Ticket #481 - expand nested posix groups

Description: Add ability to populate memberuid dynamically to
reflect nested grouping.

Makefile.am

@@ -299,6 +299,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \
 	$(srcdir)/ldap/schema/50ns-value.ldif \
 	$(srcdir)/ldap/schema/50ns-web.ldif \
 	$(srcdir)/ldap/schema/60pam-plugin.ldif \
+	$(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \
 	$(srcdir)/ldap/schema/60autofs.ldif \
 	$(srcdir)/ldap/schema/60eduperson.ldif \
 	$(srcdir)/ldap/schema/60mozilla.ldif \

Makefile.in

@@ -1527,6 +1527,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \
 	$(srcdir)/ldap/schema/50ns-value.ldif \
 	$(srcdir)/ldap/schema/50ns-web.ldif \
 	$(srcdir)/ldap/schema/60pam-plugin.ldif \
+	$(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \
 	$(srcdir)/ldap/schema/60autofs.ldif \
 	$(srcdir)/ldap/schema/60eduperson.ldif \
 	$(srcdir)/ldap/schema/60mozilla.ldif \

ldap/ldif/50posix-winsync-plugin.ldif

@@ -10,6 +10,7 @@ nsslapd-pluginenabled: off
 nsslapd-plugin-depends-on-type: database
 posixWinsyncMsSFUSchema: false
 posixWinsyncMapMemberUID: true
+posixWinsyncMapNestedGrouping: false
 posixWinsyncCreateMemberOfTask: false
 posixWinsyncLowerCaseUID: false
 nsslapd-pluginprecedence: 25

ldap/schema/60posix-winsync-plugin.ldif

@@ -0,0 +1,44 @@
+#
+# BEGIN COPYRIGHT BLOCK
+# This Program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation; version 2 of the License.
+# 
+# This Program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License along with
+# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+# Place, Suite 330, Boston, MA 02111-1307 USA.
+# 
+# In addition, as a special exception, Red Hat, Inc. gives You the additional
+# right to link the code of this Program with code not covered under the GNU
+# General Public License ("Non-GPL Code") and to distribute linked combinations
+# including the two, subject to the limitations in this paragraph. Non-GPL Code
+# permitted under this exception must only link to the code of this Program
+# through those well defined interfaces identified in the file named EXCEPTION
+# found in the source code files (the "Approved Interfaces"). The files of
+# Non-GPL Code may instantiate templates or use macros or inline functions from
+# the Approved Interfaces without causing the resulting work to be covered by
+# the GNU General Public License. Only Red Hat, Inc. may make changes or
+# additions to the list of Approved Interfaces. You must obey the GNU General
+# Public License in all respects for all of the Program code and other code used
+# in conjunction with the Program except the Non-GPL Code covered by this
+# exception. If you modify this file, you may extend this exception to your
+# version of the file, but you are not obligated to do so. If you do not wish to
+# provide this exception without modification, you must delete this exception
+# statement from your version and license this file solely under the GPL without
+# exception. 
+# 
+#  
+# Copyright (C) 2005 Red Hat, Inc.
+# All rights reserved.
+# END COPYRIGHT BLOCK
+#
+#
+# Schema for representing internal dynamically-generated group members
+#
+dn: cn=schema
+attributeTypes: ( 2.16.840.1.113730.3.1.2141 NAME 'dsOnlyMemberUid' DESC 'Elements from a memberuid attribute created to reflect dynamic group membership' SYNTAX  1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Red Hat Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.326 NAME 'dynamicGroup' DESC 'Group containing internal dynamically-generated members' SUP posixGroup AUXILIARY MAY ( dsOnlyMemberUid ) X-ORIGIN 'Red Hat Directory Server' )

ldap/servers/plugins/posix-winsync/posix-group-func.c

@@ -18,11 +18,14 @@
  $Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $
  */
 #include "slapi-plugin.h"
+#include "slapi-private.h"
 
 #include <string.h>
 #include <nspr.h>
 #include "posix-wsp-ident.h"
 
+#define MAX_RECURSION_DEPTH (5)
+
 Slapi_Value **
 valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
 static PRMonitor *memberuid_operation_lock = 0;
@@ -45,58 +48,100 @@ memberUidLockInit()
     return (memberuid_operation_lock = PR_NewMonitor()) != NULL;
 }
 
+void
+addDynamicGroupIfNecessary(Slapi_Entry *entry, Slapi_Mods *smods) {
+    Slapi_Attr *oc_attr = NULL;
+    Slapi_Value *voc = slapi_value_new();
+
+    slapi_value_init_string(voc, "dynamicGroup");
+    slapi_entry_attr_find(entry, "objectClass", &oc_attr);
+
+    if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
+        if (smods) {
+            slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");
+        }
+        else {
+            smods = slapi_mods_new();
+            slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");
+
+            Slapi_PBlock *mod_pb = slapi_pblock_new();
+            slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,
+                                             posix_winsync_get_plugin_identity(), 0);
+            slapi_modify_internal_pb(mod_pb);
+            slapi_pblock_destroy(mod_pb);
+
+            slapi_mods_free(&smods);
+        }
+    }
+
+    slapi_value_free(&voc);
+}
+
+Slapi_Entry *
+getEntry(const char *udn, char **attrs)
+{
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "getEntry: search %s\n", udn);
+
+    Slapi_DN *udn_sdn = slapi_sdn_new_dn_byval(udn);
+    Slapi_Entry *result = NULL;
+    int rc = slapi_search_internal_get_entry(udn_sdn, attrs, &result, posix_winsync_get_plugin_identity());
+    slapi_sdn_free(&udn_sdn);
+
+    if (rc == 0) {
+        if (result != NULL) {
+            return result; /* Must be freed */
+        }
+        else {
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "getEntry: %s not found\n", udn);
+        }
+    }
+    else {
+        slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
+                        "getEntry: error searching for uid: %d", rc);
+    }
+
+    return NULL;
+}
+
 /* search the user with DN udn and returns uid*/
 char *
 searchUid(const char *udn)
 {
-    Slapi_PBlock *int_search_pb = slapi_pblock_new();
-    Slapi_Entry **entries = NULL;
-    char *attrs[] = { "uid", NULL };
+    char *attrs[] = { "uid", "objectclass", NULL };
+    Slapi_Entry *entry = getEntry(udn,
+                                  /* "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", */
+                                  attrs);
     char *uid = NULL;
 
-    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search Uid: search %s\n", udn);
+    if (entry) {
+        Slapi_Attr *attr = NULL;
+        Slapi_Value *v = NULL;
 
-    slapi_search_internal_set_pb(int_search_pb, udn, LDAP_SCOPE_BASE,
-                                 "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", attrs,
-                                 0 /* attrsonly */, NULL /* controls */, NULL /* uniqueid */,
-                                 posix_winsync_get_plugin_identity(), 0 /* actions */);
-    if (slapi_search_internal_pb(int_search_pb)) {
-        /* get result and log an error */
-        int res = 0;
-        slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_RESULT, &res);
-        slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
-                        "searchUid: error searching for uid: %d", res);
-    } else {
-        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "searchUid: searched %s\n",
-                        udn);
-        slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
-        if (NULL != entries && NULL != entries[0]) {
-            Slapi_Attr *attr = NULL;
-            Slapi_Value *v = NULL;
+        if (slapi_entry_attr_find(entry, "uid", &attr) == 0 && hasObjectClass(entry, "posixAccount")) {
+            slapi_attr_first_value(attr, &v);
+            uid = slapi_ch_strdup(slapi_value_get_string(v));
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "searchUid: return uid %s\n", uid);
+        } else {
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "searchUid: uid in %s not found\n", udn);
+        }
 
-            if (slapi_entry_attr_find(entries[0], "uid", &attr) == 0) {
-                slapi_attr_first_value(attr, &v);
-                uid = slapi_ch_strdup(slapi_value_get_string(v));
-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "searchUid: return uid %s\n", uid);
-                /* slapi_value_free(&v); */
-            } else {
-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "searchUid: uid in %s not found\n", udn);
-            }
-            slapi_free_search_results_internal(int_search_pb);
-            slapi_pblock_destroy(int_search_pb);
-            if (uid && posix_winsync_config_get_lowercase()) {
-                return slapi_dn_ignore_case(uid);
-            }
-            return uid;
+        if (uid && posix_winsync_config_get_lowercase()) {
+            uid = slapi_dn_ignore_case(uid);
         }
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "searchUid: About to free entry\n", udn);
+        
+        slapi_entry_free(entry);
     }
-    slapi_free_search_results_internal(int_search_pb);
-    slapi_pblock_destroy(int_search_pb);
+
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                    "searchUid: posix user %s not found\n", udn);
-    return NULL;
+                    "searchUid: <==\n", udn);
+        
+    return uid;
 }
 
 int
@@ -152,6 +197,36 @@ uid_in_set(const char* uid, char **uids)
     return false;
 }
 
+int
+uid_in_valueset(const char* uid, Slapi_ValueSet *uids)
+{
+    int i;
+    Slapi_Value *v = NULL;
+
+    if (uid == NULL)
+        return false;
+    for (i = slapi_valueset_first_value(uids, &v); i != -1;
+         i = slapi_valueset_next_value(uids, i, &v)) {
+        Slapi_RDN *i_rdn = NULL;
+        char *i_uid = NULL;
+        char *t = NULL;
+
+        const char *uid_i = slapi_value_get_string(v);
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "uid_in_valueset: comp %s %s \n",
+                        uid, uid_i);
+        i_rdn = slapi_rdn_new_dn(uid_i);
+        if (slapi_rdn_get_first(i_rdn, &t, &i_uid) == 1) {
+            if (strncasecmp(uid, i_uid, 256) == 0) {
+                slapi_rdn_free(&i_rdn);
+                return true;
+            }
+        }
+        slapi_rdn_free(&i_rdn);
+    }
+    return false;
+}
+
 /* return 1 if smods already has the given mod - 0 otherwise */
 static int
 smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)
@@ -186,7 +261,7 @@ smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)
 }
 
 int
-isPosixGroup(Slapi_Entry *entry)
+hasObjectClass(Slapi_Entry *entry, const char *objectClass)
 {
     int rc = 0;
     int i;
@@ -200,7 +275,7 @@ isPosixGroup(Slapi_Entry *entry)
     }
 
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                    "add/mod-GroupMembership scan objectclasses\n");
+                    "Scanning objectclasses\n");
 
     for (
         i = slapi_attr_first_value(obj_attr, &value);
@@ -209,22 +284,357 @@ isPosixGroup(Slapi_Entry *entry)
     ) {
         const char *oc = NULL;
         oc = slapi_value_get_string(value);
-        if (strncasecmp(oc, "posixGroup", 11) == 0) {
-            return 1; /* Entry has objectclass posixGroup */
+        if (strcasecmp(oc, objectClass) == 0) {
+            return 1; /* Entry has the desired objectclass */
+        }
+    }
+    
+    return 0; /* Doesn't have desired objectclass */
+}
+
+void
+posix_winsync_foreach_parent(Slapi_Entry *entry, char **attrs, plugin_search_entry_callback callback, void *callback_data)
+{
+    char *cookie = NULL;
+    Slapi_Backend *be = NULL;
+
+    const char *value = slapi_entry_get_ndn(entry);
+    size_t vallen = value ? strlen(value) : 0;
+    char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1);
+    char *filter = slapi_ch_smprintf("(uniqueMember=%s)", escape_filter_value(value, vallen, filter_escaped_value));
+    slapi_ch_free_string(&filter_escaped_value);
+
+    Slapi_PBlock *search_pb = slapi_pblock_new();
+
+    for (be = slapi_get_first_backend(&cookie); be;
+         be = slapi_get_next_backend(cookie)) {
+        const Slapi_DN *base_sdn = slapi_be_getsuffix(be, 0);
+        if (base_sdn == NULL) {
+            continue;
         }
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "posix_winsync_foreach_parent: Searching subtree %s for %s\n",
+                        slapi_sdn_get_dn(base_sdn),
+                        filter);
+        
+        slapi_search_internal_set_pb(search_pb,
+                                     slapi_sdn_get_dn(base_sdn),
+                                     LDAP_SCOPE_SUBTREE,
+                                     filter,
+                                     attrs, 0, NULL, NULL,
+                                     posix_winsync_get_plugin_identity(), 0);
+        slapi_search_internal_callback_pb(search_pb, callback_data, 0, callback, 0);        
+        
+        slapi_pblock_init(search_pb);
     }
 
-    return 0; /* Doesn't have objectclass "posixGroup" */
+    slapi_pblock_destroy(search_pb);
+    slapi_ch_free((void**)&cookie);
+    slapi_ch_free_string(&filter);
 }
 
-int
-modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
+/* Retrieve nested membership from chains of groups.
+ * Muid_vs  in => any preexisting membership list
+ *         out => the union of the input list and the total membership
+ * Muid_nested_vs out => the members of muid_vs "out" that weren't in muid_vs "in"
+ * deletions in => Any elements to NOT consider if members of base_sdn
+ */
+void
+getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, Slapi_ValueSet *muid_nested_vs, Slapi_ValueSet *deletions, const Slapi_DN *base_sdn, int depth)
 {
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "getMembershipFromDownward: ==>\n");
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "getMembershipFromDownward: entry name: %s\n",
+                    slapi_entry_get_dn_const(entry));
+
     int rc = 0;
+    Slapi_Attr *um_attr = NULL; /* Entry attributes uniqueMember */
+    Slapi_Value *uid_value = NULL; /* uniqueMember attribute values */
+
+    if (depth >= MAX_RECURSION_DEPTH) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "getMembershipFromDownward: recursion limit reached: %d\n", depth);
+        return;
+    }
+
+    rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr);
+    if (rc != 0 || um_attr == NULL) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "getMembershipFromDownward end: attribute uniquemember not found\n");
+        return;
+    }
+
+    int i;
+    for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
+         i = slapi_attr_next_value(um_attr, i, &uid_value)) {
+
+        char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL };
+        const char *uid_dn = slapi_value_get_string(uid_value);
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "getMembershipFromDownward: iterating uniqueMember: %s\n",
+                        uid_dn);
+        
+        if (deletions && !slapi_sdn_compare(slapi_entry_get_sdn_const(entry), base_sdn)) {
+            if (slapi_valueset_find(um_attr, deletions, uid_value)) {
+                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                "getMembershipFromDownward: Skipping iteration because of deletion\n");
+
+                continue;
+            }
+        }
+
+        Slapi_Entry *child = getEntry(uid_dn, attrs);
+
+        if (!child) {
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "getMembershipFromDownward end: child not found: %s\n", uid_dn);
+        }
+        else {
+            /* PosixGroups except for the top one are already fully mapped out */
+            if ((!hasObjectClass(entry, "posixGroup") || depth == 0) &&
+                (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup"))) {
+
+                /* Recurse downward */
+                getMembershipFromDownward(child, muid_vs, muid_nested_vs, deletions, base_sdn, depth + 1);
+            }
+
+            if (hasObjectClass(child, "posixAccount")) {
+                Slapi_Attr *uid_attr = NULL;
+                Slapi_Value *v = NULL;
+                if (slapi_entry_attr_find(child, "uid", &uid_attr) == 0) {
+                    slapi_attr_first_value(uid_attr, &v);
+
+                    if (v && !slapi_valueset_find(uid_attr, muid_vs, v)) {                        
+                        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                        "getMembershipFromDownward: adding member: %s\n",
+                                        slapi_value_get_string(v));
+                        slapi_valueset_add_value(muid_vs, v);
+                        slapi_valueset_add_value(muid_nested_vs, v);
+                    }
+                }
+            }
+            slapi_entry_free(child);
+        }
+    }
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "getMembershipFromDownward: <==\n");
+}
+
+struct propogateMembershipUpwardArgs {
+    Slapi_ValueSet *muid_vs;
+    int depth;
+};
+
+/* Forward declaration for next function */
+void propogateMembershipUpward(Slapi_Entry *, Slapi_ValueSet *, int);
+
+int
+propogateMembershipUpwardCallback(Slapi_Entry *child, void *callback_data)
+{
+    struct propogateMembershipUpwardArgs *args = (struct propogateMembershipUpwardArgs *)(callback_data);
+    propogateMembershipUpward(child, args->muid_vs, args->depth);
+    return 0;
+}
+
+void
+propogateMembershipUpward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, int depth)
+{
+    if (depth >= MAX_RECURSION_DEPTH) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "propogateMembershipUpward: recursion limit reached: %d\n", depth);
+        return;
+    }
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateMembershipUpward: ==>\n");
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateMembershipUpward: entry name: %s\n",
+                    slapi_entry_get_dn_const(entry));
+
+    Slapi_ValueSet *muid_here_vs   = NULL;
+    Slapi_ValueSet *muid_upward_vs = NULL;
+
+    /* Get the memberUids at this location, and figure out local changes to memberUid (if any)
+     *  and changes to send upward.
+     */
+    if (depth > 0 && hasObjectClass(entry, "posixGroup")) {
+        int addDynamicGroup = 0;
+        Slapi_Attr *muid_old_attr = NULL;
+        Slapi_ValueSet *muid_old_vs = NULL;
+        int rc = slapi_entry_attr_find(entry, "memberUid", &muid_old_attr);
+        if (rc != 0 || muid_old_attr == NULL) { /* Found no memberUid list, so create  */
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "propogateMembershipUpward: no attribute memberUid\n");
+            
+            /* There's no values from this entry to add */
+            muid_upward_vs = muid_vs;
+            muid_here_vs = muid_vs;
+        }
+        else {
+            /* Eliminate duplicates */
+            muid_upward_vs = slapi_valueset_new();
+            muid_here_vs = slapi_valueset_new();
+
+            slapi_valueset_set_valueset(muid_upward_vs, muid_old_vs);
+
+            slapi_attr_get_valueset(muid_old_attr, &muid_old_vs);
+            int i = 0;
+            Slapi_Value *v = NULL;
+            for (i = slapi_valueset_first_value(muid_vs, &v); i != -1;
+                 i = slapi_valueset_next_value(muid_vs, i, &v)) {
+                
+                if (!slapi_valueset_find(muid_old_attr, muid_old_vs, v)) {
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "propogateMembershipUpward: adding %s to set\n",
+                                    slapi_value_get_string(v));
+
+                    addDynamicGroup = 1;
+                    slapi_valueset_add_value(muid_here_vs, v);
+                    slapi_valueset_add_value(muid_upward_vs, v);
+                }
+            }
+        }
+
+        /* Update this group's membership */
+        slapi_entry_add_valueset(entry, "memberUid", muid_here_vs);
+        if (addDynamicGroup) {
+            addDynamicGroupIfNecessary(entry, NULL);
+            slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_here_vs);
+        }
+    }
+    else {
+        muid_upward_vs = muid_vs;
+    }
+
+    /* Find groups containing this one, recurse
+     */
+    char *attrs[] = {"memberUid", "objectClass", NULL};
+    struct propogateMembershipUpwardArgs data = {muid_upward_vs, depth + 1};
+
+    posix_winsync_foreach_parent(entry, attrs, propogateMembershipUpwardCallback, &data);
+
+/* Cleanup */
+    if (muid_here_vs && muid_here_vs != muid_vs) {
+        slapi_valueset_free(muid_here_vs); muid_here_vs = NULL;
+    }
+    if (muid_upward_vs && muid_upward_vs != muid_vs) {
+        slapi_valueset_free(muid_upward_vs); muid_upward_vs = NULL;
+    }
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateMembershipUpward: <==\n");
+}
+
+struct propogateDeletionsUpwardArgs {
+    const Slapi_DN *base_sdn;
+    Slapi_ValueSet *smod_deluids;
+    Slapi_ValueSet *del_nested_vs;
+    int depth;
+};
+
+/* Forward declaration for next function */
+void propogateDeletionsUpward(Slapi_Entry *, const Slapi_DN *, Slapi_ValueSet*, Slapi_ValueSet *, int);
+
+int
+propogateDeletionsUpwardCallback(Slapi_Entry *entry, void *callback_data)
+{
+    struct propogateDeletionsUpwardArgs *args = (struct propogateDeletionsUpwardArgs *)(callback_data);
+    propogateDeletionsUpward(entry, args->base_sdn, args->smod_deluids, args->del_nested_vs, args->depth);
+}
+
+void
+propogateDeletionsUpward(Slapi_Entry *entry, const Slapi_DN *base_sdn, Slapi_ValueSet *smod_deluids, Slapi_ValueSet *del_nested_vs, int depth)
+{
+    if (smod_deluids == NULL) return;
+
+    if (depth >= MAX_RECURSION_DEPTH) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "propogateDeletionsUpward: recursion limit reached: %d\n", depth);
+        return;
+    }
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateDeletionsUpward: ==>\n");
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateDeletionsUpward: entry name: %s\n",
+                    slapi_entry_get_dn_const(entry));
+
+    char *attrs[] = { "uniqueMember", "memberUid", "objectClass", NULL };
+    struct propogateDeletionsUpwardArgs data = {base_sdn, smod_deluids, del_nested_vs, depth + 1};
+    posix_winsync_foreach_parent(entry, attrs, propogateDeletionsUpwardCallback, &data);
+
+    Slapi_Attr *muid_attr = NULL;
+    int rc = slapi_entry_attr_find(entry, "dsOnlyMemberUid", &muid_attr);
+    
+    if (rc == 0 && muid_attr != NULL) {
+
+        Slapi_ValueSet *muid_vs = slapi_valueset_new();
+        Slapi_ValueSet *muid_nested_vs = slapi_valueset_new();
+        Slapi_ValueSet *muid_deletions_vs = slapi_valueset_new();
+
+        getMembershipFromDownward(entry, muid_vs, muid_nested_vs, smod_deluids, base_sdn, 0);
+
+        int i;
+        Slapi_Value *v;
+        for (i = slapi_attr_first_value(muid_attr, &v); i != -1;
+             i = slapi_attr_next_value(muid_attr, i, &v)) {
+            if (!slapi_valueset_find(muid_attr, muid_vs, v)) {
+                const char *uid = slapi_value_get_string(v);
+                if (depth == 0 && !uid_in_valueset(uid, smod_deluids)) {
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "propogateDeletionsUpward: Adding deletion to modlist: %s\n",
+                                    slapi_value_get_string(v));
+                    slapi_valueset_add_value(del_nested_vs, v);                    
+                }
+                else if (depth > 0) {
+                    slapi_valueset_add_value(muid_deletions_vs, v);                
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "propogateDeletionsUpward: Adding deletion to deletion list: %s\n",
+                                    slapi_value_get_string(v));
+                }
+            }
+        }
+
+        if (depth > 0) {
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "propogateDeletionsUpward: executing deletion list\n");
+
+            Slapi_Mods *smods = slapi_mods_new();
+            slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "memberuid", valueset_get_valuearray(muid_deletions_vs));
+            slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "dsonlymemberuid", valueset_get_valuearray(muid_deletions_vs));
+
+            Slapi_PBlock *mod_pb = slapi_pblock_new();
+            slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,
+                                             posix_winsync_get_plugin_identity(), 0);
+            slapi_modify_internal_pb(mod_pb);
+            slapi_pblock_destroy(mod_pb);
+
+            slapi_mods_free(&smods);
+        }
+
+        slapi_valueset_free(muid_vs); muid_vs = NULL;
+        slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL;
+        slapi_valueset_free(muid_deletions_vs); muid_deletions_vs = NULL;
+    }
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "propogateDeletionsUpward: <==\n");
+}
+
+int
+modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
+{
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: ==>\n");
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: Modding %s\n",
+                    slapi_entry_get_dn_const(entry));
 
-    if (!isPosixGroup(entry)) {
+    int posixGroup = hasObjectClass(entry, "posixGroup");
+
+    if (!(posixGroup || hasObjectClass(entry, "ntGroup"))) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "modGroupMembership end: Not a posixGroup or ntGroup\n");
         return 0;
     }
 
@@ -232,7 +642,7 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
     Slapi_Mod *nextMod = slapi_mod_new();
     int del_mod = 0; /* Bool: was there a delete mod? */
     char **smod_adduids = NULL;
-    char **smod_deluids = NULL;
+    Slapi_ValueSet *smod_deluids = NULL;
 
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                     "modGroupMembership: posixGroup -> look for uniquemember\n");
@@ -243,15 +653,20 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
         if (slapi_attr_types_equivalent(slapi_mod_get_type(smod), "uniqueMember")) {
             struct berval *bv;
 
+            int current_del_mod = SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod));
+            if (current_del_mod) {
+                del_mod = 1;
+            }
+            
             for (bv = slapi_mod_get_first_value(smod); bv;
                  bv = slapi_mod_get_next_value(smod)) {
                 Slapi_Value *sv = slapi_value_new();
 
                 slapi_value_init_berval(sv, bv); /* copies bv_val */
-                if (SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod))) {
-                    del_mod = 1;
-                    slapi_ch_array_add(&smod_deluids,
-                                       slapi_ch_strdup(slapi_value_get_string(sv)));
+                if (current_del_mod) {
+                    if (!smod_deluids) smod_deluids = slapi_valueset_new();
+
+                    slapi_valueset_add_value(smod_deluids, sv);
                     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                                     "modGroupMembership: add to deluids %s\n",
                                     bv->bv_val);
@@ -268,60 +683,67 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
     }
     slapi_mod_free(&nextMod);
 
-    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                    "modGroupMembership: entry is posixGroup\n");
-
-    Slapi_Attr * muid_attr = NULL; /* Entry attributes        */
+    int muid_rc = 0;
+    Slapi_Attr * muid_attr  = NULL; /* Entry attributes        */
+    Slapi_ValueSet *muid_vs = NULL;
     Slapi_Value * uid_value = NULL; /* Attribute values        */
 
-    char **adduids = NULL;
-    char **moduids = NULL;
-    char **deluids = NULL;
-    int doModify = false;
+    Slapi_ValueSet *adduids = slapi_valueset_new();
+    Slapi_ValueSet *add_nested_vs = slapi_valueset_new();
+    Slapi_ValueSet *deluids = slapi_valueset_new();
+    Slapi_ValueSet *del_nested_vs = slapi_valueset_new();
+
+    const Slapi_DN *base_sdn = slapi_entry_get_sdn_const(entry);
+
     int j = 0;
 
     if (del_mod || smod_deluids != NULL) {
         do { /* Create a context to "break" from */
-            Slapi_Attr * mu_attr = NULL; /* Entry attributes        */
-            rc = slapi_entry_attr_find(entry, "memberUid", &mu_attr);
-            if (rc != 0 || mu_attr == NULL) {
-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "modGroupMembership end: attribute memberUid not found\n");
-                break;
-            }
-            /* found attribute uniquemember */
+            muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr);
+
             if (smod_deluids == NULL) { /* deletion of the last value, deletes the Attribut from entry complete, this operation has no value, so we must look by self */
                 Slapi_Attr * um_attr = NULL; /* Entry attributes        */
                 Slapi_Value * uid_dn_value = NULL; /* Attribute values        */
                 int rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr);
+                
                 if (rc != 0 || um_attr == NULL) {
                     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                                     "modGroupMembership end: attribute uniquemember not found\n");
                     break;
                 }
-                /* found attribute uniquemember */
-                /* ...loop for value...    */
-                for (j = slapi_attr_first_value(um_attr, &uid_dn_value); j != -1;
-                     j = slapi_attr_next_value(um_attr, j, &uid_dn_value)) {
-                    slapi_ch_array_add(&smod_deluids,
-                                       slapi_ch_strdup(slapi_value_get_string(uid_dn_value)));
-                }
+
+                slapi_attr_get_valueset(um_attr, &smod_deluids);
             }
-            /* ...loop for value...    */
-            for (j = slapi_attr_first_value(mu_attr, &uid_value); j != -1;
-                 j = slapi_attr_next_value(mu_attr, j, &uid_value)) {
-                /* remove from uniquemember: remove from memberUid also */
-                const char *uid = NULL;
+            if (muid_rc != 0 || muid_attr == NULL) {
                 slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "modGroupMembership: test dellist \n");
-                uid = slapi_value_get_string(uid_value);
-                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "modGroupMembership: test dellist %s\n", uid);
-                if (uid_in_set(uid, smod_deluids)) {
-                    slapi_ch_array_add(&deluids, slapi_ch_strdup(uid));
+                                "modGroupMembership end: attribute memberUid not found\n");
+            }
+            else if (posix_winsync_config_get_mapMemberUid()) {
+                /* ...loop for value...    */
+                for (j = slapi_attr_first_value(muid_attr, &uid_value); j != -1;
+                     j = slapi_attr_next_value(muid_attr, j, &uid_value)) {
+                    /* remove from uniquemember: remove from memberUid also */
+                    const char *uid = NULL;
                     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                    "modGroupMembership: add to dellist %s\n", uid);
-                    doModify = true;
+                                    "modGroupMembership: test dellist \n");
+                    uid = slapi_value_get_string(uid_value);
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "modGroupMembership: test dellist %s\n", uid);
+                    if (uid_in_valueset(uid, smod_deluids)) {
+                        slapi_valueset_add_value(deluids, uid_value);
+                        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                        "modGroupMembership: add to dellist %s\n", uid);
+                    }
+                }
+            }
+            
+            if (posix_winsync_config_get_mapNestedGrouping()) {
+                propogateDeletionsUpward(entry, base_sdn, smod_deluids, del_nested_vs, 0);
+                int i;
+                Slapi_Value *v;
+                for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1;
+                     i = slapi_valueset_next_value(del_nested_vs, i, &v)) {
+                    slapi_valueset_add_value(deluids, v);
                 }
             }
         } while (false);
@@ -331,92 +753,175 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
 
         slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                         "modGroupMembership: posixGroup -> look for uniquemember\n");
-        /* found attribute uniquemember */
-        for (j = 0; smod_adduids[j]; j++) {
-            static char *uid = NULL;
 
-            uid_dn = smod_adduids[j];
-            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                            "modGroupMembership: perform user %s\n", uid_dn);
+        if (muid_rc == 0 && muid_attr == NULL) {
+            muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr);
+        }
+        if (muid_rc == 0 && muid_attr != NULL) {
+            slapi_attr_get_valueset(muid_attr, &muid_vs);
+        }
+        else {
+            muid_vs = slapi_valueset_new();
+        }
 
-            uid = searchUid(uid_dn);
+        if (posix_winsync_config_get_mapMemberUid()) {
+            for (j = 0; smod_adduids[j]; j++) {
+                static char *uid = NULL;
 
-            if (uid == NULL) {
+                uid_dn = smod_adduids[j];
                 slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                "modGroupMembership: uid not found for %s, cannot do anything\n",
-                                uid_dn); /* member on longer on server, do nothing */
-            } else {
-                rc |= slapi_entry_attr_find(entry, "memberUid", &muid_attr);
-                if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create  */
+                                "modGroupMembership: perform user %s\n", uid_dn);
+
+                uid = searchUid(uid_dn);
+
+                if (uid == NULL) {
                     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                                    "modGroupMembership: no attribute memberUid, add with %s \n",
-                                    uid_dn);
-                    slapi_ch_array_add(&adduids, uid);
-                    uid = NULL; /* adduids now owns uid */
-                    doModify = true;
-                } else { /* Found a memberUid list, so modify */
-                    Slapi_ValueSet *vs = NULL;
+                                    "modGroupMembership: uid not found for %s, cannot do anything\n",
+                                    uid_dn); /* member on longer on server, do nothing */
+                } else {
                     Slapi_Value *v = slapi_value_new();
-
                     slapi_value_init_string_passin(v, uid);
-                    slapi_attr_get_valueset(muid_attr, &vs);
-                    if (slapi_valueset_find(muid_attr, vs, v) != NULL) { /* already exist, all ok */
+
+                    if (muid_rc == 0 && muid_attr != NULL &&
+                        slapi_valueset_find(muid_attr, muid_vs, v) != NULL) {
+
                         slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                                         "modGroupMembership: uid found in memberuid list %s nothing to do\n",
                                         uid);
-                    } else {
-                        slapi_ch_array_add(&moduids, uid);
+                    }
+                    else {
+                        slapi_valueset_add_value(adduids, v);
+                        slapi_valueset_add_value(muid_vs, v);
                         slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                                         "modGroupMembership: add to modlist %s\n", uid);
-                        uid = NULL; /* adduids now owns uid */
-                        /* have to clear out v otherwise slapi_value_free will also free uid */
-                        slapi_value_init_berval(v, NULL);
-                        doModify = true;
                     }
+
                     slapi_value_free(&v); /* also frees uid since it was a passin */
-                    slapi_valueset_free(vs); vs = NULL;
                 }
             }
         }
+
+        if (posix_winsync_config_get_mapNestedGrouping()) {
+
+            for (j = 0; smod_adduids[j]; ++j) {
+                char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL };
+                Slapi_Entry *child = getEntry(smod_adduids[j], attrs);
+
+                if (child) {
+                    if (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup")) {
+                        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                        "modGroupMembership: Found mod to add group, adding membership: %s\n",
+                                        smod_adduids[j]);
+                        Slapi_ValueSet *muid_tempnested = slapi_valueset_new();
+                        getMembershipFromDownward(child, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0);
+
+                        slapi_valueset_free(muid_tempnested); muid_tempnested = NULL;
+                    }
+                }
+                else {
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "modGroupMembership: entry not found for dn: %s\n",
+                                    smod_adduids[j]);
+                }
+            }
+
+            getMembershipFromDownward(entry, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0);
+            int i = 0;
+            Slapi_Value *v = NULL;
+            for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1;
+                 i = slapi_valueset_next_value(add_nested_vs, i, &v)) {
+                slapi_valueset_add_value(adduids, v);
+            }
+
+            propogateMembershipUpward(entry, adduids, 0);
+        }
     }
-    if (doModify) {
+    if (posixGroup) {
+        int addDynamicGroup = 0;
         int i;
-        for (i = 0; adduids && adduids[i]; i++) {
-            if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", adduids[i])) {
-                slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", adduids[i]);
+        Slapi_Value *v;
+        for (i = slapi_valueset_first_value(adduids, &v); i != -1;
+             i = slapi_valueset_next_value(adduids, i, &v)){
+            const char *muid = slapi_value_get_string(v);
+            if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", muid)) {
+                *do_modify = 1;
+                slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", muid);
+            }
+        }
+        for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1;
+             i = slapi_valueset_next_value(add_nested_vs, i, &v)) {
+            const char *muid = slapi_value_get_string(v);
+            if (!smods_has_mod(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid)) {
+                addDynamicGroup = 1;
+                *do_modify = 1;
+                slapi_mods_add_string(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid);
             }
         }
-        for (i = 0; moduids && moduids[i]; i++) {
-            if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", moduids[i])) {
-                slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", moduids[i]);
+        for (i = slapi_valueset_first_value(deluids, &v); i != -1;
+             i = slapi_valueset_next_value(deluids, i, &v)){
+            const char *muid = slapi_value_get_string(v);
+            if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", muid)) {
+                *do_modify = 1;
+                slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", muid);
             }
         }
-        for (i = 0; deluids && deluids[i]; i++) {
-            if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", deluids[i])) {
-                slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", deluids[i]);
+        for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1;
+             i = slapi_valueset_next_value(del_nested_vs, i, &v)){
+            const char *muid = slapi_value_get_string(v);
+            if (!smods_has_mod(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid)) {
+                *do_modify = 1;
+                slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid);
             }
         }
+        if (addDynamicGroup) {
+            addDynamicGroupIfNecessary(entry, smods);
+        }
 
         if (slapi_is_loglevel_set(SLAPI_LOG_PLUGIN))
             slapi_mods_dump(smods, "memberUid - mods dump");
-        *do_modify = 1;
         posix_winsync_config_set_MOFTaskCreated();
     }
     slapi_ch_array_free(smod_adduids);
     smod_adduids = NULL;
-    slapi_ch_array_free(adduids);
-    adduids = NULL;
-    slapi_ch_array_free(smod_deluids);
+    if (smod_deluids) slapi_valueset_free(smod_deluids);
     smod_deluids = NULL;
-    slapi_ch_array_free(deluids);
+
+    slapi_valueset_free(adduids);
+    adduids = NULL;
+    slapi_valueset_free(deluids);
     deluids = NULL;
-    slapi_ch_array_free(moduids);
-    moduids = NULL;
+
+    slapi_valueset_free(add_nested_vs); add_nested_vs = NULL;
+    slapi_valueset_free(del_nested_vs); del_nested_vs = NULL;
+
+    if (muid_vs) {
+        slapi_valueset_free(muid_vs); muid_vs = NULL;
+    }
 
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: <==\n");
     return 0;
 }
 
+int
+addUserToGroupMembership(Slapi_Entry *entry)
+{
+    Slapi_Attr *uid_attr = NULL;
+    Slapi_Value *v = NULL;
+    Slapi_ValueSet *muid_vs = slapi_valueset_new();
+
+    if (slapi_entry_attr_find(entry, "uid", &uid_attr) == 0) {
+        slapi_attr_first_value(uid_attr, &v);
+
+        if (v) {
+            slapi_valueset_add_value(muid_vs, v);
+        }
+    }
+
+    propogateMembershipUpward(entry, muid_vs, 0);
+
+    slapi_valueset_free(muid_vs); muid_vs = NULL;
+}
+
 int
 addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
 {
@@ -425,7 +930,11 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
 
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: ==>\n");
 
-    if(!isPosixGroup(entry)) {
+    int posixGroup = hasObjectClass(entry, "posixGroup");
+
+    if(!(posixGroup || hasObjectClass(entry, "ntGroup"))) {
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "addGroupMembership: didn't find posixGroup or ntGroup objectclass\n");
         return 0;
     }
 
@@ -448,34 +957,55 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
     if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create  */
         slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                         "addGroupMembership: no attribute memberUid\n");
+        muid_attr = NULL;
     }
     newvs = slapi_valueset_new();
     /* ...loop for value...    */
-    for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
-         i = slapi_attr_next_value(um_attr, i, &uid_value)) {
-        const char *uid_dn = NULL;
-        static char *uid = NULL;
-        Slapi_Value *v = NULL;
+    if (posix_winsync_config_get_mapMemberUid()) {
+        for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
+             i = slapi_attr_next_value(um_attr, i, &uid_value)) {
+            const char *uid_dn = NULL;
+            static char *uid = NULL;
+            Slapi_Value *v = NULL;
 
-        uid_dn = slapi_value_get_string(uid_value);
-        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                        "addGroupMembership: perform member %s\n", uid_dn);
-        uid = searchUid(uid_dn);
-        if (uid == NULL) {
+            uid_dn = slapi_value_get_string(uid_value);
             slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
-                            "addGroupMembership: uid not found for %s, cannot do anything\n",
-                            uid_dn); /* member on longer on server, do nothing */
-        } else {
-            v = slapi_value_new_string(uid);
-            slapi_ch_free_string(&uid);
-            if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) {
-                slapi_valueset_add_value(newvs, v);
+                            "addGroupMembership: perform member %s\n", uid_dn);
+            uid = searchUid(uid_dn);
+            if (uid == NULL) {
+                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                "addGroupMembership: uid not found for %s, cannot do anything\n",
+                                uid_dn); /* member on longer on server, do nothing */
+            } else {
+                v = slapi_value_new_string(uid);
+                slapi_ch_free_string(&uid);
+                if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) {
+                    slapi_valueset_add_value(newvs, v);
+                }
+                slapi_value_free(&v);
             }
-            slapi_value_free(&v);
         }
     }
-    slapi_entry_add_valueset(entry, "memberUid", newvs);
-    slapi_valueset_free(newvs);
+
+    if (posix_winsync_config_get_mapNestedGrouping()) {
+        Slapi_ValueSet *muid_nested_vs = slapi_valueset_new();
+
+        getMembershipFromDownward(entry, newvs, muid_nested_vs, NULL, NULL, 0);
+        propogateMembershipUpward(entry, newvs, 0);
+
+        if (posixGroup) {
+            addDynamicGroupIfNecessary(entry, NULL);
+            slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_nested_vs);
+        }
+
+        slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL;   
+    }
+
+    if (posixGroup) {
+        slapi_entry_add_valueset(entry, "memberUid", newvs);
+    }
+
+    slapi_valueset_free(newvs); newvs = NULL;
     posix_winsync_config_get_MOFTaskCreated();
 
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: <==\n");

ldap/servers/plugins/posix-winsync/posix-group-task.c

@@ -25,11 +25,17 @@ typedef struct _cb_data
  } posix_group_data_data;
  */
 
+Slapi_Value **
+valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
+
 /* interface function */
 int
 posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode,
     char *returntext, void *arg);
 
+Slapi_Entry *
+getEntry(const char *udn, char **attrs);
+
 static void
 posix_group_task_destructor(Slapi_Task *task);
 static void
@@ -67,6 +73,10 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
 
     *returncode = LDAP_SUCCESS;
 
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: ==>\n");
+
     /* get arg(s) */
     /* default: set replication basedn */
     if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) {
@@ -75,12 +85,18 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
         goto out;
     }
 
-    if ((filter = fetch_attr(e, "filter", "(&(objectclass=posixGroup)(uniquemember=*))")) == NULL) {
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: retrieved basedn: %s\n", dn);
+
+    if ((filter = fetch_attr(e, "filter", "(objectclass=ntGroup)")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: retrieved filter: %s\n", filter);
+
     /* setup our task data */
     mytaskdata = (task_data*) slapi_ch_malloc(sizeof(task_data));
     if (mytaskdata == NULL) {
@@ -91,19 +107,41 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
     mytaskdata->dn = slapi_ch_strdup(dn);
     mytaskdata->filter_str = slapi_ch_strdup(filter);
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: task data allocated\n");
+
     /* allocate new task now */
-    task = slapi_new_task(slapi_entry_get_ndn(e));
+    char * ndn = slapi_entry_get_ndn(e);
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: creating task object: %s\n",
+                    ndn);
+
+    task = slapi_new_task(ndn);
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: task object created\n");
 
     /* register our destructor for cleaning up our private data */
     slapi_task_set_destructor_fn(task, posix_group_task_destructor);
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: task destructor set\n");
+
     /* Stash a pointer to our data in the task */
     slapi_task_set_data(task, mytaskdata);
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: task object initialized\n");
+
     /* start the sample task as a separate thread */
     thread = PR_CreateThread(PR_USER_THREAD, posix_group_fixup_task_thread, (void *) task,
                              PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD, PR_UNJOINABLE_THREAD,
                              SLAPD_DEFAULT_THREAD_STACKSIZE);
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: thread created\n");
+
     if (thread == NULL) {
         slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
                         "unable to create task thread!\n");
@@ -114,7 +152,11 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
         rv = SLAPI_DSE_CALLBACK_OK;
     }
 
-    out: return rv;
+    out: 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "posix_group_task_add: <==\n", filter);
+
+    return rv;
 }
 
 static void
@@ -195,86 +237,172 @@ posix_group_fix_memberuid(char *dn, char *filter_str, void *txn)
 static int
 posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data)
 {
-    int rc = 0;
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "_fix_memberuid ==>\n");
+    cb_data *the_cb_data = (cb_data *) callback_data;
+
+    int rc;
+    Slapi_Attr *muid_attr = NULL;
+    Slapi_Value *v = NULL;
+
+    Slapi_Mods *smods = slapi_mods_new();
+
     char *dn = slapi_entry_get_dn(e);
     Slapi_DN *sdn = slapi_entry_get_sdn(e);
 
-    Slapi_Attr *obj_attr = NULL;
+/* Clean out memberuids and dsonlymemberuids without a valid referant */
+    rc = slapi_entry_attr_find(e, "memberuid", &muid_attr);
+    if (rc == 0 && muid_attr) {
+        Slapi_PBlock *search_pb = slapi_pblock_new();
+
+        Slapi_Attr *dsmuid_attr = NULL;
+        Slapi_ValueSet *dsmuid_vs = NULL;
+
+        char *attrs[] = { "uid", NULL };
+
+        rc = slapi_entry_attr_find(e, "dsonlymemberuid", &dsmuid_attr);
+        if (rc == 0 && dsmuid_attr) {
+            slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs);
+        }
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "_fix_memberuid scan for orphaned memberuids\n");
+
+        int i;
+        for (i = slapi_attr_first_value(muid_attr, &v); i != -1;
+             i = slapi_attr_next_value(muid_attr, i, &v)) {
+            const char *muid = slapi_value_get_string(v);
+
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "_fix_memberuid iterating memberuid: %s\n",
+                            muid);
+
+            size_t vallen = muid ? strlen(muid) : 0;
+            char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1);
+            char *filter = slapi_ch_smprintf("(uid=%s)", escape_filter_value(muid, vallen, filter_escaped_value));
+            slapi_ch_free_string(&filter_escaped_value);
+
+            Slapi_Entry **search_entries = NULL;
+
+            slapi_search_internal_set_pb(search_pb,
+                                         the_cb_data->dn,
+                                         LDAP_SCOPE_SUBTREE,
+                                         filter,
+                                         attrs, 0, NULL, NULL,
+                                         posix_winsync_get_plugin_identity(), 0);
+
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "_fix_memberuid searching %s with filter: %s\n",
+                            the_cb_data->dn, filter);
 
+            rc = slapi_search_internal_pb(search_pb);
+
+            slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &search_entries);
+
+            if (!search_entries || !search_entries[0]) {
+                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                "_fix_memberuid Adding bad memberuid %s\n",
+                                slapi_value_get_string(v));
+
+                slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberuid", slapi_value_get_string(v));
+
+                if (dsmuid_vs && slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
+                    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                    "_fix_memberuid Adding bad dsonlymemberuid %s\n",
+                                    slapi_value_get_string(v));
+
+                    slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsonlymemberuid", slapi_value_get_string(v));
+                }
+            }
+
+            slapi_free_search_results_internal(search_pb);
+            slapi_pblock_init(search_pb);
+            slapi_ch_free_string(&filter);
+        }
+
+        if (dsmuid_vs) {
+            slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL;
+        }
+
+        slapi_pblock_destroy(search_pb); search_pb = NULL;
+    }
+
+    /* Cleanup uniquemembers without a referent, and verify memberuid otherwise */
+    Slapi_Attr *obj_attr = NULL;
     rc = slapi_entry_attr_find(e, "uniquemember", &obj_attr);
-    if (rc == 0) { /* Found uniquemember, so...  */
+    if (rc == 0 && obj_attr) {
+        int fixMembership = 0;
+        Slapi_ValueSet *bad_ums = NULL;
+
         int i;
-        Slapi_Value * value = slapi_value_new(); /* new memberuid Attribute values        */
-        Slapi_Value * uniqval = NULL; /* uniquemeber Attribute values        */
-        Slapi_ValueSet *uids = slapi_valueset_new();
+        Slapi_Value * uniqval = NULL;            /* uniquemeber Attribute values          */
 
         slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                         "_fix_memberuid scan uniquemember, group %s\n", dn);
         for (i = slapi_attr_first_value(obj_attr, &uniqval); i != -1;
              i = slapi_attr_next_value(obj_attr, i, &uniqval)) {
-            const char *member = NULL;
-            char * uid = NULL;
-            member = slapi_value_get_string(uniqval);
-            /* search uid for member (DN) */
-            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search %s\n", member);
-            if ((uid = searchUid(member)) != NULL) {
-                slapi_value_set_string(value, uid);
-                /* add uids ValueSet */
-                slapi_valueset_add_value(uids, value);
+
+            const char *member = slapi_value_get_string(uniqval);
+            char *attrs[] = { "uid", "objectclass", NULL };
+            Slapi_Entry *child = getEntry(member, attrs);
+
+            if (!child) {
+                slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                                "_fix_memberuid orphaned uniquemember found: %s\n", member);
+
+                if (strncasecmp(member, "cn=", 3) == 0) {
+                    fixMembership = 1;
+                }
+                if (!bad_ums) {
+                    bad_ums = slapi_valueset_new();
+                }
+                slapi_valueset_add_value(bad_ums, uniqval);
             }
         }
-        slapi_value_free(&value);
-
-        /* If we found some posix members, replace the existing memberuid attribute
-         * with the found values.  */
-        if (uids && slapi_valueset_count(uids)) {
-            Slapi_PBlock *mod_pb = slapi_pblock_new();
-            Slapi_Value *val = 0;
-            Slapi_Mod *smod;
-            LDAPMod **mods = (LDAPMod **) slapi_ch_malloc(2 * sizeof(LDAPMod *));
-            int hint = 0;
-            cb_data *the_cb_data = (cb_data *) callback_data;
-
-            smod = slapi_mod_new();
-            slapi_mod_init(smod, 0);
-            slapi_mod_set_operation(smod, LDAP_MOD_REPLACE | LDAP_MOD_BVALUES);
-            slapi_mod_set_type(smod, "memberuid");
-
-            /* Loop through all of our values and add them to smod */
-            hint = slapi_valueset_first_value(uids, &val);
-            while (val) {
-                /* this makes a copy of the berval */
-                slapi_mod_add_value(smod, slapi_value_get_berval(val));
-                hint = slapi_valueset_next_value(uids, hint, &val);
-            }
 
-            mods[0] = slapi_mod_get_ldapmod_passout(smod);
-            mods[1] = 0;
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "_fix_memberuid Finishing...\n");
 
-            slapi_modify_internal_set_pb_ext(mod_pb, sdn, mods, 0, 0,
-                                             posix_winsync_get_plugin_identity(), 0);
+        if (fixMembership  && posix_winsync_config_get_mapNestedGrouping()) {
+            Slapi_ValueSet *del_nested_vs = slapi_valueset_new();
 
-            slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn);
-            slapi_modify_internal_pb(mod_pb);
+            slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                            "_fix_memberuid group deleted, recalculating nesting\n");
+            propogateDeletionsUpward(e, sdn, bad_ums, del_nested_vs, 0);
 
-            slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+            slapi_valueset_free(del_nested_vs); del_nested_vs = NULL;
+        }
 
-            ldap_mods_free(mods, 1);
-            slapi_mod_free(&smod);
-            slapi_pblock_destroy(mod_pb);
-        } else {
-            /* No member were found, so remove the memberuid attribute
-             * from this entry. */
-            posix_group_del_memberuid_callback(e, callback_data);
+        if (bad_ums) {
+            slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "uniquemember", valueset_get_valuearray(bad_ums));
+            slapi_valueset_free(bad_ums); bad_ums = NULL;
         }
-        slapi_valueset_free(uids);
     }
+
+    Slapi_PBlock *mod_pb = slapi_pblock_new();
+
+    slapi_modify_internal_set_pb_ext(mod_pb, sdn, slapi_mods_get_ldapmods_passout(smods), 0, 0,
+                                     posix_winsync_get_plugin_identity(), 0);
+
+    slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn);
+    slapi_modify_internal_pb(mod_pb);
+
+    slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+    slapi_pblock_destroy(mod_pb);
+
+    slapi_mods_free(&smods);
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "_fix_memberuid <==\n");
     return rc;
 }
 
 static void
 posix_group_fixup_task_thread(void *arg)
 {
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "_task_thread ==>\n");
+
     Slapi_Task *task = (Slapi_Task *) arg;
     task_data *td = NULL;
     int rc = 0;
@@ -293,11 +421,18 @@ posix_group_fixup_task_thread(void *arg)
 
     /* release the memberOf operation lock */
     memberUidUnlock();
+    
 
     slapi_task_log_notice(task, "posix_group task finished.");
     slapi_task_log_status(task, "posix_group task finished.");
     slapi_task_inc_progress(task);
 
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "_task_thread finishing\n");
+
     /* this will queue the destruction of the task */
     slapi_task_finish(task, rc);
+
+    slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                    "_task_thread <==\n");
 }

ldap/servers/plugins/posix-winsync/posix-winsync-config.c

@@ -142,6 +142,12 @@ posix_winsync_config_get_msSFUSchema()
     return theConfig.mssfuSchema;
 }
 
+PRBool
+posix_winsync_config_get_mapNestedGrouping()
+{
+    return theConfig.mapNestedGrouping;
+}
+
 Slapi_DN *
 posix_winsync_config_get_suffix()
 {
@@ -182,6 +188,7 @@ posix_winsync_config(Slapi_Entry *config_e)
     theConfig.lowercase = PR_FALSE;
     theConfig.createMemberOfTask = PR_FALSE;
     theConfig.MOFTaskCreated = PR_FALSE;
+    theConfig.mapNestedGrouping = PR_FALSE;
 
     posix_winsync_apply_config(NULL, NULL, config_e, &returncode, returntext, NULL);
     /* config DSE must be initialized before we get here */
@@ -224,6 +231,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
     PRBool createMemberOfTask = PR_FALSE;
     PRBool lowercase = PR_FALSE;
     Slapi_Attr *testattr = NULL;
+    PRBool mapNestedGrouping = PR_FALSE;
 
     *returncode = LDAP_UNWILLING_TO_PERFORM; /* be pessimistic */
 
@@ -257,6 +265,13 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
                         "_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_LOWER_CASE,
                         lowercase);
     }
+    /* propogate memberuids in nested grouping */
+    if (!slapi_entry_attr_find(e, POSIX_WINSYNC_MAP_NESTED_GROUPING, &testattr) && (NULL != testattr)) {
+        mapNestedGrouping = slapi_entry_attr_get_bool(e, POSIX_WINSYNC_MAP_NESTED_GROUPING);
+        slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+                        "_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_MAP_NESTED_GROUPING,
+                        mapNestedGrouping);
+    }
     /* if we got here, we have valid values for everything
      set the config entry */
     slapi_lock_mutex(theConfig.lock);
@@ -269,6 +284,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
     theConfig.mapMemberUID = mapMemberUID;
     theConfig.createMemberOfTask = createMemberOfTask;
     theConfig.lowercase = lowercase;
+    theConfig.mapNestedGrouping = mapNestedGrouping;
 
     /* success */
     slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,

ldap/servers/plugins/posix-winsync/posix-winsync.c

@@ -68,7 +68,7 @@
 #include "posix-wsp-ident.h"
 #include "posix-group-func.h"
 
-#define MEMBEROFTASK "memberof task"
+#define MEMBEROFTASK "memberuid task"
 Slapi_Value **
 valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
 void *
@@ -103,6 +103,7 @@ static windows_attribute_map user_mssfu_attribute_map[] =
       { "msSFU30gecos", "gecos" },
       { NULL, NULL } };
 
+/* memberUid must be first element or fixup in pre_ad_mod/add_group is required */
 static windows_attribute_map group_attribute_map[] = { { "memberUid", "memberUid" },
                                                        { "gidNumber", "gidNumber" },
                                                        { NULL, NULL } };
@@ -661,7 +662,34 @@ posix_winsync_pre_ad_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
                 char *ad_type = NULL;
                 int is_present_local;
 
-                slapi_attr_get_valueset(attr, &vs);
+                if (i == 0) { /* memberUid */
+                    Slapi_Attr *dsmuid_attr = NULL;
+                    Slapi_Value *v = NULL;
+                    slapi_entry_attr_find(ds_entry, "dsonlymemberuid", &dsmuid_attr);
+
+                    if (dsmuid_attr) {
+                        Slapi_ValueSet *dsmuid_vs = NULL;
+                        slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs);
+                        if (dsmuid_vs) {
+                            vs = slapi_valueset_new();
+
+                            int j;
+                            for (j = slapi_attr_first_value(attr, &v); j != -1;
+                                 j = slapi_attr_next_value(attr, i, &v)) {
+                                if (!slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
+                                    slapi_valueset_add_value(vs, v);
+                                }
+                            }
+
+                            slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL;
+                        }
+                    }
+                }
+
+                if (!vs) {
+                    slapi_attr_get_valueset(attr, &vs);
+                }
+
                 ad_type = slapi_ch_strdup(attr_map[i].windows_attribute_name);
                 slapi_entry_attr_find(ad_entry, ad_type, &ad_attr);
                 is_present_local = (NULL == ad_attr) ? 0 : 1;
@@ -810,6 +838,12 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
                                           valueset_get_valuearray(oc_vs));
                 slapi_value_free(&oc_nv);
                 slapi_valueset_free(oc_vs);
+
+                if (posix_winsync_config_get_mapNestedGrouping()) {
+                    memberUidLock();
+                    addUserToGroupMembership(ds_entry);
+                    memberUidUnlock();
+                }
             }
         }
         slapi_value_free(&voc);
@@ -897,7 +931,7 @@ posix_winsync_pre_ds_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
     slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
                     "_pre_ds_mod_group_cb present %d modify %d before\n", is_present_local,
                     do_modify_local);
-    if (posix_winsync_config_get_mapMemberUid()) {
+    if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) {
         memberUidLock();
         modGroupMembership(ds_entry, smods, do_modify);
         memberUidUnlock();
@@ -999,6 +1033,13 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
             slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
                             "<-- _pre_ds_add_user_cb -- adding objectclass for new entry failed %d\n",
                             rc);
+        else {
+            if (posix_winsync_config_get_mapNestedGrouping()) {
+                memberUidLock();
+                addUserToGroupMembership(ds_entry);
+                memberUidUnlock();
+            }
+        }
     }
     sync_acct_disable(cbdata, rawentry, ds_entry, ACCT_DISABLE_TO_DS, ds_entry, NULL, NULL);
     slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- _pre_ds_add_user_cb -- end\n");
@@ -1054,14 +1095,14 @@ posix_winsync_pre_ds_add_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
             slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
                             "<-- _pre_ds_add_group_cb -- adding objectclass for new entry failed %d\n",
                             rc);
-        } else {
-            if (posix_winsync_config_get_mapMemberUid()) {
-                memberUidLock();
-                addGroupMembership(ds_entry, ad_entry);
-                memberUidUnlock();
-            }
         }
     }
+    if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) {
+        memberUidLock();
+        addGroupMembership(ds_entry, ad_entry);
+        memberUidUnlock();
+    }
+
     slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
                     "<-- posix_winsync_pre_ds_add_group_cb -- end\n");
 
@@ -1274,7 +1315,7 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap
                     "--> posix_winsync_end_update_cb -- begin %d %d\n",
                     posix_winsync_config_get_MOFTaskCreated(),
                     posix_winsync_config_get_createMOFTask());
-    if (posix_winsync_config_get_MOFTaskCreated() && posix_winsync_config_get_createMOFTask()) {
+    if (1 && posix_winsync_config_get_createMOFTask()) {
         /* add a task to schedule memberof Plugin for fix memebrof attributs */
         Slapi_PBlock *pb = slapi_pblock_new();
         Slapi_Entry *e_task = slapi_entry_alloc();
@@ -1291,13 +1332,24 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap
                             posix_winsync_plugin_name, MEMBEROFTASK);
             return;
         }
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+                        "--> posix_winsync_end_update_cb, init'ing task\n");
+
         slapi_entry_init(e_task, slapi_ch_strdup(dn), NULL);
         slapi_entry_add_string(e_task, "cn", slapi_ch_strdup(posix_winsync_plugin_name));
         slapi_entry_add_string(e_task, "objectClass", "extensibleObject");
         slapi_entry_add_string(e_task, "basedn", slapi_sdn_get_dn(ds_subtree));
 
         slapi_add_entry_internal_set_pb(pb, e_task, NULL, posix_winsync_get_plugin_identity(), 0);
+
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+                        "--> posix_winsync_end_update_cb, adding task\n");
         slapi_add_internal_pb(pb);
+
+        slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+                        "--> posix_winsync_end_update_cb, retrieving return code\n");
         slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
         if (rc != 0) {
             slapi_log_error(SLAPI_LOG_FATAL, posix_winsync_plugin_name,

ldap/servers/plugins/posix-winsync/posix-wsp-ident.h

@@ -17,7 +17,7 @@
 #define POSIX_WINSYNC_MAP_MEMBERUID "posixWinsyncMapMemberUID"
 #define POSIX_WINSYNC_CREATE_MEMBEROFTASK "posixWinsyncCreateMemberOfTask"
 #define POSIX_WINSYNC_LOWER_CASE "posixWinsyncLowerCaseUID"
-
+#define POSIX_WINSYNC_MAP_NESTED_GROUPING "posixWinsyncMapNestedGrouping"
 
 void * posix_winsync_get_plugin_identity();
 
@@ -29,6 +29,7 @@ typedef struct posix_winsync_config_struct {
     PRBool lowercase; /* store the uid in group memberuid in lower case */
     PRBool createMemberOfTask; /* should memberOf Plugin Task run after AD sync */
     PRBool MOFTaskCreated;
+    PRBool mapNestedGrouping;
     Slapi_DN *rep_suffix; /* namingContext in DS of the replicated suffix */  
 } POSIX_WinSync_Config;
 
@@ -42,6 +43,7 @@ Slapi_DN *posix_winsync_config_get_suffix();
 void posix_winsync_config_reset_MOFTaskCreated();
 void posix_winsync_config_set_MOFTaskCreated();
 PRBool posix_winsync_config_get_MOFTaskCreated();
+PRBool posix_winsync_config_get_mapNestedGrouping();
 
 int posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e,
     Slapi_Entry *eAfter, int *returncode, char *returntext,