static int uldap_cache_comparedynamicgroup(request_rec *r, 

                                           util_ldap_connection_t *ldc,

                                           const char *url, const char *dn,

                                           const char *base, int scope,

                                           const char *user, const char *userdn)

{

    int result = 0;

    int failures = 0;

    int i;

    LDAPMessage *groupResult;

    char *groupAttr[] = { "objectClass", "memberURL", NULL};

    char *uidAttr[] = { "uid", NULL};

    char **attr, **tmpAttr;

    char memberURL[255];

    apr_ldap_url_desc_t *groupUrl, *origUrl;

    apr_ldap_err_t *lgroupResult;

start_over:

    if (failures++ > 10) {

        return result;

    }

    if (LDAP_SUCCESS != (result = uldap_connection_open(r, ldc))) {

        return result;

    }

    /* first thing we do is find if the specified group has any memberURL entries */

    if ((result = ldap_search_s(ldc->ldap, base, scope, dn, 

                                groupAttr, 0, &groupResult))

                                                            == LDAP_SERVER_DOWN) {

        ldc->reason = "ldap_search_s() failed with server down";

        uldap_connection_unbind(ldc);

        goto start_over;

    }

    ldc->reason = "LDAP search for dynamic group members complete";

    if ((result = ldap_count_entries(ldc->ldap, groupResult)) != 1) {

        ldc->reason = "LDAP search for dynamic group didn't have 1 result";

        ldap_msgfree(groupResult);

        return LDAP_COMPARE_FALSE;

    }

    if ((groupResult = ldap_first_entry(ldc->ldap, groupResult)) == NULL) {

        ldc->reason = "ldap_first_entry return NULL";

        return LDAP_COMPARE_FALSE;      

    }

    attr = ldap_get_values(ldc->ldap, groupResult, "objectClass");

    if (attr = NULL) {

        ldc->reason = "ldap_get_values() for objectClass returned NULL";

        return LDAP_COMPARE_FALSE;

    }

    if ((attr = ldap_get_values(ldc->ldap, groupResult, "memberURL")) == NULL) {

        ldc->reason = "ldap_get_values() for \"memberURL\" return NULL";

        return LDAP_COMPARE_FALSE;

    }

    tmpAttr = attr;

    i = 0;

    while (*tmpAttr != NULL) {

        bzero(memberURL, sizeof(memberURL));

        strcpy(memberURL, *tmpAttr++);

        /* now, memberURL should be an LDAP URL pointing to a group */

        if ((result = apr_ldap_url_parse(r->pool,

                                             (char *)memberURL,

                                             &groupUrl,

                                             &lgroupResult))

                                                           != APR_SUCCESS)

        {

            ldc->reason = "could not parse returned URL";

            continue;

        }

        else {

            /* we have a good LDAP url, now search to see if the user is there */

            if ((result = ldap_search_s(ldc->ldap, userdn, LDAP_SCOPE_SUBTREE,

                                        groupUrl->lud_filter, uidAttr,

                                        0, &groupResult))

                                                         != LDAP_SUCCESS)

            {

                continue;

            }

            else {

                if (ldap_count_entries(ldc->ldap, groupResult) >= 1) {

                    return LDAP_COMPARE_TRUE;

                }

            }

        }

    }

    return LDAP_COMPARE_FALSE;

}

char ** uldap_cache_getattributevalues(request_rec *r, util_ldap_connection_t *ldc,

                                                    const char *url, const char *dn,

                                                    const char *attrib)

{

    char **arr = NULL;

    char **attr;

    int failures = 0;

    int result = 0;

    int count;

    char *filter = NULL;

    int numvals = 0;

    LDAPMessage *res, *entry;

    util_url_node_t *curl;

    util_url_node_t curnode;

    util_search_node_t *search_nodep;

    util_search_node_t the_search_node;

    apr_time_t curtime;

    util_ldap_state_t *st =

        (util_ldap_state_t *)ap_get_module_config(r->server->module_config,

        &ldap_module);

    LDAP_CACHE_LOCK();

    curnode.url = url;

    curl = (util_url_node_t *)util_ald_cache_fetch(st->util_ldap_cache,

                                                   &curnode);

    char * key = apr_pstrcat(r->pool, dn, "::", attrib, NULL);

    if (curl == NULL) {

        curl = util_ald_create_caches(st, url);

    }

    LDAP_CACHE_UNLOCK();

    if (curl) {

        LDAP_CACHE_LOCK();

        the_search_node.username = key;

        search_nodep = util_ald_cache_fetch(curl->search_cache,

                                            &the_search_node);

        if (search_nodep != NULL) {

            /* found attributes in search cache */

            curtime = apr_time_now();

            if ((curtime - search_nodep->lastbind) > st->search_cache_ttl) {

                /* ...but entry is too old */

                util_ald_cache_remove(curl->search_cache, search_nodep);

            }

            else {

                /* entry isn't too old, so return the results */

                arr = (char **)(search_nodep->vals);

                LDAP_CACHE_UNLOCK();

                return arr;

            }

        }

        LDAP_CACHE_UNLOCK();

    }

    /* didn't get hit from cache */

start_over:

    if (failures++ > 10) {

        return arr;

    }

    if (LDAP_SUCCESS != (result = uldap_connection_open(r, ldc))) {

        return arr;

    }

    /* try do the search */

    filter = apr_pstrcat(st->pool, "objectClass", attrib, NULL);

    if ((result = ldap_search_ext_s(ldc->ldap,

                                    (char *)dn, LDAP_SCOPE_SUBTREE,

                                    filter, (char *)(attrib), 0,

                                    NULL, NULL, NULL, -1, &res))

            == LDAP_SERVER_DOWN)

    {

        ldc->reason = "ldap_search_ext_s() for attribute failed with server down";

        uldap_connection_unbind(ldc);

        goto start_over;

    }

    /* if there is an error (including LDAP_NO_SUCH_OBJECT) return now */

    if (result != LDAP_SUCCESS) {

        ldc->reason = "ldap_search_ext_s() for attribute failed";

        return arr;

    }

    /*

     * We should have found exactly one entry; to find a different

     * number is an error.

     */

    count = ldap_count_entries(ldc->ldap, res);

    if (count != 1)

    {

        if (count == 0 )

            ldc->reason = "Attribute not found";

        else

            ldc->reason = "Attribute search found multiple records.  This shouldn't happen";

        ldap_msgfree(res);

        return arr;

    }

    else {

        entry = ldap_first_entry(ldc->ldap, res);

        attr = ldap_get_values(ldc->ldap, entry, "objectClass");

        if (attr == NULL) {

            ldc->reason = "ldap_get_values() for objectClass returned NULL";

            return arr;

        }

        if ((attr = ldap_get_values(ldc->ldap, entry, attrib)) == NULL) {

            ldc->reason = "ldap_get_values() for attribute return NULL";

            return arr;

        }

        /* attr has the values */

        if (attr) {

            int k = 0;

            int i = 0;

            while (attr[k++]);

            arr = apr_pcalloc(r->pool, sizeof(char *) * (k+1));

            numvals = k;

            while (attr[i]) {

                char **values;

                int j = 0;

                char *str = NULL;

                values = ldap_get_values(ldc->ldap, entry, attr[i]);

                while (values && values[j]) {

                    str = str ? apr_pstrcat(r->pool, str, "; ", values[j], NULL)

                              : apr_pstrdup(r->pool, values[j]);

                    j++;

                }

                ldap_value_free(values);

                arr[i] = str;

                i++;

            }

        }

    }

    return arr;

}

    APR_REGISTER_OPTIONAL_FN(uldap_cache_comparedynamicgroup);

    APR_REGISTER_OPTIONAL_FN(uldap_cache_getattributevalues);

    int dynamic_group_lookup;       /* True if dynamic group lookups desired */

    apr_array_header_t *dynamicgroupattr;   /* List of dynamic group attributes */

static APR_OPTIONAL_FN_TYPE(uldap_cache_comparedynamicgroup) *util_ldap_cache_comparedynamicgroup;

static APR_OPTIONAL_FN_TYPE(uldap_cache_getattributevalues) *util_ldap_cache_getattributevalues;

    sec->dynamicgroupattr = apr_array_make(p, GROUPATTR_MAX_ELTS,

                                           sizeof(struct mod_auth_ldap_groupattr_entry_t));

    sec->dynamic_group_lookup = 0;   /* dynamic group lookup disabled by default */

    /*

     * If there are no elements in the dynamic group attribute array, populate default

     * of "memberURL".  This is the same code as above block but for dynamicgroupattr array

     */

     if (sec->dynamicgroupattr->nelts == 0) {

        struct mod_auth_ldap_groupattr_entry_t *dyngrp;

#if APR_HAS_THREADS

        apr_thread_mutex_lock(sec->lock);

#endif

        dyngrp = apr_array_push(sec->dynamicgroupattr);

        dyngrp->name = "memberURL";

#if APR_HAS_THREADS

        apr_thread_mutex_unlock(sec->lock);

#endif

     }

            /* Regular group membership has failed at this point.  Do dynamic group checking if it is enabled */

            if (sec->dynamic_group_lookup) {

                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                              "[%" APR_PID_T_FMT "] auth_ldap_authorise: require group: "

                              "testing for dynamic group: %s (%s)", getpid(),

                              sec->group_attrib_is_dn ? req->dn : req->user, t);

                for (i = 0; i < sec->dynamicgroupattr->nelts; i++) {

                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                  "[%" APR_PID_T_FMT "] auth_ldap_authorise: require group: "

                                  "dynamic group attribute %s: %s (%s)", getpid(),

                                  ent[i].name, sec->group_attrib_is_dn ? req->dn : req->user, t);

                    /* first we get all the attribute values for the current dynamic group attribute */

                    vals = util_ldap_cache_getattributevalues(r, ldc, sec->url, req->dn, ent[i].name);

                    int key = 0;

                    /* loop through all found attribute values and do a search */

                    while (vals[key]) {

                        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                      "[%" APR_PID_T_FMT "] auth_ldap_authorise: require group: "

                                      , getpid());

                        /* build search filter */

                        authn_ldap_build_filter(filtbuf, r, req->user, vals[key], sec);

                        result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

                             sec->scope, sec->attributes, filtbuf, &dn, &vals);

                        if (result == LDAP_SUCCESS) {

                            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                          "[%" APR_PID_T_FMT "] auth_ldap_authorise: checking dn match %s",

                                          getpid(), dn);

                            result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, dn,

                                 sec->compare_dn_on_server);

                        }

                        switch (result) {

                            case LDAP_COMPARE_TRUE: {

                            }

                            case LDAP_FILTER_ERROR: {

                            }

                            default: {

                            }

                        }

                        key++;

                    }

                    switch (result) {

                        case LDAP_COMPARE_TRUE: {

                            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                          "[%" APR_PID_T_FMT "] auth_ldap_authorise: require dynamic group: "

                                          "authorisation successful [%s][%s]",

                                          getpid(), ldc->reason, ldap_err2string(result));

                            return OK;

                        }

                        default : {

                            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                          "[%" APR_PID_T_FMT "] auth_ldap authorise: require dynamic group: "

                                          "authorisation failed [%s][%s]",

                                          getpid(), ldc->reason, ldap_err2string(result));

                        }

                    }

                }

            }

static const char *mod_auth_ldap_add_dynamic_group_attribute(cmd_parms *cmd, void *config, const char *arg)

{

    struct mod_auth_ldap_groupattr_entry_t *new;

    authn_ldap_config_t *sec = config;

    if (sec->dynamicgroupattr->nelts > GROUPATTR_MAX_ELTS)

        return "Too many AuthLDAPDynamicGroupAttribute directives";

    new = apr_array_push(sec->dynamicgroupattr);

    new->name = apr_pstrdup(cmd->pool, arg);

    return NULL;

}

    AP_INIT_FLAG("AuthLDAPDynamicGroupLookup", ap_set_flag_slot,

                 (void *)APR_OFFSETOF(authn_ldap_config_t, dynamic_group_lookup), OR_AUTHCFG,

                 "If set to 'on', auth_ldap will look for dynamic group URI in a group DN "

                 "and attempt to see if a user is part of a group defined by that URI "

                 "Defaults to 'off'."),

    AP_INIT_TAKE1("AuthLDAPDynamicGroupAttribute", mod_auth_ldap_add_dynamic_group_attribute, NULL, OR_AUTHCFG,

                 "A list of attributes containing dynamic group URIs.  Defaults to \"memberURL\"."),

    util_ldap_cache_comparedynamicgroup = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_comparedynamicgroup);

    util_ldap_cache_getattributevalues = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_getattributevalues);

	util_ldap_cache_comparedynamicgroup \

	util_ldap_cache_getattributevalues \

typedef struct util_ldap_attrvalue_entry_t {

    char *value;

} util_ldap_attrvalue_entry_t;

 * Checks to see if a DN is part of a dynamic group

 * @param r The request record

 * @param ldc The LDAP connection being used

 * @param url The URL of the LDAP connection - used for deciding which cache to use

 * @param dn The DN of the object containing the dynamic group attributes

 * @param groupattrib The attribute containing the dynamic group URI's

 * @param userattrib The user attribute

 * @param base The search base of the connection

 * @param scope The search scope of the connection

 * @param user  The user we are comparing

 */

APR_DECLARE_OPTIONAL_FN(int,uldap_cache_comparedynamicgroup,(request_rec *r, util_ldap_connection_t *ldc,

                            const char *url, const char *dn,

                            const char *base, int scope,

                            const char *user, const char *userdn));

/**

 * Returns an array of values for an attribute in a DN

 * @param r The request record

 * @param ldc The LDAP connection being used

 * @param url The URL of the LDAP connection - used for deciding which cache to use

 * @param dn The DN of the object containing the attribute

 * @param attrib The attrib for which to return values

 */

APR_DECLARE_OPTIONAL_FN(char **, uldap_cache_getattributevalues,(request_rec *r, util_ldap_connection_t *ldc,

                                const char *url, const char *dn, const char *attrib));

/**