NEX-17849 idmap fails to lookup group SID in AD
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>

*** 19,28 ****
--- 19,30 ----
   * CDDL HEADER END
   */
  
  /*
   * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
+  *
+  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
   */
  
  /*
   * Processes name2sid & sid2name batched lookups for a given user or
   * computer from an AD Directory server using GSSAPI authentication
*** 57,67 ****
  #define UIDNUMBER       "uidNumber"
  #define GIDNUMBER       "gidNumber"
  #define UIDNUMBERFILTER "(&(objectclass=user)(uidNumber=%u))"
  #define GIDNUMBERFILTER "(&(objectclass=group)(gidNumber=%u))"
  #define SANFILTER       "(sAMAccountName=%s)"
! #define OBJSIDFILTER    "(objectSid=%s)"
  
  void    idmap_ldap_res_search_cb(LDAP *ld, LDAPMessage **res, int rc,
                  int qid, void *argp);
  
  /*
--- 59,69 ----
  #define UIDNUMBER       "uidNumber"
  #define GIDNUMBER       "gidNumber"
  #define UIDNUMBERFILTER "(&(objectclass=user)(uidNumber=%u))"
  #define GIDNUMBERFILTER "(&(objectclass=group)(gidNumber=%u))"
  #define SANFILTER       "(sAMAccountName=%s)"
! #define OBJSIDFILTER    "(|(objectSid=%s)(sIDHistory=%s))"
  
  void    idmap_ldap_res_search_cb(LDAP *ld, LDAPMessage **res, int rc,
                  int qid, void *argp);
  
  /*
*** 790,800 ****
          ret = adutils_txtsid2hexbinsid(sid, rid, &cbinsid[0], sizeof (cbinsid));
          if (ret != 0)
                  return (IDMAP_ERR_SID);
  
          /* Assemble filter */
!         (void) asprintf(&filter, OBJSIDFILTER, cbinsid);
          if (filter == NULL)
                  return (IDMAP_ERR_MEMORY);
  
          retcode = idmap_batch_add1(state, filter, NULL, NULL, esidtype,
              dn, attr, value, name, dname, NULL, NULL, sid_type, unixname,
--- 792,802 ----
          ret = adutils_txtsid2hexbinsid(sid, rid, &cbinsid[0], sizeof (cbinsid));
          if (ret != 0)
                  return (IDMAP_ERR_SID);
  
          /* Assemble filter */
!         (void) asprintf(&filter, OBJSIDFILTER, cbinsid, cbinsid);
          if (filter == NULL)
                  return (IDMAP_ERR_MEMORY);
  
          retcode = idmap_batch_add1(state, filter, NULL, NULL, esidtype,
              dn, attr, value, name, dname, NULL, NULL, sid_type, unixname,