Changeset 745 for trunk/server/source3/auth

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/auth/auth.c (modified) (24 diffs)
• source3/auth/auth_builtin.c (modified) (9 diffs)
• source3/auth/auth_compat.c (modified) (6 diffs)
• source3/auth/auth_domain.c (modified) (22 diffs)
• source3/auth/auth_netlogond.c (modified) (11 diffs)
• source3/auth/auth_ntlmssp.c (modified) (8 diffs)
• source3/auth/auth_sam.c (modified) (8 diffs)
• source3/auth/auth_script.c (modified) (10 diffs)
• source3/auth/auth_server.c (modified) (16 diffs)
• source3/auth/auth_unix.c (modified) (4 diffs)
• source3/auth/auth_util.c (modified) (59 diffs)
• source3/auth/auth_wbc.c (modified) (7 diffs)
• source3/auth/auth_winbind.c (modified) (10 diffs)
• source3/auth/check_samsec.c (copied) (copied from vendor/current/source3/auth/check_samsec.c )
• source3/auth/pampass.c (modified) (25 diffs)
• source3/auth/pass_check.c (modified) (18 diffs)
• source3/auth/proto.h (copied) (copied from vendor/current/source3/auth/proto.h )
• source3/auth/server_info.c (copied) (copied from vendor/current/source3/auth/server_info.c )
• source3/auth/server_info_sam.c (copied) (copied from vendor/current/source3/auth/server_info_sam.c )
• source3/auth/token_util.c (modified) (16 diffs)
• source3/auth/user_info.c (copied) (copied from vendor/current/source3/auth/user_info.c )
• source3/auth/user_krb5.c (copied) (copied from vendor/current/source3/auth/user_krb5.c )
• source3/auth/user_util.c (copied) (copied from vendor/current/source3/auth/user_util.c )
• source3/auth/wscript_build (copied) (copied from vendor/current/source3/auth/wscript_build )

trunk/server/source3/auth/auth.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "smbd/globals.h"
 
 #undef DBGC_CLASS
@@ -25 +27 @@
 static_decl_auth;
 
-static struct auth_init_function_entry *backends = NULL;
+static struct auth_init_function_entry *auth_backends = NULL;
 
 static struct auth_init_function_entry *auth_find_backend_entry(const char *name);
@@ -31 +33 @@
 NTSTATUS smb_register_auth(int version, const char *name, auth_init_function init)
 {
-        struct auth_init_function_entry *entry = backends;
+        struct auth_init_function_entry *entry = auth_backends;
 
         if (version != AUTH_INTERFACE_VERSION) {
@@ -55 +57 @@
         entry->init = init;
 
-        DLIST_ADD(backends, entry);
+        DLIST_ADD(auth_backends, entry);
         DEBUG(5,("Successfully added auth method '%s'\n", name));
         return NT_STATUS_OK;
@@ -62 +64 @@
 static struct auth_init_function_entry *auth_find_backend_entry(const char *name)
 {
-        struct auth_init_function_entry *entry = backends;
+        struct auth_init_function_entry *entry = auth_backends;
 
         while(entry) {
@@ -77 +79 @@
 ****************************************************************************/
 
-static void get_ntlm_challenge(struct auth_context *auth_context,
+static NTSTATUS get_ntlm_challenge(struct auth_context *auth_context,
                                uint8_t chal[8])
 {
@@ -88 +90 @@
                           auth_context->challenge_set_by));
                 memcpy(chal, auth_context->challenge.data, 8);
-                return;
+                return NT_STATUS_OK;
         }
 
@@ -107 +109 @@
 
                 challenge = auth_method->get_chal(auth_context, &auth_method->private_data,
-                                        auth_context->mem_ctx);
+                                                  auth_context);
                 if (!challenge.length) {
                         DEBUG(3, ("auth_get_challenge: getting challenge from authentication method %s FAILED.\n", 
@@ -123 +125 @@
 
                 generate_random_buffer(tmp, sizeof(tmp));
-                auth_context->challenge = data_blob_talloc(auth_context->mem_ctx, 
+                auth_context->challenge = data_blob_talloc(auth_context,
                                                            tmp, sizeof(tmp));
 
@@ -139 +141 @@
 
         memcpy(chal, auth_context->challenge.data, 8);
+        return NT_STATUS_OK;
 }
 
@@ -214 +217 @@
 
         DEBUG(3, ("check_ntlm_password:  Checking password for unmapped user [%s]\\[%s]@[%s] with the new password interface\n", 
-                  user_info->client_domain, user_info->smb_name, user_info->wksta_name));
+                  user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
 
         DEBUG(3, ("check_ntlm_password:  mapped user is: [%s]\\[%s]@[%s]\n", 
-                  user_info->domain, user_info->internal_username, user_info->wksta_name));
+                  user_info->mapped.domain_name, user_info->mapped.account_name, user_info->workstation_name));
 
         if (auth_context->challenge.length != 8) {
@@ -233 +236 @@
 #ifdef DEBUG_PASSWORD
         DEBUG(100, ("user_info has passwords of length %d and %d\n", 
-                    (int)user_info->lm_resp.length, (int)user_info->nt_resp.length));
+                    (int)user_info->password.response.lanman.length, (int)user_info->password.response.nt.length));
         DEBUG(100, ("lm:\n"));
-        dump_data(100, user_info->lm_resp.data, user_info->lm_resp.length);
+        dump_data(100, user_info->password.response.lanman.data, user_info->password.response.lanman.length);
         DEBUG(100, ("nt:\n"));
-        dump_data(100, user_info->nt_resp.data, user_info->nt_resp.length);
+        dump_data(100, user_info->password.response.nt.data, user_info->password.response.nt.length);
 #endif
 
         /* This needs to be sorted:  If it doesn't match, what should we do? */
-        if (!check_domain_match(user_info->smb_name, user_info->domain))
+        if (!check_domain_match(user_info->client.account_name, user_info->mapped.domain_name))
                 return NT_STATUS_LOGON_FAILURE;
 
@@ -247 +250 @@
                 NTSTATUS result;
 
-                mem_ctx = talloc_init("%s authentication for user %s\\%s", auth_method->name, 
-                                            user_info->domain, user_info->smb_name);
+                mem_ctx = talloc_init("%s authentication for user %s\\%s", auth_method->name,
+                                      user_info->mapped.domain_name, user_info->client.account_name);
 
                 result = auth_method->auth(auth_context, auth_method->private_data, mem_ctx, user_info, server_info);
@@ -263 +266 @@
                 if (NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(3, ("check_ntlm_password: %s authentication for user [%s] succeeded\n", 
-                                  auth_method->name, user_info->smb_name));
+                                  auth_method->name, user_info->client.account_name));
                 } else {
                         DEBUG(5, ("check_ntlm_password: %s authentication for user [%s] FAILED with error %s\n", 
-                                  auth_method->name, user_info->smb_name, nt_errstr(nt_status)));
+                                  auth_method->name, user_info->client.account_name, nt_errstr(nt_status)));
                 }
 
@@ -284 +287 @@
                         /* We might not be root if we are an RPC call */
                         become_root();
-                        nt_status = smb_pam_accountcheck(unix_username);
+                        nt_status = smb_pam_accountcheck(
+                                unix_username,
+                                smbd_server_conn->client_id.name);
                         unbecome_root();
 
@@ -298 +303 @@
                 if (NT_STATUS_IS_OK(nt_status)) {
                         DEBUG((*server_info)->guest ? 5 : 2, 
-                              ("check_ntlm_password:  %sauthentication for user [%s] -> [%s] -> [%s] succeeded\n", 
-                               (*server_info)->guest ? "guest " : "", 
-                               user_info->smb_name, 
-                               user_info->internal_username, 
+                              ("check_ntlm_password:  %sauthentication for user [%s] -> [%s] -> [%s] succeeded\n",
+                               (*server_info)->guest ? "guest " : "",
+                               user_info->client.account_name,
+                               user_info->mapped.account_name,
                                unix_username));
                 }
@@ -310 +315 @@
         /* failed authentication; check for guest lapping */
 
-        DEBUG(2, ("check_ntlm_password:  Authentication for user [%s] -> [%s] FAILED with error %s\n", 
-                  user_info->smb_name, user_info->internal_username, 
+        DEBUG(2, ("check_ntlm_password:  Authentication for user [%s] -> [%s] FAILED with error %s\n",
+                  user_info->client.account_name, user_info->mapped.account_name,
                   nt_errstr(nt_status)));
-        ZERO_STRUCTP(server_info); 
+        ZERO_STRUCTP(server_info);
 
         return nt_status;
@@ -322 +327 @@
 ***************************************************************************/
 
-static void free_auth_context(struct auth_context **auth_context)
-{
-        auth_methods *auth_method;
-
-        if (*auth_context) {
-                /* Free private data of context's authentication methods */
-                for (auth_method = (*auth_context)->auth_method_list; auth_method; auth_method = auth_method->next) {
-                        TALLOC_FREE(auth_method->private_data);
-                }
-
-                talloc_destroy((*auth_context)->mem_ctx);
-                *auth_context = NULL;
-        }
+static int auth_context_destructor(void *ptr)
+{
+        struct auth_context *ctx = talloc_get_type(ptr, struct auth_context);
+        struct auth_methods *am;
+
+
+        /* Free private data of context's authentication methods */
+        for (am = ctx->auth_method_list; am; am = am->next) {
+                TALLOC_FREE(am->private_data);
+        }
+
+        return 0;
 }
 
@@ -341 +345 @@
 ***************************************************************************/
 
-static NTSTATUS make_auth_context(struct auth_context **auth_context) 
-{
-        TALLOC_CTX *mem_ctx;
-
-        mem_ctx = talloc_init("authentication context");
-
-        *auth_context = TALLOC_P(mem_ctx, struct auth_context);
-        if (!*auth_context) {
+static NTSTATUS make_auth_context(TALLOC_CTX *mem_ctx,
+                                  struct auth_context **auth_context)
+{
+        struct auth_context *ctx;
+
+        ctx = talloc_zero(mem_ctx, struct auth_context);
+        if (!ctx) {
                 DEBUG(0,("make_auth_context: talloc failed!\n"));
-                talloc_destroy(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
-        ZERO_STRUCTP(*auth_context);
-
-        (*auth_context)->mem_ctx = mem_ctx;
-        (*auth_context)->check_ntlm_password = check_ntlm_password;
-        (*auth_context)->get_ntlm_challenge = get_ntlm_challenge;
-        (*auth_context)->free = free_auth_context;
-
+
+        ctx->check_ntlm_password = check_ntlm_password;
+        ctx->get_ntlm_challenge = get_ntlm_challenge;
+
+        talloc_set_destructor((TALLOC_CTX *)ctx, auth_context_destructor);
+
+        *auth_context = ctx;
         return NT_STATUS_OK;
 }
@@ -421 +423 @@
 ***************************************************************************/
 
-static NTSTATUS make_auth_context_text_list(struct auth_context **auth_context, char **text_list) 
+static NTSTATUS make_auth_context_text_list(TALLOC_CTX *mem_ctx,
+                                            struct auth_context **auth_context,
+                                            char **text_list)
 {
         auth_methods *list = NULL;
@@ -432 +436 @@
         }
 
-        if (!NT_STATUS_IS_OK(nt_status = make_auth_context(auth_context)))
+        nt_status = make_auth_context(mem_ctx, auth_context);
+
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
+        }
 
         for (;*text_list; text_list++) { 
@@ -450 +457 @@
 ***************************************************************************/
 
-NTSTATUS make_auth_context_subsystem(struct auth_context **auth_context) 
+NTSTATUS make_auth_context_subsystem(TALLOC_CTX *mem_ctx,
+                                     struct auth_context **auth_context)
 {
         char **auth_method_list = NULL; 
@@ -521 +529 @@
         }
 
-        nt_status = make_auth_context_text_list(auth_context,
+        nt_status = make_auth_context_text_list(mem_ctx, auth_context,
                                                 auth_method_list);
 
@@ -532 +540 @@
 ***************************************************************************/
 
-NTSTATUS make_auth_context_fixed(struct auth_context **auth_context, uchar chal[8]) 
+NTSTATUS make_auth_context_fixed(TALLOC_CTX *mem_ctx,
+                                 struct auth_context **auth_context,
+                                 uchar chal[8])
 {
         NTSTATUS nt_status;
-        if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(auth_context))) {
+        nt_status = make_auth_context_subsystem(mem_ctx, auth_context);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
         }
 
-        (*auth_context)->challenge = data_blob_talloc((*auth_context)->mem_ctx, chal, 8);
+        (*auth_context)->challenge = data_blob_talloc(*auth_context, chal, 8);
         (*auth_context)->challenge_set_by = "fixed";
         return nt_status;

trunk/server/source3/auth/auth_builtin.c

@@ -4 +4 @@
    Copyright (C) Andrew Bartlett         2001-2002
    Copyright (C) Jelmer Vernooij              2002
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -20 +20 @@
 
 #include "includes.h"
+#include "auth.h"
 
 #undef DBGC_CLASS
@@ -35 +36 @@
                                      void *my_private_data, 
                                      TALLOC_CTX *mem_ctx,
-                                     const auth_usersupplied_info *user_info, 
-                                     auth_serversupplied_info **server_info)
+                                     const struct auth_usersupplied_info *user_info,
+                                     struct auth_serversupplied_info **server_info)
 {
         /* mark this as 'not for me' */
         NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED;
 
-        if (!(user_info->internal_username 
-              && *user_info->internal_username)) {
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
+        if (!(user_info->mapped.account_name
+              && *user_info->mapped.account_name)) {
                 nt_status = make_server_info_guest(NULL, server_info);
         }
@@ -53 +56 @@
 static NTSTATUS auth_init_guest(struct auth_context *auth_context, const char *options, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method))
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
+        }
+        result->auth = check_guest_security;
+        result->name = "guest";
 
-        (*auth_method)->auth = check_guest_security;
-        (*auth_method)->name = "guest";
+        *auth_method = result;
         return NT_STATUS_OK;
 }
@@ -78 +86 @@
                                                 void *my_private_data, 
                                                 TALLOC_CTX *mem_ctx,
-                                                const auth_usersupplied_info *user_info, 
-                                                auth_serversupplied_info **server_info)
+                                                const struct auth_usersupplied_info *user_info,
+                                                struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status;
         fstring user;
         long error_num;
-        fstrcpy(user, user_info->smb_name);
-        
+
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
+        fstrcpy(user, user_info->client.account_name);
+
         if (strnequal("NT_STATUS", user, strlen("NT_STATUS"))) {
                 strupper_m(user);
@@ -93 +104 @@
         strlower_m(user);
         error_num = strtoul(user, NULL, 16);
-        
+
         DEBUG(5,("check_name_to_ntstatus_security: Error for user %s was %lx\n", user, error_num));
 
         nt_status = NT_STATUS(error_num);
-        
+
         return nt_status;
 }
@@ -105 +116 @@
 static NTSTATUS auth_init_name_to_ntstatus(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method))
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
+        }
+        result->auth = check_name_to_ntstatus_security;
+        result->name = "name_to_ntstatus";
 
-        (*auth_method)->auth = check_name_to_ntstatus_security;
-        (*auth_method)->name = "name_to_ntstatus";
+        *auth_method = result;
         return NT_STATUS_OK;
 }
@@ -131 +147 @@
                                                void *my_private_data, 
                                                TALLOC_CTX *mem_ctx,
-                                               const auth_usersupplied_info *user_info, 
-                                               auth_serversupplied_info **server_info)
+                                               const struct auth_usersupplied_info *user_info,
+                                               struct auth_serversupplied_info **server_info)
 {
         return NT_STATUS_NOT_IMPLEMENTED;
@@ -150 +166 @@
 
 
-/** Module initailisation function */
+/** Module initialisation function */
 
 static NTSTATUS auth_init_fixed_challenge(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method))
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
+        }
+        result->auth = check_fixed_challenge_security;
+        result->get_chal = auth_get_fixed_challenge;
+        result->name = "fixed_challenge";
 
-        (*auth_method)->auth = check_fixed_challenge_security;
-        (*auth_method)->get_chal = auth_get_fixed_challenge;
-        (*auth_method)->name = "fixed_challenge";
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_compat.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "auth.h"
 
 extern struct auth_context *negprot_global_auth_context;
@@ -31 +32 @@
 
 /****************************************************************************
-check if a username/password is OK assuming the password is a 24 byte
-SMB hash
+check if a username/password is OK assuming the password is in plaintext
 return True if the password is correct, False otherwise
 ****************************************************************************/
 
-NTSTATUS check_plaintext_password(const char *smb_name, DATA_BLOB plaintext_password, auth_serversupplied_info **server_info)
+NTSTATUS check_plaintext_password(const char *smb_name,
+                                  DATA_BLOB plaintext_blob,
+                                  struct auth_serversupplied_info **server_info)
 {
         struct auth_context *plaintext_auth_context = NULL;
-        auth_usersupplied_info *user_info = NULL;
+        struct auth_usersupplied_info *user_info = NULL;
         uint8_t chal[8];
         NTSTATUS nt_status;
-        if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&plaintext_auth_context))) {
+
+        nt_status = make_auth_context_subsystem(talloc_tos(),
+                                                &plaintext_auth_context);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
         }
@@ -51 +56 @@
         if (!make_user_info_for_reply(&user_info, 
                                       smb_name, lp_workgroup(), chal,
-                                      plaintext_password)) {
+                                      plaintext_blob)) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -58 +63 @@
                                                                 user_info, server_info); 
 
-        (plaintext_auth_context->free)(&plaintext_auth_context);
+        TALLOC_FREE(plaintext_auth_context);
         free_user_info(&user_info);
         return nt_status;
@@ -67 +72 @@
                                const char *domain, 
                                DATA_BLOB lm_pwd,
-                               DATA_BLOB nt_pwd,
-                               DATA_BLOB plaintext_password,
-                               bool encrypted)
+                               DATA_BLOB nt_pwd)
 
 {
         NTSTATUS nt_status;
-        auth_serversupplied_info *server_info = NULL;
-        if (encrypted) {
-                auth_usersupplied_info *user_info = NULL;
-                if (actx == NULL) {
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-                make_user_info_for_reply_enc(&user_info, smb_name, 
-                                             domain,
-                                             lm_pwd, 
-                                             nt_pwd);
-                nt_status = actx->check_ntlm_password(actx, user_info, &server_info);
-                free_user_info(&user_info);
-        } else {
-                nt_status = check_plaintext_password(smb_name, plaintext_password, &server_info);
-        }               
+        struct auth_serversupplied_info *server_info = NULL;
+        struct auth_usersupplied_info *user_info = NULL;
+        if (actx == NULL) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        make_user_info_for_reply_enc(&user_info, smb_name,
+                                     domain,
+                                     lm_pwd,
+                                     nt_pwd);
+        nt_status = actx->check_ntlm_password(actx, user_info, &server_info);
+        free_user_info(&user_info);
         TALLOC_FREE(server_info);
         return nt_status;
@@ -112 +111 @@
                  */
                 if (session_workgroup) {
-                        if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, null_password, password_blob, null_password, encrypted))) {
+                        if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, null_password, password_blob))) {
                                 return True;
                         }
-                        if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, password_blob, null_password, null_password, encrypted))) {
+                        if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, session_workgroup, password_blob, null_password))) {
                                 return True;
                         }
                 }
 
-                if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), null_password, password_blob, null_password, encrypted))) {
+                if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), null_password, password_blob))) {
                         return True;
                 }
 
-                if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), password_blob, null_password, null_password, encrypted))) {
+                if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), password_blob, null_password))) {
                         return True;
                 }
         } else {
-                if (NT_STATUS_IS_OK(pass_check_smb(actx, smb_name, lp_workgroup(), null_password, null_password, password_blob, encrypted))) {
+                struct auth_serversupplied_info *server_info = NULL;
+                NTSTATUS nt_status = check_plaintext_password(smb_name, password_blob, &server_info);
+                TALLOC_FREE(server_info);
+                if (NT_STATUS_IS_OK(nt_status)) {
                         return True;
                 }

trunk/server/source3/auth/auth_domain.c

@@ -4 +4 @@
    Copyright (C) Andrew Tridgell 1992-1998
    Copyright (C) Andrew Bartlett 2001
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -20 +20 @@
 
 #include "includes.h"
+#include "auth.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_pipe.h"
+#include "rpc_client/cli_netlogon.h"
+#include "secrets.h"
+#include "passdb.h"
+#include "libsmb/libsmb.h"
 
 #undef DBGC_CLASS
@@ -111 +118 @@
                                                 const char *dc_name,
                                                 struct sockaddr_storage *dc_ss, 
-                                                struct rpc_pipe_client **pipe_ret,
-                                                bool *retry)
+                                                struct rpc_pipe_client **pipe_ret)
 {
         NTSTATUS result;
@@ -139 +145 @@
                 return NT_STATUS_NO_LOGON_SERVERS;
         }
-        
+
         /* Attempt connection */
-        *retry = True;
         result = cli_full_connection(cli, global_myname(), dc_name, dc_ss, 0, 
-                "IPC$", "IPC", "", "", "", 0, Undefined, retry);
+                "IPC$", "IPC", "", "", "", 0, Undefined);
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -252 +257 @@
 
 static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
-                                        const auth_usersupplied_info *user_info, 
+                                        const struct auth_usersupplied_info *user_info,
                                         const char *domain,
                                         uchar chal[8],
-                                        auth_serversupplied_info **server_info, 
+                                        struct auth_serversupplied_info **server_info,
                                         const char *dc_name,
                                         struct sockaddr_storage *dc_ss)
@@ -265 +270 @@
         NTSTATUS nt_status = NT_STATUS_NO_LOGON_SERVERS;
         int i;
-        bool retry = True;
 
         /*
@@ -276 +280 @@
 
         /* rety loop for robustness */
-        
-        for (i = 0; !NT_STATUS_IS_OK(nt_status) && retry && (i < 3); i++) {
+
+        for (i = 0; !NT_STATUS_IS_OK(nt_status) && (i < 3); i++) {
                 nt_status = connect_to_domain_password_server(&cli,
                                                         domain,
                                                         dc_name,
                                                         dc_ss,
-                                                        &netlogon_pipe,
-                                                        &retry);
+                                                        &netlogon_pipe);
         }
 
@@ -305 +308 @@
         nt_status = rpccli_netlogon_sam_network_logon(netlogon_pipe,
                                                       mem_ctx,
-                                                      user_info->logon_parameters,/* flags such as 'allow workstation logon' */ 
-                                                      dc_name,                    /* server name */
-                                                      user_info->smb_name,        /* user name logging on. */
-                                                      user_info->client_domain,   /* domain name */
-                                                      user_info->wksta_name,      /* workstation name */
-                                                      chal,                       /* 8 byte challenge. */
-                                                      3,                          /* validation level */
-                                                      user_info->lm_resp,         /* lanman 24 byte response */
-                                                      user_info->nt_resp,         /* nt 24 byte response */
-                                                      &info3);                    /* info3 out */
+                                                      user_info->logon_parameters,         /* flags such as 'allow workstation logon' */
+                                                      dc_name,                             /* server name */
+                                                      user_info->client.account_name,      /* user name logging on. */
+                                                      user_info->client.domain_name,       /* domain name */
+                                                      user_info->workstation_name,         /* workstation name */
+                                                      chal,                                /* 8 byte challenge. */
+                                                      3,                                   /* validation level */
+                                                      user_info->password.response.lanman, /* lanman 24 byte response */
+                                                      user_info->password.response.nt,     /* nt 24 byte response */
+                                                      &info3);                             /* info3 out */
 
         /* Let go as soon as possible so we avoid any potential deadlocks
            with winbind lookup up users or groups. */
-           
+
         TALLOC_FREE(mutex);
 
@@ -324 +327 @@
                 DEBUG(0,("domain_client_validate: unable to validate password "
                          "for user %s in domain %s to Domain controller %s. "
-                         "Error was %s.\n", user_info->smb_name,
-                         user_info->client_domain, dc_name, 
+                         "Error was %s.\n", user_info->client.account_name,
+                         user_info->client.domain_name, dc_name,
                          nt_errstr(nt_status)));
 
@@ -334 +337 @@
         } else {
                 nt_status = make_server_info_info3(mem_ctx,
-                                                user_info->smb_name,
-                                                domain,
-                                                server_info,
-                                                info3);
+                                                   user_info->client.account_name,
+                                                   domain,
+                                                   server_info,
+                                                   info3);
 
                 if (NT_STATUS_IS_OK(nt_status)) {
                         (*server_info)->nss_token |= user_info->was_mapped;
-
-                        if ( ! (*server_info)->guest) {
-                                /* if a real user check pam account restrictions */
-                                /* only really perfomed if "obey pam restriction" is true */
-                                nt_status = smb_pam_accountcheck((*server_info)->unix_name);
-                                if (  !NT_STATUS_IS_OK(nt_status)) {
-                                        DEBUG(1, ("PAM account restriction prevents user login\n"));
-                                        cli_shutdown(cli);
-                                        TALLOC_FREE(info3);
-                                        return nt_status;
-                                }
-                        }
-                }
-
-                netsamlogon_cache_store(user_info->smb_name, info3);
-                TALLOC_FREE(info3);
+                        netsamlogon_cache_store(user_info->client.account_name, info3);
+                        TALLOC_FREE(info3);
+                }
         }
 
@@ -374 +364 @@
                                         void *my_private_data, 
                                         TALLOC_CTX *mem_ctx,
-                                        const auth_usersupplied_info *user_info, 
-                                        auth_serversupplied_info **server_info)
+                                        const struct auth_usersupplied_info *user_info,
+                                        struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
@@ -393 +383 @@
         }
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         /* 
          * Check that the requested domain is not our own machine name.
@@ -399 +391 @@
          */
 
-        if(strequal(get_global_sam_name(), user_info->domain)) {
+        if(strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
                 DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n"));
                 return NT_STATUS_NOT_IMPLEMENTED;
@@ -408 +400 @@
         if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
                 DEBUG(5,("check_ntdomain_security: unable to locate a DC for domain %s\n",
-                        user_info->domain));
+                        user_info->mapped.domain_name));
                 return NT_STATUS_NO_LOGON_SERVERS;
         }
-        
+
         nt_status = domain_client_validate(mem_ctx,
                                         user_info,
@@ -419 +411 @@
                                         dc_name,
                                         &dc_ss);
-                
+
         return nt_status;
 }
@@ -426 +418 @@
 static NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "ntdomain";
-        (*auth_method)->auth = check_ntdomain_security;
+        result->name = "ntdomain";
+        result->auth = check_ntdomain_security;
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }
@@ -443 +439 @@
                                            void *my_private_data, 
                                            TALLOC_CTX *mem_ctx,
-                                           const auth_usersupplied_info *user_info, 
-                                           auth_serversupplied_info **server_info)
+                                           const struct auth_usersupplied_info *user_info,
+                                           struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
@@ -457 +453 @@
         }
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         /* 
          * Check that the requested domain is not our own machine name or domain name.
          */
 
-        if( strequal(get_global_sam_name(), user_info->domain)) {
+        if( strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
                 DEBUG(3,("check_trustdomain_security: Requested domain [%s] was for this machine.\n",
-                        user_info->domain));
+                        user_info->mapped.domain_name));
                 return NT_STATUS_NOT_IMPLEMENTED;
         }
@@ -471 +469 @@
            The logic is that if we know nothing about the domain, that
            user is not known to us and does not exist */
-        
-        if ( !is_trusted_domain( user_info->domain ) )
+
+        if ( !is_trusted_domain( user_info->mapped.domain_name ) )
                 return NT_STATUS_NOT_IMPLEMENTED;
 
@@ -480 +478 @@
          */
 
-        if (!pdb_get_trusteddom_pw(user_info->domain, &trust_password,
+        if (!pdb_get_trusteddom_pw(user_info->mapped.domain_name, &trust_password,
                                    NULL, NULL)) {
                 DEBUG(0, ("check_trustdomain_security: could not fetch trust "
                           "account password for domain %s\n",
-                          user_info->domain));
+                          user_info->mapped.domain_name));
                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
 
 #ifdef DEBUG_PASSWORD
-        DEBUG(100, ("Trust password for domain %s is %s\n", user_info->domain,
+        DEBUG(100, ("Trust password for domain %s is %s\n", user_info->mapped.domain_name,
                     trust_password));
 #endif
@@ -505 +503 @@
         /* use get_dc_name() for consistency even through we know that it will be 
            a netbios name */
-           
-        if ( !get_dc_name(user_info->domain, NULL, dc_name, &dc_ss) ) {
+
+        if ( !get_dc_name(user_info->mapped.domain_name, NULL, dc_name, &dc_ss) ) {
                 DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n",
-                        user_info->domain));
+                        user_info->mapped.domain_name));
                 return NT_STATUS_NO_LOGON_SERVERS;
         }
-        
+
         nt_status = domain_client_validate(mem_ctx,
-                                        user_info,
-                                        user_info->domain,
-                                        (uchar *)auth_context->challenge.data,
-                                        server_info,
-                                        dc_name,
-                                        &dc_ss);
+                                           user_info,
+                                           user_info->mapped.domain_name,
+                                           (uchar *)auth_context->challenge.data,
+                                           server_info,
+                                           dc_name,
+                                           &dc_ss);
 
         return nt_status;
@@ -526 +524 @@
 static NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "trustdomain";
-        (*auth_method)->auth = check_trustdomain_security;
+        result->name = "trustdomain";
+        result->auth = check_trustdomain_security;
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_netlogond.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "auth.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_schannel.h"
+#include "rpc_client/cli_pipe.h"
+#include "rpc_client/cli_netlogon.h"
+#include "secrets.h"
+#include "tldap.h"
+#include "tldap_util.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
+
+static bool secrets_store_local_schannel_creds(
+        const struct netlogon_creds_CredentialState *creds)
+{
+        DATA_BLOB blob;
+        enum ndr_err_code ndr_err;
+        bool ret;
+
+        ndr_err = ndr_push_struct_blob(
+                &blob, talloc_tos(), creds,
+                (ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(10, ("ndr_push_netlogon_creds_CredentialState failed: "
+                           "%s\n", ndr_errstr(ndr_err)));
+                return false;
+        }
+        ret = secrets_store(SECRETS_LOCAL_SCHANNEL_KEY,
+                            blob.data, blob.length);
+        data_blob_free(&blob);
+        return ret;
+}
+
+static struct netlogon_creds_CredentialState *
+secrets_fetch_local_schannel_creds(TALLOC_CTX *mem_ctx)
+{
+        struct netlogon_creds_CredentialState *creds;
+        enum ndr_err_code ndr_err;
+        DATA_BLOB blob;
+
+        blob.data = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY,
+                                             &blob.length);
+        if (blob.data == NULL) {
+                DEBUG(10, ("secrets_fetch failed\n"));
+                return NULL;
+        }
+
+        creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
+        if (creds == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                SAFE_FREE(blob.data);
+                return NULL;
+        }
+        ndr_err = ndr_pull_struct_blob(
+                &blob, creds, creds,
+                (ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
+        SAFE_FREE(blob.data);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(10, ("ndr_pull_netlogon_creds_CredentialState failed: "
+                           "%s\n", ndr_errstr(ndr_err)));
+                TALLOC_FREE(creds);
+                return NULL;
+        }
+
+        return creds;
+}
 
 static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
                                    const struct auth_context *auth_context,
                                    const char *ncalrpc_sockname,
-                                   uint8_t schannel_key[16],
-                                   const auth_usersupplied_info *user_info,
+                                   struct netlogon_creds_CredentialState *creds,
+                                   const struct auth_usersupplied_info *user_info,
                                    struct netr_SamInfo3 **pinfo3,
                                    NTSTATUS *schannel_bind_result)
 {
         struct rpc_pipe_client *p = NULL;
-        struct cli_pipe_auth_data *auth = NULL;
+        struct pipe_auth_data *auth = NULL;
         struct netr_SamInfo3 *info3 = NULL;
         NTSTATUS status;
@@ -47 +110 @@
         }
 
-        /*
-         * We have to fake a struct dcinfo, so that
-         * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
-         */
-
-        p->dc = netlogon_creds_client_init_session_key(p, schannel_key);
-        if (p->dc == NULL) {
-                DEBUG(0, ("talloc failed\n"));
-                TALLOC_FREE(p);
-                return NT_STATUS_NO_MEMORY;
-        }
+        p->dc = creds;
 
         status = rpccli_schannel_bind_data(p, lp_workgroup(),
@@ -79 +132 @@
         status = rpccli_netlogon_sam_network_logon_ex(
                 p, p,
-                user_info->logon_parameters,/* flags such as 'allow
-                                             * workstation logon' */
-                global_myname(),            /* server name */
-                user_info->smb_name,        /* user name logging on. */
-                user_info->client_domain,   /* domain name */
-                user_info->wksta_name,      /* workstation name */
+                user_info->logon_parameters,           /* flags such as 'allow
+                                                        * workstation logon' */
+                global_myname(),                       /* server name */
+                user_info->client.account_name,        /* user name logging on. */
+                user_info->client.domain_name,         /* domain name */
+                user_info->workstation_name,           /* workstation name */
                 (uchar *)auth_context->challenge.data, /* 8 byte challenge. */
-                3,                          /* validation level */
-                user_info->lm_resp,         /* lanman 24 byte response */
-                user_info->nt_resp,         /* nt 24 byte response */
-                &info3);                    /* info3 out */
+                3,                                     /* validation level */
+                user_info->password.response.lanman,   /* lanman 24 byte response */
+                user_info->password.response.nt,       /* nt 24 byte response */
+                &info3);                               /* info3 out */
 
         DEBUG(10, ("rpccli_netlogon_sam_network_logon_ex returned %s\n",
@@ -105 +158 @@
 }
 
-static char *mymachinepw(TALLOC_CTX *mem_ctx)
-{
-        fstring pwd;
-        const char *script;
-        char *to_free = NULL;
-        ssize_t nread;
-        int ret, fd;
-
-        script = lp_parm_const_string(
-                GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
-                NULL);
-
-        if (script == NULL) {
-                to_free = talloc_asprintf(talloc_tos(), "%s/%s",
-                                          get_dyn_SBINDIR(), "mymachinepw");
-                script = to_free;
-        }
-        if (script == NULL) {
-                return NULL;
-        }
-
-        ret = smbrun(script, &fd);
-        DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
-                            script, ret));
-        TALLOC_FREE(to_free);
-
-        if (ret != 0) {
-                return NULL;
-        }
-
-        nread = read(fd, pwd, sizeof(pwd)-1);
-        close(fd);
-
-        if (nread <= 0) {
-                DEBUG(3, ("mymachinepwd: Could not read password\n"));
-                return NULL;
-        }
-
-        pwd[nread] = '\0';
-
-        if (pwd[nread-1] == '\n') {
-                pwd[nread-1] = '\0';
-        }
-
-        return talloc_strdup(mem_ctx, pwd);
+static NTSTATUS get_ldapi_ctx(TALLOC_CTX *mem_ctx, struct tldap_context **pld)
+{
+        struct tldap_context *ld;
+        struct sockaddr_un addr;
+        char *sockaddr;
+        int fd;
+        NTSTATUS status;
+        int res;
+
+        sockaddr = talloc_asprintf(talloc_tos(), "/%s/ldap_priv/ldapi",
+                                   lp_private_dir());
+        if (sockaddr == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ZERO_STRUCT(addr);
+        addr.sun_family = AF_UNIX;
+        strncpy(addr.sun_path, sockaddr, sizeof(addr.sun_path));
+        TALLOC_FREE(sockaddr);
+
+        status = open_socket_out((struct sockaddr_storage *)(void *)&addr,
+                                 0, 0, &fd);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("Could not connect to %s: %s\n", addr.sun_path,
+                           nt_errstr(status)));
+                return status;
+        }
+        set_blocking(fd, false);
+
+        ld = tldap_context_create(mem_ctx, fd);
+        if (ld == NULL) {
+                close(fd);
+                return NT_STATUS_NO_MEMORY;
+        }
+        res = tldap_fetch_rootdse(ld);
+        if (res != TLDAP_SUCCESS) {
+                DEBUG(10, ("tldap_fetch_rootdse failed: %s\n",
+                           tldap_errstr(talloc_tos(), ld, res)));
+                TALLOC_FREE(ld);
+                return NT_STATUS_LDAP(res);
+        }
+        *pld = ld;
+        return NT_STATUS_OK;;
+}
+
+static NTSTATUS mymachinepw(uint8_t pwd[16])
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct tldap_context *ld = NULL;
+        struct tldap_message *rootdse, **msg;
+        const char *attrs[1] = { "unicodePwd" };
+        char *default_nc, *myname;
+        int rc, num_msg;
+        DATA_BLOB pwdblob;
+        NTSTATUS status;
+
+        status = get_ldapi_ctx(talloc_tos(), &ld);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto fail;
+        }
+        rootdse = tldap_rootdse(ld);
+        if (rootdse == NULL) {
+                DEBUG(10, ("Could not get rootdse\n"));
+                status = NT_STATUS_INTERNAL_ERROR;
+                goto fail;
+        }
+        default_nc = tldap_talloc_single_attribute(
+                rootdse, "defaultNamingContext", talloc_tos());
+        if (default_nc == NULL) {
+                DEBUG(10, ("Could not get defaultNamingContext\n"));
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+        DEBUG(10, ("default_nc = %s\n", default_nc));
+
+        myname = talloc_asprintf_strupper_m(talloc_tos(), "%s$",
+                                            global_myname());
+        if (myname == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        rc = tldap_search_fmt(
+                ld, default_nc, TLDAP_SCOPE_SUB, attrs, ARRAY_SIZE(attrs), 0,
+                talloc_tos(), &msg,
+                "(&(sAMAccountName=%s)(objectClass=computer))", myname);
+        if (rc != TLDAP_SUCCESS) {
+                DEBUG(10, ("Could not retrieve our account: %s\n",
+                           tldap_errstr(talloc_tos(), ld, rc)));
+                status = NT_STATUS_LDAP(rc);
+                goto fail;
+        }
+        num_msg = talloc_array_length(msg);
+        if (num_msg != 1) {
+                DEBUG(10, ("Got %d accounts, expected one\n", num_msg));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        if (!tldap_get_single_valueblob(msg[0], "unicodePwd", &pwdblob)) {
+                char *dn = NULL;
+                tldap_entry_dn(msg[0], &dn);
+                DEBUG(10, ("No unicodePwd attribute in %s\n",
+                           dn ? dn : "<unknown DN>"));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        if (pwdblob.length != 16) {
+                DEBUG(10, ("Password hash hash has length %d, expected 16\n",
+                           (int)pwdblob.length));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        memcpy(pwd, pwdblob.data, 16);
+
+fail:
+        TALLOC_FREE(frame);
+        return status;
 }
 
@@ -155 +282 @@
                                          void *my_private_data,
                                          TALLOC_CTX *mem_ctx,
-                                         const auth_usersupplied_info *user_info,
-                                         auth_serversupplied_info **server_info)
+                                         const struct auth_usersupplied_info *user_info,
+                                         struct auth_serversupplied_info **server_info)
 {
         TALLOC_CTX *frame = talloc_stackframe();
         struct netr_SamInfo3 *info3 = NULL;
         struct rpc_pipe_client *p = NULL;
-        struct cli_pipe_auth_data *auth = NULL;
+        struct pipe_auth_data *auth = NULL;
         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-        char *plaintext_machinepw = NULL;
         uint8_t machine_password[16];
-        uint8_t schannel_key[16];
+        struct netlogon_creds_CredentialState *creds;
         NTSTATUS schannel_bind_result, status;
         struct named_mutex *mutex = NULL;
         const char *ncalrpcsock;
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         ncalrpcsock = lp_parm_const_string(
                 GLOBAL_SECTION_SNUM, "auth_netlogond", "socket", NULL);
@@ -183 +311 @@
         }
 
-        if (!secrets_fetch_local_schannel_key(schannel_key)) {
+        creds = secrets_fetch_local_schannel_creds(talloc_tos());
+        if (creds == NULL) {
                 goto new_key;
         }
 
         status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                    schannel_key, user_info, &info3,
+                                    creds, user_info, &info3,
                                     &schannel_bind_result);
 
@@ -237 +366 @@
         }
 
-        plaintext_machinepw = mymachinepw(talloc_tos());
-        if (plaintext_machinepw == NULL) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        E_md4hash(plaintext_machinepw, machine_password);
-
-        TALLOC_FREE(plaintext_machinepw);
+        status = mymachinepw(machine_password);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("mymachinepw failed: %s\n", nt_errstr(status)));
+                goto done;
+        }
+
+        DEBUG(10, ("machinepw "));
+        dump_data(10, machine_password, 16);
 
         status = rpccli_netlogon_setup_creds(
@@ -257 +385 @@
         }
 
-        memcpy(schannel_key, p->dc->session_key, 16);
-        secrets_store_local_schannel_key(schannel_key);
-
-        TALLOC_FREE(p);
+        secrets_store_local_schannel_creds(p->dc);
 
         /*
@@ -268 +393 @@
 
         status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                    schannel_key, user_info, &info3,
+                                    p->dc, user_info, &info3,
                                     &schannel_bind_result);
 
+        TALLOC_FREE(p);
+
         DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
 
@@ -279 +406 @@
  okay:
 
-        status = make_server_info_info3(mem_ctx, user_info->smb_name,
-                                        user_info->domain, server_info,
+        status = make_server_info_info3(mem_ctx, user_info->client.account_name,
+                                        user_info->mapped.domain_name, server_info,
                                         info3);
         if (!NT_STATUS_IS_OK(status)) {
@@ -301 +428 @@
                                     auth_methods **auth_method)
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "netlogond";
-        (*auth_method)->auth = check_netlogond_security;
+        result->name = "netlogond";
+        result->auth = check_netlogond_security;
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_ntlmssp.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "../libcli/auth/ntlmssp.h"
+#include "ntlmssp_wrap.h"
+#include "../librpc/gen_ndr/netlogon.h"
+#include "smbd/smbd.h"
+
+NTSTATUS auth_ntlmssp_steal_session_info(TALLOC_CTX *mem_ctx,
+                                        struct auth_ntlmssp_state *auth_ntlmssp_state,
+                                        struct auth_serversupplied_info **session_info)
+{
+        /* Free the current server_info user_session_key and reset it from the
+         * current ntlmssp_state session_key */
+        data_blob_free(&auth_ntlmssp_state->server_info->user_session_key);
+        /* Set up the final session key for the connection */
+        auth_ntlmssp_state->server_info->user_session_key =
+                data_blob_talloc(
+                        auth_ntlmssp_state->server_info,
+                        auth_ntlmssp_state->ntlmssp_state->session_key.data,
+                        auth_ntlmssp_state->ntlmssp_state->session_key.length);
+        if (auth_ntlmssp_state->ntlmssp_state->session_key.length &&
+            !auth_ntlmssp_state->server_info->user_session_key.data) {
+                *session_info = NULL;
+                return NT_STATUS_NO_MEMORY;
+        }
+        /* Steal session_info away from auth_ntlmssp_state */
+        *session_info = talloc_move(mem_ctx, &auth_ntlmssp_state->server_info);
+        return NT_STATUS_OK;
+}
 
 /**
@@ -28 +56 @@
  */
 
-static void auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
-                                       uint8_t chal[8])
-{
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+static NTSTATUS auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
+                                           uint8_t chal[8])
+{
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         auth_ntlmssp_state->auth_context->get_ntlm_challenge(
                 auth_ntlmssp_state->auth_context, chal);
+        return NT_STATUS_OK;
 }
 
@@ -44 +73 @@
 static bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
 {
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 
@@ -57 +86 @@
 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
 {
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 
         SMB_ASSERT(challenge->length == 8);
 
-        auth_context->challenge = data_blob_talloc(auth_context->mem_ctx, 
+        auth_context->challenge = data_blob_talloc(auth_context,
                                                    challenge->data, challenge->length);
 
@@ -80 +109 @@
  */
 
-static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key) 
-{
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
-        auth_usersupplied_info *user_info = NULL;
+static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *mem_ctx,
+                                            DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+{
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
+        struct auth_usersupplied_info *user_info = NULL;
         NTSTATUS nt_status;
         bool username_was_mapped;
@@ -91 +121 @@
            we need to possibly reload smb.conf if smb.conf includes depend on the machine name */
 
-        set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->workstation, True);
+        set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->client.netbios_name, True);
 
         /* setup the string used by %U */
@@ -97 +127 @@
         sub_set_smb_name(auth_ntlmssp_state->ntlmssp_state->user);
 
-        reload_services(True);
+        reload_services(smbd_messaging_context(), -1, True);
 
         nt_status = make_user_info_map(&user_info, 
                                        auth_ntlmssp_state->ntlmssp_state->user, 
                                        auth_ntlmssp_state->ntlmssp_state->domain, 
-                                       auth_ntlmssp_state->ntlmssp_state->workstation, 
+                                       auth_ntlmssp_state->ntlmssp_state->client.netbios_name,
                                        auth_ntlmssp_state->ntlmssp_state->lm_resp.data ? &auth_ntlmssp_state->ntlmssp_state->lm_resp : NULL, 
                                        auth_ntlmssp_state->ntlmssp_state->nt_resp.data ? &auth_ntlmssp_state->ntlmssp_state->nt_resp : NULL, 
                                        NULL, NULL, NULL,
-                                       True);
+                                       AUTH_PASSWORD_RESPONSE);
+
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
 
         user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
 
         nt_status = auth_ntlmssp_state->auth_context->check_ntlm_password(auth_ntlmssp_state->auth_context, 
@@ -127 +157 @@
         auth_ntlmssp_state->server_info->nss_token |= username_was_mapped;
 
-        if (auth_ntlmssp_state->server_info->ptok == NULL) {
-                nt_status = create_local_token(auth_ntlmssp_state->server_info);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        DEBUG(10, ("create_local_token failed: %s\n",
-                                   nt_errstr(nt_status)));
-                        return nt_status;
-                }
-        }
-
+        nt_status = create_local_token(auth_ntlmssp_state->server_info);
+
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(10, ("create_local_token failed: %s\n",
+                        nt_errstr(nt_status)));
+                return nt_status;
+        }
+
+        /* Clear out the session keys, and pass them to the caller.
+         * They will not be used in this form again - instead the
+         * NTLMSSP code will decide on the final correct session key,
+         * and put it back here at the end of
+         * auth_ntlmssp_steal_server_info */
         if (auth_ntlmssp_state->server_info->user_session_key.length) {
                 DEBUG(10, ("Got NT session key of length %u\n",
                         (unsigned int)auth_ntlmssp_state->server_info->user_session_key.length));
-                *user_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx, 
-                                                   auth_ntlmssp_state->server_info->user_session_key.data,
-                                                   auth_ntlmssp_state->server_info->user_session_key.length);
+                *user_session_key = auth_ntlmssp_state->server_info->user_session_key;
+                talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->user_session_key.data);
+                auth_ntlmssp_state->server_info->user_session_key = data_blob_null;
         }
         if (auth_ntlmssp_state->server_info->lm_session_key.length) {
                 DEBUG(10, ("Got LM session key of length %u\n",
                         (unsigned int)auth_ntlmssp_state->server_info->lm_session_key.length));
-                *lm_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx, 
-                                                   auth_ntlmssp_state->server_info->lm_session_key.data,
-                                                   auth_ntlmssp_state->server_info->lm_session_key.length);
+                *lm_session_key = auth_ntlmssp_state->server_info->lm_session_key;
+                talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->lm_session_key.data);
+                auth_ntlmssp_state->server_info->lm_session_key = data_blob_null;
         }
         return nt_status;
 }
 
-NTSTATUS auth_ntlmssp_start(AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
+static int auth_ntlmssp_state_destructor(void *ptr);
+
+NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state **auth_ntlmssp_state)
 {
         NTSTATUS nt_status;
-        TALLOC_CTX *mem_ctx;
-
-        mem_ctx = talloc_init("AUTH NTLMSSP context");
-        
-        *auth_ntlmssp_state = TALLOC_ZERO_P(mem_ctx, AUTH_NTLMSSP_STATE);
-        if (!*auth_ntlmssp_state) {
+        bool is_standalone;
+        const char *netbios_name;
+        const char *netbios_domain;
+        const char *dns_name;
+        char *dns_domain;
+        struct auth_ntlmssp_state *ans;
+        struct auth_context *auth_context;
+
+        if ((enum server_types)lp_server_role() == ROLE_STANDALONE) {
+                is_standalone = true;
+        } else {
+                is_standalone = false;
+        }
+
+        netbios_name = global_myname();
+        netbios_domain = lp_workgroup();
+        /* This should be a 'netbios domain -> DNS domain' mapping */
+        dns_domain = get_mydnsdomname(talloc_tos());
+        if (dns_domain) {
+                strlower_m(dns_domain);
+        }
+        dns_name = get_mydnsfullname();
+
+        ans = talloc_zero(NULL, struct auth_ntlmssp_state);
+        if (!ans) {
                 DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
-                talloc_destroy(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
 
-        ZERO_STRUCTP(*auth_ntlmssp_state);
-
-        (*auth_ntlmssp_state)->mem_ctx = mem_ctx;
-
-        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_start(&(*auth_ntlmssp_state)->ntlmssp_state))) {
-                return nt_status;
-        }
-
-        if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&(*auth_ntlmssp_state)->auth_context))) {
-                return nt_status;
-        }
-
-        (*auth_ntlmssp_state)->ntlmssp_state->auth_context = (*auth_ntlmssp_state);
-        (*auth_ntlmssp_state)->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password;
-        (*auth_ntlmssp_state)->ntlmssp_state->server_role = (enum server_types)lp_server_role();
-
-        return NT_STATUS_OK;
-}
-
-void auth_ntlmssp_end(AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
-{
-        TALLOC_CTX *mem_ctx;
-
-        if (*auth_ntlmssp_state == NULL) {
-                return;
-        }
-
-        mem_ctx = (*auth_ntlmssp_state)->mem_ctx;
-        if ((*auth_ntlmssp_state)->ntlmssp_state) {
-                ntlmssp_end(&(*auth_ntlmssp_state)->ntlmssp_state);
-        }
-        if ((*auth_ntlmssp_state)->auth_context) {
-                ((*auth_ntlmssp_state)->auth_context->free)(&(*auth_ntlmssp_state)->auth_context);
-        }
-        if ((*auth_ntlmssp_state)->server_info) {
-                TALLOC_FREE((*auth_ntlmssp_state)->server_info);
-        }
-        talloc_destroy(mem_ctx);
-        *auth_ntlmssp_state = NULL;
-}
-
-NTSTATUS auth_ntlmssp_update(AUTH_NTLMSSP_STATE *auth_ntlmssp_state, 
-                             const DATA_BLOB request, DATA_BLOB *reply) 
-{
-        return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, request, reply);
-}
+        nt_status = ntlmssp_server_start(ans,
+                                         is_standalone,
+                                         netbios_name,
+                                         netbios_domain,
+                                         dns_name,
+                                         dns_domain,
+                                         &ans->ntlmssp_state);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        nt_status = make_auth_context_subsystem(talloc_tos(), &auth_context);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+        ans->auth_context = talloc_steal(ans, auth_context);
+
+        ans->ntlmssp_state->callback_private = ans;
+        ans->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
+        ans->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
+        ans->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
+        ans->ntlmssp_state->check_password = auth_ntlmssp_check_password;
+
+        talloc_set_destructor((TALLOC_CTX *)ans, auth_ntlmssp_state_destructor);
+
+        *auth_ntlmssp_state = ans;
+        return NT_STATUS_OK;
+}
+
+static int auth_ntlmssp_state_destructor(void *ptr)
+{
+        struct auth_ntlmssp_state *ans;
+
+        ans = talloc_get_type(ptr, struct auth_ntlmssp_state);
+
+        TALLOC_FREE(ans->server_info);
+        TALLOC_FREE(ans->ntlmssp_state);
+        return 0;
+}

trunk/server/source3/auth/auth_sam.c

@@ -22 +22 @@
 
 #include "includes.h"
-#include "../libcli/auth/libcli_auth.h"
+#include "auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
-/****************************************************************************
- Do a specific test for an smb password being correct, given a smb_password and
- the lanman and NT responses.
-****************************************************************************/
-
-static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
-                                TALLOC_CTX *mem_ctx,
-                                const char *username,
-                                uint32_t acct_ctrl,
-                                const uint8_t *lm_pw,
-                                const uint8_t *nt_pw,
-                                const auth_usersupplied_info *user_info, 
-                                DATA_BLOB *user_sess_key, 
-                                DATA_BLOB *lm_sess_key)
+static NTSTATUS auth_sam_ignoredomain_auth(const struct auth_context *auth_context,
+                                           void *my_private_data,
+                                           TALLOC_CTX *mem_ctx,
+                                           const struct auth_usersupplied_info *user_info,
+                                           struct auth_serversupplied_info **server_info)
 {
-        struct samr_Password _lm_hash, _nt_hash, _client_lm_hash, _client_nt_hash;
-        struct samr_Password *lm_hash = NULL;
-        struct samr_Password *nt_hash = NULL;
-        struct samr_Password *client_lm_hash = NULL;
-        struct samr_Password *client_nt_hash = NULL;
-
-        *user_sess_key = data_blob_null;
-        *lm_sess_key = data_blob_null;
-
-        if (acct_ctrl & ACB_PWNOTREQ) {
-                if (lp_null_passwords()) {
-                        DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
-                        return NT_STATUS_OK;
-                } else {
-                        DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", username));
-                        return NT_STATUS_LOGON_FAILURE;
-                }               
-        }
-
-        if (lm_pw) {
-                memcpy(_lm_hash.hash, lm_pw, sizeof(_lm_hash.hash));
-                lm_hash = &_lm_hash;
-        }
-        if (nt_pw) {
-                memcpy(_nt_hash.hash, nt_pw, sizeof(_nt_hash.hash));
-                nt_hash = &_nt_hash;
-        }
-        if (user_info->lm_interactive_pwd.data && sizeof(_client_lm_hash.hash) == user_info->lm_interactive_pwd.length) {
-                memcpy(_client_lm_hash.hash, user_info->lm_interactive_pwd.data, sizeof(_lm_hash.hash));
-                client_lm_hash = &_client_lm_hash;
-        }
-        if (user_info->nt_interactive_pwd.data && sizeof(_client_nt_hash.hash) == user_info->nt_interactive_pwd.length) {
-                memcpy(_client_nt_hash.hash, user_info->nt_interactive_pwd.data, sizeof(_nt_hash.hash));
-                client_nt_hash = &_client_nt_hash;
-        }
-
-        if (client_lm_hash || client_nt_hash) {
-                if (!nt_pw) {
-                        return NT_STATUS_WRONG_PASSWORD;
-                }
-                *user_sess_key = data_blob_talloc(mem_ctx, NULL, 16);
-                if (!user_sess_key->data) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-                SMBsesskeygen_ntv1(nt_pw, user_sess_key->data);
-                return hash_password_check(mem_ctx, lp_lanman_auth(),
-                                           client_lm_hash,
-                                           client_nt_hash,
-                                           username, 
-                                           lm_hash,
-                                           nt_hash);
-        } else {
-                return ntlm_password_check(mem_ctx, lp_lanman_auth(),
-                                           lp_ntlm_auth(),
-                                           user_info->logon_parameters,
-                                           &auth_context->challenge, 
-                                           &user_info->lm_resp, &user_info->nt_resp, 
-                                           username, 
-                                           user_info->smb_name,
-                                           user_info->client_domain,
-                                           lm_hash,
-                                           nt_hash,
-                                           user_sess_key, lm_sess_key);
-        }
-}
-
-/****************************************************************************
- Check if a user is allowed to logon at this time. Note this is the
- servers local time, as logon hours are just specified as a weekly
- bitmask.
-****************************************************************************/
-
-static bool logon_hours_ok(struct samu *sampass)
-{
-        /* In logon hours first bit is Sunday from 12AM to 1AM */
-        const uint8 *hours;
-        struct tm *utctime;
-        time_t lasttime;
-        const char *asct;
-        uint8 bitmask, bitpos;
-
-        hours = pdb_get_hours(sampass);
-        if (!hours) {
-                DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n",pdb_get_username(sampass)));
-                return True;
-        }
-
-        lasttime = time(NULL);
-        utctime = gmtime(&lasttime);
-        if (!utctime) {
-                DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
-                        pdb_get_username(sampass) ));
-                return False;
-        }
-
-        /* find the corresponding byte and bit */
-        bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
-        bitmask = 1 << (bitpos % 8);
-
-        if (! (hours[bitpos/8] & bitmask)) {
-                struct tm *t = localtime(&lasttime);
-                if (!t) {
-                        asct = "INVALID TIME";
-                } else {
-                        asct = asctime(t);
-                        if (!asct) {
-                                asct = "INVALID TIME";
-                        }
-                }
-
-                DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
-                          "logon at this time (%s).\n",
-                          pdb_get_username(sampass), asct ));
-                return False;
-        }
-
-        asct = asctime(utctime);
-        DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
-                pdb_get_username(sampass), asct ? asct : "UNKNOWN TIME" ));
-
-        return True;
-}
-
-/****************************************************************************
- Do a specific test for a struct samu being valid for this connection
- (ie not disabled, expired and the like).
-****************************************************************************/
-
-static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
-                               struct samu *sampass, 
-                               const auth_usersupplied_info *user_info)
-{
-        uint32  acct_ctrl = pdb_get_acct_ctrl(sampass);
-        char *workstation_list;
-        time_t kickoff_time;
-
-        DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
-
-        /* Quit if the account was disabled. */
-        if (acct_ctrl & ACB_DISABLED) {
-                DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
-                return NT_STATUS_ACCOUNT_DISABLED;
-        }
-
-        /* Quit if the account was locked out. */
-        if (acct_ctrl & ACB_AUTOLOCK) {
-                DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
-                return NT_STATUS_ACCOUNT_LOCKED_OUT;
-        }
-
-        /* Quit if the account is not allowed to logon at this time. */
-        if (! logon_hours_ok(sampass)) {
-                return NT_STATUS_INVALID_LOGON_HOURS;
-        }
-
-        /* Test account expire time */
-
-        kickoff_time = pdb_get_kickoff_time(sampass);
-        if (kickoff_time != 0 && time(NULL) > kickoff_time) {
-                DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
-                DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
-                return NT_STATUS_ACCOUNT_EXPIRED;
-        }
-
-        if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP) && !(pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ)) {
-                time_t must_change_time = pdb_get_pass_must_change_time(sampass);
-                time_t last_set_time = pdb_get_pass_last_set_time(sampass);
-
-                /* check for immediate expiry "must change at next logon" 
-                 * for a user account. */
-                if (((acct_ctrl & (ACB_WSTRUST|ACB_SVRTRUST)) == 0) && (last_set_time == 0)) {
-                        DEBUG(1,("sam_account_ok: Account for user '%s' password must change!\n", pdb_get_username(sampass)));
-                        return NT_STATUS_PASSWORD_MUST_CHANGE;
-                }
-
-                /* check for expired password */
-                if (must_change_time < time(NULL) && must_change_time != 0) {
-                        DEBUG(1,("sam_account_ok: Account for user '%s' password expired!\n", pdb_get_username(sampass)));
-                        DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", http_timestring(talloc_tos(), must_change_time), (long)must_change_time));
-                        return NT_STATUS_PASSWORD_EXPIRED;
-                }
-        }
-
-        /* Test workstation. Workstation list is comma separated. */
-
-        workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass));
-        if (!workstation_list)
-                return NT_STATUS_NO_MEMORY;
-
-        if (*workstation_list) {
-                bool invalid_ws = True;
-                char *tok = NULL;
-                const char *s = workstation_list;
-                char *machine_name = talloc_asprintf(mem_ctx, "%s$", user_info->wksta_name);
-
-                if (machine_name == NULL)
-                        return NT_STATUS_NO_MEMORY;
-
-                while (next_token_talloc(mem_ctx, &s, &tok, ",")) {
-                        DEBUG(10,("sam_account_ok: checking for workstation match %s and %s\n",
-                                  tok, user_info->wksta_name));
-                        if(strequal(tok, user_info->wksta_name)) {
-                                invalid_ws = False;
-                                break;
-                        }
-                        if (tok[0] == '+') {
-                                DEBUG(10,("sam_account_ok: checking for workstation %s in group: %s\n", 
-                                        machine_name, tok + 1));
-                                if (user_in_group(machine_name, tok + 1)) {
-                                        invalid_ws = False;
-                                        break;
-                                }
-                        }
-                        TALLOC_FREE(tok);
-                }
-                TALLOC_FREE(tok);
-                TALLOC_FREE(machine_name);
-
-                if (invalid_ws)
-                        return NT_STATUS_INVALID_WORKSTATION;
-        }
-
-        if (acct_ctrl & ACB_DOMTRUST) {
-                DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
-                return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
-        }
-
-        if (acct_ctrl & ACB_SVRTRUST) {
-                if (!(user_info->logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
-                        DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
-                        return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
-                }
-        }
-
-        if (acct_ctrl & ACB_WSTRUST) {
-                if (!(user_info->logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
-                        DEBUG(2,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
-                        return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
-                }
-        }
-        return NT_STATUS_OK;
-}
-
-/**
- * Check whether the given password is one of the last two
- * password history entries. If so, the bad pwcount should
- * not be incremented even thought the actual password check
- * failed.
- */
-static bool need_to_increment_bad_pw_count(
-        const struct auth_context *auth_context,
-        struct samu* sampass,
-        const auth_usersupplied_info *user_info)
-{
-        uint8_t i;
-        const uint8_t *pwhistory;
-        uint32_t pwhistory_len;
-        uint32_t policy_pwhistory_len;
-        uint32_t acct_ctrl;
-        const char *username;
-        TALLOC_CTX *mem_ctx = talloc_stackframe();
-        bool result = true;
-
-        pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY,
-                               &policy_pwhistory_len);
-        if (policy_pwhistory_len == 0) {
-                goto done;
-        }
-
-        pwhistory = pdb_get_pw_history(sampass, &pwhistory_len);
-        if (!pwhistory || pwhistory_len == 0) {
-                goto done;
-        }
-
-        acct_ctrl = pdb_get_acct_ctrl(sampass);
-        username = pdb_get_username(sampass);
-
-        for (i=1; i < MIN(MIN(3, policy_pwhistory_len), pwhistory_len); i++) {
-                static const uint8_t zero16[SALTED_MD5_HASH_LEN];
-                const uint8_t *salt;
-                const uint8_t *nt_pw;
-                NTSTATUS status;
-                DATA_BLOB user_sess_key = data_blob_null;
-                DATA_BLOB lm_sess_key = data_blob_null;
-
-                salt = &pwhistory[i*PW_HISTORY_ENTRY_LEN];
-                nt_pw = salt + PW_HISTORY_SALT_LEN;
-
-                if (memcmp(zero16, nt_pw, NT_HASH_LEN) == 0) {
-                        /* skip zero password hash */
-                        continue;
-                }
-
-                if (memcmp(zero16, salt, PW_HISTORY_SALT_LEN) != 0) {
-                        /* skip nonzero salt (old format entry) */
-                        continue;
-                }
-
-                status = sam_password_ok(auth_context, mem_ctx,
-                                         username, acct_ctrl, NULL, nt_pw,
-                                         user_info, &user_sess_key, &lm_sess_key);
-                if (NT_STATUS_IS_OK(status)) {
-                        result = false;
-                        break;
-                }
-        }
-
-done:
-        TALLOC_FREE(mem_ctx);
-        return result;
-}
-
-/****************************************************************************
-check if a username/password is OK assuming the password is a 24 byte
-SMB hash supplied in the user_info structure
-return an NT_STATUS constant.
-****************************************************************************/
-
-static NTSTATUS check_sam_security(const struct auth_context *auth_context,
-                                   void *my_private_data, 
-                                   TALLOC_CTX *mem_ctx,
-                                   const auth_usersupplied_info *user_info, 
-                                   auth_serversupplied_info **server_info)
-{
-        struct samu *sampass=NULL;
-        bool ret;
-        NTSTATUS nt_status;
-        NTSTATUS update_login_attempts_status;
-        DATA_BLOB user_sess_key = data_blob_null;
-        DATA_BLOB lm_sess_key = data_blob_null;
-        bool updated_autolock = False, updated_badpw = False;
-        const char *username;
-        const uint8_t *nt_pw;
-        const uint8_t *lm_pw;
-
         if (!user_info || !auth_context) {
                 return NT_STATUS_UNSUCCESSFUL;
         }
-
-        /* the returned struct gets kept on the server_info, by means
-           of a steal further down */
-
-        sampass = samu_new(mem_ctx);
-        if (sampass == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* get the account information */
-
-        become_root();
-        ret = pdb_getsampwnam(sampass, user_info->internal_username);
-        unbecome_root();
-
-        if (ret == False) {
-                DEBUG(3,("check_sam_security: Couldn't find user '%s' in "
-                         "passdb.\n", user_info->internal_username));
-                TALLOC_FREE(sampass);
-                return NT_STATUS_NO_SUCH_USER;
-        }
-
-        username = pdb_get_username(sampass);
-        nt_pw = pdb_get_nt_passwd(sampass);
-        lm_pw = pdb_get_lanman_passwd(sampass);
-
-        /* see if autolock flag needs to be updated */
-        if (pdb_get_acct_ctrl(sampass) & ACB_NORMAL)
-                pdb_update_autolock_flag(sampass, &updated_autolock);
-        /* Quit if the account was locked out. */
-        if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
-                DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", username));
-                return NT_STATUS_ACCOUNT_LOCKED_OUT;
-        }
-
-        nt_status = sam_password_ok(auth_context, mem_ctx,
-                                    username, pdb_get_acct_ctrl(sampass), lm_pw, nt_pw,
-                                    user_info, &user_sess_key, &lm_sess_key);
-
-        /* Notify passdb backend of login success/failure. If not 
-           NT_STATUS_OK the backend doesn't like the login */
-
-        update_login_attempts_status = pdb_update_login_attempts(sampass, NT_STATUS_IS_OK(nt_status));
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                bool increment_bad_pw_count = false;
-
-                if (NT_STATUS_EQUAL(nt_status,NT_STATUS_WRONG_PASSWORD) && 
-                    pdb_get_acct_ctrl(sampass) & ACB_NORMAL &&
-                    NT_STATUS_IS_OK(update_login_attempts_status)) 
-                {
-                        increment_bad_pw_count =
-                                need_to_increment_bad_pw_count(auth_context,
-                                                               sampass,
-                                                               user_info);
-                }
-
-                if (increment_bad_pw_count) {
-                        pdb_increment_bad_password_count(sampass);
-                        updated_badpw = True;
-                } else {
-                        pdb_update_bad_password_count(sampass, 
-                                                      &updated_badpw);
-                }
-                if (updated_autolock || updated_badpw){
-                        NTSTATUS status;
-
-                        become_root();
-                        status = pdb_update_sam_account(sampass);
-                        unbecome_root();
-
-                        if (!NT_STATUS_IS_OK(status)) {
-                                DEBUG(1, ("Failed to modify entry: %s\n",
-                                          nt_errstr(status)));
-                        }
-                }
-                goto done;
-        }
-
-        if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) &&
-            (pdb_get_bad_password_count(sampass) > 0)){
-                pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
-                pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
-                updated_badpw = True;
-        }
-
-        if (updated_autolock || updated_badpw){
-                NTSTATUS status;
-
-                become_root();
-                status = pdb_update_sam_account(sampass);
-                unbecome_root();
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(1, ("Failed to modify entry: %s\n",
-                                  nt_errstr(status)));
-                }
-        }
-
-        nt_status = sam_account_ok(mem_ctx, sampass, user_info);
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                goto done;
-        }
-
-        become_root();
-        nt_status = make_server_info_sam(server_info, sampass);
-        unbecome_root();
-        sampass = NULL;
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
-                goto done;
-        }
-
-        (*server_info)->user_session_key =
-                data_blob_talloc(*server_info, user_sess_key.data,
-                                 user_sess_key.length);
-        data_blob_free(&user_sess_key);
-
-        (*server_info)->lm_session_key =
-                data_blob_talloc(*server_info, lm_sess_key.data,
-                                 lm_sess_key.length);
-        data_blob_free(&lm_sess_key);
-
-        (*server_info)->nss_token |= user_info->was_mapped;
-
-done:
-        TALLOC_FREE(sampass);
-        data_blob_free(&user_sess_key);
-        data_blob_free(&lm_sess_key);
-        return nt_status;
+        return check_sam_security(&auth_context->challenge, mem_ctx,
+                                  user_info, server_info);
 }
 
@@ -517 +43 @@
 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
+        result->auth = auth_sam_ignoredomain_auth;
+        result->name = "sam_ignoredomain";
 
-        (*auth_method)->auth = check_sam_security;      
-        (*auth_method)->name = "sam_ignoredomain";
+        *auth_method = result;
         return NT_STATUS_OK;
 }
@@ -531 +61 @@
 ****************************************************************************/
 
-static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
-                                         void *my_private_data, 
-                                         TALLOC_CTX *mem_ctx,
-                                         const auth_usersupplied_info *user_info, 
-                                         auth_serversupplied_info **server_info)
+static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context,
+                                    void *my_private_data,
+                                    TALLOC_CTX *mem_ctx,
+                                    const struct auth_usersupplied_info *user_info,
+                                    struct auth_serversupplied_info **server_info)
 {
         bool is_local_name, is_my_domain;
@@ -543 +73 @@
         }
 
-        is_local_name = is_myname(user_info->domain);
-        is_my_domain  = strequal(user_info->domain, lp_workgroup());
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
+        is_local_name = is_myname(user_info->mapped.domain_name);
+        is_my_domain  = strequal(user_info->mapped.domain_name, lp_workgroup());
 
         /* check whether or not we service this domain/workgroup name */
@@ -553 +85 @@
                         if ( !is_local_name ) {
                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
-                                        user_info->domain, (lp_server_role() == ROLE_DOMAIN_MEMBER 
+                                        user_info->mapped.domain_name, (lp_server_role() == ROLE_DOMAIN_MEMBER
                                         ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
                                 return NT_STATUS_NOT_IMPLEMENTED;
@@ -561 +93 @@
                         if ( !is_local_name && !is_my_domain ) {
                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
-                                        user_info->domain));
+                                        user_info->mapped.domain_name));
                                 return NT_STATUS_NOT_IMPLEMENTED;
                         }
@@ -568 +100 @@
         }
 
-        return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
+        return check_sam_security(&auth_context->challenge, mem_ctx,
+                                  user_info, server_info);
 }
 
@@ -574 +107 @@
 static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
+        result->auth = auth_samstrict_auth;
+        result->name = "sam";
 
-        (*auth_method)->auth = check_samstrict_security;
-        (*auth_method)->name = "sam";
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_script.c

@@ -5 +5 @@
 
    Copyright (C) Jeremy Allison 2005.
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -21 +21 @@
 
 #include "includes.h"
+#include "auth.h"
 
 #undef malloc
@@ -41 +42 @@
                                         void *my_private_data, 
                                         TALLOC_CTX *mem_ctx,
-                                        const auth_usersupplied_info *user_info, 
-                                        auth_serversupplied_info **server_info)
+                                        const struct auth_usersupplied_info *user_info,
+                                        struct auth_serversupplied_info **server_info)
 {
         const char *script = lp_parm_const_string( GLOBAL_SECTION_SNUM, "auth_script", "script", NULL);
@@ -63 +64 @@
         }               
 
-        secret_str_len = strlen(user_info->domain) + 1 +
-                        strlen(user_info->smb_name) + 1 +
+        secret_str_len = strlen(user_info->mapped.domain_name) + 1 +
+                        strlen(user_info->client.account_name) + 1 +
                         16 + 1 + /* 8 bytes of challenge going to 16 */
                         48 + 1 + /* 24 bytes of challenge going to 48 */
@@ -74 +75 @@
         }
 
-        safe_strcpy( secret_str, user_info->domain, secret_str_len - 1);
+        safe_strcpy( secret_str, user_info->mapped.domain_name, secret_str_len - 1);
         safe_strcat( secret_str, "\n", secret_str_len - 1);
-        safe_strcat( secret_str, user_info->smb_name, secret_str_len - 1);
+        safe_strcat( secret_str, user_info->client.account_name, secret_str_len - 1);
         safe_strcat( secret_str, "\n", secret_str_len - 1);
 
@@ -85 +86 @@
         safe_strcat( secret_str, "\n", secret_str_len - 1);
 
-        if (user_info->lm_resp.data) {
+        if (user_info->password.response.lanman.data) {
                 for (i = 0; i < 24; i++) {
-                        slprintf(&hex_str[i*2], 3, "%02X", user_info->lm_resp.data[i]);
+                        slprintf(&hex_str[i*2], 3, "%02X", user_info->password.response.lanman.data[i]);
                 }
                 safe_strcat( secret_str, hex_str, secret_str_len - 1);
@@ -93 +94 @@
         safe_strcat( secret_str, "\n", secret_str_len - 1);
 
-        if (user_info->nt_resp.data) {
+        if (user_info->password.response.nt.data) {
                 for (i = 0; i < 24; i++) {
-                        slprintf(&hex_str[i*2], 3, "%02X", user_info->nt_resp.data[i]);
+                        slprintf(&hex_str[i*2], 3, "%02X", user_info->password.response.nt.data[i]);
                 }
                 safe_strcat( secret_str, hex_str, secret_str_len - 1);
@@ -110 +111 @@
         if (ret) {
                 DEBUG(1,("script_check_user_credentials: failed to authenticate %s\\%s\n",
-                        user_info->domain, user_info->smb_name ));
+                        user_info->mapped.domain_name, user_info->client.account_name ));
                 /* auth failed. */
                 return NT_STATUS_NO_SUCH_USER;
@@ -122 +123 @@
 static NTSTATUS auth_init_script(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "script";
-        (*auth_method)->auth = script_check_user_credentials;
+        result->name = "script";
+        result->auth = script_check_user_credentials;
 
         if (param && *param) {
@@ -136 +139 @@
                         return NT_STATUS_UNSUCCESSFUL;
                 }
-                (*auth_method)->private_data = (void *)priv;
+                result->private_data = (void *)priv;
         }
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_server.c

@@ -9 +9 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -20 +20 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "system/passwd.h"
+#include "smbd/smbd.h"
+#include "libsmb/libsmb.h"
 
 #undef DBGC_CLASS
@@ -136 +140 @@
         */
 
-        if (!NT_STATUS_IS_OK(cli_session_setup(cli, "", "", 0, "", 0,
-                                               ""))) {
+        status = cli_session_setup(cli, "", "", 0, "", 0, "");
+        if (!NT_STATUS_IS_OK(status)) {
                 TALLOC_FREE(mutex);
                 DEBUG(0,("%s rejected the initial session setup (%s)\n",
-                         desthost, cli_errstr(cli)));
+                         desthost, nt_errstr(status)));
                 cli_shutdown(cli);
                 return NULL;
@@ -207 +211 @@
                 interval.tv_usec = 0;
 
-                if (event_add_idle(smbd_event_context(), result, interval,
+                if (event_add_idle(server_event_context(), result, interval,
                                    "server_security_keepalive",
                                    send_server_keepalive,
@@ -229 +233 @@
 {
         struct cli_state *cli = server_cryptkey(mem_ctx);
-        
+
         if (cli) {
                 DEBUG(3,("using password server validation\n"));
@@ -237 +241 @@
                            unless 'encrypt passwords = no' */
                         DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
-                        
+
                         /* However, it is still a perfectly fine connection
                            to pass that unencrypted password over */
@@ -256 +260 @@
                 /* The return must be allocated on the caller's mem_ctx, as our own will be
                    destoyed just after the call. */
-                return data_blob_talloc(auth_context->mem_ctx, cli->secblob.data,8);
+                return data_blob_talloc((TALLOC_CTX *)auth_context, cli->secblob.data,8);
         } else {
                 return data_blob_null;
@@ -271 +275 @@
                                          void *my_private_data, 
                                          TALLOC_CTX *mem_ctx,
-                                         const auth_usersupplied_info *user_info, 
-                                         auth_serversupplied_info **server_info)
-{
-        struct server_security_state *state = talloc_get_type_abort(
-                my_private_data, struct server_security_state);
-        struct cli_state *cli;
+                                         const struct auth_usersupplied_info *user_info,
+                                         struct auth_serversupplied_info **server_info)
+{
+        struct server_security_state *state = NULL;
+        struct cli_state *cli = NULL;
         static bool tested_password_server = False;
         static bool bad_password_server = False;
@@ -282 +285 @@
         bool locally_made_cli = False;
 
+        DEBUG(10, ("check_smbserver_security: Check auth for: [%s]\n",
+                user_info->mapped.account_name));
+
+        if (my_private_data == NULL) {
+                DEBUG(10,("check_smbserver_security: "
+                        "password server is not connected\n"));
+                return NT_STATUS_LOGON_FAILURE;
+        }
+
+        state = talloc_get_type_abort(my_private_data, struct server_security_state);
         cli = state->cli;
-        
+
         if (cli) {
         } else {
@@ -294 +307 @@
                 return NT_STATUS_LOGON_FAILURE;
         }  
-        
+
         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
-                if (user_info->encrypted) {
+                if (user_info->password_state != AUTH_PASSWORD_PLAIN) {
                         DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli->desthost));
                         return NT_STATUS_LOGON_FAILURE;         
@@ -325 +338 @@
                 memset(badpass, 0x1f, sizeof(badpass));
 
-                if((user_info->nt_resp.length == sizeof(badpass)) && 
-                   !memcmp(badpass, user_info->nt_resp.data, sizeof(badpass))) {
+                if((user_info->password.response.nt.length == sizeof(badpass)) &&
+                   !memcmp(badpass, user_info->password.response.nt.data, sizeof(badpass))) {
                         /* 
                          * Very unlikely, our random bad password is the same as the users
@@ -347 +360 @@
                                                       (char *)badpass,
                                                       sizeof(badpass),
-                                                      user_info->domain))) {
+                                                      user_info->mapped.domain_name))) {
 
                         /*
@@ -390 +403 @@
          * not guest enabled, we can try with the real password.
          */
-
-        if (!user_info->encrypted) {
+        switch (user_info->password_state) {
+        case AUTH_PASSWORD_PLAIN:
                 /* Plaintext available */
                 nt_status = cli_session_setup(
-                        cli, user_info->smb_name, 
-                        (char *)user_info->plaintext_password.data, 
-                        user_info->plaintext_password.length, 
-                        NULL, 0, user_info->domain);
-
-        } else {
+                        cli, user_info->client.account_name,
+                        user_info->password.plaintext,
+                        strlen(user_info->password.plaintext),
+                        NULL, 0, user_info->mapped.domain_name);
+                break;
+
+        /* currently the hash values include a challenge-response as well */
+        case AUTH_PASSWORD_HASH:
+        case AUTH_PASSWORD_RESPONSE:
                 nt_status = cli_session_setup(
-                        cli, user_info->smb_name, 
-                        (char *)user_info->lm_resp.data, 
-                        user_info->lm_resp.length, 
-                        (char *)user_info->nt_resp.data, 
-                        user_info->nt_resp.length, 
-                        user_info->domain);
+                        cli, user_info->client.account_name,
+                        (char *)user_info->password.response.lanman.data,
+                        user_info->password.response.lanman.length,
+                        (char *)user_info->password.response.nt.data,
+                        user_info->password.response.nt.length,
+                        user_info->mapped.domain_name);
+                break;
+        default:
+                DEBUG(0,("user_info constructed for user '%s' was invalid - password_state=%u invalid.\n",user_info->mapped.account_name, user_info->password_state));
+                nt_status = NT_STATUS_INTERNAL_ERROR;
         }
 
@@ -415 +435 @@
 
         /* if logged in as guest then reject */
-        if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
+        if (cli->is_guestlogin) {
                 DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
                 nt_status = NT_STATUS_LOGON_FAILURE;
@@ -423 +443 @@
 
         if (NT_STATUS_IS_OK(nt_status)) {
-                fstring real_username;
-                struct passwd *pass;
-
-                if ( (pass = smb_getpwnam( NULL, user_info->internal_username, 
-                        real_username, True )) != NULL ) 
+                char *real_username = NULL;
+                struct passwd *pass = NULL;
+
+                if ( (pass = smb_getpwnam(talloc_tos(), user_info->mapped.account_name,
+                        &real_username, True )) != NULL )
                 {
-                        /* if a real user check pam account restrictions */
-                        /* only really perfomed if "obey pam restriction" is true */
-                        nt_status = smb_pam_accountcheck(pass->pw_name);
-                        if (  !NT_STATUS_IS_OK(nt_status)) {
-                                DEBUG(1, ("PAM account restriction prevents user login\n"));
-                        } else {
-
-                                nt_status = make_server_info_pw(server_info, pass->pw_name, pass);
-                        }
+                        nt_status = make_server_info_pw(server_info, pass->pw_name, pass);
                         TALLOC_FREE(pass);
+                        TALLOC_FREE(real_username);
                 }
                 else
@@ -455 +468 @@
 static NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-        (*auth_method)->name = "smbserver";
-        (*auth_method)->auth = check_smbserver_security;
-        (*auth_method)->get_chal = auth_get_challenge_server;
+        result->name = "smbserver";
+        result->auth = check_smbserver_security;
+        result->get_chal = auth_get_challenge_server;
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_unix.c

@@ -3 +3 @@
    Password and authentication handling
    Copyright (C) Andrew Bartlett              2001
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -19 +19 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "system/passwd.h"
+#include "smbd/globals.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
-
-/**
- * update the encrypted smbpasswd file from the plaintext username and password
- *  
- *  this ugly hack needs to die, but not quite yet, I think people still use it...
- **/
-static bool update_smbpassword_file(const char *user, const char *password)
-{
-        struct samu     *sampass;
-        bool            ret;
-        
-        if ( !(sampass = samu_new( NULL )) ) {
-                return False;
-        }
-        
-        become_root();
-        ret = pdb_getsampwnam(sampass, user);
-        unbecome_root();
-
-        if(ret == False) {
-                DEBUG(0,("pdb_getsampwnam returned NULL\n"));
-                TALLOC_FREE(sampass);
-                return False;
-        }
-
-        /*
-         * Remove the account disabled flag - we are updating the
-         * users password from a login.
-         */
-        if (!pdb_set_acct_ctrl(sampass, pdb_get_acct_ctrl(sampass) & ~ACB_DISABLED, PDB_CHANGED)) {
-                TALLOC_FREE(sampass);
-                return False;
-        }
-
-        if (!pdb_set_plaintext_passwd (sampass, password)) {
-                TALLOC_FREE(sampass);
-                return False;
-        }
-
-        /* Now write it into the file. */
-        become_root();
-
-        ret = NT_STATUS_IS_OK(pdb_update_sam_account (sampass));
-
-        unbecome_root();
-
-        if (ret) {
-                DEBUG(3,("pdb_update_sam_account returned %d\n",ret));
-        }
-
-        TALLOC_FREE(sampass);
-        return ret;
-}
-
 
 /** Check a plaintext username/password
@@ -86 +35 @@
                              void *my_private_data, 
                              TALLOC_CTX *mem_ctx,
-                             const auth_usersupplied_info *user_info, 
-                             auth_serversupplied_info **server_info)
+                             const struct auth_usersupplied_info *user_info,
+                             struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status;
         struct passwd *pass = NULL;
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         become_root();
-        pass = Get_Pwnam_alloc(talloc_tos(), user_info->internal_username);
+        pass = Get_Pwnam_alloc(talloc_tos(), user_info->mapped.account_name);
 
-        
         /** @todo This call assumes a ASCII password, no charset transformation is 
             done.  We may need to revisit this **/
         nt_status = pass_check(pass,
-                                pass ? pass->pw_name : user_info->internal_username, 
-                                (char *)user_info->plaintext_password.data,
-                                user_info->plaintext_password.length-1,
-                                lp_update_encrypted() ? 
-                                update_smbpassword_file : NULL,
-                                True);
-        
+                                pass ? pass->pw_name : user_info->mapped.account_name,
+                               smbd_server_conn->client_id.name,
+                                user_info->password.plaintext,
+                                true);
+
         unbecome_root();
 
         if (NT_STATUS_IS_OK(nt_status)) {
                 if (pass) {
-                        /* if a real user check pam account restrictions */
-                        /* only really perfomed if "obey pam restriction" is true */
-                        nt_status = smb_pam_accountcheck(pass->pw_name);
-                        if (  !NT_STATUS_IS_OK(nt_status)) {
-                                DEBUG(1, ("PAM account restriction prevents user login\n"));
-                        } else {
-                                make_server_info_pw(server_info, pass->pw_name, pass);
-                        }
+                        make_server_info_pw(server_info, pass->pw_name, pass);
                 } else {
                         /* we need to do somthing more useful here */
@@ -131 +72 @@
 static NTSTATUS auth_init_unix(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
+        result->name = "unix";
+        result->auth = check_unix_security;
 
-        (*auth_method)->name = "unix";
-        (*auth_method)->auth = check_unix_security;
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_util.c

@@ -12 +12 @@
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +23 @@
 
 #include "includes.h"
-#include "smbd/globals.h"
+#include "auth.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../lib/crypto/arcfour.h"
+#include "rpc_client/init_lsa.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/util_pw.h"
+#include "lib/winbind_util.h"
+#include "passdb.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
-
-/****************************************************************************
- Ensure primary group SID is always at position 0 in a 
- auth_serversupplied_info struct.
-****************************************************************************/
-
-static void sort_sid_array_for_smbd(auth_serversupplied_info *result,
-                                const DOM_SID *pgroup_sid)
-{
-        unsigned int i;
-
-        if (!result->sids) {
-                return;
-        }
-
-        if (sid_compare(&result->sids[0], pgroup_sid)==0) {
-                return;
-        }
-
-        for (i = 1; i < result->num_sids; i++) {
-                if (sid_compare(pgroup_sid,
-                                &result->sids[i]) == 0) {
-                        sid_copy(&result->sids[i], &result->sids[0]);
-                        sid_copy(&result->sids[0], pgroup_sid);
-                        return;
-                }
-        }
-}
 
 /****************************************************************************
@@ -105 +83 @@
 
 /****************************************************************************
- Create an auth_usersupplied_data structure
-****************************************************************************/
-
-static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
-                               const char *smb_name,
-                               const char *internal_username,
-                               const char *client_domain,
-                               const char *domain,
-                               const char *wksta_name,
-                               DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
-                               DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
-                               DATA_BLOB *plaintext,
-                               bool encrypted)
-{
-
-        DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
-
-        *user_info = SMB_MALLOC_P(auth_usersupplied_info);
-        if (*user_info == NULL) {
-                DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info)));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        ZERO_STRUCTP(*user_info);
-
-        DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
-
-        (*user_info)->smb_name = SMB_STRDUP(smb_name);
-        if ((*user_info)->smb_name == NULL) { 
-                free_user_info(user_info);
-                return NT_STATUS_NO_MEMORY;
-        }
-        
-        (*user_info)->internal_username = SMB_STRDUP(internal_username);
-        if ((*user_info)->internal_username == NULL) { 
-                free_user_info(user_info);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        (*user_info)->domain = SMB_STRDUP(domain);
-        if ((*user_info)->domain == NULL) { 
-                free_user_info(user_info);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        (*user_info)->client_domain = SMB_STRDUP(client_domain);
-        if ((*user_info)->client_domain == NULL) { 
-                free_user_info(user_info);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        (*user_info)->wksta_name = SMB_STRDUP(wksta_name);
-        if ((*user_info)->wksta_name == NULL) { 
-                free_user_info(user_info);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
-
-        if (lm_pwd)
-                (*user_info)->lm_resp = data_blob(lm_pwd->data, lm_pwd->length);
-        if (nt_pwd)
-                (*user_info)->nt_resp = data_blob(nt_pwd->data, nt_pwd->length);
-        if (lm_interactive_pwd)
-                (*user_info)->lm_interactive_pwd = data_blob(lm_interactive_pwd->data, lm_interactive_pwd->length);
-        if (nt_interactive_pwd)
-                (*user_info)->nt_interactive_pwd = data_blob(nt_interactive_pwd->data, nt_interactive_pwd->length);
-
-        if (plaintext)
-                (*user_info)->plaintext_password = data_blob(plaintext->data, plaintext->length);
-
-        (*user_info)->encrypted = encrypted;
-
-        (*user_info)->logon_parameters = 0;
-
-        DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
-
-        return NT_STATUS_OK;
-}
-
-/****************************************************************************
  Create an auth_usersupplied_data structure after appropriate mapping.
 ****************************************************************************/
 
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
                             const char *smb_name,
                             const char *client_domain,
-                            const char *wksta_name,
+                            const char *workstation_name,
                             DATA_BLOB *lm_pwd,
                             DATA_BLOB *nt_pwd,
-                            DATA_BLOB *lm_interactive_pwd,
-                            DATA_BLOB *nt_interactive_pwd,
-                            DATA_BLOB *plaintext,
-                            bool encrypted)
-{
-        struct smbd_server_connection *sconn = smbd_server_conn;
+                            const struct samr_Password *lm_interactive_pwd,
+                            const struct samr_Password *nt_interactive_pwd,
+                            const char *plaintext,
+                            enum auth_password_state password_state)
+{
         const char *domain;
         NTSTATUS result;
         bool was_mapped;
-        fstring internal_username;
-        fstrcpy(internal_username, smb_name);
-        was_mapped = map_username(sconn, internal_username);
+        char *internal_username = NULL;
+
+        was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
+        if (!internal_username) {
+                return NT_STATUS_NO_MEMORY;
+        }
 
         DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
-                 client_domain, smb_name, wksta_name));
+                 client_domain, smb_name, workstation_name));
 
         domain = client_domain;
@@ -230 +129 @@
                 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
                           "workstation [%s]\n",
-                          client_domain, domain, smb_name, wksta_name));
+                          client_domain, domain, smb_name, workstation_name));
         }
 
@@ -238 +137 @@
 
         result = make_user_info(user_info, smb_name, internal_username,
-                              client_domain, domain, wksta_name,
+                              client_domain, domain, workstation_name,
                               lm_pwd, nt_pwd,
                               lm_interactive_pwd, nt_interactive_pwd,
-                              plaintext, encrypted);
+                              plaintext, password_state);
         if (NT_STATUS_IS_OK(result)) {
+                /* We have tried mapping */
+                (*user_info)->mapped_state = True;
+                /* did we actually map the user to a different name? */
                 (*user_info)->was_mapped = was_mapped;
         }
@@ -253 +155 @@
 ****************************************************************************/
 
-bool make_user_info_netlogon_network(auth_usersupplied_info **user_info, 
+bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
                                      const char *smb_name, 
                                      const char *client_domain, 
-                                     const char *wksta_name, 
+                                     const char *workstation_name,
                                      uint32 logon_parameters,
                                      const uchar *lm_network_pwd,
@@ -270 +172 @@
         status = make_user_info_map(user_info,
                                     smb_name, client_domain, 
-                                    wksta_name, 
+                                    workstation_name,
                                     lm_pwd_len ? &lm_blob : NULL, 
                                     nt_pwd_len ? &nt_blob : NULL,
                                     NULL, NULL, NULL,
-                                    True);
+                                    AUTH_PASSWORD_RESPONSE);
 
         if (NT_STATUS_IS_OK(status)) {
@@ -291 +193 @@
 ****************************************************************************/
 
-bool make_user_info_netlogon_interactive(auth_usersupplied_info **user_info, 
+bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
                                          const char *smb_name, 
                                          const char *client_domain, 
-                                         const char *wksta_name, 
+                                         const char *workstation_name,
                                          uint32 logon_parameters,
                                          const uchar chal[8], 
@@ -301 +203 @@
                                          const uchar *dc_sess_key)
 {
-        unsigned char lm_pwd[16];
-        unsigned char nt_pwd[16];
+        struct samr_Password lm_pwd;
+        struct samr_Password nt_pwd;
         unsigned char local_lm_response[24];
         unsigned char local_nt_response[24];
         unsigned char key[16];
-        
+
         memcpy(key, dc_sess_key, 16);
-        
+
         if (lm_interactive_pwd)
-                memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
+                memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
 
         if (nt_interactive_pwd)
-                memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
-        
+                memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
+
 #ifdef DEBUG_PASSWORD
         DEBUG(100,("key:"));
         dump_data(100, key, sizeof(key));
-        
+
         DEBUG(100,("lm owf password:"));
-        dump_data(100, lm_pwd, sizeof(lm_pwd));
-        
+        dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
+
         DEBUG(100,("nt owf password:"));
-        dump_data(100, nt_pwd, sizeof(nt_pwd));
+        dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
 #endif
-        
+
         if (lm_interactive_pwd)
-                arcfour_crypt(lm_pwd, key, sizeof(lm_pwd));
-        
+                arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
+
         if (nt_interactive_pwd)
-                arcfour_crypt(nt_pwd, key, sizeof(nt_pwd));
-        
+                arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
+
 #ifdef DEBUG_PASSWORD
         DEBUG(100,("decrypt of lm owf password:"));
-        dump_data(100, lm_pwd, sizeof(lm_pwd));
-        
+        dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
+
         DEBUG(100,("decrypt of nt owf password:"));
-        dump_data(100, nt_pwd, sizeof(nt_pwd));
+        dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
 #endif
-        
+
         if (lm_interactive_pwd)
-                SMBOWFencrypt(lm_pwd, chal,
+                SMBOWFencrypt(lm_pwd.hash, chal,
                               local_lm_response);
 
         if (nt_interactive_pwd)
-                SMBOWFencrypt(nt_pwd, chal,
+                SMBOWFencrypt(nt_pwd.hash, chal,
                               local_nt_response);
-        
+
         /* Password info paranoia */
         ZERO_STRUCT(key);
@@ -357 +259 @@
                 DATA_BLOB local_nt_blob;
 
-                DATA_BLOB lm_interactive_blob;
-                DATA_BLOB nt_interactive_blob;
-                
                 if (lm_interactive_pwd) {
                         local_lm_blob = data_blob(local_lm_response,
                                                   sizeof(local_lm_response));
-                        lm_interactive_blob = data_blob(lm_pwd,
-                                                        sizeof(lm_pwd));
-                        ZERO_STRUCT(lm_pwd);
                 }
-                
+
                 if (nt_interactive_pwd) {
                         local_nt_blob = data_blob(local_nt_response,
                                                   sizeof(local_nt_response));
-                        nt_interactive_blob = data_blob(nt_pwd,
-                                                        sizeof(nt_pwd));
-                        ZERO_STRUCT(nt_pwd);
                 }
 
                 nt_status = make_user_info_map(
                         user_info, 
-                        smb_name, client_domain, wksta_name, 
+                        smb_name, client_domain, workstation_name,
                         lm_interactive_pwd ? &local_lm_blob : NULL,
                         nt_interactive_pwd ? &local_nt_blob : NULL,
-                        lm_interactive_pwd ? &lm_interactive_blob : NULL,
-                        nt_interactive_pwd ? &nt_interactive_blob : NULL,
-                        NULL, True);
+                        lm_interactive_pwd ? &lm_pwd : NULL,
+                        nt_interactive_pwd ? &nt_pwd : NULL,
+                        NULL, AUTH_PASSWORD_HASH);
 
                 if (NT_STATUS_IS_OK(nt_status)) {
@@ -392 +285 @@
                 data_blob_free(&local_lm_blob);
                 data_blob_free(&local_nt_blob);
-                data_blob_free(&lm_interactive_blob);
-                data_blob_free(&nt_interactive_blob);
                 return ret;
         }
@@ -403 +294 @@
 ****************************************************************************/
 
-bool make_user_info_for_reply(auth_usersupplied_info **user_info, 
+bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
                               const char *smb_name, 
                               const char *client_domain,
@@ -413 +304 @@
         DATA_BLOB local_nt_blob;
         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
-                        
+        char *plaintext_password_string;
         /*
          * Not encrypted - do so.
          */
-        
+
         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
                  "format.\n"));
-        
-        if (plaintext_password.data) {
+        if (plaintext_password.data && plaintext_password.length) {
                 unsigned char local_lm_response[24];
-                
+
 #ifdef DEBUG_PASSWORD
                 DEBUG(10,("Unencrypted password (len %d):\n",
@@ -434 +324 @@
                             (const uchar*)chal, local_lm_response);
                 local_lm_blob = data_blob(local_lm_response, 24);
-                
+
                 /* We can't do an NT hash here, as the password needs to be
                    case insensitive */
                 local_nt_blob = data_blob_null; 
-                
         } else {
                 local_lm_blob = data_blob_null; 
                 local_nt_blob = data_blob_null; 
         }
-        
+
+        plaintext_password_string = talloc_strndup(talloc_tos(),
+                                                   (const char *)plaintext_password.data,
+                                                   plaintext_password.length);
+        if (!plaintext_password_string) {
+                return False;
+        }
+
         ret = make_user_info_map(
                 user_info, smb_name, client_domain, 
@@ -450 +346 @@
                 local_nt_blob.data ? &local_nt_blob : NULL,
                 NULL, NULL,
-                plaintext_password.data ? &plaintext_password : NULL, 
-                False);
-        
+                plaintext_password_string,
+                AUTH_PASSWORD_PLAIN);
+
+        if (plaintext_password_string) {
+                memset(plaintext_password_string, '\0', strlen(plaintext_password_string));
+                talloc_free(plaintext_password_string);
+        }
+
         data_blob_free(&local_lm_blob);
         return NT_STATUS_IS_OK(ret) ? True : False;
@@ -461 +362 @@
 ****************************************************************************/
 
-NTSTATUS make_user_info_for_reply_enc(auth_usersupplied_info **user_info, 
+NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
                                       const char *smb_name,
                                       const char *client_domain, 
@@ -472 +373 @@
                                   nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
                                   NULL, NULL, NULL,
-                                  True);
+                                  AUTH_PASSWORD_RESPONSE);
 }
 
@@ -479 +380 @@
 ****************************************************************************/
 
-bool make_user_info_guest(auth_usersupplied_info **user_info) 
+bool make_user_info_guest(struct auth_usersupplied_info **user_info)
 {
         NTSTATUS nt_status;
@@ -490 +391 @@
                                    NULL, NULL, 
                                    NULL,
-                                   True);
-                              
+                                   AUTH_PASSWORD_RESPONSE);
+
         return NT_STATUS_IS_OK(nt_status) ? True : False;
 }
 
-static int server_info_dtor(auth_serversupplied_info *server_info)
-{
-        TALLOC_FREE(server_info->sam_account);
-        ZERO_STRUCTP(server_info);
-        return 0;
-}
-
-/***************************************************************************
- Make a server_info struct. Free with TALLOC_FREE().
-***************************************************************************/
-
-static auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
-{
-        struct auth_serversupplied_info *result;
-
-        result = TALLOC_ZERO_P(mem_ctx, auth_serversupplied_info);
-        if (result == NULL) {
-                DEBUG(0, ("talloc failed\n"));
-                return NULL;
-        }
-
-        talloc_set_destructor(result, server_info_dtor);
-
-        /* Initialise the uid and gid values to something non-zero
-           which may save us from giving away root access if there
-           is a bug in allocating these fields. */
-
-        result->utok.uid = -1;
-        result->utok.gid = -1;
-        return result;
-}
-
-static char *sanitize_username(TALLOC_CTX *mem_ctx, const char *username)
-{
-        fstring tmp;
-
-        alpha_strcpy(tmp, username, ". _-$", sizeof(tmp));
-        return talloc_strdup(mem_ctx, tmp);
-}
-
-/***************************************************************************
- Is the incoming username our own machine account ?
- If so, the connection is almost certainly from winbindd.
-***************************************************************************/
-
-static bool is_our_machine_account(const char *username)
-{
-        bool ret;
-        char *truncname = NULL;
-        size_t ulen = strlen(username);
-
-        if (ulen == 0 || username[ulen-1] != '$') {
-                return false;
-        }
-        truncname = SMB_STRDUP(username);
-        if (!truncname) {
-                return false;
-        }
-        truncname[ulen-1] = '\0';
-        ret = strequal(truncname, global_myname());
-        SAFE_FREE(truncname);
-        return ret;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a struct samu
-***************************************************************************/
-
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
-                              struct samu *sampass)
-{
-        struct passwd *pwd;
-        gid_t *gids;
-        auth_serversupplied_info *result;
-        const char *username = pdb_get_username(sampass);
-        NTSTATUS status;
-
-        if ( !(result = make_server_info(NULL)) ) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if ( !(pwd = Get_Pwnam_alloc(result, username)) ) {
-                DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
-                          pdb_get_username(sampass)));
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_SUCH_USER;
-        }
-
-        result->sam_account = sampass;
-        result->unix_name = pwd->pw_name;
-        /* Ensure that we keep pwd->pw_name, because we will free pwd below */
-        talloc_steal(result, pwd->pw_name);
-        result->utok.gid = pwd->pw_gid;
-        result->utok.uid = pwd->pw_uid;
-
-        TALLOC_FREE(pwd);
-
-        result->sanitized_username = sanitize_username(result,
-                                                       result->unix_name);
-        if (result->sanitized_username == NULL) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (IS_DC && is_our_machine_account(username)) {
-                /*
-                 * Ensure for a connection from our own
-                 * machine account (from winbindd on a DC)
-                 * there are no supplementary groups.
-                 * Prevents loops in calling gid_to_sid().
-                 */
-                result->sids = NULL;
-                gids = NULL;
-                result->num_sids = 0;
-
-                /*
-                 * This is a hack of monstrous proportions.
-                 * If we know it's winbindd talking to us,
-                 * we know we must never recurse into it,
-                 * so turn off contacting winbindd for this
-                 * entire process. This will get fixed when
-                 * winbindd doesn't need to talk to smbd on
-                 * a PDC. JRA.
-                 */
-
-                (void)winbind_off();
-
-                DEBUG(10, ("make_server_info_sam: our machine account %s "
-                        "setting supplementary group list empty and "
-                        "turning off winbindd requests.\n",
-                        username));
-        } else {
-                status = pdb_enum_group_memberships(result, sampass,
-                                            &result->sids, &gids,
-                                            &result->num_sids);
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
-                                   nt_errstr(status)));
-                        result->sam_account = NULL; /* Don't free on error exit. */
-                        TALLOC_FREE(result);
-                        return status;
-                }
-        }
-
-        /* For now we throw away the gids and convert via sid_to_gid
-         * later. This needs fixing, but I'd like to get the code straight and
-         * simple first. */
-         
-        TALLOC_FREE(gids);
-
-        DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
-                 pdb_get_username(sampass), result->unix_name));
-
-        *server_info = result;
-        /* Ensure that the sampass will be freed with the result */
-        talloc_steal(result, sampass);
-
-        return NT_STATUS_OK;
-}
-
-static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
+static NTSTATUS log_nt_token(struct security_token *token)
 {
         TALLOC_CTX *frame = talloc_stackframe();
@@ -673 +413 @@
                 group_sidstr = talloc_asprintf(
                         frame, "%s %s", group_sidstr,
-                        sid_string_talloc(frame, &token->user_sids[i]));
+                        sid_string_talloc(frame, &token->sids[i]));
         }
 
         command = talloc_string_sub(
                 frame, lp_log_nt_token_command(),
-                "%s", sid_string_talloc(frame, &token->user_sids[0]));
+                "%s", sid_string_talloc(frame, &token->sids[0]));
         command = talloc_string_sub(frame, command, "%t", group_sidstr);
 
@@ -698 +438 @@
 
 /*
- * Create the token to use from server_info->sam_account and
+ * Create the token to use from server_info->info3 and
  * server_info->sids (the info3/sam groups). Find the unix gids.
  */
 
-NTSTATUS create_local_token(auth_serversupplied_info *server_info)
-{
+NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
+{
+        struct security_token *t;
         NTSTATUS status;
         size_t i;
         struct dom_sid tmp_sid;
+        struct wbcUnixId *ids;
 
         /*
@@ -722 +464 @@
                                                     &server_info->utok.gid,
                                                     &server_info->unix_name,
-                                                    &server_info->ptok);
+                                                    &server_info->security_token);
 
         } else {
-                server_info->ptok = create_local_nt_token(
-                        server_info,
-                        pdb_get_user_sid(server_info->sam_account),
-                        server_info->guest,
-                        server_info->num_sids, server_info->sids);
-                status = server_info->ptok ?
-                        NT_STATUS_OK : NT_STATUS_NO_SUCH_USER;
+                status = create_local_nt_token_from_info3(server_info,
+                                                          server_info->guest,
+                                                          server_info->info3,
+                                                          &server_info->extra,
+                                                          &server_info->security_token);
         }
 
@@ -743 +483 @@
         server_info->utok.groups = NULL;
 
+        t = server_info->security_token;
+
+        ids = TALLOC_ARRAY(talloc_tos(), struct wbcUnixId,
+                           t->num_sids);
+        if (ids == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!sids_to_unix_ids(t->sids, t->num_sids, ids)) {
+                TALLOC_FREE(ids);
+                return NT_STATUS_NO_MEMORY;
+        }
+
         /* Start at index 1, where the groups start. */
 
-        for (i=1; i<server_info->ptok->num_sids; i++) {
-                gid_t gid;
-                DOM_SID *sid = &server_info->ptok->user_sids[i];
-
-                if (!sid_to_gid(sid, &gid)) {
+        for (i=1; i<t->num_sids; i++) {
+
+                if (ids[i].type != WBC_ID_TYPE_GID) {
                         DEBUG(10, ("Could not convert SID %s to gid, "
-                                   "ignoring it\n", sid_string_dbg(sid)));
+                                   "ignoring it\n",
+                                   sid_string_dbg(&t->sids[i])));
                         continue;
                 }
-                add_gid_to_array_unique(server_info, gid,
-                                        &server_info->utok.groups,
-                                        &server_info->utok.ngroups);
+                if (!add_gid_to_array_unique(server_info, ids[i].id.gid,
+                                             &server_info->utok.groups,
+                                             &server_info->utok.ngroups)) {
+                        return NT_STATUS_NO_MEMORY;
+                }
         }
 
@@ -772 +526 @@
          */
 
-        if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
-                DEBUG(1,("create_local_token: Failed to create SID "
-                        "for uid %u!\n", (unsigned int)server_info->utok.uid));
-        }
-        add_sid_to_array_unique(server_info->ptok, &tmp_sid,
-                                &server_info->ptok->user_sids,
-                                &server_info->ptok->num_sids);
+        uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid);
+
+        add_sid_to_array_unique(server_info->security_token, &tmp_sid,
+                                &server_info->security_token->sids,
+                                &server_info->security_token->num_sids);
 
         for ( i=0; i<server_info->utok.ngroups; i++ ) {
-                if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
-                        DEBUG(1,("create_local_token: Failed to create SID "
-                                "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
-                        continue;
-                }
-                add_sid_to_array_unique(server_info->ptok, &tmp_sid,
-                                        &server_info->ptok->user_sids,
-                                        &server_info->ptok->num_sids);
-        }
-
-        debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+                gid_to_unix_groups_sid(server_info->utok.groups[i], &tmp_sid);
+                add_sid_to_array_unique(server_info->security_token, &tmp_sid,
+                                        &server_info->security_token->sids,
+                                        &server_info->security_token->num_sids);
+        }
+
+        security_token_debug(DBGC_AUTH, 10, server_info->security_token);
         debug_unix_user_token(DBGC_AUTH, 10,
                               server_info->utok.uid,
@@ -798 +546 @@
                               server_info->utok.groups);
 
-        status = log_nt_token(server_info->ptok);
+        status = log_nt_token(server_info->security_token);
         return status;
-}
-
-/*
- * Create an artificial NT token given just a username. (Initially intended
- * for force user)
- *
- * We go through lookup_name() to avoid problems we had with 'winbind use
- * default domain'.
- *
- * We have 3 cases:
- *
- * unmapped unix users: Go directly to nss to find the user's group.
- *
- * A passdb user: The list of groups is provided by pdb_enum_group_memberships.
- *
- * If the user is provided by winbind, the primary gid is set to "domain
- * users" of the user's domain. For an explanation why this is necessary, see
- * the thread starting at
- * http://lists.samba.org/archive/samba-technical/2006-January/044803.html.
- */
-
-NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
-                                    bool is_guest,
-                                    uid_t *uid, gid_t *gid,
-                                    char **found_username,
-                                    struct nt_user_token **token)
-{
-        NTSTATUS result = NT_STATUS_NO_SUCH_USER;
-        TALLOC_CTX *tmp_ctx;
-        DOM_SID user_sid;
-        enum lsa_SidType type;
-        gid_t *gids;
-        DOM_SID *group_sids;
-        DOM_SID unix_group_sid;
-        size_t num_group_sids;
-        size_t num_gids;
-        size_t i;
-
-        tmp_ctx = talloc_new(NULL);
-        if (tmp_ctx == NULL) {
-                DEBUG(0, ("talloc_new failed\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!lookup_name_smbconf(tmp_ctx, username, LOOKUP_NAME_ALL,
-                         NULL, NULL, &user_sid, &type)) {
-                DEBUG(1, ("lookup_name_smbconf for %s failed\n", username));
-                goto done;
-        }
-
-        if (type != SID_NAME_USER) {
-                DEBUG(1, ("%s is a %s, not a user\n", username,
-                          sid_type_lookup(type)));
-                goto done;
-        }
-
-        if (sid_check_is_in_our_domain(&user_sid)) {
-                bool ret;
-
-                /* This is a passdb user, so ask passdb */
-
-                struct samu *sam_acct = NULL;
-
-                if ( !(sam_acct = samu_new( tmp_ctx )) ) {
-                        result = NT_STATUS_NO_MEMORY;
-                        goto done;
-                }
-
-                become_root();
-                ret = pdb_getsampwsid(sam_acct, &user_sid);
-                unbecome_root();
-
-                if (!ret) {
-                        DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
-                                  sid_string_dbg(&user_sid), username));
-                        DEBUGADD(1, ("Fall back to unix user %s\n", username));
-                        goto unix_user;
-                }
-
-                result = pdb_enum_group_memberships(tmp_ctx, sam_acct,
-                                                    &group_sids, &gids,
-                                                    &num_group_sids);
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(1, ("enum_group_memberships failed for %s (%s): "
-                                  "%s\n", username, sid_string_dbg(&user_sid),
-                                  nt_errstr(result)));
-                        DEBUGADD(1, ("Fall back to unix user %s\n", username));
-                        goto unix_user;
-                }
-
-                /* see the smb_panic() in pdb_default_enum_group_memberships */
-                SMB_ASSERT(num_group_sids > 0); 
-
-                *gid = gids[0];
-
-                /* Ensure we're returning the found_username on the right context. */
-                *found_username = talloc_strdup(mem_ctx,
-                                                pdb_get_username(sam_acct));
-
-                /*
-                 * If the SID from lookup_name() was the guest sid, passdb knows
-                 * about the mapping of guest sid to lp_guestaccount()
-                 * username and will return the unix_pw info for a guest
-                 * user. Use it if it's there, else lookup the *uid details
-                 * using Get_Pwnam_alloc(). See bug #6291 for details. JRA.
-                 */
-
-                /* We must always assign the *uid. */
-                if (sam_acct->unix_pw == NULL) {
-                        struct passwd *pwd = Get_Pwnam_alloc(sam_acct, *found_username );
-                        if (!pwd) {
-                                DEBUG(10, ("Get_Pwnam_alloc failed for %s\n",
-                                        *found_username));
-                                result = NT_STATUS_NO_SUCH_USER;
-                                goto done;
-                        }
-                        result = samu_set_unix(sam_acct, pwd );
-                        if (!NT_STATUS_IS_OK(result)) {
-                                DEBUG(10, ("samu_set_unix failed for %s\n",
-                                        *found_username));
-                                result = NT_STATUS_NO_SUCH_USER;
-                                goto done;
-                        }
-                }
-                *uid = sam_acct->unix_pw->pw_uid;
-
-        } else  if (sid_check_is_in_unix_users(&user_sid)) {
-
-                /* This is a unix user not in passdb. We need to ask nss
-                 * directly, without consulting passdb */
-
-                struct passwd *pass;
-
-                /*
-                 * This goto target is used as a fallback for the passdb
-                 * case. The concrete bug report is when passdb gave us an
-                 * unmapped gid.
-                 */
-
-        unix_user:
-
-                if (!sid_to_uid(&user_sid, uid)) {
-                        DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
-                                  username, sid_string_dbg(&user_sid)));
-                        result = NT_STATUS_NO_SUCH_USER;
-                        goto done;
-                }
-
-                uid_to_unix_users_sid(*uid, &user_sid);
-
-                pass = getpwuid_alloc(tmp_ctx, *uid);
-                if (pass == NULL) {
-                        DEBUG(1, ("getpwuid(%u) for user %s failed\n",
-                                  (unsigned int)*uid, username));
-                        goto done;
-                }
-
-                if (!getgroups_unix_user(tmp_ctx, username, pass->pw_gid,
-                                         &gids, &num_group_sids)) {
-                        DEBUG(1, ("getgroups_unix_user for user %s failed\n",
-                                  username));
-                        goto done;
-                }
-
-                if (num_group_sids) {
-                        group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
-                        if (group_sids == NULL) {
-                                DEBUG(1, ("TALLOC_ARRAY failed\n"));
-                                result = NT_STATUS_NO_MEMORY;
-                                goto done;
-                        }
-                } else {
-                        group_sids = NULL;
-                }
-
-                for (i=0; i<num_group_sids; i++) {
-                        gid_to_sid(&group_sids[i], gids[i]);
-                }
-
-                /* In getgroups_unix_user we always set the primary gid */
-                SMB_ASSERT(num_group_sids > 0); 
-
-                *gid = gids[0];
-
-                /* Ensure we're returning the found_username on the right context. */
-                *found_username = talloc_strdup(mem_ctx, pass->pw_name);
-        } else {
-
-                /* This user is from winbind, force the primary gid to the
-                 * user's "domain users" group. Under certain circumstances
-                 * (user comes from NT4), this might be a loss of
-                 * information. But we can not rely on winbind getting the
-                 * correct info. AD might prohibit winbind looking up that
-                 * information. */
-
-                uint32 dummy;
-
-                /* We must always assign the *uid. */
-                if (!sid_to_uid(&user_sid, uid)) {
-                        DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
-                                  username, sid_string_dbg(&user_sid)));
-                        result = NT_STATUS_NO_SUCH_USER;
-                        goto done;
-                }
-
-                num_group_sids = 1;
-                group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
-                if (group_sids == NULL) {
-                        DEBUG(1, ("TALLOC_ARRAY failed\n"));
-                        result = NT_STATUS_NO_MEMORY;
-                        goto done;
-                }
-
-                sid_copy(&group_sids[0], &user_sid);
-                sid_split_rid(&group_sids[0], &dummy);
-                sid_append_rid(&group_sids[0], DOMAIN_GROUP_RID_USERS);
-
-                if (!sid_to_gid(&group_sids[0], gid)) {
-                        DEBUG(1, ("sid_to_gid(%s) failed\n",
-                                  sid_string_dbg(&group_sids[0])));
-                        goto done;
-                }
-
-                gids = gid;
-
-                /* Ensure we're returning the found_username on the right context. */
-                *found_username = talloc_strdup(mem_ctx, username);
-        }
-
-        /* Add the "Unix Group" SID for each gid to catch mapped groups
-           and their Unix equivalent.  This is to solve the backwards
-           compatibility problem of 'valid users = +ntadmin' where
-           ntadmin has been paired with "Domain Admins" in the group
-           mapping table.  Otherwise smb.conf would need to be changed
-           to 'valid user = "Domain Admins"'.  --jerry */
-
-        num_gids = num_group_sids;
-        for ( i=0; i<num_gids; i++ ) {
-                gid_t high, low;
-
-                /* don't pickup anything managed by Winbind */
-
-                if ( lp_idmap_gid(&low, &high) && (gids[i] >= low) && (gids[i] <= high) )
-                        continue;
-
-                if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
-                        DEBUG(1,("create_token_from_username: Failed to create SID "
-                                "for gid %u!\n", (unsigned int)gids[i]));
-                        continue;
-                }
-                result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
-                                                 &group_sids, &num_group_sids);
-                if (!NT_STATUS_IS_OK(result)) {
-                        goto done;
-                }
-        }
-
-        /* Ensure we're creating the nt_token on the right context. */
-        *token = create_local_nt_token(mem_ctx, &user_sid,
-                                       is_guest, num_group_sids, group_sids);
-
-        if ((*token == NULL) || (*found_username == NULL)) {
-                result = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        result = NT_STATUS_OK;
- done:
-        TALLOC_FREE(tmp_ctx);
-        return result;
-}
-
-/***************************************************************************
- Build upon create_token_from_username:
-
- Expensive helper function to figure out whether a user given its name is
- member of a particular group.
-***************************************************************************/
-
-bool user_in_group_sid(const char *username, const DOM_SID *group_sid)
-{
-        NTSTATUS status;
-        uid_t uid;
-        gid_t gid;
-        char *found_username;
-        struct nt_user_token *token;
-        bool result;
-
-        TALLOC_CTX *mem_ctx;
-
-        mem_ctx = talloc_new(NULL);
-        if (mem_ctx == NULL) {
-                DEBUG(0, ("talloc_new failed\n"));
-                return False;
-        }
-
-        status = create_token_from_username(mem_ctx, username, False,
-                                            &uid, &gid, &found_username,
-                                            &token);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(10, ("could not create token for %s\n", username));
-                return False;
-        }
-
-        result = nt_token_check_sid(group_sid, token);
-
-        TALLOC_FREE(mem_ctx);
-        return result;
-        
-}
-
-bool user_in_group(const char *username, const char *groupname)
-{
-        TALLOC_CTX *mem_ctx;
-        DOM_SID group_sid;
-        bool ret;
-
-        mem_ctx = talloc_new(NULL);
-        if (mem_ctx == NULL) {
-                DEBUG(0, ("talloc_new failed\n"));
-                return False;
-        }
-
-        ret = lookup_name(mem_ctx, groupname, LOOKUP_NAME_ALL,
-                          NULL, NULL, &group_sid, NULL);
-        TALLOC_FREE(mem_ctx);
-
-        if (!ret) {
-                DEBUG(10, ("lookup_name for (%s) failed.\n", groupname));
-                return False;
-        }
-
-        return user_in_group_sid(username, &group_sid);
 }
 
@@ -1141 +555 @@
 ***************************************************************************/
 
-NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, 
+NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
                              char *unix_username,
                              struct passwd *pwd)
@@ -1147 +561 @@
         NTSTATUS status;
         struct samu *sampass = NULL;
-        gid_t *gids;
         char *qualified_name = NULL;
         TALLOC_CTX *mem_ctx = NULL;
-        DOM_SID u_sid;
+        struct dom_sid u_sid;
         enum lsa_SidType type;
-        auth_serversupplied_info *result;
-        
-        if ( !(sampass = samu_new( NULL )) ) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        
-        status = samu_set_unix( sampass, pwd );
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        result = make_server_info(NULL);
-        if (result == NULL) {
-                TALLOC_FREE(sampass);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        result->sam_account = sampass;
-
-        result->unix_name = talloc_strdup(result, unix_username);
-        result->sanitized_username = sanitize_username(result, unix_username);
-
-        if ((result->unix_name == NULL)
-            || (result->sanitized_username == NULL)) {
-                TALLOC_FREE(sampass);
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        result->utok.uid = pwd->pw_uid;
-        result->utok.gid = pwd->pw_gid;
-
-        status = pdb_enum_group_memberships(result, sampass,
-                                            &result->sids, &gids,
-                                            &result->num_sids);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
-                           nt_errstr(status)));
-                TALLOC_FREE(result);
-                return status;
-        }
+        struct auth_serversupplied_info *result;
 
         /*
@@ -1210 +582 @@
         mem_ctx = talloc_init("make_server_info_pw_tmp");
         if (!mem_ctx) {
-                TALLOC_FREE(result);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -1218 +589 @@
                                         unix_username );
         if (!qualified_name) {
-                TALLOC_FREE(result);
                 TALLOC_FREE(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
@@ -1226 +596 @@
                                                 NULL, NULL,
                                                 &u_sid, &type)) {
-                TALLOC_FREE(result);
                 TALLOC_FREE(mem_ctx);
                 return NT_STATUS_NO_SUCH_USER;
@@ -1234 +603 @@
 
         if (type != SID_NAME_USER) {
-                TALLOC_FREE(result);
                 return NT_STATUS_NO_SUCH_USER;
         }
 
-        status = add_sid_to_array_unique(result, &u_sid,
-                                         &result->sids,
-                                         &result->num_sids);
+        if ( !(sampass = samu_new( NULL )) ) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        status = samu_set_unix( sampass, pwd );
         if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        /* In pathological cases the above call can set the account
+         * name to the DOMAIN\username form. Reset the account name
+         * using unix_username */
+        pdb_set_username(sampass, unix_username, PDB_SET);
+
+        /* set the user sid to be the calculated u_sid */
+        pdb_set_user_sid(sampass, &u_sid, PDB_SET);
+
+        result = make_server_info(NULL);
+        if (result == NULL) {
+                TALLOC_FREE(sampass);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        status = samu_to_SamInfo3(result, sampass, global_myname(),
+                                  &result->info3, &result->extra);
+        TALLOC_FREE(sampass);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("Failed to convert samu to info3: %s\n",
+                           nt_errstr(status)));
                 TALLOC_FREE(result);
                 return status;
         }
 
-        /* For now we throw away the gids and convert via sid_to_gid
-         * later. This needs fixing, but I'd like to get the code straight and
-         * simple first. */
-        TALLOC_FREE(gids);
+        result->unix_name = talloc_strdup(result, unix_username);
+        result->sanitized_username = sanitize_username(result, unix_username);
+
+        if ((result->unix_name == NULL)
+            || (result->sanitized_username == NULL)) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        result->utok.uid = pwd->pw_uid;
+        result->utok.gid = pwd->pw_gid;
 
         *server_info = result;
 
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
+                                struct netr_SamInfo3 *info3)
+{
+        const char *guest_account = lp_guestaccount();
+        struct dom_sid domain_sid;
+        struct passwd *pwd;
+        const char *tmp;
+
+        pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
+        if (pwd == NULL) {
+                DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
+                         "account [%s]!\n", guest_account));
+                return NT_STATUS_NO_SUCH_USER;
+        }
+
+        /* Set acount name */
+        tmp = talloc_strdup(mem_ctx, pwd->pw_name);
+        if (tmp == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        init_lsa_String(&info3->base.account_name, tmp);
+
+        /* Set domain name */
+        tmp = talloc_strdup(mem_ctx, get_global_sam_name());
+        if (tmp == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        init_lsa_StringLarge(&info3->base.domain, tmp);
+
+        /* Domain sid */
+        sid_copy(&domain_sid, get_global_sam_sid());
+
+        info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
+        if (info3->base.domain_sid == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* Guest rid */
+        info3->base.rid = DOMAIN_RID_GUEST;
+
+        /* Primary gid */
+        info3->base.primary_gid = BUILTIN_RID_GUESTS;
+
+        TALLOC_FREE(pwd);
         return NT_STATUS_OK;
 }
@@ -1262 +709 @@
 ***************************************************************************/
 
-static NTSTATUS make_new_server_info_guest(auth_serversupplied_info **server_info)
-{
+static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info **server_info)
+{
+        static const char zeros[16] = {0};
+        const char *guest_account = lp_guestaccount();
+        const char *domain = global_myname();
+        struct netr_SamInfo3 info3;
+        TALLOC_CTX *tmp_ctx;
         NTSTATUS status;
-        struct samu *sampass = NULL;
-        DOM_SID guest_sid;
-        bool ret;
-        char zeros[16];
         fstring tmp;
 
-        if ( !(sampass = samu_new( NULL )) ) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        sid_copy(&guest_sid, get_global_sam_sid());
-        sid_append_rid(&guest_sid, DOMAIN_USER_RID_GUEST);
-
-        become_root();
-        ret = pdb_getsampwsid(sampass, &guest_sid);
-        unbecome_root();
-
-        if (!ret) {
-                TALLOC_FREE(sampass);
-                return NT_STATUS_NO_SUCH_USER;
-        }
-
-        status = make_server_info_sam(server_info, sampass);
+        tmp_ctx = talloc_stackframe();
+        if (tmp_ctx == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ZERO_STRUCT(info3);
+
+        status = get_guest_info3(tmp_ctx, &info3);
         if (!NT_STATUS_IS_OK(status)) {
-                TALLOC_FREE(sampass);
-                return status;
-        }
-        
+                goto done;
+        }
+
+        status = make_server_info_info3(tmp_ctx,
+                                        guest_account,
+                                        domain,
+                                        server_info,
+                                        &info3);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
         (*server_info)->guest = True;
 
@@ -1299 +746 @@
                 DEBUG(10, ("create_local_token failed: %s\n",
                            nt_errstr(status)));
-                return status;
+                goto done;
         }
 
         /* annoying, but the Guest really does have a session key, and it is
            all zeros! */
-        ZERO_STRUCT(zeros);
         (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
         (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
 
-        alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
+        alpha_strcpy(tmp, (*server_info)->info3->base.account_name.string,
+                     ". _-$", sizeof(tmp));
         (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
+
+        status = NT_STATUS_OK;
+done:
+        TALLOC_FREE(tmp_ctx);
+        return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ Make (and fill) a auth_session_info struct for a system user login.
+ This *must* succeed for smbd to start.
+***************************************************************************/
+
+static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
+                                            struct auth_serversupplied_info **session_info)
+{
+        struct passwd *pwd;
+        NTSTATUS status;
+
+        pwd = getpwuid_alloc(mem_ctx, sec_initial_uid());
+        if (pwd == NULL) {
+                return NT_STATUS_NO_SUCH_USER;
+        }
+
+        status = make_serverinfo_from_username(mem_ctx,
+                                             pwd->pw_name,
+                                             false,
+                                             session_info);
+        TALLOC_FREE(pwd);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        (*session_info)->system = true;
+
+        status = add_sid_to_array_unique((*session_info)->security_token->sids,
+                                         &global_sid_System,
+                                         &(*session_info)->security_token->sids,
+                                         &(*session_info)->security_token->num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE((*session_info));
+                return status;
+        }
 
         return NT_STATUS_OK;
@@ -1350 +839 @@
         }
 
-        *presult = result;
+        *presult = talloc_steal(mem_ctx, result);
         return NT_STATUS_OK;
 }
@@ -1356 +845 @@
 
 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
-                                                 const auth_serversupplied_info *src)
-{
-        auth_serversupplied_info *dst;
+                                                 const struct auth_serversupplied_info *src)
+{
+        struct auth_serversupplied_info *dst;
 
         dst = make_server_info(mem_ctx);
@@ -1366 +855 @@
 
         dst->guest = src->guest;
+        dst->system = src->system;
         dst->utok.uid = src->utok.uid;
         dst->utok.gid = src->utok.gid;
@@ -1377 +867 @@
         }
 
-        if (src->ptok) {
-                dst->ptok = dup_nt_token(dst, src->ptok);
-                if (!dst->ptok) {
+        if (src->security_token) {
+                dst->security_token = dup_nt_token(dst, src->security_token);
+                if (!dst->security_token) {
                         TALLOC_FREE(dst);
                         return NULL;
                 }
         }
-        
+
         dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
                                                 src->user_session_key.length);
@@ -1391 +881 @@
                                                 src->lm_session_key.length);
 
-        dst->sam_account = samu_new(NULL);
-        if (!dst->sam_account) {
+        dst->info3 = copy_netr_SamInfo3(dst, src->info3);
+        if (!dst->info3) {
                 TALLOC_FREE(dst);
                 return NULL;
         }
-
-        if (!pdb_copy_sam_account(dst->sam_account, src->sam_account)) {
-                TALLOC_FREE(dst);
-                return NULL;
-        }
-        
-        dst->pam_handle = NULL;
+        dst->extra = src->extra;
+
         dst->unix_name = talloc_strdup(dst, src->unix_name);
         if (!dst->unix_name) {
@@ -1423 +908 @@
  */
 
-bool server_info_set_session_key(struct auth_serversupplied_info *info,
+bool session_info_set_session_key(struct auth_serversupplied_info *info,
                                  DATA_BLOB session_key)
 {
@@ -1434 +919 @@
 }
 
-static auth_serversupplied_info *guest_info = NULL;
+static struct auth_serversupplied_info *guest_info = NULL;
 
 bool init_guest_info(void)
@@ -1445 +930 @@
 
 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
-                                auth_serversupplied_info **server_info)
+                                struct auth_serversupplied_info **server_info)
 {
         *server_info = copy_serverinfo(mem_ctx, guest_info);
@@ -1451 +936 @@
 }
 
+static struct auth_serversupplied_info *system_info = NULL;
+
+NTSTATUS init_system_info(void)
+{
+        if (system_info != NULL)
+                return NT_STATUS_OK;
+
+        return make_new_session_info_system(NULL, &system_info);
+}
+
+NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
+                                struct auth_serversupplied_info **session_info)
+{
+        if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
+        *session_info = copy_serverinfo(mem_ctx, system_info);
+        return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
+}
+
+const struct auth_serversupplied_info *get_session_info_system(void)
+{
+    return system_info;
+}
+
 bool copy_current_user(struct current_user *dst, struct current_user *src)
 {
         gid_t *groups;
-        NT_USER_TOKEN *nt_token;
+        struct security_token *nt_token;
 
         groups = (gid_t *)memdup(src->ut.groups,
@@ -1480 +988 @@
 /***************************************************************************
  Purely internal function for make_server_info_info3
- Fill the sam account from getpwnam
 ***************************************************************************/
-static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx, 
-                                 const char *domain,
-                                 const char *username,
-                                 char **found_username,
-                                 uid_t *uid, gid_t *gid,
-                                 struct samu *account,
-                                 bool *username_was_mapped)
-{
-        struct smbd_server_connection *sconn = smbd_server_conn;
-        NTSTATUS nt_status;
-        fstring dom_user, lower_username;
-        fstring real_username;
+
+static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
+                              const char *username, char **found_username,
+                              struct passwd **pwd,
+                              bool *username_was_mapped)
+{
+        char *orig_dom_user = NULL;
+        char *dom_user = NULL;
+        char *lower_username = NULL;
+        char *real_username = NULL;
         struct passwd *passwd;
 
-        fstrcpy( lower_username, username );
+        lower_username = talloc_strdup(mem_ctx, username);
+        if (!lower_username) {
+                return NT_STATUS_NO_MEMORY;
+        }
         strlower_m( lower_username );
 
-        fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(), 
-                lower_username);
-
-        /* Get the passwd struct.  Try to create the account is necessary. */
-
-        *username_was_mapped = map_username(sconn, dom_user);
-
-        if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
+        orig_dom_user = talloc_asprintf(mem_ctx,
+                                "%s%c%s",
+                                domain,
+                                *lp_winbind_separator(),
+                                lower_username);
+        if (!orig_dom_user) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* Get the passwd struct.  Try to create the account if necessary. */
+
+        *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
+        if (!dom_user) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, True );
+        if (!passwd) {
+                DEBUG(3, ("Failed to find authenticated user %s via "
+                          "getpwnam(), denying access.\n", dom_user));
                 return NT_STATUS_NO_SUCH_USER;
-
-        *uid = passwd->pw_uid;
-        *gid = passwd->pw_gid;
+        }
+
+        if (!real_username) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        *pwd = passwd;
 
         /* This is pointless -- there is no suport for differing 
@@ -1517 +1041 @@
            why I hate the 'winbind use default domain' parameter?   
                                          --jerry              */
-           
+
         *found_username = talloc_strdup( mem_ctx, real_username );
-        
-        DEBUG(5,("fill_sam_account: located username was [%s]\n", *found_username));
-
-        nt_status = samu_set_unix( account, passwd );
-        
-        TALLOC_FREE(passwd);
-        
-        return nt_status;
+
+        return NT_STATUS_OK;
 }
 
@@ -1534 +1052 @@
  the username if we fallback to the username only.
  ****************************************************************************/
- 
-struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
-                             fstring save_username, bool create )
+
+struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
+                             char **p_save_username, bool create )
 {
         struct passwd *pw = NULL;
-        char *p;
-        fstring username;
-        
+        char *p = NULL;
+        char *username = NULL;
+
         /* we only save a copy of the username it has been mangled 
            by winbindd use default domain */
-           
-        save_username[0] = '\0';
-           
+        *p_save_username = NULL;
+
         /* don't call map_username() here since it has to be done higher 
-           up the stack so we don't call it mutliple times */
-
-        fstrcpy( username, domuser );
-        
+           up the stack so we don't call it multiple times */
+
+        username = talloc_strdup(mem_ctx, domuser);
+        if (!username) {
+                return NULL;
+        }
+
         p = strchr_m( username, *lp_winbind_separator() );
-        
+
         /* code for a DOMAIN\user string */
-        
+
         if ( p ) {
-                fstring strip_username;
-
                 pw = Get_Pwnam_alloc( mem_ctx, domuser );
-                if ( pw ) {     
+                if ( pw ) {
                         /* make sure we get the case of the username correct */
                         /* work around 'winbind use default domain = yes' */
@@ -1566 +1084 @@
                         if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
                                 char *domain;
-                                
+
                                 /* split the domain and username into 2 strings */
                                 *p = '\0';
                                 domain = username;
 
-                                fstr_sprintf(save_username, "%s%c%s", domain, *lp_winbind_separator(), pw->pw_name);
+                                *p_save_username = talloc_asprintf(mem_ctx,
+                                                                "%s%c%s",
+                                                                domain,
+                                                                *lp_winbind_separator(),
+                                                                pw->pw_name);
+                                if (!*p_save_username) {
+                                        TALLOC_FREE(pw);
+                                        return NULL;
+                                }
+                        } else {
+                                *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
                         }
-                        else
-                                fstrcpy( save_username, pw->pw_name );
-
-                        /* whew -- done! */             
+
+                        /* whew -- done! */
                         return pw;
                 }
@@ -1584 +1110 @@
 
                 p++;
-                fstrcpy( strip_username, p );
-                fstrcpy( username, strip_username );
-        }
-        
+                username = talloc_strdup(mem_ctx, p);
+                if (!username) {
+                        return NULL;
+                }
+        }
+
         /* just lookup a plain username */
-        
+
         pw = Get_Pwnam_alloc(mem_ctx, username);
-                
+
         /* Create local user if requested but only if winbindd
            is not running.  We need to protect against cases
            where winbindd is failing and then prematurely
            creating users in /etc/passwd */
-        
+
         if ( !pw && create && !winbind_ping() ) {
                 /* Don't add a machine account. */
@@ -1605 +1133 @@
                 pw = Get_Pwnam_alloc(mem_ctx, username);
         }
-        
+
         /* one last check for a valid passwd struct */
-        
-        if ( pw )
-                fstrcpy( save_username, pw->pw_name );
-
+
+        if (pw) {
+                *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
+        }
         return pw;
 }
@@ -1621 +1149 @@
                                 const char *sent_nt_username,
                                 const char *domain,
-                                auth_serversupplied_info **server_info, 
+                                struct auth_serversupplied_info **server_info,
                                 struct netr_SamInfo3 *info3)
 {
-        char zeros[16];
+        static const char zeros[16] = {0, };
 
         NTSTATUS nt_status = NT_STATUS_OK;
@@ -1630 +1158 @@
         const char *nt_domain;
         const char *nt_username;
-        struct samu *sam_account = NULL;
-        DOM_SID user_sid;
-        DOM_SID group_sid;
         bool username_was_mapped;
-
-        uid_t uid = (uid_t)-1;
-        gid_t gid = (gid_t)-1;
-
-        auth_serversupplied_info *result;
+        struct passwd *pwd;
+        struct auth_serversupplied_info *result;
+        struct dom_sid *group_sid;
+        struct netr_SamInfo3 *i3;
 
         /* 
@@ -1646 +1170 @@
         */
 
-        sid_copy(&user_sid, info3->base.domain_sid);
-        if (!sid_append_rid(&user_sid, info3->base.rid)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        
-        sid_copy(&group_sid, info3->base.domain_sid);
-        if (!sid_append_rid(&group_sid, info3->base.primary_gid)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
         if (!nt_username) {
@@ -1669 +1183 @@
                 nt_domain = domain;
         }
-        
-        /* try to fill the SAM account..  If getpwnam() fails, then try the 
-           add user script (2.2.x behavior).
+
+        /* If getpwnam() fails try the add user script (2.2.x behavior).
 
            We use the _unmapped_ username here in an attempt to provide
@@ -1681 +1194 @@
            that is how the current code is designed.  Making the change here
            is the least disruptive place.  -- jerry */
-           
-        if ( !(sam_account = samu_new( NULL )) ) {
-                return NT_STATUS_NO_MEMORY;
-        }
 
         /* this call will try to create the user if necessary */
 
-        nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,
-                                     &found_username, &uid, &gid, sam_account,
+        nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
+                                     &found_username, &pwd,
                                      &username_was_mapped);
 
-        
-        /* if we still don't have a valid unix account check for 
-          'map to guest = bad uid' */
-          
         if (!NT_STATUS_IS_OK(nt_status)) {
-                TALLOC_FREE( sam_account );
-                if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
-                        make_server_info_guest(NULL, server_info);
-                        return NT_STATUS_OK;
-                }
                 return nt_status;
-        }
-                
-        if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        if (!pdb_set_fullname(sam_account,
-                              info3->base.full_name.string,
-                              PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_logon_script(sam_account,
-                                  info3->base.logon_script.string,
-                                  PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_profile_path(sam_account,
-                                  info3->base.profile_path.string,
-                                  PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_homedir(sam_account,
-                             info3->base.home_directory.string,
-                             PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_dir_drive(sam_account,
-                               info3->base.home_drive.string,
-                               PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_last_set_time(
-                    sam_account,
-                    nt_time_to_unix(info3->base.last_password_change),
-                    PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_can_change_time(
-                    sam_account,
-                    nt_time_to_unix(info3->base.allow_password_change),
-                    PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_must_change_time(
-                    sam_account,
-                    nt_time_to_unix(info3->base.force_password_change),
-                    PDB_CHANGED)) {
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
         }
 
@@ -1797 +1208 @@
         if (result == NULL) {
                 DEBUG(4, ("make_server_info failed!\n"));
-                TALLOC_FREE(sam_account);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* save this here to _net_sam_logon() doesn't fail (it assumes a 
-           valid struct samu) */
-                   
-        result->sam_account = sam_account;
+                return NT_STATUS_NO_MEMORY;
+        }
+
         result->unix_name = talloc_strdup(result, found_username);
 
@@ -1814 +1220 @@
         }
 
+        /* copy in the info3 */
+        result->info3 = i3 = copy_netr_SamInfo3(result, info3);
+        if (result->info3 == NULL) {
+                TALLOC_FREE(result);
+                return NT_STATUS_NO_MEMORY;
+        }
+
         /* Fill in the unix info we found on the way */
-
-        result->utok.uid = uid;
-        result->utok.gid = gid;
-
-        /* Create a 'combined' list of all SIDs we might want in the SD */
-
-        result->num_sids = 0;
-        result->sids = NULL;
-
-        nt_status = sid_array_from_info3(result, info3,
-                                         &result->sids,
-                                         &result->num_sids,
-                                         false, false);
+        result->utok.uid = pwd->pw_uid;
+        result->utok.gid = pwd->pw_gid;
+
+        /* We can't just trust that the primary group sid sent us is something
+         * we can really use. Obtain the useable sid, and store the original
+         * one as an additional group if it had to be replaced */
+        nt_status = get_primary_group_sid(mem_ctx, found_username,
+                                          &pwd, &group_sid);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 TALLOC_FREE(result);
@@ -1833 +1241 @@
         }
 
-        /* Ensure the primary group sid is at position 0. */
-        sort_sid_array_for_smbd(result, &group_sid);
-
-        result->login_server = talloc_strdup(result,
-                                             info3->base.logon_server.string);
+        /* store and check if it is the same we got originally */
+        sid_peek_rid(group_sid, &i3->base.primary_gid);
+        if (i3->base.primary_gid != info3->base.primary_gid) {
+                uint32_t n = i3->base.groups.count;
+                /* not the same, store the original as an additional group */
+                i3->base.groups.rids =
+                        talloc_realloc(i3, i3->base.groups.rids,
+                                        struct samr_RidWithAttribute, n + 1);
+                if (i3->base.groups.rids == NULL) {
+                        TALLOC_FREE(result);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                i3->base.groups.rids[n].rid = info3->base.primary_gid;
+                i3->base.groups.rids[n].attributes = SE_GROUP_ENABLED;
+                i3->base.groups.count = n + 1;
+        }
 
         /* ensure we are never given NULL session keys */
-
-        ZERO_STRUCT(zeros);
 
         if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
@@ -1874 +1291 @@
                                           const char *domain,
                                           const struct wbcAuthUserInfo *info,
-                                          auth_serversupplied_info **server_info)
-{
-        char zeros[16];
-
-        NTSTATUS nt_status = NT_STATUS_OK;
-        char *found_username = NULL;
-        const char *nt_domain;
-        const char *nt_username;
-        struct samu *sam_account = NULL;
-        DOM_SID user_sid;
-        DOM_SID group_sid;
-        bool username_was_mapped;
-        uint32_t i;
-
-        uid_t uid = (uid_t)-1;
-        gid_t gid = (gid_t)-1;
-
-        auth_serversupplied_info *result;
-
-        result = make_server_info(NULL);
-        if (result == NULL) {
-                DEBUG(4, ("make_server_info failed!\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /*
-           Here is where we should check the list of
-           trusted domains, and verify that the SID
-           matches.
-        */
-
-        memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
-        memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
-
-        if (info->account_name) {
-                nt_username = talloc_strdup(result, info->account_name);
-        } else {
-                /* If the server didn't give us one, just use the one we sent
-                 * them */
-                nt_username = talloc_strdup(result, sent_nt_username);
-        }
-        if (!nt_username) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (info->domain_name) {
-                nt_domain = talloc_strdup(result, info->domain_name);
-        } else {
-                /* If the server didn't give us one, just use the one we sent
-                 * them */
-                nt_domain = talloc_strdup(result, domain);
-        }
-        if (!nt_domain) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* try to fill the SAM account..  If getpwnam() fails, then try the
-           add user script (2.2.x behavior).
-
-           We use the _unmapped_ username here in an attempt to provide
-           consistent username mapping behavior between kerberos and NTLM[SSP]
-           authentication in domain mode security.  I.E. Username mapping
-           should be applied to the fully qualified username
-           (e.g. DOMAIN\user) and not just the login name.  Yes this means we
-           called map_username() unnecessarily in make_user_info_map() but
-           that is how the current code is designed.  Making the change here
-           is the least disruptive place.  -- jerry */
-
-        if ( !(sam_account = samu_new( result )) ) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* this call will try to create the user if necessary */
-
-        nt_status = fill_sam_account(result, nt_domain, sent_nt_username,
-                                     &found_username, &uid, &gid, sam_account,
-                                     &username_was_mapped);
-
-        /* if we still don't have a valid unix account check for
-          'map to guest = bad uid' */
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                TALLOC_FREE( result );
-                if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
-                        make_server_info_guest(NULL, server_info);
-                        return NT_STATUS_OK;
-                }
-                return nt_status;
-        }
-
-        if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        if (!pdb_set_fullname(sam_account, info->full_name, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_logon_script(sam_account, info->logon_script, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_profile_path(sam_account, info->profile_path, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_homedir(sam_account, info->home_directory, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_dir_drive(sam_account, info->home_drive, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_acct_ctrl(sam_account, info->acct_flags, PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_last_set_time(
-                    sam_account,
-                    info->pass_last_set_time,
-                    PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_can_change_time(
-                    sam_account,
-                    info->pass_can_change_time,
-                    PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_set_pass_must_change_time(
-                    sam_account,
-                    info->pass_must_change_time,
-                    PDB_CHANGED)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* save this here to _net_sam_logon() doesn't fail (it assumes a
-           valid struct samu) */
-
-        result->sam_account = sam_account;
-        result->unix_name = talloc_strdup(result, found_username);
-
-        result->sanitized_username = sanitize_username(result,
-                                                       result->unix_name);
-        result->login_server = talloc_strdup(result, info->logon_server);
-
-        if ((result->unix_name == NULL)
-            || (result->sanitized_username == NULL)
-            || (result->login_server == NULL)) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* Fill in the unix info we found on the way */
-
-        result->utok.uid = uid;
-        result->utok.gid = gid;
-
-        /* Create a 'combined' list of all SIDs we might want in the SD */
-
-        result->num_sids = info->num_sids - 2;
-        result->sids = talloc_array(result, DOM_SID, result->num_sids);
-        if (result->sids == NULL) {
-                TALLOC_FREE(result);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        for (i=0; i < result->num_sids; i++) {
-                memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
-        }
-
-        /* Ensure the primary group sid is at position 0. */
-        sort_sid_array_for_smbd(result, &group_sid);
-
-        /* ensure we are never given NULL session keys */
-
-        ZERO_STRUCT(zeros);
-
-        if (memcmp(info->user_session_key, zeros, sizeof(zeros)) == 0) {
-                result->user_session_key = data_blob_null;
-        } else {
-                result->user_session_key = data_blob_talloc(
-                        result, info->user_session_key,
-                        sizeof(info->user_session_key));
-        }
-
-        if (memcmp(info->lm_session_key, zeros, 8) == 0) {
-                result->lm_session_key = data_blob_null;
-        } else {
-                result->lm_session_key = data_blob_talloc(
-                        result, info->lm_session_key,
-                        sizeof(info->lm_session_key));
-        }
-
-        result->nss_token |= username_was_mapped;
-
-        *server_info = result;
-
-        return NT_STATUS_OK;
-}
-
-/***************************************************************************
- Free a user_info struct
-***************************************************************************/
-
-void free_user_info(auth_usersupplied_info **user_info)
-{
-        DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
-        if (*user_info != NULL) {
-                if ((*user_info)->smb_name) {
-                        DEBUG(10,("structure was created for %s\n",
-                                  (*user_info)->smb_name));
-                }
-                SAFE_FREE((*user_info)->smb_name);
-                SAFE_FREE((*user_info)->internal_username);
-                SAFE_FREE((*user_info)->client_domain);
-                SAFE_FREE((*user_info)->domain);
-                SAFE_FREE((*user_info)->wksta_name);
-                data_blob_free(&(*user_info)->lm_resp);
-                data_blob_free(&(*user_info)->nt_resp);
-                data_blob_clear_free(&(*user_info)->lm_interactive_pwd);
-                data_blob_clear_free(&(*user_info)->nt_interactive_pwd);
-                data_blob_clear_free(&(*user_info)->plaintext_password);
-                ZERO_STRUCT(**user_info);
-        }
-        SAFE_FREE(*user_info);
-}
-
-/***************************************************************************
- Make an auth_methods struct
-***************************************************************************/
-
-bool make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method) 
-{
-        if (!auth_context) {
-                smb_panic("no auth_context supplied to "
-                          "make_auth_methods()!\n");
-        }
-
-        if (!auth_method) {
-                smb_panic("make_auth_methods: pointer to auth_method pointer "
-                          "is NULL!\n");
-        }
-
-        *auth_method = TALLOC_P(auth_context->mem_ctx, auth_methods);
-        if (!*auth_method) {
-                DEBUG(0,("make_auth_method: malloc failed!\n"));
-                return False;
-        }
-        ZERO_STRUCTP(*auth_method);
-        
-        return True;
+                                          struct auth_serversupplied_info **server_info)
+{
+        struct netr_SamInfo3 *info3;
+
+        info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
+        if (!info3) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        return make_server_info_info3(mem_ctx,
+                                      sent_nt_username, domain,
+                                      server_info, info3);
 }
 
@@ -2174 +1315 @@
 bool is_trusted_domain(const char* dom_name)
 {
-        DOM_SID trustdom_sid;
+        struct dom_sid trustdom_sid;
         bool ret;
 
@@ -2220 +1361 @@
                    and running. We need to update the trustdom_cache
                    ourselves */
-                
+
                 update_trustdom_cache();
         }

trunk/server/source3/auth/auth_wbc.c

@@ -39 +39 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "nsswitch/libwbclient/wbclient.h"
 
 #undef DBGC_CLASS
@@ -48 +50 @@
                                        void *my_private_data,
                                        TALLOC_CTX *mem_ctx,
-                                       const auth_usersupplied_info *user_info,
-                                       auth_serversupplied_info **server_info)
+                                       const struct auth_usersupplied_info *user_info,
+                                       struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status;
@@ -60 +62 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
+
+        ZERO_STRUCT(params);
+
         /* Send off request */
 
-        params.account_name     = user_info->smb_name;
-        params.domain_name      = user_info->domain;
-        params.workstation_name = user_info->wksta_name;
+        DEBUG(10, ("Check auth for: [%s]", user_info->mapped.account_name));
+
+        params.account_name     = user_info->client.account_name;
+        params.domain_name      = user_info->mapped.domain_name;
+        params.workstation_name = user_info->workstation_name;
 
         params.flags            = 0;
@@ -70 +77 @@
 
         /* Handle plaintext */
-        if (!user_info->encrypted) {
+        switch (user_info->password_state) {
+        case AUTH_PASSWORD_PLAIN:
+        {
                 DEBUG(3,("Checking plaintext password for %s.\n",
-                         user_info->internal_username));
+                         user_info->mapped.account_name));
                 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
 
-                params.password.plaintext = (char *)user_info->plaintext_password.data;
-        } else {
+                params.password.plaintext = user_info->password.plaintext;
+                break;
+        }
+        case AUTH_PASSWORD_RESPONSE:
+        case AUTH_PASSWORD_HASH:
+        {
                 DEBUG(3,("Checking encrypted password for %s.\n",
-                         user_info->internal_username));
+                         user_info->mapped.account_name));
                 params.level = WBC_AUTH_USER_LEVEL_RESPONSE;
 
@@ -85 +98 @@
                     sizeof(params.password.response.challenge));
 
-                params.password.response.nt_length = user_info->nt_resp.length;
-                params.password.response.nt_data = user_info->nt_resp.data;
-                params.password.response.lm_length = user_info->lm_resp.length;
-                params.password.response.lm_data = user_info->lm_resp.data;
+                if (user_info->password.response.nt.length != 0) {
+                        params.password.response.nt_length =
+                                user_info->password.response.nt.length;
+                        params.password.response.nt_data =
+                                user_info->password.response.nt.data;
+                }
+                if (user_info->password.response.lanman.length != 0) {
+                        params.password.response.lm_length =
+                                user_info->password.response.lanman.length;
+                        params.password.response.lm_data =
+                                user_info->password.response.lanman.data;
+                }
+                break;
+        }
+        default:
+                DEBUG(0,("user_info constructed for user '%s' was invalid - password_state=%u invalid.\n",user_info->mapped.account_name, user_info->password_state));
+                return NT_STATUS_INTERNAL_ERROR;
+#if 0 /* If ever implemented in libwbclient */
+        case AUTH_PASSWORD_HASH:
+        {
+                DEBUG(3,("Checking logon (hash) password for %s.\n",
+                         user_info->mapped.account_name));
+                params.level = WBC_AUTH_USER_LEVEL_HASH;
 
+                if (user_info->password.hash.nt) {
+                        memcpy(params.password.hash.nt_hash, user_info->password.hash.nt, sizeof(* user_info->password.hash.nt));
+                } else {
+                        memset(params.password.hash.nt_hash, '\0', sizeof(params.password.hash.nt_hash));
+                }
+
+                if (user_info->password.hash.lanman) {
+                        memcpy(params.password.hash.lm_hash, user_info->password.hash.lanman, sizeof(* user_info->password.hash.lanman));
+                } else {
+                        memset(params.password.hash.lm_hash, '\0', sizeof(params.password.hash.lm_hash));
+                }
+
+        }
+#endif
         }
 
@@ -119 +165 @@
 
         nt_status = make_server_info_wbcAuthUserInfo(mem_ctx,
-                                                     user_info->smb_name,
-                                                     user_info->domain,
+                                                     user_info->client.account_name,
+                                                     user_info->mapped.domain_name,
                                                      info, server_info);
         wbcFreeMemory(info);
@@ -135 +181 @@
 static NTSTATUS auth_init_wbc(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
+        result->name = "wbc";
+        result->auth = check_wbc_security;
 
-        (*auth_method)->name = "wbc";
-        (*auth_method)->auth = check_wbc_security;
-
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/auth_winbind.c

@@ -6 +6 @@
    Copyright (C) Tim Potter 2000
    Copyright (C) Andrew Bartlett 2001 - 2002
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -22 +22 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "nsswitch/libwbclient/wbclient.h"
 
 #undef DBGC_CLASS
@@ -31 +33 @@
                                        void *my_private_data, 
                                        TALLOC_CTX *mem_ctx,
-                                       const auth_usersupplied_info *user_info, 
-                                       auth_serversupplied_info **server_info)
+                                       const struct auth_usersupplied_info *user_info,
+                                       struct auth_serversupplied_info **server_info)
 {
         NTSTATUS nt_status;
@@ -40 +42 @@
         struct wbcAuthErrorInfo *err = NULL;
 
+        ZERO_STRUCT(params);
+
         if (!user_info) {
                 return NT_STATUS_INVALID_PARAMETER;
         }
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         if (!auth_context) {
                 DEBUG(3,("Password for user %s cannot be checked because we have no auth_info to get the challenge from.\n", 
-                         user_info->internal_username));
+                         user_info->mapped.account_name));
                 return NT_STATUS_INVALID_PARAMETER;
         }               
 
-        if (strequal(user_info->domain, get_global_sam_name())) {
+        if (strequal(user_info->mapped.domain_name, get_global_sam_name())) {
                 DEBUG(3,("check_winbind_security: Not using winbind, requested domain [%s] was for this SAM.\n",
-                        user_info->domain));
+                        user_info->mapped.domain_name));
                 return NT_STATUS_NOT_IMPLEMENTED;
         }
@@ -58 +64 @@
         /* Send off request */
 
-        params.account_name     = user_info->smb_name;
-        params.domain_name      = user_info->domain;
-        params.workstation_name = user_info->wksta_name;
+        params.account_name     = user_info->client.account_name;
+        params.domain_name      = user_info->mapped.domain_name;
+        params.workstation_name = user_info->workstation_name;
 
         params.flags            = 0;
@@ -71 +77 @@
                sizeof(params.password.response.challenge));
 
-        params.password.response.nt_length      = user_info->nt_resp.length;
-        params.password.response.nt_data        = user_info->nt_resp.data;
-        params.password.response.lm_length      = user_info->lm_resp.length;
-        params.password.response.lm_data        = user_info->lm_resp.data;
+        if (user_info->password.response.nt.length != 0) {
+                params.password.response.nt_length =
+                        user_info->password.response.nt.length;
+                params.password.response.nt_data =
+                        user_info->password.response.nt.data;
+        }
+        if (user_info->password.response.lanman.length != 0) {
+                params.password.response.lm_length =
+                        user_info->password.response.lanman.length;
+                params.password.response.lm_data =
+                        user_info->password.response.lanman.data;
+        }
 
         /* we are contacting the privileged pipe */
@@ -97 +111 @@
                         return auth_method->auth(auth_context, auth_method->private_data, 
                                 mem_ctx, user_info, server_info);
-                else
-                        /* log an error since this should not happen */
-                        DEBUG(0,("check_winbind_security: ERROR!  my_private_data == NULL!\n"));
+                return NT_STATUS_LOGON_FAILURE;
         }
 
@@ -113 +125 @@
 
         nt_status = make_server_info_wbcAuthUserInfo(mem_ctx,
-                                                     user_info->smb_name,
-                                                     user_info->domain,
+                                                     user_info->client.account_name,
+                                                     user_info->mapped.domain_name,
                                                      info, server_info);
         wbcFreeMemory(info);
@@ -129 +141 @@
 static NTSTATUS auth_init_winbind(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "winbind";
-        (*auth_method)->auth = check_winbind_security;
+        result->name = "winbind";
+        result->auth = check_winbind_security;
 
         if (param && *param) {
@@ -143 +157 @@
                         return NT_STATUS_UNSUCCESSFUL;
                 }
-                (*auth_method)->private_data = (void *)priv;
+                result->private_data = (void *)priv;
         }
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }

trunk/server/source3/auth/pampass.c

@@ -6 +6 @@
    Copyright (C) Andrew Bartlett 2001
    Copyright (C) Jeremy Allison 2001
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -28 +28 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "../libcli/auth/pam_errors.h"
 
 #undef DBGC_CLASS
@@ -60 +62 @@
 typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
 
-/*
- *  Macros to help make life easy
- */
-#define COPY_STRING(s) (s) ? SMB_STRDUP(s) : NULL
-#define COPY_FSTRING(s) (s[0]) ? SMB_STRDUP(s) : NULL
+static char *smb_pam_copy_string(const char *s)
+{
+        if (s == NULL) {
+                return NULL;
+        }
+        return SMB_STRDUP(s);
+}
+
+static char *smb_pam_copy_fstring(const char *s)
+{
+        if (s[0] == '\0') {
+                return NULL;
+        }
+        return SMB_STRDUP(s);
+}
 
 /*******************************************************************
@@ -76 +88 @@
                 DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
                                 msg, pam_strerror(pamh, pam_error)));
-                
                 return False;
         }
@@ -145 +156 @@
                         case PAM_PROMPT_ECHO_ON:
                                 reply[replies].resp_retcode = PAM_SUCCESS;
-                                reply[replies].resp = COPY_STRING(udp->PAM_username);
+                                reply[replies].resp = smb_pam_copy_string(
+                                        udp->PAM_username);
                                 /* PAM frees resp */
                                 break;
@@ -151 +163 @@
                         case PAM_PROMPT_ECHO_OFF:
                                 reply[replies].resp_retcode = PAM_SUCCESS;
-                                reply[replies].resp = COPY_STRING(udp->PAM_password);
+                                reply[replies].resp = smb_pam_copy_string(
+                                        udp->PAM_password);
                                 /* PAM frees resp */
                                 break;
@@ -281 +294 @@
         bool found; 
         *resp = NULL;
-        
+
         DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
 
@@ -326 +339 @@
                                         pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
 #ifdef DEBUG_PASSWORD
-                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actualy sent: %s\n", current_reply));
+                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actually sent: %s\n", current_reply));
 #endif
                                         reply[replies].resp_retcode = PAM_SUCCESS;
-                                        reply[replies].resp = COPY_FSTRING(current_reply);
+                                        reply[replies].resp = smb_pam_copy_fstring(
+                                                current_reply);
                                         found = True;
                                         break;
@@ -357 +371 @@
                                         pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
                                         reply[replies].resp_retcode = PAM_SUCCESS;
-                                        reply[replies].resp = COPY_FSTRING(current_reply);
+                                        reply[replies].resp = smb_pam_copy_fstring(
+                                                current_reply);
 #ifdef DEBUG_PASSWORD
-                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actualy sent: %s\n", current_reply));
+                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actually sent: %s\n", current_reply));
 #endif
                                         found = True;
@@ -366 +381 @@
                         }
                         /* PAM frees resp */
-                        
+
                         if (!found) {
                                 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
@@ -383 +398 @@
                         reply[replies].resp = NULL;
                         break;
-                        
+
                 default:
                         /* Must be an error of some sort... */
@@ -391 +406 @@
                 }
         }
-                
+
         free_pw_chat(pw_chat);
         if (reply)
@@ -444 +459 @@
 
         smb_free_pam_conv(smb_pam_conv_ptr);
-       
+
         if( pamh != NULL ) {
                 pam_error = pam_end(pamh, 0);
@@ -463 +478 @@
 {
         int pam_error;
-#ifdef PAM_RHOST
-        const char *our_rhost;
-        char addr[INET6_ADDRSTRLEN];
-#endif
 
         *pamh = (pam_handle_t *)NULL;
@@ -478 +489 @@
         }
 
-#ifdef PAM_RHOST
-        if (rhost == NULL) {
-                our_rhost = client_name(get_client_fd());
-                if (strequal(our_rhost,"UNKNOWN"))
-                        our_rhost = client_addr(get_client_fd(),addr,sizeof(addr));
-        } else {
-                our_rhost = rhost;
-        }
-
-        DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", our_rhost));
-        pam_error = pam_set_item(*pamh, PAM_RHOST, our_rhost);
+#if HAVE_PAM_RHOST
+        DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", rhost));
+        pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
         if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
                 smb_pam_end(*pamh, pconv);
@@ -495 +498 @@
         }
 #endif
-#ifdef PAM_TTY
+#if HAVE_PAM_TTY
         DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
         pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
@@ -520 +523 @@
          *      auth required /lib/security/pam_pwdb.so nullok shadow audit
          */
-        
+
         DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
         pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
@@ -640 +643 @@
         int pam_error;
 
-#ifdef PAM_TTY
+#if HAVE_PAM_TTY
         DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
         pam_error = pam_set_item(pamh, PAM_TTY, tty);
@@ -774 +777 @@
  */
 
-NTSTATUS smb_pam_accountcheck(const char * user)
+NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
 {
         NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
@@ -788 +791 @@
                 return NT_STATUS_NO_MEMORY;
 
-        if (!smb_pam_start(&pamh, user, NULL, pconv))
+        if (!smb_pam_start(&pamh, user, rhost, pconv))
                 return NT_STATUS_ACCOUNT_DISABLED;
 
@@ -802 +805 @@
  */
 
-NTSTATUS smb_pam_passcheck(const char * user, const char * password)
+NTSTATUS smb_pam_passcheck(const char * user, const char * rhost,
+                           const char * password)
 {
         pam_handle_t *pamh = NULL;
@@ -817 +821 @@
                 return NT_STATUS_LOGON_FAILURE;
 
-        if (!smb_pam_start(&pamh, user, NULL, pconv))
+        if (!smb_pam_start(&pamh, user, rhost, pconv))
                 return NT_STATUS_LOGON_FAILURE;
 
@@ -846 +850 @@
  */
 
-bool smb_pam_passchange(const char * user, const char * oldpassword, const char * newpassword)
+bool smb_pam_passchange(const char *user, const char *rhost,
+                        const char *oldpassword, const char *newpassword)
 {
         /* Appropriate quantities of root should be obtained BEFORE calling this function */
@@ -855 +860 @@
                 return False;
 
-        if(!smb_pam_start(&pamh, user, NULL, pconv))
+        if(!smb_pam_start(&pamh, user, rhost, pconv))
                 return False;
 
@@ -870 +875 @@
 
 /* If PAM not used, no PAM restrictions on accounts. */
-NTSTATUS smb_pam_accountcheck(const char * user)
+NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
 {
         return NT_STATUS_OK;

trunk/server/source3/auth/pass_check.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Password checking
    Copyright (C) Andrew Tridgell 1992-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -22 +22 @@
 
 #include "includes.h"
+#include "system/passwd.h"
+#include "auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
+
+/* what is the longest significant password available on your system?
+ Knowing this speeds up password searches a lot */
+#ifndef PASSWORD_LENGTH
+#define PASSWORD_LENGTH 8
+#endif
 
 /* these are kept here to keep the string_combinations function simple */
@@ -493 +501 @@
 it assumes the string starts lowercased
 ****************************************************************************/
-static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (const char *),
-                                 int N)
+static NTSTATUS string_combinations2(char *s, int offset,
+                                     NTSTATUS (*fn)(const char *s,
+                                                    void *private_data),
+                                     int N, void *private_data)
 {
         int len = strlen(s);
@@ -505 +515 @@
 
         if (N <= 0 || offset >= len)
-                return (fn(s));
+                return (fn(s, private_data));
 
         for (i = offset; i < (len - (N - 1)); i++) {
                 char c = s[i];
-                if (!islower_ascii(c))
+                if (!islower_m(c))
                         continue;
-                s[i] = toupper_ascii(c);
-                if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
-                        return (nt_status);
+                s[i] = toupper_m(c);
+                nt_status = string_combinations2(s, i + 1, fn, N - 1,
+                                                 private_data);
+                if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
+                        return nt_status;
                 }
                 s[i] = c;
@@ -527 +539 @@
 it assumes the string starts lowercased
 ****************************************************************************/
-static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (const char *), int N)
+static NTSTATUS string_combinations(char *s,
+                                    NTSTATUS (*fn)(const char *s,
+                                                   void *private_data),
+                                    int N, void *private_data)
 {
         int n;
         NTSTATUS nt_status;
-        for (n = 1; n <= N; n++)
-                if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
+        for (n = 1; n <= N; n++) {
+                nt_status = string_combinations2(s, 0, fn, n, private_data);
+                if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
                         return nt_status;
+                }
+        }
         return NT_STATUS_WRONG_PASSWORD;
 }
@@ -541 +559 @@
 core of password checking routine
 ****************************************************************************/
-static NTSTATUS password_check(const char *password)
+static NTSTATUS password_check(const char *password, void *private_data)
 {
 #ifdef WITH_PAM
-        return smb_pam_passcheck(get_this_user(), password);
+        const char *rhost = (const char *)private_data;
+        return smb_pam_passcheck(get_this_user(), rhost, password);
 #else
 
@@ -560 +579 @@
 
 #ifdef OSF1_ENH_SEC
-        
+
         ret = (strcmp(osf1_bigcrypt(password, get_this_salt()),
                       get_this_crypted()) == 0);
@@ -573 +592 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
 #endif /* OSF1_ENH_SEC */
-        
+
 #ifdef ULTRIX_AUTH
         ret = (strcmp((char *)crypt16(password, get_this_salt()), get_this_crypted()) == 0);
@@ -583 +602 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
 #endif /* ULTRIX_AUTH */
-        
+
 #ifdef LINUX_BIGCRYPT
         ret = (linux_bigcrypt(password, get_this_salt(), get_this_crypted()));
@@ -594 +613 @@
         }
 #endif /* LINUX_BIGCRYPT */
-        
+
 #if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-        
+
         /*
          * Some systems have bigcrypt in the C library but might not
@@ -614 +633 @@
         }
 #else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-        
+
 #ifdef HAVE_BIGCRYPT
         ret = (strcmp(bigcrypt(password, get_this_salt()), get_this_crypted()) == 0);
@@ -623 +642 @@
         }
 #endif /* HAVE_BIGCRYPT */
-        
+
 #ifndef HAVE_CRYPT
         DEBUG(1, ("Warning - no crypt available\n"));
@@ -648 +667 @@
 ****************************************************************************/
 
-NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *password, 
-                    int pwlen, bool (*fn) (const char *, const char *), bool run_cracker)
+NTSTATUS pass_check(const struct passwd *pass,
+                    const char *user,
+                    const char *rhost,
+                    const char *password,
+                    bool run_cracker)
 {
         char *pass2 = NULL;
@@ -663 +685 @@
                 return NT_STATUS_LOGON_FAILURE;
 
-        if (((!*password) || (!pwlen)) && !lp_null_passwords())
+        if ((!*password) && !lp_null_passwords())
                 return NT_STATUS_LOGON_FAILURE;
 
@@ -677 +699 @@
         }
 
-        DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
+        DEBUG(4, ("pass_check: Checking (PAM) password for user %s\n", user));
 
 #else /* Not using PAM */
 
-        DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
+        DEBUG(4, ("pass_check: Checking password for user %s\n", user));
 
         if (!pass) {
@@ -819 +841 @@
 
         /* try it as it came to us */
-        nt_status = password_check(password);
+        nt_status = password_check(password, (void *)rhost);
         if NT_STATUS_IS_OK(nt_status) {
-                if (fn) {
-                        fn(user, password);
-                }
                 return (nt_status);
         } else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
@@ -850 +869 @@
         if (strhasupper(pass2)) {
                 strlower_m(pass2);
-                if NT_STATUS_IS_OK(nt_status = password_check(pass2)) {
-                        if (fn)
-                                fn(user, pass2);
+                nt_status = password_check(pass2, (void *)rhost);
+                if (NT_STATUS_IS_OK(nt_status)) {
                         return (nt_status);
                 }
@@ -864 +882 @@
         /* last chance - all combinations of up to level chars upper! */
         strlower_m(pass2);
- 
-        if (NT_STATUS_IS_OK(nt_status = string_combinations(pass2, password_check, level))) {
-                if (fn)
-                        fn(user, pass2);
+
+        nt_status = string_combinations(pass2, password_check, level,
+                                        (void *)rhost);
+        if (NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
         }
-        
+
         return NT_STATUS_WRONG_PASSWORD;
 }

trunk/server/source3/auth/token_util.c

@@ -26 +26 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "secrets.h"
+#include "memcache.h"
+#include "../librpc/gen_ndr/netlogon.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/util_pw.h"
+#include "passdb.h"
+#include "lib/privileges.h"
 
 /****************************************************************************
- Check for a SID in an NT_USER_TOKEN
+ Check for a SID in an struct security_token
 ****************************************************************************/
 
-bool nt_token_check_sid ( const DOM_SID *sid, const NT_USER_TOKEN *token )
-{
-        int i;
-
+bool nt_token_check_sid ( const struct dom_sid *sid, const struct security_token *token )
+{
         if ( !sid || !token )
                 return False;
 
-        for ( i=0; i<token->num_sids; i++ ) {
-                if ( sid_equal( sid, &token->user_sids[i] ) )
-                        return True;
-        }
-
-        return False;
-}
-
-bool nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid )
-{
-        DOM_SID domain_sid;
+        return security_token_has_sid(token, sid);
+}
+
+bool nt_token_check_domain_rid( struct security_token *token, uint32 rid )
+{
+        struct dom_sid domain_sid;
 
         /* if we are a domain member, the get the domain SID, else for
@@ -73 +74 @@
  This is similar to running under the context of the LOCAL_SYSTEM account
  in Windows.  This is a read-only token.  Do not modify it or free() it.
- Create a copy if your need to change it.
+ Create a copy if you need to change it.
 ******************************************************************************/
 
-NT_USER_TOKEN *get_root_nt_token( void )
-{
-        struct nt_user_token *token, *for_cache;
-        DOM_SID u_sid, g_sid;
+struct security_token *get_root_nt_token( void )
+{
+        struct security_token *token, *for_cache;
+        struct dom_sid u_sid, g_sid;
         struct passwd *pw;
         void *cache_data;
@@ -89 +90 @@
         if (cache_data != NULL) {
                 return talloc_get_type_abort(
-                        cache_data, struct nt_user_token);
+                        cache_data, struct security_token);
         }
 
@@ -106 +107 @@
         gid_to_sid(&g_sid, pw->pw_gid);
 
-        token = create_local_nt_token(talloc_autofree_context(), &u_sid, False,
+        token = create_local_nt_token(talloc_tos(), &u_sid, False,
                                       1, &global_sid_Builtin_Administrators);
 
-        token->privileges = se_disk_operators;
+        security_token_set_privilege(token, SEC_PRIV_DISK_OPERATOR);
 
         for_cache = token;
@@ -125 +126 @@
  */
 
-NTSTATUS add_aliases(const DOM_SID *domain_sid,
-                     struct nt_user_token *token)
+NTSTATUS add_aliases(const struct dom_sid *domain_sid,
+                     struct security_token *token)
 {
         uint32 *aliases;
@@ -141 +142 @@
 
         status = pdb_enum_alias_memberships(tmp_ctx, domain_sid,
-                                            token->user_sids,
+                                            token->sids,
                                             token->num_sids,
                                             &aliases, &num_aliases);
@@ -152 +153 @@
 
         for (i=0; i<num_aliases; i++) {
-                DOM_SID alias_sid;
+                struct dom_sid alias_sid;
                 sid_compose(&alias_sid, domain_sid, aliases[i]);
                 status = add_sid_to_array_unique(token, &alias_sid,
-                                                 &token->user_sids,
+                                                 &token->sids,
                                                  &token->num_sids);
                 if (!NT_STATUS_IS_OK(status)) {
@@ -171 +172 @@
 *******************************************************************/
 
-static NTSTATUS add_builtin_administrators(struct nt_user_token *token,
-                                           const DOM_SID *dom_sid)
-{
-        DOM_SID domadm;
+static NTSTATUS add_builtin_administrators(struct security_token *token,
+                                           const struct dom_sid *dom_sid)
+{
+        struct dom_sid domadm;
         NTSTATUS status;
 
@@ -190 +191 @@
                 sid_copy(&domadm, dom_sid);
         }
-        sid_append_rid( &domadm, DOMAIN_GROUP_RID_ADMINS );
+        sid_append_rid( &domadm, DOMAIN_RID_ADMINS );
 
         /* Add Administrators if the user beloongs to Domain Admins */
@@ -197 +198 @@
                 status = add_sid_to_array(token,
                                           &global_sid_Builtin_Administrators,
-                                          &token->user_sids, &token->num_sids);
+                                          &token->sids, &token->num_sids);
         if (!NT_STATUS_IS_OK(status)) {
                         return status;
@@ -206 +207 @@
 }
 
-/**
- * Create the requested BUILTIN if it doesn't already exist.  This requires
- * winbindd to be running.
- *
- * @param[in] rid BUILTIN rid to create
- * @return Normal NTSTATUS return.
- */
-static NTSTATUS create_builtin(uint32 rid)
-{
-        NTSTATUS status = NT_STATUS_OK;
-        DOM_SID sid;
-        gid_t gid;
-
-        if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
-                return NT_STATUS_NO_SUCH_ALIAS;
-        }
-
-        if (!sid_to_gid(&sid, &gid)) {
-                if (!lp_winbind_nested_groups() || !winbind_ping()) {
-                        return NT_STATUS_PROTOCOL_UNREACHABLE;
-                }
-                status = pdb_create_builtin_alias(rid);
-        }
-        return status;
-}
-
-/**
- * Add sid as a member of builtin_sid.
- *
- * @param[in] builtin_sid       An existing builtin group.
- * @param[in] dom_sid           sid to add as a member of builtin_sid.
- * @return Normal NTSTATUS return
- */
-static NTSTATUS add_sid_to_builtin(const DOM_SID *builtin_sid,
-                                   const DOM_SID *dom_sid)
-{
-        NTSTATUS status = NT_STATUS_OK;
-
-        if (!dom_sid || !builtin_sid) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        status = pdb_add_aliasmem(builtin_sid, dom_sid);
-
-        if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
-                DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
-                          sid_string_dbg(dom_sid),
-                          sid_string_dbg(builtin_sid)));
-                return NT_STATUS_OK;
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
-                          "%s\n", sid_string_dbg(dom_sid),
-                          sid_string_dbg(builtin_sid), nt_errstr(status)));
-        }
-        return status;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-NTSTATUS create_builtin_users(const DOM_SID *dom_sid)
-{
+static NTSTATUS finalize_local_nt_token(struct security_token *result,
+                                        bool is_guest);
+
+NTSTATUS create_local_nt_token_from_info3(TALLOC_CTX *mem_ctx,
+                                          bool is_guest,
+                                          struct netr_SamInfo3 *info3,
+                                          struct extra_auth_info *extra,
+                                          struct security_token **ntok)
+{
+        struct security_token *usrtok = NULL;
         NTSTATUS status;
-        DOM_SID dom_users;
-
-        status = create_builtin(BUILTIN_ALIAS_RID_USERS);
-        if ( !NT_STATUS_IS_OK(status) ) {
-                DEBUG(5,("create_builtin_users: Failed to create Users\n"));
-                return status;
-        }
-
-        /* add domain users */
-        if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
-                && sid_compose(&dom_users, dom_sid, DOMAIN_GROUP_RID_USERS))
-        {
-                status = add_sid_to_builtin(&global_sid_Builtin_Users,
-                                            &dom_users);
-        }
-
-        return status;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-NTSTATUS create_builtin_administrators(const DOM_SID *dom_sid)
-{
-        NTSTATUS status;
-        DOM_SID dom_admins, root_sid;
-        fstring root_name;
-        enum lsa_SidType type;
-        TALLOC_CTX *ctx;
-        bool ret;
-
-        status = create_builtin(BUILTIN_ALIAS_RID_ADMINS);
-        if ( !NT_STATUS_IS_OK(status) ) {
-                DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
-                return status;
-        }
-
-        /* add domain admins */
-        if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
-                && sid_compose(&dom_admins, dom_sid, DOMAIN_GROUP_RID_ADMINS))
-        {
-                status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
-                                            &dom_admins);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-        }
-
-        /* add root */
-        if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
+        int i;
+
+        DEBUG(10, ("Create local NT token for %s\n",
+                   info3->base.account_name.string));
+
+        usrtok = talloc_zero(mem_ctx, struct security_token);
+        if (!usrtok) {
+                DEBUG(0, ("talloc failed\n"));
                 return NT_STATUS_NO_MEMORY;
         }
-        fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
-        ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
-                          &root_sid, &type);
-        TALLOC_FREE( ctx );
-
-        if ( ret ) {
-                status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
-                                            &root_sid);
-        }
-
-        return status;
-}
-
-
-/*******************************************************************
- Create a NT token for the user, expanding local aliases
-*******************************************************************/
-
-struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
-                                            const DOM_SID *user_sid,
-                                            bool is_guest,
-                                            int num_groupsids,
-                                            const DOM_SID *groupsids)
-{
-        struct nt_user_token *result = NULL;
-        int i;
-        NTSTATUS status;
-        gid_t gid;
-        DOM_SID dom_sid;
-
-        DEBUG(10, ("Create local NT token for %s\n",
-                   sid_string_dbg(user_sid)));
-
-        if (!(result = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
-                DEBUG(0, ("talloc failed\n"));
-                return NULL;
-        }
-
-        /* Add the user and primary group sid */
-
-        status = add_sid_to_array(result, user_sid,
-                                  &result->user_sids, &result->num_sids);
-        if (!NT_STATUS_IS_OK(status)) {
-                return NULL;
-        }
-
-        /* For guest, num_groupsids may be zero. */
-        if (num_groupsids) {
-                status = add_sid_to_array(result, &groupsids[0],
-                                          &result->user_sids,
-                                          &result->num_sids);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return NULL;
-                }
-        }
-
-        /* Add in BUILTIN sids */
-
-        status = add_sid_to_array(result, &global_sid_World,
-                                  &result->user_sids, &result->num_sids);
-        if (!NT_STATUS_IS_OK(status)) {
-                return NULL;
-        }
-        status = add_sid_to_array(result, &global_sid_Network,
-                                  &result->user_sids, &result->num_sids);
-        if (!NT_STATUS_IS_OK(status)) {
-                return NULL;
-        }
-
-        if (is_guest) {
-                status = add_sid_to_array(result, &global_sid_Builtin_Guests,
-                                          &result->user_sids,
-                                          &result->num_sids);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return NULL;
-                }
+
+        /* Add the user and primary group sid FIRST */
+        /* check if the user rid is the special "Domain Guests" rid.
+         * If so pick the first sid for the extra sids instead as it
+         * is a local fake account */
+        usrtok->sids = talloc_array(usrtok, struct dom_sid, 2);
+        if (!usrtok->sids) {
+                TALLOC_FREE(usrtok);
+                return NT_STATUS_NO_MEMORY;
+        }
+        usrtok->num_sids = 2;
+
+        /* USER SID */
+        if (info3->base.rid == (uint32_t)(-1)) {
+                /* this is a signal the user was fake and generated,
+                 * the actual SID we want to use is stored in the extra
+                 * sids */
+                if (is_null_sid(&extra->user_sid)) {
+                        /* we couldn't find the user sid, bail out */
+                        DEBUG(3, ("Invalid user SID\n"));
+                        TALLOC_FREE(usrtok);
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+                sid_copy(&usrtok->sids[0], &extra->user_sid);
         } else {
-                status = add_sid_to_array(result,
-                                          &global_sid_Authenticated_Users,
-                                          &result->user_sids,
-                                          &result->num_sids);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return NULL;
-                }
+                sid_copy(&usrtok->sids[0], info3->base.domain_sid);
+                sid_append_rid(&usrtok->sids[0], info3->base.rid);
+        }
+
+        /* GROUP SID */
+        if (info3->base.primary_gid == (uint32_t)(-1)) {
+                /* this is a signal the user was fake and generated,
+                 * the actual SID we want to use is stored in the extra
+                 * sids */
+                if (is_null_sid(&extra->pgid_sid)) {
+                        /* we couldn't find the user sid, bail out */
+                        DEBUG(3, ("Invalid group SID\n"));
+                        TALLOC_FREE(usrtok);
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+                sid_copy(&usrtok->sids[1], &extra->pgid_sid);
+        } else {
+                sid_copy(&usrtok->sids[1], info3->base.domain_sid);
+                sid_append_rid(&usrtok->sids[1],
+                                info3->base.primary_gid);
         }
 
@@ -415 +281 @@
          * first group sid as primary above. */
 
+        for (i = 0; i < info3->base.groups.count; i++) {
+                struct dom_sid tmp_sid;
+
+                sid_copy(&tmp_sid, info3->base.domain_sid);
+                sid_append_rid(&tmp_sid, info3->base.groups.rids[i].rid);
+
+                status = add_sid_to_array_unique(usrtok, &tmp_sid,
+                                                 &usrtok->sids,
+                                                 &usrtok->num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(3, ("Failed to add SID to nt token\n"));
+                        TALLOC_FREE(usrtok);
+                        return status;
+                }
+        }
+
+        /* now also add extra sids if they are not the special user/group
+         * sids */
+        for (i = 0; i < info3->sidcount; i++) {
+                status = add_sid_to_array_unique(usrtok,
+                                                 info3->sids[i].sid,
+                                                 &usrtok->sids,
+                                                 &usrtok->num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(3, ("Failed to add SID to nt token\n"));
+                        TALLOC_FREE(usrtok);
+                        return status;
+                }
+        }
+
+        status = finalize_local_nt_token(usrtok, is_guest);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("Failed to finalize nt token\n"));
+                TALLOC_FREE(usrtok);
+                return status;
+        }
+
+        *ntok = usrtok;
+        return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Create a NT token for the user, expanding local aliases
+*******************************************************************/
+
+struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
+                                            const struct dom_sid *user_sid,
+                                            bool is_guest,
+                                            int num_groupsids,
+                                            const struct dom_sid *groupsids)
+{
+        struct security_token *result = NULL;
+        int i;
+        NTSTATUS status;
+
+        DEBUG(10, ("Create local NT token for %s\n",
+                   sid_string_dbg(user_sid)));
+
+        if (!(result = TALLOC_ZERO_P(mem_ctx, struct security_token))) {
+                DEBUG(0, ("talloc failed\n"));
+                return NULL;
+        }
+
+        /* Add the user and primary group sid */
+
+        status = add_sid_to_array(result, user_sid,
+                                  &result->sids, &result->num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(result);
+                return NULL;
+        }
+
+        /* For guest, num_groupsids may be zero. */
+        if (num_groupsids) {
+                status = add_sid_to_array(result, &groupsids[0],
+                                          &result->sids,
+                                          &result->num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        TALLOC_FREE(result);
+                        return NULL;
+                }
+        }
+
+        /* Now the SIDs we got from authentication. These are the ones from
+         * the info3 struct or from the pdb_enum_group_memberships, depending
+         * on who authenticated the user.
+         * Note that we start the for loop at "1" here, we already added the
+         * first group sid as primary above. */
+
         for (i=1; i<num_groupsids; i++) {
                 status = add_sid_to_array_unique(result, &groupsids[i],
-                                                 &result->user_sids,
+                                                 &result->sids,
                                                  &result->num_sids);
                 if (!NT_STATUS_IS_OK(status)) {
+                        TALLOC_FREE(result);
                         return NULL;
+                }
+        }
+
+        status = finalize_local_nt_token(result, is_guest);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(result);
+                return NULL;
+        }
+
+        return result;
+}
+
+static NTSTATUS finalize_local_nt_token(struct security_token *result,
+                                        bool is_guest)
+{
+        struct dom_sid dom_sid;
+        gid_t gid;
+        NTSTATUS status;
+
+        /* Add in BUILTIN sids */
+
+        status = add_sid_to_array(result, &global_sid_World,
+                                  &result->sids, &result->num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+        status = add_sid_to_array(result, &global_sid_Network,
+                                  &result->sids, &result->num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if (is_guest) {
+                status = add_sid_to_array(result, &global_sid_Builtin_Guests,
+                                          &result->sids,
+                                          &result->num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+        } else {
+                status = add_sid_to_array(result,
+                                          &global_sid_Authenticated_Users,
+                                          &result->sids,
+                                          &result->num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
                 }
         }
@@ -491 +493 @@
                 if (!NT_STATUS_IS_OK(status)) {
                         unbecome_root();
-                        TALLOC_FREE(result);
-                        return NULL;
+                        return status;
                 }
 
@@ -501 +502 @@
                 if (!NT_STATUS_IS_OK(status)) {
                         unbecome_root();
-                        TALLOC_FREE(result);
-                        return NULL;
+                        return status;
                 }
 
@@ -508 +508 @@
         }
 
-
-        get_privileges_for_sids(&result->privileges, result->user_sids,
+        /* Add privileges based on current user sids */
+
+        get_privileges_for_sids(&result->privilege_mask, result->sids,
                                 result->num_sids);
-        return result;
-}
-
-/****************************************************************************
- prints a NT_USER_TOKEN to debug output.
-****************************************************************************/
-
-void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
-{
-        size_t     i;
-
-        if (!token) {
-                DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
-                return;
-        }
-
-        DEBUGC(dbg_class, dbg_lev,
-               ("NT user token of user %s\n",
-                sid_string_dbg(&token->user_sids[0]) ));
-        DEBUGADDC(dbg_class, dbg_lev,
-                  ("contains %lu SIDs\n", (unsigned long)token->num_sids));
-        for (i = 0; i < token->num_sids; i++)
-                DEBUGADDC(dbg_class, dbg_lev,
-                          ("SID[%3lu]: %s\n", (unsigned long)i,
-                           sid_string_dbg(&token->user_sids[i])));
-
-        dump_se_priv( dbg_class, dbg_lev, &token->privileges );
+
+        return NT_STATUS_OK;
 }
 
@@ -559 +535 @@
 }
 
+/*
+ * Create an artificial NT token given just a username. (Initially intended
+ * for force user)
+ *
+ * We go through lookup_name() to avoid problems we had with 'winbind use
+ * default domain'.
+ *
+ * We have 3 cases:
+ *
+ * unmapped unix users: Go directly to nss to find the user's group.
+ *
+ * A passdb user: The list of groups is provided by pdb_enum_group_memberships.
+ *
+ * If the user is provided by winbind, the primary gid is set to "domain
+ * users" of the user's domain. For an explanation why this is necessary, see
+ * the thread starting at
+ * http://lists.samba.org/archive/samba-technical/2006-January/044803.html.
+ */
+
+NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
+                                    bool is_guest,
+                                    uid_t *uid, gid_t *gid,
+                                    char **found_username,
+                                    struct security_token **token)
+{
+        NTSTATUS result = NT_STATUS_NO_SUCH_USER;
+        TALLOC_CTX *tmp_ctx = talloc_stackframe();
+        struct dom_sid user_sid;
+        enum lsa_SidType type;
+        gid_t *gids;
+        struct dom_sid *group_sids;
+        struct dom_sid unix_group_sid;
+        uint32_t num_group_sids;
+        uint32_t num_gids;
+        uint32_t i;
+
+        if (!lookup_name_smbconf(tmp_ctx, username, LOOKUP_NAME_ALL,
+                         NULL, NULL, &user_sid, &type)) {
+                DEBUG(1, ("lookup_name_smbconf for %s failed\n", username));
+                goto done;
+        }
+
+        if (type != SID_NAME_USER) {
+                DEBUG(1, ("%s is a %s, not a user\n", username,
+                          sid_type_lookup(type)));
+                goto done;
+        }
+
+        if (sid_check_is_in_our_domain(&user_sid)) {
+                bool ret;
+                uint32_t pdb_num_group_sids;
+                /* This is a passdb user, so ask passdb */
+
+                struct samu *sam_acct = NULL;
+
+                if ( !(sam_acct = samu_new( tmp_ctx )) ) {
+                        result = NT_STATUS_NO_MEMORY;
+                        goto done;
+                }
+
+                become_root();
+                ret = pdb_getsampwsid(sam_acct, &user_sid);
+                unbecome_root();
+
+                if (!ret) {
+                        DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
+                                  sid_string_dbg(&user_sid), username));
+                        DEBUGADD(1, ("Fall back to unix user %s\n", username));
+                        goto unix_user;
+                }
+
+                result = pdb_enum_group_memberships(tmp_ctx, sam_acct,
+                                                    &group_sids, &gids,
+                                                    &pdb_num_group_sids);
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(1, ("enum_group_memberships failed for %s (%s): "
+                                  "%s\n", username, sid_string_dbg(&user_sid),
+                                  nt_errstr(result)));
+                        DEBUGADD(1, ("Fall back to unix user %s\n", username));
+                        goto unix_user;
+                }
+                num_group_sids = pdb_num_group_sids;
+
+                /* see the smb_panic() in pdb_default_enum_group_memberships */
+                SMB_ASSERT(num_group_sids > 0);
+
+                *gid = gids[0];
+
+                /* Ensure we're returning the found_username on the right context. */
+                *found_username = talloc_strdup(mem_ctx,
+                                                pdb_get_username(sam_acct));
+
+                /*
+                 * If the SID from lookup_name() was the guest sid, passdb knows
+                 * about the mapping of guest sid to lp_guestaccount()
+                 * username and will return the unix_pw info for a guest
+                 * user. Use it if it's there, else lookup the *uid details
+                 * using Get_Pwnam_alloc(). See bug #6291 for details. JRA.
+                 */
+
+                /* We must always assign the *uid. */
+                if (sam_acct->unix_pw == NULL) {
+                        struct passwd *pwd = Get_Pwnam_alloc(sam_acct, *found_username );
+                        if (!pwd) {
+                                DEBUG(10, ("Get_Pwnam_alloc failed for %s\n",
+                                        *found_username));
+                                result = NT_STATUS_NO_SUCH_USER;
+                                goto done;
+                        }
+                        result = samu_set_unix(sam_acct, pwd );
+                        if (!NT_STATUS_IS_OK(result)) {
+                                DEBUG(10, ("samu_set_unix failed for %s\n",
+                                        *found_username));
+                                result = NT_STATUS_NO_SUCH_USER;
+                                goto done;
+                        }
+                }
+                *uid = sam_acct->unix_pw->pw_uid;
+
+        } else  if (sid_check_is_in_unix_users(&user_sid)) {
+                uint32_t getgroups_num_group_sids;
+                /* This is a unix user not in passdb. We need to ask nss
+                 * directly, without consulting passdb */
+
+                struct passwd *pass;
+
+                /*
+                 * This goto target is used as a fallback for the passdb
+                 * case. The concrete bug report is when passdb gave us an
+                 * unmapped gid.
+                 */
+
+        unix_user:
+
+                if (!sid_to_uid(&user_sid, uid)) {
+                        DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
+                                  username, sid_string_dbg(&user_sid)));
+                        result = NT_STATUS_NO_SUCH_USER;
+                        goto done;
+                }
+
+                uid_to_unix_users_sid(*uid, &user_sid);
+
+                pass = getpwuid_alloc(tmp_ctx, *uid);
+                if (pass == NULL) {
+                        DEBUG(1, ("getpwuid(%u) for user %s failed\n",
+                                  (unsigned int)*uid, username));
+                        goto done;
+                }
+
+                if (!getgroups_unix_user(tmp_ctx, username, pass->pw_gid,
+                                         &gids, &getgroups_num_group_sids)) {
+                        DEBUG(1, ("getgroups_unix_user for user %s failed\n",
+                                  username));
+                        goto done;
+                }
+                num_group_sids = getgroups_num_group_sids;
+
+                if (num_group_sids) {
+                        group_sids = TALLOC_ARRAY(tmp_ctx, struct dom_sid, num_group_sids);
+                        if (group_sids == NULL) {
+                                DEBUG(1, ("TALLOC_ARRAY failed\n"));
+                                result = NT_STATUS_NO_MEMORY;
+                                goto done;
+                        }
+                } else {
+                        group_sids = NULL;
+                }
+
+                for (i=0; i<num_group_sids; i++) {
+                        gid_to_sid(&group_sids[i], gids[i]);
+                }
+
+                /* In getgroups_unix_user we always set the primary gid */
+                SMB_ASSERT(num_group_sids > 0);
+
+                *gid = gids[0];
+
+                /* Ensure we're returning the found_username on the right context. */
+                *found_username = talloc_strdup(mem_ctx, pass->pw_name);
+        } else {
+
+                /* This user is from winbind, force the primary gid to the
+                 * user's "domain users" group. Under certain circumstances
+                 * (user comes from NT4), this might be a loss of
+                 * information. But we can not rely on winbind getting the
+                 * correct info. AD might prohibit winbind looking up that
+                 * information. */
+
+                /* We must always assign the *uid. */
+                if (!sid_to_uid(&user_sid, uid)) {
+                        DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
+                                  username, sid_string_dbg(&user_sid)));
+                        result = NT_STATUS_NO_SUCH_USER;
+                        goto done;
+                }
+
+                num_group_sids = 1;
+                group_sids = TALLOC_ARRAY(tmp_ctx, struct dom_sid, num_group_sids);
+                if (group_sids == NULL) {
+                        DEBUG(1, ("TALLOC_ARRAY failed\n"));
+                        result = NT_STATUS_NO_MEMORY;
+                        goto done;
+                }
+
+                sid_copy(&group_sids[0], &user_sid);
+                sid_split_rid(&group_sids[0], NULL);
+                sid_append_rid(&group_sids[0], DOMAIN_RID_USERS);
+
+                if (!sid_to_gid(&group_sids[0], gid)) {
+                        DEBUG(1, ("sid_to_gid(%s) failed\n",
+                                  sid_string_dbg(&group_sids[0])));
+                        goto done;
+                }
+
+                gids = gid;
+
+                /* Ensure we're returning the found_username on the right context. */
+                *found_username = talloc_strdup(mem_ctx, username);
+        }
+
+        /* Add the "Unix Group" SID for each gid to catch mapped groups
+           and their Unix equivalent.  This is to solve the backwards
+           compatibility problem of 'valid users = +ntadmin' where
+           ntadmin has been paired with "Domain Admins" in the group
+           mapping table.  Otherwise smb.conf would need to be changed
+           to 'valid user = "Domain Admins"'.  --jerry */
+
+        num_gids = num_group_sids;
+        for ( i=0; i<num_gids; i++ ) {
+                gid_t high, low;
+
+                /* don't pickup anything managed by Winbind */
+
+                if ( lp_idmap_gid(&low, &high) && (gids[i] >= low) && (gids[i] <= high) )
+                        continue;
+
+                gid_to_unix_groups_sid(gids[i], &unix_group_sid);
+
+                result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
+                                                 &group_sids, &num_group_sids);
+                if (!NT_STATUS_IS_OK(result)) {
+                        goto done;
+                }
+        }
+
+        /* Ensure we're creating the nt_token on the right context. */
+        *token = create_local_nt_token(mem_ctx, &user_sid,
+                                       is_guest, num_group_sids, group_sids);
+
+        if ((*token == NULL) || (*found_username == NULL)) {
+                result = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        result = NT_STATUS_OK;
+ done:
+        TALLOC_FREE(tmp_ctx);
+        return result;
+}
+
+/***************************************************************************
+ Build upon create_token_from_username:
+
+ Expensive helper function to figure out whether a user given its name is
+ member of a particular group.
+***************************************************************************/
+
+bool user_in_group_sid(const char *username, const struct dom_sid *group_sid)
+{
+        NTSTATUS status;
+        uid_t uid;
+        gid_t gid;
+        char *found_username;
+        struct security_token *token;
+        bool result;
+        TALLOC_CTX *mem_ctx = talloc_stackframe();
+
+        status = create_token_from_username(mem_ctx, username, False,
+                                            &uid, &gid, &found_username,
+                                            &token);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("could not create token for %s\n", username));
+                TALLOC_FREE(mem_ctx);
+                return False;
+        }
+
+        result = security_token_has_sid(token, group_sid);
+
+        TALLOC_FREE(mem_ctx);
+        return result;
+}
+
+bool user_in_group(const char *username, const char *groupname)
+{
+        TALLOC_CTX *mem_ctx = talloc_stackframe();
+        struct dom_sid group_sid;
+        bool ret;
+
+        ret = lookup_name(mem_ctx, groupname, LOOKUP_NAME_ALL,
+                          NULL, NULL, &group_sid, NULL);
+        TALLOC_FREE(mem_ctx);
+
+        if (!ret) {
+                DEBUG(10, ("lookup_name for (%s) failed.\n", groupname));
+                return False;
+        }
+
+        return user_in_group_sid(username, &group_sid);
+}
+
 /* END */