Bug(s) fixed: 180515

Bug Description: Chain BIND requests with chain on update + global pw policy
Reviewed by: Nathan, Pete (Thanks!)
Fix Description: When using global password policy, we need to chain the
BIND request back to a master so that it can update the pw policy op
attrs in the user's entry and replicate them to all other servers.  The
call to config_get_pw_is_global_policy() is expensive (acquires a lock)
so we delay it as long as possible.
The reason we have to use config_get_pw_is_global_policy() is because the entry distribution plugin interface is poor - we have no way to register an init or start function to get the config, and no way to register a statechange callback to be notified of changes to the global password policy.
Platforms tested: Fedora Core 4
Flag Day: no
Doc impact: no

ldap/servers/plugins/replication/replutil.c

@@ -889,7 +889,6 @@ repl_chain_on_update(Slapi_PBlock *pb, Slapi_DN * target_dn,
 	op_type = slapi_op_get_type(op);
 	if (local_online &&
 		((op_type == SLAPI_OPERATION_SEARCH) ||
-	    (op_type == SLAPI_OPERATION_BIND) ||
 	    (op_type == SLAPI_OPERATION_UNBIND) ||
 	    (op_type == SLAPI_OPERATION_COMPARE))) {
 #ifdef DEBUG_CHAIN_ON_UPDATE
@@ -930,6 +929,19 @@ repl_chain_on_update(Slapi_PBlock *pb, Slapi_DN * target_dn,
 		return local_backend;
 	}
 
+    /* if using global password policy, chain the bind request so that the 
+       master can update and replicate the password policy op attrs */
+	if (op_type == SLAPI_OPERATION_BIND) {
+        extern int config_get_pw_is_global_policy();
+        if (!config_get_pw_is_global_policy()) {
+#ifdef DEBUG_CHAIN_ON_UPDATE
+            slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "repl_chain_on_update: conn=%d op=%d using "
+                            "local backend for local password policy\n", connid, opid);
+#endif
+            return local_backend;
+        }
+    }
+
 	/* all other case (update while not directory manager) :
 	 * or any normal non replicated client operation while local is disabled (import) :
 	 * use the chaining backend