Changeset 745 for trunk/server/source3/passdb

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/passdb/account_pol.c (copied) (copied from vendor/current/source3/passdb/account_pol.c )
• source3/passdb/login_cache.c (modified) (13 diffs)
• source3/passdb/lookup_sid.c (modified) (46 diffs)
• source3/passdb/lookup_sid.h (copied) (copied from vendor/current/source3/passdb/lookup_sid.h )
• source3/passdb/machine_account_secrets.c (copied) (copied from vendor/current/source3/passdb/machine_account_secrets.c )
• source3/passdb/machine_sid.c (modified) (12 diffs)
• source3/passdb/machine_sid.h (copied) (copied from vendor/current/source3/passdb/machine_sid.h )
• source3/passdb/passdb.c (modified) (59 diffs)
• source3/passdb/pdb_ads.c (modified) (74 diffs)
• source3/passdb/pdb_compat.c (modified) (7 diffs)
• source3/passdb/pdb_get_set.c (modified) (25 diffs)
• source3/passdb/pdb_interface.c (modified) (74 diffs)
• source3/passdb/pdb_ipa.c (copied) (copied from vendor/current/source3/passdb/pdb_ipa.c )
• source3/passdb/pdb_ldap.c (modified) (112 diffs)
• source3/passdb/pdb_nds.c (modified) (1 diff)
• source3/passdb/pdb_smbpasswd.c (modified) (33 diffs)
• source3/passdb/pdb_tdb.c (modified) (2 diffs)
• source3/passdb/pdb_util.c (copied) (copied from vendor/current/source3/passdb/pdb_util.c )
• source3/passdb/pdb_wbc_sam.c (modified) (20 diffs)
• source3/passdb/proto.h (copied) (copied from vendor/current/source3/passdb/proto.h )
• source3/passdb/secrets.c (modified) (11 diffs)
• source3/passdb/secrets_schannel.c (deleted)
• source3/passdb/util_builtin.c (deleted)
• source3/passdb/util_unixsids.c (deleted)
• source3/passdb/util_wellknown.c (deleted)
• source3/passdb/wscript_build (copied) (copied from vendor/current/source3/passdb/wscript_build )

trunk/server/source3/passdb/login_cache.c

@@ -3 +3 @@
    struct samu local cache for 
    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2004.
-      
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -19 +19 @@
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "passdb.h"
+#include "util_tdb.h"
 
 #undef DBGC_CLASS
@@ -32 +35 @@
 {
         char* cache_fname = NULL;
-        
+
         /* skip file open if it's already opened */
         if (cache) return True;
@@ -64 +67 @@
 
 /* if we can't read the cache, oh well, no need to return anything */
-LOGIN_CACHE * login_cache_read(struct samu *sampass)
+bool login_cache_read(struct samu *sampass, struct login_cache *entry)
 {
         char *keystr;
         TDB_DATA databuf;
-        LOGIN_CACHE *entry;
         uint32_t entry_timestamp = 0, bad_password_time = 0;
         uint16_t acct_ctrl;
 
-        if (!login_cache_init())
-                return NULL;
+        if (!login_cache_init()) {
+                return false;
+        }
 
         if (pdb_get_nt_username(sampass) == NULL) {
-                return NULL;
+                return false;
         }
 
@@ -82 +85 @@
         if (!keystr || !keystr[0]) {
                 SAFE_FREE(keystr);
-                return NULL;
+                return false;
         }
 
@@ -90 +93 @@
         SAFE_FREE(keystr);
 
-        if (!(entry = SMB_MALLOC_P(LOGIN_CACHE))) {
-                DEBUG(1, ("Unable to allocate cache entry buffer!\n"));
-                SAFE_FREE(databuf.dptr);
-                return NULL;
-        }
         ZERO_STRUCTP(entry);
 
@@ -103 +101 @@
                         &bad_password_time) == -1) {
                 DEBUG(7, ("No cache entry found\n"));
-                SAFE_FREE(entry);
                 SAFE_FREE(databuf.dptr);
-                return NULL;
+                return false;
         }
 
@@ -123 +120 @@
                   (unsigned int)entry->entry_timestamp, entry->acct_ctrl, 
                   entry->bad_password_count, (unsigned int)entry->bad_password_time));
-        return entry;
-}
-
-bool login_cache_write(const struct samu *sampass, LOGIN_CACHE entry)
+        return true;
+}
+
+bool login_cache_write(const struct samu *sampass,
+                       const struct login_cache *entry)
 {
         char *keystr;
@@ -132 +130 @@
         bool ret;
         uint32_t entry_timestamp;
-        uint32_t bad_password_time = (uint32_t)entry.bad_password_time;
+        uint32_t bad_password_time = entry->bad_password_time;
 
         if (!login_cache_init())
@@ -152 +150 @@
                 tdb_pack(NULL, 0, SAM_CACHE_FORMAT,
                          entry_timestamp,
-                         entry.acct_ctrl,
-                         entry.bad_password_count,
+                         entry->acct_ctrl,
+                         entry->bad_password_count,
                          bad_password_time);
         databuf.dptr = SMB_MALLOC_ARRAY(uint8, databuf.dsize);
@@ -160 +158 @@
                 return False;
         }
-                         
+
         if (tdb_pack(databuf.dptr, databuf.dsize, SAM_CACHE_FORMAT,
                          entry_timestamp,
-                         entry.acct_ctrl,
-                         entry.bad_password_count,
+                         entry->acct_ctrl,
+                         entry->bad_password_count,
                          bad_password_time)
             != databuf.dsize) {
@@ -182 +180 @@
         int ret;
         char *keystr;
-        
+
         if (!login_cache_init()) 
                 return False;   
@@ -199 +197 @@
         ret = tdb_delete_bystring(cache, keystr);
         DEBUG(9, ("tdb_delete returned %d\n", ret));
-        
+
         SAFE_FREE(keystr);
         return ret == 0;

trunk/server/source3/passdb/lookup_sid.c

@@ -5 +5 @@
    Copyright (C) Gerald (Jerry) Carter   2003
    Copyright (C) Volker Lendecke         2005
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -21 +21 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "../librpc/gen_ndr/ndr_security.h"
+#include "secrets.h"
+#include "memcache.h"
+#include "idmap_cache.h"
+#include "../libcli/security/security.h"
+#include "lib/winbind_util.h"
 
 /*****************************************************************
@@ -33 +40 @@
                  const char *full_name, int flags,
                  const char **ret_domain, const char **ret_name,
-                 DOM_SID *ret_sid, enum lsa_SidType *ret_type)
+                 struct dom_sid *ret_sid, enum lsa_SidType *ret_type)
 {
         char *p;
@@ -40 +47 @@
         const char *name = NULL;
         uint32 rid;
-        DOM_SID sid;
+        struct dom_sid sid;
         enum lsa_SidType type;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
@@ -66 +73 @@
         }
 
-        DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
+        DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n",
                 full_name, domain, name));
         DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags));
@@ -76 +83 @@
                 /* It's our own domain, lookup the name in passdb */
                 if (lookup_global_sam_name(name, flags, &rid, &type)) {
-                        sid_copy(&sid, get_global_sam_sid());
-                        sid_append_rid(&sid, rid);
+                        sid_compose(&sid, get_global_sam_sid(), rid);
                         goto ok;
                 }
@@ -97 +103 @@
                 /* Explicit request for a name in BUILTIN */
                 if (lookup_builtin_name(name, &rid)) {
-                        sid_copy(&sid, &global_sid_Builtin);
-                        sid_append_rid(&sid, rid);
+                        sid_compose(&sid, &global_sid_Builtin, rid);
                         type = SID_NAME_ALIAS;
                         goto ok;
@@ -216 +221 @@
         {
                 domain = talloc_strdup(tmp_ctx, builtin_domain_name());
-                sid_copy(&sid, &global_sid_Builtin);
-                sid_append_rid(&sid, rid);
+                sid_compose(&sid, &global_sid_Builtin, rid);
                 type = SID_NAME_ALIAS;
                 goto ok;
@@ -231 +235 @@
         {
                 domain = talloc_strdup(tmp_ctx, get_global_sam_name());
-                sid_copy(&sid, get_global_sam_sid());
-                sid_append_rid(&sid, rid);
+                sid_compose(&sid, get_global_sam_sid(), rid);
                 goto ok;
         }
@@ -258 +261 @@
 
         if (IS_DC && winbind_lookup_name("", name, &sid, &type)) {
-                DOM_SID dom_sid;
-                uint32 tmp_rid;
+                struct dom_sid dom_sid;
                 enum lsa_SidType domain_type;
-                
+
                 if (type == SID_NAME_DOMAIN) {
                         /* Swap name and type */
@@ -273 +275 @@
 
                 sid_copy(&dom_sid, &sid);
-                sid_split_rid(&dom_sid, &tmp_rid);
+                sid_split_rid(&dom_sid, NULL);
 
                 if (!winbind_lookup_sid(tmp_ctx, &dom_sid, &domain, NULL,
@@ -362 +364 @@
                  const char *full_name, int flags,
                  const char **ret_domain, const char **ret_name,
-                 DOM_SID *ret_sid, enum lsa_SidType *ret_type)
+                 struct dom_sid *ret_sid, enum lsa_SidType *ret_type)
 {
         char *qualified_name;
@@ -403 +405 @@
                 return true;
         }
-        
+
         /* Finally try with "Unix Users" or "Unix Group" */
         qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
@@ -420 +422 @@
 
 static bool wb_lookup_rids(TALLOC_CTX *mem_ctx,
-                           const DOM_SID *domain_sid,
+                           const struct dom_sid *domain_sid,
                            int num_rids, uint32 *rids,
                            const char **domain_name,
@@ -470 +472 @@
 }
 
-static bool lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
+static bool lookup_rids(TALLOC_CTX *mem_ctx, const struct dom_sid *domain_sid,
                         int num_rids, uint32_t *rids,
                         const char **domain_name,
@@ -544 +546 @@
         if (sid_check_is_wellknown_domain(domain_sid, NULL)) {
                 for (i=0; i<num_rids; i++) {
-                        DOM_SID sid;
-                        sid_copy(&sid, domain_sid);
-                        sid_append_rid(&sid, rids[i]);
+                        struct dom_sid sid;
+                        sid_compose(&sid, domain_sid, rids[i]);
                         if (lookup_wellknown_sid(mem_ctx, &sid,
                                                  domain_name, &(*names)[i])) {
@@ -606 +607 @@
  */
 
-static bool lookup_as_domain(const DOM_SID *sid, TALLOC_CTX *mem_ctx,
+static bool lookup_as_domain(const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
                              const char **name)
 {
@@ -657 +658 @@
 
                 for (i=0; i<num_domains; i++) {
-                        if (sid_equal(sid, &domains[i]->sid)) {
+                        if (dom_sid_equal(sid, &domains[i]->sid)) {
                                 *name = talloc_strdup(mem_ctx,
                                                       domains[i]->name);
@@ -694 +695 @@
  */
 
-static bool check_dom_sid_to_level(const DOM_SID *sid, int level)
+static bool check_dom_sid_to_level(const struct dom_sid *sid, int level)
 {
         int ret = false;
@@ -729 +730 @@
  * belonging to a domain and hands them in bulk to the appropriate lookup
  * function. In particular pdb_lookup_rids with ldapsam_trusted benefits
- * *hugely* from this. Winbind is going to be extended with a lookup_rids
- * interface as well, so on a DC we can do a bulk lsa_lookuprids to the
- * appropriate DC.
+ * *hugely* from this.
  */
 
 NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
-                     const DOM_SID **sids, int level,
+                     const struct dom_sid **sids, int level,
                      struct lsa_dom_info **ret_domains,
                      struct lsa_name_info **ret_names)
@@ -783 +782 @@
 
         for (i=0; i<num_sids; i++) {
-                DOM_SID sid;
-                uint32 rid;
+                struct dom_sid sid;
+                uint32_t rid = 0;
                 const char *domain_name = NULL;
 
@@ -802 +801 @@
                                 goto fail;
                         }
-                                
+
                         name_infos[i].rid = 0;
                         name_infos[i].type = SID_NAME_DOMAIN;
@@ -836 +835 @@
                                 break;
                         }
-                        if (sid_equal(&sid, &dom_infos[j].sid)) {
+                        if (dom_sid_equal(&sid, &dom_infos[j].sid)) {
                                 break;
                         }
@@ -921 +920 @@
                         goto fail;
                 }
-                        
+
                 for (j=0; j<dom->num_idxs; j++) {
                         int idx = dom->idxs[j];
@@ -954 +953 @@
 *****************************************************************/  
 
-bool lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
+bool lookup_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
                 const char **ret_domain, const char **ret_name,
                 enum lsa_SidType *ret_type)
@@ -1018 +1017 @@
 *****************************************************************/
 
-static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
+static bool fetch_sid_from_uid_cache(struct dom_sid *psid, uid_t uid)
 {
         DATA_BLOB cache_value;
@@ -1030 +1029 @@
         memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
         SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
+        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
 
         return true;
@@ -1039 +1038 @@
 *****************************************************************/
 
-static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
+static bool fetch_uid_from_cache( uid_t *puid, const struct dom_sid *psid )
 {
         DATA_BLOB cache_value;
 
         if (!memcache_lookup(NULL, SID_UID_CACHE,
-                             data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
+                             data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
                              &cache_value)) {
                 return false;
@@ -1059 +1058 @@
 *****************************************************************/
 
-void store_uid_sid_cache(const DOM_SID *psid, uid_t uid)
+void store_uid_sid_cache(const struct dom_sid *psid, uid_t uid)
 {
         memcache_add(NULL, SID_UID_CACHE,
-                     data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
+                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
                      data_blob_const(&uid, sizeof(uid)));
         memcache_add(NULL, UID_SID_CACHE,
                      data_blob_const(&uid, sizeof(uid)),
-                     data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
+                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
 }
 
@@ -1073 +1072 @@
 *****************************************************************/
 
-static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
+static bool fetch_sid_from_gid_cache(struct dom_sid *psid, gid_t gid)
 {
         DATA_BLOB cache_value;
@@ -1085 +1084 @@
         memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
         SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
+        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
 
         return true;
@@ -1094 +1093 @@
 *****************************************************************/
 
-static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
+static bool fetch_gid_from_cache(gid_t *pgid, const struct dom_sid *psid)
 {
         DATA_BLOB cache_value;
 
         if (!memcache_lookup(NULL, SID_GID_CACHE,
-                             data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
+                             data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
                              &cache_value)) {
                 return false;
@@ -1114 +1113 @@
 *****************************************************************/
 
-void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
+void store_gid_sid_cache(const struct dom_sid *psid, gid_t gid)
 {
         memcache_add(NULL, SID_GID_CACHE,
-                     data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
+                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
                      data_blob_const(&gid, sizeof(gid)));
         memcache_add(NULL, GID_SID_CACHE,
                      data_blob_const(&gid, sizeof(gid)),
-                     data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
+                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
 }
 
@@ -1128 +1127 @@
 *****************************************************************/  
 
-static void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
+static void legacy_uid_to_sid(struct dom_sid *psid, uid_t uid)
 {
         bool ret;
@@ -1159 +1158 @@
 *****************************************************************/  
 
-static void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
+static void legacy_gid_to_sid(struct dom_sid *psid, gid_t gid)
 {
         bool ret;
@@ -1173 +1172 @@
                 goto done;
         }
-        
+
         /* This is an unmapped group */
 
@@ -1190 +1189 @@
 *****************************************************************/  
 
-static bool legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
+static bool legacy_sid_to_uid(const struct dom_sid *psid, uid_t *puid)
 {
         enum lsa_SidType type;
-        uint32 rid;
-
-        if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
+
+        if (sid_check_is_in_our_domain(psid)) {
                 union unid_t id;
                 bool ret;
@@ -1234 +1232 @@
 *****************************************************************/  
 
-static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
-{
-        uint32 rid;
+static bool legacy_sid_to_gid(const struct dom_sid *psid, gid_t *pgid)
+{
         GROUP_MAP map;
         union unid_t id;
@@ -1258 +1255 @@
         }
 
-        if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
+        if (sid_check_is_in_our_domain(psid)) {
                 bool ret;
 
@@ -1276 +1273 @@
                         goto done;
                 }
-        
+
                 /* This was ours, but it was not mapped.  Fail */
         }
@@ -1283 +1280 @@
                   sid_string_dbg(psid)));
         return false;
-        
+
  done:
         DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
@@ -1297 +1294 @@
 *****************************************************************/  
 
-void uid_to_sid(DOM_SID *psid, uid_t uid)
+void uid_to_sid(struct dom_sid *psid, uid_t uid)
 {
         bool expired = true;
@@ -1350 +1347 @@
 *****************************************************************/  
 
-void gid_to_sid(DOM_SID *psid, gid_t gid)
+void gid_to_sid(struct dom_sid *psid, gid_t gid)
 {
         bool expired = true;
@@ -1399 +1396 @@
 }
 
+bool sids_to_unix_ids(const struct dom_sid *sids, uint32_t num_sids,
+                      struct wbcUnixId *ids)
+{
+        struct wbcDomainSid *wbc_sids = NULL;
+        struct wbcUnixId *wbc_ids = NULL;
+        uint32_t i, num_not_cached;
+        wbcErr err;
+        bool ret = false;
+
+        wbc_sids = TALLOC_ARRAY(talloc_tos(), struct wbcDomainSid, num_sids);
+        if (wbc_sids == NULL) {
+                return false;
+        }
+
+        num_not_cached = 0;
+
+        for (i=0; i<num_sids; i++) {
+                bool expired;
+                uint32_t rid;
+
+                if (fetch_uid_from_cache(&ids[i].id.uid, &sids[i])) {
+                        ids[i].type = WBC_ID_TYPE_UID;
+                        continue;
+                }
+                if (fetch_gid_from_cache(&ids[i].id.gid, &sids[i])) {
+                        ids[i].type = WBC_ID_TYPE_GID;
+                        continue;
+                }
+                if (sid_peek_check_rid(&global_sid_Unix_Users,
+                                       &sids[i], &rid)) {
+                        ids[i].type = WBC_ID_TYPE_UID;
+                        ids[i].id.uid = rid;
+                        continue;
+                }
+                if (sid_peek_check_rid(&global_sid_Unix_Groups,
+                                       &sids[i], &rid)) {
+                        ids[i].type = WBC_ID_TYPE_GID;
+                        ids[i].id.gid = rid;
+                        continue;
+                }
+                if (idmap_cache_find_sid2uid(&sids[i], &ids[i].id.uid,
+                                             &expired)
+                    && !expired) {
+                        ids[i].type = WBC_ID_TYPE_UID;
+                        continue;
+                }
+                if (idmap_cache_find_sid2gid(&sids[i], &ids[i].id.gid,
+                                             &expired)
+                    && !expired) {
+                        ids[i].type = WBC_ID_TYPE_GID;
+                        continue;
+                }
+                ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+                memcpy(&wbc_sids[num_not_cached], &sids[i],
+                       ndr_size_dom_sid(&sids[i], 0));
+                num_not_cached += 1;
+        }
+        if (num_not_cached == 0) {
+                goto done;
+        }
+        wbc_ids = TALLOC_ARRAY(talloc_tos(), struct wbcUnixId, num_not_cached);
+        if (wbc_ids == NULL) {
+                goto fail;
+        }
+        for (i=0; i<num_not_cached; i++) {
+                wbc_ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+        }
+        err = wbcSidsToUnixIds(wbc_sids, num_not_cached, wbc_ids);
+        if (!WBC_ERROR_IS_OK(err)) {
+                DEBUG(10, ("wbcSidsToUnixIds returned %s\n",
+                           wbcErrorString(err)));
+        }
+
+        num_not_cached = 0;
+
+        for (i=0; i<num_sids; i++) {
+                if (ids[i].type == WBC_ID_TYPE_NOT_SPECIFIED) {
+                        ids[i] = wbc_ids[num_not_cached];
+                        num_not_cached += 1;
+                }
+        }
+
+        for (i=0; i<num_sids; i++) {
+                if (ids[i].type != WBC_ID_TYPE_NOT_SPECIFIED) {
+                        continue;
+                }
+                if (legacy_sid_to_gid(&sids[i], &ids[i].id.gid)) {
+                        ids[i].type = WBC_ID_TYPE_GID;
+                        continue;
+                }
+                if (legacy_sid_to_uid(&sids[i], &ids[i].id.uid)) {
+                        ids[i].type = WBC_ID_TYPE_UID;
+                        continue;
+                }
+        }
+done:
+        ret = true;
+fail:
+        TALLOC_FREE(wbc_ids);
+        TALLOC_FREE(wbc_sids);
+        return ret;
+}
+
 /*****************************************************************
  *THE CANONICAL* convert SID to uid function.
 *****************************************************************/  
 
-bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
+bool sid_to_uid(const struct dom_sid *psid, uid_t *puid)
 {
         bool expired = true;
@@ -1465 +1565 @@
 *****************************************************************/  
 
-bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+bool sid_to_gid(const struct dom_sid *psid, gid_t *pgid)
 {
         bool expired = true;
@@ -1521 +1621 @@
         return true;
 }
+
+/**
+ * @brief This function gets the primary group SID mapping the primary
+ *        GID of the user as obtained by an actual getpwnam() call.
+ *        This is necessary to avoid issues with arbitrary group SIDs
+ *        stored in passdb. We try as hard as we can to get the SID
+ *        corresponding to the GID, including trying group mapping.
+ *        If nothing else works, we will force "Domain Users" as the
+ *        primary group.
+ *        This is needed because we must always be able to lookup the
+ *        primary group SID, so we cannot settle for an arbitrary SID.
+ *
+ *        This call can be expensive. Use with moderation.
+ *        If you have a "samu" struct around use pdb_get_group_sid()
+ *        instead as it does properly cache results.
+ *
+ * @param mem_ctx[in]     The memory context iused to allocate the result.
+ * @param username[in]    The user's name
+ * @param _pwd[in|out]    If available, pass in user's passwd struct.
+ *                        It will contain a tallocated passwd if NULL was
+ *                        passed in.
+ * @param _group_sid[out] The user's Primary Group SID
+ *
+ * @return NTSTATUS error code.
+ */
+NTSTATUS get_primary_group_sid(TALLOC_CTX *mem_ctx,
+                                const char *username,
+                                struct passwd **_pwd,
+                                struct dom_sid **_group_sid)
+{
+        TALLOC_CTX *tmp_ctx;
+        bool need_lookup_sid = false;
+        struct dom_sid *group_sid;
+        struct passwd *pwd = *_pwd;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!pwd) {
+                pwd = Get_Pwnam_alloc(mem_ctx, username);
+                if (!pwd) {
+                        DEBUG(0, ("Failed to find a Unix account for %s",
+                                  username));
+                        TALLOC_FREE(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+        }
+
+        group_sid = talloc_zero(mem_ctx, struct dom_sid);
+        if (!group_sid) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        gid_to_sid(group_sid, pwd->pw_gid);
+        if (!is_null_sid(group_sid)) {
+                struct dom_sid domain_sid;
+                uint32_t rid;
+
+                /* We need a sid within our domain */
+                sid_copy(&domain_sid, group_sid);
+                sid_split_rid(&domain_sid, &rid);
+                if (dom_sid_equal(&domain_sid, get_global_sam_sid())) {
+                        /*
+                         * As shortcut for the expensive lookup_sid call
+                         * compare the domain sid part
+                         */
+                        switch (rid) {
+                        case DOMAIN_RID_ADMINS:
+                        case DOMAIN_RID_USERS:
+                                goto done;
+                        default:
+                                need_lookup_sid = true;
+                                break;
+                        }
+                } else {
+                        /* Try group mapping */
+                        ZERO_STRUCTP(group_sid);
+                        if (pdb_gid_to_sid(pwd->pw_gid, group_sid)) {
+                                need_lookup_sid = true;
+                        }
+                }
+        }
+
+        /* We must verify that this is a valid SID that resolves to a
+         * group of the correct type */
+        if (need_lookup_sid) {
+                enum lsa_SidType type = SID_NAME_UNKNOWN;
+                bool lookup_ret;
+
+                DEBUG(10, ("do lookup_sid(%s) for group of user %s\n",
+                           sid_string_dbg(group_sid), username));
+
+                /* Now check that it's actually a domain group and
+                 * not something else */
+                lookup_ret = lookup_sid(tmp_ctx, group_sid,
+                                        NULL, NULL, &type);
+
+                if (lookup_ret && (type == SID_NAME_DOM_GRP)) {
+                        goto done;
+                }
+
+                DEBUG(3, ("Primary group %s for user %s is"
+                          " a %s and not a domain group\n",
+                          sid_string_dbg(group_sid), username,
+                          sid_type_lookup(type)));
+        }
+
+        /* Everything else, failed.
+         * Just set it to the 'Domain Users' RID of 513 which will
+           always resolve to a name */
+        DEBUG(3, ("Forcing Primary Group to 'Domain Users' for %s\n",
+                  username));
+
+        sid_compose(group_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
+
+done:
+        *_pwd = talloc_move(mem_ctx, &pwd);
+        *_group_sid = talloc_move(mem_ctx, &group_sid);
+        TALLOC_FREE(tmp_ctx);
+        return NT_STATUS_OK;
+}
+
+bool delete_uid_cache(uid_t puid)
+{
+        DATA_BLOB uid = data_blob_const(&puid, sizeof(puid));
+        DATA_BLOB sid;
+
+        if (!memcache_lookup(NULL, UID_SID_CACHE, uid, &sid)) {
+                DEBUG(3, ("UID %d is not memcached!\n", (int)puid));
+                return false;
+        }
+        DEBUG(3, ("Delete mapping UID %d <-> %s from memcache\n", (int)puid,
+                  sid_string_dbg((struct dom_sid*)sid.data)));
+        memcache_delete(NULL, SID_UID_CACHE, sid);
+        memcache_delete(NULL, UID_SID_CACHE, uid);
+        return true;
+}
+
+bool delete_gid_cache(gid_t pgid)
+{
+        DATA_BLOB gid = data_blob_const(&pgid, sizeof(pgid));
+        DATA_BLOB sid;
+        if (!memcache_lookup(NULL, GID_SID_CACHE, gid, &sid)) {
+                DEBUG(3, ("GID %d is not memcached!\n", (int)pgid));
+                return false;
+        }
+        DEBUG(3, ("Delete mapping GID %d <-> %s from memcache\n", (int)pgid,
+                  sid_string_dbg((struct dom_sid*)sid.data)));
+        memcache_delete(NULL, SID_GID_CACHE, sid);
+        memcache_delete(NULL, GID_SID_CACHE, gid);
+        return true;
+}
+
+bool delete_sid_cache(const struct dom_sid* psid)
+{
+        DATA_BLOB sid = data_blob_const(psid, ndr_size_dom_sid(psid, 0));
+        DATA_BLOB id;
+        if (memcache_lookup(NULL, SID_GID_CACHE, sid, &id)) {
+                DEBUG(3, ("Delete mapping %s <-> GID %d from memcache\n",
+                          sid_string_dbg(psid), *(int*)id.data));
+                memcache_delete(NULL, SID_GID_CACHE, sid);
+                memcache_delete(NULL, GID_SID_CACHE, id);
+        } else if (memcache_lookup(NULL, SID_UID_CACHE, sid, &id)) {
+                DEBUG(3, ("Delete mapping %s <-> UID %d from memcache\n",
+                          sid_string_dbg(psid), *(int*)id.data));
+                memcache_delete(NULL, SID_UID_CACHE, sid);
+                memcache_delete(NULL, UID_SID_CACHE, id);
+        } else {
+                DEBUG(3, ("SID %s is not memcached!\n", sid_string_dbg(psid)));
+                return false;
+        }
+        return true;
+}
+
+void flush_gid_cache(void)
+{
+        DEBUG(3, ("Flush GID <-> SID memcache\n"));
+        memcache_flush(NULL, SID_GID_CACHE);
+        memcache_flush(NULL, GID_SID_CACHE);
+}
+
+void flush_uid_cache(void)
+{
+        DEBUG(3, ("Flush UID <-> SID memcache\n"));
+        memcache_flush(NULL, SID_UID_CACHE);
+        memcache_flush(NULL, UID_SID_CACHE);
+}

trunk/server/source3/passdb/machine_sid.c

@@ -6 +6 @@
    Copyright (C) Gerald (Jerry) Carter          2000
    Copyright (C) Stefan (metze) Metzmacher      2002
-      
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -22 +22 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "secrets.h"
+#include "dbwrap.h"
+#include "../libcli/security/security.h"
 
 /* NOTE! the global_sam_sid is the SID of our local SAM. This is only
    equal to the domain SID when we are a DC, otherwise its our
    workstation SID */
-static DOM_SID *global_sam_sid=NULL;
+static struct dom_sid *global_sam_sid=NULL;
 
 #undef DBGC_CLASS
@@ -36 +40 @@
 ****************************************************************************/
 
-static bool read_sid_from_file(const char *fname, DOM_SID *sid)
+static bool read_sid_from_file(const char *fname, struct dom_sid *sid)
 {
         char **lines;
@@ -43 +47 @@
 
         lines = file_lines_load(fname, &numlines,0, NULL);
-        
+
         if (!lines || numlines < 1) {
-                if (lines) TALLOC_FREE(lines);
+                TALLOC_FREE(lines);
                 return False;
         }
-        
+
         ret = string_to_sid(sid, lines[0]);
         TALLOC_FREE(lines);
@@ -57 +61 @@
   generate a random sid - used to build our own sid if we don't have one
 */
-static void generate_random_sid(DOM_SID *sid)
+static void generate_random_sid(struct dom_sid *sid)
 {
         int i;
         uchar raw_sid_data[12];
 
-        memset((char *)sid, '\0', sizeof(*sid));
+        ZERO_STRUCTP(sid);
+
         sid->sid_rev_num = 1;
         sid->id_auth[5] = 5;
@@ -77 +82 @@
 ****************************************************************************/
 
-static DOM_SID *pdb_generate_sam_sid(void)
-{
-        DOM_SID domain_sid;
+static struct dom_sid *pdb_generate_sam_sid(void)
+{
+        struct dom_sid domain_sid;
         char *fname = NULL;
-        DOM_SID *sam_sid;
-        
-        if(!(sam_sid=SMB_MALLOC_P(DOM_SID)))
+        struct dom_sid *sam_sid;
+
+        if(!(sam_sid=SMB_MALLOC_P(struct dom_sid)))
                 return NULL;
 
@@ -111 +116 @@
                 }
 
-                if (!sid_equal(&domain_sid, sam_sid)) {
+                if (!dom_sid_equal(&domain_sid, sam_sid)) {
 
                         /* Domain name sid doesn't match global sam sid. Re-store domain sid as 'local' sid. */
@@ -125 +130 @@
 
                 return sam_sid;
-                
         }
 
@@ -180 +184 @@
 
 /* return our global_sam_sid */
-DOM_SID *get_global_sam_sid(void)
+struct dom_sid *get_global_sam_sid(void)
 {
         struct db_context *db;
@@ -186 +190 @@
         if (global_sam_sid != NULL)
                 return global_sam_sid;
-        
+
         /*
          * memory for global_sam_sid is allocated in
@@ -229 +233 @@
 *****************************************************************/  
 
-bool sid_check_is_domain(const DOM_SID *sid)
-{
-        return sid_equal(sid, get_global_sam_sid());
+bool sid_check_is_domain(const struct dom_sid *sid)
+{
+        return dom_sid_equal(sid, get_global_sam_sid());
 }
 
@@ -238 +242 @@
 *****************************************************************/  
 
-bool sid_check_is_in_our_domain(const DOM_SID *sid)
-{
-        DOM_SID dom_sid;
-        uint32 rid;
+bool sid_check_is_in_our_domain(const struct dom_sid *sid)
+{
+        struct dom_sid dom_sid;
 
         sid_copy(&dom_sid, sid);
-        sid_split_rid(&dom_sid, &rid);
+        sid_split_rid(&dom_sid, NULL);
         return sid_check_is_domain(&dom_sid);
 }

trunk/server/source3/passdb/passdb.c

@@ -24 +24 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "system/passwd.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "secrets.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/util_pw.h"
+#include "util_tdb.h"
 
 #undef DBGC_CLASS
@@ -146 +152 @@
         const char *domain = global_myname();
         char *fullname;
-        uint32 urid;
+        uint32_t urid;
 
         if ( !pwd ) {
@@ -194 +200 @@
 
         if ( strequal( pwd->pw_name, guest_account ) ) {
-                if ( !pdb_set_user_sid_from_rid(user, DOMAIN_USER_RID_GUEST, PDB_DEFAULT)) {
+                if ( !pdb_set_user_sid_from_rid(user, DOMAIN_RID_GUEST, PDB_DEFAULT)) {
                         return NT_STATUS_NO_SUCH_USER;
                 }
@@ -242 +248 @@
 
         if ( create && (pdb_capabilities() & PDB_CAP_STORE_RIDS)) {
-                uint32 user_rid;
-                DOM_SID user_sid;
+                uint32_t user_rid;
+                struct dom_sid user_sid;
 
                 if ( !pdb_new_rid( &user_rid ) ) {
@@ -250 +256 @@
                 }
 
-                sid_copy( &user_sid, get_global_sam_sid() );
-                sid_append_rid( &user_sid, user_rid );
+                sid_compose(&user_sid, get_global_sam_sid(), user_rid);
 
                 if ( !pdb_set_user_sid(user, &user_sid, PDB_SET) ) {
@@ -373 +378 @@
 **************************************************************/
 
-void pdb_sethexpwd(char p[33], const unsigned char *pwd, uint32 acct_ctrl)
+void pdb_sethexpwd(char p[33], const unsigned char *pwd, uint32_t acct_ctrl)
 {
         if (pwd != NULL) {
@@ -403 +408 @@
 
         for (i = 0; i < 32; i += 2) {
-                hinybble = toupper_ascii(p[i]);
-                lonybble = toupper_ascii(p[i + 1]);
+                hinybble = toupper_m(p[i]);
+                lonybble = toupper_m(p[i + 1]);
 
                 p1 = strchr(hexchars, hinybble);
@@ -453 +458 @@
 
         for (i = 0; i < 42; i += 2) {
-                hinybble = toupper_ascii(p[i]);
-                lonybble = toupper_ascii(p[i + 1]);
+                hinybble = toupper_m(p[i]);
+                lonybble = toupper_m(p[i + 1]);
 
                 p1 = strchr(hexchars, hinybble);
@@ -497 +502 @@
  ********************************************************************/
 
-uid_t algorithmic_pdb_user_rid_to_uid(uint32 user_rid)
+uid_t algorithmic_pdb_user_rid_to_uid(uint32_t user_rid)
 {
         int rid_offset = algorithmic_rid_base();
@@ -512 +517 @@
  ********************************************************************/
 
-uint32 algorithmic_pdb_uid_to_user_rid(uid_t uid)
+uint32_t algorithmic_pdb_uid_to_user_rid(uid_t uid)
 {
         int rid_offset = algorithmic_rid_base();
-        return (((((uint32)uid)*RID_MULTIPLIER) + rid_offset) | USER_RID_TYPE);
+        return (((((uint32_t)uid)*RID_MULTIPLIER) + rid_offset) | USER_RID_TYPE);
 }
 
@@ -522 +527 @@
  ********************************************************************/
 
-gid_t pdb_group_rid_to_gid(uint32 group_rid)
+gid_t pdb_group_rid_to_gid(uint32_t group_rid)
 {
         int rid_offset = algorithmic_rid_base();
@@ -541 +546 @@
  ********************************************************************/
 
-uint32 algorithmic_pdb_gid_to_group_rid(gid_t gid)
+uint32_t algorithmic_pdb_gid_to_group_rid(gid_t gid)
 {
         int rid_offset = algorithmic_rid_base();
-        return (((((uint32)gid)*RID_MULTIPLIER) + rid_offset) | GROUP_RID_TYPE);
+        return (((((uint32_t)gid)*RID_MULTIPLIER) + rid_offset) | GROUP_RID_TYPE);
 }
 
@@ -551 +556 @@
  ********************************************************************/
 
-static bool rid_is_well_known(uint32 rid)
+static bool rid_is_well_known(uint32_t rid)
 {
         /* Not using rid_offset here, because this is the actual
@@ -563 +568 @@
  ********************************************************************/
 
-bool algorithmic_pdb_rid_is_user(uint32 rid)
+bool algorithmic_pdb_rid_is_user(uint32_t rid)
 {
         if ( rid_is_well_known(rid) ) {
                 /*
-                 * The only well known user RIDs are DOMAIN_USER_RID_ADMIN
-                 * and DOMAIN_USER_RID_GUEST.
+                 * The only well known user RIDs are DOMAIN_RID_ADMINISTRATOR
+                 * and DOMAIN_RID_GUEST.
                  */
-                if(rid == DOMAIN_USER_RID_ADMIN || rid == DOMAIN_USER_RID_GUEST)
+                if(rid == DOMAIN_RID_ADMINISTRATOR || rid == DOMAIN_RID_GUEST)
                         return True;
         } else if((rid & RID_TYPE_MASK) == USER_RID_TYPE) {
@@ -594 +599 @@
 
         if ( strequal( name, "None" ) ) {
-                *rid = DOMAIN_GROUP_RID_USERS;
+                *rid = DOMAIN_RID_USERS;
                 *type = SID_NAME_DOM_GRP;
 
@@ -606 +611 @@
         if ((flags & LOOKUP_NAME_GROUP) == 0) {
                 struct samu *sam_account = NULL;
-                DOM_SID user_sid;
+                struct dom_sid user_sid;
 
                 if ( !(sam_account = samu_new( NULL )) ) {
@@ -927 +932 @@
 *********************************************************************/
 
-static bool init_samu_from_buffer_v0(struct samu *sampass, uint8 *buf, uint32 buflen)
+static bool init_samu_from_buffer_v0(struct samu *sampass, uint8_t *buf, uint32_t buflen)
 {
 
@@ -933 +938 @@
            take care on system with 64bit wide time_t
            --SSS */
-        uint32  logon_time,
+        uint32_t        logon_time,
                 logoff_time,
                 kickoff_time,
@@ -951 +956 @@
         char *acct_desc = NULL;
         char *workstations = NULL;
-        uint32  username_len, domain_len, nt_username_len,
+        uint32_t        username_len, domain_len, nt_username_len,
                 dir_drive_len, unknown_str_len, munged_dial_len,
                 fullname_len, homedir_len, logon_script_len,
                 profile_path_len, acct_desc_len, workstations_len;
 
-        uint32  user_rid, group_rid, remove_me, hours_len, unknown_6;
-        uint16  acct_ctrl, logon_divs;
-        uint16  bad_password_count, logon_count;
-        uint8   *hours = NULL;
-        uint8   *lm_pw_ptr = NULL, *nt_pw_ptr = NULL;
-        uint32          len = 0;
-        uint32          lm_pw_len, nt_pw_len, hourslen;
+        uint32_t        user_rid, group_rid, remove_me, hours_len, unknown_6;
+        uint16_t        acct_ctrl, logon_divs;
+        uint16_t        bad_password_count, logon_count;
+        uint8_t *hours = NULL;
+        uint8_t *lm_pw_ptr = NULL, *nt_pw_ptr = NULL;
+        uint32_t                len = 0;
+        uint32_t                lm_pw_len, nt_pw_len, hourslen;
         bool ret = True;
 
@@ -1005 +1010 @@
                 &unknown_6);                                            /* d */
 
-        if (len == (uint32) -1)  {
+        if (len == (uint32_t) -1)  {
                 ret = False;
                 goto done;
@@ -1086 +1091 @@
         pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
         pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
-        pdb_set_hours(sampass, hours, PDB_SET);
+        pdb_set_hours(sampass, hours, hours_len, PDB_SET);
 
 done:
@@ -1112 +1117 @@
 *********************************************************************/
 
-static bool init_samu_from_buffer_v1(struct samu *sampass, uint8 *buf, uint32 buflen)
+static bool init_samu_from_buffer_v1(struct samu *sampass, uint8_t *buf, uint32_t buflen)
 {
 
@@ -1118 +1123 @@
            take care on system with 64bit wide time_t
            --SSS */
-        uint32  logon_time,
+        uint32_t        logon_time,
                 logoff_time,
                 kickoff_time,
@@ -1137 +1142 @@
         char *acct_desc = NULL;
         char *workstations = NULL;
-        uint32  username_len, domain_len, nt_username_len,
+        uint32_t        username_len, domain_len, nt_username_len,
                 dir_drive_len, unknown_str_len, munged_dial_len,
                 fullname_len, homedir_len, logon_script_len,
                 profile_path_len, acct_desc_len, workstations_len;
 
-        uint32  user_rid, group_rid, remove_me, hours_len, unknown_6;
-        uint16  acct_ctrl, logon_divs;
-        uint16  bad_password_count, logon_count;
-        uint8   *hours = NULL;
-        uint8   *lm_pw_ptr = NULL, *nt_pw_ptr = NULL;
-        uint32          len = 0;
-        uint32          lm_pw_len, nt_pw_len, hourslen;
+        uint32_t        user_rid, group_rid, remove_me, hours_len, unknown_6;
+        uint16_t        acct_ctrl, logon_divs;
+        uint16_t        bad_password_count, logon_count;
+        uint8_t *hours = NULL;
+        uint8_t *lm_pw_ptr = NULL, *nt_pw_ptr = NULL;
+        uint32_t                len = 0;
+        uint32_t                lm_pw_len, nt_pw_len, hourslen;
         bool ret = True;
 
@@ -1193 +1198 @@
                 &unknown_6);                                            /* d */
 
-        if (len == (uint32) -1)  {
+        if (len == (uint32_t) -1)  {
                 ret = False;
                 goto done;
@@ -1278 +1283 @@
         pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
         pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
-        pdb_set_hours(sampass, hours, PDB_SET);
+        pdb_set_hours(sampass, hours, hours_len, PDB_SET);
 
 done:
@@ -1301 +1306 @@
 }
 
-static bool init_samu_from_buffer_v2(struct samu *sampass, uint8 *buf, uint32 buflen)
+static bool init_samu_from_buffer_v2(struct samu *sampass, uint8_t *buf, uint32_t buflen)
 {
 
@@ -1307 +1312 @@
            take care on system with 64bit wide time_t
            --SSS */
-        uint32  logon_time,
+        uint32_t        logon_time,
                 logoff_time,
                 kickoff_time,
@@ -1326 +1331 @@
         char *acct_desc = NULL;
         char *workstations = NULL;
-        uint32  username_len, domain_len, nt_username_len,
+        uint32_t        username_len, domain_len, nt_username_len,
                 dir_drive_len, unknown_str_len, munged_dial_len,
                 fullname_len, homedir_len, logon_script_len,
                 profile_path_len, acct_desc_len, workstations_len;
 
-        uint32  user_rid, group_rid, hours_len, unknown_6;
-        uint16  acct_ctrl, logon_divs;
-        uint16  bad_password_count, logon_count;
-        uint8   *hours = NULL;
-        uint8   *lm_pw_ptr = NULL, *nt_pw_ptr = NULL, *nt_pw_hist_ptr = NULL;
-        uint32          len = 0;
-        uint32          lm_pw_len, nt_pw_len, nt_pw_hist_len, hourslen;
-        uint32 pwHistLen = 0;
+        uint32_t        user_rid, group_rid, hours_len, unknown_6;
+        uint16_t        acct_ctrl, logon_divs;
+        uint16_t        bad_password_count, logon_count;
+        uint8_t *hours = NULL;
+        uint8_t *lm_pw_ptr = NULL, *nt_pw_ptr = NULL, *nt_pw_hist_ptr = NULL;
+        uint32_t                len = 0;
+        uint32_t                lm_pw_len, nt_pw_len, nt_pw_hist_len, hourslen;
+        uint32_t pwHistLen = 0;
         bool ret = True;
         fstring tmp_string;
@@ -1386 +1391 @@
                 &unknown_6);                                            /* d */
 
-        if (len == (uint32) -1)  {
+        if (len == (uint32_t) -1)  {
                 ret = False;
                 goto done;
@@ -1475 +1480 @@
         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
         if (pwHistLen) {
-                uint8 *pw_hist = SMB_MALLOC_ARRAY(uint8, pwHistLen * PW_HISTORY_ENTRY_LEN);
+                uint8_t *pw_hist = SMB_MALLOC_ARRAY(uint8_t, pwHistLen * PW_HISTORY_ENTRY_LEN);
                 if (!pw_hist) {
                         ret = False;
@@ -1509 +1514 @@
         pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
         pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
-        pdb_set_hours(sampass, hours, PDB_SET);
+        pdb_set_hours(sampass, hours, hours_len, PDB_SET);
 
 done:
@@ -1536 +1541 @@
 *********************************************************************/
 
-static bool init_samu_from_buffer_v3(struct samu *sampass, uint8 *buf, uint32 buflen)
+static bool init_samu_from_buffer_v3(struct samu *sampass, uint8_t *buf, uint32_t buflen)
 {
 
@@ -1542 +1547 @@
            take care on system with 64bit wide time_t
            --SSS */
-        uint32  logon_time,
+        uint32_t        logon_time,
                 logoff_time,
                 kickoff_time,
@@ -1561 +1566 @@
         char *acct_desc = NULL;
         char *workstations = NULL;
-        uint32  username_len, domain_len, nt_username_len,
+        uint32_t        username_len, domain_len, nt_username_len,
                 dir_drive_len, comment_len, munged_dial_len,
                 fullname_len, homedir_len, logon_script_len,
                 profile_path_len, acct_desc_len, workstations_len;
 
-        uint32  user_rid, group_rid, hours_len, unknown_6, acct_ctrl;
-        uint16  logon_divs;
-        uint16  bad_password_count, logon_count;
-        uint8   *hours = NULL;
-        uint8   *lm_pw_ptr = NULL, *nt_pw_ptr = NULL, *nt_pw_hist_ptr = NULL;
-        uint32          len = 0;
-        uint32          lm_pw_len, nt_pw_len, nt_pw_hist_len, hourslen;
-        uint32 pwHistLen = 0;
+        uint32_t        user_rid, group_rid, hours_len, unknown_6, acct_ctrl;
+        uint16_t  logon_divs;
+        uint16_t        bad_password_count, logon_count;
+        uint8_t *hours = NULL;
+        uint8_t *lm_pw_ptr = NULL, *nt_pw_ptr = NULL, *nt_pw_hist_ptr = NULL;
+        uint32_t                len = 0;
+        uint32_t                lm_pw_len, nt_pw_len, nt_pw_hist_len, hourslen;
+        uint32_t pwHistLen = 0;
         bool ret = True;
         fstring tmp_string;
@@ -1612 +1617 @@
                 /* Change from V1 is addition of password history field. */
                 &nt_pw_hist_len, &nt_pw_hist_ptr,                       /* B */
-                /* Change from V2 is the uint32 acb_mask */
+                /* Change from V2 is the uint32_t acb_mask */
                 &acct_ctrl,                                             /* d */
                 /* Also "remove_me" field was removed. */
@@ -1622 +1627 @@
                 &unknown_6);                                            /* d */
 
-        if (len == (uint32) -1)  {
+        if (len == (uint32_t) -1)  {
                 ret = False;
                 goto done;
         }
 
-        pdb_set_logon_time(sampass, convert_uint32_to_time_t(logon_time), PDB_SET);
-        pdb_set_logoff_time(sampass, convert_uint32_to_time_t(logoff_time), PDB_SET);
-        pdb_set_kickoff_time(sampass, convert_uint32_to_time_t(kickoff_time), PDB_SET);
-        pdb_set_bad_password_time(sampass, convert_uint32_to_time_t(bad_password_time), PDB_SET);
-        pdb_set_pass_can_change_time(sampass, convert_uint32_to_time_t(pass_can_change_time), PDB_SET);
-        pdb_set_pass_must_change_time(sampass, convert_uint32_to_time_t(pass_must_change_time), PDB_SET);
-        pdb_set_pass_last_set_time(sampass, convert_uint32_to_time_t(pass_last_set_time), PDB_SET);
+        pdb_set_logon_time(sampass, convert_uint32_t_to_time_t(logon_time), PDB_SET);
+        pdb_set_logoff_time(sampass, convert_uint32_t_to_time_t(logoff_time), PDB_SET);
+        pdb_set_kickoff_time(sampass, convert_uint32_t_to_time_t(kickoff_time), PDB_SET);
+        pdb_set_bad_password_time(sampass, convert_uint32_t_to_time_t(bad_password_time), PDB_SET);
+        pdb_set_pass_can_change_time(sampass, convert_uint32_t_to_time_t(pass_can_change_time), PDB_SET);
+        pdb_set_pass_must_change_time(sampass, convert_uint32_t_to_time_t(pass_must_change_time), PDB_SET);
+        pdb_set_pass_last_set_time(sampass, convert_uint32_t_to_time_t(pass_last_set_time), PDB_SET);
 
         pdb_set_username(sampass, username, PDB_SET); 
@@ -1710 +1715 @@
         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
         if (pwHistLen) {
-                uint8 *pw_hist = (uint8 *)SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN);
+                uint8_t *pw_hist = (uint8_t *)SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN);
                 if (!pw_hist) {
                         ret = False;
@@ -1741 +1746 @@
         pdb_set_logon_count(sampass, logon_count, PDB_SET);
         pdb_set_unknown_6(sampass, unknown_6, PDB_SET);
-        /* Change from V2 is the uint32 acct_ctrl */
+        /* Change from V2 is the uint32_t acct_ctrl */
         pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
         pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
-        pdb_set_hours(sampass, hours, PDB_SET);
+        pdb_set_hours(sampass, hours, hours_len, PDB_SET);
 
 done:
@@ -1771 +1776 @@
 *********************************************************************/
 
-static uint32 init_buffer_from_samu_v3 (uint8 **buf, struct samu *sampass, bool size_only)
+static uint32_t init_buffer_from_samu_v3 (uint8_t **buf, struct samu *sampass, bool size_only)
 {
         size_t len, buflen;
@@ -1778 +1783 @@
            take care on system with 64bit wide time_t
            --SSS */
-        uint32  logon_time,
+        uint32_t        logon_time,
                 logoff_time,
                 kickoff_time,
@@ -1786 +1791 @@
                 pass_must_change_time;
 
-        uint32  user_rid, group_rid;
+        uint32_t  user_rid, group_rid;
 
         const char *username;
@@ -1800 +1805 @@
         const char *acct_desc;
         const char *workstations;
-        uint32  username_len, domain_len, nt_username_len,
+        uint32_t        username_len, domain_len, nt_username_len,
                 dir_drive_len, comment_len, munged_dial_len,
                 fullname_len, homedir_len, logon_script_len,
                 profile_path_len, acct_desc_len, workstations_len;
 
-        const uint8 *lm_pw;
-        const uint8 *nt_pw;
-        const uint8 *nt_pw_hist;
-        uint32  lm_pw_len = 16;
-        uint32  nt_pw_len = 16;
-        uint32  nt_pw_hist_len;
-        uint32 pwHistLen = 0;
+        const uint8_t *lm_pw;
+        const uint8_t *nt_pw;
+        const uint8_t *nt_pw_hist;
+        uint32_t        lm_pw_len = 16;
+        uint32_t        nt_pw_len = 16;
+        uint32_t  nt_pw_hist_len;
+        uint32_t pwHistLen = 0;
 
         *buf = NULL;
         buflen = 0;
 
-        logon_time = convert_time_t_to_uint32(pdb_get_logon_time(sampass));
-        logoff_time = convert_time_t_to_uint32(pdb_get_logoff_time(sampass));
-        kickoff_time = convert_time_t_to_uint32(pdb_get_kickoff_time(sampass));
-        bad_password_time = convert_time_t_to_uint32(pdb_get_bad_password_time(sampass));
-        pass_can_change_time = convert_time_t_to_uint32(pdb_get_pass_can_change_time_noncalc(sampass));
-        pass_must_change_time = convert_time_t_to_uint32(pdb_get_pass_must_change_time(sampass));
-        pass_last_set_time = convert_time_t_to_uint32(pdb_get_pass_last_set_time(sampass));
+        logon_time = convert_time_t_to_uint32_t(pdb_get_logon_time(sampass));
+        logoff_time = convert_time_t_to_uint32_t(pdb_get_logoff_time(sampass));
+        kickoff_time = convert_time_t_to_uint32_t(pdb_get_kickoff_time(sampass));
+        bad_password_time = convert_time_t_to_uint32_t(pdb_get_bad_password_time(sampass));
+        pass_can_change_time = convert_time_t_to_uint32_t(pdb_get_pass_can_change_time_noncalc(sampass));
+        pass_must_change_time = convert_time_t_to_uint32_t(pdb_get_pass_must_change_time(sampass));
+        pass_last_set_time = convert_time_t_to_uint32_t(pdb_get_pass_last_set_time(sampass));
 
         user_rid = pdb_get_user_rid(sampass);
@@ -1990 +1995 @@
 
         /* malloc the space needed */
-        if ( (*buf=(uint8*)SMB_MALLOC(len)) == NULL) {
+        if ( (*buf=(uint8_t*)SMB_MALLOC(len)) == NULL) {
                 DEBUG(0,("init_buffer_from_samu_v3: Unable to malloc() memory for buffer!\n"));
                 return (-1);
@@ -2041 +2046 @@
 }
 
-static bool init_samu_from_buffer_v4(struct samu *sampass, uint8 *buf, uint32 buflen)
+static bool init_samu_from_buffer_v4(struct samu *sampass, uint8_t *buf, uint32_t buflen)
 {
         /* nothing changed between V3 and V4 */
@@ -2047 +2052 @@
 }
 
-static uint32 init_buffer_from_samu_v4(uint8 **buf, struct samu *sampass, bool size_only)
+static uint32_t init_buffer_from_samu_v4(uint8_t **buf, struct samu *sampass, bool size_only)
 {
         /* nothing changed between V3 and V4 */
@@ -2058 +2063 @@
 
 bool init_samu_from_buffer(struct samu *sampass, uint32_t level,
-                           uint8 *buf, uint32 buflen)
+                           uint8_t *buf, uint32_t buflen)
 {
         switch (level) {
@@ -2080 +2085 @@
  *********************************************************************/
 
-uint32 init_buffer_from_samu (uint8 **buf, struct samu *sampass, bool size_only)
+uint32_t init_buffer_from_samu (uint8_t **buf, struct samu *sampass, bool size_only)
 {
         return init_buffer_from_samu_v4(buf, sampass, size_only);
@@ -2090 +2095 @@
 bool pdb_copy_sam_account(struct samu *dst, struct samu *src )
 {
-        uint8 *buf = NULL;
+        uint8_t *buf = NULL;
         int len;
 
@@ -2129 +2134 @@
 {
         time_t LastBadPassword;
-        uint16 BadPasswordCount;
-        uint32 resettime; 
+        uint16_t BadPasswordCount;
+        uint32_t resettime;
         bool res;
 
@@ -2149 +2154 @@
 
         /* First, check if there is a reset time to compare */
-        if ((resettime == (uint32) -1) || (resettime == 0)) {
+        if ((resettime == (uint32_t) -1) || (resettime == 0)) {
                 DEBUG(9, ("No reset time, can't reset bad pw count\n"));
                 return True;
@@ -2156 +2161 @@
         LastBadPassword = pdb_get_bad_password_time(sampass);
         DEBUG(7, ("LastBadPassword=%d, resettime=%d, current time=%d.\n", 
-                   (uint32) LastBadPassword, resettime, (uint32)time(NULL)));
-        if (time(NULL) > (LastBadPassword + convert_uint32_to_time_t(resettime)*60)){
+                   (uint32_t) LastBadPassword, resettime, (uint32_t)time(NULL)));
+        if (time(NULL) > (LastBadPassword + convert_uint32_t_to_time_t(resettime)*60)){
                 pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
                 pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
@@ -2174 +2179 @@
 bool pdb_update_autolock_flag(struct samu *sampass, bool *updated)
 {
-        uint32 duration;
+        uint32_t duration;
         time_t LastBadPassword;
         bool res;
@@ -2194 +2199 @@
 
         /* First, check if there is a duration to compare */
-        if ((duration == (uint32) -1)  || (duration == 0)) {
+        if ((duration == (uint32_t) -1)  || (duration == 0)) {
                 DEBUG(9, ("pdb_update_autolock_flag: No reset duration, can't reset autolock\n"));
                 return True;
@@ -2201 +2206 @@
         LastBadPassword = pdb_get_bad_password_time(sampass);
         DEBUG(7, ("pdb_update_autolock_flag: Account %s, LastBadPassword=%d, duration=%d, current time =%d.\n",
-                  pdb_get_username(sampass), (uint32)LastBadPassword, duration*60, (uint32)time(NULL)));
+                  pdb_get_username(sampass), (uint32_t)LastBadPassword, duration*60, (uint32_t)time(NULL)));
 
         if (LastBadPassword == (time_t)0) {
@@ -2211 +2216 @@
         }
 
-        if ((time(NULL) > (LastBadPassword + convert_uint32_to_time_t(duration) * 60))) {
+        if ((time(NULL) > (LastBadPassword + convert_uint32_t_to_time_t(duration) * 60))) {
                 pdb_set_acct_ctrl(sampass,
                                   pdb_get_acct_ctrl(sampass) & ~ACB_AUTOLOCK,
@@ -2231 +2236 @@
 bool pdb_increment_bad_password_count(struct samu *sampass)
 {
-        uint32 account_policy_lockout;
+        uint32_t account_policy_lockout;
         bool autolock_updated = False, badpw_updated = False;
         bool ret;
@@ -2367 +2372 @@
 *******************************************************************/
 
-bool get_trust_pw_hash(const char *domain, uint8 ret_pwd[16],
+bool get_trust_pw_hash(const char *domain, uint8_t ret_pwd[16],
                        const char **account_name,
                        enum netr_SchannelType *channel)
@@ -2399 +2404 @@
         return False;
 }
-
-struct samr_LogonHours get_logon_hours_from_pdb(TALLOC_CTX *mem_ctx,
-                                                struct samu *pw)
-{
-        struct samr_LogonHours hours;
-        const int units_per_week = 168;
-
-        ZERO_STRUCT(hours);
-        hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week);
-        if (!hours.bits) {
-                return hours;
-        }
-
-        hours.units_per_week = units_per_week;
-        memset(hours.bits, 0xFF, units_per_week);
-
-        if (pdb_get_hours(pw)) {
-                memcpy(hours.bits, pdb_get_hours(pw),
-                       MIN(pdb_get_hours_len(pw), units_per_week));
-        }
-
-        return hours;
-}

trunk/server/source3/passdb/pdb_ads.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "tldap.h"
+#include "tldap_util.h"
+#include "../libds/common/flags.h"
+#include "secrets.h"
+#include "../librpc/gen_ndr/samr.h"
+#include "../libcli/ldap/ldap_ndr.h"
+#include "../libcli/security/security.h"
+#include "../libds/common/flag_mapping.h"
 
 struct pdb_ads_state {
@@ -35 +44 @@
 };
 
-static NTSTATUS pdb_ads_getsampwsid(struct pdb_methods *m,
-                                    struct samu *sam_acct,
-                                    const DOM_SID *sid);
 static bool pdb_ads_gid_to_sid(struct pdb_methods *m, gid_t gid,
-                               DOM_SID *sid);
+                               struct dom_sid *sid);
 static bool pdb_ads_dnblob2sid(struct pdb_ads_state *state, DATA_BLOB *dnblob,
                                struct dom_sid *psid);
@@ -64 +70 @@
                 return false;
         }
-        *ptime = uint64s_nt_time_to_unix_abs(&tmp);
+        *ptime = nt_time_to_unix(tmp);
         return true;
 }
@@ -151 +157 @@
         }
 
-        sidstr = sid_binstring(talloc_tos(), pdb_get_user_sid(sam));
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), pdb_get_user_sid(sam));
         if (sidstr == NULL) {
                 return NULL;
@@ -185 +191 @@
         struct dom_sid sid;
         uint64_t n;
+        uint32_t i;
         DATA_BLOB blob;
 
@@ -239 +246 @@
         if (str != NULL) {
                 pdb_set_profile_path(sam, str, PDB_SET);
+        }
+
+        str = tldap_talloc_single_attribute(entry, "comment",
+                                            talloc_tos());
+        if (str != NULL) {
+                pdb_set_comment(sam, str, PDB_SET);
+        }
+
+        str = tldap_talloc_single_attribute(entry, "description",
+                                            talloc_tos());
+        if (str != NULL) {
+                pdb_set_acct_desc(sam, str, PDB_SET);
+        }
+
+        str = tldap_talloc_single_attribute(entry, "userWorkstations",
+                                            talloc_tos());
+        if (str != NULL) {
+                pdb_set_workstations(sam, str, PDB_SET);
+        }
+
+        str = tldap_talloc_single_attribute(entry, "userParameters",
+                                            talloc_tos());
+        if (str != NULL) {
+                pdb_set_munged_dial(sam, str, PDB_SET);
         }
 
@@ -276 +307 @@
 
         }
+
+        if (tldap_pull_uint32(entry, "countryCode", &i)) {
+                pdb_set_country_code(sam, i, PDB_SET);
+        }
+
+        if (tldap_pull_uint32(entry, "codePage", &i)) {
+                pdb_set_code_page(sam, i, PDB_SET);
+        }
+
+        if (tldap_get_single_valueblob(entry, "logonHours", &blob)) {
+
+                if (blob.length > MAX_HOURS_LEN) {
+                        status = NT_STATUS_INVALID_PARAMETER;
+                        goto fail;
+                }
+                pdb_set_logon_divs(sam, blob.length * 8, PDB_SET);
+                pdb_set_hours_len(sam, blob.length, PDB_SET);
+                pdb_set_hours(sam, blob.data, blob.length, PDB_SET);
+
+        } else {
+                uint8_t hours[21];
+                pdb_set_logon_divs(sam, sizeof(hours)/8, PDB_SET);
+                pdb_set_hours_len(sam, sizeof(hours), PDB_SET);
+                memset(hours, 0xff, sizeof(hours));
+                pdb_set_hours(sam, hours, sizeof(hours), PDB_SET);
+        }
+
         status = NT_STATUS_OK;
 fail:
@@ -282 +340 @@
 }
 
+static bool pdb_ads_make_time_mod(struct tldap_message *existing,
+                                  TALLOC_CTX *mem_ctx,
+                                  struct tldap_mod **pmods, int *pnum_mods,
+                                  const char *attrib, time_t t)
+{
+        uint64_t nt_time;
+
+        unix_to_nt_time(&nt_time, t);
+
+        return tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, attrib,
+                "%llu", nt_time);
+}
+
 static bool pdb_ads_init_ads_from_sam(struct pdb_ads_state *state,
                                       struct tldap_message *existing,
                                       TALLOC_CTX *mem_ctx,
-                                      int *pnum_mods, struct tldap_mod **pmods,
+                                      struct tldap_mod **pmods, int *pnum_mods,
                                       struct samu *sam)
 {
         bool ret = true;
         DATA_BLOB blob;
+        const char *pw;
 
         /* TODO: All fields :-) */
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "displayName",
+                existing, mem_ctx, pmods, pnum_mods, "displayName",
                 "%s", pdb_get_fullname(sam));
 
-        blob = data_blob_const(pdb_get_nt_passwd(sam), NT_HASH_LEN);
-        if (blob.data != NULL) {
-                ret &= tldap_add_mod_blobs(mem_ctx, pmods, TLDAP_MOD_REPLACE,
-                                           "unicodePwd", 1, &blob);
-        }
-
-        blob = data_blob_const(pdb_get_lanman_passwd(sam), NT_HASH_LEN);
-        if (blob.data != NULL) {
-                ret &= tldap_add_mod_blobs(mem_ctx, pmods, TLDAP_MOD_REPLACE,
-                                           "dBCSPwd", 1, &blob);
+        pw = pdb_get_plaintext_passwd(sam);
+
+        /*
+         * If we have the plain text pw, this is probably about to be
+         * set. Is this true always?
+         */
+        if (pw != NULL) {
+                char *pw_quote;
+                uint8_t *pw_utf16;
+                size_t pw_utf16_len;
+
+                pw_quote = talloc_asprintf(talloc_tos(), "\"%s\"", pw);
+                if (pw_quote == NULL) {
+                        ret = false;
+                        goto fail;
+                }
+
+                ret &= convert_string_talloc(talloc_tos(),
+                                             CH_UNIX, CH_UTF16LE,
+                                             pw_quote, strlen(pw_quote),
+                                             &pw_utf16, &pw_utf16_len, false);
+                if (!ret) {
+                        goto fail;
+                }
+                blob = data_blob_const(pw_utf16, pw_utf16_len);
+
+                ret &= tldap_add_mod_blobs(mem_ctx, pmods, pnum_mods,
+                                           TLDAP_MOD_REPLACE,
+                                           "unicodePwd", &blob, 1);
+                TALLOC_FREE(pw_utf16);
+                TALLOC_FREE(pw_quote);
         }
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "userAccountControl",
+                existing, mem_ctx, pmods, pnum_mods, "userAccountControl",
                 "%d", ds_acb2uf(pdb_get_acct_ctrl(sam)));
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "homeDirectory",
+                existing, mem_ctx, pmods, pnum_mods, "homeDirectory",
                 "%s", pdb_get_homedir(sam));
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "homeDrive",
+                existing, mem_ctx, pmods, pnum_mods, "homeDrive",
                 "%s", pdb_get_dir_drive(sam));
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "scriptPath",
+                existing, mem_ctx, pmods, pnum_mods, "scriptPath",
                 "%s", pdb_get_logon_script(sam));
 
         ret &= tldap_make_mod_fmt(
-                existing, mem_ctx, pnum_mods, pmods, "profilePath",
+                existing, mem_ctx, pmods, pnum_mods, "profilePath",
                 "%s", pdb_get_profile_path(sam));
 
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "comment",
+                "%s", pdb_get_comment(sam));
+
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "description",
+                "%s", pdb_get_acct_desc(sam));
+
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "userWorkstations",
+                "%s", pdb_get_workstations(sam));
+
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "userParameters",
+                "%s", pdb_get_munged_dial(sam));
+
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "countryCode",
+                "%i", (int)pdb_get_country_code(sam));
+
+        ret &= tldap_make_mod_fmt(
+                existing, mem_ctx, pmods, pnum_mods, "codePage",
+                "%i", (int)pdb_get_code_page(sam));
+
+        ret &= pdb_ads_make_time_mod(
+                existing, mem_ctx, pmods, pnum_mods, "accountExpires",
+                (int)pdb_get_kickoff_time(sam));
+
+        ret &= tldap_make_mod_blob(
+                existing, mem_ctx, pmods, pnum_mods, "logonHours",
+                data_blob_const(pdb_get_hours(sam), pdb_get_hours_len(sam)));
+
+fail:
         return ret;
 }
@@ -368 +495 @@
                 DEBUG(10, ("Expected 1 user, got %d\n", count));
                 TALLOC_FREE(result);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                return NT_STATUS_NO_SUCH_USER;
         }
 
@@ -427 +554 @@
 static NTSTATUS pdb_ads_getsampwsid(struct pdb_methods *m,
                                     struct samu *sam_acct,
-                                    const DOM_SID *sid)
+                                    const struct dom_sid *sid)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
@@ -433 +560 @@
         char *sidstr, *filter;
 
-        sidstr = sid_binstring(talloc_tos(), sid);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), sid);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -476 +603 @@
         ok = true;
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "objectClass", "user");
+                NULL, talloc_tos(), &mods, &num_mods, "objectClass", "user");
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "samAccountName", "%s",
+                NULL, talloc_tos(), &mods, &num_mods, "samAccountName", "%s",
                 name);
         if (!ok) {
@@ -485 +612 @@
 
 
-        rc = tldap_add(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
+        rc = tldap_add(ld, dn, mods, num_mods, NULL, 0, NULL, 0);
         if (rc != TLDAP_SUCCESS) {
                 DEBUG(10, ("ldap_add failed %s\n",
@@ -578 +705 @@
 
         if (!pdb_ads_init_ads_from_sam(state, priv->ldapmsg, talloc_tos(),
-                                       &num_mods, &mods, sam)) {
+                                       &mods, &num_mods, sam)) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -587 +714 @@
         }
 
-        rc = tldap_modify(ld, priv->dn, num_mods, mods, NULL, 0,
+        rc = tldap_modify(ld, priv->dn, mods, num_mods, NULL, 0,
                           NULL, 0);
         TALLOC_FREE(mods);
@@ -620 +747 @@
 
 static NTSTATUS pdb_ads_getgrfilter(struct pdb_methods *m, GROUP_MAP *map,
-                                    const char *filter)
+                                    const char *filter,
+                                    TALLOC_CTX *mem_ctx,
+                                    struct tldap_message **pmsg)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
@@ -640 +769 @@
         }
         if (talloc_array_length(group) != 1) {
-                DEBUG(10, ("Expected 1 user, got %d\n",
+                DEBUG(10, ("Expected 1 group, got %d\n",
                            (int)talloc_array_length(group)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -682 +811 @@
         }
 
+        if (pmsg != NULL) {
+                *pmsg = talloc_move(mem_ctx, &group[0]);
+        }
         TALLOC_FREE(group);
         return NT_STATUS_OK;
@@ -687 +819 @@
 
 static NTSTATUS pdb_ads_getgrsid(struct pdb_methods *m, GROUP_MAP *map,
-                                 DOM_SID sid)
+                                 struct dom_sid sid)
 {
         char *filter;
@@ -699 +831 @@
         }
 
-        status = pdb_ads_getgrfilter(m, map, filter);
+        status = pdb_ads_getgrfilter(m, map, filter, NULL, NULL);
         TALLOC_FREE(filter);
         return status;
@@ -725 +857 @@
         }
 
-        status = pdb_ads_getgrfilter(m, map, filter);
+        status = pdb_ads_getgrfilter(m, map, filter, NULL, NULL);
         TALLOC_FREE(filter);
         return status;
@@ -760 +892 @@
 
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "samAccountName", "%s",
+                NULL, talloc_tos(), &mods, &num_mods, "samAccountName", "%s",
                 name);
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "objectClass", "group");
+                NULL, talloc_tos(), &mods, &num_mods, "objectClass", "group");
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "groupType",
+                NULL, talloc_tos(), &mods, &num_mods, "groupType",
                 "%d", (int)GTYPE_SECURITY_GLOBAL_GROUP);
 
@@ -773 +905 @@
         }
 
-        rc = tldap_add(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
+        rc = tldap_add(ld, dn, mods, num_mods, NULL, 0, NULL, 0);
         if (rc != TLDAP_SUCCESS) {
                 DEBUG(10, ("ldap_add failed %s\n",
@@ -825 +957 @@
         sid_compose(&sid, &state->domainsid, rid);
 
-        sidstr = sid_binstring(talloc_tos(), &sid);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), &sid);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -879 +1011 @@
                                                    GROUP_MAP *map)
 {
+        struct pdb_ads_state *state = talloc_get_type_abort(
+                m->private_data, struct pdb_ads_state);
+        struct tldap_context *ld;
+        struct tldap_mod *mods = NULL;
+        char *filter;
+        struct tldap_message *existing;
+        char *dn;
+        GROUP_MAP existing_map;
+        int rc, num_mods = 0;
+        bool ret;
+        NTSTATUS status;
+
+        ld = pdb_ads_ld(state);
+        if (ld == NULL) {
+                return NT_STATUS_LDAP(TLDAP_SERVER_DOWN);
+        }
+
+        filter = talloc_asprintf(talloc_tos(),
+                                 "(&(objectsid=%s)(objectclass=group))",
+                                 sid_string_talloc(talloc_tos(), &map->sid));
+        if (filter == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        status = pdb_ads_getgrfilter(m, &existing_map, filter,
+                                     talloc_tos(), &existing);
+        TALLOC_FREE(filter);
+
+        if (!tldap_entry_dn(existing, &dn)) {
+                return NT_STATUS_LDAP(TLDAP_DECODING_ERROR);
+        }
+
+        ret = true;
+
+        ret &= tldap_make_mod_fmt(
+                existing, talloc_tos(), &mods, &num_mods, "description",
+                "%s", map->comment);
+        ret &= tldap_make_mod_fmt(
+                existing, talloc_tos(), &mods, &num_mods, "samaccountname",
+                "%s", map->nt_name);
+
+        if (!ret) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (num_mods == 0) {
+                TALLOC_FREE(existing);
+                return NT_STATUS_OK;
+        }
+
+        rc = tldap_modify(ld, dn, mods, num_mods, NULL, 0, NULL, 0);
+        if (rc != TLDAP_SUCCESS) {
+                DEBUG(10, ("ldap_modify for %s failed: %s\n", dn,
+                           tldap_errstr(talloc_tos(), ld, rc)));
+                TALLOC_FREE(existing);
+                return NT_STATUS_LDAP(rc);
+        }
+        TALLOC_FREE(existing);
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS pdb_ads_delete_group_mapping_entry(struct pdb_methods *m,
+                                                   struct dom_sid sid)
+{
         return NT_STATUS_NOT_IMPLEMENTED;
 }
 
-static NTSTATUS pdb_ads_delete_group_mapping_entry(struct pdb_methods *m,
-                                                   DOM_SID sid)
-{
-        return NT_STATUS_NOT_IMPLEMENTED;
-}
-
 static NTSTATUS pdb_ads_enum_group_mapping(struct pdb_methods *m,
-                                           const DOM_SID *sid,
+                                           const struct dom_sid *sid,
                                            enum lsa_SidType sid_name_use,
                                            GROUP_MAP **pp_rmap,
@@ -900 +1089 @@
 static NTSTATUS pdb_ads_enum_group_members(struct pdb_methods *m,
                                            TALLOC_CTX *mem_ctx,
-                                           const DOM_SID *group,
+                                           const struct dom_sid *group,
                                            uint32 **pmembers,
                                            size_t *pnum_members)
@@ -913 +1102 @@
         uint32_t *members;
 
-        sidstr = sid_binstring(talloc_tos(), group);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), group);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -936 +1125 @@
         }
 
-        if (!tldap_entry_values(msg[0], "member", &num_members, &blobs)) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        if (!tldap_entry_values(msg[0], "member", &blobs, &num_members)) {
+                *pmembers = NULL;
+                *pnum_members = 0;
+                return NT_STATUS_OK;
         }
 
@@ -962 +1153 @@
                                                TALLOC_CTX *mem_ctx,
                                                struct samu *user,
-                                               DOM_SID **pp_sids,
+                                               struct dom_sid **pp_sids,
                                                gid_t **pp_gids,
-                                               size_t *p_num_groups)
+                                               uint32_t *p_num_groups)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
                 m->private_data, struct pdb_ads_state);
-        struct pdb_ads_samu_private *priv = pdb_ads_get_samu_private(
-                m, user);
+        struct pdb_ads_samu_private *priv;
         const char *attrs[1] = { "objectSid" };
         struct tldap_message **groups;
@@ -977 +1167 @@
         gid_t *gids;
 
-        rc = pdb_ads_search_fmt(
-                state, state->domaindn, TLDAP_SCOPE_SUB,
-                attrs, ARRAY_SIZE(attrs), 0, talloc_tos(), &groups,
-                "(&(member=%s)(grouptype=%d)(objectclass=group))",
-                priv->dn, GTYPE_SECURITY_GLOBAL_GROUP);
-        if (rc != TLDAP_SUCCESS) {
-                DEBUG(10, ("ldap_search failed %s\n",
-                           tldap_errstr(talloc_tos(), state->ld, rc)));
-                return NT_STATUS_LDAP(rc);
-        }
-
-        count = talloc_array_length(groups);
-
-        group_sids = talloc_array(mem_ctx, struct dom_sid, count);
+        priv = pdb_ads_get_samu_private(m, user);
+        if (priv != NULL) {
+                rc = pdb_ads_search_fmt(
+                        state, state->domaindn, TLDAP_SCOPE_SUB,
+                        attrs, ARRAY_SIZE(attrs), 0, talloc_tos(), &groups,
+                        "(&(member=%s)(grouptype=%d)(objectclass=group))",
+                        priv->dn, GTYPE_SECURITY_GLOBAL_GROUP);
+                if (rc != TLDAP_SUCCESS) {
+                        DEBUG(10, ("ldap_search failed %s\n",
+                                   tldap_errstr(talloc_tos(), state->ld, rc)));
+                        return NT_STATUS_LDAP(rc);
+                }
+                count = talloc_array_length(groups);
+        } else {
+                /*
+                 * This happens for artificial samu users
+                 */
+                DEBUG(10, ("Could not get pdb_ads_samu_private\n"));
+                count = 0;
+        }
+
+        group_sids = talloc_array(mem_ctx, struct dom_sid, count+1);
         if (group_sids == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-        gids = talloc_array(mem_ctx, gid_t, count);
+        gids = talloc_array(mem_ctx, gid_t, count+1);
         if (gids == NULL) {
                 TALLOC_FREE(group_sids);
                 return NT_STATUS_NO_MEMORY;
         }
-        num_groups = 0;
+
+        sid_copy(&group_sids[0], pdb_get_group_sid(user));
+        if (!sid_to_gid(&group_sids[0], &gids[0])) {
+                TALLOC_FREE(gids);
+                TALLOC_FREE(group_sids);
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        num_groups = 1;
 
         for (i=0; i<count; i++) {
@@ -1039 +1244 @@
         char *groupdn, *memberdn;
         struct tldap_mod *mods;
+        int num_mods;
         int rc;
         NTSTATUS status;
@@ -1062 +1268 @@
 
         mods = NULL;
-
-        if (!tldap_add_mod_str(talloc_tos(), &mods, mod_op,
+        num_mods = 0;
+
+        if (!tldap_add_mod_str(talloc_tos(), &mods, &num_mods, mod_op,
                                "member", memberdn)) {
                 TALLOC_FREE(frame);
@@ -1069 +1276 @@
         }
 
-        rc = tldap_modify(ld, groupdn, 1, mods, NULL, 0, NULL, 0);
+        rc = tldap_modify(ld, groupdn, mods, num_mods, NULL, 0, NULL, 0);
         TALLOC_FREE(frame);
         if (rc != TLDAP_SUCCESS) {
                 DEBUG(10, ("ldap_modify failed: %s\n",
                            tldap_errstr(talloc_tos(), state->ld, rc)));
-                if (rc == TLDAP_TYPE_OR_VALUE_EXISTS) {
+                if ((mod_op == TLDAP_MOD_ADD) &&
+                    (rc == TLDAP_ALREADY_EXISTS)) {
                         return NT_STATUS_MEMBER_IN_GROUP;
                 }
-                if (rc == TLDAP_NO_SUCH_ATTRIBUTE) {
+                if ((mod_op == TLDAP_MOD_DELETE) &&
+                    (rc == TLDAP_UNWILLING_TO_PERFORM)) {
                         return NT_STATUS_MEMBER_NOT_IN_GROUP;
                 }
@@ -1131 +1340 @@
 
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "samAccountName", "%s",
+                NULL, talloc_tos(), &mods, &num_mods, "samAccountName", "%s",
                 name);
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "objectClass", "group");
+                NULL, talloc_tos(), &mods, &num_mods, "objectClass", "group");
         ok &= tldap_make_mod_fmt(
-                NULL, talloc_tos(), &num_mods, &mods, "groupType",
+                NULL, talloc_tos(), &mods, &num_mods, "groupType",
                 "%d", (int)GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
 
@@ -1144 +1353 @@
         }
 
-        rc = tldap_add(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
+        rc = tldap_add(ld, dn, mods, num_mods, NULL, 0, NULL, 0);
         if (rc != TLDAP_SUCCESS) {
                 DEBUG(10, ("ldap_add failed %s\n",
@@ -1183 +1392 @@
 
 static NTSTATUS pdb_ads_delete_alias(struct pdb_methods *m,
-                                     const DOM_SID *sid)
+                                     const struct dom_sid *sid)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
@@ -1189 +1398 @@
         struct tldap_context *ld;
         struct tldap_message **alias;
-        char *sidstr, *dn;
+        char *sidstr, *dn = NULL;
         int rc;
 
@@ -1197 +1406 @@
         }
 
-        sidstr = sid_binstring(talloc_tos(), sid);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), sid);
         if (sidstr == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -1212 +1421 @@
                 DEBUG(10, ("ldap_search failed: %s\n",
                            tldap_errstr(talloc_tos(), state->ld, rc)));
-                TALLOC_FREE(dn);
                 return NT_STATUS_LDAP(rc);
         }
@@ -1230 +1438 @@
                 DEBUG(10, ("ldap_delete failed: %s\n",
                            tldap_errstr(talloc_tos(), state->ld, rc)));
-                TALLOC_FREE(dn);
                 return NT_STATUS_LDAP(rc);
         }
@@ -1238 +1445 @@
 
 static NTSTATUS pdb_ads_set_aliasinfo(struct pdb_methods *m,
-                                      const DOM_SID *sid,
+                                      const struct dom_sid *sid,
                                       struct acct_info *info)
 {
@@ -1258 +1465 @@
         }
 
-        sidstr = sid_binstring(talloc_tos(), sid);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), sid);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -1292 +1499 @@
 
         ok &= tldap_make_mod_fmt(
-                msg[0], msg, &num_mods, &mods, "description",
+                msg[0], msg, &mods, &num_mods, "description",
                 "%s", info->acct_desc);
         ok &= tldap_make_mod_fmt(
-                msg[0], msg, &num_mods, &mods, "samAccountName",
+                msg[0], msg, &mods, &num_mods, "samAccountName",
                 "%s", info->acct_name);
         if (!ok) {
@@ -1307 +1514 @@
         }
 
-        rc = tldap_modify(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
+        rc = tldap_modify(ld, dn, mods, num_mods, NULL, 0, NULL, 0);
         TALLOC_FREE(msg);
         if (rc != TLDAP_SUCCESS) {
@@ -1325 +1532 @@
         int rc;
 
-        sidstr = sid_binstring(talloc_tos(), sid);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), sid);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -1362 +1569 @@
 
 static NTSTATUS pdb_ads_mod_aliasmem(struct pdb_methods *m,
-                                     const DOM_SID *alias,
-                                     const DOM_SID *member,
+                                     const struct dom_sid *alias,
+                                     const struct dom_sid *member,
                                      int mod_op)
 {
@@ -1371 +1578 @@
         TALLOC_CTX *frame = talloc_stackframe();
         struct tldap_mod *mods;
+        int num_mods;
         int rc;
         char *aliasdn, *memberdn;
@@ -1396 +1604 @@
 
         mods = NULL;
-
-        if (!tldap_add_mod_str(talloc_tos(), &mods, mod_op,
+        num_mods = 0;
+
+        if (!tldap_add_mod_str(talloc_tos(), &mods, &num_mods, mod_op,
                                "member", memberdn)) {
                 TALLOC_FREE(frame);
@@ -1403 +1612 @@
         }
 
-        rc = tldap_modify(ld, aliasdn, 1, mods, NULL, 0, NULL, 0);
+        rc = tldap_modify(ld, aliasdn, mods, num_mods, NULL, 0, NULL, 0);
         TALLOC_FREE(frame);
         if (rc != TLDAP_SUCCESS) {
@@ -1421 +1630 @@
 
 static NTSTATUS pdb_ads_add_aliasmem(struct pdb_methods *m,
-                                     const DOM_SID *alias,
-                                     const DOM_SID *member)
+                                     const struct dom_sid *alias,
+                                     const struct dom_sid *member)
 {
         return pdb_ads_mod_aliasmem(m, alias, member, TLDAP_MOD_ADD);
@@ -1428 +1637 @@
 
 static NTSTATUS pdb_ads_del_aliasmem(struct pdb_methods *m,
-                                     const DOM_SID *alias,
-                                     const DOM_SID *member)
+                                     const struct dom_sid *alias,
+                                     const struct dom_sid *member)
 {
         return pdb_ads_mod_aliasmem(m, alias, member, TLDAP_MOD_DELETE);
@@ -1466 +1675 @@
 
 static NTSTATUS pdb_ads_enum_aliasmem(struct pdb_methods *m,
-                                      const DOM_SID *alias,
+                                      const struct dom_sid *alias,
                                       TALLOC_CTX *mem_ctx,
-                                      DOM_SID **pmembers,
+                                      struct dom_sid **pmembers,
                                       size_t *pnum_members)
 {
@@ -1480 +1689 @@
         struct dom_sid *members;
 
-        sidstr = sid_binstring(talloc_tos(), alias);
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), alias);
         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -1503 +1712 @@
         }
 
-        if (!tldap_entry_values(msg[0], "member", &num_members, &blobs)) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        if (!tldap_entry_values(msg[0], "member", &blobs, &num_members)) {
+                *pmembers = NULL;
+                *pnum_members = 0;
+                return NT_STATUS_OK;
         }
 
@@ -1526 +1737 @@
 static NTSTATUS pdb_ads_enum_alias_memberships(struct pdb_methods *m,
                                                TALLOC_CTX *mem_ctx,
-                                               const DOM_SID *domain_sid,
-                                               const DOM_SID *members,
+                                               const struct dom_sid *domain_sid,
+                                               const struct dom_sid *members,
                                                size_t num_members,
                                                uint32_t **palias_rids,
@@ -1535 +1746 @@
                 m->private_data, struct pdb_ads_state);
         const char *attrs[1] = { "objectSid" };
-        struct tldap_message **msg;
+        struct tldap_message **msg = NULL;
         uint32_t *alias_rids = NULL;
         size_t num_alias_rids = 0;
@@ -1621 +1832 @@
 
 static NTSTATUS pdb_ads_lookup_rids(struct pdb_methods *m,
-                                    const DOM_SID *domain_sid,
+                                    const struct dom_sid *domain_sid,
                                     int num_rids,
                                     uint32 *rids,
@@ -1649 +1860 @@
                 sid_compose(&sid, domain_sid, rids[i]);
 
-                sidstr = sid_binstring(talloc_tos(), &sid);
+                sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), &sid);
                 NT_STATUS_HAVE_NO_MEMORY(sidstr);
 
@@ -1697 +1908 @@
 
 static NTSTATUS pdb_ads_lookup_names(struct pdb_methods *m,
-                                     const DOM_SID *domain_sid,
+                                     const struct dom_sid *domain_sid,
                                      int num_names,
                                      const char **pp_names,
@@ -1777 +1988 @@
                                   struct pdb_search *search,
                                   const char *filter,
+                                  uint32_t acct_flags,
                                   struct pdb_ads_search_state **pstate)
 {
@@ -1791 +2003 @@
                 return false;
         }
+        sstate->acct_flags = acct_flags;
 
         rc = pdb_ads_search_fmt(
@@ -1816 +2029 @@
                 struct samr_displayentry *e;
                 struct dom_sid sid;
+                uint32_t ctrl;
 
                 e = &sstate->entries[sstate->num_entries];
@@ -1825 +2039 @@
                 }
                 sid_peek_rid(&sid, &e->rid);
-                e->acct_flags = ACB_NORMAL;
-                e->account_name = tldap_talloc_single_attribute(
-                        users[i], "samAccountName", sstate->entries);
+
+                if (tldap_pull_uint32(users[i], "userAccountControl", &ctrl)) {
+
+                        e->acct_flags = ds_uf2acb(ctrl);
+
+                        DEBUG(10, ("pdb_ads_search_filter: Found %x, "
+                                   "filter %x\n", (int)e->acct_flags,
+                                   (int)sstate->acct_flags));
+
+
+                        if ((sstate->acct_flags != 0) &&
+                            ((sstate->acct_flags & e->acct_flags) == 0)) {
+                                continue;
+                        }
+
+                        if (e->acct_flags & (ACB_WSTRUST|ACB_SVRTRUST)) {
+                                e->acct_flags |= ACB_NORMAL;
+                        }
+                } else {
+                        e->acct_flags = ACB_NORMAL;
+                }
+
+                if (e->rid == DOMAIN_RID_GUEST) {
+                        /*
+                         * Guest is specially crafted in s3. Make
+                         * QueryDisplayInfo match QueryUserInfo
+                         */
+                        e->account_name = lp_guestaccount();
+                        e->fullname = lp_guestaccount();
+                        e->description = "";
+                        e->acct_flags = ACB_NORMAL;
+                } else {
+                        e->account_name = tldap_talloc_single_attribute(
+                                users[i], "samAccountName", sstate->entries);
+                        e->fullname = tldap_talloc_single_attribute(
+                                users[i], "displayName", sstate->entries);
+                        e->description = tldap_talloc_single_attribute(
+                                users[i], "description", sstate->entries);
+                }
                 if (e->account_name == NULL) {
                         return false;
                 }
-                e->fullname = tldap_talloc_single_attribute(
-                        users[i], "displayName", sstate->entries);
                 if (e->fullname == NULL) {
                         e->fullname = "";
                 }
-                e->description = tldap_talloc_single_attribute(
-                        users[i], "description", sstate->entries);
                 if (e->description == NULL) {
                         e->description = "";
@@ -1860 +2106 @@
 {
         struct pdb_ads_search_state *sstate;
+        char *filter;
         bool ret;
 
-        ret = pdb_ads_search_filter(m, search, "(objectclass=user)", &sstate);
+        DEBUG(10, ("pdb_ads_search_users got flags %x\n", acct_flags));
+
+        if (acct_flags & ACB_NORMAL) {
+                filter = talloc_asprintf(
+                        talloc_tos(),
+                        "(&(objectclass=user)(sAMAccountType=%d))",
+                        ATYPE_NORMAL_ACCOUNT);
+        } else if (acct_flags & ACB_WSTRUST) {
+                filter = talloc_asprintf(
+                        talloc_tos(),
+                        "(&(objectclass=user)(sAMAccountType=%d))",
+                        ATYPE_WORKSTATION_TRUST);
+        } else {
+                filter = talloc_strdup(talloc_tos(), "(objectclass=user)");
+        }
+        if (filter == NULL) {
+                return false;
+        }
+
+        ret = pdb_ads_search_filter(m, search, filter, acct_flags, &sstate);
+        TALLOC_FREE(filter);
         if (!ret) {
                 return false;
         }
-        sstate->acct_flags = acct_flags;
         return true;
 }
@@ -1883 +2149 @@
                 return false;
         }
-        ret = pdb_ads_search_filter(m, search, filter, &sstate);
+        ret = pdb_ads_search_filter(m, search, filter, 0, &sstate);
         TALLOC_FREE(filter);
         if (!ret) {
                 return false;
         }
-        sstate->acct_flags = 0;
         return true;
 }
@@ -1894 +2159 @@
 static bool pdb_ads_search_aliases(struct pdb_methods *m,
                                    struct pdb_search *search,
-                                   const DOM_SID *sid)
+                                   const struct dom_sid *sid)
 {
         struct pdb_ads_search_state *sstate;
@@ -1909 +2174 @@
                 return false;
         }
-        ret = pdb_ads_search_filter(m, search, filter, &sstate);
+        ret = pdb_ads_search_filter(m, search, filter, 0, &sstate);
         TALLOC_FREE(filter);
         if (!ret) {
                 return false;
         }
-        sstate->acct_flags = 0;
         return true;
 }
 
 static bool pdb_ads_uid_to_sid(struct pdb_methods *m, uid_t uid,
-                               DOM_SID *sid)
+                               struct dom_sid *sid)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
@@ -1928 +2192 @@
 
 static bool pdb_ads_gid_to_sid(struct pdb_methods *m, gid_t gid,
-                               DOM_SID *sid)
+                               struct dom_sid *sid)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
@@ -1936 +2200 @@
 }
 
-static bool pdb_ads_sid_to_id(struct pdb_methods *m, const DOM_SID *sid,
+static bool pdb_ads_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
                               union unid_t *id, enum lsa_SidType *type)
 {
         struct pdb_ads_state *state = talloc_get_type_abort(
                 m->private_data, struct pdb_ads_state);
+        const char *attrs[4] = { "objectClass", "samAccountType",
+                                 "uidNumber", "gidNumber" };
         struct tldap_message **msg;
-        char *sidstr;
-        uint32_t rid;
+        char *sidstr, *base;
+        uint32_t atype;
         int rc;
-
-        /*
-         * This is a big, big hack: Just hard-code the rid as uid/gid.
-         */
-
-        sid_peek_rid(sid, &rid);
-
-        sidstr = sid_binstring(talloc_tos(), sid);
+        bool ret = false;
+
+        sidstr = sid_binstring_hex(sid);
         if (sidstr == NULL) {
                 return false;
         }
+        base = talloc_asprintf(talloc_tos(), "<SID=%s>", sidstr);
+        SAFE_FREE(sidstr);
 
         rc = pdb_ads_search_fmt(
-                state, state->domaindn, TLDAP_SCOPE_SUB,
-                NULL, 0, 0, talloc_tos(), &msg,
-                "(&(objectsid=%s)(objectclass=user))", sidstr);
-        if ((rc == TLDAP_SUCCESS) && (talloc_array_length(msg) > 0)) {
-                id->uid = rid;
+                state, base, TLDAP_SCOPE_BASE,
+                attrs, ARRAY_SIZE(attrs), 0, talloc_tos(), &msg,
+                "(objectclass=*)");
+        TALLOC_FREE(base);
+
+        if (rc != TLDAP_SUCCESS) {
+                DEBUG(10, ("pdb_ads_search_fmt failed: %s\n",
+                           tldap_errstr(talloc_tos(), state->ld, rc)));
+                return false;
+        }
+        if (talloc_array_length(msg) != 1) {
+                DEBUG(10, ("Got %d objects, expected 1\n",
+                           (int)talloc_array_length(msg)));
+                goto fail;
+        }
+        if (!tldap_pull_uint32(msg[0], "samAccountType", &atype)) {
+                DEBUG(10, ("samAccountType not found\n"));
+                goto fail;
+        }
+        if (atype == ATYPE_ACCOUNT) {
+                uint32_t uid;
                 *type = SID_NAME_USER;
-                TALLOC_FREE(sidstr);
-                return true;
-        }
-
-        rc = pdb_ads_search_fmt(
-                state, state->domaindn, TLDAP_SCOPE_SUB,
-                NULL, 0, 0, talloc_tos(), &msg,
-                "(&(objectsid=%s)(objectclass=group))", sidstr);
-        if ((rc == TLDAP_SUCCESS) && (talloc_array_length(msg) > 0)) {
-                id->gid = rid;
+                if (!tldap_pull_uint32(msg[0], "uidNumber", &uid)) {
+                        DEBUG(10, ("Did not find uidNumber\n"));
+                        goto fail;
+                }
+                id->uid = uid;
+        } else {
+                uint32_t gid;
                 *type = SID_NAME_DOM_GRP;
-                TALLOC_FREE(sidstr);
-                return true;
-        }
-
-        TALLOC_FREE(sidstr);
-        return false;
+                if (!tldap_pull_uint32(msg[0], "gidNumber", &gid)) {
+                        DEBUG(10, ("Did not find gidNumber\n"));
+                        goto fail;
+                }
+                id->gid = gid;
+        }
+        ret = true;
+fail:
+        TALLOC_FREE(msg);
+        return ret;
 }
 
@@ -1995 +2275 @@
 static bool pdb_ads_get_trusteddom_pw(struct pdb_methods *m,
                                       const char *domain, char** pwd,
-                                      DOM_SID *sid,
+                                      struct dom_sid *sid,
                                       time_t *pass_last_set_time)
 {
@@ -2003 +2283 @@
 static bool pdb_ads_set_trusteddom_pw(struct pdb_methods *m,
                                       const char* domain, const char* pwd,
-                                      const DOM_SID *sid)
+                                      const struct dom_sid *sid)
 {
         return false;
@@ -2202 +2482 @@
         ZERO_STRUCT(state->socket_address);
         state->socket_address.sun_family = AF_UNIX;
-        strncpy(state->socket_address.sun_path, location,
-                sizeof(state->socket_address.sun_path) - 1);
+        strlcpy(state->socket_address.sun_path, location,
+                sizeof(state->socket_address.sun_path));
 
         ld = pdb_ads_ld(state);
@@ -2231 +2511 @@
         state->configdn = tldap_talloc_single_attribute(
                 rootdse, "configurationNamingContext", state);
-        if (state->domaindn == NULL) {
+        if (state->configdn == NULL) {
                 DEBUG(10, ("Could not get configurationNamingContext\n"));
                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2320 +2600 @@
         NTSTATUS status;
 
-        m = talloc(talloc_autofree_context(), struct pdb_methods);
+        m = talloc(NULL, struct pdb_methods);
         if (m == NULL) {
                 return NT_STATUS_NO_MEMORY;

trunk/server/source3/passdb/pdb_compat.c

@@ -7 +7 @@
    Copyright (C) Andrew Bartlett                2001-2002
    Copyright (C) Stefan (metze) Metzmacher      2002
-      
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -23 +23 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "../libcli/security/security.h"
 
 #undef DBGC_CLASS
@@ -34 +36 @@
                 if (sid_peek_check_rid(get_global_sam_sid(), pdb_get_user_sid(sampass),&u_rid))
                         return u_rid;
-        
+
         return (0);
 }
@@ -50 +52 @@
 bool pdb_set_user_sid_from_rid (struct samu *sampass, uint32 rid, enum pdb_value_state flag)
 {
-        DOM_SID u_sid;
-        const DOM_SID *global_sam_sid;
-        
+        struct dom_sid u_sid;
+        const struct dom_sid *global_sam_sid;
+
         if (!sampass)
                 return False;
@@ -61 +63 @@
         }
 
-        sid_copy(&u_sid, global_sam_sid);
-
-        if (!sid_append_rid(&u_sid, rid))
+        if (!sid_compose(&u_sid, global_sam_sid, rid)) {
                 return False;
+        }
 
         if (!pdb_set_user_sid(sampass, &u_sid, flag))
@@ -77 +78 @@
 bool pdb_set_group_sid_from_rid (struct samu *sampass, uint32 grid, enum pdb_value_state flag)
 {
-        DOM_SID g_sid;
-        const DOM_SID *global_sam_sid;
+        struct dom_sid g_sid;
+        const struct dom_sid *global_sam_sid;
 
         if (!sampass)
                 return False;
-        
+
         if (!(global_sam_sid = get_global_sam_sid())) {
                 DEBUG(1, ("pdb_set_user_sid_from_rid: Could not read global sam sid!\n"));
@@ -88 +89 @@
         }
 
-        sid_copy(&g_sid, global_sam_sid);
-        
-        if (!sid_append_rid(&g_sid, grid))
+        if (!sid_compose(&g_sid, global_sam_sid, grid)) {
                 return False;
+        }
 
         if (!pdb_set_group_sid(sampass, &g_sid, flag))

trunk/server/source3/passdb/pdb_get_set.c

@@ -23 +23 @@
 
 #include "includes.h"
+#include "passdb.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../libcli/security/security.h"
 
 #undef DBGC_CLASS
@@ -41 +43 @@
  ********************************************************************/
 
-uint32 pdb_get_acct_ctrl(const struct samu *sampass)
+uint32_t pdb_get_acct_ctrl(const struct samu *sampass)
 {
         return sampass->acct_ctrl;
@@ -73 +75 @@
 time_t pdb_get_pass_can_change_time(const struct samu *sampass)
 {
-        uint32 allow;
+        uint32_t allow;
 
         /* if the last set time is zero, it means the user cannot 
@@ -86 +88 @@
         */
         if (sampass->pass_can_change_time == get_time_t_max() &&
-            pdb_get_init_flags(sampass, PDB_CANCHANGETIME) == PDB_CHANGED)
+            IS_SAM_CHANGED(sampass, PDB_CANCHANGETIME))
                 return sampass->pass_can_change_time;
 
@@ -105 +107 @@
 time_t pdb_get_pass_must_change_time(const struct samu *sampass)
 {
-        uint32 expire;
+        uint32_t expire;
 
         if (sampass->pass_last_set_time == 0)
@@ -114 +116 @@
 
         if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire)
-            || expire == (uint32)-1 || expire == 0) 
+            || expire == (uint32_t)-1 || expire == 0)
                 return get_time_t_max();
 
@@ -122 +124 @@
 bool pdb_get_pass_can_change(const struct samu *sampass)
 {
-        if (sampass->pass_can_change_time == get_time_t_max() &&
-            sampass->pass_last_set_time != 0)
+        if (sampass->pass_can_change_time == get_time_t_max())
                 return False;
         return True;
 }
 
-uint16 pdb_get_logon_divs(const struct samu *sampass)
+uint16_t pdb_get_logon_divs(const struct samu *sampass)
 {
         return sampass->logon_divs;
 }
 
-uint32 pdb_get_hours_len(const struct samu *sampass)
+uint32_t pdb_get_hours_len(const struct samu *sampass)
 {
         return sampass->hours_len;
@@ -157 +158 @@
 }
 
-const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32 *current_hist_len)
+const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
 {
         SMB_ASSERT((!sampass->nt_pw_his.data) 
@@ -176 +177 @@
 }
 
-const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
+const struct dom_sid *pdb_get_user_sid(const struct samu *sampass)
 {
         return &sampass->user_sid;
 }
 
-const DOM_SID *pdb_get_group_sid(struct samu *sampass)
-{
-        DOM_SID *gsid;
-        struct passwd *pwd;
-        bool need_lookup_sid = false;
+const struct dom_sid *pdb_get_group_sid(struct samu *sampass)
+{
+        NTSTATUS status;
 
         /* Return the cached group SID if we have that */
-        if ( sampass->group_sid ) {
+        if (sampass->group_sid) {
                 return sampass->group_sid;
-        }
-
-        /* generate the group SID from the user's primary Unix group */
-
-        if ( !(gsid  = TALLOC_ZERO_P( sampass, DOM_SID )) ) {
-                return NULL;
         }
 
@@ -202 +195 @@
            be a newly allocated one.  We rely on the user's Unix primary gid.
            We have no choice but to fail if we can't find it. */
-
-        if ( sampass->unix_pw ) {
-                pwd = sampass->unix_pw;
-        } else {
-                pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
-        }
-
-        if ( !pwd ) {
-                DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
+        status = get_primary_group_sid(sampass,
+                                        pdb_get_username(sampass),
+                                        &sampass->unix_pw,
+                                        &sampass->group_sid);
+        if (!NT_STATUS_IS_OK(status)) {
                 return NULL;
         }
 
-        gid_to_sid(gsid, pwd->pw_gid);
-        if (!is_null_sid(gsid)) {
-                DOM_SID dgsid;
-                uint32_t rid;
-
-                sid_copy(&dgsid, gsid);
-                sid_split_rid(&dgsid, &rid);
-                if (sid_equal(&dgsid, get_global_sam_sid())) {
-                        /*
-                         * As shortcut for the expensive lookup_sid call
-                         * compare the domain sid part
-                         */
-                        switch (rid) {
-                        case DOMAIN_RID_ADMINS:
-                        case DOMAIN_RID_USERS:
-                                sampass->group_sid = gsid;
-                                return sampass->group_sid;
-                        default:
-                                need_lookup_sid = true;
-                                break;
-                        }
-                } else {
-                        ZERO_STRUCTP(gsid);
-                        if (pdb_gid_to_sid(pwd->pw_gid, gsid)) {
-                                need_lookup_sid = true;
-                        }
-                }
-        }
-
-        if (need_lookup_sid) {
-                enum lsa_SidType type = SID_NAME_UNKNOWN;
-                TALLOC_CTX *mem_ctx;
-                bool lookup_ret;
-                const DOM_SID *usid = pdb_get_user_sid(sampass);
-
-                mem_ctx = talloc_init("pdb_get_group_sid");
-                if (!mem_ctx) {
-                        return NULL;
-                }
-
-                DEBUG(10,("do lookup_sid(%s) for group of user %s\n",
-                          sid_string_dbg(gsid), sid_string_dbg(usid)));
-
-                /* Now check that it's actually a domain group and not something else */
-
-                lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
-
-                TALLOC_FREE( mem_ctx );
-
-                if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
-                        sampass->group_sid = gsid;
-                        return sampass->group_sid;
-                }
-
-                DEBUG(3, ("Primary group %s for user %s is a %s and not a domain group\n",
-                        sid_string_dbg(gsid), pwd->pw_name, sid_type_lookup(type)));
-        }
-
-        /* Just set it to the 'Domain Users' RID of 512 which will 
-           always resolve to a name */
-
-        sid_copy( gsid, get_global_sam_sid() );
-        sid_append_rid( gsid, DOMAIN_GROUP_RID_USERS );
-
-        sampass->group_sid = gsid;
-
         return sampass->group_sid;
-}       
+}
 
 /**
@@ -373 +296 @@
 }
 
-uint16 pdb_get_bad_password_count(const struct samu *sampass)
+uint16_t pdb_get_bad_password_count(const struct samu *sampass)
 {
         return sampass->bad_password_count;
 }
 
-uint16 pdb_get_logon_count(const struct samu *sampass)
+uint16_t pdb_get_logon_count(const struct samu *sampass)
 {
         return sampass->logon_count;
 }
 
-uint32 pdb_get_unknown_6(const struct samu *sampass)
+uint16_t pdb_get_country_code(const struct samu *sampass)
+{
+        return sampass->country_code;
+}
+
+uint16_t pdb_get_code_page(const struct samu *sampass)
+{
+        return sampass->code_page;
+}
+
+uint32_t pdb_get_unknown_6(const struct samu *sampass)
 {
         return sampass->unknown_6;
@@ -401 +334 @@
  ********************************************************************/
 
-bool pdb_set_acct_ctrl(struct samu *sampass, uint32 acct_ctrl, enum pdb_value_state flag)
+bool pdb_set_acct_ctrl(struct samu *sampass, uint32_t acct_ctrl, enum pdb_value_state flag)
 {
         sampass->acct_ctrl = acct_ctrl;
@@ -449 +382 @@
 }
 
-bool pdb_set_hours_len(struct samu *sampass, uint32 len, enum pdb_value_state flag)
+bool pdb_set_hours_len(struct samu *sampass, uint32_t len, enum pdb_value_state flag)
 {
         sampass->hours_len = len;
@@ -455 +388 @@
 }
 
-bool pdb_set_logon_divs(struct samu *sampass, uint16 hours, enum pdb_value_state flag)
+bool pdb_set_logon_divs(struct samu *sampass, uint16_t hours, enum pdb_value_state flag)
 {
         sampass->logon_divs = hours;
@@ -527 +460 @@
 }
 
-bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid(struct samu *sampass, const struct dom_sid *u_sid, enum pdb_value_state flag)
 {
         if (!u_sid)
@@ -542 +475 @@
 bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
 {
-        DOM_SID new_sid;
+        struct dom_sid new_sid;
 
         if (!u_sid)
@@ -571 +504 @@
 ********************************************************************/
 
-bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
+bool pdb_set_group_sid(struct samu *sampass, const struct dom_sid *g_sid, enum pdb_value_state flag)
 {
         gid_t gid;
+        struct dom_sid dug_sid;
 
         if (!g_sid)
                 return False;
 
-        if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
+        if ( !(sampass->group_sid = TALLOC_P( sampass, struct dom_sid )) ) {
                 return False;
         }
@@ -585 +519 @@
            store DOMAIN_USERS as the primary groupSID */
 
-        if ( sid_to_gid( g_sid, &gid ) ) {
+        sid_compose(&dug_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
+
+        if (dom_sid_equal(&dug_sid, g_sid)) {
+                sid_copy(sampass->group_sid, &dug_sid);
+        } else if (sid_to_gid( g_sid, &gid ) ) {
                 sid_copy(sampass->group_sid, g_sid);
         } else {
-                sid_copy( sampass->group_sid, get_global_sam_sid() );
-                sid_append_rid( sampass->group_sid, DOMAIN_GROUP_RID_USERS );
+                sid_copy(sampass->group_sid, &dug_sid);
         }
 
@@ -909 +846 @@
 ********************************************************************/
 
-bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32 historyLen, enum pdb_value_state flag)
+bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32_t historyLen, enum pdb_value_state flag)
 {
         if (historyLen && pwd){
+                data_blob_free(&(sampass->nt_pw_his));
                 sampass->nt_pw_his = data_blob_talloc(sampass,
                                                 pwd, historyLen*PW_HISTORY_ENTRY_LEN);
@@ -949 +887 @@
 }
 
-bool pdb_set_bad_password_count(struct samu *sampass, uint16 bad_password_count, enum pdb_value_state flag)
+bool pdb_set_bad_password_count(struct samu *sampass, uint16_t bad_password_count, enum pdb_value_state flag)
 {
         sampass->bad_password_count = bad_password_count;
@@ -955 +893 @@
 }
 
-bool pdb_set_logon_count(struct samu *sampass, uint16 logon_count, enum pdb_value_state flag)
+bool pdb_set_logon_count(struct samu *sampass, uint16_t logon_count, enum pdb_value_state flag)
 {
         sampass->logon_count = logon_count;
@@ -961 +899 @@
 }
 
-bool pdb_set_unknown_6(struct samu *sampass, uint32 unkn, enum pdb_value_state flag)
+bool pdb_set_country_code(struct samu *sampass, uint16_t country_code,
+                          enum pdb_value_state flag)
+{
+        sampass->country_code = country_code;
+        return pdb_set_init_flags(sampass, PDB_COUNTRY_CODE, flag);
+}
+
+bool pdb_set_code_page(struct samu *sampass, uint16_t code_page,
+                       enum pdb_value_state flag)
+{
+        sampass->code_page = code_page;
+        return pdb_set_init_flags(sampass, PDB_CODE_PAGE, flag);
+}
+
+bool pdb_set_unknown_6(struct samu *sampass, uint32_t unkn, enum pdb_value_state flag)
 {
         sampass->unknown_6 = unkn;
@@ -967 +919 @@
 }
 
-bool pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
-{
+bool pdb_set_hours(struct samu *sampass, const uint8 *hours, int hours_len,
+                   enum pdb_value_state flag)
+{
+        if (hours_len > sizeof(sampass->hours)) {
+                return false;
+        }
+
         if (!hours) {
-                memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
-        } else {
-                memcpy (sampass->hours, hours, MAX_HOURS_LEN);
+                memset ((char *)sampass->hours, 0, hours_len);
+        } else {
+                memcpy (sampass->hours, hours, hours_len);
         }
 
@@ -1017 +974 @@
         uchar new_nt_p16[NT_HASH_LEN];
         uchar *pwhistory;
-        uint32 pwHistLen;
-        uint32 current_history_len;
+        uint32_t pwHistLen;
+        uint32_t current_history_len;
 
         if (!plaintext)
@@ -1126 +1083 @@
 
 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
-uint32 pdb_build_fields_present(struct samu *sampass)
+uint32_t pdb_build_fields_present(struct samu *sampass)
 {
         /* value set to all for testing */

trunk/server/source3/passdb/pdb_interface.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "system/passwd.h"
+#include "passdb.h"
+#include "secrets.h"
+#include "../librpc/gen_ndr/samr.h"
+#include "memcache.h"
+#include "nsswitch/winbind_client.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/util_pw.h"
 
 #undef DBGC_CLASS
@@ -217 +225 @@
 }
 
+/**
+ * @brief Check if the user account has been locked out and try to unlock it.
+ *
+ * If the user has been automatically locked out and a lockout duration is set,
+ * then check if we can unlock the account and reset the bad password values.
+ *
+ * @param[in]  sampass  The sam user to check.
+ *
+ * @return              True if the function was successfull, false on an error.
+ */
+static bool pdb_try_account_unlock(struct samu *sampass)
+{
+        uint32_t acb_info = pdb_get_acct_ctrl(sampass);
+
+        if ((acb_info & ACB_NORMAL) && (acb_info & ACB_AUTOLOCK)) {
+                uint32_t lockout_duration;
+                time_t bad_password_time;
+                time_t now = time(NULL);
+                bool ok;
+
+                ok = pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION,
+                                            &lockout_duration);
+                if (!ok) {
+                        DEBUG(0, ("pdb_try_account_unlock: "
+                                  "pdb_get_account_policy failed.\n"));
+                        return false;
+                }
+
+                if (lockout_duration == (uint32_t) -1 ||
+                    lockout_duration == 0) {
+                        DEBUG(9, ("pdb_try_account_unlock: No reset duration, "
+                                  "can't reset autolock\n"));
+                        return false;
+                }
+                lockout_duration *= 60;
+
+                bad_password_time = pdb_get_bad_password_time(sampass);
+                if (bad_password_time == (time_t) 0) {
+                        DEBUG(2, ("pdb_try_account_unlock: Account %s "
+                                  "administratively locked out "
+                                  "with no bad password "
+                                  "time. Leaving locked out.\n",
+                                  pdb_get_username(sampass)));
+                        return true;
+                }
+
+                if ((bad_password_time +
+                     convert_uint32_t_to_time_t(lockout_duration)) < now) {
+                        NTSTATUS status;
+
+                        pdb_set_acct_ctrl(sampass, acb_info & ~ACB_AUTOLOCK,
+                                          PDB_CHANGED);
+                        pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
+                        pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
+
+                        become_root();
+                        status = pdb_update_sam_account(sampass);
+                        unbecome_root();
+                        if (!NT_STATUS_IS_OK(status)) {
+                                DEBUG(0, ("_samr_OpenUser: Couldn't "
+                                          "update account %s - %s\n",
+                                          pdb_get_username(sampass),
+                                          nt_errstr(status)));
+                                return false;
+                        }
+                }
+        }
+
+        return true;
+}
+
+/**
+ * @brief Get a sam user structure by the given username.
+ *
+ * This functions also checks if the account has been automatically locked out
+ * and unlocks it if a lockout duration time has been defined and the time has
+ * elapsed.
+ *
+ * @param[in]  sam_acct  The sam user structure to fill.
+ *
+ * @param[in]  username  The username to look for.
+ *
+ * @return               True on success, false on error.
+ */
 bool pdb_getsampwnam(struct samu *sam_acct, const char *username) 
 {
@@ -222 +314 @@
         struct samu *for_cache;
         const struct dom_sid *user_sid;
-
-        if (!NT_STATUS_IS_OK(pdb->getsampwnam(pdb, sam_acct, username))) {
-                return False;
+        NTSTATUS status;
+        bool ok;
+
+        status = pdb->getsampwnam(pdb, sam_acct, username);
+        if (!NT_STATUS_IS_OK(status)) {
+                return false;
+        }
+
+        ok = pdb_try_account_unlock(sam_acct);
+        if (!ok) {
+                DEBUG(1, ("pdb_getsampwnam: Failed to unlock account %s\n",
+                          username));
         }
 
@@ -249 +350 @@
 **********************************************************************/
 
-bool guest_user_info( struct samu *user )
+static bool guest_user_info( struct samu *user )
 {
         struct passwd *pwd;
@@ -255 +356 @@
         const char *guestname = lp_guestaccount();
 
-        if ( !(pwd = Get_Pwnam_alloc(talloc_autofree_context(), guestname ) ) ) {
+        pwd = Get_Pwnam_alloc(talloc_tos(), guestname);
+        if (pwd == NULL) {
                 DEBUG(0,("guest_user_info: Unable to locate guest account [%s]!\n", 
                         guestname));
@@ -268 +370 @@
 }
 
-/**********************************************************************
-**********************************************************************/
-
-bool pdb_getsampwsid(struct samu *sam_acct, const DOM_SID *sid) 
-{
-        struct pdb_methods *pdb = pdb_get_methods();
-        uint32 rid;
+/**
+ * @brief Get a sam user structure by the given username.
+ *
+ * This functions also checks if the account has been automatically locked out
+ * and unlocks it if a lockout duration time has been defined and the time has
+ * elapsed.
+ *
+ *
+ * @param[in]  sam_acct  The sam user structure to fill.
+ *
+ * @param[in]  sid       The user SDI to look up.
+ *
+ * @return               True on success, false on error.
+ */
+bool pdb_getsampwsid(struct samu *sam_acct, const struct dom_sid *sid)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        uint32_t rid;
         void *cache_data;
+        bool ok = false;
 
         /* hard code the Guest RID of 501 */
@@ -282 +396 @@
                 return False;
 
-        if ( rid == DOMAIN_USER_RID_GUEST ) {
+        if ( rid == DOMAIN_RID_GUEST ) {
                 DEBUG(6,("pdb_getsampwsid: Building guest account\n"));
                 return guest_user_info( sam_acct );
@@ -296 +410 @@
                         cache_data, struct samu);
 
-                return pdb_copy_sam_account(sam_acct, cache_copy);
-        }
-
-        return NT_STATUS_IS_OK(pdb->getsampwsid(pdb, sam_acct, sid));
+                ok = pdb_copy_sam_account(sam_acct, cache_copy);
+        } else {
+                ok = NT_STATUS_IS_OK(pdb->getsampwsid(pdb, sam_acct, sid));
+        }
+
+        if (!ok) {
+                return false;
+        }
+
+        ok = pdb_try_account_unlock(sam_acct);
+        if (!ok) {
+                DEBUG(1, ("pdb_getsampwsid: Failed to unlock account %s\n",
+                          sam_acct->username));
+        }
+
+        return true;
 }
 
 static NTSTATUS pdb_default_create_user(struct pdb_methods *methods,
                                         TALLOC_CTX *tmp_ctx, const char *name,
-                                        uint32 acb_info, uint32 *rid)
+                                        uint32_t acb_info, uint32_t *rid)
 {
         struct samu *sam_pass;
@@ -354 +480 @@
 
                 pwd = Get_Pwnam_alloc(tmp_ctx, name);
+
+                if(pwd == NULL) {
+                        DEBUG(3, ("Could not find user %s, add script did not work\n", name));
+                        return NT_STATUS_NO_SUCH_USER;
+                }
         }
 
@@ -390 +521 @@
 }
 
-NTSTATUS pdb_create_user(TALLOC_CTX *mem_ctx, const char *name, uint32 flags,
-                         uint32 *rid)
+NTSTATUS pdb_create_user(TALLOC_CTX *mem_ctx, const char *name, uint32_t flags,
+                         uint32_t *rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -538 +669 @@
 }
 
-bool pdb_getgrsid(GROUP_MAP *map, DOM_SID sid)
+bool pdb_getgrsid(GROUP_MAP *map, struct dom_sid sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -559 +690 @@
                                              TALLOC_CTX *mem_ctx,
                                              const char *name,
-                                             uint32 *rid)
-{
-        DOM_SID group_sid;
+                                             uint32_t *rid)
+{
+        struct dom_sid group_sid;
         struct group *grp;
         fstring tmp;
@@ -596 +727 @@
 
 NTSTATUS pdb_create_dom_group(TALLOC_CTX *mem_ctx, const char *name,
-                              uint32 *rid)
+                              uint32_t *rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -604 +735 @@
 static NTSTATUS pdb_default_delete_dom_group(struct pdb_methods *methods,
                                              TALLOC_CTX *mem_ctx,
-                                             uint32 rid)
-{
-        DOM_SID group_sid;
+                                             uint32_t rid)
+{
+        struct dom_sid group_sid;
         GROUP_MAP map;
         NTSTATUS status;
@@ -653 +784 @@
 }
 
-NTSTATUS pdb_delete_dom_group(TALLOC_CTX *mem_ctx, uint32 rid)
+NTSTATUS pdb_delete_dom_group(TALLOC_CTX *mem_ctx, uint32_t rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -671 +802 @@
 }
 
-NTSTATUS pdb_delete_group_mapping_entry(DOM_SID sid)
+NTSTATUS pdb_delete_group_mapping_entry(struct dom_sid sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -677 +808 @@
 }
 
-bool pdb_enum_group_mapping(const DOM_SID *sid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
+bool pdb_enum_group_mapping(const struct dom_sid *sid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
                             size_t *p_num_entries, bool unix_only)
 {
@@ -686 +817 @@
 
 NTSTATUS pdb_enum_group_members(TALLOC_CTX *mem_ctx,
-                                const DOM_SID *sid,
-                                uint32 **pp_member_rids,
+                                const struct dom_sid *sid,
+                                uint32_t **pp_member_rids,
                                 size_t *p_num_members)
 {
@@ -699 +830 @@
 
         if ( !NT_STATUS_IS_OK( result ) ) {
-                uint32 rid;
+                uint32_t rid;
 
                 sid_peek_rid( sid, &rid );
 
-                if ( rid == DOMAIN_GROUP_RID_USERS ) {
+                if ( rid == DOMAIN_RID_USERS ) {
                         *p_num_members = 0;
                         *pp_member_rids = NULL;
@@ -715 +846 @@
 
 NTSTATUS pdb_enum_group_memberships(TALLOC_CTX *mem_ctx, struct samu *user,
-                                    DOM_SID **pp_sids, gid_t **pp_gids,
-                                    size_t *p_num_groups)
+                                    struct dom_sid **pp_sids, gid_t **pp_gids,
+                                    uint32_t *p_num_groups)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -757 +888 @@
 
 static bool pdb_user_in_group(TALLOC_CTX *mem_ctx, struct samu *account,
-                              const DOM_SID *group_sid)
-{
-        DOM_SID *sids;
+                              const struct dom_sid *group_sid)
+{
+        struct dom_sid *sids;
         gid_t *gids;
-        size_t i, num_groups;
+        uint32_t i, num_groups;
 
         if (!NT_STATUS_IS_OK(pdb_enum_group_memberships(mem_ctx, account,
@@ -770 +901 @@
 
         for (i=0; i<num_groups; i++) {
-                if (sid_equal(group_sid, &sids[i])) {
+                if (dom_sid_equal(group_sid, &sids[i])) {
                         return True;
                 }
@@ -779 +910 @@
 static NTSTATUS pdb_default_add_groupmem(struct pdb_methods *methods,
                                          TALLOC_CTX *mem_ctx,
-                                         uint32 group_rid,
-                                         uint32 member_rid)
-{
-        DOM_SID group_sid, member_sid;
+                                         uint32_t group_rid,
+                                         uint32_t member_rid)
+{
+        struct dom_sid group_sid, member_sid;
         struct samu *account = NULL;
         GROUP_MAP map;
@@ -835 +966 @@
 }
 
-NTSTATUS pdb_add_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
-                          uint32 member_rid)
+NTSTATUS pdb_add_groupmem(TALLOC_CTX *mem_ctx, uint32_t group_rid,
+                          uint32_t member_rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -844 +975 @@
 static NTSTATUS pdb_default_del_groupmem(struct pdb_methods *methods,
                                          TALLOC_CTX *mem_ctx,
-                                         uint32 group_rid,
-                                         uint32 member_rid)
-{
-        DOM_SID group_sid, member_sid;
+                                         uint32_t group_rid,
+                                         uint32_t member_rid)
+{
+        struct dom_sid group_sid, member_sid;
         struct samu *account = NULL;
         GROUP_MAP map;
@@ -897 +1028 @@
 }
 
-NTSTATUS pdb_del_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
-                          uint32 member_rid)
+NTSTATUS pdb_del_groupmem(TALLOC_CTX *mem_ctx, uint32_t group_rid,
+                          uint32_t member_rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -904 +1035 @@
 }
 
-NTSTATUS pdb_create_alias(const char *name, uint32 *rid)
+NTSTATUS pdb_create_alias(const char *name, uint32_t *rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -910 +1041 @@
 }
 
-NTSTATUS pdb_delete_alias(const DOM_SID *sid)
+NTSTATUS pdb_delete_alias(const struct dom_sid *sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -916 +1047 @@
 }
 
-NTSTATUS pdb_get_aliasinfo(const DOM_SID *sid, struct acct_info *info)
+NTSTATUS pdb_get_aliasinfo(const struct dom_sid *sid, struct acct_info *info)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -922 +1053 @@
 }
 
-NTSTATUS pdb_set_aliasinfo(const DOM_SID *sid, struct acct_info *info)
+NTSTATUS pdb_set_aliasinfo(const struct dom_sid *sid, struct acct_info *info)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -928 +1059 @@
 }
 
-NTSTATUS pdb_add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
+NTSTATUS pdb_add_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -934 +1065 @@
 }
 
-NTSTATUS pdb_del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
+NTSTATUS pdb_del_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -940 +1071 @@
 }
 
-NTSTATUS pdb_enum_aliasmem(const DOM_SID *alias, TALLOC_CTX *mem_ctx,
-                           DOM_SID **pp_members, size_t *p_num_members)
+NTSTATUS pdb_enum_aliasmem(const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
+                           struct dom_sid **pp_members, size_t *p_num_members)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -949 +1080 @@
 
 NTSTATUS pdb_enum_alias_memberships(TALLOC_CTX *mem_ctx,
-                                    const DOM_SID *domain_sid,
-                                    const DOM_SID *members, size_t num_members,
-                                    uint32 **pp_alias_rids,
+                                    const struct dom_sid *domain_sid,
+                                    const struct dom_sid *members, size_t num_members,
+                                    uint32_t **pp_alias_rids,
                                     size_t *p_num_alias_rids)
 {
@@ -962 +1093 @@
 }
 
-NTSTATUS pdb_lookup_rids(const DOM_SID *domain_sid,
+NTSTATUS pdb_lookup_rids(const struct dom_sid *domain_sid,
                          int num_rids,
-                         uint32 *rids,
+                         uint32_t *rids,
                          const char **names,
                          enum lsa_SidType *attrs)
@@ -984 +1115 @@
  */
 #if 0
-NTSTATUS pdb_lookup_names(const DOM_SID *domain_sid,
+NTSTATUS pdb_lookup_names(const struct dom_sid *domain_sid,
                           int num_names,
                           const char **names,
-                          uint32 *rids,
+                          uint32_t *rids,
                           enum lsa_SidType *attrs)
 {
@@ -1025 +1156 @@
 }
 
-bool pdb_uid_to_sid(uid_t uid, DOM_SID *sid)
+bool pdb_uid_to_sid(uid_t uid, struct dom_sid *sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -1031 +1162 @@
 }
 
-bool pdb_gid_to_sid(gid_t gid, DOM_SID *sid)
+bool pdb_gid_to_sid(gid_t gid, struct dom_sid *sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -1037 +1168 @@
 }
 
-bool pdb_sid_to_id(const DOM_SID *sid, union unid_t *id,
+bool pdb_sid_to_id(const struct dom_sid *sid, union unid_t *id,
                    enum lsa_SidType *type)
 {
@@ -1057 +1188 @@
 ********************************************************************/
 
-bool pdb_new_rid(uint32 *rid)
+bool pdb_new_rid(uint32_t *rid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
         const char *name = NULL;
         enum lsa_SidType type;
-        uint32 allocated_rid = 0;
+        uint32_t allocated_rid = 0;
         int i;
         TALLOC_CTX *ctx;
@@ -1137 +1268 @@
 }
 
-static NTSTATUS pdb_default_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const DOM_SID *sid)
+static NTSTATUS pdb_default_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const struct dom_sid *sid)
 {
         return NT_STATUS_NO_SUCH_USER;
@@ -1186 +1317 @@
 
 static bool pdb_default_uid_to_sid(struct pdb_methods *methods, uid_t uid,
-                                   DOM_SID *sid)
+                                   struct dom_sid *sid)
 {
         struct samu *sampw = NULL;
@@ -1225 +1356 @@
 
 static bool pdb_default_gid_to_sid(struct pdb_methods *methods, gid_t gid,
-                                   DOM_SID *sid)
+                                   struct dom_sid *sid)
 {
         GROUP_MAP map;
@@ -1238 +1369 @@
 
 static bool pdb_default_sid_to_id(struct pdb_methods *methods,
-                                  const DOM_SID *sid,
+                                  const struct dom_sid *sid,
                                   union unid_t *id, enum lsa_SidType *type)
 {
@@ -1244 +1375 @@
         bool ret = False;
         const char *name;
-        uint32 rid;
+        uint32_t rid;
 
         mem_ctx = talloc_new(NULL);
@@ -1311 +1442 @@
 }
 
-static bool get_memberuids(TALLOC_CTX *mem_ctx, gid_t gid, uid_t **pp_uids, size_t *p_num)
+static bool get_memberuids(TALLOC_CTX *mem_ctx, gid_t gid, uid_t **pp_uids, uint32_t *p_num)
 {
         struct group *grp;
@@ -1368 +1499 @@
 static NTSTATUS pdb_default_enum_group_members(struct pdb_methods *methods,
                                                TALLOC_CTX *mem_ctx,
-                                               const DOM_SID *group,
-                                               uint32 **pp_member_rids,
+                                               const struct dom_sid *group,
+                                               uint32_t **pp_member_rids,
                                                size_t *p_num_members)
 {
         gid_t gid;
         uid_t *uids;
-        size_t i, num_uids;
+        uint32_t i, num_uids;
 
         *pp_member_rids = NULL;
@@ -1388 +1519 @@
                 return NT_STATUS_OK;
 
-        *pp_member_rids = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_uids);
+        *pp_member_rids = TALLOC_ZERO_ARRAY(mem_ctx, uint32_t, num_uids);
 
         for (i=0; i<num_uids; i++) {
-                DOM_SID sid;
+                struct dom_sid sid;
 
                 uid_to_sid(&sid, uids[i]);
@@ -1411 +1542 @@
                                                    TALLOC_CTX *mem_ctx,
                                                    struct samu *user,
-                                                   DOM_SID **pp_sids,
+                                                   struct dom_sid **pp_sids,
                                                    gid_t **pp_gids,
-                                                   size_t *p_num_groups)
+                                                   uint32_t *p_num_groups)
 {
         size_t i;
@@ -1440 +1571 @@
         }
 
-        *pp_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *p_num_groups);
+        *pp_sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, *p_num_groups);
 
         if (*pp_sids == NULL) {
@@ -1458 +1589 @@
  ********************************************************************/
 
-static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
+static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32_t rid,
                                   const char **name,
                                   enum lsa_SidType *psid_name_use,
@@ -1466 +1597 @@
         GROUP_MAP map;
         bool ret;
-        DOM_SID sid;
+        struct dom_sid sid;
 
         *psid_name_use = SID_NAME_UNKNOWN;
@@ -1473 +1604 @@
                  (unsigned int)rid));
 
-        sid_copy(&sid, get_global_sam_sid());
-        sid_append_rid(&sid, rid);
+        sid_compose(&sid, get_global_sam_sid(), rid);
 
         /* see if the passdb can help us with the name of the user */
@@ -1482 +1612 @@
         }
 
-        /* BEING ROOT BLLOCK */
+        /* BEING ROOT BLOCK */
         become_root();
         if (pdb_getsampwsid(sam_account, &sid)) {
@@ -1538 +1668 @@
         }
 
-        if ( rid == DOMAIN_GROUP_RID_USERS ) {
+        if ( rid == DOMAIN_RID_USERS ) {
                 *name = talloc_strdup(mem_ctx, "None" );
                 *psid_name_use = SID_NAME_DOM_GRP;
@@ -1549 +1679 @@
 
 static NTSTATUS pdb_default_lookup_rids(struct pdb_methods *methods,
-                                        const DOM_SID *domain_sid,
+                                        const struct dom_sid *domain_sid,
                                         int num_rids,
-                                        uint32 *rids,
+                                        uint32_t *rids,
                                         const char **names,
                                         enum lsa_SidType *attrs)
@@ -1613 +1743 @@
 #if 0
 static NTSTATUS pdb_default_lookup_names(struct pdb_methods *methods,
-                                         const DOM_SID *domain_sid,
+                                         const struct dom_sid *domain_sid,
                                          int num_names,
                                          const char **names,
-                                         uint32 *rids,
+                                         uint32_t *rids,
                                          enum lsa_SidType *attrs)
 {
@@ -1627 +1757 @@
 
                 for (i=0; i<num_names; i++) {
-                        uint32 rid;
+                        uint32_t rid;
 
                         if (lookup_builtin_name(names[i], &rid)) {
@@ -1705 +1835 @@
 }
 
-static void fill_displayentry(TALLOC_CTX *mem_ctx, uint32 rid,
-                              uint16 acct_flags,
+static void fill_displayentry(TALLOC_CTX *mem_ctx, uint32_t rid,
+                              uint16_t acct_flags,
                               const char *account_name,
                               const char *fullname,
@@ -1740 +1870 @@
 {
         struct group_search *state = (struct group_search *)s->private_data;
-        uint32 rid;
+        uint32_t rid;
         GROUP_MAP *map = &state->groups[state->current_group];
 
@@ -1762 +1892 @@
 
 static bool pdb_search_grouptype(struct pdb_search *search,
-                                 const DOM_SID *sid, enum lsa_SidType type)
+                                 const struct dom_sid *sid, enum lsa_SidType type)
 {
         struct group_search *state;
@@ -1793 +1923 @@
 static bool pdb_default_search_aliases(struct pdb_methods *methods,
                                        struct pdb_search *search,
-                                       const DOM_SID *sid)
+                                       const struct dom_sid *sid)
 {
 
@@ -1800 +1930 @@
 
 static struct samr_displayentry *pdb_search_getentry(struct pdb_search *search,
-                                                     uint32 idx)
+                                                     uint32_t idx)
 {
         if (idx < search->num_entries)
@@ -1825 +1955 @@
 }
 
-struct pdb_search *pdb_search_users(TALLOC_CTX *mem_ctx, uint32 acct_flags)
+struct pdb_search *pdb_search_users(TALLOC_CTX *mem_ctx, uint32_t acct_flags)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -1859 +1989 @@
 }
 
-struct pdb_search *pdb_search_aliases(TALLOC_CTX *mem_ctx, const DOM_SID *sid)
+struct pdb_search *pdb_search_aliases(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -1878 +2008 @@
 }
 
-uint32 pdb_search_entries(struct pdb_search *search,
-                          uint32 start_idx, uint32 max_entries,
+uint32_t pdb_search_entries(struct pdb_search *search,
+                          uint32_t start_idx, uint32_t max_entries,
                           struct samr_displayentry **result)
 {
         struct samr_displayentry *end_entry;
-        uint32 end_idx = start_idx+max_entries-1;
+        uint32_t end_idx = start_idx+max_entries-1;
 
         /* The first entry needs to be searched after the last. Otherwise the
@@ -1905 +2035 @@
  *******************************************************************/
 
-bool pdb_get_trusteddom_pw(const char *domain, char** pwd, DOM_SID *sid, 
+bool pdb_get_trusteddom_pw(const char *domain, char** pwd, struct dom_sid *sid,
                            time_t *pass_last_set_time)
 {
@@ -1914 +2044 @@
 
 bool pdb_set_trusteddom_pw(const char* domain, const char* pwd,
-                           const DOM_SID *sid)
+                           const struct dom_sid *sid)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -1926 +2056 @@
 }
 
-NTSTATUS pdb_enum_trusteddoms(TALLOC_CTX *mem_ctx, uint32 *num_domains,
+NTSTATUS pdb_enum_trusteddoms(TALLOC_CTX *mem_ctx, uint32_t *num_domains,
                               struct trustdom_info ***domains)
 {
@@ -1942 +2072 @@
                                           const char *domain, 
                                           char** pwd, 
-                                          DOM_SID *sid, 
+                                          struct dom_sid *sid,
                                           time_t *pass_last_set_time)
 {
@@ -1953 +2083 @@
                                           const char* domain, 
                                           const char* pwd,
-                                          const DOM_SID *sid)
+                                          const struct dom_sid *sid)
 {
         return secrets_store_trusted_domain_password(domain, pwd, sid);
@@ -1966 +2096 @@
 static NTSTATUS pdb_default_enum_trusteddoms(struct pdb_methods *methods,
                                              TALLOC_CTX *mem_ctx, 
-                                             uint32 *num_domains,
+                                             uint32_t *num_domains,
                                              struct trustdom_info ***domains)
 {
         return secrets_trusted_domains(mem_ctx, num_domains, domains);
+}
+
+/*******************************************************************
+ trusted_domain methods
+ *******************************************************************/
+
+NTSTATUS pdb_get_trusted_domain(TALLOC_CTX *mem_ctx, const char *domain,
+                                struct pdb_trusted_domain **td)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->get_trusted_domain(pdb, mem_ctx, domain, td);
+}
+
+NTSTATUS pdb_get_trusted_domain_by_sid(TALLOC_CTX *mem_ctx, struct dom_sid *sid,
+                                struct pdb_trusted_domain **td)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->get_trusted_domain_by_sid(pdb, mem_ctx, sid, td);
+}
+
+NTSTATUS pdb_set_trusted_domain(const char* domain,
+                                const struct pdb_trusted_domain *td)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->set_trusted_domain(pdb, domain, td);
+}
+
+NTSTATUS pdb_del_trusted_domain(const char *domain)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->del_trusted_domain(pdb, domain);
+}
+
+NTSTATUS pdb_enum_trusted_domains(TALLOC_CTX *mem_ctx, uint32_t *num_domains,
+                                  struct pdb_trusted_domain ***domains)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->enum_trusted_domains(pdb, mem_ctx, num_domains, domains);
+}
+
+static NTSTATUS pdb_default_get_trusted_domain(struct pdb_methods *methods,
+                                               TALLOC_CTX *mem_ctx,
+                                               const char *domain,
+                                               struct pdb_trusted_domain **td)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS pdb_default_get_trusted_domain_by_sid(struct pdb_methods *methods,
+                                                      TALLOC_CTX *mem_ctx,
+                                                      struct dom_sid *sid,
+                                                      struct pdb_trusted_domain **td)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS pdb_default_set_trusted_domain(struct pdb_methods *methods,
+                                               const char* domain,
+                                               const struct pdb_trusted_domain *td)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS pdb_default_del_trusted_domain(struct pdb_methods *methods,
+                                               const char *domain)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS pdb_default_enum_trusted_domains(struct pdb_methods *methods,
+                                                 TALLOC_CTX *mem_ctx,
+                                                 uint32_t *num_domains,
+                                                 struct pdb_trusted_domain ***domains)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
 }
 
@@ -1989 +2194 @@
         /* allocate memory for the structure as its own talloc CTX */
 
-        *methods = talloc_zero(talloc_autofree_context(), struct pdb_methods);
+        *methods = talloc_zero(NULL, struct pdb_methods);
         if (*methods == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -2043 +2248 @@
         (*methods)->enum_trusteddoms  = pdb_default_enum_trusteddoms;
 
+        (*methods)->get_trusted_domain = pdb_default_get_trusted_domain;
+        (*methods)->get_trusted_domain_by_sid = pdb_default_get_trusted_domain_by_sid;
+        (*methods)->set_trusted_domain = pdb_default_set_trusted_domain;
+        (*methods)->del_trusted_domain = pdb_default_del_trusted_domain;
+        (*methods)->enum_trusted_domains = pdb_default_enum_trusted_domains;
+
         return NT_STATUS_OK;
 }

trunk/server/source3/passdb/pdb_ldap.c

@@ -45 +45 @@
 
 #include "includes.h"
+#include "passdb.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "secrets.h"
+#include "idmap_cache.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/util_pw.h"
+#include "lib/winbind_util.h"
 
 #undef DBGC_CLASS
@@ -52 +58 @@
 #include <lber.h>
 #include <ldap.h>
-
-/*
- * Work around versions of the LDAP client libs that don't have the OIDs
- * defined, or have them defined under the old name.  
- * This functionality is really a factor of the server, not the client 
- *
- */
-
-#if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
-#define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
-#elif !defined(LDAP_EXOP_MODIFY_PASSWD)
-#define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
-#endif
-
-#if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
-#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
-#elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
-#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID        ((ber_tag_t) 0x80U)
-#endif
-
-#if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
-#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
-#elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
-#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW       ((ber_tag_t) 0x82U)
-#endif
 
 
@@ -85 +66 @@
  **********************************************************************/
 
-static LDAP *priv2ld(struct ldapsam_privates *priv)
+LDAP *priv2ld(struct ldapsam_privates *priv)
 {
         return priv->smbldap_state->ldap_struct;
@@ -377 +358 @@
 
 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
-                                         uint32 rid, LDAPMessage ** result,
+                                         uint32_t rid, LDAPMessage ** result,
                                          const char **attr)
 {
@@ -400 +381 @@
 
 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
-                                 const DOM_SID *sid, LDAPMessage ** result,
+                                 const struct dom_sid *sid, LDAPMessage ** result,
                                  const char **attr)
 {
@@ -530 +511 @@
                         *workstations = NULL,
                         *munged_dial = NULL;
-        uint32          user_rid;
+        uint32_t                user_rid;
         uint8           smblmpwd[LM_HASH_LEN],
                         smbntpwd[NT_HASH_LEN];
         bool            use_samba_attrs = True;
-        uint32          acct_ctrl = 0;
-        uint16          logon_divs;
-        uint16          bad_password_count = 0,
+        uint32_t                acct_ctrl = 0;
+        uint16_t                logon_divs;
+        uint16_t                bad_password_count = 0,
                         logon_count = 0;
-        uint32 hours_len;
+        uint32_t hours_len;
         uint8           hours[MAX_HOURS_LEN];
         char *temp = NULL;
-        LOGIN_CACHE     *cache_entry = NULL;
-        uint32          pwHistLen;
+        struct login_cache cache_entry;
+        uint32_t                pwHistLen;
         bool expand_explicit = lp_passdb_expand_explicit();
         bool ret = false;
@@ -605 +586 @@
                                         LDAP_ATTR_USER_RID),
                                 ctx))!=NULL) {
-                        user_rid = (uint32)atol(temp);
+                        user_rid = (uint32_t)atol(temp);
                         pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
                 }
         }
 
-        if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
+        if (IS_SAM_DEFAULT(sampass, PDB_USERSID)) {
                 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n", 
                         get_userattr_key2string(ldap_state->schema_ver,
@@ -916 +897 @@
                 pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
 
-                if ((pwhist = TALLOC_ARRAY(ctx, uint8,
-                                        pwHistLen * PW_HISTORY_ENTRY_LEN)) ==
-                                NULL){
+                pwhist = TALLOC_ARRAY(ctx, uint8,
+                                      pwHistLen * PW_HISTORY_ENTRY_LEN);
+                if (pwhist == NULL) {
                         DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
                         goto fn_exit;
@@ -986 +967 @@
                         ctx);
         if (temp) {
-                bad_password_count = (uint32) atol(temp);
+                bad_password_count = (uint32_t) atol(temp);
                 pdb_set_bad_password_count(sampass,
                                 bad_password_count, PDB_SET);
@@ -1010 +991 @@
                         ctx);
         if (temp) {
-                logon_count = (uint32) atol(temp);
+                logon_count = (uint32_t) atol(temp);
                 pdb_set_logon_count(sampass, logon_count, PDB_SET);
         }
@@ -1025 +1006 @@
                 pdb_gethexhours(temp, hours);
                 memset((char *)temp, '\0', strlen(temp) +1);
-                pdb_set_hours(sampass, hours, PDB_SET);
+                pdb_set_hours(sampass, hours, hours_len, PDB_SET);
                 ZERO_STRUCT(hours);
         }
@@ -1033 +1014 @@
                 bool have_uid = false;
                 bool have_gid = false;
-                DOM_SID mapped_gsid;
-                const DOM_SID *primary_gsid;
+                struct dom_sid mapped_gsid;
+                const struct dom_sid *primary_gsid;
 
                 ZERO_STRUCT(unix_pw);
@@ -1105 +1086 @@
                 gid_to_sid(&mapped_gsid, sampass->unix_pw->pw_gid);
                 primary_gsid = pdb_get_group_sid(sampass);
-                if (primary_gsid && sid_equal(primary_gsid, &mapped_gsid)) {
+                if (primary_gsid && dom_sid_equal(primary_gsid, &mapped_gsid)) {
                         store_gid_sid_cache(primary_gsid,
                                             sampass->unix_pw->pw_gid);
@@ -1121 +1102 @@
 
         /* see if we have newer updates */
-        if (!(cache_entry = login_cache_read(sampass))) {
+        if (!login_cache_read(sampass, &cache_entry)) {
                 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
                            (unsigned int)pdb_get_bad_password_count(sampass),
@@ -1131 +1112 @@
         DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
                   (unsigned int)ldap_entry_time,
-                  (unsigned int)cache_entry->entry_timestamp,
-                  (unsigned int)cache_entry->bad_password_time));
-
-        if (ldap_entry_time > cache_entry->entry_timestamp) {
+                  (unsigned int)cache_entry.entry_timestamp,
+                  (unsigned int)cache_entry.bad_password_time));
+
+        if (ldap_entry_time > cache_entry.entry_timestamp) {
                 /* cache is older than directory , so
                    we need to delete the entry but allow the
@@ -1143 +1124 @@
                 pdb_set_acct_ctrl(sampass,
                                   pdb_get_acct_ctrl(sampass) |
-                                  (cache_entry->acct_ctrl & ACB_AUTOLOCK),
+                                  (cache_entry.acct_ctrl & ACB_AUTOLOCK),
                                   PDB_SET);
                 pdb_set_bad_password_count(sampass,
-                                           cache_entry->bad_password_count,
+                                           cache_entry.bad_password_count,
                                            PDB_SET);
                 pdb_set_bad_password_time(sampass,
-                                          cache_entry->bad_password_time,
+                                          cache_entry.bad_password_time,
                                           PDB_SET);
         }
@@ -1158 +1139 @@
 
         TALLOC_FREE(ctx);
-        SAFE_FREE(cache_entry);
         return ret;
 }
@@ -1174 +1154 @@
 {
         char *temp = NULL;
-        uint32 rid;
+        uint32_t rid;
 
         if (mods == NULL || sampass == NULL) {
@@ -1203 +1183 @@
         if (need_update(sampass, PDB_USERSID)) {
                 fstring sid_string;
-                const DOM_SID *user_sid = pdb_get_user_sid(sampass);
+                const struct dom_sid *user_sid = pdb_get_user_sid(sampass);
 
                 switch ( ldap_state->schema_ver ) {
@@ -1240 +1220 @@
         if (need_update(sampass, PDB_GROUPSID)) {
                 fstring sid_string;
-                const DOM_SID *group_sid = pdb_get_group_sid(sampass);
+                const struct dom_sid *group_sid = pdb_get_group_sid(sampass);
 
                 switch ( ldap_state->schema_ver ) {
@@ -1398 +1378 @@
                 if (need_update(sampass, PDB_PWHISTORY)) {
                         char *pwstr = NULL;
-                        uint32 pwHistLen = 0;
+                        uint32_t pwHistLen = 0;
                         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
 
@@ -1411 +1391 @@
                         } else {
                                 int i;
-                                uint32 currHistLen = 0;
+                                uint32_t currHistLen = 0;
                                 const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
                                 if (pwhist != NULL) {
@@ -1473 +1453 @@
         if (need_update(sampass, PDB_BAD_PASSWORD_COUNT))  /* &&
             need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
-                uint16 badcount = pdb_get_bad_password_count(sampass);
+                uint16_t badcount = pdb_get_bad_password_count(sampass);
                 time_t badtime = pdb_get_bad_password_time(sampass);
-                uint32 pol;
+                uint32_t pol;
                 pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &pol);
 
@@ -1512 +1492 @@
                         login_cache_delentry(sampass);
                 } else {
-                        LOGIN_CACHE cache_entry;
+                        struct login_cache cache_entry;
 
                         cache_entry.entry_timestamp = time(NULL);
@@ -1520 +1500 @@
 
                         DEBUG(7, ("Updating bad password count and time in login cache\n"));
-                        login_cache_write(sampass, cache_entry);
+                        login_cache_write(sampass, &cache_entry);
                 }
         }
@@ -1626 +1606 @@
 
 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state, 
-                                   const DOM_SID *sid, LDAPMessage **result) 
+                                   const struct dom_sid *sid, LDAPMessage **result)
 {
         int rc = -1;
         const char ** attr_list;
-        uint32 rid;
+        uint32_t rid;
 
         switch ( ldap_state->schema_ver ) {
@@ -1676 +1656 @@
 *********************************************************************/
 
-static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const DOM_SID *sid)
+static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const struct dom_sid *sid)
 {
         struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
@@ -1737 +1717 @@
         if (!newpwd || !dn) {
                 return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (!mods) {
-                DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
-                /* may be password change below however */
-        } else {
-                switch(ldap_op) {
-                        case LDAP_MOD_ADD:
-                                if (ldap_state->is_nds_ldap) {
-                                        smbldap_set_mod(&mods, LDAP_MOD_ADD, 
-                                                        "objectclass", 
-                                                        "inetOrgPerson");
-                                } else {
-                                        smbldap_set_mod(&mods, LDAP_MOD_ADD, 
-                                                        "objectclass", 
-                                                        LDAP_OBJ_ACCOUNT);
-                                }
-                                rc = smbldap_add(ldap_state->smbldap_state, 
-                                                 dn, mods);
-                                break;
-                        case LDAP_MOD_REPLACE: 
-                                rc = smbldap_modify(ldap_state->smbldap_state, 
-                                                    dn ,mods);
-                                break;
-                        default:        
-                                DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n", 
-                                         ldap_op));
-                                return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                if (rc!=LDAP_SUCCESS) {
-                        return NT_STATUS_UNSUCCESSFUL;
-                }  
         }
 
@@ -1897 +1844 @@
                 ber_bvfree(bv);
         }
+
+        if (!mods) {
+                DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
+                /* may be password change below however */
+        } else {
+                switch(ldap_op) {
+                        case LDAP_MOD_ADD:
+                                if (ldap_state->is_nds_ldap) {
+                                        smbldap_set_mod(&mods, LDAP_MOD_ADD,
+                                                        "objectclass",
+                                                        "inetOrgPerson");
+                                } else {
+                                        smbldap_set_mod(&mods, LDAP_MOD_ADD,
+                                                        "objectclass",
+                                                        LDAP_OBJ_ACCOUNT);
+                                }
+                                rc = smbldap_add(ldap_state->smbldap_state,
+                                                 dn, mods);
+                                break;
+                        case LDAP_MOD_REPLACE:
+                                rc = smbldap_modify(ldap_state->smbldap_state,
+                                                    dn ,mods);
+                                break;
+                        default:
+                                DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
+                                         ldap_op));
+                                return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                if (rc!=LDAP_SUCCESS) {
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+        }
+
         return NT_STATUS_OK;
 }
@@ -2070 +2051 @@
 static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
                                      TALLOC_CTX *tmp_ctx,
-                                     uint32 group_rid,
-                                     uint32 member_rid);
+                                     uint32_t group_rid,
+                                     uint32_t member_rid);
 
 static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
                                                TALLOC_CTX *mem_ctx,
                                                struct samu *user,
-                                               DOM_SID **pp_sids,
+                                               struct dom_sid **pp_sids,
                                                gid_t **pp_gids,
-                                               size_t *p_num_groups);
+                                               uint32_t *p_num_groups);
 
 static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
@@ -2177 +2158 @@
         LDAPMod         **mods = NULL;
         int             ldap_op = LDAP_MOD_REPLACE;
-        uint32          num_result;
+        uint32_t                num_result;
         const char      **attr_list;
         char *escape_user = NULL;
         const char      *username = pdb_get_username(newpwd);
-        const DOM_SID   *sid = pdb_get_user_sid(newpwd);
+        const struct dom_sid    *sid = pdb_get_user_sid(newpwd);
         char *filter = NULL;
         char *dn = NULL;
@@ -2594 +2575 @@
 
 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-                                 DOM_SID sid)
+                                 struct dom_sid sid)
 {
         char *filter = NULL;
@@ -2664 +2645 @@
 static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
                                            LDAPMessage *entry,
-                                           const DOM_SID *domain_sid,
-                                           uint32 *rid)
+                                           const struct dom_sid *domain_sid,
+                                           uint32_t *rid)
 {
         fstring str;
-        DOM_SID sid;
+        struct dom_sid sid;
 
         if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
@@ -2681 +2662 @@
         }
 
-        if (sid_compare_domain(&sid, domain_sid) != 0) {
+        if (dom_sid_compare_domain(&sid, domain_sid) != 0) {
                 DEBUG(10, ("SID %s is not in expected domain %s\n",
                            str, sid_string_dbg(domain_sid)));
@@ -2697 +2678 @@
 static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
                                            TALLOC_CTX *mem_ctx,
-                                           const DOM_SID *group,
-                                           uint32 **pp_member_rids,
+                                           const struct dom_sid *group,
+                                           uint32_t **pp_member_rids,
                                            size_t *p_num_members)
 {
@@ -2815 +2796 @@
                 {
                         char *sidstr;
-                        DOM_SID sid;
-                        uint32 rid;
+                        struct dom_sid sid;
+                        uint32_t rid;
 
                         sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
@@ -2867 +2848 @@
              entry = ldap_next_entry(conn->ldap_struct, entry))
         {
-                uint32 rid;
+                uint32_t rid;
 
                 if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
@@ -2898 +2879 @@
                                                TALLOC_CTX *mem_ctx,
                                                struct samu *user,
-                                               DOM_SID **pp_sids,
+                                               struct dom_sid **pp_sids,
                                                gid_t **pp_gids,
-                                               size_t *p_num_groups)
+                                               uint32_t *p_num_groups)
 {
         struct ldapsam_privates *ldap_state =
@@ -2912 +2893 @@
         LDAPMessage *entry;
         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
-        size_t num_sids, num_gids;
+        uint32_t num_sids;
+        uint32_t num_gids;
         char *gidstr;
         gid_t primary_gid = -1;
@@ -3015 +2997 @@
         {
                 fstring str;
-                DOM_SID sid;
+                struct dom_sid sid;
                 gid_t gid;
                 char *end;
@@ -3053 +3035 @@
         }
 
-        if (sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
+        if (dom_sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
                 DEBUG(3, ("primary group of [%s] not found\n",
                           pdb_get_username(user)));
@@ -3140 +3122 @@
         NTSTATUS result;
 
-        DOM_SID sid;
+        struct dom_sid sid;
 
         int rc;
@@ -3345 +3327 @@
 
 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
-                                                   DOM_SID sid)
+                                                   struct dom_sid sid)
 {
         struct ldapsam_privates *priv =
@@ -3508 +3490 @@
 
 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
-                                           const DOM_SID *domsid, enum lsa_SidType sid_name_use,
+                                           const struct dom_sid *domsid, enum lsa_SidType sid_name_use,
                                            GROUP_MAP **pp_rmap,
                                            size_t *p_num_entries,
                                            bool unix_only)
 {
-        GROUP_MAP map;
+        GROUP_MAP map = { 0, };
         size_t entries = 0;
 
@@ -3558 +3540 @@
 
 static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
-                                        const DOM_SID *alias,
-                                        const DOM_SID *member,
+                                        const struct dom_sid *alias,
+                                        const struct dom_sid *member,
                                         int modop)
 {
@@ -3663 +3645 @@
 
 static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
-                                     const DOM_SID *alias,
-                                     const DOM_SID *member)
+                                     const struct dom_sid *alias,
+                                     const struct dom_sid *member)
 {
         return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
@@ -3670 +3652 @@
 
 static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
-                                     const DOM_SID *alias,
-                                     const DOM_SID *member)
+                                     const struct dom_sid *alias,
+                                     const struct dom_sid *member)
 {
         return ldapsam_modify_aliasmem(methods, alias, member,
@@ -3678 +3660 @@
 
 static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
-                                      const DOM_SID *alias,
+                                      const struct dom_sid *alias,
                                       TALLOC_CTX *mem_ctx,
-                                      DOM_SID **pp_members,
+                                      struct dom_sid **pp_members,
                                       size_t *p_num_members)
 {
@@ -3691 +3673 @@
         int i;
         char *filter = NULL;
-        size_t num_members = 0;
+        uint32_t num_members = 0;
         enum lsa_SidType type = SID_NAME_USE_NONE;
         fstring tmp;
@@ -3766 +3748 @@
 
         for (i=0; i<count; i++) {
-                DOM_SID member;
+                struct dom_sid member;
                 NTSTATUS status;
 
@@ -3790 +3772 @@
 static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
                                           TALLOC_CTX *mem_ctx,
-                                          const DOM_SID *domain_sid,
-                                          const DOM_SID *members,
+                                          const struct dom_sid *domain_sid,
+                                          const struct dom_sid *members,
                                           size_t num_members,
-                                          uint32 **pp_alias_rids,
+                                          uint32_t **pp_alias_rids,
                                           size_t *p_num_alias_rids)
 {
@@ -3871 +3853 @@
         {
                 fstring sid_str;
-                DOM_SID sid;
-                uint32 rid;
+                struct dom_sid sid;
+                uint32_t rid;
 
                 if (!smbldap_get_single_attribute(ldap_struct, entry,
@@ -3909 +3891 @@
 static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
                                                    enum pdb_policy_type type,
-                                                   uint32 value)
+                                                   uint32_t value)
 {
         NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
@@ -3965 +3947 @@
 static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
                                                      enum pdb_policy_type type,
-                                                     uint32 *value)
+                                                     uint32_t *value)
 {
         NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
@@ -3997 +3979 @@
         attrs[1] = NULL;
 
-        filter = talloc_asprintf(NULL, "(objectClass=%s)", LDAP_OBJ_DOMINFO);
+        filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)", LDAP_OBJ_DOMINFO);
         if (filter == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -4004 +3986 @@
                             LDAP_SCOPE_BASE, filter, attrs, 0,
                             &result);
-
+        TALLOC_FREE(filter);
         if (rc != LDAP_SUCCESS) {
                 return ntstatus;
@@ -4024 +4006 @@
         }
 
-        *value = (uint32)atol(vals[0]);
+        *value = (uint32_t)atol(vals[0]);
 
         ntstatus = NT_STATUS_OK;
@@ -4100 +4082 @@
 
 static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
-                                    const DOM_SID *domain_sid,
+                                    const struct dom_sid *domain_sid,
                                     int num_rids,
-                                    uint32 *rids,
+                                    uint32_t *rids,
                                     const char **names,
                                     enum lsa_SidType *attrs)
@@ -4143 +4125 @@
 
         for (i=0; i<num_rids; i++) {
-                DOM_SID sid;
+                struct dom_sid sid;
                 sid_compose(&sid, domain_sid, rids[i]);
                 allsids = talloc_asprintf_append_buffer(
@@ -4183 +4165 @@
              entry != NULL;
              entry = ldap_next_entry(ld, entry)) {
-                uint32 rid;
+                uint32_t rid;
                 int rid_index;
                 const char *name;
@@ -4257 +4239 @@
              entry = ldap_next_entry(ld, entry))
         {
-                uint32 rid;
+                uint32_t rid;
                 int rid_index;
                 const char *attr;
@@ -4348 +4330 @@
 }
 
-const char **talloc_attrs(TALLOC_CTX *mem_ctx, ...)
+static const char **talloc_attrs(TALLOC_CTX *mem_ctx, ...)
 {
         int i, num = 0;
@@ -4381 +4363 @@
         struct smbldap_state *connection;
 
-        uint32 acct_flags;
-        uint16 group_type;
+        uint32_t acct_flags;
+        uint16_t group_type;
 
         const char *base;
@@ -4557 +4539 @@
         char **vals;
         size_t converted_size;
-        DOM_SID sid;
-        uint32 acct_flags;
+        struct dom_sid sid;
+        uint32_t acct_flags;
 
         vals = ldap_get_values(ld, entry, "sambaAcctFlags");
@@ -4650 +4632 @@
 static bool ldapsam_search_users(struct pdb_methods *methods,
                                  struct pdb_search *search,
-                                 uint32 acct_flags)
+                                 uint32_t acct_flags)
 {
         struct ldapsam_privates *ldap_state =
@@ -4703 +4685 @@
         char **vals;
         size_t converted_size;
-        DOM_SID sid;
-        uint16 group_type;
+        struct dom_sid sid;
+        uint16_t group_type;
 
         result->account_name = "";
@@ -4811 +4793 @@
 
                 default:
-                        DEBUG(0,("unkown group type: %d\n", group_type));
+                        DEBUG(0,("unknown group type: %d\n", group_type));
                         return False;
         }
@@ -4822 +4804 @@
 static bool ldapsam_search_grouptype(struct pdb_methods *methods,
                                      struct pdb_search *search,
-                                     const DOM_SID *sid,
+                                     const struct dom_sid *sid,
                                      enum lsa_SidType type)
 {
@@ -4874 +4856 @@
 static bool ldapsam_search_aliases(struct pdb_methods *methods,
                                    struct pdb_search *search,
-                                   const DOM_SID *sid)
+                                   const struct dom_sid *sid)
 {
         return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
@@ -4885 +4867 @@
 
 static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
-                                    uint32 *rid)
+                                    uint32_t *rid)
 {
         struct smbldap_state *smbldap_state = priv->smbldap_state;
@@ -4895 +4877 @@
         char *value;
         int rc;
-        uint32 nextRid = 0;
+        uint32_t nextRid = 0;
         const char *dn;
 
@@ -4932 +4914 @@
                                                 "sambaNextRid", mem_ctx);
         if (value != NULL) {
-                uint32 tmp = (uint32)strtoul(value, NULL, 10);
+                uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
                 nextRid = MAX(nextRid, tmp);
         }
@@ -4939 +4921 @@
                                                 "sambaNextUserRid", mem_ctx);
         if (value != NULL) {
-                uint32 tmp = (uint32)strtoul(value, NULL, 10);
+                uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
                 nextRid = MAX(nextRid, tmp);
         }
@@ -4946 +4928 @@
                                                 "sambaNextGroupRid", mem_ctx);
         if (value != NULL) {
-                uint32 tmp = (uint32)strtoul(value, NULL, 10);
+                uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
                 nextRid = MAX(nextRid, tmp);
         }
@@ -4981 +4963 @@
 }
 
-static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods *methods, uint32 *rid)
+static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods *methods, uint32_t *rid)
 {
         int i;
@@ -5003 +4985 @@
 }
 
-static bool ldapsam_new_rid(struct pdb_methods *methods, uint32 *rid)
+static bool ldapsam_new_rid(struct pdb_methods *methods, uint32_t *rid)
 {
         NTSTATUS result = ldapsam_new_rid_internal(methods, rid);
@@ -5010 +4992 @@
 
 static bool ldapsam_sid_to_id(struct pdb_methods *methods,
-                              const DOM_SID *sid,
+                              const struct dom_sid *sid,
                               union unid_t *id, enum lsa_SidType *type)
 {
@@ -5107 +5089 @@
  */
 static bool ldapsam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
-                               DOM_SID *sid)
+                               struct dom_sid *sid)
 {
         struct ldapsam_privates *priv =
@@ -5117 +5099 @@
         bool ret = false;
         char *user_sid_string;
-        DOM_SID *user_sid;
+        struct dom_sid user_sid;
         int rc;
         TALLOC_CTX *tmp_ctx = talloc_stackframe();
@@ -5156 +5138 @@
         }
 
-        user_sid = string_sid_talloc(tmp_ctx, user_sid_string);
-        if (user_sid == NULL) {
+        if (!string_to_sid(&user_sid, user_sid_string)) {
                 DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
                           user_sid_string));
@@ -5163 +5144 @@
         }
 
-        sid_copy(sid, user_sid);
+        sid_copy(sid, &user_sid);
 
         store_uid_sid_cache(sid, uid);
@@ -5180 +5161 @@
  */
 static bool ldapsam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
-                               DOM_SID *sid)
+                               struct dom_sid *sid)
 {
         struct ldapsam_privates *priv =
@@ -5190 +5171 @@
         bool ret = false;
         char *group_sid_string;
-        DOM_SID group_sid;
+        struct dom_sid group_sid;
         int rc;
         TALLOC_CTX *tmp_ctx = talloc_stackframe();
@@ -5262 +5243 @@
 static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
                                     TALLOC_CTX *tmp_ctx, const char *name,
-                                    uint32 acb_info, uint32 *rid)
+                                    uint32_t acb_info, uint32_t *rid)
 {
         struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
         LDAPMessage *entry = NULL;
         LDAPMessage *result = NULL;
-        uint32 num_result;
+        uint32_t num_result;
         bool is_machine = False;
         bool add_posix = False;
@@ -5279 +5260 @@
         char *shell;
         const char *dn = NULL;
-        DOM_SID group_sid;
-        DOM_SID user_sid;
+        struct dom_sid group_sid;
+        struct dom_sid user_sid;
         gid_t gid = -1;
         uid_t uid = -1;
@@ -5387 +5368 @@
         }
 
-        if (!init_ldap_from_sam(ldap_state, NULL, &mods, user, element_is_set_or_changed)) {
+        if (!init_ldap_from_sam(ldap_state, entry, &mods, user, element_is_set_or_changed)) {
                 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
                 return NT_STATUS_UNSUCCESSFUL;
@@ -5403 +5384 @@
 
                 /* retrieve the Domain Users group gid */
-                if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS) ||
+                if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_RID_USERS) ||
                     !sid_to_gid(&group_sid, &gid)) {
                         DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
@@ -5534 +5515 @@
                 struct dom_sid *sids = NULL;
                 gid_t *gids = NULL;
-                size_t num_groups = 0;
+                uint32_t num_groups = 0;
                 int i;
                 uint32_t user_rid = pdb_get_user_rid(sam_acct);
@@ -5584 +5565 @@
                                          TALLOC_CTX *tmp_ctx,
                                          const char *name,
-                                         uint32 *rid)
+                                         uint32_t *rid)
 {
         struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
@@ -5590 +5571 @@
         LDAPMessage *entry = NULL;
         LDAPMessage *result = NULL;
-        uint32 num_result;
+        uint32_t num_result;
         bool is_new_entry = False;
         LDAPMod **mods = NULL;
@@ -5599 +5580 @@
         char *gidstr;
         const char *dn = NULL;
-        DOM_SID group_sid;
+        struct dom_sid group_sid;
         gid_t gid = -1;
         int rc;
@@ -5656 +5637 @@
 
         if (num_result == 0) {
+                is_new_entry = true;
+        }
+
+        if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
+                DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
+                return ret;
+        }
+
+        sid_compose(&group_sid, get_global_sam_sid(), *rid);
+
+        groupsidstr = talloc_strdup(tmp_ctx, sid_string_talloc(tmp_ctx,
+                                                               &group_sid));
+        grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
+
+        if (!groupsidstr || !grouptype) {
+                DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
+        smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
+        smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
+        smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
+
+        if (is_new_entry) {
                 char *escape_name;
 
                 DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
-
-                is_new_entry = True;
 
                 /* lets allocate a new groupid for this group */
@@ -5690 +5694 @@
         }
 
-        if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
-                DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
-                return ret;
-        }
-
-        sid_compose(&group_sid, get_global_sam_sid(), *rid);
-
-        groupsidstr = talloc_strdup(tmp_ctx, sid_string_talloc(tmp_ctx,
-                                                               &group_sid));
-        grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
-
-        if (!groupsidstr || !grouptype) {
-                DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
-        smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
-        smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
-        smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
         talloc_autofree_ldapmod(tmp_ctx, mods);
 
@@ -5736 +5720 @@
 }
 
-static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods *my_methods, TALLOC_CTX *tmp_ctx, uint32 rid)
+static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods *my_methods, TALLOC_CTX *tmp_ctx, uint32_t rid)
 {
         struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
@@ -5745 +5729 @@
         char *gidstr;
         char *filter;
-        DOM_SID group_sid;
+        struct dom_sid group_sid;
         int rc;
 
@@ -5832 +5816 @@
 static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
                                         TALLOC_CTX *tmp_ctx,
-                                        uint32 group_rid,
-                                        uint32 member_rid,
+                                        uint32_t group_rid,
+                                        uint32_t member_rid,
                                         int modop)
 {
@@ -5839 +5823 @@
         LDAPMessage *entry = NULL;
         LDAPMessage *result = NULL;
-        uint32 num_result;
+        uint32_t num_result;
         LDAPMod **mods = NULL;
         char *filter;
         char *uidstr;
         const char *dn = NULL;
-        DOM_SID group_sid;
-        DOM_SID member_sid;
+        struct dom_sid group_sid;
+        struct dom_sid member_sid;
         int rc;
 
@@ -5994 +5978 @@
 static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
                                      TALLOC_CTX *tmp_ctx,
-                                     uint32 group_rid,
-                                     uint32 member_rid)
+                                     uint32_t group_rid,
+                                     uint32_t member_rid)
 {
         return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
@@ -6001 +5985 @@
 static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
                                      TALLOC_CTX *tmp_ctx,
-                                     uint32 group_rid,
-                                     uint32 member_rid)
+                                     uint32_t group_rid,
+                                     uint32_t member_rid)
 {
         return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
@@ -6014 +5998 @@
         LDAPMessage *entry = NULL;
         LDAPMessage *result = NULL;
-        uint32 num_result;
+        uint32_t num_result;
         LDAPMod **mods = NULL;
         char *filter;
@@ -6129 +6113 @@
         LDAPMessage *result = NULL;
         char *trusted_dn;
-        uint32 num_result;
+        uint32_t num_result;
 
         filter = talloc_asprintf(talloc_tos(),
@@ -6179 +6163 @@
                                       const char *domain,
                                       char** pwd,
-                                      DOM_SID *sid,
+                                      struct dom_sid *sid,
                                       time_t *pass_last_set_time)
 {
@@ -6223 +6207 @@
         if (sid != NULL) {
                 char *sid_str;
-                DOM_SID *dom_sid;
+                struct dom_sid dom_sid;
                 sid_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
                                                           entry, "sambaSID",
@@ -6230 +6214 @@
                         return False;
                 }
-                dom_sid = string_sid_talloc(talloc_tos(), sid_str);
-                if (dom_sid == NULL) {
+                if (!string_to_sid(&dom_sid, sid_str)) {
                         return False;
                 }
-                sid_copy(sid, dom_sid);
+                sid_copy(sid, &dom_sid);
         }
 
@@ -6243 +6226 @@
                                       const char* domain,
                                       const char* pwd,
-                                      const DOM_SID *sid)
+                                      const struct dom_sid *sid)
 {
         struct ldapsam_privates *ldap_state =
@@ -6341 +6324 @@
 static NTSTATUS ldapsam_enum_trusteddoms(struct pdb_methods *methods,
                                          TALLOC_CTX *mem_ctx,
-                                         uint32 *num_domains,
+                                         uint32_t *num_domains,
                                          struct trustdom_info ***domains)
 {
@@ -6558 +6541 @@
         NTSTATUS nt_status;
         struct ldapsam_privates *ldap_state = NULL;
-        uint32 alg_rid_base;
+        uint32_t alg_rid_base;
         char *alg_rid_base_string = NULL;
         LDAPMessage *result = NULL;
         LDAPMessage *entry = NULL;
-        DOM_SID ldap_domain_sid;
-        DOM_SID secrets_domain_sid;
+        struct dom_sid ldap_domain_sid;
+        struct dom_sid secrets_domain_sid;
         char *domain_sid_string = NULL;
         char *dn = NULL;
@@ -6570 +6553 @@
         trim_char( uri, '\"', '\"' );
         nt_status = pdb_init_ldapsam_common(pdb_method, uri);
-        if (uri) {
-                TALLOC_FREE(uri);
-        }
+
+        TALLOC_FREE(uri);
 
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6622 +6604 @@
                 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
                              "will be unable to allocate new users/groups, "
-                             "and will risk BDCs having inconsistant SIDs\n"));
+                             "and will risk BDCs having inconsistent SIDs\n"));
                 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
                 return NT_STATUS_OK;
@@ -6666 +6648 @@
                 found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
                                                      &secrets_domain_sid);
-                if (!found_sid || !sid_equal(&secrets_domain_sid,
+                if (!found_sid || !dom_sid_equal(&secrets_domain_sid,
                                              &ldap_domain_sid)) {
                         DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
@@ -6691 +6673 @@
                     talloc_tos());
         if (alg_rid_base_string) {
-                alg_rid_base = (uint32)atol(alg_rid_base_string);
+                alg_rid_base = (uint32_t)atol(alg_rid_base_string);
                 if (alg_rid_base != algorithmic_rid_base()) {
                         DEBUG(0, ("The value of 'algorithmic RID base' has "
@@ -6719 +6701 @@
         pdb_nds_init();
 
+        pdb_ipa_init();
+
         return NT_STATUS_OK;
 }

trunk/server/source3/passdb/pdb_nds.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include "passdb.h"
 
 #include <lber.h>

trunk/server/source3/passdb/pdb_smbpasswd.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "system/passwd.h"
+#include "system/filesys.h"
+#include "../librpc/gen_ndr/samr.h"
+#include "../libcli/security/security.h"
 
 #undef DBGC_CLASS
@@ -31 +36 @@
    stored by an smbpasswd entry 
  */
- 
+
 struct smb_passwd
 {
@@ -40 +45 @@
         const unsigned char *smb_nt_passwd; /* Null if no password */
 
-        uint16 acct_ctrl;             /* account info (ACB_xxxx bit-mask) */
+        uint16_t acct_ctrl;             /* account info (ACB_xxxx bit-mask) */
         time_t pass_last_set_time;    /* password last set time */
 };
@@ -48 +53 @@
         /* used for maintain locks on the smbpasswd file */
         int     pw_file_lock_depth;
-        
+
         /* Global File pointer */
         FILE    *pw_file;
-        
+
         /* formerly static variables */
         struct smb_passwd pw_buf;
@@ -70 +75 @@
 ****************************************************************/
 
-static void gotalarm_sig(void)
+static void gotalarm_sig(int signum)
 {
         gotalarm = 1;
@@ -87 +92 @@
 
         gotalarm = 0;
-        oldsig_handler = CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
+        oldsig_handler = CatchSignal(SIGALRM, gotalarm_sig);
 
         lock.l_type = type;
@@ -99 +104 @@
         ret = fcntl(fd, SMB_F_SETLKW, &lock);
         alarm(0);
-        CatchSignal(SIGALRM, SIGNAL_CAST oldsig_handler);
+        CatchSignal(SIGALRM, oldsig_handler);
 
         if (gotalarm && ret == -1) {
@@ -169 +174 @@
                 return;
         ZERO_STRUCTP (user);
-        
+
         user->pass_last_set_time = (time_t)0;
 }
@@ -224 +229 @@
                                 break;
                         }
-        }
-                       
+                default:
+                        DEBUG(10, ("Invalid open mode: %d\n", type));
+                        return NULL;
+        }
+
         for(race_loop = 0; race_loop < 5; race_loop++) {
                 DEBUG(10, ("startsmbfilepwent_internal: opening file %s\n", pfile));
@@ -621 +629 @@
         slprintf((char *)p, new_entry_length - 1 - (p - new_entry),  "%s:LCT-%08X:\n",
                 pdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN),
-                (uint32)newpwd->pass_last_set_time);
+                (uint32_t)newpwd->pass_last_set_time);
 
         return new_entry;
@@ -1010 +1018 @@
                         sizeof(ascii_p16)-(strlen(ascii_p16)+1),
                         "%s:LCT-%08X:", 
-                        encode_bits, (uint32)pwd->pass_last_set_time );
+                        encode_bits, (uint32_t)pwd->pass_last_set_time );
                 wr_len = strlen(ascii_p16);
         }
@@ -1174 +1182 @@
          * Do an atomic rename - then release the locks.
          */
+
 #ifdef __OS2__
         endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
         endsmbfilepwent(fp_write,&pfile2_lockdepth);
 #endif
-
         if(rename(pfile2,pfile) != 0) {
                 unlink(pfile2);
@@ -1198 +1206 @@
 static bool build_smb_pass (struct smb_passwd *smb_pw, const struct samu *sampass)
 {
-        uint32 rid;
+        uint32_t rid;
 
         if (sampass == NULL) 
@@ -1206 +1214 @@
         if (!IS_SAM_DEFAULT(sampass, PDB_USERSID)) {
                 rid = pdb_get_user_rid(sampass);
-                
+
                 /* If the user specified a RID, make sure its able to be both stored and retreived */
-                if (rid == DOMAIN_USER_RID_GUEST) {
+                if (rid == DOMAIN_RID_GUEST) {
                         struct passwd *passwd = Get_Pwnam_alloc(NULL, lp_guestaccount());
                         if (!passwd) {
-                                DEBUG(0, ("Could not find guest account via getpwnam()! (%s)\n", lp_guestaccount()));
+                                DEBUG(0, ("Could not find guest account via Get_Pwnam_alloc()! (%s)\n", lp_guestaccount()));
                                 return False;
                         }
@@ -1243 +1251 @@
 {
         struct passwd *pwfile;
-        
+
         if ( !sam_pass ) {
                 DEBUG(5,("build_sam_account: struct samu is NULL\n"));
@@ -1256 +1264 @@
                         return False;
         }
-        
+
         if ( !NT_STATUS_IS_OK( samu_set_unix(sam_pass, pwfile )) )
                 return False;
-                
+
         TALLOC_FREE(pwfile);
 
         /* set remaining fields */
-                
+
         if (!pdb_set_nt_passwd (sam_pass, pw_buf->smb_nt_passwd, PDB_SET))
                 return False;
@@ -1271 +1279 @@
         pdb_set_pass_last_set_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET);
         pdb_set_pass_can_change_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET);
-        
+
         return True;
 }
@@ -1307 +1315 @@
         while ( ((smb_pw=getsmbfilepwent(smbpasswd_state, fp)) != NULL)&& (!strequal(smb_pw->smb_name, username)) )
                 /* do nothing....another loop */ ;
-        
+
         endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth));
 
@@ -1314 +1322 @@
         if (smb_pw == NULL)
                 return nt_status;
-        
+
         DEBUG(10, ("getsampwnam (smbpasswd): found by name: %s\n", smb_pw->smb_name));
 
@@ -1321 +1329 @@
                 return nt_status;
         }
-                
+
         /* now build the struct samu */
         if (!build_sam_account(smbpasswd_state, sam_acct, smb_pw))
@@ -1330 +1338 @@
 }
 
-static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, struct samu *sam_acct, const DOM_SID *sid)
+static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, struct samu *sam_acct, const struct dom_sid *sid)
 {
         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
@@ -1336 +1344 @@
         struct smb_passwd *smb_pw;
         FILE *fp = NULL;
-        uint32 rid;
-        
+        uint32_t rid;
+
         DEBUG(10, ("smbpasswd_getsampwrid: search by sid: %s\n",
                    sid_string_dbg(sid)));
@@ -1345 +1353 @@
 
         /* More special case 'guest account' hacks... */
-        if (rid == DOMAIN_USER_RID_GUEST) {
+        if (rid == DOMAIN_RID_GUEST) {
                 const char *guest_account = lp_guestaccount();
                 if (!(guest_account && *guest_account)) {
@@ -1371 +1379 @@
         if (smb_pw == NULL)
                 return nt_status;
-        
+
         DEBUG(10, ("getsampwrid (smbpasswd): found by name: %s\n", smb_pw->smb_name));
-                
+
         if (!sam_acct) {
                 DEBUG(10,("getsampwrid: (smbpasswd) struct samu is NULL\n"));
@@ -1384 +1392 @@
 
         /* build_sam_account might change the SID on us, if the name was for the guest account */
-        if (NT_STATUS_IS_OK(nt_status) && !sid_equal(pdb_get_user_sid(sam_acct), sid)) {
+        if (NT_STATUS_IS_OK(nt_status) && !dom_sid_equal(pdb_get_user_sid(sam_acct), sid)) {
                 DEBUG(1, ("looking for user with sid %s instead returned %s "
                           "for account %s!?!\n", sid_string_dbg(sid),
@@ -1400 +1408 @@
         struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
         struct smb_passwd smb_pw;
-        
+
         /* convert the struct samu */
         if (!build_smb_pass(&smb_pw, sampass)) {
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        
+
         /* add the entry */
         return add_smbfilepwd_entry(smbpasswd_state, &smb_pw);
@@ -1414 +1422 @@
         struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
         struct smb_passwd smb_pw;
-        
+
         /* convert the struct samu */
         if (!build_smb_pass(&smb_pw, sampass)) {
@@ -1420 +1428 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        
+
         /* update the entry */
         if(!mod_smbfilepwd_entry(smbpasswd_state, &smb_pw)) {
@@ -1426 +1434 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        
+
         return NT_STATUS_OK;
 }
@@ -1458 +1466 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         if ( !pdb_copy_sam_account( new_acct, old_acct ) 
                 || !pdb_set_username(new_acct, newname, PDB_CHANGED)) 
@@ -1529 +1537 @@
         if (new_acct)
                 TALLOC_FREE(new_acct);
-        
+
         return (ret);   
 }
@@ -1541 +1549 @@
 {
         struct smbpasswd_privates **privates = (struct smbpasswd_privates**)vp;
-        
+
         endsmbfilepwent((*privates)->pw_file, &((*privates)->pw_file_lock_depth));
-        
+
         *privates = NULL;
         /* No need to free any further, as it is talloc()ed */
@@ -1711 +1719 @@
                 privates->smbpasswd_file = talloc_strdup(*pdb_method, lp_smb_passwd_file());
         }
-        
+
         if (!privates->smbpasswd_file) {
                 DEBUG(0, ("talloc_strdp() failed for storing smbpasswd location!\n"));

trunk/server/source3/passdb/pdb_tdb.c

@@ -24 +24 @@
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "passdb.h"
+#include "dbwrap.h"
+#include "../libcli/security/security.h"
+#include "util_tdb.h"
 
 #if 0 /* when made a module use this */
@@ -618 +623 @@
 
 static NTSTATUS tdbsam_getsampwsid(struct pdb_methods *my_methods,
-                                   struct samu * user, const DOM_SID *sid)
+                                   struct samu * user, const struct dom_sid *sid)
 {
         uint32 rid;

trunk/server/source3/passdb/pdb_wbc_sam.c

@@ -38 +38 @@
 
 #include "includes.h"
+#include "passdb.h"
+#include "lib/winbind_util.h"
 
 /***************************************************************************
@@ -51 +53 @@
                 return NT_STATUS_NO_SUCH_USER;
 
-        memset(user, 0, sizeof(user));
+        ZERO_STRUCTP(user);
 
         /* Can we really get away with this little of information */
@@ -65 +67 @@
 }
 
-static NTSTATUS pdb_wbc_sam_getsampwsid(struct pdb_methods *methods, struct samu *user, const DOM_SID *sid)
+static NTSTATUS pdb_wbc_sam_getsampwsid(struct pdb_methods *methods, struct samu *user, const struct dom_sid *sid)
 {
         return _pdb_wbc_sam_getsampw(methods, user, winbind_getpwsid(sid));
@@ -71 +73 @@
 
 static bool pdb_wbc_sam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
-                                   DOM_SID *sid)
+                                   struct dom_sid *sid)
 {
         return winbind_uid_to_sid(sid, uid);
@@ -77 +79 @@
 
 static bool pdb_wbc_sam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
-                                   DOM_SID *sid)
+                                   struct dom_sid *sid)
 {
         return winbind_gid_to_sid(sid, gid);
@@ -84 +86 @@
 static NTSTATUS pdb_wbc_sam_enum_group_members(struct pdb_methods *methods,
                                                TALLOC_CTX *mem_ctx,
-                                               const DOM_SID *group,
+                                               const struct dom_sid *group,
                                                uint32 **pp_member_rids,
                                                size_t *p_num_members)
@@ -94 +96 @@
                                                    TALLOC_CTX *mem_ctx,
                                                    struct samu *user,
-                                                   DOM_SID **pp_sids,
+                                                   struct dom_sid **pp_sids,
                                                    gid_t **pp_gids,
-                                                   size_t *p_num_groups)
+                                                   uint32_t *p_num_groups)
 {
         size_t i;
@@ -111 +113 @@
         }
 
-        *pp_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *p_num_groups);
+        *pp_sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, *p_num_groups);
 
         if (*pp_sids == NULL) {
@@ -126 +128 @@
 
 static NTSTATUS pdb_wbc_sam_lookup_rids(struct pdb_methods *methods,
-                                        const DOM_SID *domain_sid,
+                                        const struct dom_sid *domain_sid,
                                         int num_rids,
                                         uint32 *rids,
@@ -186 +188 @@
 static bool pdb_wbc_sam_search_aliases(struct pdb_methods *methods,
                                        struct pdb_search *search,
-                                       const DOM_SID *sid)
+                                       const struct dom_sid *sid)
 {
 
@@ -195 +197 @@
                                           const char *domain,
                                           char **pwd,
-                                          DOM_SID *sid,
+                                          struct dom_sid *sid,
                                           time_t *pass_last_set_time)
 {
@@ -205 +207 @@
                                           const char *domain,
                                           const char *pwd,
-                                          const DOM_SID *sid)
+                                          const struct dom_sid *sid)
 {
         return false;
@@ -224 +226 @@
 }
 
-static bool _make_group_map(struct pdb_methods *methods, const char *domain, const char *name, enum lsa_SidType name_type, gid_t gid, DOM_SID *sid, GROUP_MAP *map)
+static bool _make_group_map(struct pdb_methods *methods, const char *domain, const char *name, enum lsa_SidType name_type, gid_t gid, struct dom_sid *sid, GROUP_MAP *map)
 {
         snprintf(map->nt_name, sizeof(map->nt_name), "%s%c%s",
@@ -235 +237 @@
 
 static NTSTATUS pdb_wbc_sam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-                                 DOM_SID sid)
+                                 struct dom_sid sid)
 {
         NTSTATUS result = NT_STATUS_OK;
@@ -279 +281 @@
         char *name = NULL;
         char *domain = NULL;
-        DOM_SID sid;
+        struct dom_sid sid;
         enum lsa_SidType name_type;
 
@@ -318 +320 @@
         NTSTATUS result = NT_STATUS_OK;
         const char *domain = "";
-        DOM_SID sid;
+        struct dom_sid sid;
         gid_t gid;
         enum lsa_SidType name_type;
@@ -351 +353 @@
 
 static NTSTATUS pdb_wbc_sam_enum_group_mapping(struct pdb_methods *methods,
-                                           const DOM_SID *sid, enum lsa_SidType sid_name_use,
+                                           const struct dom_sid *sid, enum lsa_SidType sid_name_use,
                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
                                            bool unix_only)
@@ -359 +361 @@
 
 static NTSTATUS pdb_wbc_sam_get_aliasinfo(struct pdb_methods *methods,
-                                   const DOM_SID *sid,
+                                   const struct dom_sid *sid,
                                    struct acct_info *info)
 {
@@ -366 +368 @@
 
 static NTSTATUS pdb_wbc_sam_enum_aliasmem(struct pdb_methods *methods,
-                                          const DOM_SID *alias,
+                                          const struct dom_sid *alias,
                                           TALLOC_CTX *mem_ctx,
-                                          DOM_SID **pp_members,
+                                          struct dom_sid **pp_members,
                                           size_t *p_num_members)
 {
@@ -376 +378 @@
 static NTSTATUS pdb_wbc_sam_alias_memberships(struct pdb_methods *methods,
                                        TALLOC_CTX *mem_ctx,
-                                       const DOM_SID *domain_sid,
-                                       const DOM_SID *members,
+                                       const struct dom_sid *domain_sid,
+                                       const struct dom_sid *members,
                                        size_t num_members,
                                        uint32 **pp_alias_rids,

trunk/server/source3/passdb/secrets.c

@@ -24 +24 @@
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "passdb.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_secrets.h"
+#include "secrets.h"
+#include "dbwrap.h"
+#include "../libcli/security/security.h"
+#include "util_tdb.h"
 
 #undef DBGC_CLASS
@@ -31 +37 @@
 
 static struct db_context *db_ctx;
-
-/* Urrrg. global.... */
-bool global_machine_password_needs_changing;
 
 /**
@@ -171 +174 @@
 
 /**
- * Form a key for fetching the domain sid
- *
- * @param domain domain name
- *
- * @return keystring
- **/
-static const char *domain_sid_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_DOMAIN_SID, domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-bool secrets_store_domain_sid(const char *domain, const DOM_SID *sid)
-{
-        bool ret;
-
-        ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(DOM_SID));
-
-        /* Force a re-query, in case we modified our domain */
-        if (ret)
-                reset_global_sam_sid();
-        return ret;
-}
-
-bool secrets_fetch_domain_sid(const char *domain, DOM_SID *sid)
-{
-        DOM_SID *dyn_sid;
-        size_t size = 0;
-
-        dyn_sid = (DOM_SID *)secrets_fetch(domain_sid_keystr(domain), &size);
-
-        if (dyn_sid == NULL)
-                return False;
-
-        if (size != sizeof(DOM_SID)) {
-                SAFE_FREE(dyn_sid);
-                return False;
-        }
-
-        *sid = *dyn_sid;
-        SAFE_FREE(dyn_sid);
-        return True;
-}
-
-bool secrets_store_domain_guid(const char *domain, struct GUID *guid)
-{
-        fstring key;
-
-        slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
-        strupper_m(key);
-        return secrets_store(key, guid, sizeof(struct GUID));
-}
-
-bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
-{
-        struct GUID *dyn_guid;
-        fstring key;
-        size_t size = 0;
-        struct GUID new_guid;
-
-        slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
-        strupper_m(key);
-        dyn_guid = (struct GUID *)secrets_fetch(key, &size);
-
-        if (!dyn_guid) {
-                if (lp_server_role() == ROLE_DOMAIN_PDC) {
-                        new_guid = GUID_random();
-                        if (!secrets_store_domain_guid(domain, &new_guid))
-                                return False;
-                        dyn_guid = (struct GUID *)secrets_fetch(key, &size);
-                }
-                if (dyn_guid == NULL) {
-                        return False;
-                }
-        }
-
-        if (size != sizeof(struct GUID)) {
-                DEBUG(1,("UUID size %d is wrong!\n", (int)size));
-                SAFE_FREE(dyn_guid);
-                return False;
-        }
-
-        *guid = *dyn_guid;
-        SAFE_FREE(dyn_guid);
-        return True;
-}
-
-bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
-{
-        return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
-}
-
-bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
-{
-        size_t size = 0;
-        uint8_t *key;
-
-        key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
-        if (key == NULL) {
-                return false;
-        }
-
-        if (size != 16) {
-                SAFE_FREE(key);
-                return false;
-        }
-
-        memcpy(schannel_key, key, 16);
-        SAFE_FREE(key);
-        return true;
-}
-
-/**
- * Form a key for fetching the machine trust account sec channel type
- *
- * @param domain domain name
- *
- * @return keystring
- **/
-static const char *machine_sec_channel_type_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_MACHINE_SEC_CHANNEL_TYPE,
-                                            domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-/**
- * Form a key for fetching the machine trust account last change time
- *
- * @param domain domain name
- *
- * @return keystring
- **/
-static const char *machine_last_change_time_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_MACHINE_LAST_CHANGE_TIME,
-                                            domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-
-/**
- * Form a key for fetching the machine previous trust account password
- *
- * @param domain domain name
- *
- * @return keystring
- **/
-static const char *machine_prev_password_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_MACHINE_PASSWORD_PREV, domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-/**
- * Form a key for fetching the machine trust account password
- *
- * @param domain domain name
- *
- * @return keystring
- **/
-static const char *machine_password_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_MACHINE_PASSWORD, domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-/**
- * Form a key for fetching the machine trust account password
- *
- * @param domain domain name
- *
- * @return stored password's key
- **/
-static const char *trust_keystr(const char *domain)
-{
-        char *keystr;
-
-        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
-                                            SECRETS_MACHINE_ACCT_PASS, domain);
-        SMB_ASSERT(keystr != NULL);
-        return keystr;
-}
-
-/**
  * Form a key for fetching a trusted domain password
  *
@@ -394 +192 @@
 
 /************************************************************************
- Lock the trust password entry.
-************************************************************************/
-
-void *secrets_get_trust_account_lock(TALLOC_CTX *mem_ctx, const char *domain)
-{
-        if (!secrets_init()) {
-                return NULL;
-        }
-
-        return db_ctx->fetch_locked(
-                db_ctx, mem_ctx, string_term_tdb_data(trust_keystr(domain)));
-}
-
-/************************************************************************
- Routine to get the default secure channel type for trust accounts
-************************************************************************/
-
-enum netr_SchannelType get_default_sec_channel(void)
-{
-        if (lp_server_role() == ROLE_DOMAIN_BDC ||
-            lp_server_role() == ROLE_DOMAIN_PDC) {
-                return SEC_CHAN_BDC;
-        } else {
-                return SEC_CHAN_WKSTA;
-        }
-}
-
-/************************************************************************
- Routine to get the trust account password for a domain.
- This only tries to get the legacy hashed version of the password.
- The user of this function must have locked the trust password file using
- the above secrets_lock_trust_account_password().
-************************************************************************/
-
-bool secrets_fetch_trust_account_password_legacy(const char *domain,
-                                                 uint8 ret_pwd[16],
-                                                 time_t *pass_last_set_time,
-                                                 enum netr_SchannelType *channel)
-{
-        struct machine_acct_pass *pass;
-        size_t size = 0;
-
-        if (!(pass = (struct machine_acct_pass *)secrets_fetch(
-                      trust_keystr(domain), &size))) {
-                DEBUG(5, ("secrets_fetch failed!\n"));
-                return False;
-        }
-
-        if (size != sizeof(*pass)) {
-                DEBUG(0, ("secrets were of incorrect size!\n"));
-                SAFE_FREE(pass);
-                return False;
-        }
-
-        if (pass_last_set_time) {
-                *pass_last_set_time = pass->mod_time;
-        }
-        memcpy(ret_pwd, pass->hash, 16);
-
-        if (channel) {
-                *channel = get_default_sec_channel();
-        }
-
-        /* Test if machine password has expired and needs to be changed */
-        if (lp_machine_password_timeout()) {
-                if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
-                                (time_t)lp_machine_password_timeout())) {
-                        global_machine_password_needs_changing = True;
-                }
-        }
-
-        SAFE_FREE(pass);
-        return True;
-}
-
-/************************************************************************
- Routine to get the trust account password for a domain.
- The user of this function must have locked the trust password file using
- the above secrets_lock_trust_account_password().
-************************************************************************/
-
-bool secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
-                                          time_t *pass_last_set_time,
-                                          enum netr_SchannelType *channel)
-{
-        char *plaintext;
-
-        plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
-                                                   channel);
-        if (plaintext) {
-                DEBUG(4,("Using cleartext machine password\n"));
-                E_md4hash(plaintext, ret_pwd);
-                SAFE_FREE(plaintext);
-                return True;
-        }
-
-        return secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
-                                                           pass_last_set_time,
-                                                           channel);
-}
-
-/************************************************************************
  Routine to get account password to trusted domain
 ************************************************************************/
 
 bool secrets_fetch_trusted_domain_password(const char *domain, char** pwd,
-                                           DOM_SID *sid, time_t *pass_last_set_time)
+                                           struct dom_sid *sid, time_t *pass_last_set_time)
 {
         struct TRUSTED_DOM_PASS pass;
@@ -516 +212 @@
 
         /* unpack trusted domain password */
-        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &pass,
+        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &pass,
                         (ndr_pull_flags_fn_t)ndr_pull_TRUSTED_DOM_PASS);
+
+        SAFE_FREE(blob.data);
+
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return false;
         }
 
-        SAFE_FREE(blob.data);
 
         /* the trust's password */
@@ -552 +250 @@
 
 bool secrets_store_trusted_domain_password(const char* domain, const char* pwd,
-                                           const DOM_SID *sid)
+                                           const struct dom_sid *sid)
 {
         bool ret;
@@ -575 +273 @@
         sid_copy(&pass.domain_sid, sid);
 
-        ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &pass,
+        ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &pass,
                         (ndr_push_flags_fn_t)ndr_push_TRUSTED_DOM_PASS);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -584 +282 @@
 
         data_blob_free(&blob);
-
-        return ret;
-}
-
-/************************************************************************
- Routine to delete the old plaintext machine account password if any
-************************************************************************/
-
-static bool secrets_delete_prev_machine_password(const char *domain)
-{
-        char *oldpass = (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
-        if (oldpass == NULL) {
-                return true;
-        }
-        SAFE_FREE(oldpass);
-        return secrets_delete(machine_prev_password_keystr(domain));
-}
-
-/************************************************************************
- Routine to delete the plaintext machine account password and old
- password if any
-************************************************************************/
-
-bool secrets_delete_machine_password(const char *domain)
-{
-        if (!secrets_delete_prev_machine_password(domain)) {
-                return false;
-        }
-        return secrets_delete(machine_password_keystr(domain));
-}
-
-/************************************************************************
- Routine to delete the plaintext machine account password, old password,
- sec channel type and last change time from secrets database
-************************************************************************/
-
-bool secrets_delete_machine_password_ex(const char *domain)
-{
-        if (!secrets_delete_prev_machine_password(domain)) {
-                return false;
-        }
-        if (!secrets_delete(machine_password_keystr(domain))) {
-                return false;
-        }
-        if (!secrets_delete(machine_sec_channel_type_keystr(domain))) {
-                return false;
-        }
-        return secrets_delete(machine_last_change_time_keystr(domain));
-}
-
-/************************************************************************
- Routine to delete the domain sid
-************************************************************************/
-
-bool secrets_delete_domain_sid(const char *domain)
-{
-        return secrets_delete(domain_sid_keystr(domain));
-}
-
-/************************************************************************
- Routine to store the previous machine password (by storing the current password
- as the old)
-************************************************************************/
-
-static bool secrets_store_prev_machine_password(const char *domain)
-{
-        char *oldpass;
-        bool ret;
-
-        oldpass = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
-        if (oldpass == NULL) {
-                return true;
-        }
-        ret = secrets_store(machine_prev_password_keystr(domain), oldpass, strlen(oldpass)+1);
-        SAFE_FREE(oldpass);
-        return ret;
-}
-
-/************************************************************************
- Routine to set the plaintext machine account password for a realm
- the password is assumed to be a null terminated ascii string.
- Before storing
-************************************************************************/
-
-bool secrets_store_machine_password(const char *pass, const char *domain,
-                                    enum netr_SchannelType sec_channel)
-{
-        bool ret;
-        uint32 last_change_time;
-        uint32 sec_channel_type;
-
-        if (!secrets_store_prev_machine_password(domain)) {
-                return false;
-        }
-
-        ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
-        if (!ret)
-                return ret;
-
-        SIVAL(&last_change_time, 0, time(NULL));
-        ret = secrets_store(machine_last_change_time_keystr(domain), &last_change_time, sizeof(last_change_time));
-
-        SIVAL(&sec_channel_type, 0, sec_channel);
-        ret = secrets_store(machine_sec_channel_type_keystr(domain), &sec_channel_type, sizeof(sec_channel_type));
-
-        return ret;
-}
-
-
-/************************************************************************
- Routine to fetch the previous plaintext machine account password for a realm
- the password is assumed to be a null terminated ascii string.
-************************************************************************/
-
-char *secrets_fetch_prev_machine_password(const char *domain)
-{
-        return (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
-}
-
-/************************************************************************
- Routine to fetch the plaintext machine account password for a realm
- the password is assumed to be a null terminated ascii string.
-************************************************************************/
-
-char *secrets_fetch_machine_password(const char *domain,
-                                     time_t *pass_last_set_time,
-                                     enum netr_SchannelType *channel)
-{
-        char *ret;
-        ret = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
-
-        if (pass_last_set_time) {
-                size_t size;
-                uint32 *last_set_time;
-                last_set_time = (unsigned int *)secrets_fetch(machine_last_change_time_keystr(domain), &size);
-                if (last_set_time) {
-                        *pass_last_set_time = IVAL(last_set_time,0);
-                        SAFE_FREE(last_set_time);
-                } else {
-                        *pass_last_set_time = 0;
-                }
-        }
-
-        if (channel) {
-                size_t size;
-                uint32 *channel_type;
-                channel_type = (unsigned int *)secrets_fetch(machine_sec_channel_type_keystr(domain), &size);
-                if (channel_type) {
-                        *channel = IVAL(channel_type,0);
-                        SAFE_FREE(channel_type);
-                } else {
-                        *channel = get_default_sec_channel();
-                }
-        }
 
         return ret;
@@ -863 +407 @@
         blob = data_blob_const(rec->value.dptr, rec->value.dsize);
 
-        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &pass,
+        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &pass,
                         (ndr_pull_flags_fn_t)ndr_pull_TRUSTED_DOM_PASS);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -905 +449 @@
         struct list_trusted_domains_state state;
 
-        secrets_init();
-
-        if (db_ctx == NULL) {
+        if (!secrets_init()) {
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -1064 +606 @@
 
         if (( ! owner) || ( ! key)) {
-                DEBUG(1, ("Invalid Paramters"));
+                DEBUG(1, ("Invalid Parameters"));
                 return NULL;
         }