LDB ASYNC: samba4 modules

1 files changed, 1106 insertions, 527 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index cf720669b9..e4fc4908a4 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -1,8 +1,8 @@
-/* 
+/*
    SAM ldb module
 
-   Copyright (C) Simo Sorce  2004
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+   Copyright (C) Simo Sorce  2004-2008
 
    * NOTICE: this module is NOT released under the GNU LGPL license as
    * other ldb code. This module is release under the GNU GPL v3 or
@@ -12,12 +12,12 @@
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -37,728 +37,1305 @@
 #include "lib/ldb/include/ldb_errors.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_private.h"
+#include "lib/events/events.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "util/util_ldb.h"
+#include "ldb_wrap.h"
+
+struct samldb_ctx;
+
+typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
+
+struct samldb_step {
+	struct samldb_step *next;
+	samldb_step_fn_t fn;
+};
+
+struct samldb_ctx {
+	struct ldb_module *module;
+	struct ldb_request *req;
 
-int samldb_notice_sid(struct ldb_module *module, 
-		      TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
+	/* the resulting message */
+	struct ldb_message *msg;
+
+	/* used to apply templates */
+	const char *type;
+
+	/* used to find parent domain */
+	struct ldb_dn *check_dn;
+	struct ldb_dn *domain_dn;
+	struct dom_sid *domain_sid;
+	uint32_t next_rid;
+
+	/* generic storage, remember to zero it before use */
+	struct ldb_reply *ares;
+
+	/* holds the entry SID */
+	struct dom_sid *sid;
+
+	/* all the async steps necessary to complete the operation */
+	struct samldb_step *steps;
+	struct samldb_step *curstep;
+};
 
-static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
+struct samldb_ctx *samldb_ctx_init(struct ldb_module *module,
+				   struct ldb_request *req)
 {
-	struct ldb_val v;
-	enum ndr_err_code ndr_err;
+	struct samldb_ctx *ac;
 
-	ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
-				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		return false;
+	ac = talloc_zero(req, struct samldb_ctx);
+	if (ac == NULL) {
+		ldb_oom(module->ldb);
+		return NULL;
 	}
-	return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
+
+	ac->module = module;
+	ac->req = req;
+
+	return ac;
 }
 
-/*
-  allocate a new id, attempting to do it atomically
-  return 0 on failure, the id on success
-*/
-static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
-			       struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
+static int samldb_add_step(struct samldb_ctx *ac, samldb_step_fn_t fn)
 {
-	struct ldb_message msg;
-	int ret;
-	struct ldb_val vals[2];
-	struct ldb_message_element els[2];
+	struct samldb_step *step;
 
-	if (new_id == 0) {
-		/* out of IDs ! */
-		ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
+	step = talloc_zero(ac, struct samldb_step);
+	if (step == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/* we do a delete and add as a single operation. That prevents
-	   a race, in case we are not actually on a transaction db */
-	ZERO_STRUCT(msg);
-	msg.dn = ldb_dn_copy(mem_ctx, dn);
-	if (!msg.dn) {
-		ldb_oom(ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
+	if (ac->steps == NULL) {
+		ac->steps = step;
+		ac->curstep = step;
+	} else {
+		ac->curstep->next = step;
+		ac->curstep = step;
 	}
-	msg.num_elements = 2;
-	msg.elements = els;
 
-	els[0].num_values = 1;
-	els[0].values = &vals[0];
-	els[0].flags = LDB_FLAG_MOD_DELETE;
-	els[0].name = talloc_strdup(mem_ctx, "nextRid");
-	if (!els[0].name) {
-		ldb_oom(ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
+	step->fn = fn;
 
-	els[1].num_values = 1;
-	els[1].values = &vals[1];
-	els[1].flags = LDB_FLAG_MOD_ADD;
-	els[1].name = els[0].name;
+	return LDB_SUCCESS;
+}
 
-	vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
-	if (!vals[0].data) {
-		ldb_oom(ldb);
+static int samldb_first_step(struct samldb_ctx *ac)
+{
+	if (ac->steps == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	vals[0].length = strlen((char *)vals[0].data);
 
-	vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
-	if (!vals[1].data) {
-		ldb_oom(ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
+	ac->curstep = ac->steps;
+	return ac->curstep->fn(ac);
+}
+
+static int samldb_next_step(struct samldb_ctx *ac)
+{
+	if (ac->curstep->next) {
+		ac->curstep = ac->curstep->next;
+		return ac->curstep->fn(ac);
 	}
-	vals[1].length = strlen((char *)vals[1].data);
 
-	ret = ldb_modify(ldb, &msg);
-	return ret;
+	/* it is an error if the last step does not properly
+	 * return to the upper module by itself */
+	return LDB_ERR_OPERATIONS_ERROR;
 }
 
-/*
-  allocate a new id, attempting to do it atomically
-  return 0 on failure, the id on success
-*/
-static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
-				struct ldb_dn *dn, uint32_t *old_rid)
+static int samldb_search_template_callback(struct ldb_request *req,
+					   struct ldb_reply *ares)
 {
-	const char * const attrs[2] = { "nextRid", NULL };
-	struct ldb_result *res = NULL;
+	struct samldb_ctx *ac;
 	int ret;
-	const char *str;
 
-	ret = ldb_search(module->ldb, mem_ctx, &res, dn, LDB_SCOPE_BASE, attrs, "nextRid=*");
-	if (ret != LDB_SUCCESS) {
-		return ret;
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
-	if (res->count != 1) {
-		talloc_free(res);
-		return LDB_ERR_OPERATIONS_ERROR;
+	if (ares->error != LDB_SUCCESS) {
+#ifdef REAL_EVENT_SYSTEM_HOOKED_UP
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+#else
+		return ldb_request_done(req, ares->error);
+#endif
 	}
 
-	str = ldb_msg_find_attr_as_string(res->msgs[0], "nextRid", NULL);
-	if (str == NULL) {
-		ldb_asprintf_errstring(module->ldb,
-					"attribute nextRid not found in %s\n",
-					ldb_dn_get_linearized(dn));
-		talloc_free(res);
-		return LDB_ERR_OPERATIONS_ERROR;
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+		/* save entry */
+		if (ac->ares != NULL) {
+			/* one too many! */
+			ldb_set_errstring(ac->module->ldb,
+				"Invalid number of results while searching "
+				"for template objects");
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			goto done;
+		}
+
+		ac->ares = talloc_steal(ac, ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_DONE:
+
+		talloc_free(ares);
+#ifdef REAL_EVENT_SYSTEM_HOOKED_UP
+		ret = samldb_next_step(ac);
+#else
+		return ldb_request_done(req, LDB_SUCCESS);
+#endif
+		break;
+	}
+
+done:
+	if (ret != LDB_SUCCESS) {
+#ifdef REAL_EVENT_SYSTEM_HOOKED_UP
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+#else
+		return ldb_request_done(req, ret);
+#endif
 	}
 
-	*old_rid = strtol(str, NULL, 0);
-	talloc_free(res);
 	return LDB_SUCCESS;
 }
 
-static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
-				    struct ldb_dn *dn, const struct dom_sid *dom_sid, 
-				    struct dom_sid **new_sid)
+static int samldb_search_template(struct samldb_ctx *ac)
 {
-	struct dom_sid *obj_sid;
-	uint32_t old_rid;
+	struct event_context *ev;
+	struct loadparm_context *lparm_ctx;
+	struct ldb_context *templates_ldb;
+	char *templates_ldb_path;
+	struct ldb_request *req;
+	struct ldb_dn *basedn;
+	void *opaque;
 	int ret;
-	
-	ret = samldb_find_next_rid(module, mem_ctx, dn, &old_rid);	
-	if (ret) {
-		return ret;
+
+	opaque = ldb_get_opaque(ac->module->ldb, "loadparm");
+	lparm_ctx = talloc_get_type(opaque, struct loadparm_context);
+	if (lparm_ctx == NULL) {
+		ldb_set_errstring(ac->module->ldb,
+			"Unable to find loadparm context\n");
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
-		
-	/* return the new object sid */
-	obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid);
-		
-	*new_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid + 1);
-	if (!*new_sid) {
+
+	opaque = ldb_get_opaque(ac->module->ldb, "templates_ldb");
+	templates_ldb = talloc_get_type(opaque,	struct ldb_context);
+
+	/* make sure we have the templates ldb */
+	if (!templates_ldb) {
+		templates_ldb_path = samdb_relative_path(ac->module->ldb, ac,
+							 "templates.ldb");
+		if (!templates_ldb_path) {
+			ldb_set_errstring(ac->module->ldb,
+					"samldb_init_template: ERROR: Failed "
+					"to contruct path for template db");
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+
+		/* NOTE: this is a request on a different database!
+		 *
+		 * 	 Therefore we need to do a bloody sync call
+		 * 	 otherwise the fake event queue will never call it
+		 * 	 as it runs on the main ldb context and knows
+		 * 	 nothing about the templates_ldb one */
+#ifdef REAL_EVENT_SYSTEM_HOOKED_UP
+		ev = ldb_get_event_context(ac->module->ldb);
+#else
+		ev = event_context_init(NULL);
+#endif
+		if (!talloc_reference(templates_ldb, ev)) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+
+		templates_ldb = ldb_wrap_connect(ac->module->ldb, ev,
+						lparm_ctx, templates_ldb_path,
+						NULL, NULL, 0, NULL);
+		talloc_free(templates_ldb_path);
+
+		if (!templates_ldb) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+
+		ret = ldb_set_opaque(ac->module->ldb,
+					"templates_ldb", templates_ldb);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
+	/* search template */
+	basedn = ldb_dn_new_fmt(ac, templates_ldb,
+			    "cn=Template%s,cn=Templates", ac->type);
+	if (basedn == NULL) {
+		ldb_set_errstring(ac->module->ldb,
+			"samldb_init_template: ERROR: Failed "
+			"to contruct DN for template");
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = samldb_notice_sid(module, mem_ctx, *new_sid);
-	if (ret != 0) {
-		/* gah, there are conflicting sids.
-		 * This is a critical situation it means that someone messed up with
-		 * the DB and nextRid is not returning free RIDs, report an error
-		 * and refuse to create any user until the problem is fixed */
-		ldb_asprintf_errstring(module->ldb,
-					"Critical Error: unconsistent DB, unable to retireve an unique RID to generate a new SID: %s",
-					ldb_errstring(module->ldb));
+	/* pull the template record */
+	ret = ldb_build_search_req(&req, templates_ldb, ac,
+				   basedn, LDB_SCOPE_BASE,
+				  "(distinguishedName=*)", NULL,
+				  NULL,
+				  ac, samldb_search_template_callback,
+				  ac->req);
+	if (ret != LDB_SUCCESS) {
 		return ret;
 	}
-	return ret;
+
+	talloc_steal(req, basedn);
+	ac->ares = NULL;
+
+	/* NOTE: this is a request on a different database!
+	 * 	 Therefore we need to do a bloody sync call
+	 * 	 otherwise the fake event queue will never call it
+	 * 	 as it runs on the main ldb context and knows
+	 * 	 nothing about the templates_ldb one */
+#ifdef REAL_EVENT_SYSTEM_HOOKED_UP
+	return ldb_request(templates_ldb, req);
+#else
+	ret = ldb_request(templates_ldb, req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+	ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return samldb_next_step(ac);
+#endif
 }
 
-/* search the domain related to the provided dn
-   allocate a new RID for the domain
-   return the new sid string
-*/
-static int samldb_get_new_sid(struct ldb_module *module, 
-			      TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
-			      struct ldb_dn *dom_dn, 
-			      struct dom_sid **sid)
+static int samldb_apply_template(struct samldb_ctx *ac)
+{
+	struct ldb_message_element *el;
+	struct ldb_message *msg;
+	int i, j;
+	int ret;
+
+	msg = ac->ares->message;
+
+	for (i = 0; i < msg->num_elements; i++) {
+		el = &msg->elements[i];
+		/* some elements should not be copied */
+		if (ldb_attr_cmp(el->name, "cn") == 0 ||
+		    ldb_attr_cmp(el->name, "name") == 0 ||
+		    ldb_attr_cmp(el->name, "objectClass") == 0 ||
+		    ldb_attr_cmp(el->name, "sAMAccountName") == 0 ||
+		    ldb_attr_cmp(el->name, "sAMAccountName") == 0 ||
+		    ldb_attr_cmp(el->name, "distinguishedName") == 0 ||
+		    ldb_attr_cmp(el->name, "objectGUID") == 0) {
+			continue;
+		}
+		for (j = 0; j < el->num_values; j++) {
+			ret = samdb_find_or_add_attribute(
+					ac->module->ldb, ac->msg, el->name,
+					(char *)el->values[j].data);
+			if (ret != LDB_SUCCESS) {
+				ldb_set_errstring(ac->module->ldb,
+					  "Failed adding template attribute\n");
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+		}
+	}
+
+	return samldb_next_step(ac);
+}
+
+static int samldb_get_parent_domain(struct samldb_ctx *ac);
+
+static int samldb_get_parent_domain_callback(struct ldb_request *req,
+					     struct ldb_reply *ares)
 {
-	const char * const attrs[2] = { "objectSid", NULL };
-	struct ldb_result *res = NULL;
+	struct samldb_ctx *ac;
+	const char *nextRid;
 	int ret;
-	struct dom_sid *dom_sid;
 
-	/* get the domain component part of the provided dn */
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+		/* save entry */
+		if (ac->domain_dn != NULL) {
+			/* one too many! */
+			ldb_set_errstring(ac->module->ldb,
+				"Invalid number of results while searching "
+				"for domain object");
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
+		}
+
+		nextRid = ldb_msg_find_attr_as_string(ares->message,
+							"nextRid", NULL);
+		if (nextRid == NULL) {
+			ldb_asprintf_errstring(ac->module->ldb,
+				"attribute nextRid not found in %s\n",
+				ldb_dn_get_linearized(ares->message->dn));
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;;
+		}
+
+		ac->next_rid = strtol(nextRid, NULL, 0);
+
+		ac->domain_sid = samdb_result_dom_sid(ac, ares->message,
+								"objectSid");
+		if (ac->domain_sid == NULL) {
+			ldb_set_errstring(ac->module->ldb,
+				"error retrieving parent domain domain sid!\n");
+			ret = LDB_ERR_CONSTRAINT_VIOLATION;
+			break;
+		}
+		ac->domain_dn = talloc_steal(ac, ares->message->dn);
+
+		talloc_free(ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_DONE:
 
-	/* find the domain sid */
+		talloc_free(ares);
+		if (ac->domain_dn == NULL) {
+			/* search again */
+			ret = samldb_get_parent_domain(ac);
+		} else {
+			/* found, go on */
+			ret = samldb_next_step(ac);
+		}
+		break;
+	}
 
-	ret = ldb_search(module->ldb, mem_ctx, &res, dom_dn, LDB_SCOPE_BASE, attrs, "objectSid=*");
+done:
 	if (ret != LDB_SUCCESS) {
-		ldb_asprintf_errstring(module->ldb,
-					"samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
-					ldb_dn_get_linearized(dom_dn),
-					ldb_errstring(module->ldb));
-		talloc_free(res);
-		return ret;
+		return ldb_module_done(ac->req, NULL, NULL, ret);
 	}
 
-	if (res->count != 1) {
-		ldb_asprintf_errstring(module->ldb,
-					"samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
-					ldb_dn_get_linearized(dom_dn));
-		talloc_free(res);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
+	return LDB_SUCCESS;
+}
+
+/* Find a domain object in the parents of a particular DN.  */
+static int samldb_get_parent_domain(struct samldb_ctx *ac)
+{
+	static const char * const attrs[3] = { "objectSid", "nextRid", NULL };
+	struct ldb_request *req;
+	struct ldb_dn *dn;
+	int ret;
+
+	if (ac->check_dn == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
-	if (dom_sid == NULL) {
-		ldb_set_errstring(module->ldb, "samldb_get_new_sid: error parsing domain sid!\n");
-		talloc_free(res);
+	dn = ldb_dn_get_parent(ac, ac->check_dn);
+	if (dn == NULL) {
+		ldb_set_errstring(ac->module->ldb,
+			"Unable to find parent domain object");
 		return LDB_ERR_CONSTRAINT_VIOLATION;
 	}
 
-	/* allocate a new Rid for the domain */
-	ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
-	if (ret != 0) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
-		talloc_free(res);
+	ac->check_dn = dn;
+
+	ret = ldb_build_search_req(&req, ac->module->ldb, ac,
+				   dn, LDB_SCOPE_BASE,
+				   "(|(objectClass=domain)"
+				     "(objectClass=builtinDomain)"
+				     "(objectClass=samba4LocalDomain))",
+				   attrs,
+				   NULL,
+				   ac, samldb_get_parent_domain_callback,
+				   ac->req);
+
+	if (ret != LDB_SUCCESS) {
 		return ret;
 	}
 
-	talloc_free(res);
+	return ldb_next_request(ac->module, req);
+}
 
-	return ret;
+static int samldb_generate_samAccountName(struct ldb_message *msg)
+{
+	char *name;
+
+	/* Format: $000000-000000000000 */
+
+	name = talloc_asprintf(msg, "$%.6X-%.6X%.6X",
+				(unsigned int)generate_random(),
+				(unsigned int)generate_random(),
+				(unsigned int)generate_random());
+	if (name == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	return ldb_msg_add_steal_string(msg, "samAccountName", name);
 }
 
-/* If we are adding new users/groups, we need to update the nextRid
- * attribute to be 'above' all incoming users RIDs.  This tries to
- * avoid clashes in future */
+static int samldb_check_samAccountName_callback(struct ldb_request *req,
+						struct ldb_reply *ares)
+{
+	struct samldb_ctx *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+
+		/* if we get an entry it means this samAccountName
+		 * already exists */
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_ENTRY_ALREADY_EXISTS);
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_DONE:
+
+		/* not found, go on */
+		talloc_free(ares);
+		ret = samldb_next_step(ac);
+		break;
+	}
+
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
 
-int samldb_notice_sid(struct ldb_module *module, 
-		      TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
+	return LDB_SUCCESS;
+}
+
+static int samldb_check_samAccountName(struct samldb_ctx *ac)
 {
+	struct ldb_request *req;
+	const char *name;
+	char *filter;
 	int ret;
-	struct ldb_dn *dom_dn;
-	struct dom_sid *dom_sid;
-	const char *attrs[] = { NULL };
-	struct ldb_result *dom_res;
-	struct ldb_result *res;
-	uint32_t old_rid;
-
-	/* find if this SID already exists */
-	ret = ldb_search(module->ldb, mem_ctx, &res,
-				 NULL, LDB_SCOPE_SUBTREE, attrs,
-				 "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
-	if (ret == LDB_SUCCESS) {
-		if (res->count > 0) {
-			talloc_free(res);
-			ldb_asprintf_errstring(module->ldb,
-						"Attempt to add record with SID %s rejected,"
-						" because this SID is already in the database",
-						dom_sid_string(mem_ctx, sid));
-			/* We have a duplicate SID, we must reject the add */
-			return LDB_ERR_CONSTRAINT_VIOLATION;
+
+	if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
+		ret = samldb_generate_samAccountName(ac->msg);
+		if (ret != LDB_SUCCESS) {
+			return ret;
 		}
-		talloc_free(res);
-	} else {
-		ldb_asprintf_errstring(module->ldb,
-					"samldb_notice_sid: error searching to see if sid %s is in use: %s\n", 
-					dom_sid_string(mem_ctx, sid), 
-					ldb_errstring(module->ldb));
-		return ret;
 	}
 
-	dom_sid = dom_sid_dup(mem_ctx, sid);
-	if (!dom_sid) {
+	name = ldb_msg_find_attr_as_string(ac->msg, "samAccountName", NULL);
+	if (name == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	filter = talloc_asprintf(ac, "samAccountName=%s", name);
+	if (filter == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	/* get the domain component part of the provided SID */
-	dom_sid->num_auths--;
-
-	/* find the domain DN */
-	ret = ldb_search(module->ldb, mem_ctx, &dom_res,
-				 NULL, LDB_SCOPE_SUBTREE, attrs,
-				 "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))", 
-				 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
-	if (ret == LDB_SUCCESS) {
-		if (dom_res->count == 0) {
-			talloc_free(dom_res);
-			/* This isn't an operation on a domain we know about, so nothing to update */
-			return LDB_SUCCESS;
-		}
 
-		if (dom_res->count > 1) {
-			talloc_free(dom_res);
-			ldb_asprintf_errstring(module->ldb,
-					"samldb_notice_sid: error retrieving domain from sid: duplicate (found %d) domain: %s!\n", 
-					dom_res->count, dom_sid_string(dom_res, dom_sid));
-			return LDB_ERR_OPERATIONS_ERROR;
-		}
-	} else {
-		ldb_asprintf_errstring(module->ldb,
-					"samldb_notice_sid: error retrieving domain from sid: %s: %s\n", 
-					dom_sid_string(dom_res, dom_sid), 
-					ldb_errstring(module->ldb));
+	ret = ldb_build_search_req(&req, ac->module->ldb, ac,
+				ac->domain_dn, LDB_SCOPE_SUBTREE,
+				filter, NULL,
+				NULL,
+				ac, samldb_check_samAccountName_callback,
+				ac->req);
+	talloc_free(filter);
+	if (ret != LDB_SUCCESS) {
 		return ret;
 	}
+	ac->ares = NULL;
+	return ldb_next_request(ac->module, req);
+}
 
-	dom_dn = dom_res->msgs[0]->dn;
+static int samldb_check_samAccountType(struct samldb_ctx *ac)
+{
+	unsigned int account_type;
+	unsigned int group_type;
+	unsigned int uac;
+	int ret;
 
-	ret = samldb_find_next_rid(module, mem_ctx, 
-				   dom_dn, &old_rid);
-	if (ret) {
-		talloc_free(dom_res);
-		return ret;
+	/* make sure sAMAccountType is not specified */
+	if (ldb_msg_find_element(ac->msg, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(ac->module->ldb,
+					"sAMAccountType must not be specified");
+		return LDB_ERR_UNWILLING_TO_PERFORM;
 	}
 
-	if (old_rid <= sid->sub_auths[sid->num_auths - 1]) {
-		ret = samldb_set_next_rid(module->ldb, mem_ctx, dom_dn, old_rid, 
-					  sid->sub_auths[sid->num_auths - 1] + 1);
+	if (strcmp("user", ac->type) == 0) {
+		uac = samdb_result_uint(ac->msg, "userAccountControl", 0);
+		if (uac == 0) {
+			ldb_asprintf_errstring(ac->module->ldb,
+						"userAccountControl invalid");
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		} else {
+			account_type = samdb_uf2atype(uac);
+			ret = samdb_msg_add_uint(ac->module->ldb,
+						 ac->msg, ac->msg,
+						 "sAMAccountType",
+						 account_type);
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+		}
+	} else
+	if (strcmp("group", ac->type) == 0) {
+
+		group_type = samdb_result_uint(ac->msg, "groupType", 0);
+		if (group_type == 0) {
+			ldb_asprintf_errstring(ac->module->ldb,
+						"groupType invalid");
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		} else {
+			account_type = samdb_gtype2atype(group_type);
+			ret = samdb_msg_add_uint(ac->module->ldb,
+						 ac->msg, ac->msg,
+						 "sAMAccountType",
+						 account_type);
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+		}
 	}
-	talloc_free(dom_res);
-	return ret;
+
+	return samldb_next_step(ac);
 }
 
-static int samldb_handle_sid(struct ldb_module *module, 
-			     TALLOC_CTX *mem_ctx, struct ldb_message *msg2,
-			     struct ldb_dn *parent_dn)
+static int samldb_get_sid_domain_callback(struct ldb_request *req,
+					  struct ldb_reply *ares)
 {
+	struct samldb_ctx *ac;
+	const char *nextRid;
 	int ret;
-	
-	struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
-	if (sid == NULL) { 
-		ret = samldb_get_new_sid(module, msg2, msg2->dn, parent_dn, &sid);
-		if (ret != 0) {
-			return ret;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+		/* save entry */
+		if (ac->next_rid != 0) {
+			/* one too many! */
+			ldb_set_errstring(ac->module->ldb,
+				"Invalid number of results while searching "
+				"for domain object");
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
 		}
 
-		if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
-			talloc_free(sid);
-			return LDB_ERR_OPERATIONS_ERROR;
+		nextRid = ldb_msg_find_attr_as_string(ares->message,
+							"nextRid", NULL);
+		if (nextRid == NULL) {
+			ldb_asprintf_errstring(ac->module->ldb,
+				"attribute nextRid not found in %s\n",
+				ldb_dn_get_linearized(ares->message->dn));
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
 		}
-		talloc_free(sid);
+
+		ac->next_rid = strtol(nextRid, NULL, 0);
+
+		ac->domain_dn = talloc_steal(ac, ares->message->dn);
+
+		talloc_free(ares);
 		ret = LDB_SUCCESS;
-	} else {
-		ret = samldb_notice_sid(module, msg2, sid);
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		ret = LDB_SUCCESS;
+		break;
+
+	case LDB_REPLY_DONE:
+
+		if (ac->next_rid == 0) {
+			ldb_asprintf_errstring(ac->module->ldb,
+				"Unable to get nextRid from domain entry\n");
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
+		}
+
+		/* found, go on */
+		ret = samldb_next_step(ac);
+		break;
+	}
+
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
 	}
-	return ret;
+
+	return LDB_SUCCESS;
 }
 
-static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx, 
-					  struct ldb_dn *dom_dn, char **name) 
+/* Find a domain object in the parents of a particular DN.  */
+static int samldb_get_sid_domain(struct samldb_ctx *ac)
 {
-	const char *attrs[] = { NULL };
-	struct ldb_result *res;
+	static const char * const attrs[2] = { "nextRid", NULL };
+	struct ldb_request *req;
+	char *filter;
 	int ret;
-	
-	/* Format: $000000-000000000000 */
-	
-	do {
-		*name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
-		/* TODO: Figure out exactly what this is meant to conflict with */
-		ret = ldb_search(module->ldb,
-					 mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
-					 "samAccountName=%s",
-					 ldb_binary_encode_string(mem_ctx, *name));
-		if (ret != LDB_SUCCESS) {
-			ldb_asprintf_errstring(module->ldb, "samldb: Failure searching to determine if samAccountName %s is unique: %s",
-					       *name, ldb_errstring(module->ldb));
-			return ret;
-		}
 
-		if (res->count == 0) {
-			talloc_free(res);
-			/* Great. There are no conflicting users/groups/etc */
-			return LDB_SUCCESS;
-		} else {
-			talloc_free(*name);
-                        /* gah, there is a conflicting name, lets move around the loop again... */
-		}
-	} while (1);
+	if (ac->sid == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac->domain_sid = dom_sid_dup(ac, ac->sid);
+	if (!ac->domain_sid) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	/* get the domain component part of the provided SID */
+	ac->domain_sid->num_auths--;
+
+	filter = talloc_asprintf(ac, "(&(objectSid=%s)"
+				       "(|(objectClass=domain)"
+				         "(objectClass=builtinDomain)"
+				         "(objectClass=samba4LocalDomain)))",
+				 ldap_encode_ndr_dom_sid(ac, ac->domain_sid));
+	if (filter == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ret = ldb_build_search_req(&req, ac->module->ldb, ac,
+				   ldb_get_default_basedn(ac->module->ldb),
+				   LDB_SCOPE_SUBTREE,
+				   filter, attrs,
+				   NULL,
+				   ac, samldb_get_sid_domain_callback,
+				   ac->req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->next_rid = 0;
+	return ldb_next_request(ac->module, req);
 }
 
-static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg,
-						    struct ldb_message **ret_msg)
+static bool samldb_msg_add_sid(struct ldb_message *msg,
+				const char *name,
+				const struct dom_sid *sid)
 {
-	int ret;
-	unsigned int group_type;
-	char *name;
-	struct ldb_message *msg2;
-	struct ldb_dn *dom_dn;
-	const char *rdn_name;
-	TALLOC_CTX *mem_ctx = talloc_new(msg);
-	const char *errstr;
-	if (!mem_ctx) {
+	struct ldb_val v;
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return false;
+	}
+	return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
+}
+
+static int samldb_new_sid(struct samldb_ctx *ac)
+{
+
+	if (ac->domain_sid == NULL || ac->next_rid == 0) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/* build the new msg */
-	msg2 = ldb_msg_copy(mem_ctx, msg);
-	if (!msg2) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
-		talloc_free(mem_ctx);
+	ac->sid = dom_sid_add_rid(ac, ac->domain_sid, ac->next_rid + 1);
+	if (ac->sid == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = samdb_copy_template(module->ldb, msg2, 
-				  "group",
-				  &errstr);
-	if (ret != 0) {
-		
-		talloc_free(mem_ctx);
-		return ret;
+	if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+	return samldb_next_step(ac);
+}
 
-	if (strcasecmp(rdn_name, "cn") != 0) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
-		talloc_free(mem_ctx);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
+static int samldb_check_sid_callback(struct ldb_request *req,
+				     struct ldb_reply *ares)
+{
+	struct samldb_ctx *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+
+		/* if we get an entry it means an object with the
+		 * requested sid exists */
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_CONSTRAINT_VIOLATION);
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		break;
+
+	case LDB_REPLY_DONE:
+
+		/* not found, go on */
+		talloc_free(ares);
+		ret = samldb_next_step(ac);
+		break;
 	}
 
-	ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int samldb_check_sid(struct samldb_ctx *ac)
+{
+	const char *const attrs[2] = { "objectSid", NULL };
+	struct ldb_request *req;
+	char *filter;
+	int ret;
+
+	if (ac->sid == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	filter = talloc_asprintf(ac, "(objectSid=%s)",
+				 ldap_encode_ndr_dom_sid(ac, ac->sid));
+	if (filter == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ret = ldb_build_search_req(&req, ac->module->ldb, ac,
+				   ldb_get_default_basedn(ac->module->ldb),
+				   LDB_SCOPE_SUBTREE,
+				   filter, attrs,
+				   NULL,
+				   ac, samldb_check_sid_callback,
+				   ac->req);
+
 	if (ret != LDB_SUCCESS) {
-		ldb_asprintf_errstring(module->ldb,
-				       "samldb_fill_group_object: %s", errstr);
 		return ret;
 	}
 
-	/* Generate a random name, if no samAccountName was supplied */
-	if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
-		ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
-		if (ret != LDB_SUCCESS) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
-		ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
-		if (ret) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
+	return ldb_next_request(ac->module, req);
+}
+
+static int samldb_notice_sid_callback(struct ldb_request *req,
+					struct ldb_reply *ares)
+{
+	struct samldb_ctx *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
-	
-	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
-		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
-		talloc_free(mem_ctx);
-		return LDB_ERR_UNWILLING_TO_PERFORM;
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
 	}
-	group_type = samdb_result_uint(msg2, "groupType", 0);
-	if (group_type == 0) {
-		ldb_asprintf_errstring(module->ldb, "groupType invalid");
-		talloc_free(mem_ctx);
-		return LDB_ERR_UNWILLING_TO_PERFORM;
-	} else {
-		unsigned int account_type = samdb_gtype2atype(group_type);
-		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
-					 "sAMAccountType",
-					 account_type);
-		if (ret != LDB_SUCCESS) {
-			return ret;
-		}
+	if (ares->type != LDB_REPLY_DONE) {
+		ldb_set_errstring(ac->module->ldb,
+			"Invalid reply type!\n");
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
 
-	/* Manage SID allocation, conflicts etc */
-	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
+	ret = samldb_next_step(ac);
 
-	if (ret == LDB_SUCCESS) {
-		talloc_steal(msg, msg2);
-		*ret_msg = msg2;
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
 	}
-	talloc_free(mem_ctx);
-	return ret;
+
+	return LDB_SUCCESS;
 }
 
-static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg, struct ldb_message **ret_msg)
+/* If we are adding new users/groups, we need to update the nextRid
+ * attribute to be 'above' the new/incoming RID. Attempt to do it
+ *atomically. */
+static int samldb_notice_sid(struct samldb_ctx *ac)
 {
+	uint32_t old_id, new_id;
+	struct ldb_request *req;
+	struct ldb_message *msg;
+	struct ldb_message_element *els;
+	struct ldb_val *vals;
 	int ret;
-	char *name;
-	struct ldb_message *msg2;
-	struct ldb_dn *dom_dn;
-	const char *rdn_name;
-	TALLOC_CTX *mem_ctx = talloc_new(msg);
-	const char *errstr;
-	unsigned int user_account_control;
-	if (!mem_ctx) {
+
+	old_id = ac->next_rid;
+	new_id = ac->sid->sub_auths[ac->sid->num_auths - 1];
+
+	if (old_id >= new_id) {
+		/* no need to update the domain nextRid attribute */
+		return samldb_next_step(ac);
+	}
+
+	/* we do a delete and add as a single operation. That prevents
+	   a race, in case we are not actually on a transaction db */
+	msg = talloc_zero(ac, struct ldb_message);
+	if (msg == NULL) {
+		ldb_oom(ac->module->ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	els = talloc_array(msg, struct ldb_message_element, 2);
+	if (els == NULL) {
+		ldb_oom(ac->module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
+	vals = talloc_array(msg, struct ldb_val, 2);
+	if (vals == NULL) {
+		ldb_oom(ac->module->ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	msg->dn = ac->domain_dn;
+	msg->num_elements = 2;
+	msg->elements = els;
 
-	/* build the new msg */
-	msg2 = ldb_msg_copy(mem_ctx, msg);
-	if (!msg2) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
-		talloc_free(mem_ctx);
+	els[0].num_values = 1;
+	els[0].values = &vals[0];
+	els[0].flags = LDB_FLAG_MOD_DELETE;
+	els[0].name = talloc_strdup(msg, "nextRid");
+	if (!els[0].name) {
+		ldb_oom(ac->module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	ret = samdb_copy_template(module->ldb, msg2, 
-				  "user",
-				  &errstr);
-	if (ret) {
-		ldb_asprintf_errstring(module->ldb, 
-				       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
-				       errstr);
-		talloc_free(mem_ctx);
+	els[1].num_values = 1;
+	els[1].values = &vals[1];
+	els[1].flags = LDB_FLAG_MOD_ADD;
+	els[1].name = els[0].name;
+
+	vals[0].data = (uint8_t *)talloc_asprintf(vals, "%u", old_id);
+	if (!vals[0].data) {
+		ldb_oom(ac->module->ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	vals[0].length = strlen((char *)vals[0].data);
+
+	vals[1].data = (uint8_t *)talloc_asprintf(vals, "%u", new_id);
+	if (!vals[1].data) {
+		ldb_oom(ac->module->ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	vals[1].length = strlen((char *)vals[1].data);
+
+	ret = ldb_build_mod_req(&req, ac->module->ldb, ac,
+				msg, NULL,
+				ac, samldb_notice_sid_callback,
+				ac->req);
+	if (ret != LDB_SUCCESS) {
 		return ret;
 	}
 
-	rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+	return ldb_next_request(ac->module, req);
+}
 
-	if (strcasecmp(rdn_name, "cn") != 0) {
-		ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
-		talloc_free(mem_ctx);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
+static int samldb_add_entry_callback(struct ldb_request *req,
+					struct ldb_reply *ares)
+{
+	struct samldb_ctx *ac;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
 	}
+	if (ares->type != LDB_REPLY_DONE) {
+		ldb_set_errstring(ac->module->ldb,
+			"Invalid reply type!\n");
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+
+	/* we exit the samldb module here */
+	return ldb_module_done(ac->req, ares->controls,
+				ares->response, LDB_SUCCESS);
+}
 
-	ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+static int samldb_add_entry(struct samldb_ctx *ac)
+{
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_build_add_req(&req, ac->module->ldb, ac,
+				ac->msg,
+				ac->req->controls,
+				ac, samldb_add_entry_callback,
+				ac->req);
 	if (ret != LDB_SUCCESS) {
-		ldb_asprintf_errstring(module->ldb,
-				       "samldb_fill_user_or_computer_object: %s", errstr);
 		return ret;
 	}
 
-	if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
-		ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
-		if (ret != LDB_SUCCESS) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
-		ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
-		if (ret) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
+	return ldb_next_request(ac->module, req);
+}
+
+static int samldb_fill_object(struct samldb_ctx *ac, const char *type)
+{
+	int ret;
+
+	/* first look for the template */
+	ac->type = type;
+	ret = samldb_add_step(ac, samldb_search_template);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* then apply it */
+	ret = samldb_add_step(ac, samldb_apply_template);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* search for a parent domain objet */
+	ac->check_dn = ac->req->op.add.message->dn;
+	ret = samldb_add_step(ac, samldb_get_parent_domain);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* check if we have a valid samAccountName */
+	ret = samldb_add_step(ac, samldb_check_samAccountName);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* check account_type/group_type */
+	ret = samldb_add_step(ac, samldb_check_samAccountType);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* check if we have a valid SID */
+	ac->sid = samdb_result_dom_sid(ac, ac->msg, "objectSid");
+	if ( ! ac->sid) {
+		ret = samldb_add_step(ac, samldb_new_sid);
+		if (ret != LDB_SUCCESS) return ret;
+	} else {
+		ret = samldb_add_step(ac, samldb_get_sid_domain);
+		if (ret != LDB_SUCCESS) return ret;
 	}
 
-	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
-		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
-		talloc_free(mem_ctx);
-		return LDB_ERR_UNWILLING_TO_PERFORM;
+	ret = samldb_add_step(ac, samldb_check_sid);
+	if (ret != LDB_SUCCESS) return ret;
+
+	ret = samldb_add_step(ac, samldb_notice_sid);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* finally proceed with adding the entry */
+	ret = samldb_add_step(ac, samldb_add_entry);
+	if (ret != LDB_SUCCESS) return ret;
+
+	return samldb_first_step(ac);
+
+	/* TODO: userAccountControl, badPwdCount, codePage,
+	 *	 countryCode, badPasswordTime, lastLogoff, lastLogon,
+	 *	 pwdLastSet, primaryGroupID, accountExpires, logonCount */
+
+}
+
+static int samldb_foreign_notice_sid_callback(struct ldb_request *req,
+						struct ldb_reply *ares)
+{
+	struct samldb_ctx *ac;
+	const char *nextRid;
+	const char *name;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct samldb_ctx);
+
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
-	user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
-	if (user_account_control == 0) {
-		ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
-		talloc_free(mem_ctx);
-		return LDB_ERR_UNWILLING_TO_PERFORM;
-	} else {
-		unsigned int account_type = samdb_uf2atype(user_account_control);
-		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
-					 "sAMAccountType",
-					 account_type);
-		if (ret != LDB_SUCCESS) {
-			return ret;
-		}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
 	}
 
-	/* Manage SID allocation, conflicts etc */
-	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+		/* save entry */
+		if (ac->next_rid != 0) {
+			/* one too many! */
+			ldb_set_errstring(ac->module->ldb,
+				"Invalid number of results while searching "
+				"for domain object");
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
+		}
+
+		nextRid = ldb_msg_find_attr_as_string(ares->message,
+							"nextRid", NULL);
+		if (nextRid == NULL) {
+			ldb_asprintf_errstring(ac->module->ldb,
+				"attribute nextRid not found in %s\n",
+				ldb_dn_get_linearized(ares->message->dn));
+			ret = LDB_ERR_OPERATIONS_ERROR;
+			break;
+		}
+
+		ac->next_rid = strtol(nextRid, NULL, 0);
+
+		ac->domain_dn = talloc_steal(ac, ares->message->dn);
+
+		name = samdb_result_string(ares->message, "name", NULL);
+		ldb_debug(ac->module->ldb, LDB_DEBUG_TRACE,
+			 "NOTE (strange but valid): Adding foreign SID "
+			 "record with SID %s, but this domain (%s) is "
+			 "not foreign in the database",
+			 dom_sid_string(ares, ac->sid), name);
+
+		talloc_free(ares);
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		talloc_free(ares);
+		break;
 
-	/* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
+	case LDB_REPLY_DONE:
 
-	if (ret == 0) {
-		*ret_msg = msg2;
-		talloc_steal(msg, msg2);
+		/* if this is a fake foreign SID, notice the SID */
+		if (ac->domain_dn) {
+			ret = samldb_notice_sid(ac);
+			break;
+		}
+
+		/* found, go on */
+		ret = samldb_next_step(ac);
+		break;
 	}
-	talloc_free(mem_ctx);
-	return ret;
+
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	return LDB_SUCCESS;
 }
-	
-static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg, 
-						       struct ldb_message **ret_msg)
+
+/* Find a domain object in the parents of a particular DN. */
+static int samldb_foreign_notice_sid(struct samldb_ctx *ac)
 {
-	struct ldb_message *msg2;
-	const char *rdn_name;
-	struct dom_sid *dom_sid;
-	struct dom_sid *sid;
-	const char *dom_attrs[] = { "name", NULL };
-	struct ldb_message **dom_msgs;
-	const char *errstr;
+	static const char * const attrs[3] = { "nextRid", "name", NULL };
+	struct ldb_request *req;
+	char *filter;
 	int ret;
 
-	TALLOC_CTX *mem_ctx = talloc_new(msg);
-	if (!mem_ctx) {
+	if (ac->sid == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/* build the new msg */
-	msg2 = ldb_msg_copy(mem_ctx, msg);
-	if (!msg2) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
-		talloc_free(mem_ctx);
+	ac->domain_sid = dom_sid_dup(ac, ac->sid);
+	if (!ac->domain_sid) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
+	/* get the domain component part of the provided SID */
+	ac->domain_sid->num_auths--;
 
-	ret = samdb_copy_template(module->ldb, msg2, 
-				  "ForeignSecurityPrincipal",
-				  &errstr);
-	if (ret != 0) {
-		ldb_asprintf_errstring(module->ldb, 
-				       "samldb_fill_foreignSecurityPrincipal_object: "
-				       "Error copying template: %s",
-				    errstr);
-		talloc_free(mem_ctx);
-		return ret;
+	filter = talloc_asprintf(ac, "(&(objectSid=%s)(objectclass=domain))",
+				 ldap_encode_ndr_dom_sid(ac, ac->domain_sid));
+	if (filter == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+	ret = ldb_build_search_req(&req, ac->module->ldb, ac,
+				   ldb_get_default_basedn(ac->module->ldb),
+				   LDB_SCOPE_SUBTREE,
+				   filter, attrs,
+				   NULL,
+				   ac, samldb_foreign_notice_sid_callback,
+				   ac->req);
 
-	if (strcasecmp(rdn_name, "cn") != 0) {
-		ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
-		talloc_free(mem_ctx);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
+	if (ret != LDB_SUCCESS) {
+		return ret;
 	}
 
-	sid = samdb_result_dom_sid(msg2, msg, "objectSid");
-	if (!sid) {
-		/* Slightly different for the foreign sids.  We don't want
-		 * domain SIDs ending up there, it would cause all sorts of
-		 * pain */
-
-		sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
-		if (!sid) {
-			ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
-			talloc_free(mem_ctx);
-			return LDB_ERR_CONSTRAINT_VIOLATION;
-		}
+	ac->next_rid = 0;
+	return ldb_next_request(ac->module, req);
+}
 
-		if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
-			talloc_free(sid);
-			return LDB_ERR_OPERATIONS_ERROR;
-		}
+static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
+{
+	int ret;
 
-		dom_sid = dom_sid_dup(mem_ctx, sid);
-		if (!dom_sid) {
-			talloc_free(mem_ctx);
-			return LDB_ERR_OPERATIONS_ERROR;
+	ac->sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
+	if (ac->sid == NULL) {
+		ac->sid = dom_sid_parse_talloc(ac->msg,
+			   (const char *)ldb_dn_get_rdn_val(ac->msg->dn)->data);
+		if (!ac->sid) {
+			ldb_set_errstring(ac->module->ldb,
+					"No valid found SID in "
+					"ForeignSecurityPrincipal CN!");
+			talloc_free(ac);
+			return LDB_ERR_CONSTRAINT_VIOLATION;
 		}
-		/* get the domain component part of the provided SID */
-		dom_sid->num_auths--;
-
-		/* find the domain DN */
-
-		ret = gendb_search(module->ldb,
-				   mem_ctx, NULL, &dom_msgs, dom_attrs,
-				   "(&(objectSid=%s)(objectclass=domain))",
-				   ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
-		if (ret >= 1) {
-			/* We don't really like the idea of foreign sids that are not foreign, but it happens */
-			const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
-			ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database", 
-				  dom_sid_string(mem_ctx, sid), name); 
-		} else if (ret == -1) {
-			ldb_asprintf_errstring(module->ldb,
-						"samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n", 
-						dom_sid_string(mem_ctx, dom_sid));
-			talloc_free(dom_msgs);
+		if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
+			talloc_free(ac);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 	}
 
-	/* This isn't an operation on a domain we know about, so just
-	 * check for the SID, looking for duplicates via the common
-	 * code */
-	ret = samldb_notice_sid(module, msg2, sid);
-	if (ret == 0) {
-		talloc_steal(msg, msg2);
-		*ret_msg = msg2;
-	}
-	
-	return ret;
+	/* first look for the template */
+	ac->type = "foreignSecurityPrincipal";
+	ret = samldb_add_step(ac, samldb_search_template);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* then apply it */
+	ret = samldb_add_step(ac, samldb_apply_template);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* check we do not already have this SID */
+	ret = samldb_add_step(ac, samldb_check_sid);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* check if we need to notice this SID */
+	ret = samldb_add_step(ac, samldb_foreign_notice_sid);
+	if (ret != LDB_SUCCESS) return ret;
+
+	/* finally proceed with adding the entry */
+	ret = samldb_add_step(ac, samldb_add_entry);
+	if (ret != LDB_SUCCESS) return ret;
+
+	return samldb_first_step(ac);
 }
 
-/* add_record */
+static int samldb_check_rdn(struct ldb_module *module, struct ldb_dn *dn)
+{
+	const char *rdn_name;
 
-/*
- * FIXME
- *
- * Actually this module is not async at all as it does a number of sync searches
- * in the process. It still to be decided how to deal with it properly so it is
- * left SYNC for now until we think of a good solution.
- */
+	rdn_name = ldb_dn_get_rdn_name(dn);
+
+	if (strcasecmp(rdn_name, "cn") != 0) {
+		ldb_asprintf_errstring(module->ldb,
+					"Bad RDN (%s=) for samldb object, "
+					"should be CN=!\n", rdn_name);
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
 
+	return LDB_SUCCESS;
+}
+
+/* add_record */
 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
 {
-	const struct ldb_message *msg = req->op.add.message;
-	struct ldb_message *msg2 = NULL;
-	struct ldb_request *down_req;
+	struct samldb_ctx *ac;
 	int ret;
 
 	ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
 
-	if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
+	/* do not manipulate our control entries */
+	if (ldb_dn_is_special(req->op.add.message->dn)) {
 		return ldb_next_request(module, req);
 	}
 
-	/* is user or computer? */
-	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) || 
-	    (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
-		/*  add all relevant missing objects */
-		ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
-		if (ret) {
-			return ret;
-		}
+	ac = samldb_ctx_init(module, req);
+	if (ac == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/* is group? add all relevant missing objects */
-	if ( ! msg2 ) {
-		if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
-			ret = samldb_fill_group_object(module, msg, &msg2);
-			if (ret) {
-				return ret;
-			}
-		}
+	/* build the new msg */
+	ac->msg = ldb_msg_copy(ac, ac->req->op.add.message);
+	if (!ac->msg) {
+		talloc_free(ac);
+		ldb_debug(ac->module->ldb, LDB_DEBUG_FATAL,
+			  "samldb_add: ldb_msg_copy failed!\n");
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/* perhaps a foreignSecurityPrincipal? */
-	if ( ! msg2 ) {
-		if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
-			ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
-			if (ret) {
-				return ret;
-			}
+	if (samdb_find_attribute(module->ldb, ac->msg,
+				 "objectclass", "computer") != NULL) {
+
+		/* make sure the computer object also has the 'user'
+		 * objectclass so it will be handled by the next call */
+		ret = samdb_find_or_add_value(module->ldb, ac->msg,
+						"objectclass", "user");
+		if (ret != LDB_SUCCESS) {
+			talloc_free(ac);
+			return ret;
 		}
 	}
 
-	if (msg2 == NULL) {
-		return ldb_next_request(module, req);
-	}
+	if (samdb_find_attribute(module->ldb, ac->msg,
+				 "objectclass", "user") != NULL) {
 
-	down_req = talloc(req, struct ldb_request);
-	if (down_req == NULL) {
-		return LDB_ERR_OPERATIONS_ERROR;
+		ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
+		if (ret != LDB_SUCCESS) {
+			talloc_free(ac);
+			return ret;
+		}
+
+		return samldb_fill_object(ac, "user");
 	}
 
-	*down_req = *req;
-	
-	down_req->op.add.message = talloc_steal(down_req, msg2);
+	if (samdb_find_attribute(module->ldb, ac->msg,
+				 "objectclass", "group") != NULL) {
+
+		ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
+		if (ret != LDB_SUCCESS) {
+			talloc_free(ac);
+			return ret;
+		}
 
-	ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
+		return samldb_fill_object(ac, "group");
+	}
 
-	/* go on with the call chain */
-	ret = ldb_next_request(module, down_req);
+	/* perhaps a foreignSecurityPrincipal? */
+	if (samdb_find_attribute(module->ldb, ac->msg,
+				 "objectclass",
+				 "foreignSecurityPrincipal") != NULL) {
 
-	/* do not free down_req as the call results may be linked to it,
-	 * it will be freed when the upper level request get freed */
-	if (ret == LDB_SUCCESS) {
-		req->handle = down_req->handle;
+		ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
+		if (ret != LDB_SUCCESS) {
+			talloc_free(ac);
+			return ret;
+		}
+
+		return samldb_fill_foreignSecurityPrincipal_object(ac);
 	}
 
-	return ret;
+	talloc_free(ac);
+
+	/* nothing matched, go on */
+	return ldb_next_request(module, req);
 }
 
 /* modify */
@@ -777,6 +1354,8 @@ static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_UNWILLING_TO_PERFORM;
 	}
 
+	/* TODO: do not modify original request, create a new one */
+
 	el = ldb_msg_find_element(req->op.mod.message, "groupType");
 	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
 		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);