r15698: An attempt to make the winbind lookup_usergroups() call in security=ads

more scalable:

The most efficient way is to use the "tokenGroups" attribute which gives
the nested group membership. As this attribute can not always be
retrieved when binding with the machine account (the only garanteed way
to get the tokenGroups I could find is when the machine account is a
member of the "Pre Win2k Access" builtin group).

Our current fallback when "tokenGroups" failed is looking for all groups
where the userdn was in the "member" attribute. This behaves not very
well in very large AD domains.

The patch first tries the "memberOf" attribute on the user's dn in that
case and directly retrieves the group's sids by using the LDAP Extended
DN control from the user's object.

The way to pass down the control to the ldap search call is rather
painfull and probably will be rearranged later on.

Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2.

Guenther
(This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)

1 files changed, 34 insertions, 5 deletions

diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
index 58f1c20ad2..fe0c659b04 100644
--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
@@ -27,9 +27,9 @@
   a wrapper around ldap_search_s that retries depending on the error code
   this is supposed to catch dropped connections and auto-reconnect
 */
-ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope, 
-			       const char *expr,
-			       const char **attrs, void **res)
+static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope, 
+					       const char *expr,
+					       const char **attrs, void *args, void **res)
 {
 	ADS_STATUS status = ADS_SUCCESS;
 	int count = 3;
@@ -49,7 +49,7 @@ ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope
 	}
 
 	*res = NULL;
-	status = ads_do_search_all(ads, bp, scope, expr, attrs, res);
+	status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 	if (ADS_ERR_OK(status)) {
 		DEBUG(5,("Search for %s gave %d replies\n",
 			 expr, ads_count_replies(ads, *res)));
@@ -82,7 +82,7 @@ ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope
 		}
 
 		*res = NULL;
-		status = ads_do_search_all(ads, bp, scope, expr, attrs, res);
+		status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 		if (ADS_ERR_OK(status)) {
 			DEBUG(5,("Search for %s gave %d replies\n",
 				 expr, ads_count_replies(ads, *res)));
@@ -99,6 +99,20 @@ ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope
 	return status;
 }
 
+ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope, 
+			       const char *expr,
+			       const char **attrs, void **res)
+{
+	return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
+}
+
+ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path, int scope, 
+				    const char *expr,
+				    const char **attrs, void *args, void **res)
+{
+	return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
+}
+
 
 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, void **res, 
 			    const char *expr, 
@@ -116,6 +130,21 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res,
 				   "(objectclass=*)", attrs, res);
 }
 
+ADS_STATUS ads_search_retry_extended_dn(ADS_STRUCT *ads, void **res, 
+					const char *dn, 
+					const char **attrs,
+					enum ads_extended_dn_flags flags)
+{
+	ads_control args;
+
+	args.control = ADS_EXTENDED_DN_OID;
+	args.val = flags;
+	args.critical = True;
+
+	return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
+					"(objectclass=*)", attrs, &args, res);
+}
+
 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res, 
 				const DOM_SID *sid,
 				const char **attrs)