed to set the value for the response.\n";
+        goto done;
+    }
+
+    rc = LDAP_SUCCESS;
+
+done:
+    if ((req != NULL) && (req->err_msg != NULL)) {
+        err_msg = req->err_msg;
+    }
+    if (err_msg != NULL) {
+        LOG("%s", err_msg);
+    }
+    slapi_send_ldap_result(pb, rc, NULL, err_msg, 0, NULL);
+    ber_bvfree(ret_val);
+    free_req_data(req);
+    return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
+}
+
+static int ipa_extdom_init_ctx(Slapi_PBlock *pb, struct ipa_extdom_ctx **_ctx)
+{
+    struct ipa_extdom_ctx *ctx;
+    Slapi_Entry *e;
+    int ret;
+    unsigned int timeout;
+
+    ctx = calloc(1, sizeof(struct ipa_extdom_ctx));
+    if (!ctx) {
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ctx->plugin_id);
+    if ((ret != 0) || (NULL == ctx->plugin_id)) {
+        LOG_FATAL("Could not get identity or identity was NULL\n");
+        if (ret == 0) {
+            ret = -1;
+        }
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &e);
+    if (!e) {
+        LOG_FATAL("Plugin configuration not found!\n");
+        ret = -1;
+        goto done;
+    }
+
+    ctx->base_dn = slapi_entry_attr_get_charptr(e, "nsslapd-basedn");
+    if (!ctx->base_dn) {
+        LOG_FATAL("Base DN not found in plugin configuration not found!\n");
+        ret = -1;
+        goto done;
+    }
+
+    ctx->max_nss_buf_size = slapi_entry_attr_get_uint(e,
+                                                      "ipaExtdomMaxNssBufSize");
+    if (ctx->max_nss_buf_size == 0) {
+        ctx->max_nss_buf_size = DEFAULT_MAX_NSS_BUFFER;
+    }
+    LOG("Maximal nss buffer size set to [%zu]!\n", ctx->max_nss_buf_size);
+
+
+    ret = back_extdom_init_context(&ctx->nss_ctx);
+    if (ret != 0) {
+        LOG("Unable to initialize nss interface: returned [%d]!\n", ret);
+        goto done;
+    }
+
+    timeout = slapi_entry_attr_get_uint(e, "ipaExtdomMaxNssTimeout");
+    if (timeout == 0) {
+        timeout = DEFAULT_MAX_NSS_TIMEOUT;
+    }
+    back_extdom_set_timeout(ctx->nss_ctx, timeout);
+    LOG("Maximal nss timeout (in ms) set to [%u]!\n", timeout);
+
+    ret = 0;
+
+done:
+    if (ret) {
+        free(ctx);
+    } else {
+        *_ctx = ctx;
+    }
+    return ret;
+}
+
+int ipa_extdom_init(Slapi_PBlock *pb)
+{
+    int ret;
+    struct ipa_extdom_ctx *extdom_ctx;
+
+    ret = ipa_extdom_init_ctx(pb, &extdom_ctx);
+    if (ret) {
+        LOG_FATAL("Failed ot initialize external domain extended operation.\n");
+        /* do not cause DS to stop, simply do nothing */
+        return 0;
+    }
+
+    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                               (void *)&ipa_extdom_plugin_desc);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                               (void *)ipa_extdom_start);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST,
+                               ipa_extdom_oid_list);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_NAMELIST,
+                               ipa_extdom_name_list);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_FN,
+                               (void *)ipa_extdom_extop);
+    }
+    if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, extdom_ctx);
+    }
+    if (ret) {
+        LOG("Failed to set plug-in version, function, and OID.\n" );
+        return -1;
+    }
+
+    return 0;
+}

daemons/ipa-slapi-plugins/ipa-lockout/Makefile.am

@@ -0,0 +1,40 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_lockout.la		\
+	$(NULL)
+
+libipa_lockout_la_SOURCES = 	\
+	ipa_lockout.c		\
+	$(NULL)
+
+libipa_lockout_la_LDFLAGS = -avoid-version
+
+libipa_lockout_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	lockout-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-lockout/Makefile.in

@@ -0,0 +1,817 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-lockout
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_lockout_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_lockout_la_OBJECTS = ipa_lockout.lo $(am__objects_1)
+libipa_lockout_la_OBJECTS = $(am_libipa_lockout_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_lockout_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_lockout_la_LDFLAGS) $(LDFLAGS) \
+	-o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_lockout_la_SOURCES)
+DIST_SOURCES = $(libipa_lockout_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_lockout.la		\
+	$(NULL)
+
+libipa_lockout_la_SOURCES = \
+	ipa_lockout.c		\
+	$(NULL)
+
+libipa_lockout_la_LDFLAGS = -avoid-version
+libipa_lockout_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	lockout-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-lockout/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-lockout/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_lockout.la: $(libipa_lockout_la_OBJECTS) $(libipa_lockout_la_DEPENDENCIES) $(EXTRA_libipa_lockout_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_lockout_la_LINK) -rpath $(plugindir) $(libipa_lockout_la_OBJECTS) $(libipa_lockout_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_lockout.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c

@@ -0,0 +1,856 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Copyright (C) 2010 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+/**
+ * IPA Lockout plug-in
+ *
+ * Update the Kerberos lockout variables on LDAP binds.
+ *
+ */
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#endif
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+#include <time.h>
+#include "slapi-plugin.h"
+#include "nspr.h"
+#include <krb5.h>
+
+#include "util.h"
+
+#define IPALOCKOUT_PLUGIN_NAME "ipa-lockout-plugin"
+#define IPALOCKOUT_PLUGIN_VERSION 0x00010000
+
+#define IPA_PLUGIN_NAME IPALOCKOUT_PLUGIN_NAME
+
+#define IPALOCKOUT_FEATURE_DESC      "IPA Lockout"
+#define IPALOCKOUT_PLUGIN_DESC       "IPA Lockout plugin"
+#define IPALOCKOUT_POSTOP_DESC       "IPA Lockout postop plugin"
+#define IPALOCKOUT_PREOP_DESC        "IPA Lockout preop plugin"
+
+static Slapi_PluginDesc pdesc = {
+    IPALOCKOUT_FEATURE_DESC,
+    "Red Hat, Inc.",
+    "1.0",
+    IPALOCKOUT_PLUGIN_DESC
+};
+
+struct ipa_context {
+    bool disable_last_success;
+    bool disable_lockout;
+};
+
+static void *_PluginID = NULL;
+static char *_PluginDN = NULL;
+
+static int g_plugin_started = 0;
+
+static struct ipa_context *global_ipactx = NULL;
+
+static char *ipa_global_policy = NULL;
+
+#define GENERALIZED_TIME_LENGTH 15
+
+/**
+ *
+ * management functions
+ *
+ */
+int ipalockout_init(Slapi_PBlock * pb);
+static int ipalockout_start(Slapi_PBlock * pb);
+static int ipalockout_close(Slapi_PBlock * pb);
+static int ipalockout_postop_init(Slapi_PBlock * pb);
+static int ipalockout_preop_init(Slapi_PBlock * pb);
+
+/**
+ *
+ * the ops (where the real work is done)
+ *
+ */
+static int ipalockout_postop(Slapi_PBlock *pb);
+static int ipalockout_preop(Slapi_PBlock *pb);
+
+/**
+ *
+ * Get the plug-in version
+ *
+ */
+int ipalockout_version(void)
+{
+    return IPALOCKOUT_PLUGIN_VERSION;
+}
+
+/**
+ * Plugin identity mgmt
+ */
+void setPluginID(void *pluginID)
+{
+    _PluginID = pluginID;
+}
+
+void *getPluginID(void)
+{
+    return _PluginID;
+}
+
+void setPluginDN(char *pluginDN)
+{
+    _PluginDN = pluginDN;
+}
+
+char *getPluginDN(void)
+{
+    return _PluginDN;
+}
+
+static int
+ipalockout_get_global_config(struct ipa_context *ipactx)
+{
+    Slapi_Value *value = NULL;
+    Slapi_Attr *attr = NULL;
+    char *dn = NULL;
+    char *basedn = NULL;
+    char *realm = NULL;
+    Slapi_DN *sdn;
+    Slapi_Entry *config_entry;
+    krb5_context krbctx = NULL;
+    krb5_error_code krberr;
+    int ret;
+
+    /* Get cn=config so we can get the default naming context */
+    sdn = slapi_sdn_new_dn_byref("cn=config");
+
+    ret = slapi_search_internal_get_entry(sdn, NULL, &config_entry,
+              getPluginID());
+
+    slapi_sdn_free(&sdn);
+
+    if (ret) {
+        goto done;
+    }
+
+    basedn = slapi_entry_attr_get_charptr(config_entry,
+        "nsslapd-defaultnamingcontext");
+
+    slapi_entry_free(config_entry);
+
+    if (!basedn) {
+        goto done;
+    }
+
+    krberr = krb5_init_context(&krbctx);
+    if (krberr) {
+        LOG_FATAL("krb5_init_context failed (%d)\n", krberr);
+        /* Yes, we failed, but it is because /etc/krb5.conf doesn't exist
+         * or is misconfigured. Start up in a degraded mode.
+         */
+    } else {
+        krberr = krb5_get_default_realm(krbctx, &realm);
+        if (krberr) {
+            LOG_FATAL("Failed to get default realm (%d)\n", krberr);
+        } else {
+            ipa_global_policy =
+                slapi_ch_smprintf("cn=global_policy,cn=%s,cn=kerberos,%s",
+                                  realm, basedn);
+            if (!ipa_global_policy) {
+                LOG_OOM();
+                ret = LDAP_OPERATIONS_ERROR;
+                goto done;
+            }
+        }
+    }
+
+    ret = asprintf(&dn, "cn=ipaConfig,cn=etc,%s", basedn);
+    if (ret == -1) {
+        LOG_OOM();
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    sdn = slapi_sdn_new_dn_byref(dn);
+
+    ret = slapi_search_internal_get_entry(sdn, NULL, &config_entry,
+              getPluginID());
+
+    slapi_sdn_free(&sdn);
+
+    if (ret) {
+        goto done;
+    }
+
+    ret = slapi_entry_attr_find(config_entry, "ipaConfigString", &attr);
+    if (ret == -1) {
+        /* no config, nothing to do */
+        ret = 0;
+        goto done;
+    }
+
+    ret = slapi_attr_first_value(attr, &value);
+    while (ret != -1) {
+        const struct berval *val;
+
+        val = slapi_value_get_berval(value);
+        if (!val) {
+            ret = LDAP_OPERATIONS_ERROR;
+            slapi_value_free(&value);
+            goto done;
+        }
+
+        if (strncasecmp("KDC:Disable Last Success",
+                        val->bv_val, val->bv_len) == 0) {
+            ipactx->disable_last_success = true;
+        }
+        else if (strncasecmp("KDC:Disable Lockout",
+                        val->bv_val, val->bv_len) == 0) {
+            ipactx->disable_lockout = true;
+        }
+
+        ret = slapi_attr_next_value(attr, ret, &value);
+    }
+    slapi_value_free(&value);
+
+    ret = 0;
+
+done:
+    if (config_entry)
+        slapi_entry_free(config_entry);
+    free(realm);
+    krb5_free_context(krbctx);
+    free(dn);
+    free(basedn);
+    return ret;
+}
+
+int ipalockout_getpolicy(Slapi_Entry *target_entry, Slapi_Entry **policy_entry,
+                         Slapi_ValueSet** values, char **actual_type_name,
+                         const char **policy_dn, int *attr_free_flags,
+                         char **errstr)
+{
+    int ldrc = 0;
+    int type_name_disposition = 0;
+    Slapi_DN *pdn = NULL;
+
+    /* Only continue if there is a password policy */
+    ldrc = slapi_vattr_values_get(target_entry, "krbPwdPolicyReference",
+                                values,
+                                &type_name_disposition, actual_type_name,
+                                SLAPI_VIRTUALATTRS_REQUEST_POINTERS,
+                                attr_free_flags);
+    if (ldrc == 0) {
+        Slapi_Value *sv = NULL;
+
+        if (values != NULL) {
+            slapi_valueset_first_value(*values, &sv);
+            *policy_dn = slapi_value_get_string(sv);
+        }
+    } else {
+        *policy_dn = ipa_global_policy;
+    }
+
+    if (*policy_dn == NULL) {
+        LOG_TRACE("No kerberos password policy\n");
+        return LDAP_SUCCESS;
+    } else {
+        pdn = slapi_sdn_new_dn_byref(*policy_dn);
+        ldrc = slapi_search_internal_get_entry(pdn, NULL, policy_entry,
+                getPluginID());
+        slapi_sdn_free(&pdn);
+        if (ldrc != LDAP_SUCCESS) {
+            LOG_FATAL("Failed to retrieve entry \"%s\": %d\n", *policy_dn, ldrc);
+            *errstr = "Failed to retrieve account policy.";
+            return LDAP_OPERATIONS_ERROR;
+        }
+    }
+
+    return LDAP_SUCCESS;
+}
+
+int
+ipalockout_init(Slapi_PBlock *pb)
+{
+    int status = EOK;
+    char *plugin_identity = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &plugin_identity);
+    PR_ASSERT(plugin_identity);
+    setPluginID(plugin_identity);
+
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_01) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                         (void *) ipalockout_start) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                         (void *) ipalockout_close) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &pdesc) != 0 ||
+        slapi_register_plugin("postoperation",
+                              1,
+                              "ipalockout_init",
+                              ipalockout_postop_init,
+                              IPALOCKOUT_POSTOP_DESC,
+                              NULL,
+                              plugin_identity
+        ) ||
+        slapi_register_plugin("preoperation",
+                              1,
+                              "ipalockout_init",
+                              ipalockout_preop_init,
+                              IPALOCKOUT_PREOP_DESC,
+                              NULL,
+                              plugin_identity
+        )
+        ) {
+        LOG_FATAL("failed to register plugin\n");
+        status = EFAIL;
+    }
+
+    LOG_TRACE("<--out--\n");
+    return status;
+}
+
+static int
+ipalockout_postop_init(Slapi_PBlock *pb)
+{
+    int status = EOK;
+
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_01) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &pdesc) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_POST_BIND_FN,
+                         (void *) ipalockout_postop) != 0) {
+        status = EFAIL;
+    }
+
+    return status;
+}
+
+static int
+ipalockout_preop_init(Slapi_PBlock *pb)
+{
+    int status = EOK;
+
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_01) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &pdesc) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_BIND_FN,
+                         (void *) ipalockout_preop) != 0) {
+        status = EFAIL;
+    }
+
+    return status;
+}
+
+static int
+ipalockout_start(Slapi_PBlock * pb)
+{
+    LOG_TRACE("--in-->\n");
+
+    /* Check if we're already started */
+    if (g_plugin_started) {
+        goto done;
+    }
+
+    g_plugin_started = 1;
+
+    global_ipactx = (struct ipa_context *)malloc(sizeof(*global_ipactx));
+    global_ipactx->disable_last_success = false;
+    global_ipactx->disable_lockout = false;
+    ipalockout_get_global_config(global_ipactx);
+
+    LOG("ready for service\n");
+    LOG_TRACE("<--out--\n");
+
+done:
+    return EOK;
+}
+
+static int
+ipalockout_close(Slapi_PBlock * pb)
+{
+    LOG_TRACE( "--in-->\n");
+
+    slapi_ch_free_string(&ipa_global_policy);
+
+    LOG_TRACE("<--out--\n");
+
+    return EOK;
+}
+
+/*
+ * In the post-operation we know whether the bind was successful or not
+ * so here we handle updating the Kerberos lockout policy attributes.
+ */
+static int ipalockout_postop(Slapi_PBlock *pb)
+{
+    char *dn = NULL;
+    const char *policy_dn = NULL;
+    Slapi_Entry *target_entry = NULL;
+    Slapi_Entry *policy_entry = NULL;
+    Slapi_DN *sdn = NULL;
+    Slapi_PBlock *pbtm = NULL;
+    Slapi_Mods *smods = NULL;
+    Slapi_Value *objectclass = NULL;
+    char *errstr = NULL;
+    int ldrc, rc = 0;
+    int ret = LDAP_SUCCESS;
+    unsigned long failedcount = 0;
+    long old_failedcount;
+    char failedcountstr[32];
+    char *failedstr = NULL;
+    int failed_bind = 0;
+    unsigned int lockout_duration = 0;
+    unsigned int max_fail = 0;
+    struct tm utctime;
+    time_t time_now;
+    char timestr[GENERALIZED_TIME_LENGTH+1];
+    unsigned int failcnt_interval = 0;
+    char *lastfail = NULL;
+    int tries = 0;
+    int failure = 1;
+    char *actual_type_name = NULL;
+    int attr_free_flags = 0;
+    Slapi_ValueSet *values = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    /* Just bail if we aren't ready to service requests yet. */
+    if (!g_plugin_started) {
+        goto done;
+    }
+
+    if (global_ipactx->disable_lockout) {
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_RESULT_CODE, &rc);
+
+    /* free the dn here */
+    if (slapi_pblock_get(pb, SLAPI_CONN_DN, &dn) != 0) {
+        LOG_FATAL("Error retrieving bind DN\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    /* dn will be NULL on failed auth, get the target instead */
+    /* don't free this dn */
+    if (dn == NULL && rc != LDAP_SUCCESS) {
+        failed_bind = 1;
+        if (slapi_pblock_get(pb, SLAPI_BIND_TARGET, &dn) != 0) {
+            LOG_FATAL("Error retrieving target DN\n");
+            ret = LDAP_OPERATIONS_ERROR;
+            goto done;
+        }
+    }
+
+    /* Client is anonymously bound */
+    if (dn == NULL) {
+        LOG_TRACE("anonymous bind\n");
+        goto done;
+    }
+
+    /* Get the entry */
+    sdn = slapi_sdn_new_dn_byref(dn);
+    if (sdn == NULL) {
+        LOG_OOM();
+        errstr = "Out of memory.\n";
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ldrc = slapi_search_internal_get_entry(sdn, NULL, &target_entry,
+            getPluginID());
+
+    if (ldrc != LDAP_SUCCESS) {
+            LOG_TRACE("Failed to retrieve entry \"%s\": %d\n", dn, ldrc);
+            goto done;
+    }
+
+    /* Only update kerberos principal entries */
+    objectclass = slapi_value_new_string("krbPrincipalAux");
+    if ((slapi_entry_attr_has_syntax_value(target_entry, SLAPI_ATTR_OBJECTCLASS, objectclass)) != 1) {
+        LOG_TRACE("Not a kerberos user\n");
+        slapi_value_free(&objectclass);
+        goto done;
+    }
+    slapi_value_free(&objectclass);
+
+    ldrc = ipalockout_getpolicy(target_entry, &policy_entry,
+                                &values, &actual_type_name,
+                                &policy_dn, &attr_free_flags,
+                                &errstr);
+    if (ldrc != LDAP_SUCCESS || policy_dn == NULL) {
+        goto done;
+    }
+
+    max_fail = slapi_entry_attr_get_uint(policy_entry, "krbPwdMaxFailure");
+    lockout_duration = slapi_entry_attr_get_uint(policy_entry, "krbPwdLockoutDuration");
+    failedcount = slapi_entry_attr_get_ulong(target_entry, "krbLoginFailedCount");
+    old_failedcount = failedcount;
+
+    /* Fetch the string value for krbLoginFailedCount to see if the attribute
+     * exists in LDAP at all. We get a 0 if it doesn't exist as a long so we
+     * don't know whether to try delete the existing value later
+     */
+    failedstr = slapi_entry_attr_get_charptr(target_entry, "krbLoginFailedCount");
+    failcnt_interval = slapi_entry_attr_get_uint(policy_entry, "krbPwdFailureCountInterval");
+    lastfail = slapi_entry_attr_get_charptr(target_entry, "krbLastFailedAuth");
+    time_now = time(NULL);
+    if (lastfail != NULL) {
+        struct tm tm;
+        int res = 0;
+
+        memset(&tm, 0, sizeof(struct tm));
+        res = sscanf(lastfail,
+                     "%04u%02u%02u%02u%02u%02u",
+                     &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
+                     &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
+
+        if (res == 6) {
+            tm.tm_year -= 1900;
+            tm.tm_mon -= 1;
+
+            if (failedcount >= max_fail) {
+                if ((lockout_duration == 0) ||
+                    (time_now < timegm(&tm) + lockout_duration)) {
+                    /* Within lockout duration */
+                    goto done;
+                }
+            }
+            if (time_now > timegm(&tm) + failcnt_interval) {
+                /* Not within lockout duration, outside of fail interval */
+                failedcount = 0;
+            }
+        }
+    }
+
+    while (tries < 5) {
+        smods = slapi_mods_new();
+
+        /* On failures try very hard to update the entry so that failures
+         * are counted properly. This involves doing a DELETE of the value
+         * we expect and an ADD of the new one in the same update. If the
+         * record has changed while we were handling the request our
+         * update will fail and we will try again.
+         *
+         * On a successful bind just do a replace and set failurecount to 0.
+         */
+        if (failed_bind) {
+            if (failedcount < max_fail) {
+                PR_snprintf(failedcountstr, sizeof(failedcountstr), "%lu", old_failedcount);
+                if (failedstr != NULL) {
+                    slapi_mods_add_string(smods, LDAP_MOD_DELETE, "krbLoginFailedCount", failedcountstr);
+                }
+                failedcount += 1;
+                PR_snprintf(failedcountstr, sizeof(failedcountstr), "%lu", failedcount);
+                slapi_mods_add_string(smods, LDAP_MOD_ADD, "krbLoginFailedCount", failedcountstr);
+                if (lastfail) {
+                    slapi_mods_add_string(smods, LDAP_MOD_DELETE, "krbLastFailedAuth", lastfail);
+                }
+                if (!gmtime_r(&(time_now), &utctime)) {
+                    errstr = "failed to parse current date (buggy gmtime_r ?)\n";
+                    LOG_FATAL("%s", errstr);
+                    ret = LDAP_OPERATIONS_ERROR;
+                    goto done;
+                }
+                strftime(timestr, GENERALIZED_TIME_LENGTH+1,
+                     "%Y%m%d%H%M%SZ", &utctime);
+                slapi_mods_add_string(smods, LDAP_MOD_ADD, "krbLastFailedAuth", timestr);
+            }
+        } else {
+            if (old_failedcount != 0) {
+                PR_snprintf(failedcountstr, sizeof(failedcountstr), "%lu", 0L);
+                slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbLoginFailedCount", failedcountstr);
+            }
+            if (!global_ipactx->disable_last_success) {
+                time_now = time(NULL);
+                if (!gmtime_r(&(time_now), &utctime)) {
+                    errstr = "failed to parse current date (buggy gmtime_r ?)\n";
+                    LOG_FATAL("%s", errstr);
+                    ret = LDAP_OPERATIONS_ERROR;
+                    goto done;
+                }
+                strftime(timestr, GENERALIZED_TIME_LENGTH+1,
+                     "%Y%m%d%H%M%SZ", &utctime);
+                slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbLastSuccessfulAuth", timestr);
+            }
+        }
+
+        if (slapi_mods_get_num_mods(smods) == 0) {
+            LOG_TRACE("No account modification required\n");
+            goto done;
+        }
+
+        pbtm = slapi_pblock_new();
+        slapi_modify_internal_set_pb (pbtm, slapi_entry_get_dn_const(target_entry),
+        slapi_mods_get_ldapmods_byref(smods),
+        NULL, /* Controls */
+        NULL, /* UniqueID */
+        getPluginID(), /* PluginID */
+        0); /* Flags */
+
+        slapi_modify_internal_pb (pbtm);
+        slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+
+        if (rc != LDAP_SUCCESS) {
+            LOG_TRACE("WARNING: modify error %d on entry '%s'\n",
+                      rc, slapi_entry_get_dn_const(target_entry));
+
+            ldrc = slapi_search_internal_get_entry(sdn, NULL, &target_entry,
+                    getPluginID());
+
+            if (ldrc != LDAP_SUCCESS) {
+                LOG_FATAL("Failed to retrieve entry \"%s\": %d\n", dn, ldrc);
+                goto done;
+            }
+            slapi_mods_free(&smods);
+            slapi_pblock_destroy(pbtm);
+            if (lastfail) slapi_ch_free_string(&lastfail);
+            smods = NULL;
+            pbtm = NULL;
+            lastfail = NULL;
+            tries += 1;
+        } else {
+            LOG_TRACE("<= apply mods: Successful\n");
+            failure = 0;
+            break;
+        }
+    } /* while */
+
+    if (failure) {
+        LOG_FATAL("Unable to change lockout attributes\n");
+        ret = LDAP_OPERATIONS_ERROR;
+    }
+
+done:
+    if (!failed_bind && dn != NULL) slapi_ch_free_string(&dn);
+    slapi_entry_free(target_entry);
+    slapi_entry_free(policy_entry);
+    if (values != NULL) {
+        slapi_vattr_values_free(&values, &actual_type_name, attr_free_flags);
+    }
+    if (sdn) slapi_sdn_free(&sdn);
+    if (lastfail) slapi_ch_free_string(&lastfail);
+    if (pbtm) slapi_pblock_destroy(pbtm);
+    if (smods) slapi_mods_free(&smods);
+    if (failedstr) slapi_ch_free_string(&failedstr);
+
+    LOG("postop returning %d: %s\n", ret, errstr ? errstr : "success\n");
+
+    if (ret) {
+        slapi_send_ldap_result(pb, ret, NULL, errstr, 0, NULL);
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return (ret == 0 ? EOK : EFAIL);
+}
+
+/*
+ * In the pre-op stage the bind hasn't occurred yet. It is here that
+ * we do the lockout enforcement.
+ */
+static int ipalockout_preop(Slapi_PBlock *pb)
+{
+    char *dn = NULL;
+    const char *policy_dn = NULL;
+    Slapi_Entry *target_entry = NULL;
+    Slapi_Entry *policy_entry = NULL;
+    Slapi_DN *sdn = NULL;
+    Slapi_Value *objectclass = NULL;
+    char *errstr = NULL;
+    int ldrc = 0;
+    int ret = LDAP_SUCCESS;
+    unsigned long failedcount = 0;
+    time_t time_now;
+    unsigned int max_fail = 0;
+    unsigned int lockout_duration = 0;
+    time_t last_failed = 0;
+    char *lastfail = NULL;
+    char *unlock_time = NULL;
+    char *actual_type_name = NULL;
+    int attr_free_flags = 0;
+    Slapi_ValueSet *values = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    /* Just bail if we aren't ready to service requests yet. */
+    if (!g_plugin_started) {
+        goto done;
+    }
+
+    if (global_ipactx->disable_lockout) {
+        goto done;
+    }
+
+    if (slapi_pblock_get(pb, SLAPI_BIND_TARGET, &dn) != 0) {
+        LOG_FATAL("Error retrieving target DN\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    /* Client is anonymously bound */
+    if (dn == NULL) {
+        LOG_TRACE("anonymous bind\n");
+        goto done;
+    }
+
+    /* Get the entry */
+    sdn = slapi_sdn_new_dn_byref(dn);
+    if (sdn == NULL) {
+        LOG_OOM();
+        errstr = "Out of memory.\n";
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ldrc = slapi_search_internal_get_entry(sdn, NULL, &target_entry,
+            getPluginID());
+
+    if (ldrc != LDAP_SUCCESS) {
+        LOG_TRACE("Failed to retrieve entry \"%s\": %d\n", dn, ldrc);
+        goto done;
+    }
+
+    /* Only handle kerberos principal entries */
+    objectclass = slapi_value_new_string("krbPrincipalAux");
+    if ((slapi_entry_attr_has_syntax_value(target_entry, SLAPI_ATTR_OBJECTCLASS, objectclass)) != 1) {
+        LOG_TRACE("Not a kerberos user\n");
+        slapi_value_free(&objectclass);
+        goto done;
+    }
+    slapi_value_free(&objectclass);
+
+    ldrc = ipalockout_getpolicy(target_entry, &policy_entry,
+                                &values, &actual_type_name,
+                                &policy_dn, &attr_free_flags,
+                                &errstr);
+    if (ldrc != LDAP_SUCCESS || policy_dn == NULL) {
+        goto done;
+    }
+
+    failedcount = slapi_entry_attr_get_ulong(target_entry, "krbLoginFailedCount");
+    time_now = time(NULL);
+    lockout_duration = slapi_entry_attr_get_uint(policy_entry, "krbPwdLockoutDuration");
+
+    lastfail = slapi_entry_attr_get_charptr(target_entry, "krbLastFailedAuth");
+    unlock_time = slapi_entry_attr_get_charptr(target_entry, "krbLastAdminUnlock");
+    if (lastfail != NULL) {
+        struct tm tm;
+        int res = 0;
+
+        memset(&tm, 0, sizeof(struct tm));
+        res = sscanf(lastfail,
+                     "%04u%02u%02u%02u%02u%02u",
+                     &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
+                     &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
+
+        if (res == 6) {
+            tm.tm_year -= 1900;
+            tm.tm_mon -= 1;
+
+            last_failed = timegm(&tm);
+        }
+    }
+
+    if (lastfail != NULL && unlock_time != NULL) {
+        time_t unlock;
+        struct tm tm;
+        int res = 0;
+
+        memset(&tm, 0, sizeof(struct tm));
+        res = sscanf(unlock_time,
+                     "%04u%02u%02u%02u%02u%02u",
+                     &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
+                     &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
+
+        if (res == 6) {
+            tm.tm_year -= 1900;
+            tm.tm_mon -= 1;
+
+            unlock = timegm(&tm);
+            if (last_failed <= unlock) {
+                /* Administratively unlocked */
+                goto done;
+            }
+        }
+        slapi_ch_free_string(&unlock_time);
+    }
+
+    max_fail = slapi_entry_attr_get_uint(policy_entry, "krbPwdMaxFailure");
+    if (max_fail == 0) {
+        goto done;
+    }
+
+    if (failedcount >= max_fail) {
+        if (lockout_duration == 0) {
+            errstr = "Entry permanently locked.\n";
+            ret = LDAP_UNWILLING_TO_PERFORM;
+            goto done;
+        }
+
+        if (time_now < last_failed + lockout_duration) {
+            /* Too many failures */
+            LOG_TRACE("Too many failed logins. %lu out of %d\n", failedcount, max_fail);
+            errstr = "Too many failed logins.\n";
+            ret = LDAP_UNWILLING_TO_PERFORM;
+        }
+    }
+
+done:
+    if (lastfail) slapi_ch_free_string(&lastfail);
+    slapi_entry_free(target_entry);
+    slapi_entry_free(policy_entry);
+    if (values != NULL) {
+        slapi_vattr_values_free(&values, &actual_type_name, attr_free_flags);
+    }
+    if (sdn) slapi_sdn_free(&sdn);
+
+    LOG("preop returning %d: %s\n", ret, errstr ? errstr : "success\n");
+
+    if (ret) {
+        slapi_send_ldap_result(pb, ret, NULL, errstr, 0, NULL);
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return (ret == 0 ? EOK : EFAIL);
+}

daemons/ipa-slapi-plugins/ipa-lockout/lockout-conf.ldif

@@ -0,0 +1,15 @@
+dn: cn=IPA Lockout,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA Lockout
+nsslapd-pluginpath: libipa_lockout
+nsslapd-plugininitfunc: ipalockout_init
+nsslapd-plugintype: object
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipalockout_version
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA Lockout plugin
+nsslapd-plugin-depends-on-type: database

daemons/ipa-slapi-plugins/ipa-modrdn/Makefile.am

@@ -0,0 +1,40 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_modrdn.la		\
+	$(NULL)
+
+libipa_modrdn_la_SOURCES = 	\
+	ipa_modrdn.c		\
+	$(NULL)
+
+libipa_modrdn_la_LDFLAGS = -avoid-version
+
+libipa_modrdn_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	modrdn-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-modrdn/Makefile.in

@@ -0,0 +1,817 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-modrdn
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_modrdn_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_modrdn_la_OBJECTS = ipa_modrdn.lo $(am__objects_1)
+libipa_modrdn_la_OBJECTS = $(am_libipa_modrdn_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_modrdn_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_modrdn_la_LDFLAGS) $(LDFLAGS) \
+	-o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_modrdn_la_SOURCES)
+DIST_SOURCES = $(libipa_modrdn_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_modrdn.la		\
+	$(NULL)
+
+libipa_modrdn_la_SOURCES = \
+	ipa_modrdn.c		\
+	$(NULL)
+
+libipa_modrdn_la_LDFLAGS = -avoid-version
+libipa_modrdn_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	modrdn-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-modrdn/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-modrdn/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_modrdn.la: $(libipa_modrdn_la_OBJECTS) $(libipa_modrdn_la_DEPENDENCIES) $(EXTRA_libipa_modrdn_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_modrdn_la_LINK) -rpath $(plugindir) $(libipa_modrdn_la_OBJECTS) $(libipa_modrdn_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_modrdn.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-modrdn/ipa_modrdn.c

@@ -0,0 +1,814 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Copyright (C) 2010 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+/**
+ * IPA MODRDN plug-in
+ */
+#include <string.h>
+#include <stdbool.h>
+#include "slapi-plugin.h"
+#include "nspr.h"
+#include "prclist.h"
+#include <pthread.h>
+
+#include "util.h"
+
+#define IPA_PLUGIN_NAME "ipa-modrdn-plugin"
+#define IPAMODRDN_PLUGIN_VERSION 0x00010000
+
+#define IPAMODRDN_DN "cn=IPA MODRDN,cn=plugins,cn=config" /* temporary */
+
+/**
+ * IPA MODRDN config types
+ */
+#define IPAMODRDN_SATTR            "ipaModRDNsourceAttr"
+#define IPAMODRDN_TATTR            "ipaModRDNtargetAttr"
+#define IPAMODRDN_PREFIX           "ipaModRDNprefix"
+#define IPAMODRDN_SUFFIX           "ipaModRDNsuffix"
+#define IPAMODRDN_FILTER           "ipaModRDNfilter"
+#define IPAMODRDN_SCOPE            "ipaModRDNscope"
+
+#define IPAMODRDN_FEATURE_DESC      "IPA MODRDN"
+#define IPAMODRDN_PLUGIN_DESC       "IPA MODRDN plugin"
+#define IPAMODRDN_POSTOP_DESC       "IPA MODRDN postop plugin"
+
+static Slapi_PluginDesc pdesc = {
+    IPAMODRDN_FEATURE_DESC,
+    "Red Hat, Inc.",
+    "1.0",
+    IPAMODRDN_PLUGIN_DESC
+};
+
+/**
+ * linked list of config entries
+ */
+
+struct configEntry {
+    PRCList list;
+    char *dn;
+    char *sattr;
+    char *tattr;
+    char *prefix;
+    char *suffix;
+    char *filter;
+    Slapi_Filter *slapi_filter;
+    char *scope;
+};
+
+static PRCList *ipamodrdn_global_config = NULL;
+static pthread_rwlock_t g_ipamodrdn_cache_lock;
+
+static void *_PluginID = NULL;
+static char *_PluginDN = NULL;
+
+static int g_plugin_started = 0;
+
+
+/**
+ *
+ * management functions
+ *
+ */
+int ipamodrdn_init(Slapi_PBlock * pb);
+static int ipamodrdn_start(Slapi_PBlock * pb);
+static int ipamodrdn_close(Slapi_PBlock * pb);
+
+/**
+ *
+ * Local operation functions
+ *
+ */
+static int ipamodrdn_load_plugin_config(void);
+static int ipamodrdn_parse_config_entry(Slapi_Entry * e, bool apply);
+static void ipamodrdn_delete_config(void);
+static void ipamodrdn_free_config_entry(struct configEntry ** entry);
+
+/**
+ *
+ * helpers
+ *
+ */
+static char *ipamodrdn_get_dn(Slapi_PBlock * pb);
+static int ipamodrdn_dn_is_config(char *dn);
+
+/**
+ *
+ * the ops (where the real work is done)
+ *
+ */
+static int ipamodrdn_config_check_post_op(Slapi_PBlock * pb);
+static int ipamodrdn_post_op(Slapi_PBlock * pb);
+
+/**
+ * debug functions - global, for the debugger
+ */
+void ipamodrdn_dump_config(void);
+void ipamodrdn_dump_config_entry(struct configEntry *);
+
+/**
+ *
+ * Deal with cache locking
+ *
+ */
+void ipamodrdn_read_lock(void)
+{
+    pthread_rwlock_rdlock(&g_ipamodrdn_cache_lock);
+}
+
+void ipamodrdn_write_lock(void)
+{
+    pthread_rwlock_wrlock(&g_ipamodrdn_cache_lock);
+}
+
+void ipamodrdn_unlock(void)
+{
+    pthread_rwlock_unlock(&g_ipamodrdn_cache_lock);
+}
+
+/**
+ *
+ * Get the plug-in version
+ *
+ */
+int ipamodrdn_version(void)
+{
+    return IPAMODRDN_PLUGIN_VERSION;
+}
+
+/**
+ * Plugin identity mgmt
+ */
+void setPluginID(void *pluginID)
+{
+    _PluginID = pluginID;
+}
+
+void *getPluginID(void)
+{
+    return _PluginID;
+}
+
+void setPluginDN(char *pluginDN)
+{
+    _PluginDN = pluginDN;
+}
+
+char *getPluginDN(void)
+{
+    return _PluginDN;
+}
+
+/*
+	ipamodrdn_init
+	-------------
+	adds our callbacks to the list
+*/
+int
+ipamodrdn_init(Slapi_PBlock *pb)
+{
+    int status = EOK;
+    char *plugin_identity = NULL;
+    Slapi_Entry *plugin_entry = NULL;
+    char *plugin_type = NULL;
+    int delfn = SLAPI_PLUGIN_POST_DELETE_FN;
+    int mdnfn = SLAPI_PLUGIN_POST_MODRDN_FN;
+    int modfn = SLAPI_PLUGIN_POST_MODIFY_FN;
+    int addfn = SLAPI_PLUGIN_POST_ADD_FN;
+
+    LOG_TRACE("--in-->\n");
+
+        /**
+	 * Store the plugin identity for later use.
+	 * Used for internal operations
+	 */
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &plugin_identity);
+    PR_ASSERT(plugin_identity);
+    setPluginID(plugin_identity);
+
+    if ((slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &plugin_entry) == 0) &&
+        plugin_entry &&
+        (plugin_type = slapi_entry_attr_get_charptr(plugin_entry, "nsslapd-plugintype")) &&
+        plugin_type && strstr(plugin_type, "betxn"))
+    {
+        addfn = SLAPI_PLUGIN_BE_TXN_POST_ADD_FN;
+        mdnfn = SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN;
+        delfn = SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN;
+        modfn = SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN;
+    }
+    slapi_ch_free_string(&plugin_type);
+
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_01) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &pdesc) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                         (void *) ipamodrdn_start) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                         (void *) ipamodrdn_close) != 0 ||
+        slapi_pblock_set(pb, addfn,
+                         (void *) ipamodrdn_config_check_post_op) != 0 ||
+        slapi_pblock_set(pb, mdnfn,
+                         (void *) ipamodrdn_post_op) != 0 ||
+        slapi_pblock_set(pb, delfn,
+                         (void *) ipamodrdn_config_check_post_op) != 0 ||
+        slapi_pblock_set(pb, modfn,
+                         (void *) ipamodrdn_config_check_post_op) != 0) {
+        LOG_FATAL("failed to register plugin\n");
+        status = EFAIL;
+    }
+
+    LOG_TRACE("<--out--\n");
+    return status;
+}
+
+
+/*
+	ipamodrdn_start
+	--------------
+	Kicks off the config cache.
+	It is called after ipamodrdn_init.
+*/
+static int
+ipamodrdn_start(Slapi_PBlock * pb)
+{
+    char *plugindn = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    /* Check if we're already started */
+    if (g_plugin_started) {
+        goto done;
+    }
+
+    if (pthread_rwlock_init(&g_ipamodrdn_cache_lock, NULL) != 0) {
+        LOG_FATAL("lock creation failed\n");
+
+        return EFAIL;
+    }
+
+    /**
+	 *	Get the plug-in target dn from the system
+	 *	and store it for future use. This should avoid
+	 *	hardcoding of DN's in the code.
+	 */
+    slapi_pblock_get(pb, SLAPI_TARGET_DN, &plugindn);
+    if (NULL == plugindn || 0 == strlen(plugindn)) {
+        LOG("had to use hard coded config dn\n");
+        plugindn = IPAMODRDN_DN;
+    } else {
+        LOG("config at %s\n", plugindn);
+
+    }
+
+    setPluginDN(plugindn);
+
+    /*
+     * Load the config for our plug-in
+     */
+    ipamodrdn_global_config = (PRCList *)
+        slapi_ch_calloc(1, sizeof(struct configEntry));
+    PR_INIT_CLIST(ipamodrdn_global_config);
+
+    if (ipamodrdn_load_plugin_config() != EOK) {
+        LOG_FATAL("unable to load plug-in configuration\n");
+        return EFAIL;
+    }
+
+    g_plugin_started = 1;
+    LOG("ready for service\n");
+    LOG_TRACE("<--out--\n");
+
+done:
+    return EOK;
+}
+
+/*
+	ipamodrdn_close
+	--------------
+	closes down the cache
+*/
+static int
+ipamodrdn_close(Slapi_PBlock * pb)
+{
+    LOG_TRACE( "--in-->\n");
+
+    ipamodrdn_delete_config();
+
+    slapi_ch_free((void **)&ipamodrdn_global_config);
+
+    LOG_TRACE("<--out--\n");
+
+    return EOK;
+}
+
+/*
+ * config looks like this
+ * - cn=myplugin
+ * --- cn=posix
+ * ------ cn=accounts
+ * ------ cn=groups
+ * --- cn=samba
+ * --- cn=etc
+ * ------ cn=etc etc
+ */
+static int
+ipamodrdn_load_plugin_config(void)
+{
+    int status = EOK;
+    int result;
+    int i;
+    Slapi_PBlock *search_pb;
+    Slapi_Entry **entries = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    ipamodrdn_write_lock();
+    ipamodrdn_delete_config();
+
+    search_pb = slapi_pblock_new();
+
+    slapi_search_internal_set_pb(search_pb, getPluginDN(),
+                                 LDAP_SCOPE_SUBTREE, "objectclass=*",
+                                 NULL, 0, NULL, NULL, getPluginID(), 0);
+    slapi_search_internal_pb(search_pb);
+    slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+
+    if (LDAP_SUCCESS != result) {
+        status = EFAIL;
+        goto cleanup;
+    }
+
+    slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                     &entries);
+    if (NULL == entries || NULL == entries[0]) {
+        status = EOK;
+        goto cleanup;
+    }
+
+    for (i = 0; (entries[i] != NULL); i++) {
+        /* We don't care about the status here because we may have
+         * some invalid config entries, but we just want to continue
+         * looking for valid ones. */
+        ipamodrdn_parse_config_entry(entries[i], true);
+    }
+
+  cleanup:
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+    ipamodrdn_unlock();
+    LOG_TRACE("<--out--\n");
+
+    return status;
+}
+
+/*
+ * ipamodrdn_parse_config_entry()
+ *
+ * Parses a single config entry.  If apply is non-zero, then
+ * we will load and start using the new config.  You can simply
+ * validate config without making any changes by setting apply
+ * to 0.
+ *
+ * Returns EOK if the entry is valid and EFAIL
+ * if it is invalid.
+ */
+static int
+ipamodrdn_parse_config_entry(Slapi_Entry * e, bool apply)
+{
+    char *value;
+    struct configEntry *entry = NULL;
+    struct configEntry *config_entry;
+    PRCList *list;
+    int entry_added = 0;
+    int ret = EOK;
+
+    LOG_TRACE("--in-->\n");
+
+    /* If this is the main MODRDN plug-in config entry, just bail. */
+    if (strcasecmp(getPluginDN(), slapi_entry_get_ndn(e)) == 0) {
+        ret = EFAIL;
+        goto bail;
+    }
+
+    entry = (struct configEntry *)
+    slapi_ch_calloc(1, sizeof(struct configEntry));
+    if (NULL == entry) {
+        ret = EFAIL;
+        goto bail;
+    }
+
+    value = slapi_entry_get_ndn(e);
+    if (value) {
+        entry->dn = slapi_ch_strdup(value);
+    }
+
+    LOG_CONFIG("----------> dn [%s]\n", entry->dn);
+
+    entry->sattr = slapi_entry_attr_get_charptr(e, IPAMODRDN_SATTR);
+    if (!entry->sattr) {
+        LOG_FATAL("The %s config setting is required for %s.\n",
+                  IPAMODRDN_SATTR, entry->dn);
+        ret = EFAIL;
+        goto bail;
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_SATTR, entry->sattr);
+
+    entry->tattr = slapi_entry_attr_get_charptr(e, IPAMODRDN_TATTR);
+    if (!entry->tattr) {
+        LOG_FATAL("The %s config setting is required for %s.\n",
+                  IPAMODRDN_TATTR, entry->dn);
+        ret = EFAIL;
+        goto bail;
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_TATTR, entry->tattr);
+
+    value = slapi_entry_attr_get_charptr(e, IPAMODRDN_PREFIX);
+    if (value && value[0]) {
+        entry->prefix = value;
+    } else {
+        entry->prefix = slapi_ch_strdup("");
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_PREFIX, entry->prefix);
+
+    value = slapi_entry_attr_get_charptr(e, IPAMODRDN_SUFFIX);
+    if (value && value[0]) {
+        entry->suffix = value;
+    } else {
+        entry->suffix = slapi_ch_strdup("");
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_SUFFIX, entry->suffix);
+
+    value = slapi_entry_attr_get_charptr(e, IPAMODRDN_FILTER);
+    if (value) {
+        entry->filter = value;
+        if (NULL == (entry->slapi_filter = slapi_str2filter(value))) {
+            LOG_FATAL("Error: Invalid search filter in entry [%s]: [%s]\n",
+                      entry->dn, value);
+            ret = EFAIL;
+            goto bail;
+        }
+    } else {
+        LOG_FATAL("The %s config setting is required for %s.\n",
+                  IPAMODRDN_FILTER, entry->dn);
+        ret = EFAIL;
+        goto bail;
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_FILTER, value);
+
+    value = slapi_entry_attr_get_charptr(e, IPAMODRDN_SCOPE);
+    if (value) {
+        entry->scope = value;
+    } else {
+        LOG_FATAL("The %s config config setting is required for %s.\n",
+                  IPAMODRDN_SCOPE, entry->dn);
+        ret = EFAIL;
+        goto bail;
+    }
+    LOG_CONFIG("----------> %s [%s]\n", IPAMODRDN_SCOPE, entry->scope);
+
+    /* If we were only called to validate config, we can
+     * just bail out before applying the config changes */
+    if (!apply) {
+        goto bail;
+    }
+
+    /**
+     * Finally add the entry to the list.
+     * We sort by scope dn length with longer
+     * dn's first - this allows the scope
+     * checking code to be simple and quick and
+     * cunningly linear.
+     */
+    if (!PR_CLIST_IS_EMPTY(ipamodrdn_global_config)) {
+        list = PR_LIST_HEAD(ipamodrdn_global_config);
+        while (list != ipamodrdn_global_config) {
+            config_entry = (struct configEntry *) list;
+
+            if (slapi_dn_issuffix(entry->scope, config_entry->scope)) {
+                PR_INSERT_BEFORE(&(entry->list), list);
+                LOG_CONFIG("store [%s] before [%s] \n",
+                           entry->scope, config_entry->scope);
+                entry_added = 1;
+                break;
+            }
+
+            list = PR_NEXT_LINK(list);
+
+            if (ipamodrdn_global_config == list) {
+                /* add to tail */
+                PR_INSERT_BEFORE(&(entry->list), list);
+                LOG_CONFIG("store [%s] at tail\n", entry->scope);
+                entry_added = 1;
+                break;
+            }
+        }
+    } else {
+        /* first entry */
+        PR_INSERT_LINK(&(entry->list), ipamodrdn_global_config);
+        LOG_CONFIG("store [%s] at head \n", entry->scope);
+        entry_added = 1;
+    }
+
+bail:
+    if (0 == entry_added) {
+        /* Don't log error if we weren't asked to apply config */
+        if (apply && (entry != NULL)) {
+            LOG_FATAL("Invalid config entry [%s] skipped\n", entry->dn);
+        }
+        ipamodrdn_free_config_entry(&entry);
+    } else {
+        ret = EOK;
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return ret;
+}
+
+static void
+ipamodrdn_free_config_entry(struct configEntry **entry)
+{
+    struct configEntry *e;
+
+    if (!entry || !*entry) {
+        return;
+    }
+
+    e = *entry;
+
+    if (e->dn) {
+        LOG_CONFIG("freeing config entry [%s]\n", e->dn);
+    }
+    slapi_ch_free_string(&e->dn);
+    slapi_ch_free_string(&e->sattr);
+    slapi_ch_free_string(&e->tattr);
+    slapi_ch_free_string(&e->prefix);
+    slapi_ch_free_string(&e->suffix);
+    slapi_ch_free_string(&e->filter);
+    slapi_filter_free(e->slapi_filter, 1);
+    slapi_ch_free_string(&e->scope);
+    slapi_ch_free((void **)entry);
+}
+
+static void
+ipamodrdn_delete_configEntry(PRCList *entry)
+{
+    PR_REMOVE_LINK(entry);
+    ipamodrdn_free_config_entry((struct configEntry **) &entry);
+}
+
+static void
+ipamodrdn_delete_config(void)
+{
+    PRCList *list;
+
+    while (!PR_CLIST_IS_EMPTY(ipamodrdn_global_config)) {
+        list = PR_LIST_HEAD(ipamodrdn_global_config);
+        ipamodrdn_delete_configEntry(list);
+    }
+
+    return;
+}
+
+/****************************************************
+	Helpers
+****************************************************/
+
+static char *ipamodrdn_get_dn(Slapi_PBlock * pb)
+{
+    char *dn = NULL;
+
+    LOG_TRACE("--in-->\n");
+
+    if (slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn)) {
+        LOG_FATAL("failed to get dn of changed entry");
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return dn;
+}
+
+/* config check
+        matching config dn or a descendent reloads config
+*/
+static int ipamodrdn_dn_is_config(char *dn)
+{
+    int ret = 0;
+
+    LOG_TRACE("--in-->\n");
+
+    if (slapi_dn_issuffix(dn, getPluginDN())) {
+        ret = 1;
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return ret;
+}
+
+/****************************************************
+        Functions that actually do things other
+        than config and startup
+****************************************************/
+
+static int
+ipamodrdn_change_attr(struct configEntry *cfgentry,
+                      char *targetdn, const char *value)
+{
+    Slapi_PBlock *mod_pb = slapi_pblock_new();
+    LDAPMod mod;
+    LDAPMod *mods[2];
+    char *val[2] = { NULL };
+    int ret;
+
+    val[0] = slapi_ch_smprintf("%s%s%s",
+                               cfgentry->prefix, value, cfgentry->suffix);
+    if (!val[0]) {
+        LOG_OOM();
+        ret = EFAIL;
+        goto done;
+    }
+    val[1] = 0;
+
+    mod.mod_op = LDAP_MOD_REPLACE;
+    mod.mod_type = cfgentry->tattr;
+    mod.mod_values = val;
+
+    mods[0] = &mod;
+    mods[1] = 0;
+
+    LOG("Setting %s to %s in entry (%s)\n", cfgentry->tattr, value, targetdn);
+
+    /* Perform the modify operation. */
+    slapi_modify_internal_set_pb(mod_pb, targetdn, mods,
+                                 0, 0, getPluginID(), 0);
+    slapi_modify_internal_pb(mod_pb);
+    slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &ret);
+    if (ret != LDAP_SUCCESS) {
+        LOG_FATAL("Failed to change attribute with error %d\n", ret);
+        ret = EFAIL;
+    }
+    ret = EOK;
+
+done:
+    if (val[0]) slapi_ch_free_string(&(val[0]));
+    slapi_pblock_destroy(mod_pb);
+    return ret;
+}
+
+
+
+
+/* for mods and adds:
+	where dn's are supplied, the closest in scope
+	is used as long as the type filter matches
+        and the attr value has not been generated yet.
+*/
+
+static int ipamodrdn_post_op(Slapi_PBlock *pb)
+{
+    char *dn = NULL;
+    PRCList *list = NULL;
+    struct configEntry *cfgentry = NULL;
+    struct slapi_entry *e = NULL;
+    Slapi_Attr *sattr = NULL;
+    Slapi_Attr *tattr = NULL;
+    int ret = LDAP_SUCCESS;
+
+    LOG_TRACE("--in-->\n");
+
+    /* Just bail if we aren't ready to service requests yet. */
+    if (!g_plugin_started) {
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &e);
+    if (NULL == e) {
+        goto done;
+    }
+
+    dn = slapi_entry_get_ndn(e);
+    if (NULL == dn) {
+        goto done;
+    }
+
+    ipamodrdn_read_lock();
+
+    if (!PR_CLIST_IS_EMPTY(ipamodrdn_global_config)) {
+        list = PR_LIST_HEAD(ipamodrdn_global_config);
+
+        for(list = PR_LIST_HEAD(ipamodrdn_global_config);
+            list != ipamodrdn_global_config;
+            list = PR_NEXT_LINK(list)) {
+            cfgentry = (struct configEntry *) list;
+
+            /* is the entry in scope? */
+            if (cfgentry->scope) {
+                if (!slapi_dn_issuffix(dn, cfgentry->scope)) {
+                    continue;
+                }
+            }
+
+            /* does the entry match the filter? */
+            if (cfgentry->slapi_filter) {
+                ret = slapi_vattr_filter_test(pb, e,
+                                              cfgentry->slapi_filter, 0);
+                if (ret != LDAP_SUCCESS) {
+                    continue;
+                }
+            }
+
+            if (slapi_entry_attr_find(e, cfgentry->sattr, &sattr) != 0) {
+                LOG_TRACE("Source attr %s not found for %s\n",
+                          cfgentry->sattr, dn);
+                continue;
+            }
+            if (slapi_entry_attr_find(e, cfgentry->tattr, &tattr) != 0) {
+                LOG_TRACE("Target attr %s not found for %s\n",
+                          cfgentry->tattr, dn);
+            } else {
+                Slapi_Value *val;
+                const char *strval;
+
+                ret = slapi_attr_first_value(sattr, &val);
+                if (ret == -1 || !val) {
+                    LOG_FATAL("Source attr %s is empty\n", cfgentry->sattr);
+                    continue;
+                }
+                strval = slapi_value_get_string(val);
+
+                ret = ipamodrdn_change_attr(cfgentry, dn, strval);
+                if (ret != EOK) {
+                    LOG_FATAL("Failed to set target attr %s for %s\n",
+                              cfgentry->tattr, dn);
+                }
+            }
+        }
+    }
+
+    ipamodrdn_unlock();
+
+    ret = LDAP_SUCCESS;
+
+done:
+    if (ret) {
+        LOG("operation failure [%d]\n", ret);
+        ret = EFAIL;
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return ret;
+}
+
+static int ipamodrdn_config_check_post_op(Slapi_PBlock * pb)
+{
+    char *dn;
+
+    LOG_TRACE("--in-->\n");
+
+    if ((dn = ipamodrdn_get_dn(pb))) {
+        if (ipamodrdn_dn_is_config(dn)) {
+            ipamodrdn_load_plugin_config();
+        }
+    }
+
+    LOG_TRACE("<--out--\n");
+
+    return 0;
+}

daemons/ipa-slapi-plugins/ipa-modrdn/modrdn-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=IPA MODRDN,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA MODRDN
+nsslapd-pluginpath: libipa_modrdn
+nsslapd-plugininitfunc: ipamodrdn_init
+nsslapd-plugintype: betxnpostoperation
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipamodrdn_version
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA MODRDN plugin
+nsslapd-plugin-depends-on-type: database
+nsslapd-pluginPrecedence: 60

daemons/ipa-slapi-plugins/ipa-otp-counter/Makefile.am

@@ -0,0 +1,19 @@
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(AM_CFLAGS)						\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_otp_counter.la
+libipa_otp_counter_la_SOURCES = berval.c berval.h ldapmod.c ldapmod.h ipa_otp_counter.c ipa-otp-counter.sym
+libipa_otp_counter_la_LDFLAGS = -avoid-version -export-symbols $(srcdir)/ipa-otp-counter.sym
+libipa_otp_counter_la_LIBADD = $(LDAP_LIBS)

daemons/ipa-slapi-plugins/ipa-otp-counter/Makefile.in

@@ -0,0 +1,776 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-otp-counter
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_otp_counter_la_DEPENDENCIES = $(am__DEPENDENCIES_1)
+am_libipa_otp_counter_la_OBJECTS = berval.lo ldapmod.lo \
+	ipa_otp_counter.lo
+libipa_otp_counter_la_OBJECTS = $(am_libipa_otp_counter_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_otp_counter_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_otp_counter_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_otp_counter_la_SOURCES)
+DIST_SOURCES = $(libipa_otp_counter_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(AM_CFLAGS)						\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_otp_counter.la
+libipa_otp_counter_la_SOURCES = berval.c berval.h ldapmod.c ldapmod.h ipa_otp_counter.c ipa-otp-counter.sym
+libipa_otp_counter_la_LDFLAGS = -avoid-version -export-symbols $(srcdir)/ipa-otp-counter.sym
+libipa_otp_counter_la_LIBADD = $(LDAP_LIBS)
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-otp-counter/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-otp-counter/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_otp_counter.la: $(libipa_otp_counter_la_OBJECTS) $(libipa_otp_counter_la_DEPENDENCIES) $(EXTRA_libipa_otp_counter_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_otp_counter_la_LINK) -rpath $(plugindir) $(libipa_otp_counter_la_OBJECTS) $(libipa_otp_counter_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/berval.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_otp_counter.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ldapmod.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-pluginLTLIBRARIES install-ps install-ps-am \
+	install-strip installcheck installcheck-am installdirs \
+	maintainer-clean maintainer-clean-generic mostlyclean \
+	mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
+	pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \
+	uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-otp-counter/berval.c

@@ -0,0 +1,96 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "berval.h"
+
+#include <slapi-plugin.h>
+
+#include <limits.h>
+
+struct berval *
+berval_new_longlong(long long value)
+{
+    struct berval *bv;
+
+    bv = (struct berval*) slapi_ch_malloc(sizeof(struct berval));
+    bv->bv_val = slapi_ch_smprintf("%lld", value);
+    bv->bv_len = strlen(bv->bv_val);
+
+    return bv;
+}
+
+void
+berval_free(struct berval **bv)
+{
+    if (*bv == NULL)
+        return;
+
+    slapi_ch_free((void **) &(*bv)->bv_val);
+    slapi_ch_free((void **) bv);
+}
+
+long long
+berval_to_longlong(const struct berval *bv)
+{
+    char buf[bv->bv_len + 1];
+    memcpy(buf, bv->bv_val, bv->bv_len);
+    buf[sizeof(buf)-1] = '\0';
+
+    return strtoll(buf, NULL, 10);
+}
+
+struct berval **
+bervals_new_longlong(long long value)
+{
+    struct berval **bvs;
+
+    bvs = (struct berval**) slapi_ch_calloc(2, sizeof(struct berval*));
+    bvs[0] = berval_new_longlong(value);
+
+    return bvs;
+}
+
+void
+bervals_free(struct berval ***bvals)
+{
+    for (struct berval **itr = *bvals; *itr != NULL; itr++)
+        berval_free(itr);
+
+    slapi_ch_free((void**) bvals);
+}

daemons/ipa-slapi-plugins/ipa-otp-counter/berval.h

@@ -0,0 +1,66 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include <lber.h>
+#include <stdbool.h>
+
+/* Creates a new berval from a long long. */
+struct berval *
+berval_new_longlong(long long value);
+
+/* Frees a berval. */
+void
+berval_free(struct berval **bv);
+
+/* Converts a berval to a long long.
+ * If the value will not fit in a long long,
+ * LLONG_MIN or LLONG_MAX will be returned.
+ */
+long long
+berval_to_longlong(const struct berval *bv);
+
+/* Creates a NULL-terminated array with a single berval. */
+struct berval **
+bervals_new_longlong(long long value);
+
+/* Frees a NULL-terminated array of bervals. */
+void
+bervals_free(struct berval ***bvals);

daemons/ipa-slapi-plugins/ipa-otp-counter/ipa-otp-counter.sym

@@ -0,0 +1 @@
+ipa_otp_counter_init

daemons/ipa-slapi-plugins/ipa-otp-counter/ipa_otp_counter.c

@@ -0,0 +1,462 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+/**
+ * The purpose of this plugin is to ensure that counter/watermark values:
+ * 1. Have atomic operations.
+ * 2. Never go backwards.
+ * 3. Never get deleted.
+ */
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include "berval.h"
+#include "ldapmod.h"
+#include "util.h"
+
+#include <limits.h>
+
+#include <plstr.h>
+
+#define COUNTER_UNSET LLONG_MIN
+
+static void *plugin_id;
+
+static long long
+get_counter(Slapi_Entry *entry, const char *attr)
+{
+    Slapi_Attr *sattr = NULL;
+
+    if (slapi_entry_attr_find(entry, attr, &sattr) == 0)
+        return slapi_entry_attr_get_longlong(entry, attr);
+
+    return COUNTER_UNSET;
+}
+
+/**
+ * Determines the name of the counter or watermark attribute based
+ * upon the objectClass of the entry.
+ *
+ * If no match is found, this function returns NULL indicating that
+ * this entry is not a known token type.
+ */
+static const char *
+find_counter_name(Slapi_Entry *entry)
+{
+    static struct {
+        const char *clss;
+        const char *attr;
+    } table[] = {
+        { "ipatokenHOTP", "ipatokenHOTPcounter" },
+        { "ipatokenTOTP", "ipatokenTOTPwatermark" },
+        { NULL, NULL }
+    };
+
+    const char *attr = NULL;
+    char **clsses = NULL;
+
+    clsses = slapi_entry_attr_get_charray(entry, "objectClass");
+    if (clsses == NULL)
+        return NULL;
+
+    for (size_t i = 0; attr == NULL && clsses[i] != NULL; i++) {
+        for (size_t j = 0; attr == NULL && table[j].clss != NULL; j++) {
+            if (PL_strcasecmp(table[j].clss, clsses[i]) == 0)
+                attr = table[j].attr;
+        }
+    }
+
+    slapi_ch_array_free(clsses);
+    return attr;
+}
+
+/**
+ * Normalizes the input values of counter/watermark modifications.
+ *
+ * 1. All INCREMENT and REPLACE operations need to be replace by
+ *    equivalent DELETE/ADD combination operations. This ensures
+ *    atomicity.
+ *
+ * 2. Any incoming DELETE operations need to be sanity checked.
+ *
+ *    If no value is specified, the current counter value is added
+ *    to the operation. Without this, we cannot guarantee that the
+ *    operation will not causes a decrement.
+ *
+ * This function returns the size of the new LDAPMod* array or zero
+ * if there are no counter/watermark operations.
+ */
+static size_t
+normalize_input(LDAPMod ***mods, const char *attr, long long ctr)
+{
+    LDAPMod **tmp;
+    size_t o; /* Counts the number of operations. */
+    size_t c; /* Counts the number of counter operations. */
+    size_t e; /* Counts the number of expansions. */
+
+    /* Get the size of the mods when all expansions are performed. */
+    for (o = c = e = 0; (*mods)[o] != NULL; o++) {
+        if (PL_strcasecmp((*mods)[o]->mod_type, attr) != 0)
+            continue;
+
+        switch ((*mods)[o]->mod_op & LDAP_MOD_OP) {
+        case LDAP_MOD_REPLACE:
+        case LDAP_MOD_INCREMENT:
+            e++;
+            /* fall through */
+        default:
+            c++;
+        }
+    }
+
+    if (c == 0)
+        return 0;
+
+    /* Filter the modify operations. */
+    tmp = (LDAPMod **) slapi_ch_calloc(o + e + 1, sizeof(LDAPMod*));
+    for (size_t i = 0, j = 0; (*mods)[i] != NULL; tmp[j++] = (*mods)[i++]) {
+        LDAPMod *mod = (*mods)[i];
+
+        if (PL_strcasecmp(mod->mod_type, attr) != 0)
+            continue;
+
+        /* This is not strictly needed, but simplifies the code. */
+        ldapmod_convert_bvalues(mod);
+
+        switch (mod->mod_op & LDAP_MOD_OP) {
+        case LDAP_MOD_DELETE:
+            /* Normalize input: if an empty array is allocated, free it. */
+            if (mod->mod_bvalues != NULL && mod->mod_bvalues[0] == NULL)
+                bervals_free(&mod->mod_bvalues);
+
+            if (mod->mod_bvalues == NULL)
+                mod->mod_bvalues = bervals_new_longlong(ctr);
+
+            ctr = COUNTER_UNSET;
+            break;
+
+        case LDAP_MOD_INCREMENT:
+            if (ctr != COUNTER_UNSET)
+                tmp[j++] = ldapmod_new_longlong(LDAP_MOD_DELETE, attr, ctr);
+
+            ctr += ldapmod_get_value(mod, 1);
+
+            bervals_free(&mod->mod_bvalues);
+            mod->mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
+            mod->mod_bvalues = bervals_new_longlong(ctr);
+            break;
+
+        case LDAP_MOD_REPLACE:
+            if (ctr != COUNTER_UNSET)
+                tmp[j++] = ldapmod_new_longlong(LDAP_MOD_DELETE, attr, ctr);
+
+            mod->mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
+
+            /* Fall through. */
+
+        case LDAP_MOD_ADD:
+            ctr = ldapmod_get_value(mod, 0);
+            break;
+        }
+    }
+
+    slapi_ch_free((void **) mods);
+    *mods = tmp;
+    return o + e;
+}
+
+/**
+ * Simulates how the specified mods will impact the counter.
+ */
+static bool
+simulate(LDAPMod **mods, const char *attr, long long ctr, long long *out)
+{
+    bool success = true;
+
+    for (size_t i = 0; mods[i] != NULL; i++) {
+        if (PL_strcasecmp(mods[i]->mod_type, attr) != 0)
+            continue;
+
+        switch (mods[i]->mod_op & LDAP_MOD_OP) {
+        case LDAP_MOD_DELETE:
+            if (ctr == COUNTER_UNSET)
+                success = false;
+
+            ctr = COUNTER_UNSET;
+            break;
+
+        case LDAP_MOD_INCREMENT:
+            if (ctr == COUNTER_UNSET)
+                success = false;
+
+            ctr = ldapmod_get_value(mods[i], ctr + 1);
+            break;
+
+        case LDAP_MOD_ADD:
+            if (ctr != COUNTER_UNSET)
+                success = false;
+
+            /* Fall through. */
+
+        case LDAP_MOD_REPLACE:
+            ctr = ldapmod_get_value(mods[i], 0);
+            break;
+        }
+    }
+
+    *out = ctr;
+    return success;
+}
+
+/**
+ * Modifies input to ensure correct counter behavior.
+ *
+ * For non-replication operations, we change all REPLACE and INCREMENT
+ * operations into DELETE/ADD pair operations. We also sanity check
+ * incoming DELETE operations. If the request would cause the counter to
+ * decrement or delete, fail the operation.
+ *
+ * For replication operations, if the transaction would decrement the
+ * counter, delete it or modify it to the same value, we remove all mods
+ * related to the counter and let the replication request continue. In
+ * the first two cases, this enforces correct behavior. In the last case,
+ * this reduces write contention on the counter when a replica-set-wide
+ * authentication collision has occurred.
+ */
+static int
+preop_mod(Slapi_PBlock *pb)
+{
+    Slapi_Entry *epre = NULL;
+    const char *attr = NULL;
+    LDAPMod **mods = NULL;
+    char *msg = NULL;
+    long long cpost;
+    long long cpre;
+    int repl = 0;
+    int rc = 0;
+
+    rc |= slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &repl);
+    rc |= slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &epre);
+    rc |= slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
+    if (rc != 0 || epre == NULL || mods == NULL)
+        return 0;
+
+    attr = find_counter_name(epre);
+    if (attr == NULL)
+        return 0; /* Not a token. */
+
+    cpre = get_counter(epre, attr);
+
+    if (repl == 0) {
+        if (normalize_input(&mods, attr, cpre) != 0) {
+            if (slapi_pblock_set(pb, SLAPI_MODIFY_MODS, mods)) {
+                LOG_FATAL("slapi_pblock_set failed!\n");
+                goto error;
+            }
+        }
+    }
+
+    if (!simulate(mods, attr, cpre, &cpost) && repl == 0) {
+        msg = slapi_ch_smprintf("Invalid operation sequence on %s", attr);
+        goto error;
+    }
+
+    if (cpost < cpre) {
+        if (repl == 0) {
+            msg = slapi_ch_smprintf("Will not %s %s",
+                cpost == COUNTER_UNSET ? "delete" : "decrement", attr);
+            goto error;
+        }
+
+        /* Remove counter attribute modifications. */
+        for (size_t i = 0, j = 0 ; ; i++, j++) {
+            mods[j] = mods[i];
+            if (mods[j] == NULL)
+                break;
+
+            if (PL_strcasecmp(mods[j]->mod_type, attr) == 0)
+                ldapmod_free(&mods[j--]);
+        }
+    }
+
+    return 0;
+
+error:
+    rc = LDAP_UNWILLING_TO_PERFORM;
+    slapi_send_ldap_result(pb, rc, NULL, msg, 0, NULL);
+    if (slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc)) {
+        LOG_FATAL("slapi_pblock_set failed!\n");
+    }
+
+    slapi_ch_free_string(&msg);
+    return rc;
+}
+
+static void
+writeback(Slapi_Entry *entry, const char *attr,
+          long long cold, long long cnew)
+{
+    Slapi_PBlock *pb = NULL;
+    char dbuf[32];
+    char abuf[32];
+
+    LDAPMod *mods[] = {
+        &(LDAPMod) {
+            LDAP_MOD_DELETE, (char *) attr,
+            .mod_values = (char *[]) { dbuf, NULL }
+        },
+        &(LDAPMod) {
+            LDAP_MOD_ADD, (char *) attr,
+            .mod_values = (char *[]) { abuf, NULL }
+        },
+        NULL
+    };
+
+    snprintf(dbuf, sizeof(dbuf), "%lld", cold);
+    snprintf(abuf, sizeof(abuf), "%lld", cnew);
+
+    pb = slapi_pblock_new();
+    slapi_modify_internal_set_pb(pb, slapi_entry_get_dn_const(entry),
+                                 mods, NULL, NULL, plugin_id, 0);
+    slapi_modify_internal_pb(pb);
+    slapi_pblock_destroy(pb);
+}
+
+/**
+ * Ensures replications receive the highest value seen.
+ *
+ * A replication request that arrives at the server may be internally
+ * discarded, even if it has a higher counter value, because of a lower
+ * CSN. However, we always want to record the highest value seen.
+ *
+ * We solve this problem by checking the value of the replication request
+ * against the value of the entry after the replication. If the replication
+ * request contained a higher value than what the entry contains, we create
+ * a new modification to bump up the counter to the highest value.
+ *
+ * This check is only for replication operations.
+ */
+static int
+postop_mod(Slapi_PBlock *pb)
+{
+    Slapi_Entry *epost = NULL;
+    Slapi_Entry *epre = NULL;
+    const char *attr = NULL;
+    LDAPMod **mods = NULL;
+    long long cpost;
+    long long cpre;
+    long long csim;
+    int repl = 0;
+    int rc = 0;
+
+    rc |= slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &repl);
+    rc |= slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &epost);
+    rc |= slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &epre);
+    rc |= slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
+    if (rc != 0 || epost == NULL || epre == NULL || mods == NULL)
+        return 0;
+
+    if (repl == 0)
+        return 0;
+
+    attr = find_counter_name(epost);
+    if (attr == NULL)
+        return 0; /* Not a token. */
+
+    cpost = get_counter(epost, attr);
+    cpre = get_counter(epre, attr);
+
+    if (simulate(mods, attr, cpre, &csim) && csim > cpost)
+        writeback(epost, attr, cpost, csim);
+
+    return 0;
+}
+
+static int
+preop_init(Slapi_PBlock *pb)
+{
+    return slapi_pblock_set(pb, SLAPI_PLUGIN_BE_PRE_MODIFY_FN, preop_mod);
+}
+
+static int
+postop_init(Slapi_PBlock *pb)
+{
+    return slapi_pblock_set(pb, SLAPI_PLUGIN_BE_POST_MODIFY_FN, postop_mod);
+}
+
+static int
+start_fn(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+static int
+close_fn(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+int
+ipa_otp_counter_init(Slapi_PBlock *pb)
+{
+    static const Slapi_PluginDesc desc = {
+        "ipa-otp-counter",
+        "FreeIPA",
+        "FreeIPA/1.0",
+        "Ensure proper OTP token counter operation"
+    };
+
+    int ret = 0;
+
+    ret |= slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &plugin_id);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &desc);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, start_fn);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, close_fn);
+    ret |= slapi_register_plugin("bepreoperation", 1, __func__, preop_init,
+                                 "ipa-otp-counter bepreoperation", NULL,
+                                 plugin_id);
+    ret |= slapi_register_plugin("bepostoperation", 1, __func__, postop_init,
+                                 "ipa-otp-counter bepostoperation", NULL,
+                                 plugin_id);
+
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-otp-counter/ldapmod.c

@@ -0,0 +1,110 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "ldapmod.h"
+#include "berval.h"
+
+#include <limits.h>
+
+long long
+ldapmod_get_value(const LDAPMod *mod, long long def)
+{
+    long long v;
+
+    if (mod == NULL)
+        return def;
+
+    if (mod->mod_bvalues == NULL)
+        return def;
+
+    if (mod->mod_bvalues[0] == NULL)
+        return def;
+
+    v = berval_to_longlong(mod->mod_bvalues[0]);
+    if (v == LLONG_MIN || v == LLONG_MAX)
+        return def;
+
+    return v;
+}
+
+LDAPMod *
+ldapmod_new_longlong(int op, const char *attr, long long value)
+{
+    LDAPMod *mod;
+
+    mod = (LDAPMod*) slapi_ch_malloc(sizeof(LDAPMod));
+    mod->mod_op = op | LDAP_MOD_BVALUES;
+    mod->mod_type = slapi_ch_strdup(attr);
+    mod->mod_bvalues = bervals_new_longlong(value);
+
+    return mod;
+}
+
+void
+ldapmod_convert_bvalues(LDAPMod *mod)
+{
+    if (mod == NULL || (mod->mod_op & LDAP_MOD_BVALUES))
+        return;
+
+    mod->mod_op |= LDAP_MOD_BVALUES;
+
+    if (mod->mod_values == NULL) {
+        mod->mod_bvalues = NULL;
+        return;
+    }
+
+    for (size_t i = 0; mod->mod_values[i] != NULL; i++) {
+        struct berval *bv;
+        bv = (struct berval*) slapi_ch_malloc(sizeof(struct berval));
+        bv->bv_val = mod->mod_values[i];
+        bv->bv_len = strlen(bv->bv_val);
+        mod->mod_bvalues[i] = bv;
+    }
+}
+
+void
+ldapmod_free(LDAPMod **mod)
+{
+    if (mod == NULL || *mod == NULL)
+        return;
+
+    bervals_free(&(*mod)->mod_bvalues);
+    slapi_ch_free_string(&(*mod)->mod_type);
+    slapi_ch_free((void **) mod);
+}

daemons/ipa-slapi-plugins/ipa-otp-counter/ldapmod.h

@@ -0,0 +1,54 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include <slapi-plugin.h>
+
+long long
+ldapmod_get_value(const LDAPMod *mod, long long def);
+
+LDAPMod *
+ldapmod_new_longlong(int op, const char *attr, long long value);
+
+void
+ldapmod_convert_bvalues(LDAPMod *mod);
+
+void
+ldapmod_free(LDAPMod **mod);

daemons/ipa-slapi-plugins/ipa-otp-lasttoken/Makefile.am

@@ -0,0 +1,21 @@
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(AM_CFLAGS)						\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_otp_lasttoken.la
+libipa_otp_lasttoken_la_SOURCES = ipa_otp_lasttoken.c ipa-otp-lasttoken.sym
+libipa_otp_lasttoken_la_LDFLAGS = -avoid-version -export-symbols $(srcdir)/ipa-otp-lasttoken.sym
+libipa_otp_lasttoken_la_LIBADD =		\
+	$(LDAP_LIBS)				\
+	$(builddir)/../libotp/libotp.la

daemons/ipa-slapi-plugins/ipa-otp-lasttoken/Makefile.in

@@ -0,0 +1,778 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-otp-lasttoken
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_otp_lasttoken_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(builddir)/../libotp/libotp.la
+am_libipa_otp_lasttoken_la_OBJECTS = ipa_otp_lasttoken.lo
+libipa_otp_lasttoken_la_OBJECTS =  \
+	$(am_libipa_otp_lasttoken_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_otp_lasttoken_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_otp_lasttoken_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_otp_lasttoken_la_SOURCES)
+DIST_SOURCES = $(libipa_otp_lasttoken_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(AM_CFLAGS)						\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(WARN_CFLAGS)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_otp_lasttoken.la
+libipa_otp_lasttoken_la_SOURCES = ipa_otp_lasttoken.c ipa-otp-lasttoken.sym
+libipa_otp_lasttoken_la_LDFLAGS = -avoid-version -export-symbols $(srcdir)/ipa-otp-lasttoken.sym
+libipa_otp_lasttoken_la_LIBADD = \
+	$(LDAP_LIBS)				\
+	$(builddir)/../libotp/libotp.la
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-otp-lasttoken/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-otp-lasttoken/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_otp_lasttoken.la: $(libipa_otp_lasttoken_la_OBJECTS) $(libipa_otp_lasttoken_la_DEPENDENCIES) $(EXTRA_libipa_otp_lasttoken_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_otp_lasttoken_la_LINK) -rpath $(plugindir) $(libipa_otp_lasttoken_la_OBJECTS) $(libipa_otp_lasttoken_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_otp_lasttoken.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-pluginLTLIBRARIES install-ps install-ps-am \
+	install-strip installcheck installcheck-am installdirs \
+	maintainer-clean maintainer-clean-generic mostlyclean \
+	mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
+	pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \
+	uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-otp-lasttoken/ipa-otp-lasttoken.sym

@@ -0,0 +1 @@
+ipa_otp_lasttoken_init

daemons/ipa-slapi-plugins/ipa-otp-lasttoken/ipa_otp_lasttoken.c

@@ -0,0 +1,283 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include "../libotp/otp_token.h"
+#include <time.h>
+
+#include "util.h"
+
+#define PLUGIN_NAME "ipa-otp-lasttoken"
+#define OTP_CONTAINER "cn=otp,%s"
+
+static struct otp_config *otp_config;
+
+static bool entry_is_token(Slapi_Entry *entry)
+{
+    char **ocls;
+
+    ocls = slapi_entry_attr_get_charray(entry, SLAPI_ATTR_OBJECTCLASS);
+    for (size_t i = 0; ocls != NULL && ocls[i] != NULL; i++) {
+        if (strcasecmp(ocls[i], "ipaToken") == 0) {
+            slapi_ch_array_free(ocls);
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static bool sdn_in_otp_container(Slapi_DN *sdn)
+{
+    const Slapi_DN *base;
+    Slapi_DN *container;
+    bool result;
+    char *dn;
+
+    base = slapi_get_suffix_by_dn(sdn);
+    if (base == NULL)
+        return false;
+
+    dn = slapi_ch_smprintf(OTP_CONTAINER, slapi_sdn_get_dn(base));
+    if (dn == NULL)
+        return false;
+
+    container = slapi_sdn_new_dn_passin(dn);
+    result = slapi_sdn_issuffix(sdn, container);
+    slapi_sdn_free(&container);
+
+    return result;
+}
+
+static bool sdn_is_only_enabled_token(Slapi_DN *target_sdn, const char *user_dn)
+{
+    struct otp_token **tokens;
+    bool result = false;
+
+    tokens = otp_token_find(otp_config, user_dn, NULL, true, NULL);
+
+    if (tokens != NULL && tokens[0] != NULL && tokens[1] == NULL) {
+        const Slapi_DN *token_sdn = otp_token_get_sdn(tokens[0]);
+        if (token_sdn != NULL)
+            result = slapi_sdn_compare(token_sdn, target_sdn) == 0;
+    }
+
+    otp_token_free_array(tokens);
+    return result;
+}
+
+static bool is_pwd_enabled(const char *user_dn)
+{
+    char *attrs[] = { "ipaUserAuthType", NULL };
+    Slapi_Entry *entry = NULL;
+    uint32_t authtypes;
+    Slapi_DN *sdn;
+    int search_result = 0;
+
+    sdn = slapi_sdn_new_dn_byval(user_dn);
+    if (sdn == NULL)
+        return false;
+
+    search_result = slapi_search_internal_get_entry(sdn, attrs, &entry,
+            otp_config_plugin_id(otp_config));
+    if (search_result != LDAP_SUCCESS) {
+        LOG_TRACE("File '%s' line %d: Unable to access LDAP entry '%s'. "
+                "Perhaps it doesn't exist? Error code: %d\n", __FILE__,
+                __LINE__, slapi_sdn_get_dn(sdn), search_result);
+    }
+    slapi_sdn_free(&sdn);
+    if (entry == NULL)
+        return false;
+
+    authtypes = otp_config_auth_types(otp_config, entry);
+    slapi_entry_free(entry);
+
+    return authtypes & OTP_CONFIG_AUTH_TYPE_PASSWORD;
+}
+
+static bool is_allowed(Slapi_PBlock *pb, Slapi_Entry *entry)
+{
+    Slapi_DN *target_sdn = NULL;
+    const char *bind_dn;
+
+    /* Ignore internal operations. */
+    if (slapi_op_internal(pb))
+        return true;
+
+    /* Load parameters. */
+    (void) slapi_pblock_get(pb, SLAPI_TARGET_SDN, &target_sdn);
+    (void) slapi_pblock_get(pb, SLAPI_CONN_DN, &bind_dn);
+    if (target_sdn == NULL || bind_dn == NULL) {
+        LOG_FATAL("Missing parameters!\n");
+        return false;
+    }
+
+    if (entry != NULL
+            ? !entry_is_token(entry)
+            : !sdn_in_otp_container(target_sdn))
+        return true;
+
+    if (!sdn_is_only_enabled_token(target_sdn, bind_dn))
+        return true;
+
+    if (is_pwd_enabled(bind_dn))
+        return true;
+
+    return false;
+}
+
+static inline int send_error(Slapi_PBlock *pb, int rc, const char *errstr)
+{
+    slapi_send_ldap_result(pb, rc, NULL, (char *) errstr, 0, NULL);
+    if (slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc)) {
+        LOG_FATAL("slapi_pblock_set failed!\n");
+    }
+    return rc;
+}
+
+static int preop_del(Slapi_PBlock *pb)
+{
+    if (is_allowed(pb, NULL))
+        return 0;
+
+    return send_error(pb, LDAP_UNWILLING_TO_PERFORM,
+                      "Can't delete last active token");
+}
+
+static int preop_mod(Slapi_PBlock *pb)
+{
+    static const struct {
+        const char *attr;
+        const char *msg;
+    } errors[] = {
+        {"ipatokenDisabled",  "Can't disable last active token"},
+        {"ipatokenOwner",     "Can't change last active token's owner"},
+        {"ipatokenNotBefore", "Can't change last active token's start time"},
+        {"ipatokenNotAfter",  "Can't change last active token's end time"},
+        {}
+    };
+
+    const LDAPMod **mods = NULL;
+    Slapi_Entry *entry = NULL;
+
+    (void) slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &entry);
+    (void) slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
+
+    if (is_allowed(pb, entry))
+        return 0;
+
+    /* If a protected attribute is modified, deny. */
+    for (int i = 0; mods != NULL && mods[i] != NULL; i++) {
+        for (int j = 0; errors[j].attr != NULL; j++) {
+            if (strcasecmp(mods[i]->mod_type, errors[j].attr) == 0)
+                return send_error(pb, LDAP_UNWILLING_TO_PERFORM, errors[j].msg);
+        }
+    }
+
+    return 0;
+}
+
+static int preop_init(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_BE_TXN_PRE_DELETE_FN, preop_del);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_BE_TXN_PRE_MODIFY_FN, preop_mod);
+    return ret;
+}
+
+static int update_config(Slapi_PBlock *pb)
+{
+    otp_config_update(otp_config, pb);
+    return 0;
+}
+
+static int intpostop_init(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_POST_ADD_FN,    (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_POST_DELETE_FN, (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_POST_MODIFY_FN, (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_POST_MODRDN_FN, (void *) update_config);
+
+    return ret;
+}
+
+static int postop_init(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_POST_ADD_FN,    (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_POST_DELETE_FN, (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *) update_config);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_POST_MODRDN_FN, (void *) update_config);
+
+    return ret;
+}
+
+int ipa_otp_lasttoken_init(Slapi_PBlock *pb)
+{
+    static const Slapi_PluginDesc preop_desc = {
+        PLUGIN_NAME,
+        "FreeIPA",
+        "FreeIPA/1.0",
+        "Protect the user's last active token"
+    };
+
+    Slapi_ComponentId *plugin_id = NULL;
+    int ret = 0;
+
+    ret |= slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &plugin_id);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &preop_desc);
+    ret |= slapi_register_plugin("betxnpreoperation", 1, __func__, preop_init,
+                                 PLUGIN_NAME " betxnpreoperation", NULL, plugin_id);
+    ret |= slapi_register_plugin("postoperation", 1, __func__, postop_init,
+                                 PLUGIN_NAME " postoperation", NULL, plugin_id);
+    ret |= slapi_register_plugin("internalpostoperation", 1, __func__, intpostop_init,
+                                 PLUGIN_NAME " internalpostoperation", NULL, plugin_id);
+
+    /* NOTE: leak otp_config on process exit. */
+    otp_config = otp_config_init(plugin_id);
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am

@@ -0,0 +1,62 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-I$(top_srcdir)/util					\
+	-I$(top_srcdir)/asn1					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(CRYPTO_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(KRB5_CFLAGS)						\
+	$(NSPR_CFLAGS)						\
+	$(NSS_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+AM_LDFLAGS = \
+	$(CRYPTO_LIBS)	\
+	$(KRB5_LIBS)	\
+	$(LDAP_LIBS)	\
+	$(NSPR_LIBS)	\
+	$(NSS_LIBS)	\
+	-avoid-version	\
+	-export-symbols-regex ^ipapwd_init$
+
+# Plugin Binary
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_pwd_extop.la
+libipa_pwd_extop_la_LIBADD  = \
+	$(builddir)/../libotp/libotp.la \
+	$(top_builddir)/asn1/libipaasn1.la	\
+	$(top_builddir)/util/libutil.la		\
+	$(NULL)
+libipa_pwd_extop_la_SOURCES = 		\
+	common.c			\
+	encoding.c			\
+	prepost.c			\
+	ipa_pwd_extop.c			\
+	ipapwd.h			\
+	otpctrl.c			\
+	otpctrl.h			\
+	$(KRB5_UTIL_SRCS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	pwd-extop-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	README			\
+	$(app_DATA)		\
+	$(NULL)
+
+

daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile.in

@@ -0,0 +1,842 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-pwd-extop
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_pwd_extop_la_DEPENDENCIES = $(builddir)/../libotp/libotp.la \
+	$(top_builddir)/asn1/libipaasn1.la \
+	$(top_builddir)/util/libutil.la $(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_pwd_extop_la_OBJECTS = common.lo encoding.lo prepost.lo \
+	ipa_pwd_extop.lo otpctrl.lo $(am__objects_1)
+libipa_pwd_extop_la_OBJECTS = $(am_libipa_pwd_extop_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_pwd_extop_la_SOURCES)
+DIST_SOURCES = $(libipa_pwd_extop_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-I$(top_srcdir)/util					\
+	-I$(top_srcdir)/asn1					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(CRYPTO_CFLAGS)					\
+	$(LDAP_CFLAGS)						\
+	$(KRB5_CFLAGS)						\
+	$(NSPR_CFLAGS)						\
+	$(NSS_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+AM_LDFLAGS = \
+	$(CRYPTO_LIBS)	\
+	$(KRB5_LIBS)	\
+	$(LDAP_LIBS)	\
+	$(NSPR_LIBS)	\
+	$(NSS_LIBS)	\
+	-avoid-version	\
+	-export-symbols-regex ^ipapwd_init$
+
+
+# Plugin Binary
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = libipa_pwd_extop.la
+libipa_pwd_extop_la_LIBADD = \
+	$(builddir)/../libotp/libotp.la \
+	$(top_builddir)/asn1/libipaasn1.la	\
+	$(top_builddir)/util/libutil.la		\
+	$(NULL)
+
+libipa_pwd_extop_la_SOURCES = \
+	common.c			\
+	encoding.c			\
+	prepost.c			\
+	ipa_pwd_extop.c			\
+	ipapwd.h			\
+	otpctrl.c			\
+	otpctrl.h			\
+	$(KRB5_UTIL_SRCS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	pwd-extop-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	README			\
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_pwd_extop.la: $(libipa_pwd_extop_la_OBJECTS) $(libipa_pwd_extop_la_DEPENDENCIES) $(EXTRA_libipa_pwd_extop_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(LINK) -rpath $(plugindir) $(libipa_pwd_extop_la_OBJECTS) $(libipa_pwd_extop_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/common.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/encoding.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_pwd_extop.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/otpctrl.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/prepost.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c

@@ -0,0 +1,288 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2007-2010 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <dirsrv/slapi-plugin.h>
+#include <lber.h>
+#include <time.h>
+
+#include <endian.h>
+
+#include "ipapwd.h"
+#include "util.h"
+#include "ipa_krb5.h"
+
+/* krbTicketFlags */
+#define KTF_DISALLOW_POSTDATED        0x00000001
+#define KTF_DISALLOW_FORWARDABLE      0x00000002
+#define KTF_DISALLOW_TGT_BASED        0x00000004
+#define KTF_DISALLOW_RENEWABLE        0x00000008
+#define KTF_DISALLOW_PROXIABLE        0x00000010
+#define KTF_DISALLOW_DUP_SKEY         0x00000020
+#define KTF_DISALLOW_ALL_TIX          0x00000040
+#define KTF_REQUIRES_PRE_AUTH         0x00000080
+#define KTF_REQUIRES_HW_AUTH          0x00000100
+#define KTF_REQUIRES_PWCHANGE         0x00000200
+#define KTF_DISALLOW_SVR              0x00001000
+#define KTF_PWCHANGE_SERVICE          0x00002000
+
+/* ascii hex output of bytes in "in"
+ * out len is 32 (preallocated)
+ * in len is 16 */
+static const char hexchars[] = "0123456789ABCDEF";
+static void hexbuf(char *out, const uint8_t *in)
+{
+    int i;
+
+    for (i = 0; i < 16; i++) {
+        out[i*2] = hexchars[in[i] >> 4];
+        out[i*2+1] = hexchars[in[i] & 0x0f];
+    }
+}
+
+void ipapwd_keyset_free(struct ipapwd_keyset **pkset)
+{
+    struct ipapwd_keyset *kset = *pkset;
+    int i;
+
+    if (!kset) return;
+
+    for (i = 0; i < kset->num_keys; i++) {
+        free(kset->keys[i].key_data_contents[0]);
+        free(kset->keys[i].key_data_contents[1]);
+    }
+    free(kset->keys);
+    free(kset);
+    *pkset = NULL;
+}
+
+Slapi_Value **ipapwd_encrypt_encode_key(struct ipapwd_krbcfg *krbcfg,
+                                        struct ipapwd_data *data,
+                                        char *preferred_principal,
+                                        int num_encsalts,
+                                        krb5_key_salt_tuple *encsalts,
+                                        char **errMesg)
+{
+    krb5_context krbctx;
+    char *krbPrincipalName = NULL;
+    int kvno;
+    struct berval *bval = NULL;
+    Slapi_Value **svals = NULL;
+    krb5_principal princ = NULL;
+    krb5_error_code krberr;
+    krb5_data pwd = { 0 };
+    struct ipapwd_keyset *kset = NULL;
+
+    krbctx = krbcfg->krbctx;
+
+    svals = (Slapi_Value **)calloc(2, sizeof(Slapi_Value *));
+    if (!svals) {
+        LOG_OOM();
+        return NULL;
+    }
+
+    kvno = ipapwd_get_cur_kvno(data->target);
+
+    if (preferred_principal) {
+        krbPrincipalName = slapi_ch_strdup(preferred_principal);
+    } else {
+        krbPrincipalName = slapi_entry_attr_get_charptr(data->target,
+                                                        "krbCanonicalName");
+        if (!krbPrincipalName) {
+            krbPrincipalName = slapi_entry_attr_get_charptr(data->target,
+                                                        "krbPrincipalName");
+        }
+        if (!krbPrincipalName) {
+            *errMesg = "no krbPrincipalName present in this entry\n";
+            LOG_FATAL("%s", *errMesg);
+            goto enc_error;
+        }
+    }
+
+    krberr = krb5_parse_name(krbctx, krbPrincipalName, &princ);
+    if (krberr) {
+        LOG_FATAL("krb5_parse_name failed [%s]\n",
+                  krb5_get_error_message(krbctx, krberr));
+        goto enc_error;
+    }
+
+    if (data->password) {
+        pwd.data = (char *)data->password;
+        pwd.length = strlen(data->password);
+    }
+
+    kset = (struct ipapwd_keyset *) calloc(1, sizeof(struct ipapwd_keyset));
+    if (!kset) {
+        LOG_OOM();
+        goto enc_error;
+    }
+
+    /* this encoding assumes all keys have the same kvno */
+    /* major-vno = 1 and minor-vno = 1 */
+    kset->major_vno = 1;
+    kset->minor_vno = 1;
+    /* increment kvno (will be 1 if this is a new entry) */
+    kvno += 1;
+    kset->mkvno = krbcfg->mkvno;
+
+    krberr = ipa_krb5_generate_key_data(krbctx, princ,
+                                        pwd, kvno, krbcfg->kmkey,
+                                        num_encsalts, encsalts,
+                                        &kset->num_keys, &kset->keys);
+    if (krberr != 0) {
+        LOG_FATAL("generating kerberos keys failed [%s]\n",
+                  krb5_get_error_message(krbctx, krberr));
+        goto enc_error;
+    }
+
+    krberr = ber_encode_krb5_key_data(kset->keys, kset->num_keys,
+                                      kset->mkvno, &bval);
+    if (krberr != 0) {
+        LOG_FATAL("encoding krb5_key_data failed\n");
+        goto enc_error;
+    }
+
+    svals[0] = slapi_value_new_berval(bval);
+    if (!svals[0]) {
+        LOG_FATAL("Converting berval to Slapi_Value\n");
+        goto enc_error;
+    }
+
+    ipapwd_keyset_free(&kset);
+    krb5_free_principal(krbctx, princ);
+    slapi_ch_free_string(&krbPrincipalName);
+    ber_bvfree(bval);
+    return svals;
+
+enc_error:
+    *errMesg = "key encryption/encoding failed\n";
+    if (kset) ipapwd_keyset_free(&kset);
+    krb5_free_principal(krbctx, princ);
+    slapi_ch_free_string(&krbPrincipalName);
+    if (bval) ber_bvfree(bval);
+    free(svals);
+    return NULL;
+}
+
+int ipapwd_gen_hashes(struct ipapwd_krbcfg *krbcfg,
+                      struct ipapwd_data *data, char *userpw,
+                      int is_krb, int is_smb, int is_ipant, Slapi_Value ***svals,
+                      char **nthash, Slapi_Value ***ntvals,
+                      char **errMesg)
+{
+    int rc;
+
+    *svals = NULL;
+    *nthash = NULL;
+    *errMesg = NULL;
+
+    if (is_krb) {
+
+        *svals = ipapwd_encrypt_encode_key(krbcfg, data, NULL,
+                                           krbcfg->num_pref_encsalts,
+                                           krbcfg->pref_encsalts,
+                                           errMesg);
+
+        if (!*svals) {
+            /* errMesg should have been set in encrypt_encode_key() */
+            LOG_FATAL("key encryption/encoding failed\n");
+            rc = LDAP_OPERATIONS_ERROR;
+            goto done;
+        }
+    }
+
+    if (is_smb || is_ipant) {
+        char nt[33];
+        uint8_t nt_key[16];
+        int ret;
+
+        if (krbcfg->allow_nt_hash) {
+            ret = encode_nt_key(userpw, nt_key);
+            if (ret) {
+                *errMesg = "Failed to generate NT/LM hashes\n";
+                LOG_FATAL("%s", *errMesg);
+                rc = LDAP_OPERATIONS_ERROR;
+                goto done;
+            }
+
+            hexbuf(nt, nt_key);
+            nt[32] = '\0';
+            *nthash = slapi_ch_strdup(nt);
+        } else {
+            memset(nt_key, 0, 16);
+        }
+
+        if (is_ipant) {
+            *ntvals = (Slapi_Value **)calloc(2, sizeof(Slapi_Value *));
+            if (!*ntvals) {
+                LOG_OOM();
+                rc = LDAP_OPERATIONS_ERROR;
+                goto done;
+            }
+            (*ntvals)[0] = slapi_value_new();
+            if (slapi_value_set((*ntvals)[0], nt_key, 16) == NULL) {
+                rc = LDAP_OPERATIONS_ERROR;
+                goto done;
+            }
+        }
+    }
+
+    rc = LDAP_SUCCESS;
+
+done:
+
+    /* when error, free possibly allocated output parameters */
+    if (rc) {
+        ipapwd_free_slapi_value_array(svals);
+        ipapwd_free_slapi_value_array(ntvals);
+    }
+
+    return rc;
+}
+

daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd.h

@@ -0,0 +1,168 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2007-2010 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#include "../libotp/otp_token.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <prio.h>
+#include <ssl.h>
+#include <krb5.h>
+#include <kdb.h>
+#include <lber.h>
+#include <time.h>
+#include <iconv.h>
+#include <openssl/des.h>
+#include <openssl/md4.h>
+
+#include "ipa_krb5.h"
+#include "ipa_pwd.h"
+
+#define IPAPWD_PLUGIN_NAME   "ipa-pwd-extop"
+#define IPAPWD_FEATURE_DESC  "IPA Password Manager"
+#define IPAPWD_PLUGIN_DESC   "IPA Password Extended Operation plugin"
+
+#define IPA_PLUGIN_NAME IPAPWD_PLUGIN_NAME
+
+#define IPAPWD_CHECK_CONN_SECURE    0x00000001
+#define IPAPWD_CHECK_DN             0x00000002
+
+#define IPA_CHANGETYPE_NORMAL 0
+#define IPA_CHANGETYPE_ADMIN 1
+#define IPA_CHANGETYPE_DSMGR 2
+
+struct ipapwd_data {
+    Slapi_Entry *target;
+    char *dn;
+    char *password;
+    time_t timeNow;
+    time_t expireTime;
+    int changetype;
+    struct ipapwd_policy policy;
+};
+
+struct ipapwd_operation {
+    struct ipapwd_data pwdata;
+    int pwd_op;
+    int is_krb;
+    int skip_keys;
+    int skip_history;
+};
+
+#define GENERALIZED_TIME_LENGTH 15
+
+/* from common.c */
+struct ipapwd_krbcfg {
+    krb5_context krbctx;
+    char *realm;
+    int mkvno;
+    krb5_keyblock *kmkey;
+    int num_supp_encsalts;
+    krb5_key_salt_tuple *supp_encsalts;
+    int num_pref_encsalts;
+    krb5_key_salt_tuple *pref_encsalts;
+    char **passsync_mgrs;
+    int num_passsync_mgrs;
+    bool allow_nt_hash;
+};
+
+int ipapwd_entry_checks(Slapi_PBlock *pb, struct slapi_entry *e,
+                        int *is_root, int *is_krb, int *is_smb, int *is_ipant,
+                        char *attr, int access);
+int ipapwd_gen_checks(Slapi_PBlock *pb, char **errMesg,
+                      struct ipapwd_krbcfg **config, int check_flags);
+int ipapwd_CheckPolicy(struct ipapwd_data *data);
+int ipapwd_getEntry(const char *dn, Slapi_Entry **e2, char **attrlist);
+int ipapwd_get_cur_kvno(Slapi_Entry *target);
+int ipapwd_setdate(Slapi_Entry *source, Slapi_Mods *smods, const char *attr,
+                   time_t date, bool remove);
+int ipapwd_SetPassword(struct ipapwd_krbcfg *krbcfg,
+                       struct ipapwd_data *data, int is_krb);
+Slapi_Value **ipapwd_setPasswordHistory(Slapi_Mods *smods,
+                                        struct ipapwd_data *data);
+int ipapwd_apply_mods(const char *dn, Slapi_Mods *mods);
+int ipapwd_set_extradata(const char *dn,
+                         const char *principal,
+                         time_t unixtime);
+void ipapwd_free_slapi_value_array(Slapi_Value ***svals);
+void free_ipapwd_krbcfg(struct ipapwd_krbcfg **cfg);
+
+/* from encoding.c */
+struct ipapwd_keyset {
+    uint16_t major_vno;
+    uint16_t minor_vno;
+    uint32_t mkvno;
+    krb5_key_data *keys;
+    int num_keys;
+};
+
+void ipapwd_keyset_free(struct ipapwd_keyset **pkset);
+
+Slapi_Value **ipapwd_encrypt_encode_key(struct ipapwd_krbcfg *krbcfg,
+                                        struct ipapwd_data *data,
+                                        char *preferred_principal,
+                                        int num_encsalts,
+                                        krb5_key_salt_tuple *encsalts,
+                                        char **errMesg);
+
+int ipapwd_gen_hashes(struct ipapwd_krbcfg *krbcfg,
+                      struct ipapwd_data *data, char *userpw,
+                      int is_krb, int is_smb, int is_ipant,
+                      Slapi_Value ***svals, char **nthash,
+                      Slapi_Value ***ntvals, char **errMesg);
+
+/* from prepost.c */
+int ipapwd_ext_init(void);
+int ipapwd_pre_init(Slapi_PBlock *pb);
+int ipapwd_post_init(Slapi_PBlock *pb);
+int ipapwd_intpost_init(Slapi_PBlock *pb);
+int ipapwd_pre_init_betxn(Slapi_PBlock *pb);
+int ipapwd_post_init_betxn(Slapi_PBlock *pb);
+
+/* from ipa_pwd_extop.c */
+void *ipapwd_get_plugin_id(void);

daemons/ipa-slapi-plugins/ipa-pwd-extop/otpctrl.c

@@ -0,0 +1,107 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "../libotp/otp_token.h"
+#include "otpctrl.h"
+
+bool otpctrl_present(Slapi_PBlock *pb, const char *oid)
+{
+    LDAPControl **controls = NULL;
+
+    if (slapi_pblock_get(pb, SLAPI_REQCONTROLS, &controls) != 0)
+        return false;
+
+    return ldap_control_find(oid, controls, NULL) != NULL;
+}
+
+bool otpctrl_sync_handle(const struct otp_config *cfg, Slapi_PBlock *pb,
+                         const char *user_dn)
+{
+    struct otp_token **tokens = NULL;
+    LDAPControl **controls = NULL;
+    struct berval *second = NULL;
+    struct berval *first = NULL;
+    BerElement *ber = NULL;
+    char *token_dn = NULL;
+    bool success;
+
+    if (slapi_pblock_get(pb, SLAPI_REQCONTROLS, &controls) != 0)
+        return false;
+
+    if (controls == NULL || controls[0] == NULL)
+        return false;
+
+    for (int i = 0; controls[i] != NULL; i++) {
+        if (strcmp(controls[i]->ldctl_oid, OTP_SYNC_REQUEST_OID) != 0)
+            continue;
+
+        /* Decode the request. */
+        ber = ber_init(&controls[i]->ldctl_value);
+        if (ber == NULL)
+            return false;
+
+        /* Decode the token codes. */
+        if (ber_scanf(ber, "{OO", &first, &second) == LBER_ERROR) {
+            ber_free(ber, 1);
+            return false;
+        }
+
+        /* Decode the optional token DN. */
+        (void)ber_scanf(ber, "a", &token_dn);
+
+        /* Process the synchronization. */
+        success = false;
+        if (ber_scanf(ber, "}") != LBER_ERROR) {
+            tokens = otp_token_find(cfg, user_dn, token_dn, true, NULL);
+            if (tokens != NULL) {
+                success = otp_token_validate_berval(tokens, first, second);
+                otp_token_free_array(tokens);
+            }
+        }
+
+        ber_memfree(token_dn); token_dn = NULL;
+        ber_bvfree(second);
+        ber_bvfree(first);
+        ber_free(ber, 1);
+        if (!success)
+            return false;
+    }
+
+    return true;
+}

daemons/ipa-slapi-plugins/ipa-pwd-extop/otpctrl.h

@@ -0,0 +1,62 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include "../libotp/otp_config.h"
+#include <stdbool.h>
+
+/*
+ * The ASN.1 encoding of the request structure:
+ *
+ *     OTPSyncRequest ::= SEQUENCE {
+ *         firstCode   OCTET STRING,
+ *         secondCode  OCTET STRING,
+ *         tokenDN     OCTET STRING OPTIONAL
+ *     }
+ */
+#define OTP_SYNC_REQUEST_OID "2.16.840.1.113730.3.8.10.6"
+
+/* This control has no data. */
+#define OTP_REQUIRED_OID "2.16.840.1.113730.3.8.10.7"
+
+bool otpctrl_present(Slapi_PBlock *pb, const char *oid);
+
+bool otpctrl_sync_handle(const struct otp_config *cfg, Slapi_PBlock *pb,
+                         const char *user_dn);

daemons/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif

@@ -0,0 +1,17 @@
+dn: cn=ipa_pwd_extop,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: ipa_pwd_extop
+nsslapd-pluginpath: libipa_pwd_extop
+nsslapd-plugininitfunc: ipapwd_init
+nsslapd-plugintype: extendedop
+nsslapd-pluginbetxn: on
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_pwd_extop
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: RedHat
+nsslapd-plugindescription: Support saving passwords in multiple formats for different consumers (krb5, samba, freeradius, etc.)
+nsslapd-plugin-depends-on-type: database
+nsslapd-realmTree: $SUFFIX

daemons/ipa-slapi-plugins/ipa-range-check/Makefile.am

@@ -0,0 +1,40 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_range_check.la	\
+	$(NULL)
+
+libipa_range_check_la_SOURCES = 	\
+	ipa_range_check.c		\
+	$(NULL)
+
+libipa_range_check_la_LDFLAGS = -avoid-version
+
+libipa_range_check_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	range-check-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-range-check/Makefile.in

@@ -0,0 +1,817 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-range-check
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_range_check_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_range_check_la_OBJECTS = ipa_range_check.lo $(am__objects_1)
+libipa_range_check_la_OBJECTS = $(am_libipa_range_check_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_range_check_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_range_check_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_range_check_la_SOURCES)
+DIST_SOURCES = $(libipa_range_check_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_range_check.la	\
+	$(NULL)
+
+libipa_range_check_la_SOURCES = \
+	ipa_range_check.c		\
+	$(NULL)
+
+libipa_range_check_la_LDFLAGS = -avoid-version
+libipa_range_check_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	range-check-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-range-check/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-range-check/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_range_check.la: $(libipa_range_check_la_OBJECTS) $(libipa_range_check_la_DEPENDENCIES) $(EXTRA_libipa_range_check_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_range_check_la_LINK) -rpath $(plugindir) $(libipa_range_check_la_OBJECTS) $(libipa_range_check_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_range_check.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c

@@ -0,0 +1,794 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#define _GNU_SOURCE         /* See feature_test_macros(7) */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <dirsrv/slapi-plugin.h>
+
+#include "util.h"
+
+#define IPA_CN "cn"
+#define IPA_BASE_ID "ipaBaseID"
+#define IPA_ID_RANGE_SIZE "ipaIDRangeSize"
+#define IPA_RANGE_TYPE "ipaRangeType"
+#define IPA_BASE_RID "ipaBaseRID"
+#define IPA_SECONDARY_BASE_RID "ipaSecondaryBaseRID"
+#define IPA_DOMAIN_ID "ipaNTTrustedDomainSID"
+#define RANGES_FILTER "objectclass=ipaIDRange"
+#define DOMAIN_ID_FILTER "ipaNTTrustedDomainSID=*"
+
+#define AD_TRUST_RANGE_TYPE "ipa-ad-trust"
+#define AD_TRUST_POSIX_RANGE_TYPE "ipa-ad-trust-posix"
+#define LOCAL_RANGE_TYPE "ipa-local"
+
+
+#define IPA_PLUGIN_NAME "ipa-range-check"
+#define IPA_RANGE_CHECK_FEATURE_DESC "IPA ID range check plugin"
+#define IPA_RANGE_CHECK_PLUGIN_DESC "Check if newly added or modified " \
+                                    "ID ranges do not overlap with existing ones"
+
+Slapi_PluginDesc ipa_range_check_plugin_desc = {
+    IPA_RANGE_CHECK_FEATURE_DESC,
+    "FreeIPA project",
+    "FreeIPA/1.0",
+    IPA_RANGE_CHECK_PLUGIN_DESC
+};
+
+struct ipa_range_check_ctx {
+    Slapi_ComponentId *plugin_id;
+    const char *base_dn;
+};
+
+typedef enum {
+    RANGE_CHECK_OK,
+    RANGE_CHECK_BASE_OVERLAP,
+    RANGE_CHECK_PRIMARY_PRIMARY_RID_OVERLAP,
+    RANGE_CHECK_SECONDARY_SECONDARY_RID_OVERLAP,
+    RANGE_CHECK_PRIMARY_SECONDARY_RID_OVERLAP,
+    RANGE_CHECK_SECONDARY_PRIMARY_RID_OVERLAP,
+    RANGE_CHECK_DIFFERENT_TYPE_IN_DOMAIN,
+} range_check_result_t;
+
+struct range_info {
+    char *name;
+    char *domain_id;
+    char *forest_root_id;
+    char *id_range_type;
+    uint32_t base_id;
+    uint32_t id_range_size;
+    uint32_t base_rid;
+    uint32_t secondary_base_rid;
+    bool base_rid_set;
+    bool secondary_base_rid_set;
+};
+
+static void free_range_info(struct range_info *range) {
+    if (range != NULL) {
+        slapi_ch_free_string(&(range->name));
+        slapi_ch_free_string(&(range->domain_id));
+        slapi_ch_free_string(&(range->forest_root_id));
+        slapi_ch_free_string(&(range->id_range_type));
+        free(range);
+    }
+}
+
+struct domain_info {
+    char *domain_id;
+    char *forest_root_id;
+    struct domain_info *next;
+};
+
+static void free_domain_info(struct domain_info *info) {
+    if (info != NULL) {
+        slapi_ch_free_string(&(info->domain_id));
+        slapi_ch_free_string(&(info->forest_root_id));
+        free(info);
+    }
+}
+
+static int map_domain_to_root(struct domain_info **head,
+                              struct slapi_entry *domain,
+                              struct slapi_entry *root_domain){
+
+    struct domain_info* new_head = NULL;
+    new_head = (struct domain_info*) malloc(sizeof(struct domain_info));
+    if (new_head == NULL) {
+        return ENOMEM;
+    }
+
+    new_head->domain_id = slapi_entry_attr_get_charptr(domain,
+                                                       IPA_DOMAIN_ID);
+    new_head->forest_root_id = slapi_entry_attr_get_charptr(root_domain,
+                                                            IPA_DOMAIN_ID);
+    new_head->next = *head;
+    *head = new_head;
+
+    return 0;
+}
+
+/* Searches for the domain_info struct with the specified domain_id
+ * in the linked list. Returns the forest root domain's ID, or NULL for
+ * local ranges. */
+
+static char* get_forest_root_id(struct domain_info *head, char* domain_id) {
+
+    /* For local ranges there is no forest root domain,
+     * so consider only ranges with domain_id set */
+    if (domain_id != NULL) {
+        while(head) {
+            if (strcasecmp(head->domain_id, domain_id) == 0) {
+                return slapi_ch_strdup(head->forest_root_id);
+            }
+            head = head->next;
+        }
+     }
+
+    return NULL;
+}
+
+
+/*
+ * This function builds a mapping from domain ID to forest
+ * root domain ID.
+ */
+
+static int build_domain_to_forest_root_map(struct domain_info **head,
+                                           struct ipa_range_check_ctx *ctx){
+
+    Slapi_PBlock *trusted_domain_search_pb = NULL;
+    Slapi_Entry **trusted_domain_entries = NULL;
+    Slapi_DN *base_dn = NULL;
+    char *base = NULL;
+
+    int search_result;
+    int ret = 0;
+
+    LOG("Building forest root map \n");
+
+    /* Set the base DN for the search to cn=ad, cn=trusts, $SUFFIX */
+    ret = asprintf(&base, "cn=ad,cn=trusts,%s", ctx->base_dn);
+    if (ret == -1) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    /* Create SDN from the base */
+    base_dn = slapi_sdn_new_dn_byref(base);
+    if (base_dn == NULL) {
+        LOG_FATAL("Failed to convert base DN.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    /* Allocate a new parameter block */
+    trusted_domain_search_pb = slapi_pblock_new();
+    if (trusted_domain_search_pb == NULL) {
+        LOG_FATAL("Failed to create new pblock.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    /* Search for all the root domains, note the LDAP_SCOPE_ONELEVEL */
+    slapi_search_internal_set_pb(trusted_domain_search_pb,
+                                 base,
+                                 LDAP_SCOPE_SUBTREE, DOMAIN_ID_FILTER,
+                                 NULL, 0, NULL, NULL, ctx->plugin_id, 0);
+
+    ret = slapi_search_internal_pb(trusted_domain_search_pb);
+    if (ret != 0) {
+        LOG_FATAL("Starting internal search failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_pblock_get(trusted_domain_search_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
+    if (ret != 0 || search_result != LDAP_SUCCESS) {
+
+        /* If the search for the trusted domains fails,
+         * AD Trust support on IPA server is not available */
+
+        LOG("Empty forest root map as trusts are not enabled on this IPA server.\n");
+        ret = 0;
+        *head = NULL;
+
+        goto done;
+    }
+
+    ret = slapi_pblock_get(trusted_domain_search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                           &trusted_domain_entries);
+
+    if (ret != 0) {
+        LOG_FATAL("Failed to read searched root domain entries.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    if (trusted_domain_entries == NULL || trusted_domain_entries[0] == NULL) {
+        LOG("No existing root domain entries.\n");
+        ret = 0;
+        goto done;
+    }
+
+    /* now we iterate the domains and determine which of them are root domains */
+    for (int i = 0; trusted_domain_entries[i] != NULL; i++) {
+
+        ret = slapi_sdn_isparent(base_dn,
+                                 slapi_entry_get_sdn(trusted_domain_entries[i]));
+
+        /* trusted domain is root domain */
+        if (ret == 1) {
+            ret = map_domain_to_root(head,
+                                     trusted_domain_entries[i],
+                                     trusted_domain_entries[i]);
+            if (ret != 0) {
+                goto done;
+            }
+        }
+        else {
+            /* we need to search for the root domain */
+            for (int j = 0; trusted_domain_entries[j] != NULL; j++) {
+                ret = slapi_sdn_isparent(
+                          slapi_entry_get_sdn(trusted_domain_entries[j]),
+                          slapi_entry_get_sdn(trusted_domain_entries[i]));
+
+                /* match, set the jth domain as the root domain for the ith */
+                if (ret == 1) {
+                    ret = map_domain_to_root(head,
+                                             trusted_domain_entries[i],
+                                             trusted_domain_entries[j]);
+                    if (ret != 0) {
+                        goto done;
+                    }
+
+                    break;
+                }
+            }
+        }
+    }
+
+done:
+    slapi_free_search_results_internal(trusted_domain_search_pb);
+    slapi_pblock_destroy(trusted_domain_search_pb);
+    free(base);
+
+    return ret;
+
+}
+
+static int slapi_entry_to_range_info(struct domain_info *domain_info_head,
+                                     struct slapi_entry *entry,
+                                     struct range_info **_range)
+{
+    int ret;
+    unsigned long ul_val;
+    struct range_info *range = NULL;
+    Slapi_Attr *attr;
+
+    range = calloc(1, sizeof(struct range_info));
+    if (range == NULL) {
+        return ENOMEM;
+    }
+
+    range->name = slapi_entry_attr_get_charptr(entry, IPA_CN);
+    range->domain_id = slapi_entry_attr_get_charptr(entry, IPA_DOMAIN_ID);
+    range->id_range_type = slapi_entry_attr_get_charptr(entry, IPA_RANGE_TYPE);
+    range->forest_root_id = get_forest_root_id(domain_info_head,
+                                               range->domain_id);
+
+    if (range->name == NULL || range->id_range_type == NULL) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_BASE_ID);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
+    range->base_id = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_ID_RANGE_SIZE);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
+    range->id_range_size = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_BASE_RID);
+    if (ul_val >= UINT32_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
+    range->base_rid = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_SECONDARY_BASE_RID);
+    if (ul_val >= UINT32_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
+    range->secondary_base_rid = ul_val;
+
+    /* slapi_entry_attr_find return 0 if requested attribute is present in entry */
+    range->base_rid_set = (slapi_entry_attr_find(entry, IPA_BASE_RID, &attr) == 0);
+    range->secondary_base_rid_set = (slapi_entry_attr_find(entry, IPA_SECONDARY_BASE_RID, &attr) == 0);
+
+    *_range = range;
+    ret = 0;
+
+done:
+    if (ret != 0) {
+        free_range_info(range);
+    }
+
+    return ret;
+}
+
+#define IN_RANGE(x,base,size) ( (x) >= (base) && ((x) - (base) < (size)) )
+static bool intervals_overlap(uint32_t x, uint32_t base, uint32_t x_size, uint32_t base_size)
+{
+    if (IN_RANGE(x, base, base_size) ||
+        IN_RANGE((x + x_size - 1), base, base_size) ||
+        IN_RANGE(base, x, x_size) ||
+        IN_RANGE((base + base_size - 1), x, x_size)) {
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * returns 0 if there is no overlap
+ *
+ * connected ranges must not overlap:
+ * existing range:  base  rid  sec_rid
+ *                   |     |  \  / |
+ *                   |     |   \/  |
+ *                   |     |   /\  |
+ *                   |     |  /  \ |
+ * new range:       base  rid  sec_rid
+ **/
+static range_check_result_t check_ranges(struct range_info *r1, struct range_info *r2)
+{
+    /* Do not check overlaps of range with the range itself */
+    if (r1->name != NULL && r2->name != NULL &&
+        strcasecmp(r1->name, r2->name) == 0) {
+        return RANGE_CHECK_OK;
+    }
+
+    /* Check if base range overlaps with existing base range.
+     * Exception: ipa-ad-trust-posix ranges from the same forest */
+    if (!((strcasecmp(r1->id_range_type, AD_TRUST_POSIX_RANGE_TYPE) == 0) &&
+          (strcasecmp(r2->id_range_type, AD_TRUST_POSIX_RANGE_TYPE) == 0) &&
+          (r1->forest_root_id != NULL && r2->forest_root_id != NULL) &&
+          (strcasecmp(r1->forest_root_id, r2->forest_root_id) == 0))) {
+
+        if (intervals_overlap(r1->base_id, r2->base_id,
+            r1->id_range_size, r2->id_range_size)){
+            return RANGE_CHECK_BASE_OVERLAP;
+        }
+
+    }
+
+    /* Following checks apply for the ranges from the same domain */
+    bool ranges_from_same_domain =
+         (r1->domain_id == NULL && r2->domain_id == NULL) ||
+         (r1->domain_id != NULL && r2->domain_id != NULL &&
+          strcasecmp(r1->domain_id, r2->domain_id) == 0);
+
+    if (ranges_from_same_domain) {
+
+        /* Ranges from the same domain must have the same type */
+        if (strcasecmp(r1->id_range_type, r2->id_range_type) != 0) {
+            return RANGE_CHECK_DIFFERENT_TYPE_IN_DOMAIN;
+        }
+
+        /* For ipa-local or ipa-ad-trust range types primary RID ranges should
+         * not overlap */
+
+        if (strcasecmp(r1->id_range_type, AD_TRUST_RANGE_TYPE) == 0 ||
+            strcasecmp(r1->id_range_type, LOCAL_RANGE_TYPE) == 0) {
+
+            /* Check if primary rid range overlaps with existing primary rid range */
+            if ((r1->base_rid_set && r2->base_rid_set) &&
+                intervals_overlap(r1->base_rid, r2->base_rid,
+                                  r1->id_range_size, r2->id_range_size))
+                return RANGE_CHECK_PRIMARY_PRIMARY_RID_OVERLAP;
+        }
+
+        /* The following 3 checks are relevant only if both ranges are local. */
+        if (strcasecmp(r1->id_range_type, LOCAL_RANGE_TYPE) == 0){
+
+            /* Check if secondary RID range overlaps with existing secondary or
+             * primary RID range. */
+            if ((r1->secondary_base_rid_set && r2->secondary_base_rid_set) &&
+                intervals_overlap(r1->secondary_base_rid, r2->secondary_base_rid,
+                                  r1->id_range_size, r2->id_range_size))
+                return RANGE_CHECK_SECONDARY_SECONDARY_RID_OVERLAP;
+
+            /* Check if RID range overlaps with existing secondary RID range */
+            if ((r1->base_rid_set && r2->secondary_base_rid_set) &&
+                intervals_overlap(r1->base_rid, r2->secondary_base_rid,
+                                  r1->id_range_size, r2->id_range_size))
+                return RANGE_CHECK_PRIMARY_SECONDARY_RID_OVERLAP;
+
+            /* Check if secondary RID range overlaps with existing RID range */
+            if ((r1->secondary_base_rid_set && r2->base_rid_set) &&
+                intervals_overlap(r1->secondary_base_rid, r2->base_rid,
+                                  r1->id_range_size, r2->id_range_size))
+                return RANGE_CHECK_SECONDARY_PRIMARY_RID_OVERLAP;
+            }
+    }
+
+    return RANGE_CHECK_OK;
+}
+
+static int ipa_range_check_start(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+static int ipa_range_check_close(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+static int ipa_range_check_pre_op(Slapi_PBlock *pb, int modtype)
+{
+    int ret;
+    int is_repl_op;
+    struct slapi_entry *entry = NULL;
+    bool free_entry = false;
+    struct range_info *new_range = NULL;
+    struct range_info *old_range = NULL;
+    const char *dn_str;
+    Slapi_DN *dn = NULL;
+    struct ipa_range_check_ctx *ctx;
+    LDAPMod **mods = NULL;
+    Slapi_PBlock *search_pb = NULL;
+    int search_result;
+    Slapi_Entry **search_entries = NULL;
+    size_t c;
+    int ranges_valid = 0;
+    const char *check_attr;
+    char *errmsg = NULL;
+    struct domain_info *domain_info_head = NULL;
+
+    ret = slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &is_repl_op);
+    if (ret != 0) {
+        LOG_FATAL("slapi_pblock_get failed!?\n");
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    if (is_repl_op) {
+        LOG("Is replicated operation, nothing to do.\n");
+        return LDAP_SUCCESS;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret != 0) {
+        LOG_FATAL("Missing private plugin context.\n");
+        goto done;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn_str);
+    if (ret != 0) {
+        LOG_FATAL("Missing target DN.\n");
+        goto done;
+    }
+
+    dn = slapi_sdn_new_dn_byref(dn_str);
+    if (dn == NULL) {
+        LOG_FATAL("Failed to convert target DN.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+
+    switch (modtype) {
+        case LDAP_CHANGETYPE_ADD:
+            ret = slapi_pblock_get(pb, SLAPI_ADD_ENTRY, &entry);
+            if (ret != 0) {
+                LOG_FATAL("Missing entry to add.\n");
+                goto done;
+            }
+
+            /* Check if this is a range object */
+            check_attr = slapi_entry_attr_get_charptr(entry, IPA_BASE_ID);
+            if (check_attr == NULL) {
+                LOG("Not an ID range object, nothing to do.\n");
+                ret = 0;
+                goto done;
+            }
+
+            break;
+        case  LDAP_CHANGETYPE_MODIFY:
+            ret = slapi_search_internal_get_entry(dn, NULL, &entry,
+                                                  ctx->plugin_id);
+            if (ret != 0 || entry == NULL) {
+                LOG("Missing entry to modify.\n");
+                /* No range object, nothing to do. */
+                ret = 0;
+                goto done;
+            }
+            free_entry = true;
+
+            /* Check if this is a range object */
+            check_attr = slapi_entry_attr_get_charptr(entry, IPA_BASE_ID);
+            if (check_attr == NULL) {
+                LOG("Not an ID range object, nothing to do.\n");
+                ret = 0;
+                goto done;
+            }
+
+            ret = slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
+            if (ret != 0) {
+                LOG_FATAL("Missing modify values.\n");
+                goto done;
+            }
+
+            ret = slapi_entry_apply_mods(entry, mods);
+            if (ret != 0) {
+                LOG_FATAL("Failed to apply modifications.\n");
+                goto done;
+            }
+
+            break;
+        default:
+            ret = LDAP_OPERATIONS_ERROR;
+            LOG_FATAL("Unsupported LDAP operation.\n");
+            goto done;
+    }
+
+    /* build a linked list of domain_info structs */
+    ret = build_domain_to_forest_root_map(&domain_info_head, ctx);
+    if (ret != 0) {
+        LOG_FATAL("Building of domain forest root domain map failed.\n");
+        goto done;
+    }
+
+    ret = slapi_entry_to_range_info(domain_info_head, entry, &new_range);
+    if (ret != 0) {
+        LOG_FATAL("Failed to convert LDAP entry to range struct.\n");
+        goto done;
+    }
+
+    search_pb = slapi_pblock_new();
+    if (search_pb == NULL) {
+        LOG_FATAL("Failed to create new pblock.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    slapi_search_internal_set_pb(search_pb, ctx->base_dn,
+                                 LDAP_SCOPE_SUBTREE, RANGES_FILTER,
+                                 NULL, 0, NULL, NULL, ctx->plugin_id, 0);
+
+    ret = slapi_search_internal_pb(search_pb);
+    if (ret != 0) {
+        LOG_FATAL("Starting internal search failed.\n");
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
+    if (ret != 0 || search_result != LDAP_SUCCESS) {
+        LOG_FATAL("Internal search failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                           &search_entries);
+    if (ret != 0) {
+        LOG_FATAL("Failed to read searched entries.\n");
+        goto done;
+    }
+
+    if (search_entries == NULL || search_entries[0] == NULL) {
+        LOG("No existing entries.\n");
+        ret = 0;
+        goto done;
+    }
+
+    for (c = 0; search_entries[c] != NULL; c++) {
+        ret = slapi_entry_to_range_info(domain_info_head, search_entries[c],
+                                        &old_range);
+        if (ret != 0) {
+            LOG_FATAL("Failed to convert LDAP entry to range struct.\n");
+            goto done;
+        }
+
+        ranges_valid = check_ranges(new_range, old_range);
+        free_range_info(old_range);
+        old_range = NULL;
+        if (ranges_valid != RANGE_CHECK_OK) {
+            ret = LDAP_CONSTRAINT_VIOLATION;
+
+            switch (ranges_valid){
+            case RANGE_CHECK_BASE_OVERLAP:
+                errmsg = "New base range overlaps with existing base range.";
+                break;
+            case RANGE_CHECK_PRIMARY_PRIMARY_RID_OVERLAP:
+                errmsg = "New primary rid range overlaps with existing primary rid range.";
+                break;
+            case RANGE_CHECK_SECONDARY_SECONDARY_RID_OVERLAP:
+                errmsg = "New secondary rid range overlaps with existing secondary rid range.";
+                break;
+            case RANGE_CHECK_PRIMARY_SECONDARY_RID_OVERLAP:
+                errmsg = "New primary rid range overlaps with existing secondary rid range.";
+                break;
+            case RANGE_CHECK_SECONDARY_PRIMARY_RID_OVERLAP:
+                errmsg = "New secondary rid range overlaps with existing primary rid range.";
+                break;
+            case RANGE_CHECK_DIFFERENT_TYPE_IN_DOMAIN:
+                errmsg = "New ID range has invalid type. All ranges in the same domain must be of the same type.";
+                break;
+            default:
+                errmsg = "New range overlaps with existing one.";
+                break;
+            }
+
+            LOG_FATAL("%s\n",errmsg);
+            goto done;
+        }
+    }
+    LOG("No overlaps found.\n");
+
+    ret = 0;
+
+done:
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+    slapi_sdn_free(&dn);
+    free_range_info(old_range);
+    free_range_info(new_range);
+    if (free_entry) {
+        slapi_entry_free(entry);
+    }
+
+    /* Remove the domain info linked list from memory */
+    struct domain_info *next;
+    while(domain_info_head) {
+        next = domain_info_head->next;
+        free_domain_info(domain_info_head);
+        domain_info_head = next;
+    }
+
+    if (ret != 0) {
+        if (errmsg == NULL) {
+            errmsg = "Range Check error";
+        }
+        slapi_send_ldap_result(pb, ret, NULL, errmsg, 0, NULL);
+    }
+
+    return ret;
+}
+
+static int ipa_range_check_mod_pre_op(Slapi_PBlock * pb)
+{
+    return ipa_range_check_pre_op(pb, LDAP_CHANGETYPE_MODIFY);
+}
+
+static int ipa_range_check_add_pre_op(Slapi_PBlock *pb)
+{
+    return ipa_range_check_pre_op(pb, LDAP_CHANGETYPE_ADD);
+}
+
+static int ipa_range_check_init_ctx(Slapi_PBlock *pb,
+                                    struct ipa_range_check_ctx **_ctx)
+{
+    struct ipa_range_check_ctx *ctx;
+    Slapi_Entry *entry;
+    int ret;
+
+    ctx = calloc(1, sizeof(struct ipa_range_check_ctx));
+    if (ctx == NULL) {
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ctx->plugin_id);
+    if ((ret != 0) || (ctx->plugin_id == NULL)) {
+        LOG_FATAL("Could not get identity or identity was NULL\n");
+        if (ret == 0) {
+            ret = -1;
+        }
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &entry);
+    if (entry == NULL) {
+        LOG_FATAL("Plugin configuration not found!\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    ctx->base_dn = slapi_entry_attr_get_charptr(entry, "nsslapd-basedn");
+    if (ctx->base_dn == NULL) {
+        LOG_FATAL("Base DN not found in plugin configuration!\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = 0;
+
+done:
+    if (ret != 0) {
+        free(ctx);
+    } else {
+        *_ctx = ctx;
+    }
+
+    return ret;
+}
+
+int ipa_range_check_init(Slapi_PBlock *pb)
+{
+    int ret;
+    struct ipa_range_check_ctx *rc_ctx;
+
+    ret = ipa_range_check_init_ctx(pb, &rc_ctx);
+    if (ret != 0) {
+        LOG_FATAL("Failed ot initialize range check plugin.\n");
+        /* do not cause DS to stop, simply do nothing */
+        return 0;
+    }
+
+    ret = 0;
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_01) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                         (void *) ipa_range_check_start) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                         (void *) ipa_range_check_close) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &ipa_range_check_plugin_desc) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_MODIFY_FN,
+                         (void *) ipa_range_check_mod_pre_op) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_ADD_FN,
+                         (void *) ipa_range_check_add_pre_op) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, rc_ctx) != 0) {
+        LOG_FATAL("failed to register plugin\n");
+        ret = EFAIL;
+    }
+
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-range-check/range-check-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=IPA Range-Check,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA Range-Check
+nsslapd-pluginpath: libipa_range_check
+nsslapd-plugininitfunc: ipa_range_check_init
+nsslapd-plugintype: preoperation
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_range_check_version
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA Range-Check plugin
+nsslapd-plugin-depends-on-type: database
+nsslapd-basedn: $SUFFIX

daemons/ipa-slapi-plugins/ipa-sidgen/Makefile.am

@@ -0,0 +1,58 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_sidgen.la	\
+	libipa_sidgen_task.la	\
+	$(NULL)
+
+libipa_sidgen_la_SOURCES = 	\
+	ipa_sidgen.c		\
+	ipa_sidgen_common.c	\
+	$(NULL)
+
+libipa_sidgen_la_LDFLAGS = -avoid-version
+
+libipa_sidgen_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+libipa_sidgen_task_la_SOURCES = 	\
+	ipa_sidgen_task.c		\
+	ipa_sidgen_common.c		\
+	$(NULL)
+
+libipa_sidgen_task_la_LDFLAGS = -avoid-version
+
+libipa_sidgen_task_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+noinst_HEADERS =	\
+	ipa_sidgen.h
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =				\
+	ipa-sidgen-conf.ldif		\
+	ipa-sidgen-task-conf.ldif	\
+	ipa-sidgen-task-run.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-sidgen/Makefile.in

@@ -0,0 +1,853 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-sidgen
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \
+	$(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_sidgen_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_sidgen_la_OBJECTS = ipa_sidgen.lo ipa_sidgen_common.lo \
+	$(am__objects_1)
+libipa_sidgen_la_OBJECTS = $(am_libipa_sidgen_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_sidgen_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_sidgen_la_LDFLAGS) $(LDFLAGS) \
+	-o $@
+libipa_sidgen_task_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am_libipa_sidgen_task_la_OBJECTS = ipa_sidgen_task.lo \
+	ipa_sidgen_common.lo $(am__objects_1)
+libipa_sidgen_task_la_OBJECTS = $(am_libipa_sidgen_task_la_OBJECTS)
+libipa_sidgen_task_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_sidgen_task_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_sidgen_la_SOURCES) $(libipa_sidgen_task_la_SOURCES)
+DIST_SOURCES = $(libipa_sidgen_la_SOURCES) \
+	$(libipa_sidgen_task_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+HEADERS = $(noinst_HEADERS)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_sidgen.la	\
+	libipa_sidgen_task.la	\
+	$(NULL)
+
+libipa_sidgen_la_SOURCES = \
+	ipa_sidgen.c		\
+	ipa_sidgen_common.c	\
+	$(NULL)
+
+libipa_sidgen_la_LDFLAGS = -avoid-version
+libipa_sidgen_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+libipa_sidgen_task_la_SOURCES = \
+	ipa_sidgen_task.c		\
+	ipa_sidgen_common.c		\
+	$(NULL)
+
+libipa_sidgen_task_la_LDFLAGS = -avoid-version
+libipa_sidgen_task_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(NULL)
+
+noinst_HEADERS = \
+	ipa_sidgen.h
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	ipa-sidgen-conf.ldif		\
+	ipa-sidgen-task-conf.ldif	\
+	ipa-sidgen-task-run.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-sidgen/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-sidgen/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_sidgen.la: $(libipa_sidgen_la_OBJECTS) $(libipa_sidgen_la_DEPENDENCIES) $(EXTRA_libipa_sidgen_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_sidgen_la_LINK) -rpath $(plugindir) $(libipa_sidgen_la_OBJECTS) $(libipa_sidgen_la_LIBADD) $(LIBS)
+
+libipa_sidgen_task.la: $(libipa_sidgen_task_la_OBJECTS) $(libipa_sidgen_task_la_DEPENDENCIES) $(EXTRA_libipa_sidgen_task_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_sidgen_task_la_LINK) -rpath $(plugindir) $(libipa_sidgen_task_la_OBJECTS) $(libipa_sidgen_task_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_sidgen.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_sidgen_common.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_sidgen_task.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA) $(HEADERS)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-sidgen/ipa-sidgen-conf.ldif

@@ -0,0 +1,16 @@
+dn: cn=IPA SIDGEN,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA SIDGEN
+nsslapd-pluginpath: libipa_sidgen
+nsslapd-plugininitfunc: ipa_sidgen_init
+nsslapd-plugintype: postoperation
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipa_sidgen_postop
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA SIDGEN post operation
+nsslapd-plugin-depends-on-type: database
+nsslapd-basedn: $SUFFIX

daemons/ipa-slapi-plugins/ipa-sidgen/ipa-sidgen-task-conf.ldif

@@ -0,0 +1,20 @@
+dn: cn=ipa-sidgen-task,cn=plugins,cn=config
+changetype: add
+objectClass: top
+objectClass: nsSlapdPlugin
+objectClass: extensibleObject
+cn: ipa-sidgen-task
+nsslapd-pluginPath: libipa_sidgen_task
+nsslapd-pluginInitfunc: sidgen_task_init
+nsslapd-pluginType: object
+nsslapd-pluginEnabled: on
+nsslapd-pluginId: ipa_sidgen_task
+nsslapd-pluginVersion: 1.0
+nsslapd-pluginVendor: RedHat
+nsslapd-pluginDescription: Generate SIDs for existing user and group entries
+
+dn: cn=ipa-sidgen-task,cn=tasks,cn=config
+changetype: add
+objectClass: top
+objectClass: extensibleObject
+cn: ipa-sidgen-task

daemons/ipa-slapi-plugins/ipa-sidgen/ipa-sidgen-task-run.ldif

@@ -0,0 +1,10 @@
+dn: cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config
+changetype: add
+objectClass: top
+objectClass: extensibleObject
+cn: sidgen
+# $SUFFIX must be replaced with the base DN of the IPA directory tree
+nsslapd-basedn: $SUFFIX
+# delay specifies the time the task should sleep between the generation of SIDs
+# in nanoseconds
+delay: 0

daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.c

@@ -0,0 +1,244 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2012 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include <stdlib.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <dirsrv/slapi-plugin.h>
+
+#include "util.h"
+#include "ipa_sidgen.h"
+
+Slapi_PluginDesc ipa_sidgen_plugin_desc = {
+    IPA_SIDGEN_FEATURE_DESC,
+    "FreeIPA project",
+    "FreeIPA/1.0",
+    IPA_SIDGEN_PLUGIN_DESC
+};
+
+static int ipa_sidgen_start(Slapi_PBlock *pb)
+{
+    return 0;
+}
+
+static int ipa_sidgen_close(Slapi_PBlock *pb)
+{
+    int ret;
+    struct ipa_sidgen_ctx *ctx;
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret == 0) {
+        free_ranges(&ctx->ranges);
+        slapi_ch_free_string(&ctx->dom_sid);
+    } else {
+        LOG_FATAL("Missing private plugin context.\n");
+    }
+
+    return 0;
+}
+
+static int ipa_sidgen_add_post_op(Slapi_PBlock *pb)
+{
+    int ret;
+    int is_repl_op;
+    struct slapi_entry *entry = NULL;
+    const char *dn_str;
+    Slapi_DN *dn = NULL;
+    struct ipa_sidgen_ctx *ctx;
+    Slapi_PBlock *search_pb = NULL;
+    char *errmsg = NULL;
+
+    ret = slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &is_repl_op);
+    if (ret != 0) {
+        LOG_FATAL("slapi_pblock_get failed!?\n");
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    if (is_repl_op) {
+        LOG("Is replicated operation, nothing to do.\n");
+        return LDAP_SUCCESS;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx);
+    if (ret != 0) {
+        LOG_FATAL("Missing private plugin context.\n");
+        goto done;
+    }
+
+    if (ctx->dom_sid == NULL) {
+        ret = get_dom_sid(ctx->plugin_id, ctx->base_dn, &ctx->dom_sid);
+        if (ret != 0) {
+            LOG("Domain SID not available, nothing to do.\n");
+            ret = 0;
+            goto done;
+        }
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn_str);
+    if (ret != 0) {
+        LOG_FATAL("Missing target DN.\n");
+        goto done;
+    }
+
+    dn = slapi_sdn_new_dn_byref(dn_str);
+    if (dn == NULL) {
+        LOG_FATAL("Failed to convert target DN.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_search_internal_get_entry(dn, NULL, &entry, ctx->plugin_id);
+    if (ret != 0 || entry == NULL) {
+        LOG_FATAL("Missing target entry.\n");
+        ret = LDAP_NO_SUCH_OBJECT;
+        goto done;
+    }
+
+    if (ctx->ranges == NULL) {
+        ret = get_ranges(ctx->plugin_id, ctx->base_dn, &ctx->ranges);
+        if (ret != 0) {
+            if (ret == LDAP_NO_SUCH_OBJECT) {
+                ret = 0;
+                LOG("No ID ranges found, nothing to do.\n");
+            } else {
+                LOG_FATAL("Failed to get ID ranges.\n");
+            }
+            goto done;
+        }
+    }
+
+    ret = find_sid_for_ldap_entry(entry, ctx->plugin_id, ctx->base_dn,
+                                  ctx->dom_sid, ctx->ranges);
+    if (ret != 0) {
+        LOG_FATAL("Cannot add SID to new entry.\n");
+        goto done;
+    }
+
+    ret = 0;
+done:
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+    slapi_sdn_free(&dn);
+
+    if (ret != 0) {
+        if (errmsg == NULL) {
+            errmsg = "SIDGEN error";
+        }
+        slapi_send_ldap_result(pb, ret, NULL, errmsg, 0, NULL);
+    }
+
+    return ret;
+}
+
+static int ipa_sidgen_init_ctx(Slapi_PBlock *pb, struct ipa_sidgen_ctx **_ctx)
+{
+    struct ipa_sidgen_ctx *ctx;
+    Slapi_Entry *entry;
+    int ret;
+
+    ctx = calloc(1, sizeof(struct ipa_sidgen_ctx));
+    if (ctx == NULL) {
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ctx->plugin_id);
+    if ((ret != 0) || (ctx->plugin_id == NULL)) {
+        LOG_FATAL("Could not get identity or identity was NULL\n");
+        if (ret == 0) {
+            ret = -1;
+        }
+        goto done;
+    }
+
+    slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &entry);
+    if (entry == NULL) {
+        LOG_FATAL("Plugin configuration not found!\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    ctx->base_dn = slapi_entry_attr_get_charptr(entry, "nsslapd-basedn");
+    if (ctx->base_dn == NULL) {
+        LOG_FATAL("Base DN not found in plugin configuration!\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    ret = 0;
+
+done:
+    if (ret != 0) {
+        free(ctx);
+    } else {
+        *_ctx = ctx;
+    }
+
+    return ret;
+}
+
+int ipa_sidgen_init(Slapi_PBlock *pb)
+{
+    int ret;
+    struct ipa_sidgen_ctx *ctx;
+
+    ret = ipa_sidgen_init_ctx(pb, &ctx);
+    if (ret != 0) {
+        LOG_FATAL("Failed ot initialize sidgen postop plugin.\n");
+        /* do not cause DS to stop, simply do nothing */
+        return 0;
+    }
+
+    ret = 0;
+    if (slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                         SLAPI_PLUGIN_VERSION_03) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                         (void *) ipa_sidgen_start) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                         (void *) ipa_sidgen_close) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION,
+                         (void *) &ipa_sidgen_plugin_desc) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_POST_ADD_FN,
+                         (void *) ipa_sidgen_add_post_op) != 0 ||
+        slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, ctx) != 0) {
+        LOG_FATAL("failed to register plugin\n");
+        ret = EFAIL;
+    }
+
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h

@@ -0,0 +1,106 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2012 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#define OBJECTCLASS "objectclass"
+#define IPA_OBJECT "ipaobject"
+#define MEP_MANAGED_ENTRY "mepmanagedentry"
+#define UID_NUMBER "uidnumber"
+#define GID_NUMBER "gidnumber"
+#define IPA_SID "ipantsecurityidentifier"
+#define DOM_ATTRS_FILTER OBJECTCLASS"=ipantdomainattrs"
+#define DOMAIN_ID_RANGE_FILTER OBJECTCLASS"=ipadomainidrange"
+#define POSIX_ACCOUNT "posixaccount"
+#define POSIX_GROUP "posixgroup"
+#define IPA_ID_OBJECT "ipaidobject"
+#define IPANT_USER_ATTRS "ipantuserattrs"
+#define IPANT_GROUP_ATTRS "ipantgroupattrs"
+
+#define IPA_PLUGIN_NAME "ipa-sidgen-postop"
+#define IPA_SIDGEN_FEATURE_DESC "IPA SIDGEN postop plugin"
+#define IPA_SIDGEN_PLUGIN_DESC "Add a SID to newly added or modified " \
+                               "objects with uid pr gid numbers"
+
+#define IPA_BASE_ID "ipaBaseID"
+#define IPA_ID_RANGE_SIZE "ipaIDRangeSize"
+#define IPA_BASE_RID "ipaBaseRID"
+#define IPA_SECONDARY_BASE_RID "ipaSecondaryBaseRID"
+
+struct range_info {
+    uint32_t base_id;
+    uint32_t id_range_size;
+    uint32_t base_rid;
+    uint32_t secondary_base_rid;
+};
+
+struct ipa_sidgen_ctx {
+    Slapi_ComponentId *plugin_id;
+    const char *base_dn;
+    char *dom_sid;
+    struct range_info **ranges;
+};
+
+void set_plugin_id_for_sidgen_task(Slapi_ComponentId *plugin_id);
+
+int sidgen_task_add(Slapi_PBlock *pb, Slapi_Entry *e,
+                    Slapi_Entry *eAfter, int *returncode,
+                    char *returntext, void *arg);
+
+int get_dom_sid(Slapi_ComponentId *plugin_id, const char *base_dn, char **_sid);
+
+int get_objectclass_flags(char **objectclasses,
+                          bool *has_posix_account,
+                          bool *has_posix_group,
+                          bool *has_ipa_id_object);
+
+void free_ranges(struct range_info ***_ranges);
+
+int get_ranges(Slapi_ComponentId *plugin_id, const char *base_dn,
+               struct range_info ***_ranges);
+
+int find_sid_for_id(uint32_t id, Slapi_ComponentId *plugin_id,
+                    const char *base_dn, const char *dom_sid,
+                    struct range_info **ranges, char **_sid);
+
+int find_sid_for_ldap_entry(struct slapi_entry *entry,
+                            Slapi_ComponentId *plugin_id,
+                            const char *base_dn,
+                            const char *dom_sid,
+                            struct range_info **ranges);

daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c

@@ -0,0 +1,563 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2012 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include <stdlib.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <dirsrv/slapi-plugin.h>
+
+#include "util.h"
+#include "ipa_sidgen.h"
+
+int get_dom_sid(Slapi_ComponentId *plugin_id, const char *base_dn, char **_sid)
+{
+    Slapi_PBlock *search_pb = NULL;
+    int search_result;
+    Slapi_Entry **search_entries = NULL;
+    int ret;
+    const char *sid;
+
+    search_pb = slapi_pblock_new();
+    if (search_pb == NULL) {
+        LOG_FATAL("Failed to create new pblock.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    slapi_search_internal_set_pb(search_pb, base_dn,
+                                 LDAP_SCOPE_SUBTREE, DOM_ATTRS_FILTER,
+                                 NULL, 0, NULL, NULL, plugin_id, 0);
+
+    ret = slapi_search_internal_pb(search_pb);
+    if (ret != 0) {
+        LOG_FATAL("Starting internal search failed.\n");
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
+    if (ret != 0 || search_result != LDAP_SUCCESS) {
+        LOG_FATAL("Internal search failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                           &search_entries);
+    if (ret != 0) {
+        LOG_FATAL("Failed to read searched entries.\n");
+        goto done;
+    }
+
+    if (search_entries == NULL || search_entries[0] == NULL) {
+        LOG("No existing entries.\n");
+        ret = LDAP_NO_SUCH_OBJECT;
+        goto done;
+    }
+
+    if (search_entries[1] != NULL) {
+        LOG("Too many results found.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    sid = slapi_entry_attr_get_charptr(search_entries[0], IPA_SID);
+    if (sid == NULL) {
+        LOG("Domain object does not have a SID.\n");
+        ret = LDAP_NO_SUCH_ATTRIBUTE;
+        goto done;
+    }
+
+    *_sid = slapi_ch_strdup(sid);
+    if (*_sid == NULL) {
+        LOG("slapi_ch_strdup failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    LOG("Found domain SID [%s].\n", *_sid);
+    ret = 0;
+
+done:
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+
+    return ret;
+}
+
+static int slapi_entry_to_range_info(struct slapi_entry *entry,
+                                     struct range_info **_range)
+{
+    int ret;
+    unsigned long ul_val;
+    struct range_info *range = NULL;
+
+    range = ( struct range_info *) slapi_ch_calloc(1, sizeof(struct range_info));
+    if (range == NULL) {
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_BASE_ID);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+    range->base_id = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_ID_RANGE_SIZE);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+    range->id_range_size = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_BASE_RID);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+    range->base_rid = ul_val;
+
+    ul_val = slapi_entry_attr_get_ulong(entry, IPA_SECONDARY_BASE_RID);
+    if (ul_val == 0 || ul_val >= UINT32_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
+    range->secondary_base_rid = ul_val;
+
+    *_range = range;
+    ret = 0;
+
+done:
+    if (ret != 0) {
+        slapi_ch_free((void **) &range);
+    }
+
+    return ret;
+}
+
+int get_objectclass_flags(char **objectclasses,
+                          bool *has_posix_account,
+                          bool *has_posix_group,
+                          bool *has_ipa_id_object)
+{
+    size_t c;
+
+    if (objectclasses == NULL) {
+        return LDAP_OPERATIONS_ERROR;
+    }
+
+    *has_posix_account = false;
+    *has_posix_group = false;
+    *has_ipa_id_object = false;
+
+    for (c = 0; objectclasses[c] != NULL; c++) {
+        if (strcasecmp(objectclasses[c], POSIX_ACCOUNT) == 0) {
+            *has_posix_account = true;
+        } else if (strcasecmp(objectclasses[c], POSIX_GROUP) == 0) {
+            *has_posix_group = true;
+        } else if (strcasecmp(objectclasses[c], IPA_ID_OBJECT) == 0) {
+            *has_ipa_id_object = true;
+        }
+    }
+
+    return 0;
+}
+
+void free_ranges(struct range_info ***_ranges)
+{
+    size_t c;
+    struct range_info **ranges = *_ranges;
+
+    if (ranges != NULL) {
+        for (c = 0; ranges[c] != NULL; c++) {
+            slapi_ch_free((void **) &ranges[c]);
+        }
+
+        slapi_ch_free((void **) _ranges);
+    }
+}
+
+int get_ranges(Slapi_ComponentId *plugin_id, const char *base_dn,
+               struct range_info ***_ranges)
+{
+    Slapi_PBlock *search_pb = NULL;
+    Slapi_Entry **search_entries = NULL;
+    int search_result;
+    size_t c;
+    int ret;
+    struct range_info **ranges = NULL;
+
+    search_pb = slapi_pblock_new();
+    if (search_pb == NULL) {
+        LOG_FATAL("Failed to create new pblock.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    slapi_search_internal_set_pb(search_pb, base_dn,
+                                 LDAP_SCOPE_SUBTREE, DOMAIN_ID_RANGE_FILTER,
+                                 NULL, 0, NULL, NULL, plugin_id, 0);
+
+    ret = slapi_search_internal_pb(search_pb);
+    if (ret != 0) {
+        LOG_FATAL("Starting internal search failed.\n");
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
+    if (ret != 0 || search_result != LDAP_SUCCESS) {
+        LOG_FATAL("Internal search failed.\n");
+        ret = (search_result != LDAP_SUCCESS) ? search_result:
+                                                LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                           &search_entries);
+    if (ret != 0) {
+        LOG_FATAL("Failed to read searched entries.\n");
+        goto done;
+    }
+
+    if (search_entries == NULL || search_entries[0] == NULL) {
+        LOG("No ranges found.\n");
+        ret = LDAP_NO_SUCH_OBJECT;
+        goto done;
+    }
+
+    for (c = 0; search_entries[c] != NULL; c++);
+    ranges = (struct range_info **) slapi_ch_calloc(c + 1,
+                                                    sizeof(struct range_info *));
+    if (ranges == NULL) {
+        LOG("calloc failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    for (c = 0; search_entries[c] != NULL; c++) {
+        ret = slapi_entry_to_range_info(search_entries[c], &ranges[c]);
+        if (ret != 0) {
+            LOG_FATAL("Failed to convert LDAP entry to range struct.\n");
+            goto done;
+        }
+    }
+
+    *_ranges = ranges;
+    ret = 0;
+
+done:
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+    if (ret != 0) {
+        free_ranges(&ranges);
+    }
+
+    return ret;
+}
+
+static int find_sid(const char *sid, Slapi_ComponentId *plugin_id,
+                    const char *base_dn)
+{
+    Slapi_PBlock *search_pb = NULL;
+    Slapi_Entry **search_entries = NULL;
+    int search_result;
+    int ret;
+    char *filter = NULL;
+
+    search_pb = slapi_pblock_new();
+    if (search_pb == NULL) {
+        LOG_FATAL("Failed to create new pblock.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    filter = slapi_ch_smprintf("%s=%s", IPA_SID, sid);
+    if (filter == NULL) {
+        LOG_FATAL("Cannot create search filter to check if SID is used.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    slapi_search_internal_set_pb(search_pb, base_dn,
+                                 LDAP_SCOPE_SUBTREE, filter,
+                                 NULL, 0, NULL, NULL, plugin_id, 0);
+
+    ret = slapi_search_internal_pb(search_pb);
+    if (ret != 0) {
+        LOG_FATAL("Starting internal search failed.\n");
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
+    if (ret != 0 || search_result != LDAP_SUCCESS) {
+        LOG_FATAL("Internal search failed.\n");
+        ret = (search_result != LDAP_SUCCESS) ? search_result:
+                                                LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    ret = slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES,
+                           &search_entries);
+    if (ret != 0) {
+        LOG_FATAL("Failed to read searched entries.\n");
+        goto done;
+    }
+
+    if (search_entries == NULL || search_entries[0] == NULL) {
+        LOG("No SID found.\n");
+        ret = LDAP_NO_SUCH_OBJECT;
+        goto done;
+    }
+
+    ret = 0;
+
+done:
+    slapi_ch_free_string(&filter);
+    slapi_free_search_results_internal(search_pb);
+    slapi_pblock_destroy(search_pb);
+
+    return ret;
+}
+
+static int rid_to_sid_with_check(uint32_t rid, Slapi_ComponentId *plugin_id,
+                                 const char *base_dn, const char *dom_sid,
+                                 char **_sid)
+{
+    char *sid = NULL;
+    int ret;
+
+    sid = slapi_ch_smprintf("%s-%lu", dom_sid, (unsigned long) rid);
+    if (sid == NULL) {
+        LOG("Failed to create SID string.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    LOG("SID is [%s].\n", sid);
+
+    ret = find_sid(sid, plugin_id, base_dn);
+    if (ret == LDAP_NO_SUCH_OBJECT) {
+        *_sid = sid;
+        ret = 0;
+        goto done;
+    } else if (ret != 0) {
+        LOG_FATAL("Cannot check if SID is already used.\n");
+        goto done;
+    }
+
+    LOG_FATAL("SID [%s] is already used.\n", sid);
+    ret = LDAP_CONSTRAINT_VIOLATION;
+
+done:
+    if (ret != 0) {
+        slapi_ch_free_string(&sid);
+    }
+
+    return ret;
+}
+
+int find_sid_for_id(uint32_t id, Slapi_ComponentId *plugin_id,
+                    const char *base_dn, const char *dom_sid,
+                    struct range_info **ranges, char **_sid)
+{
+    uint32_t rid;
+    size_t c;
+    char *sid = NULL;
+    int ret;
+
+    rid = 0;
+    for (c = 0; ranges[c] != NULL; c++) {
+        if (id >= ranges[c]->base_id &&
+            id < (ranges[c]->base_id + ranges[c]->id_range_size)) {
+            rid = ranges[c]->base_rid + (id - ranges[c]->base_id);
+            break;
+        }
+    }
+
+    if (rid == 0) {
+        LOG("No matching range found. Cannot add SID.\n");
+        ret = LDAP_NO_SUCH_OBJECT;
+        goto done;
+    }
+
+    ret = rid_to_sid_with_check(rid, plugin_id, base_dn, dom_sid, &sid);
+    if (ret != LDAP_CONSTRAINT_VIOLATION) {
+        goto done;
+    }
+
+    /* SID is already used, try secondary range.*/
+    rid = ranges[c]->secondary_base_rid + (id - ranges[c]->base_id);
+
+    ret = rid_to_sid_with_check(rid, plugin_id, base_dn, dom_sid, &sid);
+    if (ret != LDAP_CONSTRAINT_VIOLATION) {
+        goto done;
+    }
+
+    LOG_FATAL("Secondary SID is used as well.\n");
+
+done:
+    if (ret != 0) {
+        slapi_ch_free_string(&sid);
+    } else {
+        *_sid = sid;
+    }
+
+    return ret;
+}
+
+int find_sid_for_ldap_entry(struct slapi_entry *entry,
+                            Slapi_ComponentId *plugin_id,
+                            const char *base_dn,
+                            const char *dom_sid,
+                            struct range_info **ranges)
+{
+    int ret;
+    const char *dn_str;
+    uint32_t uid_number;
+    uint32_t gid_number;
+    uint32_t id;
+    char *sid = NULL;
+    char **objectclasses = NULL;
+    Slapi_PBlock *mod_pb = NULL;
+    Slapi_Mods *smods = NULL;
+    int result;
+    bool has_posix_account = false;
+    bool has_posix_group = false;
+    bool has_ipa_id_object = false;
+    const char *objectclass_to_add = NULL;
+
+    dn_str = slapi_entry_get_dn_const(entry);
+    if (dn_str == NULL) {
+        LOG_FATAL("Cannot find DN of an LDAP entry.\n");
+        ret = LDAP_NO_SUCH_ATTRIBUTE;
+        goto done;
+    }
+    LOG("Trying to add SID for [%s].\n", dn_str);
+
+    uid_number = slapi_entry_attr_get_ulong(entry, UID_NUMBER);
+    gid_number = slapi_entry_attr_get_ulong(entry, GID_NUMBER);
+
+    if (uid_number == 0 && gid_number == 0) {
+        LOG("[%s] does not have Posix IDs, nothing to do.\n", dn_str);
+        ret = 0;
+        goto done;
+    }
+
+    if (uid_number >= UINT32_MAX || gid_number >= UINT32_MAX) {
+        LOG_FATAL("ID value too large.\n");
+        ret = LDAP_CONSTRAINT_VIOLATION;
+        goto done;
+    }
+
+    sid = slapi_entry_attr_get_charptr(entry, IPA_SID);
+    if (sid != NULL) {
+        LOG("Object already has a SID, nothing to do.\n");
+        ret = 0;
+        goto done;
+    }
+
+    objectclasses = slapi_entry_attr_get_charray(entry, OBJECTCLASS);
+    ret = get_objectclass_flags(objectclasses, &has_posix_account,
+                                               &has_posix_group,
+                                               &has_ipa_id_object);
+    if (ret != 0) {
+        LOG_FATAL("Cannot determine objectclasses.\n");
+        goto done;
+    }
+
+    if (has_posix_account && uid_number != 0 && gid_number != 0) {
+        id = uid_number;
+        objectclass_to_add = IPANT_USER_ATTRS;
+    } else if (has_posix_group && gid_number != 0) {
+        id = gid_number;
+        objectclass_to_add = IPANT_GROUP_ATTRS;
+    } else if (has_ipa_id_object) {
+        id = (uid_number != 0) ? uid_number : gid_number;
+        objectclass_to_add = NULL;
+    } else {
+        LOG_FATAL("Inconsistent objectclasses and attributes, nothing to do.\n");
+        ret = 0;
+        goto done;
+    }
+
+    ret = find_sid_for_id(id, plugin_id, base_dn, dom_sid, ranges, &sid);
+    if (ret != 0) {
+        LOG_FATAL("Cannot convert Posix ID [%lu] into an unused SID.\n",
+                  (unsigned long) id);
+        goto done;
+    }
+
+    smods = slapi_mods_new();
+    if (smods == NULL) {
+        LOG("slapi_mods_new failed.\n");
+        ret = LDAP_OPERATIONS_ERROR;
+        goto done;
+    }
+
+    if (objectclass_to_add != NULL) {
+        slapi_mods_add_string(smods, LDAP_MOD_ADD,
+                              OBJECTCLASS, objectclass_to_add);
+    }
+    slapi_mods_add_string(smods, LDAP_MOD_REPLACE, IPA_SID, sid);
+
+    mod_pb = slapi_pblock_new();
+    slapi_modify_internal_set_pb(mod_pb, dn_str,
+                                 slapi_mods_get_ldapmods_byref(smods),
+                                 NULL, NULL, plugin_id, 0);
+
+    ret = slapi_modify_internal_pb(mod_pb);
+    if (ret != 0) {
+        LOG_FATAL("Modify failed with [%d] on entry [%s]\n", ret, dn_str);
+        goto done;
+    }
+
+    ret = slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+    if (ret != 0 || result != LDAP_SUCCESS){
+        LOG_FATAL("Modify failed on entry [%s]\n", dn_str);
+        goto done;
+    }
+
+done:
+    slapi_ch_free_string(&sid);
+    slapi_pblock_destroy(mod_pb);
+    slapi_mods_free(&smods);
+    slapi_ch_array_free(objectclasses);
+
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c

@@ -0,0 +1,351 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2012 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdbool.h>
+
+#include <pthread.h>
+#include <dirsrv/slapi-plugin.h>
+
+#include "util.h"
+#include "ipa_sidgen.h"
+
+#define NSEC_PER_SEC     1000000000UL
+
+
+#define AT_CN "cn"
+
+Slapi_ComponentId *global_sidgen_plugin_id = NULL;
+
+struct worker_ctx {
+    long delay;
+    char *base_dn;
+    Slapi_ComponentId *plugin_id;
+    pthread_t tid;
+    char *dom_sid;
+    struct range_info **ranges;
+};
+
+static const char *fetch_attr(Slapi_Entry *e, const char *attrname,
+                                              const char *default_val)
+{
+    Slapi_Attr *attr;
+    Slapi_Value *val = NULL;
+
+    if (slapi_entry_attr_find(e, attrname, &attr) != 0)
+        return default_val;
+
+    if (slapi_attr_first_value(attr, &val) == -1)
+        return default_val;
+
+    return slapi_value_get_string(val);
+}
+
+static void free_pblock(void *arg)
+{
+    Slapi_PBlock *pb = (Slapi_PBlock *) arg;
+
+    slapi_free_search_results_internal(pb);
+    slapi_pblock_destroy(pb);
+}
+
+static int do_work(struct worker_ctx *worker_ctx)
+{
+    Slapi_PBlock *pb;
+    int ret;
+    size_t c;
+    char *filter = NULL;
+    char *attrs[] = { OBJECTCLASS, UID_NUMBER, GID_NUMBER, NULL };
+    Slapi_Entry **e = NULL;
+    struct timespec ts;
+
+    pb = slapi_pblock_new();
+    if (pb == NULL) {
+        return ENOMEM;
+    }
+
+    pthread_cleanup_push(free_pblock, (void *) pb);
+
+    filter = slapi_ch_smprintf("(&(%s=%s)(!(%s=%s))(|(%s=%s)(%s=%s)(%s=%s))(!(%s=*)))",
+                               OBJECTCLASS, IPA_OBJECT,
+                               OBJECTCLASS, MEP_MANAGED_ENTRY,
+                               OBJECTCLASS, POSIX_ACCOUNT,
+                               OBJECTCLASS, POSIX_GROUP,
+                               OBJECTCLASS, IPA_ID_OBJECT,
+                               IPA_SID);
+    if (filter == NULL) {
+        LOG_FATAL("Cannot generate search filter for objects without a SID.\n");
+        ret = ENOMEM;
+        goto done;
+    }
+    LOG("Base DN: [%s], Filter: [%s].\n", worker_ctx->base_dn, filter);
+
+    slapi_search_internal_set_pb(pb, worker_ctx->base_dn, LDAP_SCOPE_SUBTREE,
+                                 filter, attrs, 0, NULL, NULL,
+                                 worker_ctx->plugin_id, 0);
+    ret = slapi_search_internal_pb(pb);
+    if (ret != 0) {
+        slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret);
+        if (ret != 0) {
+            LOG_FATAL("Search failed with [%d].\n", ret);
+        } else {
+            LOG_FATAL("slapi_search_internal_pb failed, "
+                      "but no error code available.\n");
+            ret = EFAULT;
+        }
+        goto done;
+    }
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &e);
+    if (ret != 0) {
+        LOG_FATAL("slapi_pblock_get failed.\n");
+        ret = EFAULT;
+        goto done;
+    }
+
+    if (e == NULL || e[0] == NULL) {
+        LOG("No entry with missing SID found.\n");
+        ret = 0;
+        goto done;
+    }
+
+    for (c = 0; e[c] != NULL; c++) {
+        ret = find_sid_for_ldap_entry(e[c], worker_ctx->plugin_id,
+                                      worker_ctx->base_dn, worker_ctx->dom_sid,
+                                      worker_ctx->ranges);
+        if (ret != 0) {
+            LOG_FATAL("Cannot add SID to existing entry.\n");
+            goto done;
+        }
+
+        if (worker_ctx->delay != 0) {
+            ts.tv_nsec = worker_ctx->delay % NSEC_PER_SEC;
+            ts.tv_sec = (worker_ctx->delay - ts.tv_nsec) / NSEC_PER_SEC;
+            nanosleep(&ts, NULL);
+        }
+    };
+
+done:
+    slapi_ch_free_string(&filter);
+    pthread_cleanup_pop(1);
+
+    LOG("do_work finished with [%d].\n", ret);
+
+    return ret;
+}
+
+static void *sidgen_task_thread(void *arg)
+{
+    Slapi_Task *task = (Slapi_Task *)arg;
+    struct worker_ctx *worker_ctx;
+    int ret;
+
+    if (task == NULL) {
+        LOG_FATAL("Missing task data!\n");
+        ret =SLAPI_DSE_CALLBACK_OK;
+        goto done;
+    }
+
+    worker_ctx = slapi_task_get_data(task);
+    if (worker_ctx == NULL) {
+        LOG_FATAL("Missing context!\n");
+        ret =SLAPI_DSE_CALLBACK_OK;
+        goto done;
+    }
+
+    slapi_task_begin(task, 1);
+    LOG_FATAL("Sidgen task starts ...\n");
+
+    ret = do_work(worker_ctx);
+
+done:
+    LOG_FATAL("Sidgen task finished [%d].\n", ret);
+    slapi_task_inc_progress(task);
+    slapi_task_finish(task, ret);
+
+    return NULL;
+}
+
+static void sidgen_task_destructor(Slapi_Task *task)
+{
+    struct worker_ctx *worker_ctx;
+
+    if (task != NULL) {
+        worker_ctx = slapi_task_get_data(task);
+        if (worker_ctx != NULL) {
+            free_ranges(&worker_ctx->ranges);
+            slapi_ch_free_string(&worker_ctx->dom_sid);
+            slapi_ch_free_string(&worker_ctx->base_dn);
+            slapi_ch_free((void **) &worker_ctx);
+        }
+    }
+}
+
+int sidgen_task_add(Slapi_PBlock *pb, Slapi_Entry *e,
+                    Slapi_Entry *eAfter, int *returncode,
+                    char *returntext, void *arg)
+{
+    int ret = SLAPI_DSE_CALLBACK_ERROR;
+    const char *str;
+    struct worker_ctx *worker_ctx = NULL;
+    char *endptr;
+    Slapi_Task *task = NULL;
+
+    *returncode = LDAP_OPERATIONS_ERROR;
+    returntext[0] = '\0';
+
+    worker_ctx = (struct worker_ctx *) slapi_ch_calloc(1,
+                                                     sizeof(struct worker_ctx));
+    if (worker_ctx == NULL) {
+        LOG_FATAL("slapi_ch_malloc failed!\n");
+        *returncode = LDAP_OPERATIONS_ERROR;
+        ret = SLAPI_DSE_CALLBACK_ERROR;
+        goto done;
+    }
+
+    worker_ctx->plugin_id = global_sidgen_plugin_id;
+
+    str = fetch_attr(e, "delay", NULL);
+    if (str != NULL) {
+        errno = 0;
+        worker_ctx->delay = strtol(str, &endptr, 10);
+        if (errno != 0 || worker_ctx->delay < 0) {
+            LOG_FATAL("invalid delay [%s]!\n", str);
+            *returncode = LDAP_CONSTRAINT_VIOLATION;
+            ret = SLAPI_DSE_CALLBACK_ERROR;
+            goto done;
+        }
+    }
+    LOG("delay is [%li].\n", worker_ctx->delay);
+
+    str = fetch_attr(e, "nsslapd-basedn", NULL);
+    if (str == NULL) {
+        LOG_FATAL("Missing nsslapd-basedn!\n");
+        *returncode = LDAP_CONSTRAINT_VIOLATION;
+        ret = SLAPI_DSE_CALLBACK_ERROR;
+        goto done;
+    }
+    worker_ctx->base_dn = slapi_ch_strdup(str);
+    if (worker_ctx->base_dn == NULL) {
+        LOG_FATAL("Failed to copy base DN.\n");
+        *returncode = LDAP_OPERATIONS_ERROR;
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = get_dom_sid(worker_ctx->plugin_id, worker_ctx->base_dn,
+                      &worker_ctx->dom_sid);
+    if (ret != 0) {
+        LOG_FATAL("Cannot find domain SID.\n");
+        goto done;
+    }
+
+    ret = get_ranges(worker_ctx->plugin_id, worker_ctx->base_dn,
+                     &worker_ctx->ranges);
+    if (ret != 0) {
+        LOG_FATAL("Cannot find ranges.\n");
+        goto done;
+    }
+
+    task = slapi_new_task(slapi_entry_get_ndn(e));
+    if (task == NULL) {
+        LOG_FATAL("unable to allocate new task!\n");
+        *returncode = LDAP_OPERATIONS_ERROR;
+        ret = SLAPI_DSE_CALLBACK_ERROR;
+        goto done;
+    }
+
+    slapi_task_set_destructor_fn(task, sidgen_task_destructor);
+    slapi_task_set_data(task, worker_ctx);
+
+    ret = pthread_create(&worker_ctx->tid, NULL, sidgen_task_thread, task);
+    if (ret != 0) {
+        LOG_FATAL("unable to create sidgen task thread!\n");
+        *returncode = LDAP_OPERATIONS_ERROR;
+        ret = SLAPI_DSE_CALLBACK_ERROR;
+        slapi_task_finish(task, *returncode);
+        goto done;
+    }
+
+    ret = SLAPI_DSE_CALLBACK_OK;
+    *returncode = LDAP_SUCCESS;
+
+done:
+    if (ret != SLAPI_DSE_CALLBACK_OK) {
+        slapi_ch_free((void **) &worker_ctx->base_dn);
+        slapi_ch_free((void **) &worker_ctx);
+    }
+    return ret;
+}
+
+static int sigden_task_start(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret = slapi_task_register_handler("ipa-sidgen-task", sidgen_task_add);
+
+    return ret;
+}
+
+int sidgen_task_init(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY,
+                           &global_sidgen_plugin_id);
+    if (ret != 0 || global_sidgen_plugin_id == NULL) {
+        LOG_FATAL("Plugin identity not available.\n");
+        ret = (ret != 0) ? ret : EINVAL;
+        goto done;
+    }
+
+    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION,
+                            (void *) SLAPI_PLUGIN_VERSION_03);
+
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                            (void *) sigden_task_start);
+
+done:
+    if (ret != 0) {
+        LOG_FATAL("Failed to initialize plug-in\n" );
+    }
+
+    return ret;
+}

daemons/ipa-slapi-plugins/ipa-uuid/Makefile.am

@@ -0,0 +1,41 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 		\
+	libipa_uuid.la		\
+	$(NULL)
+
+libipa_uuid_la_SOURCES = 	\
+	ipa_uuid.c		\
+	$(NULL)
+
+libipa_uuid_la_LDFLAGS = -avoid-version
+
+libipa_uuid_la_LIBADD = 	\
+	$(LDAP_LIBS)		\
+	$(UUID_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	uuid-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-uuid/Makefile.in

@@ -0,0 +1,818 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-uuid
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_uuid_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_uuid_la_OBJECTS = ipa_uuid.lo $(am__objects_1)
+libipa_uuid_la_OBJECTS = $(am_libipa_uuid_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_uuid_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_uuid_la_LDFLAGS) $(LDFLAGS) -o \
+	$@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_uuid_la_SOURCES)
+DIST_SOURCES = $(libipa_uuid_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_uuid.la		\
+	$(NULL)
+
+libipa_uuid_la_SOURCES = \
+	ipa_uuid.c		\
+	$(NULL)
+
+libipa_uuid_la_LDFLAGS = -avoid-version
+libipa_uuid_la_LIBADD = \
+	$(LDAP_LIBS)		\
+	$(UUID_LIBS)		\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	uuid-conf.ldif		\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-uuid/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-uuid/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_uuid.la: $(libipa_uuid_la_OBJECTS) $(libipa_uuid_la_DEPENDENCIES) $(EXTRA_libipa_uuid_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_uuid_la_LINK) -rpath $(plugindir) $(libipa_uuid_la_OBJECTS) $(libipa_uuid_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_uuid.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-uuid/uuid-conf.ldif

@@ -0,0 +1,15 @@
+dn: cn=IPA UUID,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA UUID
+nsslapd-pluginpath: libipa_uuid
+nsslapd-plugininitfunc: ipauuid_init
+nsslapd-plugintype: preoperation
+nsslapd-pluginenabled: on
+nsslapd-pluginid: ipauuid_version
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA UUID plugin
+nsslapd-plugin-depends-on-type: database

daemons/ipa-slapi-plugins/ipa-version/Makefile.am

@@ -0,0 +1,42 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(top_builddir)/daemons/				\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(KRB5_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 			\
+	libipa_repl_version.la	\
+	$(NULL)
+
+libipa_repl_version_la_SOURCES = 	\
+	ipa_repl_version.c		\
+	$(NULL)
+
+libipa_repl_version_la_LDFLAGS = -avoid-version
+
+libipa_repl_version_la_LIBADD = 	\
+	$(LDAP_LIBS)			\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	version-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-version/Makefile.in

@@ -0,0 +1,820 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-version
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libipa_repl_version_la_DEPENDENCIES = $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am__objects_1 =
+am_libipa_repl_version_la_OBJECTS = ipa_repl_version.lo \
+	$(am__objects_1)
+libipa_repl_version_la_OBJECTS = $(am_libipa_repl_version_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_repl_version_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_repl_version_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_repl_version_la_SOURCES)
+DIST_SOURCES = $(libipa_repl_version_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(top_builddir)/daemons/				\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(KRB5_CFLAGS)						\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_repl_version.la	\
+	$(NULL)
+
+libipa_repl_version_la_SOURCES = \
+	ipa_repl_version.c		\
+	$(NULL)
+
+libipa_repl_version_la_LDFLAGS = -avoid-version
+libipa_repl_version_la_LIBADD = \
+	$(LDAP_LIBS)			\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	version-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-version/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-version/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_repl_version.la: $(libipa_repl_version_la_OBJECTS) $(libipa_repl_version_la_DEPENDENCIES) $(EXTRA_libipa_repl_version_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_repl_version_la_LINK) -rpath $(plugindir) $(libipa_repl_version_la_OBJECTS) $(libipa_repl_version_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_repl_version.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-version/ipa_repl_version.c

@@ -0,0 +1,199 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Copyright (C) 2005 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "slapi-plugin.h"
+#include "repl-session-plugin.h"
+#include "ipa-version.h"
+#include "util.h"
+#include <string.h>
+
+/* Identify the type of data we're sending, an unsigned int in this case */
+#define REPL_VERSION_DATA_GUID "2D562D8B-2F30-4447-AF76-2B721D1D5F6A"
+
+#define IPA_PLUGIN_NAME "ipa_replication_version"
+static char *data_version = NULL;
+
+/*
+ * Plugin identifiers
+ */
+static Slapi_PluginDesc repl_version_pdesc = {
+    "ipa-repl-version-plugin",
+    "Red Hat, Inc.",
+    "1.0",
+    "IPA Replication version plugin"
+};
+
+static Slapi_ComponentId *repl_version_plugin_id = NULL;
+
+
+/*
+ * Replication Version Callbacks
+ */
+
+/*
+ * This is called on a master when we are about to acquire a
+ * replica.
+ *
+ * Returning non-0 will abort the replication session.  This
+ * results in the master going into incremental backoff mode.
+ */
+static int
+repl_version_plugin_pre_acquire_cb(void *cookie, const Slapi_DN *repl_subtree,
+                                        int is_total, char **data_guid, struct berval **data)
+{
+    LOG("repl_version_plugin_pre_acquire_cb() called for suffix \"%s\", "
+        "is_total: \"%s\".\n", slapi_sdn_get_ndn(repl_subtree),
+        is_total ? "TRUE" : "FALSE");
+
+    /* allocate some data to be sent to the replica */
+    *data_guid = slapi_ch_smprintf("%s", REPL_VERSION_DATA_GUID);
+    *data = (struct berval *)slapi_ch_malloc(sizeof(struct berval));
+    (*data)->bv_val = slapi_ch_smprintf("%s", data_version);
+    (*data)->bv_len = strlen((*data)->bv_val) + 1;
+
+    LOG("repl_version_plugin_pre_acquire_cb() sending data: guid: \"%s\" data: \"%s\".\n",
+        *data_guid, (*data)->bv_val);
+
+    return 0;
+}
+
+/*
+ * This is called on a replica when it receives a start replication
+ * extended operation from a master.
+ *
+ * The data sent by the master (version) is compared with our own
+ * hardcoded version to determine if replication can proceed or not.
+ *
+ * The replication plug-in will take care of freeing data_guid and data.
+ *
+ * Returning non-0 will abort the replication session.  This
+ * results in the master going into incremental backoff mode.
+ */
+static int
+repl_version_plugin_recv_acquire_cb(const char *repl_subtree, int is_total,
+                                         const char *data_guid, const struct berval *data)
+{
+    LOG("test_repl_session_plugin_recv_acquire_cb() called for suffix \"%s\", is_total: \"%s\".\n",
+        repl_subtree, is_total ? "TRUE" : "FALSE");
+
+    /* compare our data version to the master data version */
+    if (data_guid && data && (strcmp(data_guid, REPL_VERSION_DATA_GUID) == 0)) {
+        LOG("repl_version_plugin_recv_acquire_cb() received data: guid: \"%s\" data: \"%s\".\n",
+            data_guid, data->bv_val);
+        if (!(strcmp(data_version, data->bv_val) == 0)) {
+            LOG_FATAL("Incompatible IPA versions, pausing replication. "
+                      "This server: \"%s\" remote server: \"%s\".\n",
+                      data_version, data->bv_val);
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/*
+ * Callback list for registering API
+ */
+static void *repl_version_api[] = {
+    NULL, /* reserved for api broker use, must be zero */
+    NULL, /* init cb */
+    repl_version_plugin_pre_acquire_cb,
+    NULL, /* reply_acquire_cb */
+    NULL, /* post_acquire_cb */
+    repl_version_plugin_recv_acquire_cb,
+    NULL /* destroy cb */
+};
+
+/*
+ * Plug-in framework functions
+ */
+static int
+repl_version_plugin_start(Slapi_PBlock *pb)
+{
+    LOG("--> repl_version_plugin_start -- begin\n");
+
+    data_version = slapi_ch_smprintf("%llu", (unsigned long long) DATA_VERSION);
+
+    LOG("<-- repl_version_plugin_start -- end\n");
+    return 0;
+}
+
+static int
+repl_version_plugin_close(Slapi_PBlock *pb)
+{
+    LOG("--> repl_version_plugin_close -- begin\n");
+
+    slapi_apib_unregister(REPL_SESSION_v1_0_GUID);
+
+    slapi_ch_free_string(&data_version);
+
+    LOG("<-- repl_version_plugin_close -- end\n");
+    return 0;
+}
+
+int repl_version_plugin_init(Slapi_PBlock *pb)
+{
+    LOG("--> repl_version_plugin_init -- begin\n");
+
+    if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
+                           SLAPI_PLUGIN_VERSION_01 ) != 0 ||
+         slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
+                          (void *) repl_version_plugin_start ) != 0 ||
+         slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                          (void *) repl_version_plugin_close ) != 0 ||
+         slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
+                           (void *)&repl_version_pdesc ) != 0 )
+    {
+        LOG_FATAL("<-- repl_version_plugin_init -- failed to register plugin -- end\n");
+        return -1;
+    }
+
+    if( slapi_apib_register(REPL_SESSION_v1_0_GUID, repl_version_api) ) {
+        LOG_FATAL("<-- repl_version_plugin_start -- failed to register repl_version api -- end\n");
+        return -1;
+    }
+
+
+    /* Retrieve and save the plugin identity to later pass to
+       internal operations */
+    if (slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &repl_version_plugin_id) != 0) {
+        LOG_FATAL("<-- repl_version_plugin_init -- failed to retrieve plugin identity -- end\n");
+        return -1;
+    }
+
+    LOG("<-- repl_version_plugin_init -- end\n");
+    return 0;
+}

daemons/ipa-slapi-plugins/ipa-version/version-conf.ldif

@@ -0,0 +1,17 @@
+dn: cn=IPA Version Replication,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: IPA Version Replication
+nsslapd-pluginpath: libipa_repl_version
+nsslapd-plugininitfunc: repl_version_plugin_init
+nsslapd-plugintype: preoperation
+nsslapd-pluginenabled: off
+nsslapd-pluginid: ipa_repl_version
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat, Inc.
+nsslapd-plugindescription: IPA Replication version plugin
+nsslapd-plugin-depends-on-type: database
+nsslapd-plugin-depends-on-named: Multimaster Replication Plugin
+

daemons/ipa-slapi-plugins/ipa-winsync/Makefile.am

@@ -0,0 +1,43 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+
+AM_CPPFLAGS =							\
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = 			\
+	libipa_winsync.la		\
+	$(NULL)
+
+libipa_winsync_la_SOURCES = 		\
+	ipa-winsync.c			\
+	ipa-winsync.h			\
+	ipa-winsync-config.c			\
+	$(NULL)
+
+libipa_winsync_la_LDFLAGS = -avoid-version
+
+#libipa_winsync_la_LIBADD = 		\
+#	$(LDAP_LIBS)			\
+#	$(NULL)
+
+appdir = $(IPA_DATA_DIR)
+app_DATA =			\
+	ipa-winsync-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST =			\
+	README			\
+	$(app_DATA)		\
+	$(NULL)

daemons/ipa-slapi-plugins/ipa-winsync/Makefile.in

@@ -0,0 +1,820 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = daemons/ipa-slapi-plugins/ipa-winsync
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+libipa_winsync_la_LIBADD =
+am__objects_1 =
+am_libipa_winsync_la_OBJECTS = ipa-winsync.lo ipa-winsync-config.lo \
+	$(am__objects_1)
+libipa_winsync_la_OBJECTS = $(am_libipa_winsync_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libipa_winsync_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libipa_winsync_la_LDFLAGS) $(LDFLAGS) \
+	-o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libipa_winsync_la_SOURCES)
+DIST_SOURCES = $(libipa_winsync_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+DATA = $(app_DATA)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
+GREP = @GREP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_LIBS = @KRB5_LIBS@
+LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
+LDFLAGS = @LDFLAGS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
+NM = @NM@
+NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NSS_CFLAGS = @NSS_CFLAGS@
+NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+ODS_USER = @ODS_USER@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON2 = @PYTHON2@
+PYTHON3 = @PYTHON3@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
+RANLIB = @RANLIB@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
+STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
+VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+i18ntests = @i18ntests@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+krb5rundir = @krb5rundir@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+NULL = 
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS = \
+	-I$(srcdir)						\
+	-I$(PLUGIN_COMMON_DIR)					\
+	-DPREFIX=\""$(prefix)"\" 				\
+	-DBINDIR=\""$(bindir)"\"				\
+	-DLIBDIR=\""$(libdir)"\" 				\
+	-DLIBEXECDIR=\""$(libexecdir)"\"			\
+	-DDATADIR=\""$(datadir)"\"				\
+	$(DIRSRV_CFLAGS)					\
+	$(LDAP_CFLAGS)					\
+	$(WARN_CFLAGS)						\
+	$(NULL)
+
+plugindir = $(libdir)/dirsrv/plugins
+plugin_LTLIBRARIES = \
+	libipa_winsync.la		\
+	$(NULL)
+
+libipa_winsync_la_SOURCES = \
+	ipa-winsync.c			\
+	ipa-winsync.h			\
+	ipa-winsync-config.c			\
+	$(NULL)
+
+libipa_winsync_la_LDFLAGS = -avoid-version
+
+#libipa_winsync_la_LIBADD = 		\
+#	$(LDAP_LIBS)			\
+#	$(NULL)
+appdir = $(IPA_DATA_DIR)
+app_DATA = \
+	ipa-winsync-conf.ldif	\
+	$(NULL)
+
+EXTRA_DIST = \
+	README			\
+	$(app_DATA)		\
+	$(NULL)
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-winsync/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign daemons/ipa-slapi-plugins/ipa-winsync/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(plugindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(plugindir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+	}
+
+uninstall-pluginLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+	done
+
+clean-pluginLTLIBRARIES:
+	-test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+	@list='$(plugin_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+
+libipa_winsync.la: $(libipa_winsync_la_OBJECTS) $(libipa_winsync_la_DEPENDENCIES) $(EXTRA_libipa_winsync_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libipa_winsync_la_LINK) -rpath $(plugindir) $(libipa_winsync_la_OBJECTS) $(libipa_winsync_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa-winsync-config.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa-winsync.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-appDATA: $(app_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(appdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(appdir)" || exit $$?; \
+	done
+
+uninstall-appDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES) $(DATA)
+installdirs:
+	for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(appdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-appDATA install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
+	clean-libtool clean-pluginLTLIBRARIES cscopelist-am ctags \
+	ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-pluginLTLIBRARIES install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-appDATA uninstall-pluginLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-conf.ldif

@@ -0,0 +1,28 @@
+dn: cn=ipa-winsync,cn=plugins,cn=config
+changetype: add
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: ipa-winsync
+nsslapd-pluginpath: libipa_winsync
+nsslapd-plugininitfunc: ipa_winsync_plugin_init
+nsslapd-pluginDescription: Allows IPA to work with the DS windows sync feature
+nsslapd-pluginid: ipa-winsync
+nsslapd-pluginversion: 1.0
+nsslapd-pluginvendor: Red Hat
+nsslapd-plugintype: preoperation
+nsslapd-pluginenabled: on
+nsslapd-plugin-depends-on-type: database
+ipaWinSyncRealmFilter: (objectclass=krbRealmContainer)
+ipaWinSyncRealmAttr: cn
+ipaWinSyncNewEntryFilter: (cn=ipaConfig)
+ipaWinSyncNewUserOCAttr: ipauserobjectclasses
+ipaWinSyncUserFlatten: true
+ipaWinsyncHomeDirAttr: ipaHomesRootDir
+ipaWinsyncLoginShellAttr: ipaDefaultLoginShell
+ipaWinSyncDefaultGroupAttr: ipaDefaultPrimaryGroup
+ipaWinSyncDefaultGroupFilter: (gidNumber=*)(objectclass=posixGroup)(objectclass=groupOfNames)
+ipaWinSyncAcctDisable: both
+ipaWinSyncForceSync: true
+ipaWinSyncUserAttr: uidNumber -1
+ipaWinSyncUserAttr: gidNumber -1

daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync.h

@@ -0,0 +1,173 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Rich Megginson <rmeggins@redhat.com>
+ *
+ * Copyright (C) 2008 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+#ifdef WINSYNC_TEST_IPA
+#include <slapi-plugin.h>
+#include "winsync-plugin.h"
+#else /* the default */
+#include <dirsrv/slapi-plugin.h>
+#include <dirsrv/winsync-plugin.h>
+#endif /* WINSYNC_TEST_IPA */
+
+#include <string.h>
+#include <strings.h>
+
+#include "util.h"
+
+#define IPA_PLUGIN_NAME "ipa-winsync"
+
+typedef struct ipa_winsync_config_struct {
+    Slapi_Mutex *lock; /* for config access */
+    Slapi_Entry *config_e; /* configuration entry */
+    PRBool flatten; /* flatten AD DNs */
+    char *realm_filter;
+    char *realm_attr;
+    char *new_entry_filter;
+    char *new_user_oc_attr; /* don't care about groups for now */
+    char *homedir_prefix_attr;
+    char *login_shell_attr;
+    char *default_group_attr;
+    char *default_group_filter;
+    int acct_disable; /* see below for possible values */
+    char *inactivated_filter;
+    char *activated_filter;
+    PRBool forceSync;
+} IPA_WinSync_Config;
+
+/*
+  This is the structure that holds our domain 
+  specific configuration
+*/
+typedef struct ipa_winsync_domain_config {
+    Slapi_Entry *domain_e; /* info is stored in this entry */
+    char *realm_name; /* realm name */
+    char *homedir_prefix;
+    char *login_shell;
+    char *inactivated_group_dn; /* DN of inactivated group */
+    char *activated_group_dn; /* DN of activated group */
+} IPA_WinSync_Domain_Config;
+
+void ipa_winsync_set_plugin_identity(void * identity);
+void * ipa_winsync_get_plugin_identity(void);
+
+int ipa_winsync_config( Slapi_Entry *config_e );
+IPA_WinSync_Config *ipa_winsync_get_config( void );
+
+/*
+ * Agreement/domain specific configuration
+ */
+/* return a new domain specific configuration object */
+void *ipa_winsync_config_new_domain(const Slapi_DN *ds_subtree, const Slapi_DN *ad_subtree);
+/* refresh the domain specific configuration object */
+void ipa_winsync_config_refresh_domain(void *cbdata, const Slapi_DN *ds_subtree, const Slapi_DN *ad_subtree);
+/* destroy the domain specific configuration object */
+void ipa_winsync_config_destroy_domain(void *cbdata, const Slapi_DN *ds_subtree, const Slapi_DN *ad_subtree);
+
+/* name of attribute holding the filter to use to
+   find the ipa realm value
+*/
+#define IPA_WINSYNC_REALM_FILTER_ATTR "ipaWinSyncRealmFilter"
+/* name of attribute holding the name of the attribute
+   which contains the ipa realm value
+*/
+#define IPA_WINSYNC_REALM_ATTR_ATTR "ipaWinSyncRealmAttr"
+/* name of attribute holding the filter to use to
+   find the new user template entry
+*/
+#define IPA_WINSYNC_NEW_ENTRY_FILTER_ATTR "ipaWinSyncNewEntryFilter"
+/* name of attribute holding the name of the attribute
+   in the new user template entry which has the list of objectclasses
+*/
+#define IPA_WINSYNC_NEW_USER_OC_ATTR "ipaWinSyncNewUserOCAttr"
+/* name of attribute holding the new user attributes and values */
+#define IPA_WINSYNC_NEW_USER_ATTRS_VALS "ipaWinSyncUserAttr"
+/* name of attribute holding the name of the attribute which
+   has the homeDirectory prefix - suffix is the uid */
+#define IPA_WINSYNC_HOMEDIR_PREFIX_ATTR "ipaWinSyncHomeDirAttr"
+/* name of attribute holding the name of the attribute which
+   has the loginShell value */
+#define IPA_WINSYNC_LOGIN_SHELL_ATTR "ipaWinSyncLoginShellAttr"
+/* name of attribute holding the name of the attribute which is
+   used to get the default posix gidNumber */
+#define IPA_WINSYNC_DEFAULTGROUP_ATTR "ipaWinSyncDefaultGroupAttr"
+/* filter used to find the group with the gid number whose group name
+   is in the IPA_WINSYNC_DEFAULTGROUP_ATTR - the filter will have
+   cn=valueofIPA_WINSYNC_DEFAULTGROUP_ATTR appended to it */
+#define IPA_WINSYNC_DEFAULTGROUP_FILTER_ATTR "ipaWinSyncDefaultGroupFilter"
+/* name of attribute holding boolean value to flatten user dns or not */
+#define IPA_WINSYNC_USER_FLATTEN "ipaWinSyncUserFlatten"
+/* name of attribute holding account disable sync value */
+#define IPA_WINSYNC_ACCT_DISABLE "ipaWinSyncAcctDisable"
+/* possible values of IPA_WINSYNC_ACCT_DISABLE */
+#define IPA_WINSYNC_ACCT_DISABLE_NONE "none"
+#define IPA_WINSYNC_ACCT_DISABLE_TO_AD "to_ad"
+#define IPA_WINSYNC_ACCT_DISABLE_TO_DS "to_ds"
+#define IPA_WINSYNC_ACCT_DISABLE_BOTH "both"
+/* enum representing the values above */
+enum {
+    ACCT_DISABLE_INVALID, /* the invalid value */
+    ACCT_DISABLE_NONE, /* do not sync acct disable status */
+    ACCT_DISABLE_TO_AD, /* sync only from ds to ad */
+    ACCT_DISABLE_TO_DS, /* sync only from ad to ds */
+    ACCT_DISABLE_BOTH /* bi-directional sync */
+};
+/* name of attributes holding the search filters to use to find
+   the DN of the groups that represent inactivated and activated users */
+#define IPA_WINSYNC_INACTIVATED_FILTER "ipaWinSyncInactivatedFilter"
+#define IPA_WINSYNC_ACTIVATED_FILTER "ipaWinSyncActivatedFilter"
+/* name of attribute holding the value of the forceSync parameter -
+   this is a boolean attribute - if true, all users in AD that have
+   a corresponding entry in the DS will be synced - there will be no
+   way to "turn off sync" on individual entries - if this value is
+   false, only users which have the ntUser objectclass and an
+   ntDomainUserID attribute which corresponds to an AD account
+   with the same value for samAccountName will be synced
+*/
+#define IPA_WINSYNC_FORCE_SYNC "ipaWinSyncForceSync"
+
+/* Path to UPG configuration */
+#define IPA_WINSYNC_UPG_DEF_DN "cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,%s"
+#define IPA_WINSYNC_UPG_DEF_ATTR "originfilter"
+#define IPA_WINSYNC_UPG_DEF_DISABLED "(objectclass=disable)"

daemons/ipa-slapi-plugins/libotp/Makefile.am

@@ -0,0 +1,18 @@
+NULL =
+
+PLUGIN_COMMON_DIR = $(srcdir)/../common
+AM_CPPFLAGS =							\
+	-I$(PLUGIN_COMMON_DIR)					\
+	$(DIRSRV_CFLAGS)					\
+	$(NSPR_CFLAGS)						\
+	$(NSS_CFLAGS)						\
+	$(NULL)
+
+noinst_LTLIBRARIES = libhotp.la libotp.la
+libhotp_la_SOURCES = hotp.c hotp.h
+libotp_la_SOURCES = otp_config.c otp_config.h otp_token.c otp_token.h
+libotp_la_LIBADD = libhotp.la
+
+check_PROGRAMS = t_hotp
+TESTS = $(check_PROGRAMS)
+t_hotp_LDADD = libhotp.la $(NSPR_LIBS) $(NSS_LIBS)

daemons/ipa-slapi-plugins/libotp/hotp.c

@@ -0,0 +1,170 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+/*
+ * This file contains an implementation of HOTP (RFC 4226) and TOTP (RFC 6238).
+ * For details of how these algorithms work, please see the relevant RFCs.
+ */
+
+#include "hotp.h"
+#include <time.h>
+
+#include <nss.h>
+#include <pk11pub.h>
+#include <hasht.h>
+#include <prnetdb.h>
+
+struct digest_buffer {
+    uint8_t buf[SHA512_LENGTH];
+    unsigned int len;
+};
+
+static const struct {
+    const char *algo;
+    CK_MECHANISM_TYPE mech;
+} algo2mech[] = {
+    { "sha1",   CKM_SHA_1_HMAC },
+    { "sha256", CKM_SHA256_HMAC },
+    { "sha384", CKM_SHA384_HMAC },
+    { "sha512", CKM_SHA512_HMAC },
+    { }
+};
+
+/*
+ * This code is mostly cargo-cult taken from here:
+ *   http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn5.html
+ *
+ * It should implement HMAC with the given mechanism (SHA: 1, 256, 384, 512).
+ */
+static bool hmac(SECItem *key, CK_MECHANISM_TYPE mech, const SECItem *in,
+                 struct digest_buffer *out)
+{
+    SECItem param = { siBuffer, NULL, 0 };
+    PK11SlotInfo *slot = NULL;
+    PK11SymKey *symkey = NULL;
+    PK11Context *ctx = NULL;
+    bool ret = false;
+    SECStatus s;
+
+    slot = PK11_GetBestSlot(mech, NULL);
+    if (slot == NULL) {
+        slot = PK11_GetInternalKeySlot();
+        if (slot == NULL) {
+            goto done;
+        }
+    }
+
+    symkey = PK11_ImportSymKey(slot, mech, PK11_OriginUnwrap,
+                               CKA_SIGN, key, NULL);
+    if (symkey == NULL)
+        goto done;
+
+    ctx = PK11_CreateContextBySymKey(mech, CKA_SIGN, symkey, &param);
+    if (ctx == NULL)
+        goto done;
+
+    s = PK11_DigestBegin(ctx);
+    if (s != SECSuccess)
+        goto done;
+
+    s = PK11_DigestOp(ctx, in->data, in->len);
+    if (s != SECSuccess)
+        goto done;
+
+    s = PK11_DigestFinal(ctx, out->buf, &out->len, sizeof(out->buf));
+    if (s != SECSuccess)
+        goto done;
+
+    ret = true;
+
+done:
+    if (ctx != NULL)
+        PK11_DestroyContext(ctx, PR_TRUE);
+    if (symkey != NULL)
+        PK11_FreeSymKey(symkey);
+    if (slot != NULL)
+        PK11_FreeSlot(slot);
+    return ret;
+}
+
+/*
+ * An implementation of HOTP (RFC 4226).
+ */
+bool hotp(const struct hotp_token *token, uint64_t counter, uint32_t *out)
+{
+    const SECItem cntr = { siBuffer, (uint8_t *) &counter, sizeof(counter) };
+    SECItem keyitm = { siBuffer, token->key.bytes, token->key.len };
+    CK_MECHANISM_TYPE mech = CKM_SHA_1_HMAC;
+    PRUint64 offset, binary, div;
+    struct digest_buffer digest;
+    int digits = token->digits;
+    int i;
+
+    /* Convert counter to network byte order. */
+    counter = PR_htonll(counter);
+
+    /* Find the mech. */
+    for (i = 0; algo2mech[i].algo; i++) {
+        if (strcasecmp(algo2mech[i].algo, token->algo) == 0) {
+            mech = algo2mech[i].mech;
+            break;
+        }
+    }
+
+    /* Create the digits divisor. */
+    for (div = 1; digits > 0; digits--) {
+        div *= 10;
+    }
+
+    /* Do the digest. */
+    if (!hmac(&keyitm, mech, &cntr, &digest)) {
+        return false;
+    }
+
+    /* Truncate. */
+    offset  = digest.buf[digest.len - 1] & 0xf;
+    binary  = (digest.buf[offset + 0] & 0x7f) << 0x18;
+    binary |= (digest.buf[offset + 1] & 0xff) << 0x10;
+    binary |= (digest.buf[offset + 2] & 0xff) << 0x08;
+    binary |= (digest.buf[offset + 3] & 0xff) << 0x00;
+    binary  = binary % div;
+
+    *out = binary;
+    return true;
+}

daemons/ipa-slapi-plugins/libotp/hotp.h

@@ -0,0 +1,60 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+struct hotp_token_key {
+    uint8_t *bytes;
+    size_t len;
+};
+
+struct hotp_token {
+    struct hotp_token_key key;
+    char *algo;
+    int digits;
+};
+
+/*
+ * An implementation of HOTP (RFC 4226).
+ */
+bool hotp(const struct hotp_token *token, uint64_t counter, uint32_t *out);

daemons/ipa-slapi-plugins/libotp/otp_config.c

@@ -0,0 +1,364 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "otp_config.h"
+#include "util.h"
+
+#include <pratom.h>
+#include <plstr.h>
+
+#define OTP_CONFIG_AUTH_TYPE_DISABLED (1 << 31)
+
+struct spec {
+    uint32_t (*func)(Slapi_Entry *, const char *attr);
+    const char *prefix;
+    const char *attr;
+    uint32_t dflt;
+};
+
+struct record {
+    struct record *next;
+    const struct spec *spec;
+    Slapi_DN *sdn;
+    uint32_t value;
+};
+
+struct otp_config {
+    Slapi_ComponentId *plugin_id;
+    struct record *records;
+};
+
+static uint32_t string_to_types(const char *str)
+{
+    static const struct {
+        const char *string;
+        uint32_t config;
+    } map[] = {
+        { "disabled", OTP_CONFIG_AUTH_TYPE_DISABLED },
+        { "password", OTP_CONFIG_AUTH_TYPE_PASSWORD },
+        { "otp",      OTP_CONFIG_AUTH_TYPE_OTP },
+        { "pkinit",   OTP_CONFIG_AUTH_TYPE_PKINIT },
+        { "radius",   OTP_CONFIG_AUTH_TYPE_RADIUS },
+        {}
+    };
+
+    for (uint32_t i = 0; map[i].string != NULL; i++) {
+        if (strcasecmp(map[i].string, str) == 0)
+            return map[i].config;
+    }
+
+    return OTP_CONFIG_AUTH_TYPE_NONE;
+}
+
+static uint32_t entry_to_authtypes(Slapi_Entry *e, const char *attr)
+{
+    char **auth_types = NULL;
+
+    if (e == NULL)
+        return OTP_CONFIG_AUTH_TYPE_NONE;
+
+    /* Fetch the auth type values from the config entry. */
+    auth_types = slapi_entry_attr_get_charray(e, attr);
+    if (auth_types == NULL)
+        return OTP_CONFIG_AUTH_TYPE_NONE;
+
+    uint32_t types = OTP_CONFIG_AUTH_TYPE_NONE;
+    for (uint32_t i = 0; auth_types[i] != NULL; i++)
+        types |= string_to_types(auth_types[i]);
+
+    slapi_ch_array_free(auth_types);
+    return types;
+}
+
+static uint32_t entry_to_window(Slapi_Entry *e, const char *attr)
+{
+    long long val;
+
+    if (e == NULL)
+        return 0;
+
+    val = slapi_entry_attr_get_longlong(e, attr);
+    return val > 0 ? val : 0;
+}
+
+static const struct spec authtypes = {
+    entry_to_authtypes,
+    "cn=ipaConfig,cn=etc,%s",
+    "ipaUserAuthType",
+    OTP_CONFIG_AUTH_TYPE_PASSWORD
+};
+
+static const struct spec totp_auth_window = {
+    entry_to_window,
+    "cn=otp,cn=etc,%s",
+    "ipatokenTOTPauthWindow",
+    300
+};
+
+static const struct spec totp_sync_window = {
+    entry_to_window,
+    "cn=otp,cn=etc,%s",
+    "ipatokenTOTPsyncWindow",
+    86400
+};
+
+static const struct spec hotp_auth_window = {
+    entry_to_window,
+    "cn=otp,cn=etc,%s",
+    "ipatokenHOTPauthWindow",
+    10
+};
+
+static const struct spec hotp_sync_window = {
+    entry_to_window,
+    "cn=otp,cn=etc,%s",
+    "ipatokenHOTPsyncWindow",
+    100
+};
+
+static Slapi_DN *make_sdn(const char *prefix, const Slapi_DN *suffix)
+{
+    char *dn = slapi_ch_smprintf(prefix, slapi_sdn_get_dn(suffix));
+    return slapi_sdn_new_dn_passin(dn);
+}
+
+static uint32_t find_value(const struct otp_config *cfg,
+                           const Slapi_DN *suffix, const struct spec *spec)
+{
+    uint32_t value = 0;
+    Slapi_DN *sdn;
+
+    sdn = make_sdn(spec->prefix, suffix);
+    for (struct record *rec = cfg->records; rec != NULL; rec = rec->next) {
+        if (rec->spec != spec)
+            continue;
+
+        if (slapi_sdn_compare(sdn, rec->sdn) != 0)
+            continue;
+
+        value = PR_ATOMIC_ADD(&rec->value, 0);
+        break;
+    }
+
+    slapi_sdn_free(&sdn);
+    return value;
+}
+
+static void update(const struct otp_config *cfg, Slapi_DN *src,
+                   Slapi_Entry *entry)
+{
+    Slapi_DN *dst = entry == NULL ? NULL : slapi_entry_get_sdn(entry);
+
+    for (struct record *rec = cfg->records; rec != NULL; rec = rec->next) {
+        uint32_t val = rec->spec->dflt;
+
+        /* If added, modified or moved into place... */
+        if (dst != NULL && slapi_sdn_compare(rec->sdn, dst) == 0) {
+            Slapi_Attr *attr = NULL;
+            if (slapi_entry_attr_find(entry, rec->spec->attr, &attr) == 0)
+                val = rec->spec->func(entry, rec->spec->attr);
+
+        /* If NOT deleted or moved out of place... */
+        } else if (slapi_sdn_compare(rec->sdn, src) != 0)
+            continue;
+
+        PR_ATOMIC_SET(&rec->value, val);
+    }
+}
+
+struct otp_config *otp_config_init(Slapi_ComponentId *plugin_id)
+{
+    static const struct spec *specs[] = {
+        &authtypes,
+        &totp_auth_window,
+        &totp_sync_window,
+        &hotp_auth_window,
+        &hotp_sync_window,
+        NULL
+    };
+
+    struct otp_config *cfg = NULL;
+    void *node = NULL;
+    int search_result = 0;
+
+    cfg = (typeof(cfg)) slapi_ch_calloc(1, sizeof(*cfg));
+    cfg->plugin_id = plugin_id;
+
+    /* Build the config table. */
+    for (Slapi_DN *sfx = slapi_get_first_suffix(&node, 0);
+         sfx != NULL;
+         sfx = slapi_get_next_suffix(&node, 0)) {
+        for (size_t i = 0; specs[i] != NULL; i++) {
+            Slapi_Entry *entry = NULL;
+            struct record *rec;
+
+            /* Create the config entry. */
+            rec = (typeof(rec)) slapi_ch_calloc(1, sizeof(*rec));
+            rec->spec = specs[i];
+            rec->sdn = make_sdn(rec->spec->prefix, sfx);
+
+            /* Add config to the list. */
+            rec->next = cfg->records;
+            cfg->records = rec;
+
+            /* Load the specified entry. */
+            search_result = slapi_search_internal_get_entry(rec->sdn,
+                    NULL, &entry, plugin_id);
+            if (search_result != LDAP_SUCCESS) {
+                LOG_TRACE("File '%s' line %d: Unable to access LDAP entry "
+                        "'%s'. Perhaps it doesn't exist? "
+                        "Error code: %d\n", __FILE__, __LINE__,
+                        slapi_sdn_get_dn(rec->sdn), search_result);
+            }
+            update(cfg, rec->sdn, entry);
+            slapi_entry_free(entry);
+        }
+    }
+
+    return cfg;
+}
+
+static void record_fini(struct record **rec)
+{
+    if (rec == NULL || *rec == NULL)
+        return;
+
+    record_fini(&(*rec)->next);
+    slapi_sdn_free(&(*rec)->sdn);
+    slapi_ch_free((void **) rec);
+}
+
+void otp_config_fini(struct otp_config **cfg)
+{
+    if (cfg == NULL || *cfg == NULL)
+        return;
+
+    record_fini(&(*cfg)->records);
+    slapi_ch_free((void **) cfg);
+}
+
+void otp_config_update(struct otp_config *cfg, Slapi_PBlock *pb)
+{
+    Slapi_Entry *entry = NULL;
+    Slapi_DN *src = NULL;
+    int oprc = 0;
+
+    /* Just bail if the operation failed. */
+    if (slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &oprc) != 0 || oprc != 0)
+        return;
+
+    /* Get the source SDN. */
+    if (slapi_pblock_get(pb, SLAPI_TARGET_SDN, &src) != 0)
+        return;
+
+    /* Ignore the error here (delete operations). */
+    (void) slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &entry);
+
+    update(cfg, src, entry);
+}
+
+Slapi_ComponentId *otp_config_plugin_id(const struct otp_config *cfg)
+{
+    if (cfg == NULL)
+        return NULL;
+
+    return cfg->plugin_id;
+}
+
+uint32_t otp_config_auth_types(const struct otp_config *cfg,
+                               Slapi_Entry *user_entry)
+{
+    uint32_t glbl = OTP_CONFIG_AUTH_TYPE_NONE;
+    uint32_t user = OTP_CONFIG_AUTH_TYPE_NONE;
+    const Slapi_DN *sfx;
+
+    /* Load the global value. */
+    sfx = slapi_get_suffix_by_dn(slapi_entry_get_sdn(user_entry));
+    glbl = find_value(cfg, sfx, &authtypes);
+
+    /* Load the user value if not disabled. */
+    if ((glbl & OTP_CONFIG_AUTH_TYPE_DISABLED) == 0)
+        user = entry_to_authtypes(user_entry, authtypes.attr);
+
+    /* Filter out the disabled flag. */
+    glbl &= ~OTP_CONFIG_AUTH_TYPE_DISABLED;
+    user &= ~OTP_CONFIG_AUTH_TYPE_DISABLED;
+
+    if (user != OTP_CONFIG_AUTH_TYPE_NONE)
+        return user;
+
+    if (glbl != OTP_CONFIG_AUTH_TYPE_NONE)
+        return glbl;
+
+    return OTP_CONFIG_AUTH_TYPE_PASSWORD;
+}
+
+struct otp_config_window
+otp_config_window(const struct otp_config *cfg, Slapi_Entry *token_entry)
+{
+    const struct spec *auth = NULL, *sync = NULL;
+    struct otp_config_window wndw = { 0, 0 };
+    const Slapi_DN *sfx;
+    char **clses;
+
+    sfx = slapi_get_suffix_by_dn(slapi_entry_get_sdn_const(token_entry));
+
+    clses = slapi_entry_attr_get_charray(token_entry, SLAPI_ATTR_OBJECTCLASS);
+    for (size_t i = 0; clses != NULL && clses[i] != NULL; i++) {
+        if (strcasecmp(clses[i], "ipatokenTOTP") == 0) {
+            auth = &totp_auth_window;
+            sync = &totp_sync_window;
+            break;
+        }
+
+        if (strcasecmp(clses[i], "ipatokenHOTP") == 0) {
+            auth = &hotp_auth_window;
+            sync = &hotp_sync_window;
+            break;
+        }
+    }
+    slapi_ch_array_free(clses);
+
+    if (auth == NULL || sync == NULL)
+        return wndw;
+
+    wndw.auth = find_value(cfg, sfx, auth);
+    wndw.sync = find_value(cfg, sfx, sync);
+    return wndw;
+}

daemons/ipa-slapi-plugins/libotp/otp_config.h

@@ -0,0 +1,82 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2014 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include <dirsrv/slapi-plugin.h>
+
+#define OTP_CONFIG_AUTH_TYPE_NONE     0
+#define OTP_CONFIG_AUTH_TYPE_PASSWORD (1 << 0)
+#define OTP_CONFIG_AUTH_TYPE_OTP      (1 << 1)
+#define OTP_CONFIG_AUTH_TYPE_PKINIT   (1 << 2)
+#define OTP_CONFIG_AUTH_TYPE_RADIUS   (1 << 3)
+
+struct otp_config;
+
+struct otp_config_window {
+    uint32_t auth;
+    uint32_t sync;
+};
+
+struct otp_config *otp_config_init(Slapi_ComponentId *plugin_id);
+
+void otp_config_fini(struct otp_config **cfg);
+
+void otp_config_update(struct otp_config *cfg, Slapi_PBlock *pb);
+
+Slapi_ComponentId *otp_config_plugin_id(const struct otp_config *cfg);
+
+/* Gets the permitted authentication types for the given user entry.
+ *
+ * The entry should be queried for the "ipaUserAuthType" attribute.
+ */
+uint32_t otp_config_auth_types(const struct otp_config *cfg,
+                               Slapi_Entry *user_entry);
+
+/* Gets the window sizes for a token.
+ *
+ * The entry should be queried for the following attributes:
+ *   objectClass
+ *   ipatokenTOTPauthWindow
+ *   ipatokenTOTPsyncWindow
+ *   ipatokenHOTPauthWindow
+ *   ipatokenHOTPsyncWindow
+ */
+struct otp_config_window otp_config_window(const struct otp_config *cfg,
+                                           Slapi_Entry *token_entry);

daemons/ipa-slapi-plugins/libotp/otp_token.c

@@ -0,0 +1,533 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include "otp_token.h"
+#include "otp_config.h"
+#include "hotp.h"
+
+#include <time.h>
+#include <errno.h>
+
+#define TOKEN(s) "ipaToken" s
+#define O(s) TOKEN("OTP" s)
+#define T(s) TOKEN("TOTP" s)
+#define H(s) TOKEN("HOTP" s)
+
+#define IPA_OTP_DEFAULT_TOKEN_STEP 30
+#define IPA_OTP_OBJCLS_FILTER \
+    "(|(objectClass=ipaTokenTOTP)(objectClass=ipaTokenHOTP))"
+
+enum type {
+    TYPE_NONE = 0,
+    TYPE_TOTP,
+    TYPE_HOTP,
+};
+
+struct otp_token {
+    const struct otp_config *cfg;
+    Slapi_DN *sdn;
+    struct hotp_token token;
+    enum type type;
+    struct otp_config_window window;
+    union {
+        struct {
+            uint64_t watermark;
+            int step; /* Seconds. */
+            int offset;
+        } totp;
+        struct {
+            uint64_t counter;
+        } hotp;
+    };
+};
+
+static inline bool is_algo_valid(const char *algo)
+{
+    static const char *valid_algos[] = { "sha1", "sha256", "sha384",
+                                         "sha512", NULL };
+    int i, ret;
+
+    for (i = 0; valid_algos[i]; i++) {
+        ret = strcasecmp(algo, valid_algos[i]);
+        if (ret == 0)
+            return true;
+    }
+
+    return false;
+}
+
+static const struct berval *entry_attr_get_berval(const Slapi_Entry* e,
+                                                  const char *type)
+{
+    Slapi_Attr* attr = NULL;
+    Slapi_Value *v;
+    int ret;
+
+    ret = slapi_entry_attr_find(e, type, &attr);
+    if (ret != 0 || attr == NULL)
+        return NULL;
+
+    ret = slapi_attr_first_value(attr, &v);
+    if (ret < 0)
+        return NULL;
+
+    return slapi_value_get_berval(v);
+}
+
+static bool writeattr(const struct otp_token *token, const char *attr,
+                      long long val)
+{
+    Slapi_PBlock *pb = NULL;
+    bool success = false;
+    char value[32];
+    int ret;
+
+    LDAPMod *mods[] = {
+        &(LDAPMod) {
+            LDAP_MOD_REPLACE, (char *) attr,
+            .mod_values = (char *[]) { value, NULL }
+        },
+        NULL
+    };
+
+    snprintf(value, sizeof(value), "%lld", val);
+
+    pb = slapi_pblock_new();
+    slapi_modify_internal_set_pb(pb, slapi_sdn_get_dn(token->sdn), mods, NULL,
+                                 NULL, otp_config_plugin_id(token->cfg), 0);
+    if (slapi_modify_internal_pb(pb) != 0)
+        goto error;
+    if (slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret) != 0)
+        goto error;
+    if (ret != LDAP_SUCCESS)
+        goto error;
+
+    success = true;
+
+error:
+    slapi_pblock_destroy(pb);
+    return success;
+}
+
+/**
+ * Validate a token.
+ *
+ * If the second token code is specified, perform synchronization.
+ */
+static bool validate(struct otp_token *token, time_t now, ssize_t step,
+                     uint32_t first, const uint32_t *second)
+{
+    const char *attr;
+    uint32_t tmp;
+
+    /* Calculate the absolute step. */
+    switch (token->type) {
+    case TYPE_TOTP:
+        attr = T("watermark");
+        step = (now + token->totp.offset) / token->totp.step + step;
+        if (token->totp.watermark > 0 && step < token->totp.watermark)
+            return false;
+        break;
+    case TYPE_HOTP:
+        if (step < 0) /* NEVER go backwards! */
+            return false;
+        attr = H("counter");
+        step = token->hotp.counter + step;
+        break;
+    default:
+        return false;
+    }
+
+    /* Validate the first code. */
+    if (!hotp(&token->token, step++, &tmp))
+        return false;
+
+    if (first != tmp)
+        return false;
+
+    /* Validate the second code if specified. */
+    if (second != NULL) {
+        if (!hotp(&token->token, step++, &tmp))
+            return false;
+
+        if (*second != tmp)
+            return false;
+    }
+
+    /* Write the step value. */
+    if (!writeattr(token, attr, step))
+        return false;
+
+    /* Save our modifications to the object. */
+    switch (token->type) {
+    case TYPE_TOTP:
+        /* Perform optional synchronization steps. */
+        if (second != NULL) {
+            long long off = (step - now / token->totp.step) * token->totp.step;
+            if (!writeattr(token, T("clockOffset"), off))
+                return false;
+            token->totp.offset = off;
+        }
+        token->totp.watermark = step;
+        break;
+    case TYPE_HOTP:
+        token->hotp.counter = step;
+        break;
+    default:
+        break;
+    }
+
+    return true;
+}
+
+static void otp_token_free(struct otp_token *token)
+{
+    if (token == NULL)
+        return;
+
+    slapi_sdn_free(&token->sdn);
+    free(token->token.key.bytes);
+    slapi_ch_free_string(&token->token.algo);
+    free(token);
+}
+
+void otp_token_free_array(struct otp_token **tokens)
+{
+    if (tokens == NULL)
+        return;
+
+    for (size_t i = 0; tokens[i] != NULL; i++)
+        otp_token_free(tokens[i]);
+
+    free(tokens);
+}
+
+static struct otp_token *otp_token_new(const struct otp_config *cfg,
+                                       Slapi_Entry *entry)
+{
+    const struct berval *tmp;
+    struct otp_token *token;
+    char **vals;
+
+    token = calloc(1, sizeof(struct otp_token));
+    if (token == NULL)
+        return NULL;
+    token->cfg = cfg;
+    token->window = otp_config_window(cfg, entry);
+
+    /* Get the token type. */
+    vals = slapi_entry_attr_get_charray(entry, "objectClass");
+    if (vals == NULL)
+        goto error;
+    token->type = TYPE_NONE;
+    for (int i = 0; vals[i] != NULL; i++) {
+        if (strcasecmp(vals[i], "ipaTokenTOTP") == 0)
+            token->type = TYPE_TOTP;
+        else if (strcasecmp(vals[i], "ipaTokenHOTP") == 0)
+            token->type = TYPE_HOTP;
+    }
+    slapi_ch_array_free(vals);
+    if (token->type == TYPE_NONE)
+        goto error;
+
+    /* Get SDN. */
+    token->sdn = slapi_sdn_dup(slapi_entry_get_sdn(entry));
+    if (token->sdn == NULL)
+        goto error;
+
+    /* Get key. */
+    tmp = entry_attr_get_berval(entry, O("key"));
+    if (tmp == NULL)
+        goto error;
+    token->token.key.len = tmp->bv_len;
+    token->token.key.bytes = malloc(token->token.key.len);
+    if (token->token.key.bytes == NULL)
+        goto error;
+    memcpy(token->token.key.bytes, tmp->bv_val, token->token.key.len);
+
+    /* Get length. */
+    token->token.digits = slapi_entry_attr_get_int(entry, O("digits"));
+    if (token->token.digits != 6 && token->token.digits != 8)
+        goto error;
+
+    /* Get algorithm. */
+    token->token.algo = slapi_entry_attr_get_charptr(entry, O("algorithm"));
+    if (token->token.algo == NULL)
+        token->token.algo = slapi_ch_strdup("sha1");
+    if (!is_algo_valid(token->token.algo))
+        goto error;
+
+    switch (token->type) {
+    case TYPE_TOTP:
+        /* Get offset. */
+        token->totp.offset = slapi_entry_attr_get_int(entry, T("clockOffset"));
+
+        /* Get watermark. */
+        token->totp.watermark = slapi_entry_attr_get_int(entry, T("watermark"));
+
+        /* Get step. */
+        token->totp.step = slapi_entry_attr_get_uint(entry, T("timeStep"));
+        if (token->totp.step < 5)
+            token->totp.step = IPA_OTP_DEFAULT_TOKEN_STEP;
+        break;
+    case TYPE_HOTP:
+        /* Get counter. */
+        token->hotp.counter = slapi_entry_attr_get_int(entry, H("counter"));
+        break;
+    default:
+        break;
+    }
+
+    return token;
+
+error:
+    otp_token_free(token);
+    return NULL;
+}
+
+static struct otp_token **find(const struct otp_config *cfg, const char *user_dn,
+                               const char *token_dn, const char *intfilter,
+                               const char *extfilter)
+{
+    struct otp_token **tokens = NULL;
+    const Slapi_DN *basedn = NULL;
+    Slapi_Entry **entries = NULL;
+    Slapi_PBlock *pb = NULL;
+    Slapi_DN *sdn = NULL;
+    char *filter = NULL;
+    size_t count = 0;
+    int result = -1;
+
+    if (intfilter == NULL)
+        intfilter = "";
+
+    if (extfilter == NULL)
+        extfilter = "";
+
+    /* Create the filter. */
+    if (user_dn == NULL) {
+        filter = "(&" IPA_OTP_OBJCLS_FILTER "%s%s)";
+        filter = slapi_filter_sprintf(filter, intfilter, extfilter);
+    } else {
+        filter = "(&" IPA_OTP_OBJCLS_FILTER "(ipatokenOwner=%s%s)%s%s)";
+        filter = slapi_filter_sprintf(filter, ESC_AND_NORM_NEXT_VAL,
+                                      user_dn, intfilter, extfilter);
+    }
+
+    /* Create the search. */
+    pb = slapi_pblock_new();
+    if (token_dn != NULL) {
+        /* Find only the token specified. */
+        slapi_search_internal_set_pb(pb, token_dn, LDAP_SCOPE_BASE, filter,
+                                     NULL, 0, NULL, NULL,
+                                     otp_config_plugin_id(cfg), 0);
+    } else {
+        sdn = slapi_sdn_new_dn_byval(user_dn);
+        basedn = slapi_get_suffix_by_dn(sdn);
+        slapi_sdn_free(&sdn);
+        if (basedn == NULL)
+            goto error;
+
+        /* Find all user tokens. */
+        slapi_search_internal_set_pb(pb, slapi_sdn_get_dn(basedn),
+                                     LDAP_SCOPE_SUBTREE, filter, NULL, 0,
+                                     NULL, NULL, otp_config_plugin_id(cfg), 0);
+    }
+    slapi_search_internal_pb(pb);
+    slapi_ch_free_string(&filter);
+
+    /* Get the results. */
+    slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+    if (result != LDAP_SUCCESS)
+        goto error;
+    slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
+    if (entries == NULL)
+        goto error;
+
+    /* TODO: Can I get the count another way? */
+    for (count = 0; entries[count] != NULL; count++)
+        continue;
+
+    /* Create the array. */
+    tokens = calloc(count + 1, sizeof(*tokens));
+    if (tokens == NULL)
+        goto error;
+    for (count = 0; entries[count] != NULL; count++) {
+        tokens[count] = otp_token_new(cfg, entries[count]);
+        if (tokens[count] == NULL) {
+            otp_token_free_array(tokens);
+            tokens = NULL;
+            goto error;
+        }
+    }
+
+error:
+    slapi_pblock_destroy(pb);
+    return tokens;
+}
+
+struct otp_token **otp_token_find(const struct otp_config *cfg,
+                                  const char *user_dn, const char *token_dn,
+                                  bool active, const char *filter)
+{
+    static const char template[] =
+    "(|(ipatokenNotBefore<=%04d%02d%02d%02d%02d%02dZ)(!(ipatokenNotBefore=*)))"
+    "(|(ipatokenNotAfter>=%04d%02d%02d%02d%02d%02dZ)(!(ipatokenNotAfter=*)))"
+    "(|(ipatokenDisabled=FALSE)(!(ipatokenDisabled=*)))";
+    char actfilt[sizeof(template)];
+    struct tm tm;
+    time_t now;
+
+    if (!active)
+        return find(cfg, user_dn, token_dn, NULL, filter);
+
+    /* Get the current time. */
+    if (time(&now) == (time_t) -1)
+        return NULL;
+    if (gmtime_r(&now, &tm) == NULL)
+        return NULL;
+
+    /* Get the current time string. */
+    if (snprintf(actfilt, sizeof(actfilt), template,
+                 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+                 tm.tm_hour, tm.tm_min, tm.tm_sec,
+                 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+                 tm.tm_hour, tm.tm_min, tm.tm_sec) < 0)
+        return NULL;
+
+    return find(cfg, user_dn, token_dn, actfilt, filter);
+}
+
+const Slapi_DN *otp_token_get_sdn(struct otp_token *token)
+{
+    return token->sdn;
+}
+
+/*
+ *  Convert code berval to decimal.
+ *
+ *  NOTE: We can't use atol() or strtoul() because:
+ *    1. If we have leading zeros, atol() fails.
+ *    2. Neither support limiting conversion by length.
+ */
+static bool bvtod(const struct berval *code, int digits, uint32_t *out)
+{
+    *out = 0;
+
+    if (code == NULL || digits <= 0 || code->bv_len < digits)
+        return false;
+
+    for (ber_len_t i = code->bv_len - digits; i < code->bv_len; i++) {
+        if (code->bv_val[i] < '0' || code->bv_val[i] > '9')
+            return false;
+        *out *= 10;
+        *out += code->bv_val[i] - '0';
+    }
+
+    return true;
+}
+
+static bool step_is_valid(struct otp_token *token, bool sync, uint32_t i)
+{
+    uint32_t window = sync ? token->window.sync : token->window.auth;
+
+    switch (token->type) {
+    case TYPE_TOTP:
+        return i * token->totp.step < window;
+    case TYPE_HOTP:
+        return i < window;
+    default:
+        return false;
+    }
+}
+
+bool otp_token_validate_berval(struct otp_token * const *tokens,
+                               struct berval *first_code,
+                               struct berval *second_code)
+{
+    time_t now = 0;
+
+    if (tokens == NULL)
+        return false;
+
+    if (time(&now) == (time_t) -1)
+        return false;
+
+    for (ssize_t i = 0, cnt = 1; cnt != 0; i++) {
+        cnt = 0;
+        for (int j = 0; tokens[j] != NULL; j++) {
+            uint32_t *secondp = NULL;
+            uint32_t second;
+            uint32_t first;
+
+            /* Don't validate beyond the specified window. */
+            if (!step_is_valid(tokens[j], second_code != NULL, i))
+                continue;
+            cnt++;
+
+            /* Parse the first code. */
+            if (!bvtod(first_code, tokens[j]->token.digits, &first))
+                continue;
+
+            /* Parse the second code. */
+            if (second_code != NULL) {
+                secondp = &second;
+                if (!bvtod(second_code, tokens[j]->token.digits, secondp))
+                    continue;
+            }
+
+            /* Validate the positive/negative steps. */
+            if (!validate(tokens[j], now,  i, first, secondp) &&
+                !validate(tokens[j], now, -i, first, secondp))
+                continue;
+
+            /* Codes validated; strip. */
+            first_code->bv_len -= tokens[j]->token.digits;
+            first_code->bv_val[first_code->bv_len] = '\0';
+            if (second_code != NULL) {
+                second_code->bv_len -= tokens[j]->token.digits;
+                second_code->bv_val[second_code->bv_len] = '\0';
+            }
+
+            return true;
+        }
+    }
+
+    return false;
+}

daemons/ipa-slapi-plugins/libotp/otp_token.h

@@ -0,0 +1,88 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Nathaniel McCallum <npmccallum@redhat.com>
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#pragma once
+
+#include "otp_config.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+struct otp_token;
+
+/* Frees the token array. */
+void
+otp_token_free_array(struct otp_token **tokens);
+
+/* Find tokens.
+ *
+ * All criteria below are cumulative. For example, if you specify both dn and
+ * active and the token at the dn specified isn't active, an empty array will
+ * be returned.
+ *
+ * If user_dn is not NULL, the user's tokens are returned.
+ *
+ * If token_dn is not NULL, only this specified token is returned.
+ *
+ * If active is true, only tokens that are active are returned.
+ *
+ * If filter is not NULL, the filter will be added to the search criteria.
+ *
+ * Returns NULL on error. If no tokens are found, an empty array is returned.
+ * The array is NULL terminated.
+ */
+struct otp_token **otp_token_find(const struct otp_config *cfg,
+                                  const char *user_dn, const char *token_dn,
+                                  bool active, const char *filter);
+
+/* Get the SDN of the token. */
+const Slapi_DN *otp_token_get_sdn(struct otp_token *token);
+
+/* Perform OTP authentication.
+ *
+ * If only the first code is specified, validation will be performed and the
+ * validated token will be stripped.
+ *
+ * If both codes are specified, synchronization will be performed and the
+ * validated tokens will be stripped.
+ *
+ * Returns true if and only if all specified tokens were validated.
+ */
+bool otp_token_validate_berval(struct otp_token * const *tokens,
+                               struct berval *first_code,
+                               struct berval *second_code);