Hi,
The original values of memberOf and the original DN are used in the HBAC
evaluation and should be send to the IPA client for AD users via the
extdom plugin. The attached patches adds those attribute to the response
of of the getorig request. No changes in the extdom plugin are needed.
Since originalMemberOf is a multi-value attribute fill_orig() must be
able to handle multi-value attributes. The first patch adds the needed
changes while the second refactors fill_orig() a bit. To make reviewing
easier I didn't squash them together. The last patch adds the new
attributes to the getorig request.
bye,
Sumit