this implements a completely new strategy for fetching group

membership from an ADS server. We now use a 'member' query on the
group and do a separate call to convert the resulting distinguished
name to a name, rid etc. This is *much* faster for very large numbers
of groups (on a quantum test system with 10000 groups it drops the
time from an hour to about 35 seconds).

strangely enough, this actually *increases* the amount of ldap
traffic, its just that the MS LDAP server answers these queries much
faster.
(This used to be commit 5538048e4f6dd224b2990f3c6a3e99fd07065f77)

1 files changed, 35 insertions, 0 deletions

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index c9ad3e08db..0f41269e3a 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -1294,6 +1294,41 @@ char *ads_pull_string(ADS_STRUCT *ads,
 }
 
 /**
+ * pull an array of strings from a ADS result
+ * @param ads connection to ads server
+ * @param mem_ctx TALLOC_CTX to use for allocating result string
+ * @param msg Results of search
+ * @param field Attribute to retrieve
+ * @return Result strings in talloc context
+ **/
+char **ads_pull_strings(ADS_STRUCT *ads, 
+		       TALLOC_CTX *mem_ctx, void *msg, const char *field)
+{
+	char **values;
+	char **ret = NULL;
+	int i, n;
+
+	values = ldap_get_values(ads->ld, msg, field);
+	if (!values) return NULL;
+
+	for (i=0;values[i];i++) /* noop */ ;
+	n = i;
+
+	ret = talloc(mem_ctx, sizeof(char *) * (n+1));
+
+	for (i=0;i<n;i++) {
+		if (pull_utf8_talloc(mem_ctx, (void **)&ret[i], values[i]) == -1) {
+			return NULL;
+		}
+	}
+	ret[i] = NULL;
+
+	ldap_value_free(values);
+	return ret;
+}
+
+
+/**
  * pull a single uint32 from a ADS result
  * @param ads connection to ads server
  * @param msg Results of search