This set of patches ends up fixing the initgroups call.
It still uses the slowest possible method, a future improvement is to
use the deref (IPA/DS/OpenLDAP) or the ASQ (AD) controls to reduce the
number of LDAP searches.
Patches 0001 though 0004 are dependencies for 0005
0001: add way to get a string w/o manually parsing the attributes
0002: make function public and move it to sdap.c
0003: this is also needed by the access modules, stores the original
memberof DNs
0004: remove redundant code and at the same time make it easier to use
the generic search function for users and groups retrieval. With this
change it will be possible to reduce further code duplication my
changing the code that searches for users and groups to use the generic
search function (I plan to do this once the patch is accepted)
0005: initgroups call fixups make it work and have specialized code
depending on the schema used (still doesn't fully support nested groups
in AD, but that is not a priority right now)
I have tested it with an IPA 1.2 server and seem to work properly.
Simo.
--
Simo Sorce * Red Hat, Inc * New York