Implement the ldap identity module.

This uses and exapands the async helpers.

5 files changed, 1173 insertions, 709 deletions

diff --git a/server/providers/ldap/ldap_id.c b/server/providers/ldap/ldap_id.c
index 744f29ca..12180270 100644
--- a/server/providers/ldap/ldap_id.c
+++ b/server/providers/ldap/ldap_id.c
@@ -23,756 +23,791 @@
 */
 
 #include <errno.h>
-#include <ldap.h>
+#include <time.h>
 #include <sys/time.h>
 
-#include <security/pam_modules.h>
-
 #include "util/util.h"
-#include "providers/dp_backend.h"
 #include "db/sysdb.h"
-#include "../sss_client/sss_cli.h"
-
-struct sdap_conf_ctx {
-    char *base_dn;
-
-    char *usr_base_dn;
-    int usr_search_scope;
-    char *usr_search_filter;
-
-    char *usr_objectclass;
-    char *usr_attr_name;
-    char *usr_attr_pwd;
-    char *usr_attr_uidnum;
-    char *usr_attr_gidnum;
-    char *usr_attr_gecos;
-    char *usr_attr_homedir;
-    char *usr_attr_shell;
-    char **usr_attr_others;
-
-    char *grp_base_dn;
-    int grp_search_scope;
-    char *grp_search_filter;
-
-    char *grp_objectclass;
-    char *grp_attr_name;
-    char *grp_attr_pwd;
-    char *grp_attr_gidnum;
-    char *grp_attr_member;
-    char **grp_attr_others;
-
-    enum sdap_schema {
-        SDAP_SCHEMA_RFC2307,
-        SDAP_SCHEMA_RFC2307BIS
-    } schema;
+#include "providers/dp_backend.h"
+#include "providers/ldap/sdap_async.h"
+
+struct sdap_id_ctx {
+    struct sdap_options *opts;
+
+    /* global sdap handler */
+    struct sdap_handle *gsh;
+
+    time_t went_offline;
+    bool offline;
 };
 
-struct sdap_ctx {
-    char *ldap_uri;
+static void sdap_req_done(struct be_req *req, int ret, const char *err)
+{
+    return req->fn(req, ret, err);
+}
 
-    char *bind_dn;
-    char *auth_method;
-    char *secret;
-    int secret_size;
+static bool is_offline(struct sdap_id_ctx *ctx)
+{
+    time_t now = time(NULL);
 
-    struct sdap_conf_ctx *conf;
+    if (ctx->went_offline + ctx->opts->offline_timeout < now) {
+        return false;
+    }
+    return ctx->offline;
+}
 
-    LDAP *ldap;
-    int network_timeout;
-    int opt_timeout;
-};
+static void sdap_check_online(struct be_req *req)
+{
+    struct be_online_req *oreq;
+    struct sdap_id_ctx *ctx;
 
-#if 0
-struct sdap_id_req {
-    struct be_req *req;
-    struct sdap_srv_ctx *srvctx;
+    ctx = talloc_get_type(req->be_ctx->pvt_id_data, struct sdap_id_ctx);
+    oreq = talloc_get_type(req->req_data, struct be_online_req);
 
-    
+    if (is_offline(ctx)) {
+        oreq->online = MOD_OFFLINE;
+    } else {
+        oreq->online = MOD_ONLINE;
+    }
+
+    sdap_req_done(req, EOK, NULL);
+}
+
+static int build_attrs_from_map(TALLOC_CTX *memctx,
+                                struct sdap_id_map *map,
+                                size_t size,
+                                const char ***_attrs)
+{
+    char **attrs;
+    int i;
+
+    attrs = talloc_array(memctx, char *, size + 1);
+    if (!attrs) return ENOMEM;
+
+    /* first attribute is the objectclass value not the attribute name */
+    attrs[0] = talloc_strdup(memctx, "objectClass");
+    if (!attrs[0]) return ENOMEM;
+
+    /* add the others */
+    for (i = 1; i < size; i++) {
+        attrs[i] = map[i].name;
+    }
+    attrs[i] = NULL;
+
+    *_attrs = (const char **)attrs;
+
+    return EOK;
+}
+
+
+/* =Connection-handling-functions========================================= */
+
+static bool connected(struct sdap_id_ctx *ctx)
+{
+    if (ctx->gsh) {
+        return ctx->gsh->connected;
+    }
+
+    return false;
+}
+
+struct sdap_id_connect_state {
+    struct tevent_context *ev;
+    struct sdap_options *opts;
+    bool use_start_tls;
+
+    struct sdap_handle *sh;
 };
 
-static int schedule_next_task(struct sdap_id_req *lr, struct timeval tv,
-                              tevent_timer_handler_t task)
+static void sdap_id_connect_done(struct tevent_req *subreq);
+static void sdap_id_anon_bind_done(struct tevent_req *subreq);
+
+struct tevent_req *sdap_id_connect_send(TALLOC_CTX *memctx,
+                                        struct tevent_context *ev,
+                                        struct sdap_options *opts,
+                                        bool use_start_tls)
 {
-    int ret;
-    struct tevent_timer *te;
-    struct timeval timeout;
+    struct tevent_req *req, *subreq;
+    struct sdap_id_connect_state *state;
 
-    ret = gettimeofday(&timeout, NULL);
-    if (ret == -1) {
-        DEBUG(1, ("gettimeofday failed [%d][%s].\n", errno, strerror(errno)));
-        return ret;
+    req = tevent_req_create(memctx, &state, struct sdap_id_connect_state);
+    if (!req) return NULL;
+
+    state->ev = ev;
+    state->opts = opts;
+    state->use_start_tls = use_start_tls;
+
+    subreq = sdap_connect_send(state, ev, opts, use_start_tls);
+    if (!subreq) {
+        talloc_zfree(req);
+        return NULL;
     }
-    timeout.tv_sec += tv.tv_sec;
-    timeout.tv_usec += tv.tv_usec;
+    tevent_req_set_callback(subreq, sdap_id_connect_done, req);
 
+    return req;
+}
 
-    te = tevent_add_timer(lr->req->be_ctx->ev, lr, timeout, task, lr);
-    if (te == NULL) {
-        return EIO;
+static void sdap_id_connect_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct sdap_id_connect_state *state = tevent_req_data(req,
+                                                struct sdap_id_connect_state);
+    int ret;
+
+    ret = sdap_connect_recv(subreq, state, &state->sh);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
     }
 
-    return EOK;
+    /* TODO: use authentication (SASL/GSSAPI) when necessary */
+    subreq = sdap_auth_send(state, state->ev, state->sh, NULL, NULL);
+    if (!subreq) {
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+
+    tevent_req_set_callback(subreq, sdap_id_anon_bind_done, req);
 }
 
-static int wait_for_fd(struct sdap_req *lr)
+static void sdap_id_anon_bind_done(struct tevent_req *subreq)
 {
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    enum sdap_result result;
     int ret;
-    int fd;
-    struct tevent_fd *fde;
 
-    ret = ldap_get_option(lr->ldap, LDAP_OPT_DESC, &fd);
-    if (ret != LDAP_OPT_SUCCESS) {
-        DEBUG(1, ("ldap_get_option failed.\n"));
-        return ret;
+    ret = sdap_auth_recv(subreq, &result);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
+    if (result != SDAP_AUTH_SUCCESS) {
+        tevent_req_error(req, EACCES);
+        return;
     }
 
-    fde = tevent_add_fd(lr->req->be_ctx->ev, lr, fd, TEVENT_FD_READ, lr->next_task, lr);
-    if (fde == NULL) {
+    tevent_req_done(req);
+}
+
+static int sdap_id_connect_recv(struct tevent_req *req,
+                                TALLOC_CTX *memctx, struct sdap_handle **sh)
+{
+    struct sdap_id_connect_state *state = tevent_req_data(req,
+                                                struct sdap_id_connect_state);
+    enum tevent_req_state tstate;
+    uint64_t err;
+
+    if (tevent_req_is_error(req, &tstate, &err)) {
+        if (err) return err;
         return EIO;
     }
 
+    *sh = talloc_steal(memctx, state->sh);
+    if (!*sh) {
+        return ENOMEM;
+    }
     return EOK;
 }
 
-static int sdap_pam_chauthtok(struct sdap_req *lr)
+
+/* =Users-Related-Functions-(by-name,by-uid)============================== */
+
+struct users_get_state {
+    struct tevent_context *ev;
+    struct sdap_id_ctx *ctx;
+
+    struct sss_domain_info *dom;
+    struct sysdb_ctx *sysdb;
+
+    char *filter;
+    const char **attrs;
+};
+
+static void users_get_connect_done(struct tevent_req *subreq);
+static void users_get_op_done(struct tevent_req *subreq);
+
+static struct tevent_req *users_get_send(TALLOC_CTX *memctx,
+                                         struct tevent_context *ev,
+                                         struct sdap_id_ctx *ctx,
+                                         struct be_ctx *bectx,
+                                         const char *wildcard,
+                                         int filter_type,
+                                         int attrs_type)
 {
-    BerElement *ber=NULL;
+    struct tevent_req *req, *subreq;
+    struct users_get_state *state;
+    const char *attr_name;
     int ret;
-    int pam_status=PAM_SUCCESS;
-    struct berval *bv;
-    int msgid;
-    LDAPMessage *result=NULL;
-    int ldap_ret;
-
-    ber = ber_alloc_t( LBER_USE_DER );
-    if (ber == NULL) {
-        DEBUG(1, ("ber_alloc_t failed.\n"));
-        return PAM_SYSTEM_ERR;
-    }
-
-    ret = ber_printf( ber, "{tststs}", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
-                     lr->user_dn,
-                     LDAP_TAG_EXOP_MODIFY_PASSWD_OLD, lr->pd->authtok,
-                     LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, lr->pd->newauthtok);
-    if (ret == -1) {
-        DEBUG(1, ("ber_printf failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto cleanup;
-    }
-
-    ret = ber_flatten(ber, &bv);
-    if (ret == -1) {
-        DEBUG(1, ("ber_flatten failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto cleanup;
-    }
-
-    ret = ldap_extended_operation(lr->ldap, LDAP_EXOP_MODIFY_PASSWD, bv,
-                                  NULL, NULL, &msgid);
-    if (ret != LDAP_SUCCESS) {
-        DEBUG(1, ("ldap_extended_operation failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto cleanup;
-    }
-
-    ret = ldap_result(lr->ldap, msgid, FALSE, NULL, &result);
-    if (ret == -1) {
-        DEBUG(1, ("ldap_result failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto cleanup;
-    }
-    ret = ldap_parse_result(lr->ldap, result, &ldap_ret, NULL, NULL, NULL,
-                            NULL, 0);
-    if (ret != LDAP_SUCCESS) {
-        DEBUG(1, ("ldap_parse_result failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto cleanup;
-    }
-    DEBUG(3, ("LDAP_EXOP_MODIFY_PASSWD result: [%d][%s]\n", ldap_ret,
-              ldap_err2string(ldap_ret)));
-
-    ldap_msgfree(result);
-
-    if (ldap_ret != LDAP_SUCCESS) pam_status = PAM_SYSTEM_ERR;
-
-cleanup:
-    ber_bvfree(bv);
-    ber_free(ber, 1);
-    return pam_status;
+
+    req = tevent_req_create(memctx, &state, struct users_get_state);
+    if (!req) return NULL;
+
+    state->ev = ev;
+    state->ctx = ctx;
+    state->dom = bectx->domain;
+    state->sysdb = bectx->sysdb;
+
+    switch(filter_type) {
+    case BE_FILTER_NAME:
+        attr_name = ctx->opts->user_map[SDAP_AT_USER_NAME].name;
+        break;
+    case BE_FILTER_IDNUM:
+        attr_name = ctx->opts->user_map[SDAP_AT_USER_UID].name;
+        break;
+    default:
+        ret = EINVAL;
+        goto fail;
+    }
+
+    state->filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s))",
+                                    attr_name, wildcard,
+                                    ctx->opts->user_map[SDAP_OC_USER].name);
+    if (!state->filter) {
+        DEBUG(2, ("Failed to build filter\n"));
+        ret = ENOMEM;
+        goto fail;
+    }
+
+    /* TODO: handle attrs_type */
+    ret = build_attrs_from_map(state, ctx->opts->user_map,
+                               SDAP_OPTS_USER, &state->attrs);
+    if (ret != EOK) goto fail;
+
+    if (!connected(ctx)) {
+
+        if (ctx->gsh) talloc_zfree(ctx->gsh);
+
+        /* FIXME: add option to decide if tls should be used
+         * or SASL/GSSAPI, etc ... */
+        subreq = sdap_id_connect_send(state, ev, ctx->opts, false);
+        if (!subreq) {
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        tevent_req_set_callback(subreq, users_get_connect_done, req);
+
+        return req;
+    }
+
+    subreq = sdap_get_users_send(state, state->ev,
+                                 state->dom, bectx->sysdb,
+                                 state->ctx->opts, state->ctx->gsh,
+                                 state->attrs, state->filter);
+    if (!subreq) {
+        ret = ENOMEM;
+        goto fail;
+    }
+    tevent_req_set_callback(subreq, users_get_op_done, req);
+
+    return req;
+
+fail:
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
 }
 
-static int sdap_init(struct sdap_req *lr)
+static void users_get_connect_done(struct tevent_req *subreq)
 {
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct users_get_state *state = tevent_req_data(req,
+                                                     struct users_get_state);
     int ret;
-    int status=EOK;
-    int ldap_vers = LDAP_VERSION3;
-    int msgid;
-    struct timeval network_timeout;
-    struct timeval opt_timeout;
-
-    ret = ldap_initialize(&(lr->ldap), lr->sdap_ctx->ldap_uri);
-    if (ret != LDAP_SUCCESS) {
-        DEBUG(1, ("ldap_initialize failed: %s\n", strerror(errno)));
-        return EIO;
+
+    ret = sdap_id_connect_recv(subreq, state->ctx, &state->ctx->gsh);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
     }
 
-    /* LDAPv3 is needed for TLS */
-    ret = ldap_set_option(lr->ldap, LDAP_OPT_PROTOCOL_VERSION, &ldap_vers);
-    if (ret != LDAP_OPT_SUCCESS) {
-        DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret)));
-        status = EIO;
-        goto cleanup;
-    }
-
-    network_timeout.tv_sec = lr->sdap_ctx->network_timeout;
-    network_timeout.tv_usec = 0;
-    opt_timeout.tv_sec = lr->sdap_ctx->opt_timeout;
-    opt_timeout.tv_usec = 0;
-    ret = ldap_set_option(lr->ldap, LDAP_OPT_NETWORK_TIMEOUT, &network_timeout);
-    if (ret != LDAP_OPT_SUCCESS) {
-        DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret)));
-        status = EIO;
-        goto cleanup;
-    }
-    ret = ldap_set_option(lr->ldap, LDAP_OPT_TIMEOUT, &opt_timeout);
-    if (ret != LDAP_OPT_SUCCESS) {
-        DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret)));
-        status = EIO;
-        goto cleanup;
-    }
-
-    /* For now TLS is forced. Maybe it would be necessary to make this
-     * configurable to allow people to expose their passwords over the
-     * network. */
-    ret = ldap_start_tls(lr->ldap, NULL, NULL, &msgid);
-    if (ret != LDAP_SUCCESS) {
-        DEBUG(1, ("ldap_start_tls failed: [%d][%s]\n", ret,
-                  ldap_err2string(ret)));
-        if (ret == LDAP_SERVER_DOWN) {
-            status = EAGAIN;
-        } else {
-            status = EIO;
-        }
-        goto cleanup;
+    subreq = sdap_get_users_send(state, state->ev,
+                                 state->dom, state->sysdb,
+                                 state->ctx->opts, state->ctx->gsh,
+                                 state->attrs, state->filter);
+    if (!subreq) {
+        tevent_req_error(req, ENOMEM);
+        return;
     }
+    tevent_req_set_callback(subreq, users_get_op_done, req);
+}
 
-    lr->msgid = msgid;
+static void users_get_op_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    int ret;
 
-    return EOK;
+    ret = sdap_get_users_recv(subreq);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    tevent_req_done(req);
+}
+
+static void users_get_done(struct tevent_req *req)
+{
+    struct be_req *breq = tevent_req_callback_data(req, struct be_req);
+    enum tevent_req_state tstate;
+    uint64_t err;
+    const char *error = NULL;
+    int ret = EOK;
+
+    if (tevent_req_is_error(req, &tstate, &err)) {
+        ret = err;
+    }
 
-cleanup:
-    ldap_unbind_ext(lr->ldap, NULL, NULL);
-    lr->ldap = NULL;
-    return status;
+    if (ret) error = "Enum Users Failed";
+
+    return sdap_req_done(breq, ret, error);
 }
 
-static int sdap_bind(struct sdap_req *lr)
+/* =Groups-Related-Functions-(by-name,by-uid)============================= */
+
+struct groups_get_state {
+    struct tevent_context *ev;
+    struct sdap_id_ctx *ctx;
+
+    struct sss_domain_info *dom;
+    struct sysdb_ctx *sysdb;
+
+    char *filter;
+    const char **attrs;
+};
+
+static void groups_get_connect_done(struct tevent_req *subreq);
+static void groups_get_op_done(struct tevent_req *subreq);
+
+static struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
+                                          struct tevent_context *ev,
+                                          struct sdap_id_ctx *ctx,
+                                          struct be_ctx *bectx,
+                                          const char *wildcard,
+                                          int filter_type,
+                                          int attrs_type)
 {
+    struct tevent_req *req, *subreq;
+    struct groups_get_state *state;
+    const char *attr_name;
     int ret;
-    int msgid;
-    char *dn=NULL;
-    struct berval pw;
 
-    pw.bv_len = 0;
-    pw.bv_val = NULL;
+    req = tevent_req_create(memctx, &state, struct groups_get_state);
+    if (!req) return NULL;
+
+    state->ev = ev;
+    state->ctx = ctx;
+    state->dom = bectx->domain;
+    state->sysdb = bectx->sysdb;
+
+    switch(filter_type) {
+    case BE_FILTER_NAME:
+        attr_name = ctx->opts->group_map[SDAP_AT_GROUP_NAME].name;
+        break;
+    case BE_FILTER_IDNUM:
+        attr_name = ctx->opts->group_map[SDAP_AT_GROUP_GID].name;
+        break;
+    default:
+        ret = EINVAL;
+        goto fail;
+    }
 
-    if (lr->user_dn != NULL) {
-        dn = lr->user_dn;
-        pw.bv_len = lr->pd->authtok_size;
-        pw.bv_val = (char *) lr->pd->authtok;
+    state->filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s))",
+                                    attr_name, wildcard,
+                                    ctx->opts->group_map[SDAP_OC_GROUP].name);
+    if (!state->filter) {
+        DEBUG(2, ("Failed to build filter\n"));
+        ret = ENOMEM;
+        goto fail;
     }
-    if (lr->user_dn == NULL && lr->sdap_ctx->default_bind_dn != NULL) {
-        dn = lr->sdap_ctx->default_bind_dn;
-        pw.bv_len = lr->sdap_ctx->default_authtok_size;
-        pw.bv_val = lr->sdap_ctx->default_authtok;
+
+    /* TODO: handle attrs_type */
+    ret = build_attrs_from_map(state, ctx->opts->group_map,
+                               SDAP_OPTS_GROUP, &state->attrs);
+    if (ret != EOK) goto fail;
+
+    if (!connected(ctx)) {
+
+        if (ctx->gsh) talloc_zfree(ctx->gsh);
+
+        /* FIXME: add option to decide if tls should be used
+         * or SASL/GSSAPI, etc ... */
+        subreq = sdap_id_connect_send(state, ev, ctx->opts, false);
+        if (!subreq) {
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        tevent_req_set_callback(subreq, groups_get_connect_done, req);
+
+        return req;
     }
 
-    DEBUG(3, ("Trying to bind as [%s][%*s]\n", dn, pw.bv_len, pw.bv_val));
-    ret = ldap_sasl_bind(lr->ldap, dn, LDAP_SASL_SIMPLE, &pw, NULL, NULL,
-                         &msgid);
-    if (ret == -1 || msgid == -1) {
-        DEBUG(1, ("ldap_bind failed\n"));
-        return LDAP_OTHER;
+    subreq = sdap_get_groups_send(state, state->ev,
+                                 state->dom, bectx->sysdb,
+                                 state->ctx->opts, state->ctx->gsh,
+                                 state->attrs, state->filter);
+    if (!subreq) {
+        ret = ENOMEM;
+        goto fail;
     }
-    lr->msgid = msgid;
-    return LDAP_SUCCESS;
+    tevent_req_set_callback(subreq, groups_get_op_done, req);
+
+    return req;
+
+fail:
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
 }
 
-static void sdap_pam_loop(struct tevent_context *ev, struct tevent_fd *te,
-                         uint16_t fd, void *pvt)
+static void groups_get_connect_done(struct tevent_req *subreq)
 {
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct users_get_state *state = tevent_req_data(req,
+                                                     struct users_get_state);
     int ret;
-    int pam_status=PAM_SUCCESS;
-    int ldap_ret;
-    struct sdap_req *lr;
-    struct pam_data *pd;
-    struct be_req *req;
-    LDAPMessage *result=NULL;
-    LDAPMessage *msg=NULL;
-    struct timeval no_timeout={0, 0};
-    char *errmsgp = NULL;
-/* FIXME: user timeout form config */
-    char *filter=NULL;
-    char *attrs[] = { LDAP_NO_ATTRS, NULL };
-
-    lr = talloc_get_type(pvt, struct sdap_req);
-
-    switch (lr->next_step) {
-        case SDAP_OP_INIT:
-            ret = sdap_init(lr);
-            if (ret != EOK) {
-                DEBUG(1, ("sdap_init failed.\n"));
-                lr->ldap = NULL;
-                if (ret == EAGAIN) {
-                    pam_status = PAM_AUTHINFO_UNAVAIL;
-                } else {
-                    pam_status = PAM_SYSTEM_ERR;
-                }
-                goto done;
-            }
-        case SDAP_CHECK_INIT_RESULT:
-            ret = ldap_result(lr->ldap, lr->msgid, FALSE, &no_timeout, &result);
-            if (ret == -1) {
-                DEBUG(1, ("ldap_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            if (ret == 0) {
-                DEBUG(1, ("ldap_result not ready yet, waiting.\n"));
-                lr->next_task = sdap_pam_loop;
-                lr->next_step = SDAP_CHECK_INIT_RESULT;
-                ret = wait_for_fd(lr);
-                if (ret != EOK) {
-                    DEBUG(1, ("schedule_next_task failed.\n"));
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-                }
-                return;
-            }
-
-            ret = ldap_parse_result(lr->ldap, result, &ldap_ret, NULL, NULL, NULL, NULL, 0);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("ldap_parse_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            DEBUG(3, ("ldap_start_tls result: [%d][%s]\n", ldap_ret, ldap_err2string(ldap_ret)));
-
-            if (ldap_ret != LDAP_SUCCESS) {
-                DEBUG(1, ("setting up TLS failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-
-/* FIXME: take care that ldap_install_tls might block */
-            ret = ldap_install_tls(lr->ldap);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("ldap_install_tls failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-
-            ret = sdap_bind(lr);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("sdap_bind failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-        case SDAP_CHECK_STD_BIND:
-            ret = ldap_result(lr->ldap, lr->msgid, FALSE, &no_timeout, &result);
-            if (ret == -1) {
-                DEBUG(1, ("ldap_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            if (ret == 0) {
-                DEBUG(1, ("ldap_result not ready yet, waiting.\n"));
-                lr->next_task = sdap_pam_loop;
-                lr->next_step = SDAP_CHECK_STD_BIND;
-                ret = wait_for_fd(lr);
-                if (ret != EOK) {
-                    DEBUG(1, ("schedule_next_task failed.\n"));
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-                }
-                return;
-            }
-
-            ret = ldap_parse_result(lr->ldap, result, &ldap_ret, NULL, &errmsgp,
-                                    NULL, NULL, 0);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("ldap_parse_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            DEBUG(3, ("Bind result: [%d][%s][%s]\n", ldap_ret,
-                      ldap_err2string(ldap_ret), errmsgp));
-            if (ldap_ret != LDAP_SUCCESS) {
-                DEBUG(1, ("bind failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-
-            filter = talloc_asprintf(lr->sdap_ctx,
-                                     "(&(%s=%s)(objectclass=%s))",
-                                     lr->sdap_ctx->user_name_attribute,
-                                     lr->pd->user,
-                                     lr->sdap_ctx->user_object_class);
-
-            DEBUG(4, ("calling ldap_search_ext with [%s].\n", filter));
-            ret = ldap_search_ext(lr->ldap,
-                                  lr->sdap_ctx->user_search_base,
-                                  LDAP_SCOPE_SUBTREE,
-                                  filter,
-                                  attrs,
-                                  TRUE,
-                                  NULL,
-                                  NULL,
-                                  NULL,
-                                  0,
-                                  &(lr->msgid));
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("ldap_search_ext failed [%d][%s].\n", ret, ldap_err2string(ret)));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-        case SDAP_CHECK_SEARCH_DN_RESULT:
-            ret = ldap_result(lr->ldap, lr->msgid, TRUE, &no_timeout, &result);
-            if (ret == -1) {
-                DEBUG(1, ("ldap_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            if (ret == 0) {
-                DEBUG(1, ("ldap_result not ready yet, waiting.\n"));
-                lr->next_task = sdap_pam_loop;
-                lr->next_step = SDAP_CHECK_SEARCH_DN_RESULT;
-                ret = wait_for_fd(lr);
-                if (ret != EOK) {
-                    DEBUG(1, ("schedule_next_task failed.\n"));
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-                }
-                return;
-            }
-
-            msg = ldap_first_message(lr->ldap, result);
-            if (msg == NULL) {
-                DEBUG(1, ("ldap_first_message failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-
-            do {
-                switch ( ldap_msgtype(msg) ) {
-                    case LDAP_RES_SEARCH_ENTRY:
-                        if (lr->user_dn != NULL) {
-                            DEBUG(1, ("Found more than one object with filter [%s].\n",
-                                      filter));
-                            pam_status = PAM_SYSTEM_ERR;
-                            goto done;
-                        }
-                        lr->user_dn = ldap_get_dn(lr->ldap, msg);
-                        if (lr->user_dn == NULL) {
-                            DEBUG(1, ("ldap_get_dn failed.\n"));
-                            pam_status = PAM_SYSTEM_ERR;
-                            goto done;
-                        }
-
-                        if ( *(lr->user_dn) == '\0' ) {
-                            DEBUG(1, ("No user found.\n"));
-                            pam_status = PAM_USER_UNKNOWN;
-                            goto done;
-                        }
-                        DEBUG(3, ("Found dn: %s\n",lr->user_dn));
-
-                        ldap_msgfree(result);
-                        result = NULL;
-                        break;
-                    default:
-                        DEBUG(3, ("ignoring message with type %d.\n", ldap_msgtype(msg)));
-                }
-            } while( (msg=ldap_next_message(lr->ldap, msg)) != NULL );
-
-            switch (lr->pd->cmd) {
-                case SSS_PAM_AUTHENTICATE:
-                case SSS_PAM_CHAUTHTOK:
-                    break;
-                case SSS_PAM_ACCT_MGMT:
-                case SSS_PAM_SETCRED:
-                case SSS_PAM_OPEN_SESSION:
-                case SSS_PAM_CLOSE_SESSION:
-                    pam_status = PAM_SUCCESS;
-                    goto done;
-                    break;
-                default:
-                    DEBUG(1, ("Unknown pam command %d.\n", lr->pd->cmd));
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-            }
-
-            ret = sdap_bind(lr);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("sdap_bind failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-        case SDAP_CHECK_USER_BIND:
-            ret = ldap_result(lr->ldap, lr->msgid, FALSE, &no_timeout, &result);
-            if (ret == -1) {
-                DEBUG(1, ("ldap_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            if (ret == 0) {
-                DEBUG(1, ("ldap_result not ready yet, waiting.\n"));
-                lr->next_task = sdap_pam_loop;
-                lr->next_step = SDAP_CHECK_USER_BIND;
-                ret = wait_for_fd(lr);
-                if (ret != EOK) {
-                    DEBUG(1, ("schedule_next_task failed.\n"));
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-                }
-                return;
-            }
-
-            ret = ldap_parse_result(lr->ldap, result, &ldap_ret, NULL, &errmsgp,
-                                    NULL, NULL, 0);
-            if (ret != LDAP_SUCCESS) {
-                DEBUG(1, ("ldap_parse_result failed.\n"));
-                pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
-            DEBUG(3, ("Bind result: [%d][%s][%s]\n", ldap_ret,
-                      ldap_err2string(ldap_ret), errmsgp));
-            switch (ldap_ret) {
-                case LDAP_SUCCESS:
-                    pam_status = PAM_SUCCESS;
-                    break;
-                case LDAP_INVALID_CREDENTIALS:
-                    pam_status = PAM_CRED_INSUFFICIENT;
-                    goto done;
-                    break;
-                default:
-                    pam_status = PAM_SYSTEM_ERR;
-                    goto done;
-            }
-
-            switch (lr->pd->cmd) {
-                case SSS_PAM_AUTHENTICATE:
-                    pam_status = PAM_SUCCESS;
-                    break;
-                case SSS_PAM_CHAUTHTOK:
-                    pam_status = sdap_pam_chauthtok(lr);
-                    break;
-                case SSS_PAM_ACCT_MGMT:
-                case SSS_PAM_SETCRED:
-                case SSS_PAM_OPEN_SESSION:
-                case SSS_PAM_CLOSE_SESSION:
-                    pam_status = PAM_SUCCESS;
-                    break;
-                default:
-                    DEBUG(1, ("Unknown pam command %d.\n", lr->pd->cmd));
-                    pam_status = PAM_SYSTEM_ERR;
-            }
-            break;
-        default:
-            DEBUG(1, ("Unknown ldap backend operation %d.\n", lr->next_step));
-            pam_status = PAM_SYSTEM_ERR;
+
+    ret = sdap_id_connect_recv(subreq, state->ctx, &state->ctx->gsh);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
     }
 
-done:
-    ldap_memfree(errmsgp);
-    ldap_msgfree(result);
-    talloc_free(filter);
-    if (lr->ldap != NULL) ldap_unbind_ext(lr->ldap, NULL, NULL);
-    req = lr->req;
-    pd = talloc_get_type(lr->req->req_data, struct pam_data);
-    pd->pam_status = pam_status;
+    subreq = sdap_get_groups_send(state, state->ev,
+                                 state->dom, state->sysdb,
+                                 state->ctx->opts, state->ctx->gsh,
+                                 state->attrs, state->filter);
+    if (!subreq) {
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+    tevent_req_set_callback(subreq, groups_get_op_done, req);
+}
+
+static void groups_get_op_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    int ret;
 
-    talloc_free(lr);
+    ret = sdap_get_groups_recv(subreq);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
 
-    req->fn(req, pam_status, NULL);
+    tevent_req_done(req);
 }
 
-static void sdap_start(struct tevent_context *ev, struct tevent_timer *te,
-                       struct timeval tv, void *pvt)
+static void groups_get_done(struct tevent_req *req)
 {
+    struct be_req *breq = tevent_req_callback_data(req, struct be_req);
+    enum tevent_req_state tstate;
+    uint64_t err;
+    const char *error = NULL;
+    int ret = EOK;
+
+    if (tevent_req_is_error(req, &tstate, &err)) {
+        ret = err;
+    }
+
+    if (ret) error = "Enum Groups Failed";
+
+    return sdap_req_done(breq, ret, error);
+}
+
+/* =Get-Groups-for-User================================================== */
+
+struct groups_by_user_state {
+    struct tevent_context *ev;
+    struct sdap_id_ctx *ctx;
+    struct sss_domain_info *dom;
+    struct sysdb_ctx *sysdb;
+    const char *name;
+    const char **attrs;
+};
+
+static void groups_by_user_connect_done(struct tevent_req *subreq);
+static void groups_by_user_op_done(struct tevent_req *subreq);
+
+static struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
+                                              struct tevent_context *ev,
+                                              struct sdap_id_ctx *ctx,
+                                              struct sss_domain_info *dom,
+                                              struct sysdb_ctx *sysdb,
+                                              const char *name)
+{
+    struct tevent_req *req, *subreq;
+    struct groups_by_user_state *state;
     int ret;
-    int pam_status;
-    struct sdap_req *lr;
-    struct be_req *req;
-    struct pam_data *pd;
 
-    lr = talloc_get_type(pvt, struct sdap_req);
+    req = tevent_req_create(memctx, &state, struct groups_by_user_state);
+    if (!req) return NULL;
 
-    ret = sdap_init(lr);
-    if (ret != EOK) {
-        DEBUG(1, ("sdap_init failed.\n"));
-        lr->ldap = NULL;
-        if (ret == EAGAIN) {
-            pam_status = PAM_AUTHINFO_UNAVAIL;
-        } else {
-            pam_status = PAM_SYSTEM_ERR;
+    state->ev = ev;
+    state->ctx = ctx;
+    state->dom = dom;
+    state->sysdb = sysdb;
+    state->name = name;
+
+    ret = build_attrs_from_map(state, ctx->opts->group_map,
+                               SDAP_OPTS_GROUP, &state->attrs);
+    if (ret != EOK) goto fail;
+
+    if (!connected(ctx)) {
+
+        if (ctx->gsh) talloc_zfree(ctx->gsh);
+
+        /* FIXME: add option to decide if tls should be used
+         * or SASL/GSSAPI, etc ... */
+        subreq = sdap_id_connect_send(state, ev, ctx->opts, false);
+        if (!subreq) {
+            ret = ENOMEM;
+            goto fail;
         }
-        goto done;
+
+        tevent_req_set_callback(subreq, groups_by_user_connect_done, req);
+
+        return req;
     }
 
-    lr->next_task = sdap_pam_loop;
-    lr->next_step = SDAP_CHECK_INIT_RESULT;
-    ret = wait_for_fd(lr);
-    if (ret != EOK) {
-        DEBUG(1, ("schedule_next_task failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto done;
+    subreq = sdap_get_initgr_send(state, state->ev,
+                                  state->dom, state->sysdb,
+                                  state->ctx->opts, state->ctx->gsh,
+                                  state->name, state->attrs);
+    if (!subreq) {
+        ret = ENOMEM;
+        goto fail;
     }
-    return;
+    tevent_req_set_callback(subreq, groups_by_user_op_done, req);
 
-done:
-    if (lr->ldap != NULL ) ldap_unbind_ext(lr->ldap, NULL, NULL);
-    req = lr->req;
-    pd = talloc_get_type(lr->req->req_data, struct pam_data);
-    pd->pam_status = pam_status;
+    return req;
+
+fail:
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static void groups_by_user_connect_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct groups_by_user_state *state = tevent_req_data(req,
+                                                     struct groups_by_user_state);
+    int ret;
 
-    talloc_free(lr);
+    ret = sdap_id_connect_recv(subreq, state->ctx, &state->ctx->gsh);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
 
-    req->fn(req, pam_status, NULL);
+    subreq = sdap_get_initgr_send(state, state->ev,
+                                  state->dom, state->sysdb,
+                                  state->ctx->opts, state->ctx->gsh,
+                                  state->name, state->attrs);
+    if (!subreq) {
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+    tevent_req_set_callback(subreq, groups_by_user_op_done, req);
 }
 
-static void sdap_pam_handler(struct be_req *req)
+static void groups_by_user_op_done(struct tevent_req *subreq)
 {
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
     int ret;
-    int pam_status=PAM_SUCCESS;
-    struct sdap_req *lr;
-    struct sdap_ctx *sdap_ctx;
-    struct pam_data *pd;
-    struct timeval timeout;
 
-    pd = talloc_get_type(req->req_data, struct pam_data);
+    ret = sdap_get_initgr_recv(subreq);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
 
-    sdap_ctx = talloc_get_type(req->be_ctx->pvt_auth_data, struct sdap_ctx);
+    tevent_req_done(req);
+}
 
-    lr = talloc(req, struct sdap_req);
+static void groups_by_user_done(struct tevent_req *req)
+{
+    struct be_req *breq = tevent_req_callback_data(req, struct be_req);
+    enum tevent_req_state tstate;
+    uint64_t err;
+    const char *error = NULL;
+    int ret = EOK;
+
+    if (tevent_req_is_error(req, &tstate, &err)) {
+        ret = err;
+    }
 
-    lr->ldap = NULL;
-    lr->req = req;
-    lr->pd = pd;
-    lr->sdap_ctx = sdap_ctx;
-    lr->user_dn = NULL;
-    lr->next_task = NULL;
-    lr->next_step = SDAP_NOOP;
+    if (ret) error = "Init Groups Failed";
 
-    timeout.tv_sec=0;
-    timeout.tv_usec=0;
-    ret = schedule_next_task(lr, timeout, sdap_start);
-    if (ret != EOK) {
-        DEBUG(1, ("schedule_next_task failed.\n"));
-        pam_status = PAM_SYSTEM_ERR;
-        goto done;
+    return sdap_req_done(breq, ret, error);
+}
+
+
+
+/* =Get-Account-Info-Call================================================= */
+
+/* FIXME: embed this function in sssd_be and only call out
+ * specific functions from modules */
+static void sdap_get_account_info(struct be_req *breq)
+{
+    struct sdap_id_ctx *ctx;
+    struct be_acct_req *ar;
+    struct tevent_req *req;
+    const char *err = "Unknown Error";
+    int ret = EOK;
+
+    ctx = talloc_get_type(breq->be_ctx->pvt_id_data, struct sdap_id_ctx);
+
+    if (is_offline(ctx)) {
+        return sdap_req_done(breq, EAGAIN, "Offline");
     }
 
-    return;
+    ar = talloc_get_type(breq->req_data, struct be_acct_req);
 
-done:
-    talloc_free(lr);
+    switch (ar->entry_type) {
+    case BE_REQ_USER: /* user */
+
+        req = users_get_send(breq, breq->be_ctx->ev,
+                             ctx, breq->be_ctx,
+                             ar->filter_value,
+                             ar->filter_type,
+                             ar->attr_type);
+        if (!req) {
+            return sdap_req_done(breq, ENOMEM, "Out of memory");
+        }
+
+        tevent_req_set_callback(req, users_get_done, breq);
+
+        break;
+
+    case BE_REQ_GROUP: /* group */
+
+        req = groups_get_send(breq, breq->be_ctx->ev,
+                              ctx, breq->be_ctx,
+                              ar->filter_value,
+                              ar->filter_type,
+                              ar->attr_type);
+        if (!req) {
+            return sdap_req_done(breq, ENOMEM, "Out of memory");
+        }
+
+        tevent_req_set_callback(req, groups_get_done, breq);
+
+        break;
+
+    case BE_REQ_INITGROUPS: /* init groups for user */
+        if (ar->filter_type != BE_FILTER_NAME) {
+            ret = EINVAL;
+            err = "Invalid filter type";
+            break;
+        }
+        if (ar->attr_type != BE_ATTR_CORE) {
+            ret = EINVAL;
+            err = "Invalid attr type";
+            break;
+        }
+        if (strchr(ar->filter_value, '*')) {
+            ret = EINVAL;
+            err = "Invalid filter value";
+            break;
+        }
+        req = groups_by_user_send(breq, breq->be_ctx->ev, ctx,
+                                  breq->be_ctx->domain, breq->be_ctx->sysdb,
+                                  ar->filter_value);
+        if (!req) ret = ENOMEM;
+        /* tevent_req_set_callback(req, groups_by_user_done, breq); */
+
+        tevent_req_set_callback(req, groups_by_user_done, breq);
+
+        break;
 
-    pd->pam_status = pam_status;
-    req->fn(req, pam_status, NULL);
+    default: /*fail*/
+        ret = EINVAL;
+        err = "Invalid request type";
+    }
+
+    if (ret != EOK) return sdap_req_done(breq, ret, err);
 }
 
 static void sdap_shutdown(struct be_req *req)
 {
     /* TODO: Clean up any internal data */
-    req->fn(req, EOK, NULL);
+    sdap_req_done(req, EOK, NULL);
 }
 
-struct be_auth_ops sdap_auth_ops = {
-    .pam_handler = sdap_pam_handler,
+struct be_id_ops sdap_id_ops = {
+    .check_online = sdap_check_online,
+    .get_account_info = sdap_get_account_info,
     .finalize = sdap_shutdown
 };
 
-
 int sssm_ldap_init(struct be_ctx *bectx,
-                   struct be_id_ops **ops, void **pvt_data)
+                   struct be_id_ops **ops,
+                   void **pvt_data)
 {
-    struct sdap_ctx *ctx;
-}
+    int ldap_opt_x_tls_require_cert;
+    struct sdap_id_ctx *ctx;
+    char *tls_reqcert;
+    int ret;
 
+    ctx = talloc_zero(bectx, struct sdap_id_ctx);
+    if (!ctx) return ENOMEM;
 
-{
-    char *ldap_uri;
-    char *default_bind_dn;
-    char *default_authtok_type;
-    char *default_authtok;
-    char *user_search_base;
-    char *user_name_attribute;
-    char *user_object_class;
-    int network_timeout;
-    int opt_timeout;
-    int ret;
+    ret = sdap_get_options(ctx, bectx->cdb, bectx->conf_path,
+                           &ctx->opts);
 
-    ctx = talloc(bectx, struct sdap_ctx);
-    if (!ctx) {
-        return ENOMEM;
+    tls_reqcert = ctx->opts->basic[SDAP_TLS_REQCERT].value;
+    if (tls_reqcert) {
+        if (strcasecmp(tls_reqcert, "never") == 0) {
+            ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_NEVER;
+        }
+        else if (strcasecmp(tls_reqcert, "allow") == 0) {
+            ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_ALLOW;
+        }
+        else if (strcasecmp(tls_reqcert, "try") == 0) {
+            ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_TRY;
+        }
+        else if (strcasecmp(tls_reqcert, "demand") == 0) {
+            ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;
+        }
+        else if (strcasecmp(tls_reqcert, "hard") == 0) {
+            ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_HARD;
+        }
+        else {
+            DEBUG(1, ("Unknown value for tls_reqcert.\n"));
+            ret = EINVAL;
+            goto done;
+        }
+        /* LDAP_OPT_X_TLS_REQUIRE_CERT has to be set as a global option,
+         * because the SSL/TLS context is initialized from this value. */
+        ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
+                              &ldap_opt_x_tls_require_cert);
+        if (ret != LDAP_OPT_SUCCESS) {
+            DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret)));
+            ret = EIO;
+            goto done;
+        }
     }
 
-/* TODO: add validation checks for ldapUri, user_search_base,
- * user_name_attribute, etc */
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "ldapUri", "ldap://localhost", &ldap_uri);
-    if (ret != EOK) goto done;
-    ctx->ldap_uri = ldap_uri;
-
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "defaultBindDn", NULL, &default_bind_dn);
-    if (ret != EOK) goto done;
-    ctx->default_bind_dn = default_bind_dn;
-
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "defaultAuthtokType", NULL, &default_authtok_type);
-    if (ret != EOK) goto done;
-    ctx->default_authtok_type = default_authtok_type;
-
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "userSearchBase", NULL, &user_search_base);
-    if (ret != EOK) goto done;
-    if (user_search_base == NULL) {
-        DEBUG(1, ("missing userSearchBase.\n"));
-        ret = EINVAL;
-        goto done;
-    }
-    ctx->user_search_base = user_search_base;
-
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "userNameAttribute", "uid", &user_name_attribute);
-    if (ret != EOK) goto done;
-    ctx->user_name_attribute = user_name_attribute;
-
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "userObjectClass", "posixAccount",
-                           &user_object_class);
-    if (ret != EOK) goto done;
-    ctx->user_object_class = user_object_class;
-
-/* TODO: better to have a blob object than a string here */
-    ret = confdb_get_string(bectx->cdb, ctx, bectx->conf_path,
-                           "defaultAuthtok", NULL, &default_authtok);
-    if (ret != EOK) goto done;
-    ctx->default_authtok = default_authtok;
-    ctx->default_authtok_size = (default_authtok==NULL?0:strlen(default_authtok));
-
-    ret = confdb_get_int(bectx->cdb, ctx, bectx->conf_path,
-                         "network_timeout", 5, &network_timeout);
-    if (ret != EOK) goto done;
-    ctx->network_timeout = network_timeout;
-
-    ret = confdb_get_int(bectx->cdb, ctx, bectx->conf_path,
-                         "opt_timeout", 5, &opt_timeout);
-    if (ret != EOK) goto done;
-    ctx->network_timeout = opt_timeout;
-
-    *ops = &sdap_auth_ops;
+    *ops = &sdap_id_ops;
     *pvt_data = ctx;
     ret = EOK;
 
@@ -782,5 +817,3 @@ done:
     }
     return ret;
 }
-
-#endif
diff --git a/server/providers/ldap/sdap.c b/server/providers/ldap/sdap.c
index 9abcf566..ddba0ba5 100644
--- a/server/providers/ldap/sdap.c
+++ b/server/providers/ldap/sdap.c
@@ -110,6 +110,48 @@ int sdap_get_options(TALLOC_CTX *memctx,
                   opts->basic[i].opt_name, opts->basic[i].value));
     }
 
+    /* re-read special options that are easier to be consumed after they are
+     * transformed */
+
+/* TODO: better to have a blob object than a string here */
+    ret = confdb_get_string(cdb, opts, conf_path,
+                            "defaultAuthtok", NULL,
+                            &opts->default_authtok);
+    if (ret != EOK) goto done;
+    if (opts->default_authtok) {
+        opts->default_authtok_size = strlen(opts->default_authtok);
+    }
+
+    ret = confdb_get_int(cdb, opts, conf_path,
+                         "network_timeout", 5,
+                         &opts->network_timeout);
+    if (ret != EOK) goto done;
+
+    ret = confdb_get_int(cdb, opts, conf_path,
+                         "opt_timeout", 5,
+                         &opts->opt_timeout);
+    if (ret != EOK) goto done;
+
+    ret = confdb_get_int(cdb, opts, conf_path,
+                         "offline_timeout", 60,
+                         &opts->offline_timeout);
+    if (ret != EOK) goto done;
+
+    /* schema type */
+    if (strcasecmp(opts->basic[SDAP_SCHEMA].value, "rfc2307") == 0) {
+        opts->schema_type = SDAP_SCHEMA_RFC2307;
+    } else
+    if (strcasecmp(opts->basic[SDAP_SCHEMA].value, "rfc2307bis") == 0) {
+        opts->schema_type = SDAP_SCHEMA_RFC2307BIS;
+    } else {
+        DEBUG(0, ("Unrecognized schema type: %s\n",
+                  opts->basic[SDAP_SCHEMA].value));
+        ret = EINVAL;
+        goto done;
+    }
+
+
+/* FIXME: make defaults per schema type memberUid vs member, etc... */
     for (i = 0; i < SDAP_OPTS_USER; i++) {
 
         opts->user_map[i].opt_name = default_user_map[i].opt_name;
@@ -154,33 +196,6 @@ int sdap_get_options(TALLOC_CTX *memctx,
                   opts->group_map[i].opt_name, opts->group_map[i].name));
     }
 
-    /* re-read special options that are easier to be consumed after they are
-     * transformed */
-
-/* TODO: better to have a blob object than a string here */
-    ret = confdb_get_string(cdb, opts, conf_path,
-                            "defaultAuthtok", NULL,
-                            &opts->default_authtok);
-    if (ret != EOK) goto done;
-    if (opts->default_authtok) {
-        opts->default_authtok_size = strlen(opts->default_authtok);
-    }
-
-    ret = confdb_get_int(cdb, opts, conf_path,
-                         "network_timeout", 5,
-                         &opts->network_timeout);
-    if (ret != EOK) goto done;
-
-    ret = confdb_get_int(cdb, opts, conf_path,
-                         "opt_timeout", 5,
-                         &opts->opt_timeout);
-    if (ret != EOK) goto done;
-
-    ret = confdb_get_int(cdb, opts, conf_path,
-                         "offline_timeout", 60,
-                         &opts->offline_timeout);
-    if (ret != EOK) goto done;
-
     ret = EOK;
     *_opts = opts;
 
diff --git a/server/providers/ldap/sdap.h b/server/providers/ldap/sdap.h
index b3435c8b..85b17515 100644
--- a/server/providers/ldap/sdap.h
+++ b/server/providers/ldap/sdap.h
@@ -113,6 +113,13 @@ struct sdap_options {
     int network_timeout;
     int opt_timeout;
     int offline_timeout;
+
+    /* supported schema types */
+    enum schema_type {
+        SDAP_SCHEMA_RFC2307 = 1,    /* memberUid = uid */
+        SDAP_SCHEMA_RFC2307BIS = 2, /* member = dn */
+        SDAP_SCHEMA_IPA_V1 = 3      /* member/memberof with unrolling */
+    } schema_type;
 };
 
 int sdap_get_options(TALLOC_CTX *memctx,
diff --git a/server/providers/ldap/sdap_async.c b/server/providers/ldap/sdap_async.c
index 2aba33c1..b795e83d 100644
--- a/server/providers/ldap/sdap_async.c
+++ b/server/providers/ldap/sdap_async.c
@@ -85,6 +85,13 @@ static int get_fd_from_ldap(LDAP *ldap, int *fd)
     return EOK;
 }
 
+static bool valid_handle(struct sdap_handle *sh)
+{
+    if (!sh) return false;
+    if (sh->ldap) return true;
+    return false;
+}
+
 /* ==Parse-Results-And-Handle-Disconnections============================== */
 
 static enum sdap_result sdap_check_result(struct sdap_handle *sh,
@@ -117,6 +124,45 @@ static enum sdap_result sdap_check_result(struct sdap_handle *sh,
     return SDAP_SUCCESS;
 }
 
+/* ==LDAP-Operations-Helpers============================================== */
+
+struct ldap_operation_destructor_state {
+    struct sdap_handle *sh;
+    int msgid;
+};
+
+static int ldap_operation_destructor(void *mem)
+{
+    struct ldap_operation_destructor_state *state =
+            (struct ldap_operation_destructor_state *)mem;
+
+    if (valid_handle(state->sh)) {
+        /* we don't check the result here, if a message was really abandoned,
+         * hopefully the server will get an abandon.
+         * If the operation was already fully completed, this is going to be
+         * just a noop */
+        ldap_abandon_ext(state->sh->ldap, state->msgid, NULL, NULL);
+    }
+
+    return 0;
+}
+
+static int set_ldap_operation_destructor(TALLOC_CTX *parent,
+                                         struct sdap_handle *sh, int msgid)
+{
+    struct ldap_operation_destructor_state *state;
+
+    state = talloc(parent, struct ldap_operation_destructor_state);
+    if (!state) return ENOMEM;
+
+/* TODO: should we talloc_reference sdap_handle here ? */
+    state->sh = sh;
+    state->msgid = msgid;
+
+    talloc_set_destructor((TALLOC_CTX *)state, ldap_operation_destructor);
+
+    return EOK;
+}
 
 /* ==Connect-to-LDAP-Server=============================================== */
 
@@ -862,6 +908,9 @@ struct tevent_req *sdap_get_users_send(TALLOC_CTX *memctx,
     }
     DEBUG(8, ("ldap_search_ext called, msgid = %d\n", state->msgid));
 
+    ret = set_ldap_operation_destructor(state, sh, state->msgid);
+    if (ret) goto fail;
+
     subreq = sysdb_transaction_send(state, state->ev, sysdb);
     if (!subreq) {
         ret = ENOMEM;
@@ -1055,24 +1104,12 @@ static void sdap_fake_users_done(struct tevent_context *ev,
 
 int sdap_get_users_recv(struct tevent_req *req)
 {
-    struct sdap_get_users_state *state = tevent_req_data(req,
-                                             struct sdap_get_users_state);
     enum tevent_req_state tstate;
     uint64_t err;
 
     if (tevent_req_is_error(req, &tstate, &err)) {
-
-        /* FIXME: send abandon ?
-         * read all to flush the read queue ?
-         * close the connection ? */
-
-        /* closing for now */
-        ldap_unbind_ext(state->sh->ldap, NULL, NULL);
-        state->sh->connected = false;
-        state->sh->ldap = NULL;
-        state->sh->fd = -1;
-
-        return err;
+        if (err) return err;
+        return EIO;
     }
 
     return EOK;
@@ -1131,6 +1168,9 @@ struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
     }
     DEBUG(8, ("ldap_search_ext called, msgid = %d\n", state->msgid));
 
+    ret = set_ldap_operation_destructor(state, sh, state->msgid);
+    if (ret) goto fail;
+
     subreq = sysdb_transaction_send(state, state->ev, sysdb);
     if (!subreq) {
         ret = ENOMEM;
@@ -1276,9 +1316,9 @@ static void sdap_get_groups_done(struct tevent_context *ev,
     }
 }
 
-static void sdap_fake_groups_done(struct tevent_context *ev,
-                                 struct tevent_timer *te,
-                                 struct timeval tv, void *pvt);
+static void sdap_get_groups_fake_done(struct tevent_context *ev,
+                                      struct tevent_timer *te,
+                                      struct timeval tv, void *pvt);
 
 static void sdap_get_groups_save_done(struct tevent_req *subreq)
 {
@@ -1303,16 +1343,16 @@ static void sdap_get_groups_save_done(struct tevent_req *subreq)
      * get a SDAP_RETRY it is fine.  */
 
     te = tevent_add_timer(state->ev, state, tv,
-                          sdap_fake_groups_done, req);
+                          sdap_get_groups_fake_done, req);
     if (!te) {
         tevent_req_error(req, ENOMEM);
         return;
     }
 }
 
-static void sdap_fake_groups_done(struct tevent_context *ev,
-                                 struct tevent_timer *te,
-                                 struct timeval tv, void *pvt)
+static void sdap_get_groups_fake_done(struct tevent_context *ev,
+                                      struct tevent_timer *te,
+                                      struct timeval tv, void *pvt)
 {
     struct tevent_req *req = talloc_get_type(pvt, struct tevent_req);
     struct sdap_get_groups_state *state = tevent_req_data(req,
@@ -1324,24 +1364,387 @@ static void sdap_fake_groups_done(struct tevent_context *ev,
 
 int sdap_get_groups_recv(struct tevent_req *req)
 {
-    struct sdap_get_groups_state *state = tevent_req_data(req,
-                                             struct sdap_get_groups_state);
     enum tevent_req_state tstate;
     uint64_t err;
 
     if (tevent_req_is_error(req, &tstate, &err)) {
+        if (err) return err;
+        return EIO;
+    }
 
-        /* FIXME: send abandon ?
-         * read all to flush the read queue ?
-         * close the connection ? */
+    return EOK;
+}
 
-        /* closing for now */
-        ldap_unbind_ext(state->sh->ldap, NULL, NULL);
-        state->sh->connected = false;
-        state->sh->ldap = NULL;
-        state->sh->fd = -1;
+/* ==Initgr-call-(groups-a-user-is-member-of)============================= */
 
-        return err;
+struct sdap_get_initgr_state {
+    struct tevent_context *ev;
+    struct sysdb_ctx *sysdb;
+    struct sdap_options *opts;
+    struct sss_domain_info *dom;
+    struct sdap_handle *sh;
+    const char *name;
+    const char **grp_attrs;
+
+    struct sysdb_handle *handle;
+    struct tevent_fd *fde;
+    int msgid;
+};
+
+static void sdap_get_initgr_process(struct tevent_req *subreq);
+static void sdap_get_initgr_transaction(struct tevent_req *subreq);
+static void sdap_get_initgr_done(struct tevent_context *ev,
+                                struct tevent_fd *fde,
+                                uint16_t flags, void *pvt);
+static void sdap_get_initgr_save_done(struct tevent_req *subreq);
+
+struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
+                                        struct tevent_context *ev,
+                                        struct sss_domain_info *dom,
+                                        struct sysdb_ctx *sysdb,
+                                        struct sdap_options *opts,
+                                        struct sdap_handle *sh,
+                                        const char *name,
+                                        const char **grp_attrs)
+{
+    struct tevent_req *req, *subreq;
+    struct sdap_get_initgr_state *state;
+    struct timeval tv = {0, 0};
+    const char **attrs;
+    int ret;
+
+    req = tevent_req_create(memctx, &state, struct sdap_get_initgr_state);
+    if (!req) return NULL;
+
+    state->ev = ev;
+    state->opts = opts;
+    state->sysdb = sysdb;
+    state->dom = dom;
+    state->sh = sh;
+    state->name = name;
+    state->grp_attrs = grp_attrs;
+
+    switch (opts->schema_type) {
+    case SDAP_SCHEMA_RFC2307:
+
+        subreq = tevent_wakeup_send(state, ev, tv);
+        if (!subreq) {
+            ret = ENOMEM;
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, sdap_get_initgr_process, req);
+        break;
+
+    case SDAP_SCHEMA_RFC2307BIS:
+
+        attrs = talloc_array(state, const char *, 2);
+        if (!attrs) {
+            ret = ENOMEM;
+            goto fail;
+        }
+        attrs[0] = SYSDB_ORIG_DN;
+        attrs[1] = NULL;
+
+        subreq = sysdb_search_user_by_name_send(state, ev, sysdb, NULL,
+                                                dom, name, attrs);
+        if (!subreq) {
+            ret = ENOMEM;
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, sdap_get_initgr_process, req);
+        break;
+
+    default:
+        ret = EINVAL;
+        goto fail;
+    }
+
+    return req;
+
+fail:
+    tevent_req_error(req, EIO);
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static void sdap_get_initgr_process(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct sdap_get_initgr_state *state = tevent_req_data(req,
+                                               struct sdap_get_initgr_state);
+    struct ldb_message *msg;
+    const char *user_dn;
+    char *filter;
+    int ret;
+
+    switch (state->opts->schema_type) {
+    case SDAP_SCHEMA_RFC2307:
+
+        if (!tevent_wakeup_recv(subreq)) {
+            tevent_req_error(req, EFAULT);
+            return;
+        }
+        talloc_zfree(subreq);
+
+        filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s))",
+                          state->opts->group_map[SDAP_AT_GROUP_MEMBER].name,
+                          state->name,
+                          state->opts->group_map[SDAP_OC_GROUP].name);
+        if (!filter) {
+            tevent_req_error(req, ENOENT);
+            return;
+        }
+
+        break;
+
+    case SDAP_SCHEMA_RFC2307BIS:
+
+        ret = sysdb_search_user_recv(subreq, state, &msg);
+        talloc_zfree(subreq);
+        if (ret) {
+            tevent_req_error(req, ret);
+            return;
+        }
+
+        user_dn = ldb_msg_find_attr_as_string(msg, SYSDB_ORIG_DN, NULL);
+        if (!user_dn) {
+            tevent_req_error(req, ENOENT);
+            return;
+        }
+
+        filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s))",
+                          state->opts->user_map[SDAP_AT_GROUP_MEMBER].name,
+                          user_dn,
+                          state->opts->user_map[SDAP_OC_GROUP].name);
+        if (!filter) {
+            tevent_req_error(req, ENOMEM);
+            return;
+        }
+
+        talloc_free(msg);
+
+        break;
+
+    default:
+        tevent_req_error(req, EINVAL);
+        return;
+    }
+
+    DEBUG(5, ("calling ldap_search_ext with filter:[%s].\n", filter));
+
+
+    ret = ldap_search_ext(state->sh->ldap,
+                          state->opts->basic[SDAP_GROUP_SEARCH_BASE].value,
+                          LDAP_SCOPE_SUBTREE, filter,
+                          discard_const(state->grp_attrs),
+                          false, NULL, NULL, NULL, 0, &state->msgid);
+    if (ret != LDAP_SUCCESS) {
+        DEBUG(3, ("ldap_search_ext failed: %s\n", ldap_err2string(ret)));
+        tevent_req_error(req, EIO);
+        return;
+    }
+
+    DEBUG(8, ("ldap_search_ext called, msgid = %d\n", state->msgid));
+
+    ret = set_ldap_operation_destructor(state, state->sh, state->msgid);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    subreq = sysdb_transaction_send(state, state->ev, state->sysdb);
+    if (!subreq) {
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+    tevent_req_set_callback(subreq, sdap_get_initgr_transaction, req);
+}
+
+static void sdap_get_initgr_transaction(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct sdap_get_initgr_state *state = tevent_req_data(req,
+                                               struct sdap_get_initgr_state);
+    int ret;
+
+    ret = sysdb_transaction_recv(subreq, state, &state->handle);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    state->fde = tevent_add_fd(state->ev, state,
+                               state->sh->fd, TEVENT_FD_READ,
+                               sdap_get_initgr_done, req);
+    if (!state->fde) {
+        DEBUG(1, ("Failed to set up fd event!\n"));
+        tevent_req_error(req, ENOMEM);
+    }
+}
+
+static void sdap_get_initgr_done(struct tevent_context *ev,
+                                 struct tevent_fd *fde,
+                                 uint16_t flags, void *pvt)
+{
+    struct tevent_req *req = talloc_get_type(pvt, struct tevent_req);
+    struct sdap_get_initgr_state *state = tevent_req_data(req,
+                                               struct sdap_get_initgr_state);
+    struct tevent_req *subreq;
+    LDAPMessage *msg = NULL;
+    struct sdap_msg *reply;
+    enum sdap_result res;
+    char *errmsg;
+    int restype;
+    int result;
+    int ret;
+
+    res = sdap_check_result(state->sh, state->msgid, false,
+                            &msg, &restype);
+    if (res != SDAP_SUCCESS) {
+        if (res != SDAP_RETRY) {
+            tevent_req_error(req, EIO);
+            return;
+        }
+
+        /* make sure fd is readable so we can fetch the next result */
+        TEVENT_FD_READABLE(state->fde);
+        return;
+    }
+
+    if (!msg) {
+        tevent_req_error(req, EIO);
+        return;
+    }
+
+    reply = talloc_zero(state, struct sdap_msg);
+    if (!reply) {
+        ldap_msgfree(msg);
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+
+    reply->msg = msg;
+    ret = sdap_msg_attach(reply, msg);
+    if (ret) {
+        DEBUG(1, ("Error appending memory: %s(%d)\n", strerror(ret), ret));
+        tevent_req_error(req, EFAULT);
+        return;
+    }
+
+    switch (restype) {
+    case LDAP_RES_SEARCH_REFERENCE:
+        /* ignore references for now */
+        ldap_msgfree(msg);
+        break;
+
+    case LDAP_RES_SEARCH_ENTRY:
+        /* FIXME: should we set a timeout tevent timed function ?  */
+
+        /* stop reading until operation is done */
+        TEVENT_FD_NOT_READABLE(state->fde);
+
+        subreq = sdap_save_group_send(state, state->ev, state->handle,
+                                     state->opts, state->dom,
+                                     state->sh, reply);
+        if (!subreq) {
+            tevent_req_error(req, ENOMEM);
+            return;
+        }
+        /* attach reply to subreq,
+         * will not be needed anymore once subreq is done */
+        talloc_steal(subreq, reply);
+
+        tevent_req_set_callback(subreq, sdap_get_initgr_save_done, req);
+        break;
+
+    case LDAP_RES_SEARCH_RESULT:
+        /* End of the story */
+
+        ret = ldap_parse_result(state->sh->ldap, reply->msg,
+                                &result, NULL, &errmsg, NULL, NULL, 0);
+        if (ret != LDAP_SUCCESS) {
+            DEBUG(2, ("ldap_parse_result failed (%d)\n", state->msgid));
+            tevent_req_error(req, EIO);
+            return;
+        }
+
+        DEBUG(3, ("Search result: %s(%d), %s\n",
+                  ldap_err2string(result), result, errmsg));
+
+        subreq = sysdb_transaction_commit_send(state, state->ev,
+                                               state->handle);
+        if (!subreq) {
+            tevent_req_error(req, ENOMEM);
+            return;
+        }
+        /* sysdb_transaction_complete will call tevent_req_done(req) */
+        tevent_req_set_callback(subreq, sysdb_transaction_complete, req);
+        break;
+
+    default:
+        /* what is going on here !? */
+        tevent_req_error(req, EIO);
+        return;
+    }
+}
+
+static void sdap_get_initgr_fake_done(struct tevent_context *ev,
+                                      struct tevent_timer *te,
+                                      struct timeval tv, void *pvt);
+
+static void sdap_get_initgr_save_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct sdap_get_initgr_state *state = tevent_req_data(req,
+                                               struct sdap_get_initgr_state);
+    struct timeval tv = { 0, 0 };
+    struct tevent_timer *te;
+    int ret;
+
+    ret = sdap_save_group_recv(subreq);
+    talloc_zfree(subreq);
+    if (ret) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    /* unfortunately LDAP libraries consume everything sitting on the wire but
+     * do not give us a way to know if there is anything waiting to be read or
+     * or not. So schedule a fake fde event and wake up ourselves again. If we
+     * get a SDAP_RETRY it is fine.  */
+
+    te = tevent_add_timer(state->ev, state, tv,
+                          sdap_get_initgr_fake_done, req);
+    if (!te) {
+        tevent_req_error(req, ENOMEM);
+        return;
+    }
+}
+
+static void sdap_get_initgr_fake_done(struct tevent_context *ev,
+                                      struct tevent_timer *te,
+                                      struct timeval tv, void *pvt)
+{
+    struct tevent_req *req = talloc_get_type(pvt, struct tevent_req);
+    struct sdap_get_initgr_state *state = tevent_req_data(req,
+                                               struct sdap_get_initgr_state);
+
+    sdap_get_initgr_done(state->ev, state->fde, 0, pvt);
+}
+
+
+int sdap_get_initgr_recv(struct tevent_req *req)
+{
+    enum tevent_req_state tstate;
+    uint64_t err;
+
+    if (tevent_req_is_error(req, &tstate, &err)) {
+        if (err) return err;
+        return EIO;
     }
 
     return EOK;
diff --git a/server/providers/ldap/sdap_async.h b/server/providers/ldap/sdap_async.h
index 37c307a0..6ed95320 100644
--- a/server/providers/ldap/sdap_async.h
+++ b/server/providers/ldap/sdap_async.h
@@ -45,7 +45,6 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
                                      struct tevent_context *ev,
                                      struct sdap_options *opts,
                                      bool use_start_tls);
-
 int sdap_connect_recv(struct tevent_req *req,
                       TALLOC_CTX *memctx,
                       struct sdap_handle **sh);
@@ -58,7 +57,6 @@ struct tevent_req *sdap_get_users_send(TALLOC_CTX *memctx,
                                        struct sdap_handle *sh,
                                        const char **attrs,
                                        const char *wildcard);
-
 int sdap_get_users_recv(struct tevent_req *req);
 
 struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
@@ -69,7 +67,6 @@ struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
                                        struct sdap_handle *sh,
                                        const char **attrs,
                                        const char *wildcard);
-
 int sdap_get_groups_recv(struct tevent_req *req);
 
 struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
@@ -77,5 +74,14 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
                                   struct sdap_handle *sh,
                                   const char *user_dn,
                                   const char *password);
-
 int sdap_auth_recv(struct tevent_req *req, enum sdap_result *result);
+
+struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
+                                        struct tevent_context *ev,
+                                        struct sss_domain_info *dom,
+                                        struct sysdb_ctx *sysdb,
+                                        struct sdap_options *opts,
+                                        struct sdap_handle *sh,
+                                        const char *name,
+                                        const char **grp_attrs);
+int sdap_get_initgr_recv(struct tevent_req *req);