r15725: First shot at making password_hash async

The async path is not yet enabled by default so it should make no harm
(This used to be commit b7d5f2325726757a4fcd0b5ac03de1b867085a89)

2 files changed, 1077 insertions, 12 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 46bafeefc2..b7f4aff67a 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -121,13 +121,6 @@ static int password_hash_handle(struct ldb_module *module, struct ldb_request *r
 
 	/* Do the original action */
 	
-	/* If no part of this touches the sambaPassword, then we don't
-	 * need to make any changes.  For password changes/set there should
-	 * be a 'delete' or a 'modify' on this attribute. */
-	if ((attribute = ldb_msg_find_element(msg, "sambaPassword")) == NULL ) {
-		return ldb_next_request(module, req);
-	}
-
 	mem_ctx = talloc_new(module);
 	if (!mem_ctx) {
 		return LDB_ERR_OPERATIONS_ERROR;
@@ -326,7 +319,7 @@ static int password_hash_handle(struct ldb_module *module, struct ldb_request *r
 		is_computer = False;
 	}
 	
-	domain_expression  = talloc_asprintf(mem_ctx, "(&(objectSid=%s)(|(objectClass=domain)(objectClass=builtinDomain)))", 
+	domain_expression  = talloc_asprintf(mem_ctx, "(&(objectSid=%s)(objectClass=domain))", 
 					     ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
 
 	/* Find the user's domain, then find out the domain password
@@ -663,12 +656,12 @@ static int password_hash_handle(struct ldb_module *module, struct ldb_request *r
 		}
 		sambaNTPwdHistory_len = MIN(sambaNTPwdHistory_len + 1, pwdHistoryLength);
 		
-		CHECK_RET(samdb_msg_add_hashes(module->ldb, mem_ctx, modify_msg, 
+		CHECK_RET(samdb_msg_add_hashes(mem_ctx, modify_msg, 
 					       "sambaLMPwdHistory", 
 					       new_sambaLMPwdHistory, 
 					       sambaLMPwdHistory_len));
 		
-		CHECK_RET(samdb_msg_add_hashes(module->ldb, mem_ctx, modify_msg, 
+		CHECK_RET(samdb_msg_add_hashes(mem_ctx, modify_msg, 
 					       "sambaNTPwdHistory", 
 					       new_sambaNTPwdHistory, 
 					       sambaNTPwdHistory_len));
@@ -704,6 +697,13 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
 		return ldb_next_request(module, req);
 	}
 	
+	/* If no part of this touches the sambaPassword, then we don't
+	 * need to make any changes.  For password changes/set there should
+	 * be a 'delete' or a 'modify' on this attribute. */
+	if (ldb_msg_find_element(msg, "sambaPassword") == NULL ) {
+		return ldb_next_request(module, req);
+	}
+
 	return password_hash_handle(module, req, msg);
 }
 
@@ -718,9 +718,1067 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r
 		return ldb_next_request(module, req);
 	}
 	
+	/* If no part of this touches the sambaPassword, then we don't
+	 * need to make any changes.  For password changes/set there should
+	 * be a 'delete' or a 'modify' on this attribute. */
+	if (ldb_msg_find_element(msg, "sambaPassword") == NULL ) {
+		return ldb_next_request(module, req);
+	}
+
 	return password_hash_handle(module, req, msg);
 }
 
+enum ph_type {PH_ADD, PH_MOD};
+enum ph_step {PH_ADD_SEARCH_DOM, PH_ADD_DO_ADD, PH_MOD_DO_REQ, PH_MOD_SEARCH_SELF, PH_MOD_SEARCH_DOM, PH_MOD_DO_MOD};
+
+struct ph_async_context {
+
+	enum ph_type type;
+	enum ph_step step;
+
+	struct ldb_module *module;
+	struct ldb_request *orig_req;
+
+	struct ldb_request *dom_req;
+	struct ldb_async_result *dom_res;
+
+	struct ldb_request *down_req;
+
+	struct ldb_request *search_req;
+	struct ldb_async_result *search_res;
+
+	struct ldb_request *mod_req;
+};
+
+struct domain_data {
+	uint_t pwdProperties;
+	uint_t pwdHistoryLength;
+	char *dnsDomain;
+	char *realm;
+};
+
+static int add_password_hashes(struct ldb_module *module, struct ldb_message *msg, int is_mod)
+{
+	const char *sambaPassword;
+	struct samr_Password tmp_hash;
+	
+	sambaPassword = ldb_msg_find_string(msg, "sambaPassword", NULL);
+	if (sambaPassword == NULL) { /* impossible, what happened ?! */
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* compute the new nt and lm hashes */
+	if (is_mod) {
+		if (ldb_msg_add_empty(msg, "ntPwdHash", LDB_FLAG_MOD_REPLACE) != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}	
+	E_md4hash(sambaPassword, tmp_hash.hash);
+	if (samdb_msg_add_hash(module->ldb, msg, msg, "ntPwdHash", &tmp_hash) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if (E_deshash(sambaPassword, tmp_hash.hash)) {
+		if (is_mod) {
+			if (ldb_msg_add_empty(msg, "lmPwdHash", LDB_FLAG_MOD_REPLACE) != 0) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+		}
+		if (samdb_msg_add_hash(module->ldb, msg, msg, "lmPwdHash", &tmp_hash) != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int add_krb5_keys_from_password(struct ldb_module *module, struct ldb_message *msg,
+					struct smb_krb5_context *smb_krb5_context,
+					struct domain_data *domain,
+					const char *samAccountName,
+					const char *user_principal_name,
+					int is_computer)
+{
+	const char *sambaPassword;
+	Principal *salt_principal;
+	krb5_error_code krb5_ret;
+	size_t num_keys;
+	Key *keys;
+	int i;
+
+	/* Many, many thanks to lukeh@padl.com for this
+	 * algorithm, described in his Nov 10 2004 mail to
+	 * samba-technical@samba.org */
+
+	sambaPassword = ldb_msg_find_string(msg, "sambaPassword", NULL);
+	if (sambaPassword == NULL) { /* impossible, what happened ?! */
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if (is_computer) {
+		/* Determine a salting principal */
+		char *name = talloc_strdup(msg, samAccountName);
+		char *saltbody;
+		if (name == NULL) {
+			ldb_set_errstring(module->ldb,
+					  talloc_asprintf(msg, "password_hash_handle: "
+							  "generation of new kerberos keys failed: %s is a computer without a samAccountName",
+							  ldb_dn_linearize(msg, msg->dn)));
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		if (name[strlen(name)-1] == '$') {
+			name[strlen(name)-1] = '\0';
+		}
+		saltbody = talloc_asprintf(msg, "%s.%s", name, domain->dnsDomain);
+		
+		krb5_ret = krb5_make_principal(smb_krb5_context->krb5_context,
+						&salt_principal,
+						domain->realm, "host",
+						saltbody, NULL);
+	} else if (user_principal_name) {
+		char *p;
+		user_principal_name = talloc_strdup(msg, user_principal_name);
+		if (user_principal_name == NULL) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		} else {
+			p = strchr(user_principal_name, '@');
+			if (p) {
+				p[0] = '\0';
+			}
+			krb5_ret = krb5_make_principal(smb_krb5_context->krb5_context,
+							&salt_principal,
+							domain->realm, user_principal_name, NULL);
+		} 
+	} else {
+		if (!samAccountName) {
+			ldb_set_errstring(module->ldb,
+					  talloc_asprintf(msg, "password_hash_handle: "
+							  "generation of new kerberos keys failed: %s has no samAccountName",
+							  ldb_dn_linearize(msg, msg->dn)));
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		krb5_ret = krb5_make_principal(smb_krb5_context->krb5_context,
+						&salt_principal,
+						domain->realm, samAccountName,
+						NULL);
+	}
+
+	if (krb5_ret) {
+		ldb_set_errstring(module->ldb,
+				  talloc_asprintf(msg, "password_hash_handle: "
+						  "generation of a saltking principal failed: %s",
+						  smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
+									     krb5_ret, msg)));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* TODO: We may wish to control the encryption types chosen in future */
+	krb5_ret = hdb_generate_key_set_password(smb_krb5_context->krb5_context,
+						 salt_principal, sambaPassword, &keys, &num_keys);
+	krb5_free_principal(smb_krb5_context->krb5_context, salt_principal);
+
+	if (krb5_ret) {
+		ldb_set_errstring(module->ldb,
+				  talloc_asprintf(msg, "password_hash_handle: "
+						  "generation of new kerberos keys failed: %s",
+						  smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
+									     krb5_ret, msg)));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* Walking all the key types generated, transform each
+	 * key into an ASN.1 blob
+	 */
+	for (i=0; i < num_keys; i++) {
+		unsigned char *buf;
+		size_t buf_size;
+		size_t len;
+		struct ldb_val val;
+		int ret;
+		
+		if (keys[i].key.keytype == ENCTYPE_ARCFOUR_HMAC) {
+			/* We might end up doing this below:
+			 * This ensures we get the unicode
+			 * conversion right.  This should also
+			 * be fixed in the Heimdal libs */
+			continue;
+		}
+		ASN1_MALLOC_ENCODE(Key, buf, buf_size, &keys[i], &len, krb5_ret);
+		if (krb5_ret) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		
+		val.data = talloc_memdup(msg, buf, len);
+		val.length = len;
+		free(buf);
+		if (!val.data || krb5_ret) {
+			hdb_free_keys (smb_krb5_context->krb5_context, num_keys, keys);
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		ret = ldb_msg_add_value(msg, "krb5Key", &val);
+		if (ret != LDB_SUCCESS) {
+			hdb_free_keys (smb_krb5_context->krb5_context, num_keys, keys);
+			return ret;
+		}
+	}
+	
+	hdb_free_keys (smb_krb5_context->krb5_context, num_keys, keys);
+
+	return LDB_SUCCESS;
+}
+
+static int add_krb5_keys_from_NThash(struct ldb_module *module, struct ldb_message *msg,
+					struct smb_krb5_context *smb_krb5_context)
+{
+	struct samr_Password *ntPwdHash;
+	krb5_error_code krb5_ret;
+	unsigned char *buf;
+	size_t buf_size;
+	size_t len;
+	struct ldb_val val;
+	Key key;
+	
+	key.mkvno = 0;
+	key.salt = NULL; /* No salt for this enc type */
+
+	ntPwdHash = samdb_result_hash(msg, msg, "ntPwdHash");
+	if (ntPwdHash == NULL) { /* what happened ?! */
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	krb5_ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+				 ENCTYPE_ARCFOUR_HMAC,
+				 ntPwdHash->hash, sizeof(ntPwdHash->hash), 
+				 &key.key);
+	if (krb5_ret) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ASN1_MALLOC_ENCODE(Key, buf, buf_size, &key, &len, krb5_ret);
+	if (krb5_ret) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	krb5_free_keyblock_contents(smb_krb5_context->krb5_context,
+				    &key.key);
+	
+	val.data = talloc_memdup(msg, buf, len);
+	val.length = len;
+	free(buf);
+	if (!val.data) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	if (ldb_msg_add_value(msg, "krb5Key", &val) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int set_pwdLastSet(struct ldb_module *module, struct ldb_message *msg)
+{
+	NTTIME now_nt;
+
+	/* set it as now */
+	unix_to_nt_time(&now_nt, time(NULL));
+
+	/* replace or add */
+	if (ldb_msg_add_empty(msg, "pwdLastSet", LDB_FLAG_MOD_REPLACE) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if (samdb_msg_add_uint64(module->ldb, msg, msg, "pwdLastSet", now_nt) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int add_keyVersionNumber(struct ldb_module *module, struct ldb_message *msg, int previous)
+{
+	/* replace or add */
+	if (ldb_msg_add_empty(msg, "msDS-KeyVersionNumber", LDB_FLAG_MOD_REPLACE) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if (samdb_msg_add_uint(module->ldb, msg, msg, "msDS-KeyVersionNumber", previous+1) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int setPwdHistory(struct ldb_module *module, struct ldb_message *msg, struct ldb_message *old_msg, int hlen)
+{
+	struct samr_Password *nt_hash;
+	struct samr_Password *lm_hash;
+	struct samr_Password *nt_history;
+	struct samr_Password *lm_history;
+	struct samr_Password *new_nt_history;
+	struct samr_Password *new_lm_history;
+	int nt_hist_len;
+	int lm_hist_len;
+	int i;
+
+	nt_hash = samdb_result_hash(msg, old_msg, "ntPwdHash");
+	lm_hash = samdb_result_hash(msg, old_msg, "lmPwdHash");
+
+	/* if no previous passwords just return */
+	if (nt_hash == NULL && lm_hash == NULL) return LDB_SUCCESS;
+
+	nt_hist_len = samdb_result_hashes(msg, old_msg, "sambaNTPwdHistory", &nt_history);
+	lm_hist_len = samdb_result_hashes(msg, old_msg, "sambaLMPwdHistory", &lm_history);
+
+	/* We might not have an old NT password */
+	new_nt_history = talloc_array(msg, struct samr_Password, hlen);
+	if (new_nt_history == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	for (i = 0; i < MIN(hlen-1, nt_hist_len); i++) {
+		new_nt_history[i+1] = nt_history[i];
+	}
+	nt_hist_len = i + 1;
+	if (nt_hash) {
+		new_nt_history[0] = *nt_hash;
+	} else {
+		ZERO_STRUCT(new_nt_history[0]);
+	}
+	if (ldb_msg_add_empty(msg, "sambaNTPwdHistory", LDB_FLAG_MOD_REPLACE) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	if (samdb_msg_add_hashes(msg, msg, "sambaNTPwdHistory", new_nt_history, nt_hist_len) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+		
+
+	/* Don't store 'long' passwords in the LM history, 
+	   but make sure to 'expire' one password off the other end */
+	new_lm_history = talloc_array(msg, struct samr_Password, hlen);
+	if (new_lm_history == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	for (i = 0; i < MIN(hlen-1, lm_hist_len); i++) {
+		new_lm_history[i+1] = lm_history[i];
+	}
+	lm_hist_len = i + 1;
+	if (lm_hash) {
+		new_lm_history[0] = *lm_hash;
+	} else {
+		ZERO_STRUCT(new_lm_history[0]);
+	}
+	if (ldb_msg_add_empty(msg, "sambaLMPwdHistory", LDB_FLAG_MOD_REPLACE) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	if (samdb_msg_add_hashes(msg, msg, "sambaLMPwdHistory", new_lm_history, lm_hist_len) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	return LDB_SUCCESS;
+}
+
+static struct ldb_async_handle *ph_init_handle(struct ldb_request *req, struct ldb_module *module, enum ph_type type)
+{
+	struct ph_async_context *ac;
+	struct ldb_async_handle *h;
+
+	h = talloc_zero(req, struct ldb_async_handle);
+	if (h == NULL) {
+		ldb_set_errstring(module->ldb, talloc_asprintf(module, "Out of Memory"));
+		return NULL;
+	}
+
+	h->module = module;
+
+	ac = talloc_zero(h, struct ph_async_context);
+	if (ac == NULL) {
+		ldb_set_errstring(module->ldb, talloc_asprintf(module, "Out of Memory"));
+		talloc_free(h);
+		return NULL;
+	}
+
+	h->private_data = (void *)ac;
+
+	h->state = LDB_ASYNC_INIT;
+	h->status = LDB_SUCCESS;
+
+	ac->type = type;
+	ac->module = module;
+	ac->orig_req = req;
+
+	return h;
+}
+
+static int get_domain_data_callback(struct ldb_context *ldb, void *context, struct ldb_async_result *ares)
+{
+	struct ph_async_context *ac;
+
+	if (!context || !ares) {
+		ldb_set_errstring(ldb, talloc_asprintf(ldb, "NULL Context or Result in callback"));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac = talloc_get_type(context, struct ph_async_context);
+
+	/* we are interested only in the single reply (base search) we receive here */
+	if (ares->type == LDB_REPLY_ENTRY) {
+		if (ac->dom_res != NULL) {
+			ldb_set_errstring(ldb, talloc_asprintf(ldb, "Too many results"));
+			talloc_free(ares);
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		ac->dom_res = talloc_steal(ac, ares);
+	} else {
+		talloc_free(ares);
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int build_domain_data_request(struct ph_async_context *ac,
+				     struct dom_sid *sid)
+{
+	const char * const attrs[] = { "pwdProperties", "pwdHistoryLength", "dnsDomain", NULL };
+	char *filter;
+
+	ac->dom_req = talloc_zero(ac, struct ldb_request);
+	if (ac->dom_req == NULL) {
+		ldb_debug(ac->module->ldb, LDB_DEBUG_ERROR, "Out of Memory!\n");
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ac->dom_req->operation = LDB_ASYNC_SEARCH;
+	ac->dom_req->op.search.base = NULL;
+	ac->dom_req->op.search.scope = LDB_SCOPE_SUBTREE;
+
+	filter = talloc_asprintf(ac->dom_req, "(&(objectSid=%s)(objectClass=domain))", dom_sid_string(ac->dom_req, sid));
+	if (filter == NULL) {
+		ldb_debug(ac->module->ldb, LDB_DEBUG_ERROR, "Out of Memory!\n");
+		talloc_free(ac->dom_req);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac->dom_req->op.search.tree = ldb_parse_tree(ac->module->ldb, filter);
+	if (ac->dom_req->op.search.tree == NULL) {
+		ldb_set_errstring(ac->module->ldb, talloc_asprintf(ac, "Invalid search filter"));
+		talloc_free(ac->dom_req);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ac->dom_req->op.search.attrs = attrs;
+	ac->dom_req->controls = NULL;
+	ac->dom_req->creds = ac->orig_req->creds;
+	ac->dom_req->async.context = ac;
+	ac->dom_req->async.callback = get_domain_data_callback;
+	ac->dom_req->async.timeout = ac->orig_req->async.timeout;
+
+	return LDB_SUCCESS;
+}
+
+static struct domain_data *get_domain_data(struct ldb_module *module, void *mem_ctx, struct ldb_async_result *res)
+{
+	struct domain_data *data;
+	const char *tmp;
+	
+	data = talloc_zero(mem_ctx, struct domain_data);
+	if (data == NULL) {
+		return NULL;
+	}
+
+	data->pwdProperties = samdb_result_uint(res->message, "pwdProperties", 0);
+	data->pwdHistoryLength = samdb_result_uint(res->message, "pwdHistoryLength", 0);
+	tmp = ldb_msg_find_string(res->message, "dnsDomain", NULL);
+
+	if (tmp != NULL) {
+		data->dnsDomain = talloc_strdup(data, tmp);
+		if (data->dnsDomain == NULL) {
+			ldb_debug(module->ldb, LDB_DEBUG_ERROR, "Out of memory!\n");
+			return NULL;
+		}
+		data->realm = strupper_talloc(mem_ctx, tmp);
+		if (data->realm == NULL) {
+			ldb_debug(module->ldb, LDB_DEBUG_ERROR, "Out of memory!\n");
+			return NULL;
+		}
+	}
+
+	return data;
+}
+
+static int password_hash_add_async(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_async_handle *h;
+	struct ph_async_context *ac;
+	struct ldb_message_element *attribute;
+	struct dom_sid *domain_sid;
+	int ret;
+
+	ldb_debug(module->ldb, LDB_DEBUG_TRACE, "password_hash_add_async\n");
+
+	if (ldb_dn_is_special(req->op.add.message->dn)) { /* do not manipulate our control entries */
+		return ldb_next_request(module, req);
+	}
+
+	/* nobody must touch password Histories */
+	if (ldb_msg_find_element(req->op.add.message, "sambaNTPwdHistory") ||
+	    ldb_msg_find_element(req->op.add.message, "sambaLMPwdHistory")) {
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	/* If no part of this touches the sambaPassword, then we don't
+	 * need to make any changes.  For password changes/set there should
+	 * be a 'delete' or a 'modify' on this attribute. */
+	if ((attribute = ldb_msg_find_element(req->op.add.message, "sambaPassword")) == NULL ) {
+		return ldb_next_request(module, req);
+	}
+
+	/* if it is not an entry of type person its an error */
+	/* TODO: remove this when sambaPassword will be in schema */
+	if (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "person")) {
+		return LDB_ERR_OBJECT_CLASS_VIOLATION;
+	}
+
+	/* check sambaPassword is single valued here */
+	/* TODO: remove this when sambaPassword will be single valued in schema */
+	if (attribute->num_values > 1) {
+		ldb_set_errstring(module->ldb, talloc_asprintf(req,
+					"mupltiple values for sambaPassword not allowed!\n"));
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
+
+	/* get user domain data */
+	domain_sid = samdb_result_sid_prefix(req, req->op.add.message, "objectSid");
+	if (domain_sid == NULL) {
+		ldb_debug(module->ldb, LDB_DEBUG_ERROR, "can't handle entry with missing objectSid!\n");
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	h = ph_init_handle(req, module, PH_ADD);
+	if (!h) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	ret = build_domain_data_request(ac, domain_sid);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step = PH_ADD_SEARCH_DOM;
+
+	req->async.handle = h;
+
+	return ldb_next_request(module, ac->dom_req);
+}
+
+static int password_hash_add_async_do_add(struct ldb_async_handle *h) {
+
+	struct ph_async_context *ac;
+	struct domain_data *domain;
+	struct smb_krb5_context *smb_krb5_context;
+	struct ldb_message *msg;
+
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	domain = get_domain_data(ac->module, ac, ac->search_res);
+	if (domain == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac->down_req = talloc(ac, struct ldb_request);
+	if (ac->down_req == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	*(ac->down_req) = *(ac->orig_req);
+	ac->down_req->op.add.message = msg = ldb_msg_copy_shallow(ac->down_req, ac->orig_req->op.add.message);
+	if (ac->down_req->op.add.message == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	
+	/* Some operations below require kerberos contexts */
+	if (smb_krb5_init_context(ac->down_req, &smb_krb5_context) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* we can compute new password hashes from the unicode password */
+	if (add_password_hashes(ac->module, msg, 0) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* now add krb5 keys based on unicode password */
+	if (add_krb5_keys_from_password(ac->module, msg, smb_krb5_context, domain,
+					ldb_msg_find_string(msg, "samAccountName", NULL),
+					ldb_msg_find_string(msg, "userPrincipalName", NULL),
+					ldb_msg_check_string_attribute(msg, "objectClass", "computer")
+				       ) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* add also kr5 keys based on NT the hash */
+	if (add_krb5_keys_from_NThash(ac->module, msg, smb_krb5_context) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* if both the domain properties and the user account controls do not permit
+	 * clear text passwords then wipe out the sambaPassword */
+	if ((!(domain->pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT)) ||
+	    (!(ldb_msg_find_uint(msg, "userAccountControl", 0) & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED))) {
+		ldb_msg_remove_attr(msg, "sambaPassword");
+	}
+
+	/* don't touch it if a value is set. It could be an incoming samsync */
+	if (ldb_msg_find_uint64(msg, "pwdLastSet", 0) == 0) {
+		if (set_pwdLastSet(ac->module, msg) != LDB_SUCCESS) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}
+
+	/* don't touch it if a value is set. It could be an incoming samsync */
+	if (!ldb_msg_find_element(msg, "msDS-KeyVersionNumber")) {
+		if (add_keyVersionNumber(ac->module, msg, 0) != LDB_SUCCESS) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}
+
+	h->state = LDB_ASYNC_INIT;
+	h->status = LDB_SUCCESS;
+
+	ac->step = PH_ADD_DO_ADD;
+
+	/* perform the operation */
+	return ldb_next_request(ac->module, ac->down_req);
+}
+
+static int password_hash_mod_async_search_self(struct ldb_async_handle *h);
+
+static int password_hash_modify_async(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_async_handle *h;
+	struct ph_async_context *ac;
+	struct ldb_message_element *sambaAttr;
+	struct ldb_message_element *ntAttr;
+	struct ldb_message_element *lmAttr;
+
+	ldb_debug(module->ldb, LDB_DEBUG_TRACE, "password_hash_add_async\n");
+
+	if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
+		return ldb_next_request(module, req);
+	}
+	
+	/* nobody must touch password Histories */
+	if (ldb_msg_find_element(req->op.mod.message, "sambaNTPwdHistory") ||
+	    ldb_msg_find_element(req->op.mod.message, "sambaLMPwdHistory")) {
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	sambaAttr = ldb_msg_find_element(req->op.mod.message, "sambaPassword");
+	ntAttr = ldb_msg_find_element(req->op.mod.message, "ntPwdHash");
+	lmAttr = ldb_msg_find_element(req->op.mod.message, "lmPwdHash");
+
+	/* check passwords are single valued here */
+	/* TODO: remove this when passwords will be single valued in schema */
+	if (sambaAttr && (sambaAttr->num_values > 1)) {
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
+	if (ntAttr && (ntAttr->num_values > 1)) {
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
+	if (lmAttr && (lmAttr->num_values > 1)) {
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
+
+	/* If no part of this touches the sambaPassword OR ntPwdHash and/or lmPwdHash, then we don't
+	 * need to make any changes.  For password changes/set there should
+	 * be a 'delete' or a 'modify' on this attribute. */
+	/* If the only operation is the deletion of the passwords then go on */
+	if (	   ((!sambaAttr) || ((sambaAttr->flags & LDB_FLAG_MOD_MASK) == LDB_FLAG_MOD_DELETE))
+		&& ((!ntAttr) || ((ntAttr->flags & LDB_FLAG_MOD_MASK) == LDB_FLAG_MOD_DELETE))
+		&& ((!lmAttr) || ((lmAttr->flags & LDB_FLAG_MOD_MASK) == LDB_FLAG_MOD_DELETE))	) {
+
+		return ldb_next_request(module, req);
+	}
+
+	h = ph_init_handle(req, module, PH_MOD);
+	if (!h) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	/* return or own handle to deal with this call */
+	req->async.handle = h;
+
+	/* prepare the first operation */
+	ac->down_req = talloc_zero(ac, struct ldb_request);
+	if (ac->down_req == NULL) {
+		ldb_set_errstring(module->ldb, talloc_asprintf(module->ldb, "Out of memory!"));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	*(ac->down_req) = *req; /* copy the request */
+
+	/* use a new message structure so that we can modify it */
+	ac->down_req->op.mod.message = ldb_msg_copy_shallow(ac->down_req, req->op.mod.message);
+
+	/* - remove any imodification to the password from the first commit
+	 *   we will make the real modification later */
+	if (sambaAttr) ldb_msg_remove_attr(ac->down_req->op.mod.message, "sambaPassword");
+	if (ntAttr) ldb_msg_remove_attr(ac->down_req->op.mod.message, "ntPwdHash");
+	if (lmAttr) ldb_msg_remove_attr(ac->down_req->op.mod.message, "lmPwdHash");
+
+	/* if there was nothing else to be modify skip to next step */
+	if (ac->down_req->op.mod.message->num_elements == 0) {
+		talloc_free(ac->down_req);
+		ac->down_req = NULL;
+		return password_hash_mod_async_search_self(h);
+	}
+	
+	ac->down_req->async.context = NULL;
+	ac->down_req->async.callback = NULL;
+
+	ac->step = PH_MOD_DO_REQ;
+
+	return ldb_next_request(module, ac->down_req);
+}
+
+static int get_self_callback(struct ldb_context *ldb, void *context, struct ldb_async_result *ares)
+{
+	struct ph_async_context *ac;
+
+	if (!context || !ares) {
+		ldb_set_errstring(ldb, talloc_asprintf(ldb, "NULL Context or Result in callback"));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac = talloc_get_type(context, struct ph_async_context);
+
+	/* we are interested only in the single reply (base search) we receive here */
+	if (ares->type == LDB_REPLY_ENTRY) {
+		if (ac->search_res != NULL) {
+			ldb_set_errstring(ldb, talloc_asprintf(ldb, "Too many results"));
+			talloc_free(ares);
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+
+		/* if it is not an entry of type person this is an error */
+		/* TODO: remove this when sambaPassword will be in schema */
+		if (!ldb_msg_check_string_attribute(ares->message, "objectClass", "person")) {
+			ldb_set_errstring(ldb, talloc_asprintf(ldb, "Object class violation"));
+			talloc_free(ares);
+			return LDB_ERR_OBJECT_CLASS_VIOLATION;
+		}
+
+		ac->search_res = talloc_steal(ac, ares);
+	} else {
+		talloc_free(ares);
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int password_hash_mod_async_search_self(struct ldb_async_handle *h) {
+
+	struct ph_async_context *ac;
+
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	/* prepare the search operation */
+	ac->search_req = talloc_zero(ac, struct ldb_request);
+	if (ac->search_req == NULL) {
+		ldb_debug(ac->module->ldb, LDB_DEBUG_ERROR, "Out of Memory!\n");
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac->search_req->operation = LDB_ASYNC_SEARCH;
+	ac->search_req->op.search.base = ac->orig_req->op.mod.message->dn;
+	ac->search_req->op.search.scope = LDB_SCOPE_BASE;
+	ac->search_req->op.search.tree = ldb_parse_tree(ac->module->ldb, NULL);
+	if (ac->search_req->op.search.tree == NULL) {
+		ldb_set_errstring(ac->module->ldb, talloc_asprintf(ac, "Invalid search filter"));
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ac->search_req->op.search.attrs = NULL;
+	ac->search_req->controls = NULL;
+	ac->search_req->creds = ac->orig_req->creds;
+	ac->search_req->async.context = ac;
+	ac->search_req->async.callback = get_self_callback;
+	ac->search_req->async.timeout = ac->orig_req->async.timeout;
+
+	ac->step = PH_MOD_SEARCH_SELF;
+
+	return ldb_next_request(ac->module, ac->search_req);
+}
+
+static int password_hash_mod_async_search_dom(struct ldb_async_handle *h) {
+
+	struct ph_async_context *ac;
+	struct dom_sid *domain_sid;
+	int ret;
+
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	/* get object domain sid */
+	domain_sid = samdb_result_sid_prefix(ac, ac->search_res->message, "objectSid");
+	if (domain_sid == NULL) {
+		ldb_debug(ac->module->ldb, LDB_DEBUG_ERROR, "can't handle entry with missing objectSid!\n");
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* get user domain data */
+	ret = build_domain_data_request(ac, domain_sid);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ac->step = PH_MOD_SEARCH_DOM;
+
+	return ldb_next_request(ac->module, ac->dom_req);
+}
+
+static int password_hash_mod_async_do_mod(struct ldb_async_handle *h) {
+
+	struct ph_async_context *ac;
+	struct domain_data *domain;
+	struct smb_krb5_context *smb_krb5_context;
+	struct ldb_message_element *sambaAttr;
+	struct ldb_message *msg;
+	int phlen;
+
+	ac = talloc_get_type(h->private_data, struct ph_async_context);
+
+	domain = get_domain_data(ac->module, ac, ac->dom_res);
+	if (domain == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	ac->mod_req = talloc(ac, struct ldb_request);
+	if (ac->mod_req == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	*(ac->mod_req) = *(ac->orig_req);
+	
+	/* use a new message structure so that we can modify it */
+	ac->mod_req->op.mod.message = msg = ldb_msg_new(ac->mod_req);
+	if (msg == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* modify dn */
+	msg->dn = ac->orig_req->op.mod.message->dn;
+
+	/* Some operations below require kerberos contexts */
+	if (smb_krb5_init_context(ac->mod_req, &smb_krb5_context) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* we are going to replace the existing krb5key or delete it */
+	if (ldb_msg_add_empty(msg, "krb5key", LDB_FLAG_MOD_REPLACE) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* if we have sambaPassword in the original message add the operatio on it here */
+	sambaAttr = ldb_msg_find_element(ac->orig_req->op.mod.message, "sambaPassword");
+	if (sambaAttr) {
+
+		if (ldb_msg_add(msg, sambaAttr, sambaAttr->flags) != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+
+		/* we are not deleteing it add password hashes */
+	       	if ((sambaAttr->flags & LDB_FLAG_MOD_MASK) != LDB_FLAG_MOD_DELETE) {
+		
+			/* we can compute new password hashes from the unicode password */
+			if (add_password_hashes(ac->module, msg, 1) != LDB_SUCCESS) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+
+			/* now add krb5 keys based on unicode password */
+			if (add_krb5_keys_from_password(ac->module, msg, smb_krb5_context, domain,
+				ldb_msg_find_string(ac->search_res->message, "samAccountName", NULL),
+				ldb_msg_find_string(ac->search_res->message, "userPrincipalName", NULL),
+				ldb_msg_check_string_attribute(ac->search_res->message, "objectClass", "computer")
+						       ) != LDB_SUCCESS) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+
+			/* if the domain properties or the user account controls do not permit
+			 * clear text passwords then wipe out the sambaPassword */
+			if ((!(domain->pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT)) ||
+			    (!(ldb_msg_find_uint(ac->search_res->message, "userAccountControl", 0) & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED))) {
+				ldb_msg_remove_attr(msg, "sambaPassword");
+			}
+
+		}
+	}
+
+	/* if we don't have sambaPassword or we are trying to delete it try with nt or lm hasehs */
+	if ((!sambaAttr) || ((sambaAttr->flags & LDB_FLAG_MOD_MASK) == LDB_FLAG_MOD_DELETE)) {
+		struct ldb_message_element *el;
+		
+		el = ldb_msg_find_element(ac->orig_req->op.mod.message, "ntPwdHash");
+		if (ldb_msg_add(msg, el, el->flags) != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		
+		el = ldb_msg_find_element(ac->orig_req->op.mod.message, "lmPwdHash");
+		if (ldb_msg_add(msg, el, el->flags) != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}
+
+	/* add also kr5 keys based on NT the hash */
+	if (add_krb5_keys_from_NThash(ac->module, msg, smb_krb5_context) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* set change time */
+	if (set_pwdLastSet(ac->module, msg) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	/* don't touch it if a value is set. It could be an incoming samsync */
+	if (add_keyVersionNumber(ac->module, msg,
+				 ldb_msg_find_uint(msg, "msDS-KeyVersionNumber", 0)
+				) != LDB_SUCCESS) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if ((phlen = samdb_result_uint(ac->dom_res->message, "pwdHistoryLength", 0)) > 0) {
+		if (setPwdHistory(ac->module, msg, ac->search_res->message, phlen) != LDB_SUCCESS) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+	}
+
+	h->state = LDB_ASYNC_INIT;
+	h->status = LDB_SUCCESS;
+
+	ac->step = PH_MOD_DO_MOD;
+
+	/* perform the search */
+	return ldb_next_request(ac->module, ac->mod_req);
+}
+
+static int ph_async_wait(struct ldb_async_handle *handle) {
+	struct ph_async_context *ac;
+	int ret;
+    
+	if (!handle || !handle->private_data) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	if (handle->state == LDB_ASYNC_DONE) {
+		return handle->status;
+	}
+
+	handle->state = LDB_ASYNC_PENDING;
+
+	ac = talloc_get_type(handle->private_data, struct ph_async_context);
+
+	switch (ac->step) {
+	case PH_ADD_SEARCH_DOM:
+		if (ac->dom_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->dom_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->dom_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+
+		/* domain search done, go on */
+		return password_hash_add_async_do_add(handle);
+
+	case PH_ADD_DO_ADD:
+		if (ac->down_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->down_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->down_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+		return LDB_SUCCESS;
+		
+	case PH_MOD_DO_REQ:
+		if (ac->down_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->down_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->down_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+
+		/* non-password mods done, go on */
+		return password_hash_mod_async_search_self(handle);
+		
+	case PH_MOD_SEARCH_SELF:
+		if (ac->search_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->search_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->search_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+
+		/* self search done, go on */
+		return password_hash_mod_async_search_dom(handle);
+		
+	case PH_MOD_SEARCH_DOM:
+		if (ac->dom_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->dom_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->dom_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+
+		/* domain search done, go on */
+		return password_hash_mod_async_do_mod(handle);
+
+	case PH_MOD_DO_MOD:
+		if (ac->mod_req->async.handle->status != LDB_ASYNC_DONE) {
+			ret = ldb_async_wait(ac->mod_req->async.handle, LDB_WAIT_NONE);
+			if (ret != LDB_SUCCESS) goto error;
+
+			if (ac->mod_req->async.handle->status != LDB_ASYNC_DONE) {
+				return LDB_SUCCESS;
+			}
+		}
+		return LDB_SUCCESS;
+		
+	default:
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto error;
+	}
+
+error:
+	handle->state = LDB_ASYNC_DONE;
+	handle->status = ret;
+	return ret;
+}
+
+static int ph_async_wait_all(struct ldb_async_handle *handle) {
+
+	int ret;
+
+	while (handle->state != LDB_ASYNC_DONE) {
+		ret = ph_async_wait(handle);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
+	return handle->status;
+}
+
+static int password_hash_async_wait(struct ldb_async_handle *handle, enum ldb_async_wait_type type)
+{
+	if (type == LDB_WAIT_ALL) {
+		return ph_async_wait_all(handle);
+	} else {
+		return ph_async_wait(handle);
+	}
+}
+
 static int password_hash_request(struct ldb_module *module, struct ldb_request *req)
 {
 	switch (req->operation) {
@@ -731,6 +1789,12 @@ static int password_hash_request(struct ldb_module *module, struct ldb_request *
 	case LDB_REQ_MODIFY:
 		return password_hash_modify(module, req);
 
+	case LDB_ASYNC_ADD:
+		return password_hash_add_async(module, req);
+
+	case LDB_ASYNC_MODIFY:
+		return password_hash_modify_async(module, req);
+
 	default:
 		return ldb_next_request(module, req);
 
@@ -739,7 +1803,8 @@ static int password_hash_request(struct ldb_module *module, struct ldb_request *
 
 static const struct ldb_module_ops password_hash_ops = {
 	.name          = "password_hash",
-	.request       = password_hash_request
+	.request       = password_hash_request,
+	.async_wait    = password_hash_async_wait
 };
 
 
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index 5dbfd4ee87..771a3e5367 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -808,7 +808,7 @@ int samdb_msg_add_hash(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct
 /*
   add a samr_Password array to a message
 */
-int samdb_msg_add_hashes(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+int samdb_msg_add_hashes(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
 			 const char *attr_name, struct samr_Password *hashes, uint_t count)
 {
 	struct ldb_val val;