--- servers/slapd/overlays/refint.c	2006/04/04 20:16:24	1.19
+++ servers/slapd/overlays/refint.c	2011/01/03 23:41:56	1.19.2.16
@@ -1,8 +1,8 @@
 /* refint.c - referential integrity module */
-/* $OpenLDAP: pkg/ldap/servers/slapd/overlays/refint.c,v 1.18 2006/01/03 22:12:25 kurt Exp $ */
+/* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2006 The OpenLDAP Foundation.
+ * Copyright 2004-2010 The OpenLDAP Foundation.
  * Portions Copyright 2004 Symas Corporation.
  * All rights reserved.
  *
@@ -26,8 +26,8 @@
  * DN whenever the DN is changed or its entry is deleted, and making
  * the appropriate update.
  *
- * Updates are performed using the database rootdn, but the ModifiersName
- * is always set to refint_dn.
+ * Updates are performed using the database rootdn in a separate task
+ * to allow the original operation to complete immediately.
  */
 
 #ifdef SLAPD_OVER_REFINT
@@ -38,157 +38,312 @@
 #include <ac/socket.h>
 
 #include "slap.h"
+#include "config.h"
+#include "ldap_rq.h"
 
 static slap_overinst refint;
 
 /* The DN to use in the ModifiersName for all refint updates */
 static BerValue refint_dn = BER_BVC("cn=Referential Integrity Overlay");
+static BerValue refint_ndn = BER_BVC("cn=referential integrity overlay");
 
 typedef struct refint_attrs_s {
-	struct refint_attrs_s *next;
-	AttributeDescription *attr;
+	struct refint_attrs_s	*next;
+	AttributeDescription	*attr;
+	BerVarray		old_vals;
+	BerVarray		old_nvals;
+	BerVarray		new_vals;
+	BerVarray		new_nvals;
+	int				ra_numvals;
+	int				dont_empty;
 } refint_attrs;
 
 typedef struct dependents_s {
 	struct dependents_s *next;
 	BerValue dn;				/* target dn */
-	Modifications *mm;
+	BerValue ndn;
+	refint_attrs *attrs;
 } dependent_data;
 
+typedef struct refint_q {
+	struct refint_q *next;
+	struct refint_data_s *rdata;
+	dependent_data *attrs;		/* entries and attrs returned from callback */
+	BackendDB *db;
+	BerValue olddn;
+	BerValue oldndn;
+	BerValue newdn;
+	BerValue newndn;
+} refint_q;
+
 typedef struct refint_data_s {
-	const char *message;			/* breadcrumbs */
 	struct refint_attrs_s *attrs;	/* list of known attrs */
-	struct dependents_s *mods;		/* modifications returned from callback */
-	BerValue dn;				/* basedn in parent, searchdn in call */
-	BerValue newdn;				/* replacement value for modrdn callback */
-	BerValue nnewdn;			/* normalized replacement value */
+	BerValue dn;				/* basedn in parent, */
 	BerValue nothing;			/* the nothing value, if needed */
 	BerValue nnothing;			/* normalized nothingness */
+	BerValue refint_dn;			/* modifier's name */
+	BerValue refint_ndn;			/* normalized modifier's name */
+	struct re_s *qtask;
+	refint_q *qhead;
+	refint_q *qtail;
+	ldap_pvt_thread_mutex_t qmutex;
 } refint_data;
 
+#define	RUNQ_INTERVAL	36000	/* a long time */
+
+static MatchingRule	*mr_dnSubtreeMatch;
+
+enum {
+	REFINT_ATTRS = 1,
+	REFINT_NOTHING,
+	REFINT_MODIFIERSNAME
+};
+
+static ConfigDriver refint_cf_gen;
+
+static ConfigTable refintcfg[] = {
+	{ "refint_attributes", "attribute...", 2, 0, 0,
+	  ARG_MAGIC|REFINT_ATTRS, refint_cf_gen,
+	  "( OLcfgOvAt:11.1 NAME 'olcRefintAttribute' "
+	  "DESC 'Attributes for referential integrity' "
+	  "EQUALITY caseIgnoreMatch "
+	  "SYNTAX OMsDirectoryString )", NULL, NULL },
+	{ "refint_nothing", "string", 2, 2, 0,
+	  ARG_DN|ARG_MAGIC|REFINT_NOTHING, refint_cf_gen,
+	  "( OLcfgOvAt:11.2 NAME 'olcRefintNothing' "
+	  "DESC 'Replacement DN to supply when needed' "
+	  "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
+	{ "refint_modifiersName", "DN", 2, 2, 0,
+	  ARG_DN|ARG_MAGIC|REFINT_MODIFIERSNAME, refint_cf_gen,
+	  "( OLcfgOvAt:11.3 NAME 'olcRefintModifiersName' "
+	  "DESC 'The DN to use as modifiersName' "
+	  "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
+	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
+};
+
+static ConfigOCs refintocs[] = {
+	{ "( OLcfgOvOc:11.1 "
+	  "NAME 'olcRefintConfig' "
+	  "DESC 'Referential integrity configuration' "
+	  "SUP olcOverlayConfig "
+	  "MAY ( olcRefintAttribute "
+		"$ olcRefintNothing "
+		"$ olcRefintModifiersName "
+	  ") )",
+	  Cft_Overlay, refintcfg },
+	{ NULL, 0, NULL }
+};
+
+static int
+refint_cf_gen(ConfigArgs *c)
+{
+	slap_overinst *on = (slap_overinst *)c->bi;
+	refint_data *dd = (refint_data *)on->on_bi.bi_private;
+	refint_attrs *ip, *pip, **pipp = NULL;
+	AttributeDescription *ad;
+	const char *text;
+	int rc = ARG_BAD_CONF;
+	int i;
+
+	switch ( c->op ) {
+	case SLAP_CONFIG_EMIT:
+		switch ( c->type ) {
+		case REFINT_ATTRS:
+			ip = dd->attrs;
+			while ( ip ) {
+				value_add_one( &c->rvalue_vals,
+					       &ip->attr->ad_cname );
+				ip = ip->next;
+			}
+			rc = 0;
+			break;
+		case REFINT_NOTHING:
+			if ( !BER_BVISEMPTY( &dd->nothing )) {
+				rc = value_add_one( &c->rvalue_vals,
+						    &dd->nothing );
+				if ( rc ) return rc;
+				rc = value_add_one( &c->rvalue_nvals,
+						    &dd->nnothing );
+				return rc;
+			}
+			rc = 0;
+			break;
+		case REFINT_MODIFIERSNAME:
+			if ( !BER_BVISEMPTY( &dd->refint_dn )) {
+				rc = value_add_one( &c->rvalue_vals,
+						    &dd->refint_dn );
+				if ( rc ) return rc;
+				rc = value_add_one( &c->rvalue_nvals,
+						    &dd->refint_ndn );
+				return rc;
+			}
+			rc = 0;
+			break;
+		default:
+			abort ();
+		}
+		break;
+	case LDAP_MOD_DELETE:
+		switch ( c->type ) {
+		case REFINT_ATTRS:
+			pipp = &dd->attrs;
+			if ( c->valx < 0 ) {
+				ip = *pipp;
+				*pipp = NULL;
+				while ( ip ) {
+					pip = ip;
+					ip = ip->next;
+					ch_free ( pip );
+				}
+			} else {
+				/* delete from linked list */
+				for ( i=0; i < c->valx; ++i ) {
+					pipp = &(*pipp)->next;
+				}
+				ip = *pipp;
+				*pipp = (*pipp)->next;
+
+				/* AttributeDescriptions are global so
+				 * shouldn't be freed here... */
+				ch_free ( ip );
+			}
+			rc = 0;
+			break;
+		case REFINT_NOTHING:
+			ch_free( dd->nothing.bv_val );
+			ch_free( dd->nnothing.bv_val );
+			BER_BVZERO( &dd->nothing );
+			BER_BVZERO( &dd->nnothing );
+			rc = 0;
+			break;
+		case REFINT_MODIFIERSNAME:
+			ch_free( dd->refint_dn.bv_val );
+			ch_free( dd->refint_ndn.bv_val );
+			BER_BVZERO( &dd->refint_dn );
+			BER_BVZERO( &dd->refint_ndn );
+			rc = 0;
+			break;
+		default:
+			abort ();
+		}
+		break;
+	case SLAP_CONFIG_ADD:
+		/* fallthrough to LDAP_MOD_ADD */
+	case LDAP_MOD_ADD:
+		switch ( c->type ) {
+		case REFINT_ATTRS:
+			rc = 0;
+			for ( i=1; i < c->argc; ++i ) {
+				ad = NULL;
+				if ( slap_str2ad ( c->argv[i], &ad, &text )
+				     == LDAP_SUCCESS) {
+					ip = ch_malloc (
+						sizeof ( refint_attrs ) );
+					ip->attr = ad;
+					ip->next = dd->attrs;
+					dd->attrs = ip;
+				} else {
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"%s <%s>: %s", c->argv[0], c->argv[i], text );
+					Debug ( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
+						"%s: %s\n", c->log, c->cr_msg, 0 );
+					rc = ARG_BAD_CONF;
+				}
+			}
+			break;
+		case REFINT_NOTHING:
+			if ( !BER_BVISNULL( &c->value_ndn )) {
+				ch_free ( dd->nothing.bv_val );
+				ch_free ( dd->nnothing.bv_val );
+				dd->nothing = c->value_dn;
+				dd->nnothing = c->value_ndn;
+				rc = 0;
+			} else {
+				rc = ARG_BAD_CONF;
+			}
+			break;
+		case REFINT_MODIFIERSNAME:
+			if ( !BER_BVISNULL( &c->value_ndn )) {
+				ch_free( dd->refint_dn.bv_val );
+				ch_free( dd->refint_ndn.bv_val );
+				dd->refint_dn = c->value_dn;
+				dd->refint_ndn = c->value_ndn;
+				rc = 0;
+			} else {
+				rc = ARG_BAD_CONF;
+			}
+			break;
+		default:
+			abort ();
+		}
+		break;
+	default:
+		abort ();
+	}
+
+	return rc;
+}
+
 /*
 ** allocate new refint_data;
-** initialize, copy basedn;
 ** store in on_bi.bi_private;
 **
 */
 
 static int
 refint_db_init(
-	BackendDB	*be
+	BackendDB	*be,
+	ConfigReply	*cr
 )
 {
 	slap_overinst *on = (slap_overinst *)be->bd_info;
-	refint_data *id = ch_malloc(sizeof(refint_data));
+	refint_data *id = ch_calloc(1,sizeof(refint_data));
 
-	id->message = "_init";
-	id->attrs = NULL;
-	id->newdn.bv_val = NULL;
-	id->nothing.bv_val = NULL;
-	id->nnothing.bv_val = NULL;
-	ber_dupbv( &id->dn, &be->be_nsuffix[0] );
 	on->on_bi.bi_private = id;
+	ldap_pvt_thread_mutex_init( &id->qmutex );
 	return(0);
 }
 
-
-/*
-** if command = attributes:
-**	foreach argument:
-**		convert to attribute;
-**		add to configured attribute list;
-** elseif command = basedn:
-**	set our basedn to argument;
-**
-*/
-
 static int
-refint_config(
+refint_db_destroy(
 	BackendDB	*be,
-	const char	*fname,
-	int		lineno,
-	int		argc,
-	char		**argv
+	ConfigReply	*cr
 )
 {
-	slap_overinst *on	= (slap_overinst *) be->bd_info;
-	refint_data *id	= on->on_bi.bi_private;
-	refint_attrs *ip;
-	const char *text;
-	AttributeDescription *ad;
-	BerValue dn;
-	int i;
+	slap_overinst *on = (slap_overinst *)be->bd_info;
 
-	if(!strcasecmp(*argv, "refint_attributes")) {
-		for(i = 1; i < argc; i++) {
-			for(ip = id->attrs; ip; ip = ip->next)
-			    if(!strcmp(argv[i], ip->attr->ad_cname.bv_val)) {
-				Debug(LDAP_DEBUG_ANY,
-					"%s: line %d: duplicate attribute <s>, ignored\n",
-					fname, lineno, argv[i]);
-				continue;
-			}
-			ad = NULL;
-			if(slap_str2ad(argv[i], &ad, &text) != LDAP_SUCCESS) {
-				Debug(LDAP_DEBUG_ANY,
-					"%s: line %d: bad attribute <%s>, ignored\n",
-					fname, lineno, text);
-				continue;		/* XXX */
-			} else if(ad->ad_next) {
-				Debug(LDAP_DEBUG_ANY,
-					"%s: line %d: multiple attributes match <%s>, ignored\n",
-					fname, lineno, argv[i]);
-				continue;
-			}
-			ip = ch_malloc(sizeof(refint_attrs));
-			ip->attr = ad;
-			ip->next = id->attrs;
-			id->attrs = ip;
-			Debug(LDAP_DEBUG_ANY, "%s: line %d: new attribute <%s>\n",
-				fname, lineno, argv[i]);
-		}
-	} else if(!strcasecmp(*argv, "refint_base")) {
-		/* XXX only one basedn (yet) - need validate argument! */
-		if(id->dn.bv_val) ch_free(id->dn.bv_val);
-		ber_str2bv( argv[1], 0, 0, &dn );
-		Debug(LDAP_DEBUG_ANY, "%s: line %d: new baseDN <%s>\n",
-			fname, lineno, argv[1]);
-		if(dnNormalize(0, NULL, NULL, &dn, &id->dn, NULL)) {
-			Debug(LDAP_DEBUG_ANY, "%s: line %d: bad baseDN!\n", fname, lineno, 0);
-			return(1);
-		}
-	} else if(!strcasecmp(*argv, "refint_nothing")) {
-		if(id->nothing.bv_val) ch_free(id->nothing.bv_val);
-		if(id->nnothing.bv_val) ch_free(id->nnothing.bv_val);
-		ber_str2bv( argv[1], 0, 1, &id->nothing );
-		if(dnNormalize(0, NULL, NULL, &id->nothing, &id->nnothing, NULL)) {
-			Debug(LDAP_DEBUG_ANY, "%s: line %d: bad nothingDN!\n", fname, lineno, 0);
-			return(1);
-		}
-		Debug(LDAP_DEBUG_ANY, "%s: line %d: new nothingDN<%s>\n",
-			fname, lineno, argv[1]);
-	} else {
-		return(SLAP_CONF_UNKNOWN);
+	if ( on->on_bi.bi_private ) {
+		refint_data *id = on->on_bi.bi_private;
+		on->on_bi.bi_private = NULL;
+		ldap_pvt_thread_mutex_destroy( &id->qmutex );
+		ch_free( id );
 	}
-
-	id->message = "_config";
 	return(0);
 }
 
-
 /*
-** nothing really happens here;
+** initialize, copy basedn if not already set
 **
 */
 
 static int
 refint_open(
-	BackendDB *be
+	BackendDB *be,
+	ConfigReply *cr
 )
 {
 	slap_overinst *on	= (slap_overinst *)be->bd_info;
 	refint_data *id	= on->on_bi.bi_private;
-	id->message		= "_open";
+
+	if ( BER_BVISNULL( &id->dn )) {
+		if ( BER_BVISNULL( &be->be_nsuffix[0] ))
+			return -1;
+		ber_dupbv( &id->dn, &be->be_nsuffix[0] );
+	}
+	if ( BER_BVISNULL( &id->refint_dn ) ) {
+		ber_dupbv( &id->refint_dn, &refint_dn );
+		ber_dupbv( &id->refint_ndn, &refint_ndn );
+	}
 	return(0);
 }
 
@@ -197,7 +352,6 @@ refint_open(
 ** foreach configured attribute:
 **	free it;
 ** free our basedn;
-** (do not) free id->message;
 ** reset on_bi.bi_private;
 ** free our config data;
 **
@@ -205,229 +359,481 @@ refint_open(
 
 static int
 refint_close(
-	BackendDB *be
+	BackendDB *be,
+	ConfigReply *cr
 )
 {
 	slap_overinst *on	= (slap_overinst *) be->bd_info;
 	refint_data *id	= on->on_bi.bi_private;
 	refint_attrs *ii, *ij;
-	id->message		= "_close";
 
 	for(ii = id->attrs; ii; ii = ij) {
 		ij = ii->next;
 		ch_free(ii);
 	}
+	id->attrs = NULL;
 
-	ch_free(id->dn.bv_val);
-	ch_free(id->nothing.bv_val);
-	ch_free(id->nnothing.bv_val);
-
-	on->on_bi.bi_private = NULL;	/* XXX */
-
-	ch_free(id);
+	ch_free( id->dn.bv_val );
+	BER_BVZERO( &id->dn );
+	ch_free( id->nothing.bv_val );
+	BER_BVZERO( &id->nothing );
+	ch_free( id->nnothing.bv_val );
+	BER_BVZERO( &id->nnothing );
+	ch_free( id->refint_dn.bv_val );
+	BER_BVZERO( &id->refint_dn );
+	ch_free( id->refint_ndn.bv_val );
+	BER_BVZERO( &id->refint_ndn );
 
 	return(0);
 }
 
 /*
-** delete callback
-** generates a list of Modification* from search results
+** search callback
+** generates a list of Attributes from search results
 */
 
 static int
-refint_delete_cb(
+refint_search_cb(
 	Operation *op,
 	SlapReply *rs
 )
 {
 	Attribute *a;
 	BerVarray b = NULL;
-	refint_data *dd = op->o_callback->sc_private;
-	refint_attrs *ia, *da = dd->attrs;
+	refint_q *rq = op->o_callback->sc_private;
+	refint_data *dd = rq->rdata;
+	refint_attrs *ia, *da = dd->attrs, *na;
 	dependent_data *ip;
-	Modifications *mp, *ma;
 	int i;
 
-	Debug(LDAP_DEBUG_TRACE, "refint_delete_cb <%s>\n",
+	Debug(LDAP_DEBUG_TRACE, "refint_search_cb <%s>\n",
 		rs->sr_entry ? rs->sr_entry->e_name.bv_val : "NOTHING", 0, 0);
 
 	if (rs->sr_type != REP_SEARCH || !rs->sr_entry) return(0);
-	dd->message = "_delete_cb";
 
 	/*
 	** foreach configured attribute type:
 	**	if this attr exists in the search result,
 	**	and it has a value matching the target:
-	**		allocate a Modification;
-	**		allocate its array of 2 BerValues;
-	**		if only one value, and we have a configured Nothing:
-	**			allocate additional Modification
-	**			type = MOD_ADD
-	**			BerValues[] = { Nothing, NULL };
-	**			add to list
-	**		type = MOD_DELETE
-	**		BerValues[] = { our target dn, NULL };
-	**	add this mod to the list of mods;
+	**		allocate an attr;
+	**		handle olcRefintNothing;
 	**
 	*/
 
-	ip = ch_malloc(sizeof(dependent_data));
-	ip->dn.bv_val = NULL;
-	ip->next = NULL;
-	ip->mm = NULL;
-	ma = NULL;
+	ip = op->o_tmpalloc(sizeof(dependent_data), op->o_tmpmemctx );
+	ber_dupbv_x( &ip->dn, &rs->sr_entry->e_name, op->o_tmpmemctx );
+	ber_dupbv_x( &ip->ndn, &rs->sr_entry->e_nname, op->o_tmpmemctx );
+	ip->next = rq->attrs;
+	rq->attrs = ip;
+	ip->attrs = NULL;
 	for(ia = da; ia; ia = ia->next) {
-	    if ( (a = attr_find(rs->sr_entry->e_attrs, ia->attr) ) )
-		for(i = 0, b = a->a_nvals; b[i].bv_val; i++)
-		    if(bvmatch(&dd->dn, &b[i])) {
-			if(!ip->dn.bv_val) ber_dupbv(&ip->dn, &rs->sr_entry->e_nname);
-			if(!b[1].bv_val && dd->nothing.bv_val) {
-				mp = ch_malloc(sizeof(Modifications));
-				mp->sml_desc = ia->attr;		/* XXX */
-				mp->sml_type = a->a_desc->ad_cname;
-				mp->sml_values  = ch_malloc(2 * sizeof(BerValue));
-				mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
-				mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
-				mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
-
-				mp->sml_op = LDAP_MOD_ADD;
-				mp->sml_flags = 0;
-				ber_dupbv(&mp->sml_values[0],  &dd->nothing);
-				ber_dupbv(&mp->sml_nvalues[0], &dd->nnothing);
-				mp->sml_next = ma;
-				ma = mp;
-			}
-		 	/* this might violate the object class */
-			mp = ch_malloc(sizeof(Modifications));
-			mp->sml_desc = ia->attr;		/* XXX */
-			mp->sml_type = a->a_desc->ad_cname;
-			mp->sml_values  = ch_malloc(2 * sizeof(BerValue));
-			mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
-			mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
-			mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
-			mp->sml_op = LDAP_MOD_DELETE;
-			mp->sml_flags = 0;
-			ber_dupbv(&mp->sml_values[0], &dd->dn);
-			ber_dupbv(&mp->sml_nvalues[0], &mp->sml_values[0]);
-			mp->sml_next = ma;
-			ma = mp;
-			Debug(LDAP_DEBUG_TRACE, "refint_delete_cb: %s: %s\n",
-				a->a_desc->ad_cname.bv_val, dd->dn.bv_val, 0);
-			break;
-	    }
+		if ( (a = attr_find(rs->sr_entry->e_attrs, ia->attr) ) ) {
+			int		first = -1, count = 0, deleted = 0;
+
+			na = NULL;
+
+			for(i = 0, b = a->a_nvals; b[i].bv_val; i++) {
+				if(dnIsSuffix(&b[i], &rq->oldndn)) {
+					/* first match? create structure */
+					if ( na == NULL ) {
+						na = op->o_tmpcalloc( 1,
+							sizeof( refint_attrs ),
+							op->o_tmpmemctx );
+						na->next = ip->attrs;
+						ip->attrs = na;
+						na->attr = ia->attr;
+
+						/* delete, or exact match? note it's first match */
+						if ( BER_BVISEMPTY( &rq->newdn ) &&
+							b[i].bv_len == rq->oldndn.bv_len )
+						{
+							first = i;
+						}
+					}
+
+					/* if it's a rename, or a subordinate match,
+					 * save old and build new dn */
+					if ( !BER_BVISEMPTY( &rq->newdn ) &&
+						b[i].bv_len != rq->oldndn.bv_len )
+					{
+						struct berval	newsub, newdn, olddn, oldndn;
+
+						/* if not first, save first as well */
+						if ( first != -1 ) {
+
+							ber_dupbv_x( &olddn, &a->a_vals[first], op->o_tmpmemctx );
+							ber_bvarray_add_x( &na->old_vals, &olddn, op->o_tmpmemctx );
+							ber_dupbv_x( &oldndn, &a->a_nvals[first], op->o_tmpmemctx );
+							ber_bvarray_add_x( &na->old_nvals, &oldndn, op->o_tmpmemctx );
+							na->ra_numvals++;
+
+							newsub = a->a_vals[first];
+							newsub.bv_len -= rq->olddn.bv_len + 1;
+
+							build_new_dn( &newdn, &rq->newdn, &newsub, op->o_tmpmemctx );
+
+							ber_bvarray_add_x( &na->new_vals, &newdn, op->o_tmpmemctx );
+
+							newsub = a->a_nvals[first];
+							newsub.bv_len -= rq->oldndn.bv_len + 1;
+
+							build_new_dn( &newdn, &rq->newndn, &newsub, op->o_tmpmemctx );
+
+							ber_bvarray_add_x( &na->new_nvals, &newdn, op->o_tmpmemctx );
+							
+							first = -1;
+						}
+
+						ber_dupbv_x( &olddn, &a->a_vals[i], op->o_tmpmemctx );
+						ber_bvarray_add_x( &na->old_vals, &olddn, op->o_tmpmemctx );
+						ber_dupbv_x( &oldndn, &a->a_nvals[i], op->o_tmpmemctx );
+						ber_bvarray_add_x( &na->old_nvals, &oldndn, op->o_tmpmemctx );
+						na->ra_numvals++;
+
+						newsub = a->a_vals[i];
+						newsub.bv_len -= rq->olddn.bv_len + 1;
+
+						build_new_dn( &newdn, &rq->newdn, &newsub, op->o_tmpmemctx );
+
+						ber_bvarray_add_x( &na->new_vals, &newdn, op->o_tmpmemctx );
+
+						newsub = a->a_nvals[i];
+						newsub.bv_len -= rq->oldndn.bv_len + 1;
+
+						build_new_dn( &newdn, &rq->newndn, &newsub, op->o_tmpmemctx );
+
+						ber_bvarray_add_x( &na->new_nvals, &newdn, op->o_tmpmemctx );
+					}
+
+					/* count deletes */
+					if ( BER_BVISEMPTY( &rq->newdn ) ) {
+						deleted++;
+					}
+				}
+			}
+
+			/* Deleting/replacing all values and a nothing DN is configured? */
+			if ( deleted == i && na && !BER_BVISNULL(&dd->nothing) )
+				na->dont_empty = 1;
+
+			Debug( LDAP_DEBUG_TRACE, "refint_search_cb: %s: %s (#%d)\n",
+				a->a_desc->ad_cname.bv_val, rq->olddn.bv_val, i );
+		}
 	}
-	ip->mm = ma;
-	ip->next = dd->mods;
-	dd->mods = ip;
 
 	return(0);
 }
 
-/*
-** null callback
-** does nothing
-*/
-
 static int
-refint_null_cb(
-	Operation *op,
-	SlapReply *rs
-)
+refint_repair(
+	Operation	*op,
+	SlapReply	*rs,
+	refint_data	*id,
+	refint_q	*rq )
 {
-	((refint_data *)op->o_callback->sc_private)->message = "_null_cb";
-	return(LDAP_SUCCESS);
-}
+	dependent_data	*dp;
+	int		rc;
 
-/*
-** modrdn callback
-** generates a list of Modification* from search results
-*/
+	op->o_callback->sc_response = refint_search_cb;
+	op->o_req_dn = op->o_bd->be_suffix[ 0 ];
+	op->o_req_ndn = op->o_bd->be_nsuffix[ 0 ];
+	op->o_dn = op->o_bd->be_rootdn;
+	op->o_ndn = op->o_bd->be_rootndn;
 
-static int
-refint_modrdn_cb(
-	Operation *op,
-	SlapReply *rs
-)
-{
-	Attribute *a;
-	BerVarray b = NULL;
-	refint_data *dd = op->o_callback->sc_private;
-	refint_attrs *ia, *da = dd->attrs;
-	dependent_data *ip = NULL;
-	Modifications *mp;
-	int i, fix;
+	/* search */
+	rc = op->o_bd->be_search( op, rs );
 
-	Debug(LDAP_DEBUG_TRACE, "refint_modrdn_cb <%s>\n",
-		rs->sr_entry ? rs->sr_entry->e_name.bv_val : "NOTHING", 0, 0);
+	if ( rc != LDAP_SUCCESS ) {
+		Debug( LDAP_DEBUG_TRACE,
+			"refint_repair: search failed: %d\n",
+			rc, 0, 0 );
+		return 0;
+	}
 
-	if (rs->sr_type != REP_SEARCH || !rs->sr_entry) return(0);
-	dd->message = "_modrdn_cb";
+	/* safety? paranoid just in case */
+	if ( op->o_callback->sc_private == NULL ) {
+		Debug( LDAP_DEBUG_TRACE,
+			"refint_repair: callback wiped out sc_private?!\n",
+			0, 0, 0 );
+		return 0;
+	}
+
+	/* Set up the Modify requests */
+	op->o_callback->sc_response = &slap_null_cb;
 
 	/*
-	** foreach configured attribute type:
-	**   if this attr exists in the search result,
-	**   and it has a value matching the target:
-	**	allocate a pair of Modifications;
-	**	make it MOD_ADD the new value and MOD_DELETE the old;
-	**	allocate its array of BerValues;
-	**	foreach value in the search result:
-	**	   if it matches our target value, replace it;
-	**	   otherwise, copy from the search result;
-	**	terminate the array of BerValues;
-	**   add these mods to the list of mods;
+	 * [our search callback builds a list of attrs]
+	 * foreach attr:
+	 *	make sure its dn has a backend;
+	 *	build Modification* chain;
+	 *	call the backend modify function;
+	 *
+	 */
+
+	for ( dp = rq->attrs; dp; dp = dp->next ) {
+		Operation	op2 = *op;
+		SlapReply	rs2 = { 0 };
+		refint_attrs	*ra;
+		Modifications	*m;
+
+		op2.o_tag = LDAP_REQ_MODIFY;
+		op2.orm_modlist = NULL;
+		op2.o_req_dn	= dp->dn;
+		op2.o_req_ndn	= dp->ndn;
+		op2.o_bd = select_backend( &dp->ndn, 1 );
+		if ( !op2.o_bd ) {
+			Debug( LDAP_DEBUG_TRACE,
+				"refint_repair: no backend for DN %s!\n",
+				dp->dn.bv_val, 0, 0 );
+			continue;
+		}
+
+		rs2.sr_type = REP_RESULT;
+		for ( ra = dp->attrs; ra; ra = ra->next ) {
+			size_t	len;
+
+			/* Set our ModifiersName */
+			if ( SLAP_LASTMOD( op->o_bd ) ) {
+				m = op2.o_tmpalloc( sizeof(Modifications) +
+					4*sizeof(BerValue), op2.o_tmpmemctx );
+				m->sml_next = op2.orm_modlist;
+				op2.orm_modlist = m;
+				m->sml_op = LDAP_MOD_REPLACE;
+				m->sml_flags = SLAP_MOD_INTERNAL;
+				m->sml_desc = slap_schema.si_ad_modifiersName;
+				m->sml_type = m->sml_desc->ad_cname;
+				m->sml_numvals = 1;
+				m->sml_values = (BerVarray)(m+1);
+				m->sml_nvalues = m->sml_values+2;
+				BER_BVZERO( &m->sml_values[1] );
+				BER_BVZERO( &m->sml_nvalues[1] );
+				m->sml_values[0] = id->refint_dn;
+				m->sml_nvalues[0] = id->refint_ndn;
+			}
+
+			/* Add values */
+			if ( ra->dont_empty || !BER_BVISEMPTY( &rq->newdn ) ) {
+				len = sizeof(Modifications);
+
+				if ( ra->new_vals == NULL ) {
+					len += 4*sizeof(BerValue);
+				}
+
+				m = op2.o_tmpalloc( len, op2.o_tmpmemctx );
+				m->sml_next = op2.orm_modlist;
+				op2.orm_modlist = m;
+				m->sml_op = LDAP_MOD_ADD;
+				m->sml_flags = 0;
+				m->sml_desc = ra->attr;
+				m->sml_type = ra->attr->ad_cname;
+				if ( ra->new_vals == NULL ) {
+					m->sml_values = (BerVarray)(m+1);
+					m->sml_nvalues = m->sml_values+2;
+					BER_BVZERO( &m->sml_values[1] );
+					BER_BVZERO( &m->sml_nvalues[1] );
+					m->sml_numvals = 1;
+					if ( BER_BVISEMPTY( &rq->newdn ) ) {
+						m->sml_values[0] = id->nothing;
+						m->sml_nvalues[0] = id->nnothing;
+					} else {
+						m->sml_values[0] = rq->newdn;
+						m->sml_nvalues[0] = rq->newndn;
+					}
+				} else {
+					m->sml_values = ra->new_vals;
+					m->sml_nvalues = ra->new_nvals;
+					m->sml_numvals = ra->ra_numvals;
+				}
+			}
+
+			/* Delete values */
+			len = sizeof(Modifications);
+			if ( ra->old_vals == NULL ) {
+				len += 4*sizeof(BerValue);
+			}
+			m = op2.o_tmpalloc( len, op2.o_tmpmemctx );
+			m->sml_next = op2.orm_modlist;
+			op2.orm_modlist = m;
+			m->sml_op = LDAP_MOD_DELETE;
+			m->sml_flags = 0;
+			m->sml_desc = ra->attr;
+			m->sml_type = ra->attr->ad_cname;
+			if ( ra->old_vals == NULL ) {
+				m->sml_numvals = 1;
+				m->sml_values = (BerVarray)(m+1);
+				m->sml_nvalues = m->sml_values+2;
+				m->sml_values[0] = rq->olddn;
+				m->sml_nvalues[0] = rq->oldndn;
+				BER_BVZERO( &m->sml_values[1] );
+				BER_BVZERO( &m->sml_nvalues[1] );
+			} else {
+				m->sml_values = ra->old_vals;
+				m->sml_nvalues = ra->old_nvals;
+				m->sml_numvals = ra->ra_numvals;
+			}
+		}
+
+		op2.o_dn = op2.o_bd->be_rootdn;
+		op2.o_ndn = op2.o_bd->be_rootndn;
+		slap_op_time( &op2.o_time, &op2.o_tincr );
+		if ( ( rc = op2.o_bd->be_modify( &op2, &rs2 ) ) != LDAP_SUCCESS ) {
+			Debug( LDAP_DEBUG_TRACE,
+				"refint_repair: dependent modify failed: %d\n",
+				rs2.sr_err, 0, 0 );
+		}
+
+		while ( ( m = op2.orm_modlist ) ) {
+			op2.orm_modlist = m->sml_next;
+			op2.o_tmpfree( m, op2.o_tmpmemctx );
+		}
+	}
+
+	return 0;
+}
+
+static void *
+refint_qtask( void *ctx, void *arg )
+{
+	struct re_s *rtask = arg;
+	refint_data *id = rtask->arg;
+	Connection conn = {0};
+	OperationBuffer opbuf;
+	Operation *op;
+	SlapReply rs = {REP_RESULT};
+	slap_callback cb = { NULL, NULL, NULL, NULL };
+	Filter ftop, *fptr;
+	refint_q *rq;
+	refint_attrs *ip;
+
+	connection_fake_init( &conn, &opbuf, ctx );
+	op = &opbuf.ob_op;
+
+	/*
+	** build a search filter for all configured attributes;
+	** populate our Operation;
+	** pass our data (attr list, dn) to backend via sc_private;
+	** call the backend search function;
+	** nb: (|(one=thing)) is valid, but do smart formatting anyway;
+	** nb: 16 is arbitrarily a dozen or so extra bytes;
 	**
 	*/
 
-	for(ia = da; ia; ia = ia->next) {
-	    if((a = attr_find(rs->sr_entry->e_attrs, ia->attr))) {
-		    for(fix = 0, i = 0, b = a->a_nvals; b[i].bv_val; i++)
-			if(bvmatch(&dd->dn, &b[i])) { fix++; break; }
-		    if(fix) {
-			if (!ip) {
-	    		    ip = ch_malloc(sizeof(dependent_data));
-	    		    ip->next = NULL;
-	    		    ip->mm = NULL;
-	    		    ber_dupbv(&ip->dn, &rs->sr_entry->e_nname);
-			}
-			mp = ch_malloc(sizeof(Modifications));
-			mp->sml_op = LDAP_MOD_ADD;
-			mp->sml_flags = 0;
-			mp->sml_desc = ia->attr;		/* XXX */
-			mp->sml_type = ia->attr->ad_cname;
-			mp->sml_values  = ch_malloc(2 * sizeof(BerValue));
-			mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
-			ber_dupbv(&mp->sml_values[0], &dd->newdn);
-			ber_dupbv(&mp->sml_nvalues[0], &dd->nnewdn);
-			mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
-			mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
-			mp->sml_next = ip->mm;
-			ip->mm = mp;
-			mp = ch_malloc(sizeof(Modifications));
-			mp->sml_op = LDAP_MOD_DELETE;
-			mp->sml_flags = 0;
-			mp->sml_desc = ia->attr;		/* XXX */
-			mp->sml_type = ia->attr->ad_cname;
-			mp->sml_values  = ch_malloc(2 * sizeof(BerValue));
-			mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
-			ber_dupbv(&mp->sml_values[0], &dd->dn);
-			ber_dupbv(&mp->sml_nvalues[0], &dd->dn);
-			mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
-			mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
-			mp->sml_next = ip->mm;
-			ip->mm = mp;
-			Debug(LDAP_DEBUG_TRACE, "refint_modrdn_cb: %s: %s\n",
-				a->a_desc->ad_cname.bv_val, dd->dn.bv_val, 0);
-		}
-	    }
-	}
-	if (ip) {
-		ip->next = dd->mods;
-		dd->mods = ip;
+	ftop.f_choice = LDAP_FILTER_OR;
+	ftop.f_next = NULL;
+	ftop.f_or = NULL;
+	op->ors_filter = &ftop;
+	for(ip = id->attrs; ip; ip = ip->next) {
+		fptr = op->o_tmpcalloc( sizeof(Filter) + sizeof(MatchingRuleAssertion),
+			1, op->o_tmpmemctx );
+		/* Use (attr:dnSubtreeMatch:=value) to catch subtree rename
+		 * and subtree delete where supported */
+		fptr->f_choice = LDAP_FILTER_EXT;
+		fptr->f_mra = (MatchingRuleAssertion *)(fptr+1);
+		fptr->f_mr_rule = mr_dnSubtreeMatch;
+		fptr->f_mr_rule_text = mr_dnSubtreeMatch->smr_bvoid;
+		fptr->f_mr_desc = ip->attr;
+		fptr->f_mr_dnattrs = 0;
+		fptr->f_next = ftop.f_or;
+		ftop.f_or = fptr;
 	}
 
-	return(0);
-}
+	for (;;) {
+		dependent_data	*dp, *dp_next;
+		refint_attrs *ra, *ra_next;
+
+		/* Dequeue an op */
+		ldap_pvt_thread_mutex_lock( &id->qmutex );
+		rq = id->qhead;
+		if ( rq ) {
+			id->qhead = rq->next;
+			if ( !id->qhead )
+				id->qtail = NULL;
+		}
+		ldap_pvt_thread_mutex_unlock( &id->qmutex );
+		if ( !rq )
+			break;
+
+		for (fptr = ftop.f_or; fptr; fptr = fptr->f_next )
+			fptr->f_mr_value = rq->oldndn;
+
+		filter2bv_x( op, op->ors_filter, &op->ors_filterstr );
 
+		/* callback gets the searched dn instead */
+		cb.sc_private	= rq;
+		cb.sc_response	= refint_search_cb;
+		op->o_callback	= &cb;
+		op->o_tag	= LDAP_REQ_SEARCH;
+		op->ors_scope	= LDAP_SCOPE_SUBTREE;
+		op->ors_deref	= LDAP_DEREF_NEVER;
+		op->ors_limit   = NULL;
+		op->ors_slimit	= SLAP_NO_LIMIT;
+		op->ors_tlimit	= SLAP_NO_LIMIT;
+
+		/* no attrs! */
+		op->ors_attrs = slap_anlist_no_attrs;
+
+		slap_op_time( &op->o_time, &op->o_tincr );
+
+		if ( rq->db != NULL ) {
+			op->o_bd = rq->db;
+			refint_repair( op, &rs, id, rq );
+
+		} else {
+			BackendDB	*be;
+
+			LDAP_STAILQ_FOREACH( be, &backendDB, be_next ) {
+				/* we may want to skip cn=config */
+				if ( be == LDAP_STAILQ_FIRST(&backendDB) ) {
+					continue;
+				}
+
+				if ( be->be_search && be->be_modify ) {
+					op->o_bd = be;
+					refint_repair( op, &rs, id, rq );
+				}
+			}
+		}
+
+		for ( dp = rq->attrs; dp; dp = dp_next ) {
+			dp_next = dp->next;
+			for ( ra = dp->attrs; ra; ra = ra_next ) {
+				ra_next = ra->next;
+				ber_bvarray_free_x( ra->new_nvals, op->o_tmpmemctx );
+				ber_bvarray_free_x( ra->new_vals, op->o_tmpmemctx );
+				ber_bvarray_free_x( ra->old_nvals, op->o_tmpmemctx );
+				ber_bvarray_free_x( ra->old_vals, op->o_tmpmemctx );
+				op->o_tmpfree( ra, op->o_tmpmemctx );
+			}
+			op->o_tmpfree( dp->ndn.bv_val, op->o_tmpmemctx );
+			op->o_tmpfree( dp->dn.bv_val, op->o_tmpmemctx );
+			op->o_tmpfree( dp, op->o_tmpmemctx );
+		}
+		op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx );
+
+		if ( !BER_BVISNULL( &rq->newndn )) {
+			ch_free( rq->newndn.bv_val );
+			ch_free( rq->newdn.bv_val );
+		}
+		ch_free( rq->oldndn.bv_val );
+		ch_free( rq->olddn.bv_val );
+		ch_free( rq );
+	}
+
+	/* free filter */
+	for ( fptr = ftop.f_or; fptr; ) {
+		Filter *f_next = fptr->f_next;
+		op->o_tmpfree( fptr, op->o_tmpmemctx );
+		fptr = f_next;
+	}
+
+	/* wait until we get explicitly scheduled again */
+	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+	ldap_pvt_runqueue_stoptask( &slapd_rq, id->qtask );
+	ldap_pvt_runqueue_resched( &slapd_rq,id->qtask, 1 );
+	ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+
+	return NULL;
+}
 
 /*
 ** refint_response
@@ -440,21 +846,13 @@ refint_response(
 	SlapReply *rs
 )
 {
-	Operation nop = *op;
-	SlapReply nrs = { REP_RESULT };
-	slap_callback cb = { NULL, NULL, NULL, NULL };
-	slap_callback cb2 = { NULL, slap_replog_cb, NULL, NULL };
-	slap_callback *cbo, *cbp;
 	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
 	refint_data *id = on->on_bi.bi_private;
-	refint_data dd = *id;
-	refint_attrs *ip;
-	dependent_data *dp;
 	BerValue pdn;
-	int rc, ac;
-	Filter ftop, *fptr;
-
-	id->message = "_refint_response";
+	int ac;
+	refint_q *rq;
+	BackendDB *db = NULL;
+	refint_attrs *ip;
 
 	/* If the main op failed or is not a Delete or ModRdn, ignore it */
 	if (( op->o_tag != LDAP_REQ_DELETE && op->o_tag != LDAP_REQ_MODRDN ) ||
@@ -479,185 +877,75 @@ refint_response(
 	**
 	*/
 
-	nop.o_bd = select_backend(&id->dn, 0, 1);
+	if ( on->on_info->oi_origdb != frontendDB ) {
+		db = select_backend(&id->dn, 1);
 
-	if(nop.o_bd) {
-		if (!nop.o_bd->be_search || !nop.o_bd->be_modify) {
+		if ( db ) {
+			if ( !db->be_search || !db->be_modify ) {
+				Debug( LDAP_DEBUG_TRACE,
+					"refint_response: backend missing search and/or modify\n",
+					0, 0, 0 );
+				return SLAP_CB_CONTINUE;
+			}
+		} else {
 			Debug( LDAP_DEBUG_TRACE,
-				"refint_response: backend missing search and/or modify\n",
-				0, 0, 0 );
+				"refint_response: no backend for our baseDN %s??\n",
+				id->dn.bv_val, 0, 0 );
 			return SLAP_CB_CONTINUE;
 		}
-	} else {
-		Debug( LDAP_DEBUG_TRACE,
-			"refint_response: no backend for our baseDN %s??\n",
-			id->dn.bv_val, 0, 0 );
-		return SLAP_CB_CONTINUE;
 	}
 
-	cb2.sc_next = &cb;
+	rq = ch_calloc( 1, sizeof( refint_q ));
+	ber_dupbv( &rq->olddn, &op->o_req_dn );
+	ber_dupbv( &rq->oldndn, &op->o_req_ndn );
+	rq->db = db;
+	rq->rdata = id;
 
-	/*
-	** if delete: set delete callback;
-	** else modrdn: create a newdn, set modify callback;
-	**
-	*/
-
-	if(op->o_tag == LDAP_REQ_DELETE) {
-		cb.sc_response = &refint_delete_cb;
-		dd.newdn.bv_val = NULL;
-		dd.nnewdn.bv_val = NULL;
-	} else {
-		cb.sc_response = &refint_modrdn_cb;
+	if ( op->o_tag == LDAP_REQ_MODRDN ) {
 		if ( op->oq_modrdn.rs_newSup ) {
 			pdn = *op->oq_modrdn.rs_newSup;
 		} else {
 			dnParent( &op->o_req_dn, &pdn );
 		}
-		build_new_dn( &dd.newdn, &pdn, &op->orr_newrdn, NULL );
+		build_new_dn( &rq->newdn, &pdn, &op->orr_newrdn, NULL );
 		if ( op->oq_modrdn.rs_nnewSup ) {
 			pdn = *op->oq_modrdn.rs_nnewSup;
 		} else {
 			dnParent( &op->o_req_ndn, &pdn );
 		}
-		build_new_dn( &dd.nnewdn, &pdn, &op->orr_nnewrdn, NULL );
-	}
-
-	/*
-	** build a search filter for all configured attributes;
-	** populate our Operation;
-	** pass our data (attr list, dn) to backend via sc_private;
-	** call the backend search function;
-	** nb: (|(one=thing)) is valid, but do smart formatting anyway;
-	** nb: 16 is arbitrarily a dozen or so extra bytes;
-	**
-	*/
-
-	ftop.f_choice = LDAP_FILTER_OR;
-	ftop.f_next = NULL;
-	ftop.f_or = NULL;
-	nop.ors_filter = &ftop;
-	for(ip = id->attrs; ip; ip = ip->next) {
-		fptr = ch_malloc( sizeof(Filter) + sizeof(AttributeAssertion) );
-		fptr->f_choice = LDAP_FILTER_EQUALITY;
-		fptr->f_ava = (AttributeAssertion *)(fptr+1);
-		fptr->f_ava->aa_desc = ip->attr;
-		fptr->f_ava->aa_value = op->o_req_ndn;
-		fptr->f_next = ftop.f_or;
-		ftop.f_or = fptr;
-	}
-	filter2bv( nop.ors_filter, &nop.ors_filterstr );
-
-	/* callback gets the searched dn instead */
-	dd.dn = op->o_req_ndn;
-	dd.message	= "_dependent_search";
-	dd.mods		= NULL;
-	cb.sc_private	= &dd;
-	nop.o_callback	= &cb;
-	nop.o_tag	= LDAP_REQ_SEARCH;
-	nop.ors_scope	= LDAP_SCOPE_SUBTREE;
-	nop.ors_deref	= LDAP_DEREF_NEVER;
-	nop.ors_limit   = NULL;
-	nop.ors_slimit	= SLAP_NO_LIMIT;
-	nop.ors_tlimit	= SLAP_NO_LIMIT;
-
-	/* no attrs! */
-	nop.ors_attrs = slap_anlist_no_attrs;
-	nop.ors_attrsonly = 1;
-
-	nop.o_req_ndn = id->dn;
-	nop.o_req_dn = id->dn;
-
-	/* search */
-	rc = nop.o_bd->be_search(&nop, &nrs);
-
-	ch_free( nop.ors_filterstr.bv_val );
-	while ( (fptr = ftop.f_or) != NULL ) {
-		ftop.f_or = fptr->f_next;
-		ch_free( fptr );
-	}
-	ch_free(dd.nnewdn.bv_val);
-	ch_free(dd.newdn.bv_val);
-	dd.newdn.bv_val	= NULL;
-	dd.nnewdn.bv_val = NULL;
-
-	if(rc != LDAP_SUCCESS) {
-		Debug( LDAP_DEBUG_TRACE,
-			"refint_response: search failed: %d\n",
-			rc, 0, 0 );
-		goto done;
-	}
-
-	/* safety? paranoid just in case */
-	if(!cb.sc_private) {
-		Debug( LDAP_DEBUG_TRACE,
-			"refint_response: callback wiped out sc_private?!\n",
-			0, 0, 0 );
-		goto done;
+		build_new_dn( &rq->newndn, &pdn, &op->orr_nnewrdn, NULL );
 	}
 
-	/* presto! now it's a modify request with null callback */
-	cb.sc_response	= &refint_null_cb;
-	nop.o_tag	= LDAP_REQ_MODIFY;
-	dd.message	= "_dependent_modify";
-
-	/* See if the parent operation is going into the replog */
-	for (cbo=op->o_callback, cbp = cbo->sc_next; cbp; cbo=cbp,cbp=cbp->sc_next) {
-		if (cbp->sc_response == slap_replog_cb) {
-			/* Invoke replog now, arrange for our
-			 * dependent mods to also be logged
-			 */
-			cbo->sc_next = cbp->sc_next;
-			replog( op );
-			nop.o_callback = &cb2;
-			break;
-		}
+	ldap_pvt_thread_mutex_lock( &id->qmutex );
+	if ( id->qtail ) {
+		id->qtail->next = rq;
+	} else {
+		id->qhead = rq;
 	}
+	id->qtail = rq;
+	ldap_pvt_thread_mutex_unlock( &id->qmutex );
 
-	/*
-	** [our search callback builds a list of mods]
-	** foreach mod:
-	**	make sure its dn has a backend;
-	**	connect Modification* chain to our op;
-	**	call the backend modify function;
-	**	pass any errors upstream;
-	**
-	*/
-
-	for(dp = dd.mods; dp; dp = dp->next) {
-		nop.o_req_dn	= dp->dn;
-		nop.o_req_ndn	= dp->dn;
-		nop.o_bd = select_backend(&dp->dn, 0, 1);
-		if(!nop.o_bd) {
-			Debug( LDAP_DEBUG_TRACE,
-				"refint_response: no backend for DN %s!\n",
-				dp->dn.bv_val, 0, 0 );
-			goto done;
-		}
-		nrs.sr_type	= REP_RESULT;
-		nop.orm_modlist = dp->mm;	/* callback did all the work */
-		nop.o_dn = refint_dn;
-		nop.o_ndn = refint_dn;
-		nop.o_dn = nop.o_bd->be_rootdn;
-		nop.o_ndn = nop.o_bd->be_rootndn;
-		if(rs->sr_err != LDAP_SUCCESS) goto done;
-		if((rc = nop.o_bd->be_modify(&nop, &nrs)) != LDAP_SUCCESS) {
-			Debug( LDAP_DEBUG_TRACE,
-				"refint_response: dependent modify failed: %d\n",
-				nrs.sr_err, 0, 0 );
-			goto done;
+	ac = 0;
+	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+	if ( !id->qtask ) {
+		id->qtask = ldap_pvt_runqueue_insert( &slapd_rq, RUNQ_INTERVAL,
+			refint_qtask, id, "refint_qtask",
+			op->o_bd->be_suffix[0].bv_val );
+		ac = 1;
+	} else {
+		if ( !ldap_pvt_runqueue_isrunning( &slapd_rq, id->qtask ) &&
+			!id->qtask->next_sched.tv_sec ) {
+			id->qtask->interval.tv_sec = 0;
+			ldap_pvt_runqueue_resched( &slapd_rq, id->qtask, 0 );
+			id->qtask->interval.tv_sec = RUNQ_INTERVAL;
+			ac = 1;
 		}
 	}
+	ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+	if ( ac )
+		slap_wake_listener();
 
-done:
-	for(dp = dd.mods; dp; dp = dd.mods) {
-		dd.mods = dp->next;
-		ch_free(dp->dn.bv_val);
-		slap_mods_free(dp->mm, 1);
-	}
-	dd.mods = NULL;
-
-	return(SLAP_CB_CONTINUE);
+	return SLAP_CB_CONTINUE;
 }
 
 /*
@@ -666,15 +954,28 @@ done:
 */
 
 int refint_initialize() {
+	int rc;
+
+	mr_dnSubtreeMatch = mr_find( "dnSubtreeMatch" );
+	if ( mr_dnSubtreeMatch == NULL ) {
+		Debug( LDAP_DEBUG_ANY, "refint_initialize: "
+			"unable to find MatchingRule 'dnSubtreeMatch'.\n",
+			0, 0, 0 );
+		return 1;
+	}
 
 	/* statically declared just after the #includes at top */
 	refint.on_bi.bi_type = "refint";
 	refint.on_bi.bi_db_init = refint_db_init;
-	refint.on_bi.bi_db_config = refint_config;
+	refint.on_bi.bi_db_destroy = refint_db_destroy;
 	refint.on_bi.bi_db_open = refint_open;
 	refint.on_bi.bi_db_close = refint_close;
 	refint.on_response = refint_response;
 
+	refint.on_bi.bi_cf_ocs = refintocs;
+	rc = config_register_schema ( refintcfg, refintocs );
+	if ( rc ) return rc;
+
 	return(overlay_register(&refint));
 }