Mass tree reorganization for IPAv2. To view previous history of files use:

% git log --follow -- <file>

renamed: ipa-server/autogen.sh -> autogen.sh
renamed: ipa-server/ipa-kpasswd/Makefile.am -> daemons/ipa-kpasswd/Makefile.am
renamed: ipa-server/ipa-kpasswd/README -> daemons/ipa-kpasswd/README
renamed: ipa-server/ipa-kpasswd/ipa_kpasswd.c -> daemons/ipa-kpasswd/ipa_kpasswd.c
renamed: ipa-server/ipa-kpasswd/ipa_kpasswd.init -> daemons/ipa-kpasswd/ipa_kpasswd.init
renamed: ipa-server/ipa-slapi-plugins/Makefile.am -> daemons/ipa-slapi-plugins/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/README -> daemons/ipa-slapi-plugins/README
renamed: ipa-server/ipa-slapi-plugins/dna/Makefile.am -> daemons/ipa-slapi-plugins/dna/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif -> daemons/ipa-slapi-plugins/dna/dna-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/dna/dna.c -> daemons/ipa-slapi-plugins/dna/dna.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am -> daemons/ipa-slapi-plugins/ipa-memberof/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof.c -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof.h -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof.h
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof_config.c -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof_config.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/memberof-conf.ldif -> daemons/ipa-slapi-plugins/ipa-memberof/memberof-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am -> daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/README -> daemons/ipa-slapi-plugins/ipa-pwd-extop/README
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c -> daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif -> daemons/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/Makefile.am -> daemons/ipa-slapi-plugins/ipa-winsync/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/README -> daemons/ipa-slapi-plugins/ipa-winsync/README
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync-conf.ldif -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync-config.c -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-config.c
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync.c -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync.c
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync.h -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync.h
renamed: ipa-server/xmlrpc-server/ipa-rewrite.conf -> install/conf/ipa-rewrite.conf
renamed: ipa-server/xmlrpc-server/ipa.conf -> install/conf/ipa.conf
renamed: ipa-server/xmlrpc-server/ssbrowser.html -> install/html/ssbrowser.html
renamed: ipa-server/xmlrpc-server/unauthorized.html -> install/html/unauthorized.html
renamed: ipa-server/ipa-install/share/60ipaconfig.ldif -> install/share/60ipaconfig.ldif
renamed: ipa-server/ipa-install/share/60kerberos.ldif -> install/share/60kerberos.ldif
renamed: ipa-server/ipa-install/share/60radius.ldif -> install/share/60radius.ldif
renamed: ipa-server/ipa-install/share/60samba.ldif -> install/share/60samba.ldif
renamed: ipa-server/ipa-install/share/Makefile.am -> install/share/Makefile.am
renamed: ipa-server/ipa-install/share/bind.named.conf.template -> install/share/bind.named.conf.template
renamed: ipa-server/ipa-install/share/bind.zone.db.template -> install/share/bind.zone.db.template
renamed: ipa-server/ipa-install/share/bootstrap-template.ldif -> install/share/bootstrap-template.ldif
renamed: ipa-server/ipa-install/share/certmap.conf.template -> install/share/certmap.conf.template
renamed: ipa-server/ipa-install/share/default-aci.ldif -> install/share/default-aci.ldif
renamed: ipa-server/ipa-install/share/default-keytypes.ldif -> install/share/default-keytypes.ldif
renamed: ipa-server/ipa-install/share/dna-posix.ldif -> install/share/dna-posix.ldif
renamed: ipa-server/ipa-install/share/encrypted_attribute.ldif -> install/share/encrypted_attribute.ldif
renamed: ipa-server/ipa-install/share/fedora-ds.init.patch -> install/share/fedora-ds.init.patch
renamed: ipa-server/ipa-install/share/indices.ldif -> install/share/indices.ldif
renamed: ipa-server/ipa-install/share/kdc.conf.template -> install/share/kdc.conf.template
renamed: ipa-server/ipa-install/share/kerberos.ldif -> install/share/kerberos.ldif
renamed: ipa-server/ipa-install/share/krb.con.template -> install/share/krb.con.template
renamed: ipa-server/ipa-install/share/krb5.conf.template -> install/share/krb5.conf.template
renamed: ipa-server/ipa-install/share/krb5.ini.template -> install/share/krb5.ini.template
renamed: ipa-server/ipa-install/share/krbrealm.con.template -> install/share/krbrealm.con.template
renamed: ipa-server/ipa-install/share/master-entry.ldif -> install/share/master-entry.ldif
renamed: ipa-server/ipa-install/share/memberof-task.ldif -> install/share/memberof-task.ldif
renamed: ipa-server/ipa-install/share/ntp.conf.server.template -> install/share/ntp.conf.server.template
renamed: ipa-server/ipa-install/share/ntpd.sysconfig.template -> install/share/ntpd.sysconfig.template
renamed: ipa-server/ipa-install/share/preferences.html.template -> install/share/preferences.html.template
renamed: ipa-server/ipa-install/share/referint-conf.ldif -> install/share/referint-conf.ldif
renamed: ipa-server/ipa-install/share/schema_compat.uldif -> install/share/schema_compat.uldif
renamed: ipa-server/ipa-install/share/unique-attributes.ldif -> install/share/unique-attributes.ldif
renamed: ipa-server/ipa-install/Makefile.am -> install/tools/Makefile.am
renamed: ipa-server/ipa-install/README -> install/tools/README
renamed: ipa-server/ipa-compat-manage -> install/tools/ipa-compat-manage
renamed: ipa-server/ipa-fix-CVE-2008-3274 -> install/tools/ipa-fix-CVE-2008-3274
renamed: ipa-server/ipa-ldap-updater -> install/tools/ipa-ldap-updater
renamed: ipa-server/ipa-install/ipa-replica-install -> install/tools/ipa-replica-install
renamed: ipa-server/ipa-install/ipa-replica-manage -> install/tools/ipa-replica-manage
renamed: ipa-server/ipa-install/ipa-replica-prepare -> install/tools/ipa-replica-prepare
renamed: ipa-server/ipa-install/ipa-server-certinstall -> install/tools/ipa-server-certinstall
renamed: ipa-server/ipa-install/ipa-server-install -> install/tools/ipa-server-install
renamed: ipa-server/ipa-upgradeconfig -> install/tools/ipa-upgradeconfig
renamed: ipa-server/ipa-install/ipactl -> install/tools/ipactl
renamed: ipa-server/man/Makefile.am -> install/tools/man/Makefile.am
renamed: ipa-server/man/ipa-compat-manage.1 -> install/tools/man/ipa-compat-manage.1
renamed: ipa-server/man/ipa-ldap-updater.1 -> install/tools/man/ipa-ldap-updater.1
renamed: ipa-server/man/ipa-replica-install.1 -> install/tools/man/ipa-replica-install.1
renamed: ipa-server/man/ipa-replica-manage.1 -> install/tools/man/ipa-replica-manage.1
renamed: ipa-server/man/ipa-replica-prepare.1 -> install/tools/man/ipa-replica-prepare.1
renamed: ipa-server/man/ipa-server-certinstall.1 -> install/tools/man/ipa-server-certinstall.1
renamed: ipa-server/man/ipa-server-install.1 -> install/tools/man/ipa-server-install.1
renamed: ipa-server/man/ipa_kpasswd.8 -> install/tools/man/ipa_kpasswd.8
renamed: ipa-server/man/ipa_webgui.8 -> install/tools/man/ipa_webgui.8
renamed: ipa-server/man/ipactl.8 -> install/tools/man/ipactl.8
renamed: ipa-server/ipa-install/updates/Makefile.am -> install/updates/Makefile.am
renamed: ipa-server/ipa-install/updates/RFC2307bis.update -> install/updates/RFC2307bis.update
renamed: ipa-server/ipa-install/updates/RFC4876.update -> install/updates/RFC4876.update
renamed: ipa-server/ipa-install/updates/indices.update -> install/updates/indices.update
renamed: ipa-server/ipa-install/updates/nss_ldap.update -> install/updates/nss_ldap.update
renamed: ipa-server/ipa-install/updates/replication.update -> install/updates/replication.update
renamed: ipa-server/ipa-install/updates/winsync_index.update -> install/updates/winsync_index.update
renamed: ipa-server/ipaserver/Makefile.am -> ipaserver/install/Makefile.am
renamed: ipa-server/ipaserver/__init__.py -> ipaserver/install/__init__.py
renamed: ipa-server/ipaserver/bindinstance.py -> ipaserver/install/bindinstance.py
renamed: ipa-server/ipaserver/certs.py -> ipaserver/install/certs.py
renamed: ipa-server/ipaserver/dsinstance.py -> ipaserver/install/dsinstance.py
renamed: ipa-server/ipaserver/httpinstance.py -> ipaserver/install/httpinstance.py
renamed: ipa-server/ipaserver/installutils.py -> ipaserver/install/installutils.py
renamed: ipa-server/ipaserver/ipaldap.py -> ipaserver/install/ipaldap.py
renamed: ipa-server/ipaserver/krbinstance.py -> ipaserver/install/krbinstance.py
renamed: ipa-server/ipaserver/ldapupdate.py -> ipaserver/install/ldapupdate.py
renamed: ipa-server/ipaserver/ntpinstance.py -> ipaserver/install/ntpinstance.py
renamed: ipa-server/ipaserver/replication.py -> ipaserver/install/replication.py
renamed: ipa-server/ipaserver/service.py -> ipaserver/install/service.py
renamed: ipa-server/selinux/Makefile -> selinux/Makefile
renamed: ipa-server/selinux/ipa-server-selinux.spec.in -> selinux/ipa-server-selinux.spec.in
renamed: ipa-server/selinux/ipa_kpasswd/ipa_kpasswd.fc -> selinux/ipa_kpasswd/ipa_kpasswd.fc
renamed: ipa-server/selinux/ipa_kpasswd/ipa_kpasswd.te -> selinux/ipa_kpasswd/ipa_kpasswd.te
renamed: ipa-server/selinux/ipa_webgui/ipa_webgui.fc -> selinux/ipa_webgui/ipa_webgui.fc
renamed: ipa-server/selinux/ipa_webgui/ipa_webgui.te -> selinux/ipa_webgui/ipa_webgui.te
renamed: ipa-server/version.m4.in -> version.m4.in

4 files changed, 0 insertions, 4120 deletions

diff --git a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am
deleted file mode 100644
index 540646f06..000000000
--- a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am
+++ /dev/null
@@ -1,46 +0,0 @@
-NULL =
-
-INCLUDES =							\
-	-I.							\
-	-I$(srcdir)						\
-	-DPREFIX=\""$(prefix)"\" 				\
-	-DBINDIR=\""$(bindir)"\"				\
-	-DLIBDIR=\""$(libdir)"\" 				\
-	-DLIBEXECDIR=\""$(libexecdir)"\"			\
-	-DDATADIR=\""$(datadir)"\"				\
-	$(MOZLDAP_CFLAGS)					\
-	$(KRB5_CFLAGS)						\
-	$(SSL_CFLAGS)						\
-	$(WARN_CFLAGS)						\
-	$(NULL)
-
-plugindir = $(libdir)/dirsrv/plugins
-plugin_LTLIBRARIES = 			\
-	libipa_pwd_extop.la		\
-	$(NULL)
-
-libipa_pwd_extop_la_SOURCES = 		\
-	ipa_pwd_extop.c			\
-	$(NULL)
-
-libipa_pwd_extop_la_LDFLAGS = -avoid-version
-
-libipa_pwd_extop_la_LIBADD = 		\
-	$(KRB5_LIBS)			\
-	$(SSL_LIBS)			\
-	$(MOZLDAP_LIBS)			\
-	$(NULL)
-
-appdir = $(IPA_DATA_DIR)
-app_DATA =			\
-	pwd-extop-conf.ldif	\
-	$(NULL)
-
-EXTRA_DIST =			\
-	README			\
-	$(app_DATA)		\
-	$(NULL)
-
-MAINTAINERCLEANFILES =		\
-	*~			\
-	Makefile.in
diff --git a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/README b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/README
deleted file mode 100644
index e69de29bb..000000000
--- a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/README
+++ /dev/null
diff --git a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
deleted file mode 100644
index 24acc8875..000000000
--- a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
+++ /dev/null
@@ -1,4058 +0,0 @@
-/** BEGIN COPYRIGHT BLOCK
- * This Program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; version 2 of the License.
- *
- * This Program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details
- *
- * You should have received a copy of the GNU General Public License along with
- * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * In addition, as a special exception, Red Hat, Inc. gives You the additional
- * right to link the code of this Program with code not covered under the GNU
- * General Public License ("Non-GPL Code") and to distribute linked combinations
- * including the two, subject to the limitations in this paragraph. Non-GPL Code
- * permitted under this exception must only link to the code of this Program
- * through those well defined interfaces identified in the file named EXCEPTION
- * found in the source code files (the "Approved Interfaces"). The files of
- * Non-GPL Code may instantiate templates or use macros or inline functions from
- * the Approved Interfaces without causing the resulting work to be covered by
- * the GNU General Public License. Only Red Hat, Inc. may make changes or
- * additions to the list of Approved Interfaces. You must obey the GNU General
- * Public License in all respects for all of the Program code and other code
- * used in conjunction with the Program except the Non-GPL Code covered by this
- * exception. If you modify this file, you may extend this exception to your
- * version of the file, but you are not obligated to do so. If you do not wish
- * to provide this exception without modification, you must delete this
- * exception statement from your version and license this file solely under the
- * GPL without exception.
- *
- * Authors:
- * Simo Sorce <ssorce@redhat.com>
- *
- * Copyright (C) 2005 Red Hat, Inc.
- * All rights reserved.
- * END COPYRIGHT BLOCK **/
-
-#ifdef HAVE_CONFIG_H
-#  include <config.h>
-#endif
-
-/*
- * Password Modify - LDAP Extended Operation.
- * RFC 3062
- *
- *
- * This plugin implements the "Password Modify - LDAP3"
- * extended operation for LDAP. The plugin function is called by
- * the server if an LDAP client request contains the OID:
- * "1.3.6.1.4.1.4203.1.11.1".
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <unistd.h>
-
-#include <prio.h>
-#include <ssl.h>
-#include <dirsrv/slapi-plugin.h>
-#define KRB5_PRIVATE 1
-#include <krb5.h>
-#include <lber.h>
-#include <time.h>
-#include <iconv.h>
-#include <openssl/des.h>
-#include <openssl/md4.h>
-
-/* Type of connection for this operation;*/
-#define LDAP_EXTOP_PASSMOD_CONN_SECURE
-
-/* Uncomment the following #undef FOR TESTING:
- * allows non-SSL connections to use the password change extended op */
-/* #undef LDAP_EXTOP_PASSMOD_CONN_SECURE */
-
-/* ber tags for the PasswdModifyRequestValue sequence */
-#define LDAP_EXTOP_PASSMOD_TAG_USERID	0x80U
-#define LDAP_EXTOP_PASSMOD_TAG_OLDPWD	0x81U
-#define LDAP_EXTOP_PASSMOD_TAG_NEWPWD	0x82U
-
-/* ber tags for the PasswdModifyResponseValue sequence */
-#define LDAP_EXTOP_PASSMOD_TAG_GENPWD	0x80U
-
-/* OID of the extended operation handled by this plug-in */
-#define EXOP_PASSWD_OID	"1.3.6.1.4.1.4203.1.11.1"
-
-/* OID to retrieve keytabs */
-#define KEYTAB_SET_OID "2.16.840.1.113730.3.8.3.1"
-#define KEYTAB_RET_OID "2.16.840.1.113730.3.8.3.2"
-
-/* krbTicketFlags */
-#define KTF_DISALLOW_POSTDATED        0x00000001
-#define KTF_DISALLOW_FORWARDABLE      0x00000002
-#define KTF_DISALLOW_TGT_BASED        0x00000004
-#define KTF_DISALLOW_RENEWABLE        0x00000008
-#define KTF_DISALLOW_PROXIABLE        0x00000010
-#define KTF_DISALLOW_DUP_SKEY         0x00000020
-#define KTF_DISALLOW_ALL_TIX          0x00000040
-#define KTF_REQUIRES_PRE_AUTH         0x00000080
-#define KTF_REQUIRES_HW_AUTH          0x00000100
-#define KTF_REQUIRES_PWCHANGE         0x00000200
-#define KTF_DISALLOW_SVR              0x00001000
-#define KTF_PWCHANGE_SERVICE          0x00002000
-
-/* These are the default enc:salt types if nothing is defined.
- * TODO: retrieve the configure set of ecntypes either from the
- * kfc.conf file or by synchronizing the the file content into
- * the directory */
-
-/* Salt types */
-#define KRB5_KDB_SALTTYPE_NORMAL        0
-#define KRB5_KDB_SALTTYPE_V4            1
-#define KRB5_KDB_SALTTYPE_NOREALM       2
-#define KRB5_KDB_SALTTYPE_ONLYREALM     3
-#define KRB5_KDB_SALTTYPE_SPECIAL       4
-#define KRB5_KDB_SALTTYPE_AFS3          5
-
-#define KRB5P_SALT_SIZE 16
-
-void krb5int_c_free_keyblock_contents(krb5_context context, register krb5_keyblock *key);
-
-static const char *ipapwd_def_encsalts[] = {
-	"des3-hmac-sha1:normal",
-/*	"arcfour-hmac:normal",
-	"des-hmac-sha1:normal",
-	"des-cbc-md5:normal", */
-	"des-cbc-crc:normal",
-/*	"des-cbc-crc:v4",
-	"des-cbc-crc:afs3", */
-	NULL
-};
-
-struct ipapwd_encsalt {
-	krb5_int32	enc_type;
-	krb5_int32	salt_type;
-};
-
-static const char *ipa_realm_dn;
-static const char *ipa_pwd_config_dn;
-static const char *ipa_changepw_principal_dn;
-
-#define IPAPWD_PLUGIN_NAME   "ipa-pwd-extop"
-#define IPAPWD_FEATURE_DESC  "IPA Password Manager"
-#define IPAPWD_PLUGIN_DESC   "IPA Password Extended Operation plugin"
-
-static Slapi_PluginDesc pdesc = {
-    IPAPWD_FEATURE_DESC,
-    "FreeIPA project",
-    "FreeIPA/1.0",
-    IPAPWD_PLUGIN_DESC
-};
-
-static void *ipapwd_plugin_id;
-
-#define IPA_CHANGETYPE_NORMAL 0
-#define IPA_CHANGETYPE_ADMIN 1
-#define IPA_CHANGETYPE_DSMGR 2
-
-struct ipapwd_krbcfg {
-    krb5_context krbctx;
-    char *realm;
-    krb5_keyblock *kmkey;
-    int num_supp_encsalts;
-    struct ipapwd_encsalt *supp_encsalts;
-    int num_pref_encsalts;
-    struct ipapwd_encsalt *pref_encsalts;
-    char **passsync_mgrs;
-    int num_passsync_mgrs;
-};
-
-static void free_ipapwd_krbcfg(struct ipapwd_krbcfg **cfg)
-{
-    struct ipapwd_krbcfg *c = *cfg;
-
-    if (!c) return;
-
-    krb5_free_default_realm(c->krbctx, c->realm);
-    krb5_free_context(c->krbctx);
-    free(c->kmkey->contents);
-    free(c->kmkey);
-    free(c->supp_encsalts);
-    free(c->pref_encsalts);
-    slapi_ch_array_free(c->passsync_mgrs);
-    free(c);
-    *cfg = NULL;
-};
-
-struct ipapwd_data {
-	Slapi_Entry *target;
-	char *dn;
-	char *password;
-	time_t timeNow;
-	time_t lastPwChange;
-	time_t expireTime;
-	int changetype;
-	int pwHistoryLen;
-};
-
-struct ipapwd_krbkeydata {
-	int32_t type;
-	struct berval value;
-};
-
-struct ipapwd_krbkey {
-	struct ipapwd_krbkeydata *salt;
-	struct ipapwd_krbkeydata *ekey;
-	struct berval s2kparams;
-};
-
-struct ipapwd_keyset {
-	uint16_t major_vno;
-	uint16_t minor_vno;
-	uint32_t kvno;
-	uint32_t mkvno;
-	struct ipapwd_krbkey *keys;
-	int num_keys;
-};
-
-static void ipapwd_keyset_free(struct ipapwd_keyset **pkset)
-{
-	struct ipapwd_keyset *kset = *pkset;
-	int i;
-
-	if (!kset) return;
-
-	for (i = 0; i < kset->num_keys; i++) {
-		if (kset->keys[i].salt) {
-			free(kset->keys[i].salt->value.bv_val);
-			free(kset->keys[i].salt);
-		}
-		if (kset->keys[i].ekey) {
-			free(kset->keys[i].ekey->value.bv_val);
-			free(kset->keys[i].ekey);
-		}
-		free(kset->keys[i].s2kparams.bv_val);
-	}
-	free(kset->keys);
-	free(kset);
-	*pkset = NULL;
-}
-
-static int filter_keys(struct ipapwd_krbcfg *krbcfg, struct ipapwd_keyset *kset)
-{
-	int i, j;
-
-	for (i = 0; i < kset->num_keys; i++) {
-		for (j = 0; j < krbcfg->num_supp_encsalts; j++) {
-			if (kset->keys[i].ekey->type ==
-					krbcfg->supp_encsalts[j].enc_type) {
-				break;
-			}
-		}
-		if (j == krbcfg->num_supp_encsalts) { /* not valid */
-
-			/* free key */
-			if (kset->keys[i].ekey) {
-				free(kset->keys[i].ekey->value.bv_val);
-				free(kset->keys[i].ekey);
-			}
-			if (kset->keys[i].salt) {
-				free(kset->keys[i].salt->value.bv_val);
-				free(kset->keys[i].salt);
-			}
-			free(kset->keys[i].s2kparams.bv_val);
-
-			/* move all remaining keys up by one */
-			kset->num_keys -= 1;
-
-			for (j = i; j < kset->num_keys; j++) {
-				kset->keys[j] = kset->keys[j + 1];
-			}
-
-			/* new key has been moved to this position, make sure
-			 * we do not skip it, by neutralizing next increment */
-			i--;
-		}
-	}
-
-	return 0;
-}
-
-/* Novell key-format scheme:
-
-   KrbKeySet ::= SEQUENCE {
-   attribute-major-vno       [0] UInt16,
-   attribute-minor-vno       [1] UInt16,
-   kvno                      [2] UInt32,
-   mkvno                     [3] UInt32 OPTIONAL,
-   keys                      [4] SEQUENCE OF KrbKey,
-   ...
-   }
-
-   KrbKey ::= SEQUENCE {
-   salt      [0] KrbSalt OPTIONAL,
-   key       [1] EncryptionKey,
-   s2kparams [2] OCTET STRING OPTIONAL,
-    ...
-   }
-
-   KrbSalt ::= SEQUENCE {
-   type      [0] Int32,
-   salt      [1] OCTET STRING OPTIONAL
-   }
-
-   EncryptionKey ::= SEQUENCE {
-   keytype   [0] Int32,
-   keyvalue  [1] OCTET STRING
-   }
-
- */
-
-static struct berval *encode_keys(struct ipapwd_keyset *kset)
-{
-	BerElement *be = NULL;
-	struct berval *bval = NULL;
-	int ret, i;
-
-	be = ber_alloc_t(LBER_USE_DER);
-
-	if (!be) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"memory allocation failed\n");
-		return NULL;
-	}
-
-	ret = ber_printf(be, "{t[i]t[i]t[i]t[i]t[{",
-				(ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 0), kset->major_vno,
-				(ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1), kset->minor_vno,
-				(ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 2), kset->kvno,
-				(ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 3), kset->mkvno,
-				(ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 4));
-	if (ret == -1) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"encoding asn1 vno info failed\n");
-		goto done;
-	}
-
-	for (i = 0; i < kset->num_keys; i++) {
-
-		ret = ber_printf(be, "{");
-		if (ret == -1) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"encoding asn1 EncryptionKey failed\n");
-			goto done;
-		}
-
-		if (kset->keys[i].salt) {
-			ret = ber_printf(be, "t[{t[i]",
-					 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 0),
-					 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 0),
-					 kset->keys[i].salt->type);
-			if ((ret != -1) && kset->keys[i].salt->value.bv_len) {
-				ret = ber_printf(be, "t[o]",
-						 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1),
-						 kset->keys[i].salt->value.bv_val,
-						 kset->keys[i].salt->value.bv_len);
-			}
-			if (ret != -1) {
-				ret = ber_printf(be, "}]");
-			}
-			if (ret == -1) {
-				goto done;
-			}
-		}
-
-		ret = ber_printf(be, "t[{t[i]t[o]}]",
-				 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1),
-				 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 0),
-				 kset->keys[i].ekey->type,
-				 (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1),
-				 kset->keys[i].ekey->value.bv_val,
-				 kset->keys[i].ekey->value.bv_len);
-		if (ret == -1) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"encoding asn1 EncryptionKey failed\n");
-			goto done;
-		}
-
-		/* FIXME: s2kparams not supported yet */
-
-		ret = ber_printf(be, "}");
-		if (ret == -1) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"encoding asn1 EncryptionKey failed\n");
-			goto done;
-		}
-	}
-
-	ret = ber_printf(be, "}]}");
-	if (ret == -1) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"encoding asn1 end of sequences failed\n");
-		goto done;
-	}
-
-	ret = ber_flatten(be, &bval);
-	if (ret == -1) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"flattening asn1 failed\n");
-		goto done;
-	}
-done:
-	ber_free(be, 1);
-
-	return bval;
-}
-
-static int ipapwd_get_cur_kvno(Slapi_Entry *target)
-{
-	Slapi_Attr *krbPrincipalKey = NULL;
-	Slapi_ValueSet *svs;
-	Slapi_Value *sv;
-	BerElement *be = NULL;
-	const struct berval *cbval;
-	ber_tag_t tag, tmp;
-	ber_int_t tkvno;
-	int hint;
-	int kvno;
-	int ret;
-
-	/* retrieve current kvno and and keys */
-	ret = slapi_entry_attr_find(target, "krbPrincipalKey", &krbPrincipalKey);
-	if (ret != 0) {
-		return 0;
-	}
-
-	kvno = 0;
-
-	slapi_attr_get_valueset(krbPrincipalKey, &svs);
-	hint = slapi_valueset_first_value(svs, &sv);
-	while (hint != -1) {
-		cbval = slapi_value_get_berval(sv);
-		if (!cbval) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-					"Error retrieving berval from Slapi_Value\n");
-			goto next;
-		}
-		be = ber_init(cbval);
-		if (!be) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-					"ber_init() failed!\n");
-			goto next;
-		}
-
-		tag = ber_scanf(be, "{xxt[i]", &tmp, &tkvno);
-		if (tag == LBER_ERROR) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-					"Bad OLD key encoding ?!\n");
-			ber_free(be, 1);
-			goto next;
-		}
-
-		if (tkvno > kvno) {
-			kvno = tkvno;
-		}
-
-		ber_free(be, 1);
-next:
-		hint = slapi_valueset_next_value(svs, hint, &sv);
-	}
-
-	return kvno;
-}
-
-static inline void encode_int16(unsigned int val, unsigned char *p)
-{
-	p[1] = (val >>  8) & 0xff;
-	p[0] = (val      ) & 0xff;
-}
-
-static Slapi_Value **encrypt_encode_key(struct ipapwd_krbcfg *krbcfg,
-					struct ipapwd_data *data)
-{
-	krb5_context krbctx;
-	char *krbPrincipalName = NULL;
-	uint32_t krbMaxTicketLife;
-	int kvno, i;
-	int krbTicketFlags;
-	struct berval *bval = NULL;
-	Slapi_Value **svals = NULL;
-	krb5_principal princ;
-	krb5_error_code krberr;
-	krb5_data pwd;
-	struct ipapwd_keyset *kset = NULL;
-
-	krbctx = krbcfg->krbctx;
-
-	svals = (Slapi_Value **)calloc(2, sizeof(Slapi_Value *));
-	if (!svals) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "memory allocation failed\n");
-		return NULL;
-	}
-
-	kvno = ipapwd_get_cur_kvno(data->target);
-
-	krbPrincipalName = slapi_entry_attr_get_charptr(data->target, "krbPrincipalName");
-	if (!krbPrincipalName) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "no krbPrincipalName present in this entry\n");
-		return NULL;
-	}
-
-	krberr = krb5_parse_name(krbctx, krbPrincipalName, &princ);
-	if (krberr) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"krb5_parse_name failed [%s]\n",
-				krb5_get_error_message(krbctx, krberr));
-		goto enc_error;
-	}
-
-	krbMaxTicketLife = slapi_entry_attr_get_uint(data->target, "krbMaxTicketLife");
-	if (krbMaxTicketLife == 0) {
-		/* FIXME: retrieve the default from config (max_life from kdc.conf) */
-		krbMaxTicketLife = 86400; /* just set the default 24h for now */
-	}
-
-	krbTicketFlags = slapi_entry_attr_get_int(data->target, "krbTicketFlags");
-
-	pwd.data = (char *)data->password;
-	pwd.length = strlen(data->password);
-
-	kset = malloc(sizeof(struct ipapwd_keyset));
-	if (!kset) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-		goto enc_error;
-	}
-
-	/* this encoding assumes all keys have the same kvno */
-	/* major-vno = 1 and minor-vno = 1 */
-	kset->major_vno = 1;
-	kset->minor_vno = 1;
-	/* increment kvno (will be 1 if this is a new entry) */
-	kset->kvno = kvno + 1;
-	/* we also assum mkvno is 0 */
-	kset->mkvno = 0;
-
-	kset->num_keys = krbcfg->num_pref_encsalts;
-	kset->keys = calloc(kset->num_keys, sizeof(struct ipapwd_krbkey));
-	if (!kset->keys) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-		goto enc_error;
-	}
-
-	for (i = 0; i < kset->num_keys; i++) {
-		krb5_keyblock key;
-		krb5_data salt;
-		krb5_octet *ptr;
-		krb5_data plain;
-		krb5_enc_data cipher;
-		size_t len;
-		const char *p;
-
-		salt.data = NULL;
-
-		switch (krbcfg->pref_encsalts[i].salt_type) {
-
-		case KRB5_KDB_SALTTYPE_ONLYREALM:
-
-			p = strchr(krbPrincipalName, '@');
-			if (!p) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-						"Invalid principal name, no realm found!\n");
-				goto enc_error;
-			}
-			p++;
-			salt.data = strdup(p);
-			if (!salt.data) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-						"memory allocation failed\n");
-				goto enc_error;
-			}
-			salt.length = strlen(salt.data); /* final \0 omitted on purpose */
-			break;
-
-		case KRB5_KDB_SALTTYPE_NOREALM:
-
-			krberr = krb5_principal2salt_norealm(krbctx, princ, &salt);
-			if (krberr) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-						"krb5_principal2salt failed [%s]\n",
-						krb5_get_error_message(krbctx, krberr));
-				goto enc_error;
-			}
-			break;
-
-		case KRB5_KDB_SALTTYPE_NORMAL:
-
-			/* If pre auth is required we can set a random salt, otherwise
-			 * we have to use a more conservative approach and set the salt
-			 * to be REALMprincipal (the concatenation of REALM and principal
-			 * name without any separator) */
-#if 0
-			if (krbTicketFlags & KTF_REQUIRES_PRE_AUTH) {
-				salt.length = KRB5P_SALT_SIZE;
-				salt.data = malloc(KRB5P_SALT_SIZE);
-				if (!salt.data) {
-					slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-							"memory allocation failed\n");
-					goto enc_error;
-				}
-				krberr = krb5_c_random_make_octets(krbctx, &salt);
-				if (krberr) {
-					slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-							"krb5_c_random_make_octets failed [%s]\n",
-							krb5_get_error_message(krbctx, krberr));
-					goto enc_error;
-				}
-			} else {
-#endif
-				krberr = krb5_principal2salt(krbctx, princ, &salt);
-				if (krberr) {
-					slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-							"krb5_principal2salt failed [%s]\n",
-							krb5_get_error_message(krbctx, krberr));
-					goto enc_error;
-				}
-#if 0
-			}
-#endif
-			break;
-
-		case KRB5_KDB_SALTTYPE_V4:
-			salt.length = 0;
-			break;
-
-		case KRB5_KDB_SALTTYPE_AFS3:
-
-			p = strchr(krbPrincipalName, '@');
-			if (!p) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-						"Invalid principal name, no realm found!\n");
-				goto enc_error;
-			}
-			p++;
-			salt.data = strdup(p);
-			if (!salt.data) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-						"memory allocation failed\n");
-				goto enc_error;
-			}
-			salt.length = SALT_TYPE_AFS_LENGTH; /* special value */
-			break;
-
-		default:
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"Invalid salt type [%d]\n", krbcfg->pref_encsalts[i].salt_type);
-			goto enc_error;
-		}
-
-		/* need to build the key now to manage the AFS salt.length special case */
-		krberr = krb5_c_string_to_key(krbctx, krbcfg->pref_encsalts[i].enc_type, &pwd, &salt, &key);
-		if (krberr) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"krb5_c_string_to_key failed [%s]\n",
-					krb5_get_error_message(krbctx, krberr));
-			krb5_free_data_contents(krbctx, &salt);
-			goto enc_error;
-		}
-		if (salt.length == SALT_TYPE_AFS_LENGTH) {
-			salt.length = strlen(salt.data);
-		}
-
-		krberr = krb5_c_encrypt_length(krbctx, krbcfg->kmkey->enctype, key.length, &len);
-		if (krberr) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"krb5_c_string_to_key failed [%s]\n",
-					krb5_get_error_message(krbctx, krberr));
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			krb5_free_data_contents(krbctx, &salt);
-			goto enc_error;
-		}
-
-		if ((ptr = (krb5_octet *) malloc(2 + len)) == NULL) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"memory allocation failed\n");
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			krb5_free_data_contents(krbctx, &salt);
-			goto enc_error;
-		}
-
-		encode_int16(key.length, ptr);
-
-		plain.length = key.length;
-		plain.data = (char *)key.contents;
-
-		cipher.ciphertext.length = len;
-		cipher.ciphertext.data = (char *)ptr+2;
-
-		krberr = krb5_c_encrypt(krbctx, krbcfg->kmkey, 0, 0, &plain, &cipher);
-		if (krberr) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"krb5_c_encrypt failed [%s]\n",
-					krb5_get_error_message(krbctx, krberr));
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			krb5_free_data_contents(krbctx, &salt);
-			free(ptr);
-			goto enc_error;
-		}
-
-		/* KrbSalt  */
-		kset->keys[i].salt = malloc(sizeof(struct ipapwd_krbkeydata));
-		if (!kset->keys[i].salt) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			free(ptr);
-			goto enc_error;
-		}
-
-		kset->keys[i].salt->type = krbcfg->pref_encsalts[i].salt_type;
-
-		if (salt.length) {
-			kset->keys[i].salt->value.bv_len = salt.length;
-			kset->keys[i].salt->value.bv_val = salt.data;
-		}
-
-		/* EncryptionKey */
-		kset->keys[i].ekey = malloc(sizeof(struct ipapwd_krbkeydata));
-		if (!kset->keys[i].ekey) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			free(ptr);
-			goto enc_error;
-		}
-		kset->keys[i].ekey->type = key.enctype;
-		kset->keys[i].ekey->value.bv_len = len+2;
-		kset->keys[i].ekey->value.bv_val = malloc(len+2);
-		if (!kset->keys[i].ekey->value.bv_val) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-			krb5int_c_free_keyblock_contents(krbctx, &key);
-			free(ptr);
-			goto enc_error;
-		}
-		memcpy(kset->keys[i].ekey->value.bv_val, ptr, len+2);
-
-		/* make sure we free the memory used now that we are done with it */
-		krb5int_c_free_keyblock_contents(krbctx, &key);
-		free(ptr);
-	}
-
-	bval = encode_keys(kset);
-	if (!bval) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"encoding asn1 KrbSalt failed\n");
-		goto enc_error;
-	}
-
-	svals[0] = slapi_value_new_berval(bval);
-	if (!svals[0]) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"Converting berval to Slapi_Value\n");
-		goto enc_error;
-	}
-
-	ipapwd_keyset_free(&kset);
-	krb5_free_principal(krbctx, princ);
-	slapi_ch_free_string(&krbPrincipalName);
-	ber_bvfree(bval);
-	return svals;
-
-enc_error:
-	if (kset) ipapwd_keyset_free(&kset);
-	krb5_free_principal(krbctx, princ);
-	slapi_ch_free_string(&krbPrincipalName);
-	if (bval) ber_bvfree(bval);
-	free(svals);
-	return NULL;
-}
-
-static void ipapwd_free_slapi_value_array(Slapi_Value ***svals)
-{
-    Slapi_Value **sv = *svals;
-    int i;
-
-    if (sv) {
-        for (i = 0; sv[i]; i++) {
-            slapi_value_free(&sv[i]);
-        }
-    }
-
-    slapi_ch_free((void **)sv);
-}
-
-
-struct ntlm_keys {
-	uint8_t lm[16];
-	uint8_t nt[16];
-};
-
-#define KTF_LM_HASH 0x01
-#define KTF_NT_HASH 0x02
-#define KTF_DOS_CHARSET "CP850" /* same default as samba */
-#define KTF_UTF8 "UTF-8"
-#define KTF_UCS2 "UCS-2LE"
-
-static const uint8_t parity_table[128] = {
-	  1,  2,  4,  7,  8, 11, 13, 14, 16, 19, 21, 22, 25, 26, 28, 31,
-	 32, 35, 37, 38, 41, 42, 44, 47, 49, 50, 52, 55, 56, 59, 61, 62,
-	 64, 67, 69, 70, 73, 74, 76, 79, 81, 82, 84, 87, 88, 91, 93, 94,
-	 97, 98,100,103,104,107,109,110,112,115,117,118,121,122,124,127,
-	128,131,133,134,137,138,140,143,145,146,148,151,152,155,157,158,
-	161,162,164,167,168,171,173,174,176,179,181,182,185,186,188,191,
-	193,194,196,199,200,203,205,206,208,211,213,214,217,218,220,223,
-	224,227,229,230,233,234,236,239,241,242,244,247,248,251,253,254};
-
-static void lm_shuffle(uint8_t *out, uint8_t *in)
-{
-	out[0] = parity_table[in[0]>>1];
-	out[1] = parity_table[((in[0]<<6)|(in[1]>>2)) & 0x7F];
-	out[2] = parity_table[((in[1]<<5)|(in[2]>>3)) & 0x7F];
-	out[3] = parity_table[((in[2]<<4)|(in[3]>>4)) & 0x7F];
-	out[4] = parity_table[((in[3]<<3)|(in[4]>>5)) & 0x7F];
-	out[5] = parity_table[((in[4]<<2)|(in[5]>>6)) & 0x7F];
-	out[6] = parity_table[((in[5]<<1)|(in[6]>>7)) & 0x7F];
-	out[7] = parity_table[in[6] & 0x7F];
-}
-
-/* create the lm and nt hashes
-   newPassword: the clear text utf8 password
-   flags: KTF_LM_HASH | KTF_NT_HASH
-*/
-static int encode_ntlm_keys(char *newPasswd, unsigned int flags, struct ntlm_keys *keys)
-{
-	int ret = 0;
-
-	/* do lanman first */
-	if (flags & KTF_LM_HASH) {
-		iconv_t cd;
-		size_t cs, il, ol;
-		char *inc, *outc;
-		char *upperPasswd;
-		char *asciiPasswd;
-		DES_key_schedule schedule;
-		DES_cblock deskey;
-		DES_cblock magic = "KGS!@#$%";
-
-		/* TODO: must store the dos charset somewhere in the directory */
-		cd = iconv_open(KTF_DOS_CHARSET, KTF_UTF8);
-		if (cd == (iconv_t)(-1)) {
-			ret = -1;
-			goto done;
-		}
-
-		/* the lanman password is upper case */
-		upperPasswd = (char *)slapi_utf8StrToUpper((unsigned char *)newPasswd);
-		if (!upperPasswd) {
-			ret = -1;
-			goto done;
-		}
-		il = strlen(upperPasswd);
-
-		/* an ascii string can only be smaller than or equal to an utf8 one */
-		ol = il;
-		if (ol < 14) ol = 14;
-		asciiPasswd = calloc(ol+1, 1);
-		if (!asciiPasswd) {
-			slapi_ch_free_string(&upperPasswd);
-			ret = -1;
-			goto done;
-		}
-
-		inc = upperPasswd;
-		outc = asciiPasswd;
-		cs = iconv(cd, &inc, &il, &outc, &ol);
-		if (cs == -1) {
-			ret = -1;
-			slapi_ch_free_string(&upperPasswd);
-			free(asciiPasswd);
-			iconv_close(cd);
-			goto done;
-		}
-
-		/* done with these */
-		slapi_ch_free_string(&upperPasswd);
-		iconv_close(cd);
-
-		/* we are interested only in the first 14 ASCII chars for lanman */
-		if (strlen(asciiPasswd) > 14) {
-			asciiPasswd[14] = '\0';
-		}
-
-		/* first half */
-		lm_shuffle(deskey, (uint8_t *)asciiPasswd);
-
-		DES_set_key_unchecked(&deskey, &schedule);
-		DES_ecb_encrypt(&magic, (DES_cblock *)keys->lm, &schedule, DES_ENCRYPT);
-
-		/* second half */
-		lm_shuffle(deskey, (uint8_t *)&asciiPasswd[7]);
-
-		DES_set_key_unchecked(&deskey, &schedule);
-		DES_ecb_encrypt(&magic, (DES_cblock *)&(keys->lm[8]), &schedule, DES_ENCRYPT);
-
-		/* done with it */
-		free(asciiPasswd);
-
-	} else {
-		memset(keys->lm, 0, 16);
-	}
-
-	if (flags & KTF_NT_HASH) {
-		iconv_t cd;
-		size_t cs, il, ol, sl;
-		char *inc, *outc;
-		char *ucs2Passwd;
-		MD4_CTX md4ctx;
-
-		/* TODO: must store the dos charset somewhere in the directory */
-		cd = iconv_open(KTF_UCS2, KTF_UTF8);
-		if (cd == (iconv_t)(-1)) {
-			ret = -1;
-			goto done;
-		}
-
-		il = strlen(newPasswd);
-
-		/* an ucs2 string can be at most double than an utf8 one */
-		sl = ol = (il+1)*2;
-		ucs2Passwd = calloc(ol, 1);
-		if (!ucs2Passwd) {
-			ret = -1;
-			goto done;
-		}
-
-		inc = newPasswd;
-		outc = ucs2Passwd;
-		cs = iconv(cd, &inc, &il, &outc, &ol);
-		if (cs == -1) {
-			ret = -1;
-			free(ucs2Passwd);
-			iconv_close(cd);
-			goto done;
-		}
-
-		/* done with it */
-		iconv_close(cd);
-
-		/* get the final ucs2 string length */
-		sl -= ol;
-		/* we are interested only in the first 14 wchars for the nt password */
-		if (sl > 28) {
-			sl = 28;
-		}
-
-		ret = MD4_Init(&md4ctx);
-		if (ret == 0) {
-			ret = -1;
-			free(ucs2Passwd);
-			goto done;
-		}
-		ret = MD4_Update(&md4ctx, ucs2Passwd, sl);
-		if (ret == 0) {
-			ret = -1;
-			free(ucs2Passwd);
-			goto done;
-		}
-		ret = MD4_Final(keys->nt, &md4ctx);
-		if (ret == 0) {
-			ret = -1;
-			free(ucs2Passwd);
-			goto done;
-		}
-
-	} else {
-		memset(keys->nt, 0, 16);
-	}
-
-	ret = 0;
-
-done:
-	return ret;
-}
-
-/* searches the directory and finds the policy closest to the DN */
-/* return 0 on success, -1 on error or if no policy is found */
-static int ipapwd_getPolicy(const char *dn, Slapi_Entry *target, Slapi_Entry **e)
-{
-	const char *krbPwdPolicyReference;
-	const char *pdn;
-	const Slapi_DN *psdn;
-	Slapi_Backend *be;
-	Slapi_PBlock *pb = NULL;
-	char *attrs[] = { "krbMaxPwdLife", "krbMinPwdLife",
-			  "krbPwdMinDiffChars", "krbPwdMinLength",
-			  "krbPwdHistoryLength", NULL};
-	Slapi_Entry **es = NULL;
-	Slapi_Entry *pe = NULL;
-	char **edn;
-	int ret, res, dist, rdnc, scope, i;
-	Slapi_DN *sdn = NULL;
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"ipapwd_getPolicy: Searching policy for [%s]\n", dn);
-
-	sdn = slapi_sdn_new_dn_byref(dn);
-	if (sdn == NULL) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-		                "ipapwd_getPolicy: Out of memory on [%s]\n", dn);
-		ret = -1;
-		goto done;
-	}
-
-	krbPwdPolicyReference = slapi_entry_attr_get_charptr(target, "krbPwdPolicyReference");
-	if (krbPwdPolicyReference) {
-		pdn = krbPwdPolicyReference;
-		scope = LDAP_SCOPE_BASE;
-	} else {
-		/* Find ancestor base DN */
-		be = slapi_be_select(sdn);
-		psdn = slapi_be_getsuffix(be, 0);
-		if (psdn == NULL) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			                "ipapwd_getPolicy: Invalid DN [%s]\n", dn);
-			ret = -1;
-			goto done;
-		}
-		pdn = slapi_sdn_get_dn(psdn);
-		scope = LDAP_SCOPE_SUBTREE;
-	}
-
-	*e = NULL;
-
-	pb = slapi_pblock_new();
-	slapi_search_internal_set_pb (pb,
-		pdn, scope,
-		"(objectClass=krbPwdPolicy)",
-		attrs, 0,
-		NULL, /* Controls */
-		NULL, /* UniqueID */
-		ipapwd_plugin_id,
-		0); /* Flags */
-
-	/* do search the tree */
-	ret = slapi_search_internal_pb(pb);
-	slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &res);
-	if (ret == -1 || res != LDAP_SUCCESS) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_getPolicy: Couldn't find policy, err (%d)\n",
-				res?res:ret);
-		ret = -1;
-		goto done;
-	}
-
-	/* get entries */
-	slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &es);
-	if (!es) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_getPolicy: No entries ?!");
-		ret = -1;
-		goto done;
-	}
-
-	/* count entries */
-	for (i = 0; es[i]; i++) /* count */ ;
-
-	/* if there is only one, return that */
-	if (i == 1) {
-		*e = slapi_entry_dup(es[0]);
-
-		ret = 0;
-		goto done;
-	}
-
-	/* count number of RDNs in DN */
-	edn = ldap_explode_dn(dn, 0);
-	if (!edn) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_getPolicy: ldap_explode_dn(dn) failed ?!");
-		ret = -1;
-		goto done;
-	}
-	for (rdnc = 0; edn[rdnc]; rdnc++) /* count */ ;
-	ldap_value_free(edn);
-
-	pe = NULL;
-	dist = -1;
-
-	/* find closest entry */
-	for (i = 0; es[i]; i++) {
-		const Slapi_DN *esdn;
-
-		esdn = slapi_entry_get_sdn_const(es[i]);
-        if (esdn == NULL) continue;
-		if (0 == slapi_sdn_compare(esdn, sdn)) {
-			pe = es[i];
-			dist = 0;
-			break;
-		}
-		if (slapi_sdn_issuffix(sdn, esdn)) {
-			const char *dn1;
-			char **e1;
-			int c1;
-
-			dn1 = slapi_sdn_get_dn(esdn);
-			if (!dn1) continue;
-			e1 = ldap_explode_dn(dn1, 0);
-			if (!e1) continue;
-			for (c1 = 0; e1[c1]; c1++) /* count */ ;
-			ldap_value_free(e1);
-			if ((dist == -1) ||
-			    ((rdnc - c1) < dist)) {
-				dist = rdnc - c1;
-				pe = es[i];
-			}
-		}
-		if (dist == 0) break; /* found closest */
-	}
-
-	if (pe == NULL) {
-		ret = -1;
-		goto done;
-	}
-
-	*e = slapi_entry_dup(pe);
-	ret = 0;
-done:
-	if (pb) {
-		slapi_free_search_results_internal(pb);
-		slapi_pblock_destroy(pb);
-	}
-	if (sdn) slapi_sdn_free(&sdn);
-	return ret;
-}
-
-#define GENERALIZED_TIME_LENGTH 15
-
-static int ipapwd_sv_pw_cmp(const void *pv1, const void *pv2)
-{
-	const char *pw1 = slapi_value_get_string(*((Slapi_Value **)pv1));
-	const char *pw2 = slapi_value_get_string(*((Slapi_Value **)pv2));
-
-	return strncmp(pw1, pw2, GENERALIZED_TIME_LENGTH);
-}
-
-static Slapi_Value **ipapwd_setPasswordHistory(Slapi_Mods *smods, struct ipapwd_data *data)
-{
-	Slapi_Value **pH = NULL;
-	Slapi_Attr *passwordHistory = NULL;
-	char timestr[GENERALIZED_TIME_LENGTH+1];
-	char *histr, *old_pw;
-	struct tm utctime;
-	int ret, pc;
-
-	old_pw = slapi_entry_attr_get_charptr(data->target, "userPassword");
-	if (!old_pw) {
-		/* no old password to store, just return */
-		return NULL;
-	}
-
-	if (!gmtime_r(&(data->timeNow), &utctime)) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "failed to retrieve current date (buggy gmtime_r ?)\n");
-		return NULL;
-	}
-	strftime(timestr, GENERALIZED_TIME_LENGTH+1, "%Y%m%d%H%M%SZ", &utctime);
-
-	histr = slapi_ch_smprintf("%s%s", timestr, old_pw);
-	if (!histr) {
-		slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-				"ipapwd_checkPassword: Out of Memory\n");
-		return NULL;
-	}
-
-	/* retrieve current history */
-	ret = slapi_entry_attr_find(data->target, "passwordHistory", &passwordHistory);
-	if (ret == 0) {
-		int ret, hint, count, i;
-		const char *pwstr;
-		Slapi_Value *pw;
-
-		hint = 0;
-		count = 0;
-		ret = slapi_attr_get_numvalues(passwordHistory, &count);
-		/* if we have one */
-		if (count > 0 && data->pwHistoryLen > 0) {
-			pH = calloc(count + 2, sizeof(Slapi_Value *));
-			if (!pH) {
-				slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-						"ipapwd_checkPassword: Out of Memory\n");
-				free(histr);
-				return NULL;
-			}
-
-			i = 0;
-			hint = slapi_attr_first_value(passwordHistory, &pw);
-			while (hint != -1) {
-				pwstr = slapi_value_get_string(pw);
-				/* if shorter than GENERALIZED_TIME_LENGTH, it
-				 * is garbage, we never set timeless entries */
-				if (pwstr &&
-				    (strlen(pwstr) > GENERALIZED_TIME_LENGTH)) {
-					pH[i] = pw;
-					i++;
-				}
-				hint = slapi_attr_next_value(passwordHistory, hint, &pw);
-			}
-
-			qsort(pH, i, sizeof(Slapi_Value *), ipapwd_sv_pw_cmp);
-
-			if (i >= data->pwHistoryLen) {
-				i = data->pwHistoryLen;
-				pH[i] = NULL;
-				i--;
-			}
-
-			pc = i;
-
-			/* copy only interesting entries */
-			for (i = 0; i < pc; i++) {
-				pH[i] = slapi_value_dup(pH[i]);
-				if (pH[i] == NULL) {
-					slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-							"ipapwd_checkPassword: Out of Memory\n");
-					while (i) {
-						i--;
-						slapi_value_free(&pH[i]);
-					}
-					free(pH);
-					free(histr);
-					return NULL;
-				}
-			}
-		}
-	}
-
-	if (pH == NULL) {
-		pH = calloc(2, sizeof(Slapi_Value *));
-		if (!pH) {
-			slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-					"ipapwd_checkPassword: Out of Memory\n");
-			free(histr);
-			return NULL;
-		}
-		pc = 0;
-	}
-
-	/* add new history value */
-	pH[pc] = slapi_value_new_string(histr);
-
-	free(histr);
-
-	return pH;
-}
-
-static Slapi_Value *ipapwd_strip_pw_date(Slapi_Value *pw)
-{
-	const char *pwstr;
-
-	pwstr = slapi_value_get_string(pw);
-	return slapi_value_new_string(&pwstr[GENERALIZED_TIME_LENGTH]);
-}
-
-#define IPAPWD_POLICY_MASK 0x0FF
-#define IPAPWD_POLICY_ERROR 0x100
-#define IPAPWD_POLICY_OK 0
-
-/* 90 days default pwd max lifetime */
-#define IPAPWD_DEFAULT_PWDLIFE (90 * 24 *3600)
-#define IPAPWD_DEFAULT_MINLEN 0
-
-/* check password strenght and history */
-static int ipapwd_CheckPolicy(struct ipapwd_data *data)
-{
-	char *krbPrincipalExpiration = NULL;
-	char *krbLastPwdChange = NULL;
-	char *krbPasswordExpiration = NULL;
-	int krbMaxPwdLife = IPAPWD_DEFAULT_PWDLIFE;
-	int krbPwdMinLength = IPAPWD_DEFAULT_MINLEN;
-	int krbPwdMinDiffChars = 0;
-	int krbMinPwdLife = 0;
-	int pwdCharLen = 0;
-	Slapi_Entry *policy = NULL;
-	Slapi_Attr *passwordHistory = NULL;
-	struct tm tm;
-	int tmp, ret;
-	char *old_pw;
-
-	/* check account is not expired. Ignore unixtime = 0 (Jan 1 1970) */
-	krbPrincipalExpiration = slapi_entry_attr_get_charptr(data->target, "krbPrincipalExpiration");
-	if (krbPrincipalExpiration &&
-	    (strcasecmp("19700101000000Z", krbPrincipalExpiration) != 0)) {
-		/* if expiration date is set check it */
-		memset(&tm, 0, sizeof(struct tm));
-		ret = sscanf(krbPrincipalExpiration,
-			     "%04u%02u%02u%02u%02u%02u",
-			     &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
-			     &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
-
-		if (ret == 6) {
-			tm.tm_year -= 1900;
-			tm.tm_mon -= 1;
-
-			if (data->timeNow > timegm(&tm)) {
-				slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "Account Expired");
-				return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_PWDMODNOTALLOWED;
-			}
-		}
-		/* FIXME: else error out ? */
-	}
-	slapi_ch_free_string(&krbPrincipalExpiration);
-
-	/* find the entry with the password policy */
-	ret = ipapwd_getPolicy(data->dn, data->target, &policy);
-	if (ret) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "No password policy");
-		goto no_policy;
-	}
-
-	/* Retrieve Max History Len */
-	data->pwHistoryLen = slapi_entry_attr_get_int(policy, "krbPwdHistoryLength");
-
-	if (data->changetype != IPA_CHANGETYPE_NORMAL) {
-		/* We must skip policy checks (Admin change) but
-		 * force a password change on the next login.
-		 * But not if Directory Manager */
-		if (data->changetype == IPA_CHANGETYPE_ADMIN) {
-			data->expireTime = data->timeNow;
-		}
-
-		/* skip policy checks */
-		slapi_entry_free(policy);
-		goto no_policy;
-	}
-
-	/* first of all check current password, if any */
-	old_pw = slapi_entry_attr_get_charptr(data->target, "userPassword");
-	if (old_pw) {
-		Slapi_Value *cpw[2] = {NULL, NULL};
-		Slapi_Value *pw;
-
-		cpw[0] = slapi_value_new_string(old_pw);
-		pw = slapi_value_new_string(data->password);
-		if (!pw) {
-			slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-					"ipapwd_checkPassword: Out of Memory\n");
-			slapi_entry_free(policy);
-			slapi_ch_free_string(&old_pw);
-			slapi_value_free(&cpw[0]);
-			slapi_value_free(&pw);
-			return LDAP_OPERATIONS_ERROR;
-		}
-
-		ret = slapi_pw_find_sv(cpw, pw);
-		slapi_ch_free_string(&old_pw);
-		slapi_value_free(&cpw[0]);
-		slapi_value_free(&pw);
-
-		if (ret == 0) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_checkPassword: Password in history\n");
-			slapi_entry_free(policy);
-			return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_PWDINHISTORY;
-		}
-	}
-
-	krbPasswordExpiration = slapi_entry_attr_get_charptr(data->target, "krbPasswordExpiration");
-	krbLastPwdChange = slapi_entry_attr_get_charptr(data->target, "krbLastPwdChange");
-	/* if no previous change, it means this is probably a new account
-	 * or imported, log and just ignore */
-	if (krbLastPwdChange) {
-
-		memset(&tm, 0, sizeof(struct tm));
-		ret = sscanf(krbLastPwdChange,
-			     "%04u%02u%02u%02u%02u%02u",
-			     &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
-			     &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
-
-		if (ret == 6) {
-			tm.tm_year -= 1900;
-			tm.tm_mon -= 1;
-			data->lastPwChange = timegm(&tm);
-		}
-		/* FIXME: *else* report an error ? */
-	} else {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"Warning: Last Password Change Time is not available");
-	}
-
-	/* Check min age */
-	krbMinPwdLife = slapi_entry_attr_get_int(policy, "krbMinPwdLife");
-	/* if no default then treat it as no limit */
-	if (krbMinPwdLife != 0) {
-
-		/* check for reset cases */
-		if (krbLastPwdChange == NULL ||
-                    ((krbPasswordExpiration != NULL) &&
-		     strcmp(krbPasswordExpiration, krbLastPwdChange) == 0)) {
-			/* Expiration and last change time are the same or
-			 * missing this happens only when a password is reset
-			 * by an admin or the account is new or no expiration
-			 * policy is set, PASS */
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_checkPolicy: Ignore krbMinPwdLife Expiration, not enough info\n");
-
-		} else if (data->timeNow < data->lastPwChange + krbMinPwdLife) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_checkPolicy: Too soon to change password\n");
-			slapi_entry_free(policy);
-			slapi_ch_free_string(&krbPasswordExpiration);
-			slapi_ch_free_string(&krbLastPwdChange);
-			return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_PWDTOOYOUNG;
-		}
-	}
-
-	/* free strings or we leak them */
-	slapi_ch_free_string(&krbPasswordExpiration);
-	slapi_ch_free_string(&krbLastPwdChange);
-
-	/* Retrieve min length */
-	tmp = slapi_entry_attr_get_int(policy, "krbPwdMinLength");
-	if (tmp != 0) {
-		krbPwdMinLength = tmp;
-	}
-
-	/* check complexity */
-	/* FIXME: this code is partially based on Directory Server code,
-	 *        the plan is to merge this code later making it available
-	 *        trough a pulic DS API for slapi plugins */
-	krbPwdMinDiffChars = slapi_entry_attr_get_int(policy, "krbPwdMinDiffChars");
-	if (krbPwdMinDiffChars != 0) {
-		int num_digits = 0;
-		int num_alphas = 0;
-		int num_uppers = 0;
-		int num_lowers = 0;
-		int num_specials = 0;
-		int num_8bit = 0;
-		int num_repeated = 0;
-		int max_repeated = 0;
-		int num_categories = 0;
-		char *p, *pwd;
-
-		pwd = strdup(data->password);
-
-		/* check character types */
-		p = pwd;
-		while ( p && *p )
-		{
-			if ( ldap_utf8isdigit( p ) ) {
-				num_digits++;
-			} else if ( ldap_utf8isalpha( p ) ) {
-				num_alphas++;
-				if ( slapi_utf8isLower( (unsigned char *)p ) ) {
-					num_lowers++;
-				} else {
-					num_uppers++;
-				}
-			} else {
-				/* check if this is an 8-bit char */
-				if ( *p & 128 ) {
-					num_8bit++;
-				} else {
-					num_specials++;
-				}
-			}
-
-			/* check for repeating characters. If this is the
-			   first char of the password, no need to check */
-			if ( pwd != p ) {
-				int len = ldap_utf8len( p );
-				char *prev_p = ldap_utf8prev( p );
-
-				if ( len == ldap_utf8len( prev_p ) )
-				{
-					if ( memcmp( p, prev_p, len ) == 0 )
-                                	{
-						num_repeated++;
-						if ( max_repeated < num_repeated ) {
-							max_repeated = num_repeated;
-						}
-					} else {
-						num_repeated = 0;
-					}
-				} else {
-					num_repeated = 0;
-				}
-			}
-
-			p = ldap_utf8next( p );
-		}
-
-		free(pwd);
-		p = pwd = NULL;
-
-		/* tally up the number of character categories */
-		if ( num_digits > 0 )
-			++num_categories;
-		if ( num_uppers > 0 )
-			++num_categories;
-		if ( num_lowers > 0 )
-			++num_categories;
-		if ( num_specials > 0 )
-			++num_categories;
-		if ( num_8bit > 0 )
-			++num_categories;
-
-		/* FIXME: the kerberos plicy schema does not define separated threshold values,
-		 *        so just treat anything as a category, we will fix this when we merge
-		 *        with DS policies */
-
-		if (max_repeated > 1)
-			--num_categories;
-
-		if (num_categories < krbPwdMinDiffChars) {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_checkPassword: Password not complex enough\n");
-			slapi_entry_free(policy);
-			return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_INVALIDPWDSYNTAX;
-		}
-	}
-
-	/* Check password history */
-	ret = slapi_entry_attr_find(data->target, "passwordHistory", &passwordHistory);
-	if (ret == 0) {
-		int ret, hint, count, i, j;
-		const char *pwstr;
-		Slapi_Value **pH;
-		Slapi_Value *pw;
-
-		hint = 0;
-		count = 0;
-		ret = slapi_attr_get_numvalues(passwordHistory, &count);
-		/* check history only if we have one */
-		if (count > 0 && data->pwHistoryLen > 0) {
-			pH = calloc(count + 2, sizeof(Slapi_Value *));
-			if (!pH) {
-				slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-						"ipapwd_checkPassword: Out of Memory\n");
-				slapi_entry_free(policy);
-				return LDAP_OPERATIONS_ERROR;
-			}
-
-			i = 0;
-			hint = slapi_attr_first_value(passwordHistory, &pw);
-			while (hint != -1) {
-				pwstr = slapi_value_get_string(pw);
-				/* if shorter than GENERALIZED_TIME_LENGTH, it
-				 * is garbage, we never set timeless entries */
-				if (pwstr &&
-				    (strlen(pwstr) > GENERALIZED_TIME_LENGTH)) {
-					pH[i] = pw;
-					i++;
-				}
-				hint = slapi_attr_next_value(passwordHistory, hint, &pw);
-			}
-
-			qsort(pH, i, sizeof(Slapi_Value *), ipapwd_sv_pw_cmp);
-
-			if (i > data->pwHistoryLen) {
-				i = data->pwHistoryLen;
-				pH[i] = NULL;
-			}
-
-			for (j = 0; pH[j]; j++) {
-				pH[j] = ipapwd_strip_pw_date(pH[j]);
-			}
-
-			pw = slapi_value_new_string(data->password);
-			if (!pw) {
-				slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-						"ipapwd_checkPassword: Out of Memory\n");
-				slapi_entry_free(policy);
-				free(pH);
-				return LDAP_OPERATIONS_ERROR;
-			}
-
-			ret = slapi_pw_find_sv(pH, pw);
-
-			for (j = 0; pH[j]; j++) {
-				slapi_value_free(&pH[j]);
-			}
-			slapi_value_free(&pw);
-			free(pH);
-
-			if (ret == 0) {
-				slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-					"ipapwd_checkPassword: Password in history\n");
-				slapi_entry_free(policy);
-				return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_PWDINHISTORY;
-			}
-		}
-	}
-
-	/* Calculate max age */
-	tmp = slapi_entry_attr_get_int(policy, "krbMaxPwdLife");
-	if (tmp != 0) {
-		krbMaxPwdLife = tmp;
-	}
-
-	slapi_entry_free(policy);
-
-no_policy:
-
-	/* check min lenght */
-	pwdCharLen = ldap_utf8characters(data->password);
-
-	if (pwdCharLen < krbPwdMinLength) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"ipapwd_checkPassword: Password too short\n");
-		return IPAPWD_POLICY_ERROR | LDAP_PWPOLICY_PWDTOOSHORT;
-	}
-
-	if (data->expireTime == 0) {
-		data->expireTime = data->timeNow + krbMaxPwdLife;
-	}
-
-	return IPAPWD_POLICY_OK;
-}
-
-
-/* Searches the dn in directory,
- *  If found	 : fills in slapi_entry structure and returns 0
- *  If NOT found : returns the search result as LDAP_NO_SUCH_OBJECT
- */
-static int ipapwd_getEntry(const char *dn, Slapi_Entry **e2, char **attrlist)
-{
-	Slapi_DN *sdn;
-	int search_result = 0;
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "=> ipapwd_getEntry\n");
-
-	sdn = slapi_sdn_new_dn_byref(dn);
-	if ((search_result = slapi_search_internal_get_entry( sdn, attrlist, e2,
- 					ipapwd_plugin_id)) != LDAP_SUCCESS ){
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"ipapwd_getEntry: No such entry-(%s), err (%d)\n",
-				dn, search_result);
-	}
-
-	slapi_sdn_free( &sdn );
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"<= ipapwd_getEntry: %d\n", search_result);
-	return search_result;
-}
-
-
-/* Construct Mods pblock and perform the modify operation
- * Sets result of operation in SLAPI_PLUGIN_INTOP_RESULT
- */
-static int ipapwd_apply_mods(const char *dn, Slapi_Mods *mods)
-{
-	Slapi_PBlock *pb;
-	int ret;
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "=> ipapwd_apply_mods\n");
-
-	if (!mods || (slapi_mods_get_num_mods(mods) == 0)) {
-		return -1;
-	}
-
-	pb = slapi_pblock_new();
-	slapi_modify_internal_set_pb (pb, dn,
-		slapi_mods_get_ldapmods_byref(mods),
-		NULL, /* Controls */
-		NULL, /* UniqueID */
-		ipapwd_plugin_id, /* PluginID */
-		0); /* Flags */
-
-	ret = slapi_modify_internal_pb (pb);
-	if (ret) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"WARNING: modify error %d on entry '%s'\n",
-			ret, dn);
-	} else {
-
-		slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret);
-
-		if (ret != LDAP_SUCCESS){
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"WARNING: modify error %d on entry '%s'\n",
-				ret, dn);
-		} else {
-			slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"<= ipapwd_apply_mods: Successful\n");
-		}
-	}
-
-	slapi_pblock_destroy(pb);
-
-	return ret;
-}
-
-/* ascii hex output of bytes in "in"
- * out len is 32 (preallocated)
- * in len is 16 */
-static const char hexchars[] = "0123456789ABCDEF";
-static void hexbuf(char *out, const uint8_t *in)
-{
-	int i;
-
-	for (i = 0; i < 16; i++) {
-		out[i*2] = hexchars[in[i] >> 4];
-		out[i*2+1] = hexchars[in[i] & 0x0f];
-	}
-}
-
-/* Modify the Password attributes of the entry */
-static int ipapwd_SetPassword(struct ipapwd_krbcfg *krbcfg,
-				struct ipapwd_data *data)
-{
-	int ret = 0, i = 0;
-	Slapi_Mods *smods;
-	Slapi_Value **svals = NULL;
-	Slapi_Value **pwvals = NULL;
-	struct tm utctime;
-	char timestr[GENERALIZED_TIME_LENGTH+1];
-	krb5_context krbctx;
-	krb5_error_code krberr;
-	char lm[33], nt[33];
-	struct ntlm_keys ntlm;
-	int ntlm_flags = 0;
-	Slapi_Value *sambaSamAccount;
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "=> ipapwd_SetPassword\n");
-
-	smods = slapi_mods_new();
-
-	/* generate kerberos keys to be put into krbPrincipalKey */
-	svals = encrypt_encode_key(krbcfg, data);
-	if (!svals) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "key encryption/encoding failed\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-
-	slapi_mods_add_mod_values(smods, LDAP_MOD_REPLACE, "krbPrincipalKey", svals);
-
-	/* change Last Password Change field with the current date */
-	if (!gmtime_r(&(data->timeNow), &utctime)) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "failed to retrieve current date (buggy gmtime_r ?)\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-	strftime(timestr, GENERALIZED_TIME_LENGTH+1, "%Y%m%d%H%M%SZ", &utctime);
-	slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbLastPwdChange", timestr);
-
-	/* set Password Expiration date */
-	if (!gmtime_r(&(data->expireTime), &utctime)) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "failed to convert expiration date\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-	strftime(timestr, GENERALIZED_TIME_LENGTH+1, "%Y%m%d%H%M%SZ", &utctime);
-	slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbPasswordExpiration", timestr);
-
-	sambaSamAccount = slapi_value_new_string("sambaSamAccount");
-	if (slapi_entry_attr_has_syntax_value(data->target, "objectClass", sambaSamAccount)) {
-		/* TODO: retrieve if we want to store the LM hash or not */
-		ntlm_flags = KTF_LM_HASH | KTF_NT_HASH;
-	}
-	slapi_value_free(&sambaSamAccount);
-
-	if (ntlm_flags) {
-		char *password = strdup(data->password);
-		if (encode_ntlm_keys(password, ntlm_flags, &ntlm) != 0) {
-			free(password);
-			ret = LDAP_OPERATIONS_ERROR;
-			goto free_and_return;
-		}
-		if (ntlm_flags & KTF_LM_HASH) {
-			hexbuf(lm, ntlm.lm);
-			lm[32] = '\0';
-			slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "sambaLMPassword", lm);
-		}
-		if (ntlm_flags & KTF_NT_HASH) {
-			hexbuf(nt, ntlm.nt);
-			nt[32] = '\0';
-			slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "sambaNTPassword", nt);
-		}
-		free(password);
-	}
-
-	/* let DS encode the password itself, this allows also other plugins to
-	 * intercept it to perform operations like synchronization with Active
-	 * Directory domains through the replication plugin */
-	slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "userPassword", data->password);
-
-	/* set password history */
-	pwvals = ipapwd_setPasswordHistory(smods, data);
-	if (pwvals) {
-		slapi_mods_add_mod_values(smods, LDAP_MOD_REPLACE, "passwordHistory", pwvals);
-	}
-
-	/* FIXME:
-	 * instead of replace we should use a delete/add so that we are
-	 * completely sure nobody else modified the entry meanwhile and
-	 * fail if that's the case */
-
-	/* commit changes */
-	ret = ipapwd_apply_mods(data->dn, smods);
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "<= ipapwd_SetPassword: %d\n", ret);
-
-free_and_return:
-	slapi_mods_free(&smods);
-	ipapwd_free_slapi_value_array(&svals);
-	ipapwd_free_slapi_value_array(&pwvals);
-
-	return ret;
-}
-
-static int ipapwd_chpwop(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg)
-{
-	char 		*bindDN = NULL;
-	char		*authmethod = NULL;
-	char		*dn = NULL;
-	char		*oldPasswd = NULL;
-	char		*newPasswd = NULL;
-	char		*errMesg = NULL;
-	int             ret=0, rc=0, is_root=0;
-	ber_tag_t	tag=0;
-	ber_len_t	len=-1;
-	struct berval	*extop_value = NULL;
-	BerElement	*ber = NULL;
-	Slapi_Entry *targetEntry=NULL;
-	char *attrlist[] = {"*", "passwordHistory", NULL };
-	struct ipapwd_data pwdata;
-
-	/* Get the ber value of the extended operation */
-	slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
-
-	if ((ber = ber_init(extop_value)) == NULL)
-	{
-		errMesg = "PasswdModify Request decode failed.\n";
-		rc = LDAP_PROTOCOL_ERROR;
-		goto free_and_return;
-	}
-
-	/* Format of request to parse
-	 *
-	 * PasswdModifyRequestValue ::= SEQUENCE {
-	 * userIdentity    [0]  OCTET STRING OPTIONAL
-	 * oldPasswd       [1]  OCTET STRING OPTIONAL
-	 * newPasswd       [2]  OCTET STRING OPTIONAL }
-	 *
-	 * The request value field is optional. If it is
-	 * provided, at least one field must be filled in.
-	 */
-
-	/* ber parse code */
-	if ( ber_scanf( ber, "{") == LBER_ERROR )
-	{
-		/* The request field wasn't provided.  We'll
-		 * now try to determine the userid and verify
-		 * knowledge of the old password via other
-		 * means.
-		 */
-		goto parse_req_done;
-	} else {
-		tag = ber_peek_tag( ber, &len);
-	}
-
-	/* identify userID field by tags */
-	if (tag == LDAP_EXTOP_PASSMOD_TAG_USERID )
-	{
-		if (ber_scanf(ber, "a", &dn) == LBER_ERROR) {
-			slapi_ch_free_string(&dn);
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"ber_scanf failed\n");
-			errMesg = "ber_scanf failed at userID parse.\n";
-			rc = LDAP_PROTOCOL_ERROR;
-			goto free_and_return;
-		}
-
-		tag = ber_peek_tag(ber, &len);
-	}
-
-	/* identify oldPasswd field by tags */
-	if (tag == LDAP_EXTOP_PASSMOD_TAG_OLDPWD )
-	{
-		if (ber_scanf(ber, "a", &oldPasswd) == LBER_ERROR) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"ber_scanf failed\n");
-			errMesg = "ber_scanf failed at oldPasswd parse.\n";
-			rc = LDAP_PROTOCOL_ERROR;
-			goto free_and_return;
-		}
-		tag = ber_peek_tag(ber, &len);
-	}
-
-	/* identify newPasswd field by tags */
-	if (tag == LDAP_EXTOP_PASSMOD_TAG_NEWPWD )
-	{
-		if (ber_scanf(ber, "a", &newPasswd) == LBER_ERROR) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"ber_scanf failed\n");
-			errMesg = "ber_scanf failed at newPasswd parse.\n";
-			rc = LDAP_PROTOCOL_ERROR;
-			goto free_and_return;
-		}
-	}
-
-parse_req_done:
-	/* Uncomment for debugging, otherwise we don't want to leak the
-	 * password values into the log... */
-	/* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s),
-	 * 		newPasswd (%s)\n", dn, oldPasswd, newPasswd); */
-
-
-	 /* Get Bind DN */
-	 slapi_pblock_get(pb, SLAPI_CONN_DN, &bindDN);
-
-	 /* If the connection is bound anonymously, we must refuse
-	  * to process this operation. */
-	if (bindDN == NULL || *bindDN == '\0') {
-	 	/* Refuse the operation because they're bound anonymously */
-		errMesg = "Anonymous Binds are not allowed.\n";
-		rc = LDAP_INSUFFICIENT_ACCESS;
-		goto free_and_return;
-	}
-
-	/* A new password was not supplied in the request, and we do not support
-	 * password generation yet.
-	 */
-	if (newPasswd == NULL || *newPasswd == '\0') {
-		errMesg = "Password generation not implemented.\n";
-		rc = LDAP_UNWILLING_TO_PERFORM;
-		goto free_and_return;
-	}
-
-	if (oldPasswd == NULL || *oldPasswd == '\0') {
-		/* If user is authenticated, they already gave their password during
-		the bind operation (or used sasl or client cert auth or OS creds) */
-		slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod);
-		if (!authmethod || !strcmp(authmethod, SLAPD_AUTH_NONE)) {
-			errMesg = "User must be authenticated to the directory server.\n";
-			rc = LDAP_INSUFFICIENT_ACCESS;
-			goto free_and_return;
-		}
-	}
-
-	 /* Determine the target DN for this operation */
-	 /* Did they give us a DN ? */
-	if (dn == NULL || *dn == '\0') {
-	 	/* Get the DN from the bind identity on this connection */
-		dn = slapi_ch_strdup(bindDN);
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-			"Missing userIdentity in request, using the bind DN instead.\n");
-	 }
-
-	 slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn );
-
-	 /* Now we have the DN, look for the entry */
-	 ret = ipapwd_getEntry(dn, &targetEntry, attrlist);
-	 /* If we can't find the entry, then that's an error */
-	 if (ret) {
-	 	/* Couldn't find the entry, fail */
-		errMesg = "No such Entry exists.\n" ;
-		rc = LDAP_NO_SUCH_OBJECT;
-		goto free_and_return;
-	 }
-
-	 /* First thing to do is to ask access control if the bound identity has
-	  * rights to modify the userpassword attribute on this entry. If not,
-	  * then we fail immediately with insufficient access. This means that
-	  * we don't leak any useful information to the client such as current
-	  * password wrong, etc.
-	  */
-
-	is_root = slapi_dn_isroot(bindDN);
-	slapi_pblock_set(pb, SLAPI_REQUESTOR_ISROOT, &is_root);
-
-	/* In order to perform the access control check, we need to select a
-	 * backend (even though we don't actually need it otherwise).
-	 */
-	{
-		Slapi_Backend *be = NULL;
-
-		be = slapi_be_select(slapi_entry_get_sdn(targetEntry));
-		if (NULL == be) {
-			errMesg = "Failed to find backend for target entry";
-			rc = LDAP_OPERATIONS_ERROR;
-			goto free_and_return;
-		}
-		slapi_pblock_set(pb, SLAPI_BACKEND, be);
-	}
-
-	ret = slapi_access_allowed( pb, targetEntry, "krbPrincipalKey", NULL, SLAPI_ACL_WRITE );
-	if ( ret != LDAP_SUCCESS ) {
-		errMesg = "Insufficient access rights\n";
-		rc = LDAP_INSUFFICIENT_ACCESS;
-		goto free_and_return;
-	}
-
-	/* Now we have the entry which we want to modify
- 	 * They gave us a password (old), check it against the target entry
-	 * Is the old password valid ?
-	 */
-	if (oldPasswd && *oldPasswd) {
-		/* If user is authenticated, they already gave their password
-		 * during the bind operation (or used sasl or client cert auth
-		 * or OS creds) */
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"oldPasswd provided, but we will ignore it");
-	}
-
-	memset(&pwdata, 0, sizeof(pwdata));
-	pwdata.target = targetEntry;
-	pwdata.dn = dn;
-	pwdata.password = newPasswd;
-	pwdata.timeNow = time(NULL);
-	pwdata.changetype = IPA_CHANGETYPE_NORMAL;
-
-    /*
-     *  (technically strcasecmp to compare DNs is not absolutely correct,
-     *  but it should work for the cases we care about here)
-     */
-
-	/* determine type of password change */
-    /* special cases */
-    if ((strcasecmp(dn, bindDN) != 0) &&
-        (strcasecmp(ipa_changepw_principal_dn, bindDN) != 0)) {
-        int i;
-
-        pwdata.changetype = IPA_CHANGETYPE_ADMIN;
-
-        for (i = 0; i < krbcfg->num_passsync_mgrs; i++) {
-            if (strcasecmp(krbcfg->passsync_mgrs[i], bindDN) == 0) {
-                pwdata.changetype = IPA_CHANGETYPE_DSMGR;
-                break;
-            }
-        }
-    }
-
-	/* check the policy */
-	ret = ipapwd_CheckPolicy(&pwdata);
-	if (ret) {
-		errMesg = "Password Fails to meet minimum strength criteria";
-		if (ret & IPAPWD_POLICY_ERROR) {
-			slapi_pwpolicy_make_response_control(pb, -1, -1, ret & IPAPWD_POLICY_MASK);
-			rc = LDAP_CONSTRAINT_VIOLATION;
-		} else {
-			errMesg = "Internal error";
-			rc = ret;
-		}
-		goto free_and_return;
-	}
-
-	/* Now we're ready to set the kerberos key material */
-	ret = ipapwd_SetPassword(krbcfg, &pwdata);
-	if (ret != LDAP_SUCCESS) {
-		/* Failed to modify the password,
-		 * e.g. because insufficient access allowed */
-		errMesg = "Failed to update password";
-		if (ret > 0) {
-			rc = ret;
-		} else {
-			rc = LDAP_OPERATIONS_ERROR;
-		}
-		goto free_and_return;
-	}
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "<= ipapwd_extop: %d\n", rc);
-
-	/* Free anything that we allocated above */
-free_and_return:
-	slapi_ch_free_string(&oldPasswd);
-	slapi_ch_free_string(&newPasswd);
-	/* Either this is the same pointer that we allocated and set above,
-	 * or whoever used it should have freed it and allocated a new
-	 * value that we need to free here */
-	slapi_pblock_get(pb, SLAPI_ORIGINAL_TARGET, &dn);
-	slapi_ch_free_string(&dn);
-	slapi_pblock_set(pb, SLAPI_ORIGINAL_TARGET, NULL);
-	slapi_ch_free_string(&authmethod);
-
-	if (targetEntry) slapi_entry_free(targetEntry);
-	if (ber) ber_free(ber, 1);
-
-	slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop", errMesg ? errMesg : "success");
-	slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
-
-	return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
-
-}
-
-/* Password Modify Extended operation plugin function */
-static int ipapwd_setkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg)
-{
-	char *bindDN = NULL;
-	char *serviceName = NULL;
-	char *errMesg = NULL;
-	int ret=0, rc=0, is_root=0;
-	struct berval *extop_value = NULL;
-	BerElement *ber = NULL;
-	Slapi_PBlock *pbte = NULL;
-	Slapi_Entry *targetEntry=NULL;
-	struct berval *bval = NULL;
-	Slapi_Value **svals = NULL;
-	const char *bdn;
-	const Slapi_DN *bsdn;
-	Slapi_DN *sdn;
-	Slapi_Backend *be;
-	Slapi_Entry **es = NULL;
-	int scope, res;
-	char *filter;
-	char *attrlist[] = {"krbPrincipalKey", "krbLastPwdChange", NULL };
-	krb5_context krbctx = NULL;
-	krb5_principal krbname = NULL;
-	krb5_error_code krberr;
-	int i, kvno;
-	Slapi_Mods *smods;
-	ber_tag_t rtag, ttmp;
-	ber_int_t tint;
-	ber_len_t tlen;
-	struct ipapwd_keyset *kset = NULL;
-	struct tm utctime;
-	char timestr[GENERALIZED_TIME_LENGTH+1];
-	time_t time_now = time(NULL);
-
-	svals = (Slapi_Value **)calloc(2, sizeof(Slapi_Value *));
-	if (!svals) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"memory allocation failed\n");
-		rc = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-
-	krberr = krb5_init_context(&krbctx);
-	if (krberr) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"krb5_init_context failed\n");
-		rc = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-
-	/* Get Bind DN */
-	slapi_pblock_get(pb, SLAPI_CONN_DN, &bindDN);
-
-	 /* If the connection is bound anonymously, we must refuse to process
-	 * this operation. */
-	if (bindDN == NULL || *bindDN == '\0') {
-	 	/* Refuse the operation because they're bound anonymously */
-		errMesg = "Anonymous Binds are not allowed.\n";
-		rc = LDAP_INSUFFICIENT_ACCESS;
-		goto free_and_return;
-	}
-
-	/* Get the ber value of the extended operation */
-	slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
-
-	if ((ber = ber_init(extop_value)) == NULL)
-	{
-		errMesg = "KeytabGet Request decode failed.\n";
-		rc = LDAP_PROTOCOL_ERROR;
-		goto free_and_return;
-	}
-
-	/* Format of request to parse
-	 *
-	 * KeytabGetRequest ::= SEQUENCE {
-	 *     serviceIdentity OCTET STRING
-	 *     keys            SEQUENCE OF KrbKey,
-	 *     ...
-	 * }
-	 *
-	 * KrbKey ::= SEQUENCE {
-	 *     key       [0] EncryptionKey,
-	 *     salt      [1] KrbSalt OPTIONAL,
-	 *     s2kparams [2] OCTET STRING OPTIONAL,
-	 *     ...
-	 * }
-	 *
-	 * EncryptionKey ::= SEQUENCE {
-	 *     keytype   [0] Int32,
-	 *     keyvalue  [1] OCTET STRING
-	 * }
-	 *
-	 * KrbSalt ::= SEQUENCE {
-	 *     type      [0] Int32,
-	 *     salt      [1] OCTET STRING OPTIONAL
-	 * }
-	 */
-
-	/* ber parse code */
-	rtag = ber_scanf(ber, "{a{", &serviceName);
-	if (rtag == LBER_ERROR) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"ber_scanf failed\n");
-		errMesg = "Invalid payload, failed to decode.\n";
-		rc = LDAP_PROTOCOL_ERROR;
-		goto free_and_return;
-	}
-
-	/* make sure it is a valid name */
-	krberr = krb5_parse_name(krbctx, serviceName, &krbname);
-	if (krberr) {
-		slapi_ch_free_string(&serviceName);
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"krb5_parse_name failed\n");
-		rc = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	} else {
-		/* invert so that we get the canonical form
-		 * (add REALM if not present for example) */
-		char *canonname;
-		krberr = krb5_unparse_name(krbctx, krbname, &canonname);
-		if (krberr) {
-			slapi_ch_free_string(&serviceName);
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-					"krb5_unparse_name failed\n");
-			rc = LDAP_OPERATIONS_ERROR;
-			goto free_and_return;
-		}
-		slapi_ch_free_string(&serviceName);
-		serviceName = canonname;
-	}
-
-	/* check entry before doing any other decoding */
-
-	/* Find ancestor base DN */
-	sdn = slapi_sdn_new_dn_byval(ipa_realm_dn);
-	be = slapi_be_select(sdn);
-	slapi_sdn_free(&sdn);
-	bsdn = slapi_be_getsuffix(be, 0);
-	if (bsdn == NULL) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"Search for Base DN failed\n");
-		errMesg = "PrincipalName not found.\n";
-		rc = LDAP_NO_SUCH_OBJECT;
-		goto free_and_return;
-	}
-	bdn = slapi_sdn_get_dn(bsdn);
-	scope = LDAP_SCOPE_SUBTREE;
-
-	/* get Entry by krbPrincipalName */
-	filter = slapi_ch_smprintf("(krbPrincipalName=%s)", serviceName);
-
-	pbte = slapi_pblock_new();
-	slapi_search_internal_set_pb(pbte,
-		bdn, scope, filter, attrlist, 0,
-		NULL, /* Controls */
-		NULL, /* UniqueID */
-		ipapwd_plugin_id,
-		0); /* Flags */
-
-	/* do search the tree */
-	ret = slapi_search_internal_pb(pbte);
-	slapi_pblock_get(pbte, SLAPI_PLUGIN_INTOP_RESULT, &res);
-	if (ret == -1 || res != LDAP_SUCCESS) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"Search for Principal failed, err (%d)\n",
-				res?res:ret);
-		errMesg = "PrincipalName not found.\n";
-		rc = LDAP_NO_SUCH_OBJECT;
-		goto free_and_return;
-	}
-
-	/* get entries */
-	slapi_pblock_get(pbte, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &es);
-	if (!es) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "No entries ?!");
-		errMesg = "PrincipalName not found.\n";
-		rc = LDAP_NO_SUCH_OBJECT;
-		goto free_and_return;
-	}
-
-	/* count entries */
-	for (i = 0; es[i]; i++) /* count */ ;
-
-	/* if there is none or more than one, freak out */
-	if (i != 1) {
-		slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop",
-				"Too many entries, or entry no found (%d)", i);
-		errMesg = "PrincipalName not found.\n";
-		rc = LDAP_NO_SUCH_OBJECT;
-		goto free_and_return;
-	}
-	targetEntry = es[0];
-
-	/* First thing to do is to ask access control if the bound identity has
-	 * rights to modify the userpassword attribute on this entry. If not,
-	 * then we fail immediately with insufficient access. This means that
-	 * we don't leak any useful information to the client such as current
-	 * password wrong, etc.
-	 */
-
-	is_root = slapi_dn_isroot(bindDN);
-	slapi_pblock_set(pb, SLAPI_REQUESTOR_ISROOT, &is_root);
-
-	/* In order to perform the access control check,
-	 * we need to select a backend (even though
-	 * we don't actually need it otherwise).
-	 */
-	slapi_pblock_set(pb, SLAPI_BACKEND, be);
-
-	/* Access Strategy:
-	 * If the user has WRITE-ONLY access, a new keytab is set on the entry.
-	 */
-
-	ret = slapi_access_allowed(pb, targetEntry, "krbPrincipalKey", NULL, SLAPI_ACL_WRITE);
-	if (ret != LDAP_SUCCESS) {
-		errMesg = "Insufficient access rights\n";
-		rc = LDAP_INSUFFICIENT_ACCESS;
-		goto free_and_return;
-	}
-
-	/* increment kvno (will be 1 if this is a new entry) */
-	kvno = ipapwd_get_cur_kvno(targetEntry) + 1;
-
-	/* ok access allowed, init kset and continue to parse ber buffer */
-
-	errMesg = "Unable to set key\n";
-	rc = LDAP_OPERATIONS_ERROR;
-
-	kset = malloc(sizeof(struct ipapwd_keyset));
-	if (!kset) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-		goto free_and_return;
-	}
-
-	/* this encoding assumes all keys have the same kvno */
-	/* major-vno = 1 and minor-vno = 1 */
-	kset->major_vno = 1;
-	kset->minor_vno = 1;
-	kset->kvno = kvno;
-	/* we also assum mkvno is 0 */
-	kset->mkvno = 0;
-
-	kset->keys = NULL;
-	kset->num_keys = 0;
-
-	rtag = ber_peek_tag(ber, &tlen);
-	while (rtag == LBER_SEQUENCE) {
-		krb5_data plain;
-		krb5_enc_data cipher;
-		struct berval tval;
-		krb5_octet *kdata;
-		size_t klen;
-
-		i = kset->num_keys;
-
-		if (kset->keys) {
-			struct ipapwd_krbkey *newset;
-
-			newset = realloc(kset->keys, sizeof(struct ipapwd_krbkey) * (i + 1));
-			if (!newset) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-				goto free_and_return;
-			}
-			kset->keys = newset;
-		} else {
-			kset->keys = malloc(sizeof(struct ipapwd_krbkey));
-			if (!kset->keys) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-				goto free_and_return;
-			}
-		}
-		kset->num_keys += 1;
-
-		kset->keys[i].salt = NULL;
-		kset->keys[i].ekey = NULL;
-		kset->keys[i].s2kparams.bv_len = 0;
-		kset->keys[i].s2kparams.bv_val = NULL;
-
-		/* EncryptionKey */
-		rtag = ber_scanf(ber, "{t[{t[i]t[o]}]", &ttmp, &ttmp, &tint, &ttmp, &tval);
-		if (rtag == LBER_ERROR) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "ber_scanf failed\n");
-			errMesg = "Invalid payload, failed to decode.\n";
-			rc = LDAP_PROTOCOL_ERROR;
-			goto free_and_return;
-		}
-
-		kset->keys[i].ekey = calloc(1, sizeof(struct ipapwd_krbkeydata));
-		if (!kset->keys[i].ekey) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-			goto free_and_return;
-		}
-
-		kset->keys[i].ekey->type = tint;
-
-		plain.length = tval.bv_len;
-		plain.data = tval.bv_val;
-
-		krberr = krb5_c_encrypt_length(krbctx, krbcfg->kmkey->enctype, plain.length, &klen);
-		if (krberr) {
-			free(tval.bv_val);
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "krb encryption failed!\n");
-			goto free_and_return;
-		}
-
-		kdata = malloc(2 + klen);
-		if (!kdata) {
-			free(tval.bv_val);
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-			goto free_and_return;
-		}
-		encode_int16(plain.length, kdata);
-
-		kset->keys[i].ekey->value.bv_len = 2 + klen;
-		kset->keys[i].ekey->value.bv_val = (char *)kdata;
-
-		cipher.ciphertext.length = klen;
-		cipher.ciphertext.data = (char *)kdata + 2;
-
-		krberr = krb5_c_encrypt(krbctx, krbcfg->kmkey, 0, 0, &plain, &cipher);
-		if (krberr) {
-			free(tval.bv_val);
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "krb encryption failed!\n");
-			goto free_and_return;
-		}
-
-		free(tval.bv_val);
-
-		rtag = ber_peek_tag(ber, &tlen);
-
-		/* KrbSalt */
-		if (rtag == (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1)) {
-
-			rtag = ber_scanf(ber, "t[{t[i]", &ttmp, &ttmp, &tint);
-			if (rtag == LBER_ERROR) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "ber_scanf failed\n");
-				errMesg = "Invalid payload, failed to decode.\n";
-				rc = LDAP_PROTOCOL_ERROR;
-				goto free_and_return;
-			}
-
-			kset->keys[i].salt = calloc(1, sizeof(struct ipapwd_krbkeydata));
-			if (!kset->keys[i].salt) {
-				slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "malloc failed!\n");
-				goto free_and_return;
-			}
-
-			kset->keys[i].salt->type = tint;
-
-			rtag = ber_peek_tag(ber, &tlen);
-			if (rtag == (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 1)) {
-
-				rtag = ber_scanf(ber, "t[o]}]", &ttmp, &tval);
-				if (rtag == LBER_ERROR) {
-					slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "ber_scanf failed\n");
-					errMesg = "Invalid payload, failed to decode.\n";
-					rc = LDAP_PROTOCOL_ERROR;
-					goto free_and_return;
-				}
-
-				kset->keys[i].salt->value = tval;
-
-				rtag = ber_peek_tag(ber, &tlen);
-			}
-		}
-
-		/* FIXME: s2kparams - NOT implemented yet */
-		if (rtag == (ber_tag_t)(LBER_CONSTRUCTED | LBER_CLASS_CONTEXT | 2)) {
-			rtag = ber_scanf(ber, "t[x]}", &ttmp);
-		} else {
-			rtag = ber_scanf(ber, "}", &ttmp);
-		}
-		if (rtag == LBER_ERROR) {
-			slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop", "ber_scanf failed\n");
-			errMesg = "Invalid payload, failed to decode.\n";
-			rc = LDAP_PROTOCOL_ERROR;
-			goto free_and_return;
-		}
-
-		rtag = ber_peek_tag(ber, &tlen);
-	}
-
-	ber_free(ber, 1);
-	ber = NULL;
-
-	/* filter un-supported encodings */
-	ret = filter_keys(krbcfg, kset);
-	if (ret) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"keyset filtering failed\n");
-		goto free_and_return;
-	}
-
-	/* check if we have any left */
-	if (kset->num_keys == 0) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"keyset filtering rejected all proposed keys\n");
-		errMesg = "All enctypes provided are unsupported";
-		rc = LDAP_UNWILLING_TO_PERFORM;
-		goto free_and_return;
-	}
-
-	smods = slapi_mods_new();
-
-	/* change Last Password Change field with the current date */
-	if (!gmtime_r(&(time_now), &utctime)) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"failed to retrieve current date (buggy gmtime_r ?)\n");
-		slapi_mods_free(&smods);
-		goto free_and_return;
-	}
-	strftime(timestr, GENERALIZED_TIME_LENGTH+1, "%Y%m%d%H%M%SZ", &utctime);
-	slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbLastPwdChange", timestr);
-
-	/* FIXME: set Password Expiration date ? */
-#if 0
-	if (!gmtime_r(&(data->expireTime), &utctime)) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"failed to convert expiration date\n");
-		slapi_ch_free_string(&randPasswd);
-		slapi_mods_free(&smods);
-		rc = LDAP_OPERATIONS_ERROR;
-		goto free_and_return;
-	}
-	strftime(timestr, GENERALIZED_TIME_LENGTH+1, "%Y%m%d%H%M%SZ", &utctime);
-	slapi_mods_add_string(smods, LDAP_MOD_REPLACE, "krbPasswordExpiration", timestr);
-#endif
-
-	bval = encode_keys(kset);
-	if (!bval) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"encoding asn1 KrbSalt failed\n");
-		slapi_mods_free(&smods);
-		goto free_and_return;
-	}
-
-	svals[0] = slapi_value_new_berval(bval);
-	if (!svals[0]) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipa_pwd_extop",
-				"Converting berval to Slapi_Value\n");
-		slapi_mods_free(&smods);
-		goto free_and_return;
-	}
-
-	slapi_mods_add_mod_values(smods, LDAP_MOD_REPLACE, "krbPrincipalKey", svals);
-
-	/* commit changes */
-	ret = ipapwd_apply_mods(slapi_entry_get_dn_const(targetEntry), smods);
-
-	if (ret != LDAP_SUCCESS) {
-		slapi_mods_free(&smods);
-		goto free_and_return;
-
-	}
-	slapi_mods_free(&smods);
-
-	/* Format of response
-	 *
-	 * KeytabGetRequest ::= SEQUENCE {
-	 * 	new_kvno	Int32
-	 * 	SEQUENCE OF	KeyTypes
-	 * }
-	 *
-	 * * List of accepted enctypes *
-	 * KeyTypes ::= SEQUENCE {
-	 * 	enctype		Int32
-	 * }
-	 */
-
-	errMesg = "Internal Error\n";
-	rc = LDAP_OPERATIONS_ERROR;
-
-	ber = ber_alloc();
-	if (!ber) {
-		goto free_and_return;
-	}
-
-	ret = ber_printf(ber, "{i{", (ber_int_t)kvno);
-	if (ret == -1) {
-		goto free_and_return;
-	}
-
-	for (i = 0; i < kset->num_keys; i++) {
-		ret = ber_printf(ber, "{i}", (ber_int_t)kset->keys[i].ekey->type);
-		if (ret == -1) {
-			goto free_and_return;
-		}
-	}
-	ret = ber_printf(ber, "}}");
-	if (ret == -1) {
-		goto free_and_return;
-	}
-
-	if (ret != -1) {
-		struct berval *bvp;
-		LDAPControl new_ctrl = {0};
-
-		ret = ber_flatten(ber, &bvp);
-		if (ret == -1) {
-			goto free_and_return;
-		}
-
-		new_ctrl.ldctl_oid = KEYTAB_RET_OID;
-		new_ctrl.ldctl_value = *bvp;
-		new_ctrl.ldctl_iscritical = 0;
-		rc= slapi_pblock_set(pb, SLAPI_ADD_RESCONTROL, &new_ctrl);
-		ber_bvfree(bvp);
-	}
-
-	/* Free anything that we allocated above */
-free_and_return:
-	free(serviceName);
-	if (kset) ipapwd_keyset_free(&kset);
-
-	if (bval) ber_bvfree(bval);
-	if (ber) ber_free(ber, 1);
-
-	if (pbte) {
-		slapi_free_search_results_internal(pbte);
-		slapi_pblock_destroy(pbte);
-	}
-	if (svals) {
-		for (i = 0; svals[i]; i++) {
-			slapi_value_free(&svals[i]);
-		}
-		free(svals);
-	}
-
-	if (krbname) krb5_free_principal(krbctx, krbname);
-	if (krbctx) krb5_free_context(krbctx);
-
-	slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop", errMesg ? errMesg : "success");
-	slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
-
-	return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
-}
-
-static int new_ipapwd_encsalt(krb5_context krbctx, const char * const *encsalts,
-			      struct ipapwd_encsalt **es_types, int *num_es_types)
-{
-	struct ipapwd_encsalt *es;
-	int nes, i;
-
-	for (i = 0; encsalts[i]; i++) /* count */ ;
-	es = calloc(i + 1, sizeof(struct ipapwd_encsalt));
-	if (!es) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_start", "Out of memory!\n");
-		return LDAP_OPERATIONS_ERROR;
-	}
-
-	for (i = 0, nes = 0; encsalts[i]; i++) {
-		char *enc, *salt;
-		krb5_int32 tmpsalt;
-		krb5_enctype tmpenc;
-		krb5_boolean similar;
-		krb5_error_code krberr;
-		int j;
-
-		enc = strdup(encsalts[i]);
-		if (!enc) {
-			slapi_log_error(SLAPI_LOG_PLUGIN, "ipapwd_start",
-					"Allocation error\n");
-			return LDAP_OPERATIONS_ERROR;
-		}
-		salt = strchr(enc, ':');
-		if (!salt) {
-			slapi_log_error(SLAPI_LOG_PLUGIN, "ipapwd_start",
-					"Invalid krb5 enc string\n");
-			free(enc);
-			continue;
-		}
-		*salt = '\0'; /* null terminate the enc type */
-		salt++; /* skip : */
-
-		krberr = krb5_string_to_enctype(enc, &tmpenc);
-		if (krberr) {
-			slapi_log_error(SLAPI_LOG_PLUGIN, "ipapwd_start",
-					"Invalid krb5 enctype\n");
-			free(enc);
-			continue;
-		}
-
-		krberr = krb5_string_to_salttype(salt, &tmpsalt);
-		for (j = 0; j < nes; j++) {
-			krb5_c_enctype_compare(krbctx, es[j].enc_type, tmpenc, &similar);
-			if (similar && (es[j].salt_type == tmpsalt)) {
-				break;
-			}
-		}
-
-		if (j == nes) {
-			/* not found */
-			es[j].enc_type = tmpenc;
-			es[j].salt_type = tmpsalt;
-			nes++;
-		}
-
-		free(enc);
-	}
-
-	*es_types = es;
-	*num_es_types = nes;
-
-	return LDAP_SUCCESS;
-}
-
-static struct ipapwd_krbcfg *ipapwd_getConfig(void)
-{
-    krb5_error_code krberr;
-    struct ipapwd_krbcfg *config = NULL;
-    krb5_keyblock *kmkey = NULL;
-    Slapi_Entry *realm_entry = NULL;
-    Slapi_Entry *config_entry = NULL;
-    Slapi_Attr *a;
-    Slapi_Value *v;
-    BerElement *be = NULL;
-    ber_tag_t tag, tmp;
-    ber_int_t ttype;
-    const struct berval *bval;
-    struct berval *mkey = NULL;
-    char **encsalts;
-    char *tmpstr;
-    int i, ret;
-
-    config = calloc(1, sizeof(struct ipapwd_krbcfg));
-    if (!config) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Out of memory!\n");
-        goto free_and_error;
-    }
-    kmkey = calloc(1, sizeof(krb5_keyblock));
-    if (!kmkey) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Out of memory!\n");
-        goto free_and_error;
-    }
-    config->kmkey = kmkey;
-
-    krberr = krb5_init_context(&config->krbctx);
-    if (krberr) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "krb5_init_context failed\n");
-        goto free_and_error;
-    }
-
-    ret = krb5_get_default_realm(config->krbctx, &config->realm);
-    if (ret) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Failed to get default realm?!\n");
-        goto free_and_error;
-    }
-
-    /* get the Realm Container entry */
-    ret = ipapwd_getEntry(ipa_realm_dn, &realm_entry, NULL);
-    if (ret != LDAP_SUCCESS) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "No realm Entry?\n");
-        goto free_and_error;
-    }
-
-    /*** get the Kerberos Master Key ***/
-
-    ret = slapi_entry_attr_find(realm_entry, "krbMKey", &a);
-    if (ret == -1) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "No master key??\n");
-        goto free_and_error;
-    }
-
-    /* there should be only one value here */
-    ret = slapi_attr_first_value(a, &v);
-    if (ret == -1) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "No master key??\n");
-        goto free_and_error;
-    }
-
-    bval = slapi_value_get_berval(v);
-    if (!bval) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Error retrieving master key berval\n");
-        goto free_and_error;
-    }
-
-    be = ber_init(bval);
-    if (!bval) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "ber_init() failed!\n");
-        goto free_and_error;
-    }
-
-    tag = ber_scanf(be, "{i{iO}}", &tmp, &ttype, &mkey);
-    if (tag == LBER_ERROR) {
-        slapi_log_error(SLAPI_LOG_TRACE, "ipapwd_getConfig",
-                        "Bad Master key encoding ?!\n");
-        goto free_and_error;
-    }
-
-    kmkey->magic = KV5M_KEYBLOCK;
-    kmkey->enctype = ttype;
-    kmkey->length = mkey->bv_len;
-    kmkey->contents = malloc(mkey->bv_len);
-    if (!kmkey->contents) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Out of memory!\n");
-        goto free_and_error;
-    }
-    memcpy(kmkey->contents, mkey->bv_val, mkey->bv_len);
-    ber_bvfree(mkey);
-    ber_free(be, 1);
-    mkey = NULL;
-    be = NULL;
-
-    /*** get the Supported Enc/Salt types ***/
-
-    encsalts = slapi_entry_attr_get_charray(realm_entry, "krbSupportedEncSaltTypes");
-    if (encsalts) {
-        ret = new_ipapwd_encsalt(config->krbctx,
-                                 (const char * const *)encsalts,
-                                 &config->supp_encsalts,
-                                 &config->num_supp_encsalts);
-        slapi_ch_array_free(encsalts);
-    } else {
-        slapi_log_error(SLAPI_LOG_TRACE, "ipapwd_getConfig",
-                        "No configured salt types use defaults\n");
-        ret = new_ipapwd_encsalt(config->krbctx,
-                                 ipapwd_def_encsalts,
-                                 &config->supp_encsalts,
-                                 &config->num_supp_encsalts);
-    }
-    if (ret) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Can't get Supported EncSalt Types\n");
-        goto free_and_error;
-    }
-
-    /*** get the Preferred Enc/Salt types ***/
-
-    encsalts = slapi_entry_attr_get_charray(realm_entry, "krbDefaultEncSaltTypes");
-    if (encsalts) {
-        ret = new_ipapwd_encsalt(config->krbctx,
-                                 (const char * const *)encsalts,
-                                 &config->pref_encsalts,
-                                 &config->num_pref_encsalts);
-        slapi_ch_array_free(encsalts);
-    } else {
-        slapi_log_error(SLAPI_LOG_TRACE, "ipapwd_getConfig",
-                        "No configured salt types use defaults\n");
-        ret = new_ipapwd_encsalt(config->krbctx,
-                                 ipapwd_def_encsalts,
-                                 &config->pref_encsalts,
-                                 &config->num_pref_encsalts);
-    }
-    if (ret) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Can't get Preferred EncSalt Types\n");
-        goto free_and_error;
-    }
-
-    slapi_entry_free(realm_entry);
-
-    /* get the Realm Container entry */
-    ret = ipapwd_getEntry(ipa_pwd_config_dn, &config_entry, NULL);
-    if (ret != LDAP_SUCCESS) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "No config Entry? Impossible!\n");
-        goto free_and_error;
-    }
-    config->passsync_mgrs = slapi_entry_attr_get_charray(config_entry, "passSyncManagersDNs");
-    /* now add Directory Manager, it is always added by default */
-    tmpstr = slapi_ch_strdup("cn=Directory Manager");
-    slapi_ch_array_add(&config->passsync_mgrs, tmpstr);
-    if (config->passsync_mgrs == NULL) {
-        slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_getConfig",
-                        "Out of memory!\n");
-        goto free_and_error;
-    }
-    for (i = 0; config->passsync_mgrs[i]; i++) /* count */ ;
-    config->num_passsync_mgrs = i;
-
-    return config;
-
-free_and_error:
-    if (mkey) ber_bvfree(mkey);
-    if (be) ber_free(be, 1);
-    if (kmkey) {
-        free(kmkey->contents);
-        free(kmkey);
-    }
-    if (config) {
-        if (config->krbctx) {
-            if (config->realm)
-                krb5_free_default_realm(config->krbctx, config->realm);
-            krb5_free_context(config->krbctx);
-        }
-        free(config->pref_encsalts);
-        free(config->supp_encsalts);
-        slapi_ch_array_free(config->passsync_mgrs);
-        free(config);
-    }
-    slapi_entry_free(config_entry);
-    slapi_entry_free(realm_entry);
-    return NULL;
-}
-
-#define IPAPWD_CHECK_CONN_SECURE    0x00000001
-#define IPAPWD_CHECK_DN             0x00000002
-
-static int ipapwd_gen_checks(Slapi_PBlock *pb, char **errMesg,
-                             struct ipapwd_krbcfg **config,
-                             int check_flags)
-{
-    int ret, sasl_ssf, is_ssl;
-    int rc = LDAP_SUCCESS;
-    Slapi_Backend *be;
-    const Slapi_DN *psdn;
-    Slapi_DN *sdn;
-    char *dn = NULL;
-
-    slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "=> ipapwd_gen_checks\n");
-
-#ifdef LDAP_EXTOP_PASSMOD_CONN_SECURE
-    if (check_flags & IPAPWD_CHECK_CONN_SECURE) {
-        /* Allow password modify only for SSL/TLS established connections and
-         * connections using SASL privacy layers */
-        if (slapi_pblock_get(pb, SLAPI_CONN_SASL_SSF, &sasl_ssf) != 0) {
-            slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-                            "Could not get SASL SSF from connection\n");
-            *errMesg = "Operation requires a secure connection.\n";
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-
-        if (slapi_pblock_get(pb, SLAPI_CONN_IS_SSL_SESSION, &is_ssl) != 0) {
-            slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-                            "Could not get IS SSL from connection\n");
-            *errMesg = "Operation requires a secure connection.\n";
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-
-        if ((0 == is_ssl) && (sasl_ssf <= 1)) {
-            *errMesg = "Operation requires a secure connection.\n";
-            rc = LDAP_CONFIDENTIALITY_REQUIRED;
-            goto done;
-        }
-    }
-#endif
-
-    if (check_flags & IPAPWD_CHECK_DN) {
-        /* check we have a valid DN in the pblock or just abort */
-        ret = slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn);
-        if (ret) {
-            slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-                            "Tried to change password for an invalid DN [%s]\n",
-                            dn?dn:"<NULL>");
-            *errMesg = "Invalid DN";
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-        sdn = slapi_sdn_new_dn_byref(dn);
-        if (!sdn) {
-            *errMesg = "Internal Error";
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-        be = slapi_be_select(sdn);
-        slapi_sdn_free(&sdn);
-
-        psdn = slapi_be_getsuffix(be, 0);
-        if (!psdn) {
-            *errMesg = "Invalid DN";
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-    }
-
-    /* get the kerberos context and master key */
-    *config = ipapwd_getConfig();
-    if (NULL == *config) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-                        "Error Retrieving Master Key");
-        *errMesg = "Fatal Internal Error";
-        rc = LDAP_OPERATIONS_ERROR;
-    }
-
-done:
-    return rc;
-}
-
-static int ipapwd_extop(Slapi_PBlock *pb)
-{
-	struct ipapwd_krbcfg *krbcfg = NULL;
-	char *errMesg = NULL;
-	char *oid = NULL;
-	int rc, ret;
-
-	slapi_log_error(SLAPI_LOG_TRACE, "ipa_pwd_extop", "=> ipapwd_extop\n");
-
-	rc = ipapwd_gen_checks(pb, &errMesg, &krbcfg, IPAPWD_CHECK_CONN_SECURE);
-	if (rc) {
-		goto free_and_return;
-	}
-
-	/* Before going any further, we'll make sure that the right extended
-	 * operation plugin has been called: i.e., the OID shipped whithin the
-	 * extended operation request must match this very plugin's OIDs:
-	 * EXOP_PASSWD_OID or KEYTAB_SET_OID. */
-	if (slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_OID, &oid) != 0) {
-		errMesg = "Could not get OID value from request.\n";
-		rc = LDAP_OPERATIONS_ERROR;
-		slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop", errMesg);
-		goto free_and_return;
-	} else {
-	        slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop",
-				"Received extended operation request with OID %s\n", oid);
-	}
-
-	if (strcasecmp(oid, EXOP_PASSWD_OID) == 0) {
-		ret = ipapwd_chpwop(pb, krbcfg);
-		free_ipapwd_krbcfg(&krbcfg);
-		return ret;
-	}
-	if (strcasecmp(oid, KEYTAB_SET_OID) == 0) {
-		ret = ipapwd_setkeytab(pb, krbcfg);
-		free_ipapwd_krbcfg(&krbcfg);
-		return ret;
-	}
-
-	errMesg = "Request OID does not match supported OIDs.\n";
-	rc = LDAP_OPERATIONS_ERROR;
-
-free_and_return:
-	if (krbcfg) free_ipapwd_krbcfg(&krbcfg);
-
-	slapi_log_error(SLAPI_LOG_PLUGIN, "ipa_pwd_extop", errMesg);
-	slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
-
-	return SLAPI_PLUGIN_EXTENDED_SENT_RESULT;
-}
-
-/*****************************************************************************
- * pre/post operations to intercept writes to userPassword
- ****************************************************************************/
-
-#define IPAPWD_OP_NULL 0
-#define IPAPWD_OP_ADD 1
-#define IPAPWD_OP_MOD 2
-struct ipapwd_operation {
-    struct ipapwd_data pwdata;
-    int pwd_op;
-    int is_krb;
-};
-
-/* structure with information for each extension */
-struct ipapwd_op_ext {
-    char *object_name;   /* name of the object extended   */
-    int object_type;     /* handle to the extended object */
-    int handle;          /* extension handle              */
-};
-
-static struct ipapwd_op_ext ipapwd_op_ext_list;
-
-static void *ipapwd_op_ext_constructor(void *object, void *parent)
-{
-    struct ipapwd_operation *ext;
-
-    ext = (struct ipapwd_operation *)slapi_ch_calloc(1, sizeof(struct ipapwd_operation));
-    return ext;
-}
-
-static void ipapwd_op_ext_destructor(void *ext, void *object, void *parent)
-{
-    struct ipapwd_operation *pwdop = (struct ipapwd_operation *)ext;
-    if (!pwdop)
-        return;
-    if (pwdop->pwd_op != IPAPWD_OP_NULL) {
-        slapi_ch_free_string(&(pwdop->pwdata.dn));
-        slapi_ch_free_string(&(pwdop->pwdata.password));
-    }
-    slapi_ch_free((void **)&pwdop);
-}
-
-static int ipapwd_entry_checks(Slapi_PBlock *pb, struct slapi_entry *e,
-                               int *is_root, int *is_krb, int *is_smb,
-                               char *attr, int access)
-{
-    Slapi_Value *sval;
-    int rc;
-
-    /* Check ACIs */
-    slapi_pblock_get(pb, SLAPI_REQUESTOR_ISROOT, is_root);
-
-    if (!*is_root) {
-        /* verify this user is allowed to write a user password */
-        rc = slapi_access_allowed(pb, e, attr, NULL, access);
-        if (rc != LDAP_SUCCESS) {
-            /* we have no business here, the operation will be denied anyway */
-            rc = LDAP_SUCCESS;
-            goto done;
-        }
-    }
-
-    /* Check if this is a krbPrincial and therefore needs us to generate other
-     * hashes */
-    sval = slapi_value_new_string("krbPrincipalAux");
-    if (!sval) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-    *is_krb = slapi_entry_attr_has_syntax_value(e, SLAPI_ATTR_OBJECTCLASS, sval);
-    slapi_value_free(&sval);
-
-    sval = slapi_value_new_string("sambaSamAccount");
-    if (!sval) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-    *is_smb = slapi_entry_attr_has_syntax_value(e, SLAPI_ATTR_OBJECTCLASS, sval);
-    slapi_value_free(&sval);
-
-    rc = LDAP_SUCCESS;
-
-done:
-    return rc;
-}
-
-static int ipapwd_preop_gen_hashes(struct ipapwd_krbcfg *krbcfg,
-                                   struct ipapwd_operation *pwdop,
-                                   char *userpw,
-                                   int is_krb, int is_smb,
-                                   Slapi_Value ***svals,
-                                   char **nthash, char **lmhash)
-{
-    int rc;
-
-    if (is_krb) {
-
-        pwdop->is_krb = 1;
-
-        *svals = encrypt_encode_key(krbcfg, &pwdop->pwdata);
-
-        if (!*svals) {
-            slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                            "key encryption/encoding failed\n");
-	    rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-    }
-
-    if (is_smb) {
-        char lm[33], nt[33];
-        struct ntlm_keys ntlm;
-        int ntlm_flags = 0;
-        int ret;
-
-        /* TODO: retrieve if we want to store the LM hash or not */
-        ntlm_flags = KTF_LM_HASH | KTF_NT_HASH;
-
-        ret = encode_ntlm_keys(userpw, ntlm_flags, &ntlm);
-        if (ret) {
-            slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                            "Failed to generate NT/LM hashes\n");
-            rc = LDAP_OPERATIONS_ERROR;
-            goto done;
-        }
-        if (ntlm_flags & KTF_LM_HASH) {
-            hexbuf(lm, ntlm.lm);
-            lm[32] = '\0';
-            *lmhash = slapi_ch_strdup(lm);
-        }
-        if (ntlm_flags & KTF_NT_HASH) {
-            hexbuf(nt, ntlm.nt);
-            nt[32] = '\0';
-            *nthash = slapi_ch_strdup(nt);
-        }
-    }
-
-    rc = LDAP_SUCCESS;
-
-done:
-
-    return rc;
-}
-
-/* PRE ADD Operation:
- * Gets the clean text password (fail the operation if the password came
- * pre-hashed, unless this is a replicated operation).
- * Check user is authorized to add it otherwise just returns, operation will
- * fail later anyway.
- * Run a password policy check.
- * Check if krb or smb hashes are required by testing if the krb or smb
- * objectclasses are present.
- * store information for the post operation
- */
-static int ipapwd_pre_add(Slapi_PBlock *pb)
-{
-    struct ipapwd_krbcfg *krbcfg = NULL;
-    char *errMesg = "Internal operations error\n";
-    struct slapi_entry *e = NULL;
-    char *userpw = NULL;
-    char *dn = NULL;
-    struct ipapwd_operation *pwdop = NULL;
-    void *op;
-    int is_repl_op, is_root, is_krb, is_smb;
-    int ret, rc;
-
-    slapi_log_error(SLAPI_LOG_TRACE, IPAPWD_PLUGIN_NAME, "=> ipapwd_pre_add\n");
-
-    ret = slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &is_repl_op);
-    if (ret != 0) {
-        slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                        "slapi_pblock_get failed!?\n");
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    /* pass through if this is a replicated operation */
-    if (is_repl_op)
-        return 0;
-
-    /* retrieve the entry */
-    slapi_pblock_get(pb, SLAPI_ADD_ENTRY, &e);
-    if (NULL == e)
-        return 0;
-
-    /* check this is something interesting for us first */
-    userpw = slapi_entry_attr_get_charptr(e, SLAPI_USERPWD_ATTR);
-    if (!userpw) {
-	/* nothing interesting here */
-	return 0;
-    }
-
-    /* Ok this is interesting,
-     * Check this is a clear text password, or refuse operation */
-    if ('{' == userpw[0]) {
-        if (0 == strncasecmp(userpw, "{CLEAR}", strlen("{CLEAR}"))) {
-            char *tmp = slapi_ch_strdup(&userpw[strlen("{CLEAR}")]);
-            if (NULL == tmp) {
-                slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                                "Strdup failed, Out of memory\n");
-                rc = LDAP_OPERATIONS_ERROR;
-                goto done;
-            }
-            slapi_ch_free_string(&userpw);
-            userpw = tmp;
-        } else if (slapi_is_encoded(userpw)) {
-
-            slapi_ch_free_string(&userpw);
-
-            /* check if we have access to the unhashed user password */
-            userpw = slapi_entry_attr_get_charptr(e, "unhashed#user#password");
-            if (!userpw) {
-                slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                                "Pre-Encoded passwords are not valid\n");
-                errMesg = "Pre-Encoded passwords are not valid\n";
-                rc = LDAP_CONSTRAINT_VIOLATION;
-                goto done;
-            }
-        }
-    }
-
-    rc = ipapwd_entry_checks(pb, e,
-                             &is_root, &is_krb, &is_smb,
-                             NULL, SLAPI_ACL_ADD);
-    if (rc) {
-        goto done;
-    }
-
-    rc = ipapwd_gen_checks(pb, &errMesg, &krbcfg, IPAPWD_CHECK_DN);
-    if (rc) {
-        goto done;
-    }
-
-    /* Get target DN */
-    ret = slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn);
-    if (ret) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    /* time to get the operation handler */
-    ret = slapi_pblock_get(pb, SLAPI_OPERATION, &op);
-    if (ret != 0) {
-        slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                        "slapi_pblock_get failed!?\n");
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    pwdop = slapi_get_object_extension(ipapwd_op_ext_list.object_type,
-                                       op, ipapwd_op_ext_list.handle);
-    if (NULL == pwdop) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    pwdop->pwd_op = IPAPWD_OP_ADD;
-    pwdop->pwdata.password = slapi_ch_strdup(userpw);
-
-    if (is_root) {
-        pwdop->pwdata.changetype = IPA_CHANGETYPE_DSMGR;
-    } else {
-        char *binddn;
-        int i;
-
-        pwdop->pwdata.changetype = IPA_CHANGETYPE_ADMIN;
-
-        /* Check Bind DN */
-        slapi_pblock_get(pb, SLAPI_CONN_DN, &binddn);
-
-        /* if it is a passsync manager we also need to skip resets */
-        for (i = 0; i < krbcfg->num_passsync_mgrs; i++) {
-            if (strcasecmp(krbcfg->passsync_mgrs[i], binddn) == 0) {
-                pwdop->pwdata.changetype = IPA_CHANGETYPE_DSMGR;
-                break;
-            }
-        }
-    }
-
-    pwdop->pwdata.dn = slapi_ch_strdup(dn);
-    pwdop->pwdata.timeNow = time(NULL);
-    pwdop->pwdata.target = e;
-
-    ret = ipapwd_CheckPolicy(&pwdop->pwdata);
-    if (ret) {
-        errMesg = "Password Fails to meet minimum strength criteria";
-        rc = LDAP_CONSTRAINT_VIOLATION;
-        goto done;
-    }
-
-    if (is_krb || is_smb) {
-
-        Slapi_Value **svals = NULL;
-        char *nt = NULL;
-        char *lm = NULL;
-
-        rc = ipapwd_preop_gen_hashes(krbcfg,
-                                     pwdop, userpw,
-                                     is_krb, is_smb,
-                                     &svals, &nt, &lm);
-        if (rc) {
-            goto done;
-        }
-
-        if (svals) {
-            /* add/replace values in existing entry */
-            ret = slapi_entry_attr_replace_sv(e, "krbPrincipalKey", svals);
-            if (ret) {
-                slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                                "failed to set encoded values in entry\n");
-                rc = LDAP_OPERATIONS_ERROR;
-                ipapwd_free_slapi_value_array(&svals);
-                goto done;
-            }
-
-            ipapwd_free_slapi_value_array(&svals);
-        }
-
-        if (lm) {
-            /* set value */
-            slapi_entry_attr_set_charptr(e, "sambaLMPassword", lm);
-            slapi_ch_free_string(&lm);
-        }
-        if (nt) {
-            /* set value */
-            slapi_entry_attr_set_charptr(e, "sambaNTPassword", nt);
-            slapi_ch_free_string(&nt);
-        }
-    }
-
-    rc = LDAP_SUCCESS;
-
-done:
-    if (pwdop) pwdop->pwdata.target = NULL;
-    free_ipapwd_krbcfg(&krbcfg);
-    slapi_ch_free_string(&userpw);
-    if (rc != LDAP_SUCCESS) {
-        slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
-        return -1;
-    }
-    return 0;
-}
-
-/* PRE MOD Operation:
- * Gets the clean text password (fail the operation if the password came
- * pre-hashed, unless this is a replicated operation).
- * Check user is authorized to add it otherwise just returns, operation will
- * fail later anyway.
- * Check if krb or smb hashes are required by testing if the krb or smb
- * objectclasses are present.
- * Run a password policy check.
- * store information for the post operation
- */
-static int ipapwd_pre_mod(Slapi_PBlock *pb)
-{
-    struct ipapwd_krbcfg *krbcfg = NULL;
-    char *errMesg = NULL;
-    LDAPMod **mods;
-    Slapi_Mod *smod, *tmod;
-    Slapi_Mods *smods = NULL;
-    char *userpw = NULL;
-    char *unhashedpw = NULL;
-    char *dn = NULL;
-    Slapi_DN *tmp_dn;
-    struct slapi_entry *e = NULL;
-    struct ipapwd_operation *pwdop = NULL;
-    void *op;
-    int is_repl_op, is_pwd_op, is_root, is_krb, is_smb;
-    int ret, rc;
-
-    slapi_log_error(SLAPI_LOG_TRACE, IPAPWD_PLUGIN_NAME, "=> ipapwd_pre_mod\n");
-
-    ret = slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &is_repl_op);
-    if (ret != 0) {
-        slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                        "slapi_pblock_get failed!?\n");
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    /* pass through if this is a replicated operation */
-    if (is_repl_op) {
-        rc = LDAP_SUCCESS;
-        goto done;
-    }
-
-    /* grab the mods - we'll put them back later with
-     * our modifications appended
-     */
-    slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
-    smods = slapi_mods_new();
-    slapi_mods_init_passin(smods, mods);
-
-    /* In the first pass,
-     * only check there is anything we are interested in */
-    is_pwd_op = 0;
-    tmod = slapi_mod_new();
-    smod = slapi_mods_get_first_smod(smods, tmod);
-    while (smod) {
-        struct berval *bv;
-        const char *type;
-        int mop;
-
-        type = slapi_mod_get_type(smod);
-        if (slapi_attr_types_equivalent(type, SLAPI_USERPWD_ATTR)) {
-            mop = slapi_mod_get_operation(smod);
-            /* check op filtering out LDAP_MOD_BVALUES */
-            switch (mop & 0x0f) {
-            case LDAP_MOD_ADD:
-            case LDAP_MOD_REPLACE:
-                is_pwd_op = 1;
-            default:
-                break;
-            }
-        }
-
-        /* we check for unahsehd password here so that we are sure to catch them
-         * early, before further checks go on, this helps checking
-         * LDAP_MOD_DELETE operations in some corner cases later */
-        /* we keep only the last one if multiple are provided for any absurd
-	 * reason */
-        if (slapi_attr_types_equivalent(type, "unhashed#user#password")) {
-            bv = slapi_mod_get_first_value(smod);
-            if (!bv) {
-                slapi_mod_free(&tmod);
-                rc = LDAP_OPERATIONS_ERROR;
-                goto done;
-            }
-            slapi_ch_free_string(&unhashedpw);
-            unhashedpw = slapi_ch_malloc(bv->bv_len+1);
-            if (!unhashedpw) {
-                slapi_mod_free(&tmod);
-                rc = LDAP_OPERATIONS_ERROR;
-                goto done;
-            }
-            memcpy(unhashedpw, bv->bv_val, bv->bv_len);
-            unhashedpw[bv->bv_len] = '\0';
-        }
-        slapi_mod_done(tmod);
-        smod = slapi_mods_get_next_smod(smods, tmod);
-    }
-    slapi_mod_free(&tmod);
-
-    /* If userPassword is not modified we are done here */
-    if (! is_pwd_op) {
-        rc = LDAP_SUCCESS;
-        goto done;
-    }
-
-    /* OK swe have something interesting here, start checking for
-     * pre-requisites */
-
-    /* Get target DN */
-    ret = slapi_pblock_get(pb, SLAPI_TARGET_DN, &dn);
-    if (ret) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    tmp_dn = slapi_sdn_new_dn_byref(dn);
-    if (tmp_dn) {
-        /* xxxPAR: Ideally SLAPI_MODIFY_EXISTING_ENTRY should be
-         * available but it turns out that is only true if you are
-         * a dbm backend pre-op plugin - lucky dbm backend pre-op
-         * plugins.
-         * I think that is wrong since the entry is useful for filter
-         * tests and schema checks and this plugin shouldn't be limited
-         * to a single backend type, but I don't want that fight right
-         * now so we go get the entry here
-         *
-         slapi_pblock_get( pb, SLAPI_MODIFY_EXISTING_ENTRY, &e);
-         */
-        ret = slapi_search_internal_get_entry(tmp_dn, 0, &e, ipapwd_plugin_id);
-        slapi_sdn_free(&tmp_dn);
-        if (ret != LDAP_SUCCESS) {
-            slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                            "Failed tpo retrieve entry?!?\n");
-           rc = LDAP_NO_SUCH_OBJECT;
-           goto done;
-        }
-    }
-
-    rc = ipapwd_entry_checks(pb, e,
-                             &is_root, &is_krb, &is_smb,
-                             SLAPI_USERPWD_ATTR, SLAPI_ACL_WRITE);
-    if (rc) {
-        goto done;
-    }
-
-    rc = ipapwd_gen_checks(pb, &errMesg, &krbcfg, IPAPWD_CHECK_DN);
-    if (rc) {
-        goto done;
-    }
-
-    /* run through the mods again and adjust flags if operations affect them */
-    tmod = slapi_mod_new();
-    smod = slapi_mods_get_first_smod(smods, tmod);
-    while (smod) {
-        struct berval *bv;
-        const char *type;
-        int mop;
-
-        type = slapi_mod_get_type(smod);
-        if (slapi_attr_types_equivalent(type, SLAPI_USERPWD_ATTR)) {
-            mop = slapi_mod_get_operation(smod);
-            /* check op filtering out LDAP_MOD_BVALUES */
-            switch (mop & 0x0f) {
-            case LDAP_MOD_ADD:
-                /* FIXME: should we try to track cases where we would end up
-                 * with multiple userPassword entries ?? */
-            case LDAP_MOD_REPLACE:
-                is_pwd_op = 1;
-                bv = slapi_mod_get_first_value(smod);
-                if (!bv) {
-                    slapi_mod_free(&tmod);
-                    rc = LDAP_OPERATIONS_ERROR;
-                    goto done;
-                }
-                slapi_ch_free_string(&userpw);
-                userpw = slapi_ch_malloc(bv->bv_len+1);
-                if (!userpw) {
-                    slapi_mod_free(&tmod);
-                    rc = LDAP_OPERATIONS_ERROR;
-                    goto done;
-                }
-                memcpy(userpw, bv->bv_val, bv->bv_len);
-                userpw[bv->bv_len] = '\0';
-                break;
-            case LDAP_MOD_DELETE:
-                /* reset only if we are deleting all values, or the exact
-                 * same value previously set, otherwise we are just trying to
-                 * add a new value and delete an existing one */
-                bv = slapi_mod_get_first_value(smod);
-                if (!bv) {
-                    is_pwd_op = 0;
-                } else {
-                    if (0 == strncmp(userpw, bv->bv_val, bv->bv_len) ||
-                        0 == strncmp(unhashedpw, bv->bv_val, bv->bv_len))
-                        is_pwd_op = 0;
-                }
-            default:
-                break;
-            }
-        }
-
-        if (slapi_attr_types_equivalent(type, SLAPI_ATTR_OBJECTCLASS)) {
-            mop = slapi_mod_get_operation(smod);
-            /* check op filtering out LDAP_MOD_BVALUES */
-            switch (mop & 0x0f) {
-            case LDAP_MOD_REPLACE:
-                /* if objectclasses are replaced we need to start clean with
-                 * flags, so we sero them out and see if they get set again */
-                is_krb = 0;
-                is_smb = 0;
-
-            case LDAP_MOD_ADD:
-                bv = slapi_mod_get_first_value(smod);
-                if (!bv) {
-                    slapi_mod_free(&tmod);
-                    rc = LDAP_OPERATIONS_ERROR;
-                    goto done;
-                }
-                do {
-                    if (0 == strncasecmp("krbPrincipalAux", bv->bv_val, bv->bv_len))
-                        is_krb = 1;
-                    if (0 == strncasecmp("sambaSamAccount", bv->bv_val, bv->bv_len))
-                        is_smb = 1;
-                } while ((bv = slapi_mod_get_next_value(smod)) != NULL);
-
-                break;
-
-            case LDAP_MOD_DELETE:
-                /* can this happen for objectclasses ? */
-                is_krb = 0;
-                is_smb = 0;
-
-            default:
-                break;
-            }
-        }
-
-        slapi_mod_done(tmod);
-        smod = slapi_mods_get_next_smod(smods, tmod);
-    }
-    slapi_mod_free(&tmod);
-
-    /* It seem like we have determined that the end result will be deletion of
-     * the userPassword attribute, so we have no more business here */
-    if (! is_pwd_op) {
-        rc = LDAP_SUCCESS;
-        goto done;
-    }
-
-    /* Check this is a clear text password, or refuse operation (only if we need
-     * to comput other hashes */
-    if (! unhashedpw) {
-        if ('{' == userpw[0]) {
-            if (0 == strncasecmp(userpw, "{CLEAR}", strlen("{CLEAR}"))) {
-                unhashedpw = slapi_ch_strdup(&userpw[strlen("{CLEAR}")]);
-                if (NULL == unhashedpw) {
-                    slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                                    "Strdup failed, Out of memory\n");
-                    rc = LDAP_OPERATIONS_ERROR;
-                    goto done;
-                }
-                slapi_ch_free_string(&userpw);
-
-            } else if (slapi_is_encoded(userpw)) {
-
-                slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                                "Pre-Encoded passwords are not valid\n");
-                errMesg = "Pre-Encoded passwords are not valid\n";
-                rc = LDAP_CONSTRAINT_VIOLATION;
-                goto done;
-            }
-        }
-    }
-
-    /* time to get the operation handler */
-    ret = slapi_pblock_get(pb, SLAPI_OPERATION, &op);
-    if (ret != 0) {
-        slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                        "slapi_pblock_get failed!?\n");
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    pwdop = slapi_get_object_extension(ipapwd_op_ext_list.object_type,
-                                       op, ipapwd_op_ext_list.handle);
-    if (NULL == pwdop) {
-        rc = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    pwdop->pwd_op = IPAPWD_OP_MOD;
-    pwdop->pwdata.password = slapi_ch_strdup(unhashedpw);
-    pwdop->pwdata.changetype = IPA_CHANGETYPE_NORMAL;
-
-    if (is_root) {
-        pwdop->pwdata.changetype = IPA_CHANGETYPE_DSMGR;
-    } else {
-        char *binddn;
-        Slapi_DN *bdn, *tdn;
-        int i;
-
-        /* Check Bind DN */
-        slapi_pblock_get(pb, SLAPI_CONN_DN, &binddn);
-        bdn = slapi_sdn_new_dn_byref(binddn);
-        tdn = slapi_sdn_new_dn_byref(dn);
-
-        /* if the change is performed by someone else,
-         * it is an admin change that will require a new
-         * password change immediately as per our IPA policy */
-        if (slapi_sdn_compare(bdn, tdn)) {
-            pwdop->pwdata.changetype = IPA_CHANGETYPE_ADMIN;
-
-            /* if it is a passsync manager we also need to skip resets */
-            for (i = 0; i < krbcfg->num_passsync_mgrs; i++) {
-                if (strcasecmp(krbcfg->passsync_mgrs[i], binddn) == 0) {
-                    pwdop->pwdata.changetype = IPA_CHANGETYPE_DSMGR;
-                    break;
-                }
-            }
-
-        }
-
-        slapi_sdn_free(&bdn);
-        slapi_sdn_free(&tdn);
-
-    }
-
-    pwdop->pwdata.dn = slapi_ch_strdup(dn);
-    pwdop->pwdata.timeNow = time(NULL);
-    pwdop->pwdata.target = e;
-
-    ret = ipapwd_CheckPolicy(&pwdop->pwdata);
-    if (ret) {
-        errMesg = "Password Fails to meet minimum strength criteria";
-        rc = LDAP_CONSTRAINT_VIOLATION;
-        goto done;
-    }
-
-    if (is_krb || is_smb) {
-
-        Slapi_Value **svals = NULL;
-        char *nt = NULL;
-        char *lm = NULL;
-
-        rc = ipapwd_preop_gen_hashes(krbcfg,
-                                     pwdop, unhashedpw,
-                                     is_krb, is_smb,
-                                     &svals, &nt, &lm);
-        if (rc) {
-            goto done;
-        }
-
-        if (svals) {
-            /* replace values */
-            slapi_mods_add_mod_values(smods, LDAP_MOD_REPLACE,
-                                      "krbPrincipalKey", svals);
-            ipapwd_free_slapi_value_array(&svals);
-        }
-
-        if (lm) {
-            /* replace value */
-            slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
-                                  "sambaLMPassword", lm);
-            slapi_ch_free_string(&lm);
-        }
-        if (nt) {
-            /* replace value */
-            slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
-                                  "sambaNTPassword", nt);
-            slapi_ch_free_string(&nt);
-        }
-    }
-
-    rc = LDAP_SUCCESS;
-
-done:
-    free_ipapwd_krbcfg(&krbcfg);
-    slapi_ch_free_string(&userpw); /* just to be sure */
-    slapi_ch_free_string(&unhashedpw); /* we copied it to pwdop  */
-    if (e) slapi_entry_free(e); /* this is a copy in this function */
-    if (pwdop) pwdop->pwdata.target = NULL;
-
-    /* put back a, possibly modified, set of mods */
-    if (smods) {
-        mods = slapi_mods_get_ldapmods_passout(smods);
-        slapi_pblock_set(pb, SLAPI_MODIFY_MODS, mods);
-        slapi_mods_free(&smods);
-    }
-
-    if (rc != LDAP_SUCCESS) {
-        slapi_send_ldap_result(pb, rc, NULL, errMesg, 0, NULL);
-        return -1;
-    }
-
-    return 0;
-}
-
-static int ipapwd_post_op(Slapi_PBlock *pb)
-{
-    char *errMesg = "Internal operations error\n";
-    void *op;
-    struct ipapwd_operation *pwdop = NULL;
-    Slapi_Mods *smods;
-    Slapi_Value **pwvals;
-    struct tm utctime;
-    char timestr[GENERALIZED_TIME_LENGTH+1];
-    int ret;
-
-    slapi_log_error(SLAPI_LOG_TRACE, IPAPWD_PLUGIN_NAME,
-                    "=> ipapwd_post_add\n");
-
-    /* time to get the operation handler */
-    ret = slapi_pblock_get(pb, SLAPI_OPERATION, &op);
-    if (ret != 0) {
-        slapi_log_error(SLAPI_LOG_FATAL, IPAPWD_PLUGIN_NAME,
-                        "slapi_pblock_get failed!?\n");
-        return 0;
-    }
-
-    pwdop = slapi_get_object_extension(ipapwd_op_ext_list.object_type,
-                                       op, ipapwd_op_ext_list.handle);
-    if (NULL == pwdop) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                        "Internal error, couldn't find pluginextension ?!\n");
-        return 0;
-    }
-
-    /* not interesting */
-    if (IPAPWD_OP_NULL == pwdop->pwd_op)
-        return 0;
-
-    if ( ! (pwdop->is_krb)) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                        "Not a kerberos user, ignore krb attributes\n");
-        return 0;
-    }
-
-    /* prepare changes that can be made only as root */
-    smods = slapi_mods_new();
-
-    /* change Last Password Change field with the current date */
-    if (!gmtime_r(&(pwdop->pwdata.timeNow), &utctime)) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                        "failed to parse current date (buggy gmtime_r ?)\n");
-        goto done;
-    }
-    strftime(timestr, GENERALIZED_TIME_LENGTH+1,
-             "%Y%m%d%H%M%SZ", &utctime);
-    slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
-                          "krbLastPwdChange", timestr);
-
-    /* set Password Expiration date */
-    if (!gmtime_r(&(pwdop->pwdata.expireTime), &utctime)) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                        "failed to parse expiration date (buggy gmtime_r ?)\n");
-        goto done;
-    }
-    strftime(timestr, GENERALIZED_TIME_LENGTH+1,
-             "%Y%m%d%H%M%SZ", &utctime);
-    slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
-                          "krbPasswordExpiration", timestr);
-
-    /* This was a mod operation on an existing entry, make sure we also update
-     * the password history based on the entry we saved from the pre-op */
-    if (IPAPWD_OP_MOD == pwdop->pwd_op) {
-        Slapi_DN *tmp_dn = slapi_sdn_new_dn_byref(pwdop->pwdata.dn);
-        if (tmp_dn) {
-            ret = slapi_search_internal_get_entry(tmp_dn, 0,
-                                                  &pwdop->pwdata.target,
-                                                  ipapwd_plugin_id);
-            slapi_sdn_free(&tmp_dn);
-            if (ret != LDAP_SUCCESS) {
-                slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                                "Failed tpo retrieve entry?!?\n");
-                goto done;
-            }
-        }
-        pwvals = ipapwd_setPasswordHistory(smods, &pwdop->pwdata);
-        if (pwvals) {
-            slapi_mods_add_mod_values(smods, LDAP_MOD_REPLACE,
-                                      "passwordHistory", pwvals);
-        }
-    }
-
-    ret = ipapwd_apply_mods(pwdop->pwdata.dn, smods);
-    if (ret)
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-           "Failed to set additional password attributes in the post-op!\n");
-
-done:
-    if (pwdop && pwdop->pwdata.target) slapi_entry_free(pwdop->pwdata.target);
-    slapi_mods_free(&smods);
-    return 0;
-}
-
-/* Copied from ipamo_string2filter()
- *
- * ipapwd_string2filter()
- *
- * For some reason slapi_str2filter writes to its input
- * which means you cannot pass in a string constant
- * so this is a fix up function for that
- */
-Slapi_Filter *ipapwd_string2filter(char *strfilter)
-{
-	Slapi_Filter *ret = NULL;
-	char *idontbelieveit = slapi_ch_strdup(strfilter);
-
-	ret = slapi_str2filter(idontbelieveit);
-
-	slapi_ch_free_string(&idontbelieveit);
-
-	return ret;
-}
-
-/* Init data structs */
-static int ipapwd_start( Slapi_PBlock *pb )
-{
-	krb5_context krbctx;
-	krb5_error_code krberr;
-	char *realm = NULL;
-	char *config_dn;
-	char *partition_dn;
-	Slapi_Entry *config_entry = NULL;
-	int ret;
-
-	krberr = krb5_init_context(&krbctx);
-	if (krberr) {
-		slapi_log_error(SLAPI_LOG_FATAL, "ipapwd_start", "krb5_init_context failed\n");
-		return LDAP_OPERATIONS_ERROR;
-	}
-
-	if (slapi_pblock_get(pb, SLAPI_TARGET_DN, &config_dn) != 0) {
-		slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "No config DN?\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto done;
-	}
-
-	if (ipapwd_getEntry(config_dn, &config_entry, NULL) != LDAP_SUCCESS) {
-		slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "No config Entry?\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto done;
-	}
-
-	partition_dn = slapi_entry_attr_get_charptr(config_entry, "nsslapd-realmtree");
-	if (!partition_dn) {
-		slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "Missing partition configuration entry (nsslapd-realmTree)!\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto done;
-	}
-
-	ret = krb5_get_default_realm(krbctx, &realm);
-	if (ret) {
-		slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "Failed to get default realm?!\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto done;
-	}
-	ipa_realm_dn = slapi_ch_smprintf("cn=%s,cn=kerberos,%s", realm, partition_dn);
-	if (!ipa_realm_dn) {
-		slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "Out of memory ?\n");
-		ret = LDAP_OPERATIONS_ERROR;
-		goto done;
-	}
-
-    ipa_pwd_config_dn = slapi_ch_strdup(config_dn);
-    if (!ipa_pwd_config_dn) {
-        slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "Out of memory ?\n");
-        ret = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-    ipa_changepw_principal_dn =
-        slapi_ch_smprintf("krbprincipalname=kadmin/changepw@%s,%s",
-                          realm, ipa_realm_dn);
-    if (!ipa_changepw_principal_dn) {
-        slapi_log_error( SLAPI_LOG_FATAL, "ipapwd_start", "Out of memory ?\n");
-        ret = LDAP_OPERATIONS_ERROR;
-        goto done;
-    }
-
-    ret = LDAP_SUCCESS;
-
-done:
-	free(realm);
-	krb5_free_context(krbctx);
-	if (config_entry) slapi_entry_free(config_entry);
-	return ret;
-}
-
-
-static int ipapwd_ext_init()
-{
-    int ret;
-
-    ipapwd_op_ext_list.object_name = SLAPI_EXT_OPERATION;
-
-    ret = slapi_register_object_extension(IPAPWD_PLUGIN_NAME,
-                                          SLAPI_EXT_OPERATION,
-                                          ipapwd_op_ext_constructor,
-                                          ipapwd_op_ext_destructor,
-                                          &ipapwd_op_ext_list.object_type,
-                                          &ipapwd_op_ext_list.handle);
-
-    return ret;
-}
-
-
-static char *ipapwd_oid_list[] = {
-	EXOP_PASSWD_OID,
-	KEYTAB_SET_OID,
-	NULL
-};
-
-
-static char *ipapwd_name_list[] = {
-	"Password Change Extended Operation",
-	"Keytab Retrieval Extended Operation",
-	NULL
-};
-
-/* Init pre ops */
-static int ipapwd_pre_init(Slapi_PBlock *pb)
-{
-    int ret;
-
-    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_ADD_FN, (void *)ipapwd_pre_add);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_MODIFY_FN, (void *)ipapwd_pre_mod);
-
-    return ret;
-}
-
-/* Init post ops */
-static int ipapwd_post_init(Slapi_PBlock *pb)
-{
-    int ret;
-
-    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_POST_ADD_FN, (void *)ipapwd_post_op);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *)ipapwd_post_op);
-
-    return ret;
-}
-
-/* Initialization function */
-int ipapwd_init( Slapi_PBlock *pb )
-{
-    int ret;
-
-    /* Get the arguments appended to the plugin extendedop directive. The first argument
-     * (after the standard arguments for the directive) should contain the OID of the
-     * extended operation. */
-
-    ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ipapwd_plugin_id);
-    if ((ret != 0) || (NULL == ipapwd_plugin_id)) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, "ipapwd_init",
-                        "Could not get identity or identity was NULL\n");
-        return -1;
-    }
-
-    if (ipapwd_ext_init() != 0) {
-        slapi_log_error(SLAPI_LOG_PLUGIN, IPAPWD_PLUGIN_NAME,
-                        "Object Extension Operation failed\n");
-        return -1;
-    }
-
-    /* Register the plug-in function as an extended operation
-     * plug-in function that handles the operation identified by
-     * OID 1.3.6.1.4.1.4203.1.11.1 .  Also specify the version of the server
-     * plug-in */
-    ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, (void *)ipapwd_start);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, ipapwd_oid_list);
-    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_NAMELIST, ipapwd_name_list);
-    if (!ret) slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_FN, (void *)ipapwd_extop);
-    if (ret) {
-        slapi_log_error( SLAPI_LOG_PLUGIN, "ipapwd_init",
-                 "Failed to set plug-in version, function, and OID.\n" );
-        return -1;
-    }
-
-    slapi_register_plugin("preoperation", 1,
-                          "ipapwd_pre_init", ipapwd_pre_init,
-                          "IPA pwd pre ops", NULL,
-                          ipapwd_plugin_id);
-
-    slapi_register_plugin("postoperation", 1,
-                          "ipapwd_post_init", ipapwd_post_init,
-                          "IPA pwd post ops", NULL,
-                          ipapwd_plugin_id);
-
-    return 0;
-}
diff --git a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif
deleted file mode 100644
index e31a8e79b..000000000
--- a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif
+++ /dev/null
@@ -1,16 +0,0 @@
-dn: cn=ipa_pwd_extop,cn=plugins,cn=config
-changetype: add
-objectclass: top
-objectclass: nsSlapdPlugin
-objectclass: extensibleObject
-cn: ipa_pwd_extop
-nsslapd-pluginpath: libipa_pwd_extop
-nsslapd-plugininitfunc: ipapwd_init
-nsslapd-plugintype: extendedop
-nsslapd-pluginenabled: on
-nsslapd-pluginid: ipa_pwd_extop
-nsslapd-pluginversion: 1.0
-nsslapd-pluginvendor: RedHat
-nsslapd-plugindescription: Support saving passwords in multiple formats for different consumers (krb5, samba, freeradius, etc.)
-nsslapd-plugin-depends-on-type: database
-nsslapd-realmTree: $SUFFIX