I think I should bring up one piece of the last patch:
+ /* Get the list of original DN attributes the group had in
AD */
+ group_odn_list = sss_ldb_el_to_string_list(tmp_ctx, om);
+ if (group_odn_list == NULL) {
+ ret = EFAULT;
+ goto done;
+ }
+
+ /* Compare the two lists */
+ ret = diff_string_lists(tmp_ctx, discard_const(group_odn_list),
+ sysdb_odn_list, &group_only, NULL, NULL);
I think that using discard_const is usually frowned upon, but here I
think the diff_string_list prototype should be changed to accept a "const
char **" for the two input lists (they are strictly read-only). And I
would prefer to do so in a separate patch.