Use new LDAP connection framework in IPA access backend.

3 files changed, 308 insertions, 308 deletions

diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index 3d66c16d..7e2bf8df 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -159,12 +159,16 @@ static errno_t hbac_sysdb_data_recv(TALLOC_CTX *mem_ctx,
     return EOK;
 }
 
-static void ipa_access_reply(struct be_req *be_req, int pam_status)
+static void ipa_access_reply(struct hbac_ctx *hbac_ctx, int pam_status)
 {
+    struct be_req *be_req = hbac_ctx->be_req;
     struct pam_data *pd;
     pd = talloc_get_type(be_req->req_data, struct pam_data);
     pd->pam_status = pam_status;
 
+    /* destroy HBAC context now to release all used resources and LDAP connection */
+    talloc_zfree(hbac_ctx);
+
     if (pam_status == PAM_SUCCESS || pam_status == PAM_PERM_DENIED) {
         be_req->fn(be_req, DP_ERR_OK, pam_status, NULL);
     } else {
@@ -173,10 +177,7 @@ static void ipa_access_reply(struct be_req *be_req, int pam_status)
 }
 
 struct hbac_get_service_data_state {
-    struct tevent_context *ev;
-    struct sdap_id_ctx *sdap_ctx;
-    struct sysdb_ctx *sysdb;
-    struct sysdb_handle *handle;
+    struct hbac_ctx *hbac_ctx;
     const char *basedn;
     bool offline;
 
@@ -189,19 +190,16 @@ struct hbac_get_service_data_state {
     size_t current_item;
 };
 
-static void hbac_get_services_connect_done(struct tevent_req *subreq);
 static void hbac_services_get_done(struct tevent_req *subreq);
 
 struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
-                                              struct tevent_context *ev,
-                                               bool offline,
-                                               struct sdap_id_ctx *sdap_ctx,
-                                               struct sysdb_ctx *sysdb,
-                                               const char *basedn)
+                                              struct hbac_ctx *hbac_ctx,
+                                              const char *basedn)
 {
     struct tevent_req *req = NULL;
     struct tevent_req *subreq = NULL;
     struct hbac_get_service_data_state *state;
+    struct sdap_handle *sdap_handle;
     int ret;
 
     req = tevent_req_create(memctx, &state, struct hbac_get_service_data_state);
@@ -210,11 +208,7 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
         return NULL;
     }
 
-    state->ev = ev;
-    state->offline = offline;
-    state->sdap_ctx = sdap_ctx;
-    state->sysdb = sysdb;
-    state->handle = NULL;
+    state->hbac_ctx = hbac_ctx;
     state->basedn = basedn;
 
     state->services_reply_list = NULL;
@@ -253,9 +247,10 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
 
     DEBUG(9, ("Services filter: [%s].\n", state->services_filter));
 
-    if (offline) {
-        ret = hbac_sysdb_data_recv(state, state->sysdb,
-                                   state->sdap_ctx->be->domain,
+    if (hbac_ctx_is_offline(state->hbac_ctx)) {
+        ret = hbac_sysdb_data_recv(state,
+                                   hbac_ctx_sysdb(state->hbac_ctx),
+                                   hbac_ctx_be(state->hbac_ctx)->domain,
                                    state->services_filter, HBAC_SERVICES_SUBDIR,
                                    state->services_attrs,
                                    &state->services_reply_count,
@@ -266,27 +261,20 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
         }
 
         tevent_req_done(req);
-        tevent_req_post(req, ev);
+        tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
         return req;
     }
 
-    if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
-        subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts,
-                                       sdap_ctx->be, sdap_ctx->service, NULL);
-        if (!subreq) {
-            DEBUG(1, ("sdap_cli_connect_send failed.\n"));
-            ret = ENOMEM;
-            goto fail;
-        }
-
-        tevent_req_set_callback(subreq, hbac_get_services_connect_done, req);
-
-        return req;
+    sdap_handle = sdap_id_op_handle(hbac_ctx_sdap_id_op(state->hbac_ctx));
+    if (sdap_handle == NULL) {
+        DEBUG(1, ("Bug: sdap_id_op is disconnected.\n"));
+        ret = EIO;
+        goto fail;
     }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
+    subreq = sdap_get_generic_send(state,
+                                   hbac_ctx_ev(state->hbac_ctx),
+                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                                   sdap_handle,
                                    state->services_search_base,
                                    LDAP_SCOPE_SUB,
                                    state->services_filter,
@@ -305,55 +293,18 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
 
 fail:
     tevent_req_error(req, ret);
-    tevent_req_post(req, ev);
+    tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
     return req;
 }
 
-static void hbac_get_services_connect_done(struct tevent_req *subreq)
-{
-    struct tevent_req *req = tevent_req_callback_data(subreq,
-                                                      struct tevent_req);
-    struct hbac_get_service_data_state *state = tevent_req_data(req,
-                                            struct hbac_get_service_data_state);
-    int ret;
-
-    ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh,
-                                NULL);
-    talloc_zfree(subreq);
-    if (ret) {
-        tevent_req_error(req, ret);
-        return;
-    }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
-                                   state->services_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->services_filter,
-                                   state->services_attrs,
-                                   NULL, 0);
-
-    if (subreq == NULL) {
-        DEBUG(1, ("sdap_get_generic_send failed.\n"));
-        ret = ENOMEM;
-        goto fail;
-    }
-
-    tevent_req_set_callback(subreq, hbac_services_get_done, req);
-    return;
-
-fail:
-    tevent_req_error(req, ret);
-    return;
-}
-
 static void hbac_services_get_done(struct tevent_req *subreq)
 {
     struct tevent_req *req = tevent_req_callback_data(subreq,
                                                       struct tevent_req);
     struct hbac_get_service_data_state *state = tevent_req_data(req,
                                             struct hbac_get_service_data_state);
+    struct sysdb_ctx *sysdb;
+    struct sss_domain_info *domain;
     int ret;
     bool in_transaction = false;
     struct ldb_dn *base_dn;
@@ -375,7 +326,10 @@ static void hbac_services_get_done(struct tevent_req *subreq)
         return;
     }
 
-    ret = sysdb_transaction_start(state->sysdb);
+    sysdb = hbac_ctx_sysdb(state->hbac_ctx);
+    domain = hbac_ctx_be(state->hbac_ctx)->domain;
+
+    ret = sysdb_transaction_start(sysdb);
     if (ret != EOK) {
         DEBUG(1, ("sysdb_transaction_start failed.\n"));
         tevent_req_error(req, ret);
@@ -383,15 +337,15 @@ static void hbac_services_get_done(struct tevent_req *subreq)
     }
     in_transaction = true;
 
-    base_dn = sysdb_custom_subtree_dn(state->sysdb, state,
-                                      state->sdap_ctx->be->domain->name,
+    base_dn = sysdb_custom_subtree_dn(sysdb, state,
+                                      domain->name,
                                       HBAC_SERVICES_SUBDIR);
     if (base_dn == NULL) {
         ret = ENOMEM;
         goto fail;
     }
 
-    ret = sysdb_delete_recursive(state, state->sysdb, base_dn, true);
+    ret = sysdb_delete_recursive(state, sysdb, base_dn, true);
     if (ret) {
         DEBUG(1, ("sysdb_delete_recursive failed.\n"));
         goto fail;
@@ -416,8 +370,8 @@ static void hbac_services_get_done(struct tevent_req *subreq)
         }
         DEBUG(9, ("Object name: [%s].\n", object_name));
 
-        ret = sysdb_store_custom(state, state->sysdb,
-                                 state->sdap_ctx->be->domain, object_name,
+        ret = sysdb_store_custom(state, sysdb,
+                                 domain, object_name,
                                  HBAC_SERVICES_SUBDIR,
                                  state->services_reply_list[i]);
         if (ret) {
@@ -426,7 +380,7 @@ static void hbac_services_get_done(struct tevent_req *subreq)
         }
     }
 
-    ret = sysdb_transaction_commit(state->sysdb);
+    ret = sysdb_transaction_commit(sysdb);
     if (ret) {
         DEBUG(1, ("sysdb_transaction_commit failed.\n"));
         goto fail;
@@ -438,7 +392,7 @@ static void hbac_services_get_done(struct tevent_req *subreq)
 
 fail:
     if (in_transaction) {
-        sysdb_transaction_cancel(state->sysdb);
+        sysdb_transaction_cancel(sysdb);
     }
     tevent_req_error(req, ret);
     return;
@@ -573,10 +527,7 @@ fail:
 
 
 struct hbac_get_host_info_state {
-    struct tevent_context *ev;
-    struct sdap_id_ctx *sdap_ctx;
-    struct sysdb_ctx *sysdb;
-    bool offline;
+    struct hbac_ctx *hbac_ctx;
 
     char *host_filter;
     char *host_search_base;
@@ -588,21 +539,18 @@ struct hbac_get_host_info_state {
     struct hbac_host_info **hbac_host_info;
 };
 
-static void hbac_get_host_info_connect_done(struct tevent_req *subreq);
-static void hbac_get_host_memberof(struct tevent_req *req);
+static void hbac_get_host_memberof(struct tevent_req *req, bool offline);
 static void hbac_get_host_memberof_done(struct tevent_req *subreq);
 
 static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
-                                                  struct tevent_context *ev,
-                                                  bool offline,
-                                                  struct sdap_id_ctx *sdap_ctx,
-                                                  struct sysdb_ctx *sysdb,
+                                                  struct hbac_ctx *hbac_ctx,
                                                   const char *basedn,
                                                   const char **hostnames)
 {
     struct tevent_req *req = NULL;
     struct tevent_req *subreq = NULL;
     struct hbac_get_host_info_state *state;
+    struct sdap_handle *sdap_handle;
     int ret;
     int i;
 
@@ -617,10 +565,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
         return NULL;
     }
 
-    state->ev = ev;
-    state->sdap_ctx = sdap_ctx;
-    state->sysdb = sysdb;
-    state->offline = offline;
+    state->hbac_ctx = hbac_ctx;
 
     state->host_reply_list = NULL;
     state->host_reply_count = 0;
@@ -671,9 +616,9 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
     state->host_attrs[5] = SYSDB_ORIG_MEMBEROF;
     state->host_attrs[6] = NULL;
 
-    if (offline) {
-        ret = hbac_sysdb_data_recv(state, state->sysdb,
-                                   state->sdap_ctx->be->domain,
+    if (hbac_ctx_is_offline(state->hbac_ctx)) {
+        ret = hbac_sysdb_data_recv(state, hbac_ctx_sysdb(state->hbac_ctx),
+                                   hbac_ctx_be(state->hbac_ctx)->domain,
                                    state->host_filter, HBAC_HOSTS_SUBDIR,
                                    state->host_attrs,
                                    &state->host_reply_count,
@@ -682,28 +627,20 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
             DEBUG(1, ("hbac_sysdb_data_recv failed.\n"));
             goto fail;
         }
-        hbac_get_host_memberof(req);
-        tevent_req_post(req, ev);
+        hbac_get_host_memberof(req, true);
+        tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
         return req;
     }
 
-    if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
-        subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts,
-                                       sdap_ctx->be, sdap_ctx->service, NULL);
-        if (!subreq) {
-            DEBUG(1, ("sdap_cli_connect_send failed.\n"));
-            ret = ENOMEM;
-            goto fail;
-        }
-
-        tevent_req_set_callback(subreq, hbac_get_host_info_connect_done, req);
-
-        return req;
+    sdap_handle = sdap_id_op_handle(hbac_ctx_sdap_id_op(state->hbac_ctx));
+    if (sdap_handle == NULL) {
+        DEBUG(1, ("Bug: sdap_id_op is disconnected.\n"));
+        ret = EIO;
+        goto fail;
     }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
+    subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx),
+                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                                   sdap_handle,
                                    state->host_search_base,
                                    LDAP_SCOPE_SUB,
                                    state->host_filter,
@@ -722,50 +659,10 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
 
 fail:
     tevent_req_error(req, ret);
-    tevent_req_post(req, ev);
+    tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
     return req;
 }
 
-static void hbac_get_host_info_connect_done(struct tevent_req *subreq)
-{
-    struct tevent_req *req = tevent_req_callback_data(subreq,
-                                                      struct tevent_req);
-    struct hbac_get_host_info_state *state = tevent_req_data(req,
-                                               struct hbac_get_host_info_state);
-    int ret;
-
-    ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh,
-                                NULL);
-    talloc_zfree(subreq);
-    if (ret) {
-        tevent_req_error(req, ret);
-        return;
-    }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
-                                   state->host_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->host_filter,
-                                   state->host_attrs,
-                                   NULL, 0);
-
-    if (subreq == NULL) {
-        DEBUG(1, ("sdap_get_generic_send failed.\n"));
-        ret = ENOMEM;
-        goto fail;
-    }
-
-    tevent_req_set_callback(subreq, hbac_get_host_memberof_done, req);
-
-    return;
-
-fail:
-    tevent_req_error(req, ret);
-    return;
-}
-
 static void hbac_get_host_memberof_done(struct tevent_req *subreq)
 {
     struct tevent_req *req = tevent_req_callback_data(subreq,
@@ -782,13 +679,14 @@ static void hbac_get_host_memberof_done(struct tevent_req *subreq)
         return;
     }
 
-    hbac_get_host_memberof(req);
+    hbac_get_host_memberof(req, false);
 }
 
-static void hbac_get_host_memberof(struct tevent_req *req)
+static void hbac_get_host_memberof(struct tevent_req *req, bool offline)
 {
     struct hbac_get_host_info_state *state =
                     tevent_req_data(req, struct hbac_get_host_info_state);
+    struct sysdb_ctx *sysdb;
     bool in_transaction = false;
     int ret;
     int i;
@@ -875,8 +773,8 @@ static void hbac_get_host_memberof(struct tevent_req *req)
         }
 
         ret = sysdb_attrs_get_string_array(state->host_reply_list[i],
-                                          state->offline ? SYSDB_ORIG_MEMBEROF :
-                                                           IPA_MEMBEROF,
+                                          offline ? SYSDB_ORIG_MEMBEROF :
+                                                    IPA_MEMBEROF,
                                           hhi, &(hhi[i]->memberof));
         if (ret != EOK) {
             if (ret != ENOENT) {
@@ -896,12 +794,14 @@ static void hbac_get_host_memberof(struct tevent_req *req)
 
     state->hbac_host_info = hhi;
 
-    if (state->offline) {
+    if (offline) {
         tevent_req_done(req);
         return;
     }
 
-    ret = sysdb_transaction_start(state->sysdb);
+    sysdb = hbac_ctx_sysdb(state->hbac_ctx);
+
+    ret = sysdb_transaction_start(sysdb);
     if (ret != EOK) {
         tevent_req_error(req, ret);
         return;
@@ -928,8 +828,8 @@ static void hbac_get_host_memberof(struct tevent_req *req)
         }
         DEBUG(9, ("Fqdn [%s].\n", object_name));
 
-        ret = sysdb_store_custom(state, state->sysdb,
-                                 state->sdap_ctx->be->domain,
+        ret = sysdb_store_custom(state, sysdb,
+                                 hbac_ctx_be(state->hbac_ctx)->domain,
                                  object_name,
                                  HBAC_HOSTS_SUBDIR,
                                  state->host_reply_list[i]);
@@ -940,7 +840,7 @@ static void hbac_get_host_memberof(struct tevent_req *req)
         }
     }
 
-    ret = sysdb_transaction_commit(state->sysdb);
+    ret = sysdb_transaction_commit(sysdb);
     if (ret) {
         DEBUG(1, ("sysdb_transaction_commit failed.\n"));
         goto fail;
@@ -952,7 +852,7 @@ static void hbac_get_host_memberof(struct tevent_req *req)
 
 fail:
     if (in_transaction) {
-        sysdb_transaction_cancel(state->sysdb);
+        sysdb_transaction_cancel(sysdb);
     }
     tevent_req_error(req, ret);
     return;
@@ -972,10 +872,7 @@ static int hbac_get_host_info_recv(struct tevent_req *req, TALLOC_CTX *memctx,
 
 
 struct hbac_get_rules_state {
-    struct tevent_context *ev;
-    struct sdap_id_ctx *sdap_ctx;
-    struct sysdb_ctx *sysdb;
-    bool offline;
+    struct hbac_ctx *hbac_ctx;
 
     const char *host_dn;
     const char **memberof;
@@ -989,22 +886,19 @@ struct hbac_get_rules_state {
     int current_item;
 };
 
-static void hbac_get_rules_connect_done(struct tevent_req *subreq);
-static void hbac_rule_get(struct tevent_req *req);
+static void hbac_rule_get(struct tevent_req *req, bool offline);
 static void hbac_rule_get_done(struct tevent_req *subreq);
 
 static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
-                                             struct tevent_context *ev,
-                                             bool offline,
-                                             struct sdap_id_ctx *sdap_ctx,
-                                             struct sysdb_ctx *sysdb,
-                                             const char *basedn,
-                                             const char *host_dn,
-                                             const char **memberof)
+                                              struct hbac_ctx *hbac_ctx,
+                                              const char *basedn,
+                                              const char *host_dn,
+                                              const char **memberof)
 {
     struct tevent_req *req = NULL;
     struct tevent_req *subreq = NULL;
     struct hbac_get_rules_state *state;
+    struct sdap_handle *sdap_handle;
     int ret;
     int i;
 
@@ -1019,10 +913,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
         return NULL;
     }
 
-    state->ev = ev;
-    state->offline = offline;
-    state->sdap_ctx = sdap_ctx;
-    state->sysdb = sysdb;
+    state->hbac_ctx = hbac_ctx;
     state->host_dn = host_dn;
     state->memberof = memberof;
 
@@ -1091,9 +982,9 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
 
     DEBUG(9, ("HBAC rule filter: [%s].\n", state->hbac_filter));
 
-    if (offline) {
-        ret = hbac_sysdb_data_recv(state, state->sysdb,
-                                   state->sdap_ctx->be->domain,
+    if (hbac_ctx_is_offline(state->hbac_ctx)) {
+        ret = hbac_sysdb_data_recv(state, hbac_ctx_sysdb(state->hbac_ctx),
+                                   hbac_ctx_be(state->hbac_ctx)->domain,
                                    state->hbac_filter, HBAC_RULES_SUBDIR,
                                    state->hbac_attrs,
                                    &state->hbac_reply_count,
@@ -1102,28 +993,20 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
             DEBUG(1, ("hbac_sysdb_data_recv failed.\n"));
             goto fail;
         }
-        hbac_rule_get(req);
-        tevent_req_post(req, ev);
+        hbac_rule_get(req, true);
+        tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
         return req;
     }
 
-    if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
-        subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts,
-                                       sdap_ctx->be, sdap_ctx->service, NULL);
-        if (!subreq) {
-            DEBUG(1, ("sdap_cli_connect_send failed.\n"));
-            ret = ENOMEM;
-            goto fail;
-        }
-
-        tevent_req_set_callback(subreq, hbac_get_rules_connect_done, req);
-
-        return req;
+    sdap_handle = sdap_id_op_handle(hbac_ctx_sdap_id_op(state->hbac_ctx));
+    if (sdap_handle == NULL) {
+        DEBUG(1, ("Bug: sdap_id_op is disconnected.\n"));
+        ret = EIO;
+        goto fail;
     }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
+    subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx),
+                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                                   sdap_handle,
                                    state->hbac_search_base,
                                    LDAP_SCOPE_SUB,
                                    state->hbac_filter,
@@ -1142,49 +1025,10 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
 
 fail:
     tevent_req_error(req, ret);
-    tevent_req_post(req, ev);
+    tevent_req_post(req, hbac_ctx_ev(state->hbac_ctx));
     return req;
 }
 
-static void hbac_get_rules_connect_done(struct tevent_req *subreq)
-{
-    struct tevent_req *req = tevent_req_callback_data(subreq,
-                                                      struct tevent_req);
-    struct hbac_get_rules_state *state = tevent_req_data(req,
-                                                     struct hbac_get_rules_state);
-    int ret;
-
-    ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh,
-                                NULL);
-    talloc_zfree(subreq);
-    if (ret) {
-        tevent_req_error(req, ret);
-        return;
-    }
-
-    subreq = sdap_get_generic_send(state, state->ev,
-                                   state->sdap_ctx->opts,
-                                   state->sdap_ctx->gsh,
-                                   state->hbac_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->hbac_filter,
-                                   state->hbac_attrs,
-                                   NULL, 0);
-
-    if (subreq == NULL) {
-        DEBUG(1, ("sdap_get_generic_send failed.\n"));
-        ret = ENOMEM;
-        goto fail;
-    }
-
-    tevent_req_set_callback(subreq, hbac_rule_get_done, req);
-    return;
-
-fail:
-    tevent_req_error(req, ret);
-    return;
-}
-
 static void hbac_rule_get_done(struct tevent_req *subreq)
 {
     struct tevent_req *req = tevent_req_callback_data(subreq,
@@ -1201,14 +1045,16 @@ static void hbac_rule_get_done(struct tevent_req *subreq)
         return;
     }
 
-    hbac_rule_get(req);
+    hbac_rule_get(req, false);
 }
 
-static void hbac_rule_get(struct tevent_req *req)
+static void hbac_rule_get(struct tevent_req *req, bool offline)
 {
     struct hbac_get_rules_state *state =
                         tevent_req_data(req, struct hbac_get_rules_state);
     bool in_transaction = false;
+    struct sysdb_ctx *sysdb;
+    struct sss_domain_info *domain;
     int ret;
     int i;
     struct ldb_message_element *el;
@@ -1229,26 +1075,29 @@ static void hbac_rule_get(struct tevent_req *req)
         DEBUG(9, ("OriginalDN: [%s].\n", (const char *)el->values[0].data));
     }
 
-    if (state->hbac_reply_count == 0 || state->offline) {
+    if (state->hbac_reply_count == 0 || offline) {
         tevent_req_done(req);
         return;
     }
 
-    ret = sysdb_transaction_start(state->sysdb);
+    sysdb = hbac_ctx_sysdb(state->hbac_ctx);
+    domain = hbac_ctx_be(state->hbac_ctx)->domain;
+
+    ret = sysdb_transaction_start(sysdb);
     if (ret != EOK) {
         tevent_req_error(req, ret);
         return;
     }
     in_transaction = true;
 
-    hbac_base_dn = sysdb_custom_subtree_dn(state->sysdb, state,
-                                           state->sdap_ctx->be->domain->name,
+    hbac_base_dn = sysdb_custom_subtree_dn(sysdb, state,
+                                           domain->name,
                                            HBAC_RULES_SUBDIR);
     if (hbac_base_dn == NULL) {
         ret = ENOMEM;
         goto fail;
     }
-    ret = sysdb_delete_recursive(state, state->sysdb, hbac_base_dn, true);
+    ret = sysdb_delete_recursive(state, sysdb, hbac_base_dn, true);
     if (ret) {
         DEBUG(1, ("sysdb_delete_recursive_send failed.\n"));
         goto fail;
@@ -1275,8 +1124,8 @@ static void hbac_rule_get(struct tevent_req *req)
         }
         DEBUG(9, ("IPAUniqueId: [%s].\n", object_name));
 
-        ret = sysdb_store_custom(state, state->sysdb,
-                                 state->sdap_ctx->be->domain,
+        ret = sysdb_store_custom(state, sysdb,
+                                 domain,
                                  object_name,
                                  HBAC_RULES_SUBDIR,
                                  state->hbac_reply_list[i]);
@@ -1287,7 +1136,7 @@ static void hbac_rule_get(struct tevent_req *req)
         }
     }
 
-    ret = sysdb_transaction_commit(state->sysdb);
+    ret = sysdb_transaction_commit(sysdb);
     if (ret) {
         DEBUG(1, ("sysdb_transaction_commit failed.\n"));
         goto fail;
@@ -1299,7 +1148,7 @@ static void hbac_rule_get(struct tevent_req *req)
 
 fail:
     if (in_transaction) {
-        sysdb_transaction_cancel(state->sysdb);
+        sysdb_transaction_cancel(sysdb);
     }
     tevent_req_error(req, ret);
     return;
@@ -1311,15 +1160,13 @@ static int hbac_get_rules_recv(struct tevent_req *req, TALLOC_CTX *memctx,
 {
     struct hbac_get_rules_state *state = tevent_req_data(req,
                                                      struct hbac_get_rules_state);
-    int i;
 
     TEVENT_REQ_RETURN_ON_ERROR(req);
 
     *hbac_rule_count = state->hbac_reply_count;
     *hbac_rule_list = talloc_steal(memctx, state->hbac_reply_list);
-    for (i = 0; i < state->hbac_reply_count; i++) {
-        talloc_steal(memctx, state->hbac_reply_list[i]);
-    }
+    /* we do not need to steal each hbac_reply_list[i]
+     * as it belongs to hbac_reply_list memory block */
     return EOK;
 }
 
@@ -1817,18 +1664,22 @@ static int evaluate_ipa_hbac_rules(struct hbac_ctx *hbac_ctx,
     return EOK;
 }
 
+static int hbac_retry(struct hbac_ctx *hbac_ctx);
+static void hbac_connect_done(struct tevent_req *subreq);
+static bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret);
+
+static int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx);
 static void hbac_get_host_info_done(struct tevent_req *req);
 static void hbac_get_rules_done(struct tevent_req *req);
 static void hbac_get_service_data_done(struct tevent_req *req);
 
 void ipa_access_handler(struct be_req *be_req)
 {
-    struct tevent_req *req;
     struct pam_data *pd;
     struct hbac_ctx *hbac_ctx;
     int pam_status = PAM_SYSTEM_ERR;
     struct ipa_access_ctx *ipa_access_ctx;
-    const char *hostlist[3];
+    bool offline;
     int ret;
 
     pd = talloc_get_type(be_req->req_data, struct pam_data);
@@ -1853,59 +1704,157 @@ void ipa_access_handler(struct be_req *be_req)
         DEBUG(1, ("domain_to_basedn failed.\n"));
         goto fail;
     }
-    hbac_ctx->offline = be_is_offline(be_req->be_ctx);
 
-    DEBUG(9, ("Connection status is [%s].\n", hbac_ctx->offline ? "offline" :
-                                                                  "online"));
+    offline = be_is_offline(be_req->be_ctx);
+    DEBUG(9, ("Connection status is [%s].\n", offline ? "offline" : "online"));
+
+    if (!offline) {
+        hbac_ctx->sdap_op = sdap_id_op_create(hbac_ctx,
+                                    hbac_ctx_sdap_id_ctx(hbac_ctx)->conn_cache);
+        if (!hbac_ctx->sdap_op) {
+            DEBUG(1, ("sdap_id_op_create failed.\n"));
+            goto fail;
+        }
+    }
+
+    ret = hbac_retry(hbac_ctx);
+    if (ret != EOK) {
+        goto fail;
+    }
+
+    return;
+
+fail:
+    ipa_access_reply(hbac_ctx, pam_status);
+}
+
+static int hbac_retry(struct hbac_ctx *hbac_ctx)
+{
+    struct tevent_req *subreq;
+    int ret;
+
+    if (hbac_ctx_is_offline(hbac_ctx)) {
+        return hbac_get_host_info_step(hbac_ctx);
+    }
+
+    subreq = sdap_id_op_connect_send(hbac_ctx_sdap_id_op(hbac_ctx), hbac_ctx, &ret);
+    if (!subreq) {
+        DEBUG(1, ("sdap_id_op_connect_send failed: %d(%s).\n", ret, strerror(ret)));
+        return ret;
+    }
 
+    tevent_req_set_callback(subreq, hbac_connect_done, hbac_ctx);
+    return EOK;
+}
+
+static void hbac_connect_done(struct tevent_req *subreq)
+{
+    struct hbac_ctx *hbac_ctx = tevent_req_callback_data(subreq, struct hbac_ctx);
+    int ret, dp_error;
+
+    ret = sdap_id_op_connect_recv(subreq, &dp_error);
+    talloc_zfree(subreq);
+
+    if (dp_error == DP_ERR_OFFLINE) {
+        /* switching to offline mode */
+        talloc_zfree(hbac_ctx->sdap_op);
+    } else if (ret != EOK) {
+        goto fail;
+    }
+
+    ret = hbac_get_host_info_step(hbac_ctx);
+    if (ret != EOK) {
+        goto fail;
+    }
+
+    return;
+
+fail:
+    ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
+}
+
+/* Check the step result code and continue, retry, get offline result or abort accordingly */
+static bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret)
+{
+    int dp_error;
+
+    if (ret == EOK) {
+        return true;
+    }
+
+    if (hbac_ctx_is_offline(hbac_ctx)) {
+        /* already offline => the error is fatal */
+        ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
+        return false;
+    }
+
+    ret = sdap_id_op_done(hbac_ctx_sdap_id_op(hbac_ctx), ret, &dp_error);
+    if (dp_error == DP_ERR_OFFLINE) {
+        /* switching to offline mode */
+        talloc_zfree(hbac_ctx->sdap_op);
+        dp_error = DP_ERR_OK;
+    }
+
+    if (dp_error == DP_ERR_OK) {
+        /* retry */
+        ret = hbac_retry(hbac_ctx);
+        if (ret == EOK) {
+            return false;
+        }
+
+        dp_error = DP_ERR_FATAL;
+    }
+
+    ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
+    return false;
+}
+
+static int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx)
+{
+    struct pam_data *pd = hbac_ctx->pd;
+    const char *hostlist[3];
+    struct tevent_req *subreq;
 
     hostlist[0] = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);
     if (hostlist[0] == NULL) {
         DEBUG(1, ("ipa_hostname not available.\n"));
-        goto fail;
+        return EINVAL;
     }
     if (pd->rhost != NULL && *pd->rhost != '\0') {
         hostlist[1] = pd->rhost;
+        hostlist[2] = NULL;
     } else {
         hostlist[1] = NULL;
-        pd->rhost = dp_opt_get_string(hbac_ctx->ipa_options, IPA_HOSTNAME);
-        if (pd->rhost == NULL) {
-            DEBUG(1, ("ipa_hostname not available.\n"));
-            goto fail;
-        }
+        pd->rhost = discard_const_p(char, hostlist[0]);
     }
-    hostlist[2] = NULL;
 
-    req = hbac_get_host_info_send(hbac_ctx, be_req->be_ctx->ev,
-                                  hbac_ctx->offline, hbac_ctx->sdap_ctx,
-                                  be_req->be_ctx->sysdb, hbac_ctx->ldap_basedn,
-                                  hostlist);
-    if (req == NULL) {
+    subreq = hbac_get_host_info_send(hbac_ctx, hbac_ctx,
+                                     hbac_ctx->ldap_basedn,
+                                     hostlist);
+    if (!subreq) {
         DEBUG(1, ("hbac_get_host_info_send failed.\n"));
-        goto fail;
+        return ENOMEM;
     }
 
-    tevent_req_set_callback(req, hbac_get_host_info_done, hbac_ctx);
-    return;
-
-fail:
-    ipa_access_reply(be_req, pam_status);
+    tevent_req_set_callback(subreq, hbac_get_host_info_done, hbac_ctx);
+    return EOK;
 }
 
 static void hbac_get_host_info_done(struct tevent_req *req)
 {
     struct hbac_ctx *hbac_ctx = tevent_req_callback_data(req, struct hbac_ctx);
-    struct be_req *be_req = hbac_ctx->be_req;
     int ret;
     int pam_status = PAM_SYSTEM_ERR;
     const char *ipa_hostname;
     struct hbac_host_info *local_hhi = NULL;
     int i;
 
+    talloc_zfree(hbac_ctx->hbac_host_info);
     ret = hbac_get_host_info_recv(req, hbac_ctx, &hbac_ctx->hbac_host_info);
     talloc_zfree(req);
-    if (ret != EOK) {
-        goto fail;
+
+    if (!hbac_check_step_result(hbac_ctx, ret)) {
+        return;
     }
 
     ipa_hostname = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);
@@ -1935,8 +1884,7 @@ static void hbac_get_host_info_done(struct tevent_req *req)
         ret = EINVAL;
         goto fail;
     }
-    req = hbac_get_rules_send(hbac_ctx, be_req->be_ctx->ev, hbac_ctx->offline,
-                              hbac_ctx->sdap_ctx, be_req->be_ctx->sysdb,
+    req = hbac_get_rules_send(hbac_ctx, hbac_ctx,
                               hbac_ctx->ldap_basedn, local_hhi->dn,
                               local_hhi->memberof);
     if (req == NULL) {
@@ -1948,26 +1896,27 @@ static void hbac_get_host_info_done(struct tevent_req *req)
     return;
 
 fail:
-    ipa_access_reply(be_req, pam_status);
+    ipa_access_reply(hbac_ctx, pam_status);
 }
 
 static void hbac_get_rules_done(struct tevent_req *req)
 {
     struct hbac_ctx *hbac_ctx = tevent_req_callback_data(req, struct hbac_ctx);
-    struct be_req *be_req = hbac_ctx->be_req;
     int ret;
     int pam_status = PAM_SYSTEM_ERR;
 
+    hbac_ctx->hbac_rule_count = 0;
+    talloc_zfree(hbac_ctx->hbac_rule_list);
+
     ret = hbac_get_rules_recv(req, hbac_ctx, &hbac_ctx->hbac_rule_count,
                               &hbac_ctx->hbac_rule_list);
     talloc_zfree(req);
-    if (ret != EOK) {
-        goto failed;
+
+    if (!hbac_check_step_result(hbac_ctx, ret)) {
+        return;
     }
 
-    req = hbac_get_service_data_send(hbac_ctx, be_req->be_ctx->ev,
-                                     hbac_ctx->offline, hbac_ctx->sdap_ctx,
-                                     be_req->be_ctx->sysdb,
+    req = hbac_get_service_data_send(hbac_ctx, hbac_ctx,
                                      hbac_ctx->ldap_basedn);
     if (req == NULL) {
         DEBUG(1, ("hbac_get_service_data_send failed.\n"));
@@ -1978,27 +1927,38 @@ static void hbac_get_rules_done(struct tevent_req *req)
     return;
 
 failed:
-    ipa_access_reply(be_req, pam_status);
+    ipa_access_reply(hbac_ctx, pam_status);
 }
 
 static void hbac_get_service_data_done(struct tevent_req *req)
 {
     struct hbac_ctx *hbac_ctx = tevent_req_callback_data(req, struct hbac_ctx);
     struct pam_data *pd = hbac_ctx->pd;
-    struct be_req *be_req = hbac_ctx->be_req;
     int ret;
     int pam_status = PAM_SYSTEM_ERR;
     bool access_allowed = false;
 
+    hbac_ctx->hbac_services_count = 0;
+    talloc_zfree(hbac_ctx->hbac_services_list);
+
     ret = hbac_get_service_data_recv(req, hbac_ctx,
                                      &hbac_ctx->hbac_services_count,
                                      &hbac_ctx->hbac_services_list);
     talloc_zfree(req);
-    if (ret != EOK) {
-        goto failed;
+
+    if (!hbac_check_step_result(hbac_ctx, ret)) {
+        return;
     }
 
-    ret = hbac_get_user_info(hbac_ctx, be_req->be_ctx,
+    if (hbac_ctx->user_dn) {
+        talloc_free(discard_const_p(TALLOC_CTX, hbac_ctx->user_dn));
+        hbac_ctx->user_dn = 0;
+    }
+
+    hbac_ctx->groups_count = 0;
+    talloc_zfree(hbac_ctx->groups);
+
+    ret = hbac_get_user_info(hbac_ctx, hbac_ctx_be(hbac_ctx),
                              pd->user, &hbac_ctx->user_dn,
                              &hbac_ctx->groups_count, &hbac_ctx->groups);
     if (ret != EOK) {
@@ -2020,5 +1980,5 @@ static void hbac_get_service_data_done(struct tevent_req *req)
     }
 
 failed:
-    ipa_access_reply(be_req, pam_status);
+    ipa_access_reply(hbac_ctx, pam_status);
 }
diff --git a/src/providers/ipa/ipa_access.h b/src/providers/ipa/ipa_access.h
index 514afc00..b43c712f 100644
--- a/src/providers/ipa/ipa_access.h
+++ b/src/providers/ipa/ipa_access.h
@@ -47,6 +47,7 @@ struct ipa_access_ctx {
 
 struct hbac_ctx {
     struct sdap_id_ctx *sdap_ctx;
+    struct sdap_id_op *sdap_op;
     struct dp_option *ipa_options;
     struct time_rules_ctx *tr_ctx;
     struct be_req *be_req;
@@ -58,12 +59,51 @@ struct hbac_ctx {
     const char *user_dn;
     size_t groups_count;
     const char **groups;
-    bool offline;
     char *ldap_basedn;
     struct sysdb_attrs **hbac_services_list;
     size_t hbac_services_count;
 };
 
+/* Get BE context associated with HBAC context */
+static inline struct be_ctx *hbac_ctx_be(struct hbac_ctx *hbac_ctx)
+{
+    struct be_req *req = hbac_ctx != NULL ? hbac_ctx->be_req : NULL;
+    return req != NULL ? req->be_ctx : NULL;
+}
+
+/* Get sysdb associated with HBAC context */
+static inline struct sysdb_ctx *hbac_ctx_sysdb(struct hbac_ctx *hbac_ctx)
+{
+    struct be_ctx *be_ctx = hbac_ctx_be(hbac_ctx);
+    return be_ctx != NULL ? be_ctx->sysdb : NULL;
+}
+
+/* Get tevent context associated with HBAC context */
+static inline struct tevent_context *hbac_ctx_ev(struct hbac_ctx *hbac_ctx)
+{
+    struct be_ctx *be_ctx = hbac_ctx_be(hbac_ctx);
+    return be_ctx != NULL ? be_ctx->ev : NULL;
+}
+
+/* Get sdap_id_ctx associated with HBAC context */
+static inline struct sdap_id_ctx *hbac_ctx_sdap_id_ctx(struct hbac_ctx *hbac_ctx)
+{
+    return hbac_ctx != NULL ? hbac_ctx->sdap_ctx : NULL;
+}
+
+/* Get struct sdap_id_op associated with HBAC context */
+static inline struct sdap_id_op *hbac_ctx_sdap_id_op(struct hbac_ctx *hbac_ctx)
+{
+    return hbac_ctx != NULL ? hbac_ctx->sdap_op : NULL;
+}
+
+/* Check whether the current HBAC request is processed in off-line mode */
+static inline bool hbac_ctx_is_offline(struct hbac_ctx *ctx)
+{
+    return ctx == NULL || ctx->sdap_op == NULL;
+}
+
+
 void ipa_access_handler(struct be_req *be_req);
 
 #endif /* _IPA_ACCESS_H_ */
diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index f3fa610e..3eaa0a13 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -175,10 +175,10 @@ int sssm_ipa_id_init(struct be_ctx *bectx,
         goto done;
     }
 
-    ret = be_add_offline_cb(ctx, bectx, sdap_gsh_disconnect_callback, ctx,
-                            NULL);
+    ret = sdap_id_conn_cache_create(ctx, ctx->be,
+                                    ctx->opts, ctx->service,
+                                    &ctx->conn_cache);
     if (ret != EOK) {
-        DEBUG(1, ("be_add_offline_cb failed.\n"));
         goto done;
     }