Changeset 745 for trunk/server/source4/auth/ntlm/auth.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/auth/ntlm/auth.c (modified) (21 diffs)

trunk/server/source4/auth/ntlm/auth.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include <tevent.h>
+#include "../lib/util/tevent_ntstatus.h"
 #include "../lib/util/dlinklist.h"
 #include "auth/auth.h"
 #include "auth/ntlm/auth_proto.h"
-#include "lib/events/events.h"
 #include "param/param.h"
+#include "dsdb/samdb/samdb.h"
+
 
 /***************************************************************************
@@ -43 +46 @@
  Set a fixed challenge
 ***************************************************************************/
-bool auth_challenge_may_be_modified(struct auth_context *auth_ctx) 
+_PUBLIC_ bool auth_challenge_may_be_modified(struct auth_context *auth_ctx)
 {
         return auth_ctx->challenge.may_be_modified;
@@ -52 +55 @@
  Returns a const char of length 8 bytes.
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, const uint8_t **_chal)
+_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8])
 {
         NTSTATUS nt_status;
         struct auth_method_context *method;
 
-        if (auth_ctx->challenge.data.length) {
+        if (auth_ctx->challenge.data.length == 8) {
                 DEBUG(5, ("auth_get_challenge: returning previous challenge by module %s (normal)\n", 
                           auth_ctx->challenge.set_by));
-                *_chal = auth_ctx->challenge.data.data;
+                memcpy(chal, auth_ctx->challenge.data.data, 8);
                 return NT_STATUS_OK;
         }
 
         for (method = auth_ctx->methods; method; method = method->next) {
-                DATA_BLOB challenge = data_blob(NULL,0);
-
-                nt_status = method->ops->get_challenge(method, auth_ctx, &challenge);
+                nt_status = method->ops->get_challenge(method, auth_ctx, chal);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
@@ -74 +75 @@
                 NT_STATUS_NOT_OK_RETURN(nt_status);
 
-                if (challenge.length != 8) {
-                        DEBUG(0, ("auth_get_challenge: invalid challenge (length %u) by mothod [%s]\n",
-                                (unsigned)challenge.length, method->ops->name));
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-
-                auth_ctx->challenge.data        = challenge;
+                auth_ctx->challenge.data        = data_blob_talloc(auth_ctx, chal, 8);
+                NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
                 auth_ctx->challenge.set_by      = method->ops->name;
 
@@ -87 +83 @@
 
         if (!auth_ctx->challenge.set_by) {
-                uint8_t chal[8];
                 generate_random_buffer(chal, 8);
 
@@ -100 +95 @@
                  auth_ctx->challenge.set_by));
 
-        *_chal = auth_ctx->challenge.data.data;
         return NT_STATUS_OK;
 }
 
 /****************************************************************************
- Try to get a challenge out of the various authentication modules.
- Returns a const char of length 8 bytes.
+Used in the gensec_gssapi and gensec_krb5 server-side code, where the
+PAC isn't available, and for tokenGroups in the DSDB stack.
+
+ Supply either a principal or a DN
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_server_info_principal(TALLOC_CTX *mem_ctx, 
-                                                  struct auth_context *auth_ctx,
-                                                  const char *principal,
-                                                  struct auth_serversupplied_info **server_info)
+_PUBLIC_ NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                                 struct auth_context *auth_ctx,
+                                                 const char *principal,
+                                                 struct ldb_dn *user_dn,
+                                                 struct auth_user_info_dc **user_info_dc)
 {
         NTSTATUS nt_status;
@@ -117 +114 @@
 
         for (method = auth_ctx->methods; method; method = method->next) {
-                if (!method->ops->get_server_info_principal) {
+                if (!method->ops->get_user_info_dc_principal) {
                         continue;
                 }
 
-                nt_status = method->ops->get_server_info_principal(mem_ctx, auth_ctx, principal, server_info);
+                nt_status = method->ops->get_user_info_dc_principal(mem_ctx, auth_ctx, principal, user_dn, user_info_dc);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
                 }
 
-                NT_STATUS_NOT_OK_RETURN(nt_status);
-
-                break;
-        }
-
-        return NT_STATUS_OK;
-}
-
-struct auth_check_password_sync_state {
-        bool finished;
-        NTSTATUS status;
-        struct auth_serversupplied_info *server_info;
-};
-
-static void auth_check_password_sync_callback(struct auth_check_password_request *req,
-                                              void *private_data)
-{
-        struct auth_check_password_sync_state *s = talloc_get_type(private_data,
-                                                   struct auth_check_password_sync_state);
-
-        s->finished = true;
-        s->status = auth_check_password_recv(req, s, &s->server_info);
+                return nt_status;
+        }
+
+        return NT_STATUS_NOT_IMPLEMENTED;
 }
 
@@ -155 +134 @@
  *
  * Check a user's password, as given in the user_info struct and return various
- * interesting details in the server_info struct.
- *
- * The return value takes precedence over the contents of the server_info 
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
@@ -168 +147 @@
  * @param user_info Contains the user supplied components, including the passwords.
  *
- * @param mem_ctx The parent memory context for the server_info structure
- *
- * @param server_info If successful, contains information about the authentication, 
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
  *
@@ -180 +159 @@
                              TALLOC_CTX *mem_ctx,
                              const struct auth_usersupplied_info *user_info, 
-                             struct auth_serversupplied_info **server_info)
-{
-        struct auth_check_password_sync_state *sync_state;
+                             struct auth_user_info_dc **user_info_dc)
+{
+        struct tevent_req *subreq;
+        struct tevent_context *ev;
+        bool ok;
         NTSTATUS status;
 
-        sync_state = talloc_zero(auth_ctx, struct auth_check_password_sync_state);
-        NT_STATUS_HAVE_NO_MEMORY(sync_state);
-
-        auth_check_password_send(auth_ctx, user_info, auth_check_password_sync_callback, sync_state);
-
-        while (!sync_state->finished) {
-                event_loop_once(auth_ctx->event_ctx);
-        }
-
-        status = sync_state->status;
-
-        if (NT_STATUS_IS_OK(status)) {
-                *server_info = talloc_steal(mem_ctx, sync_state->server_info);
-        }
-
-        talloc_free(sync_state);
+        /*TODO: create a new event context here! */
+        ev = auth_ctx->event_ctx;
+
+        subreq = auth_check_password_send(mem_ctx,
+                                          ev,
+                                          auth_ctx,
+                                          user_info);
+        if (subreq == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ok = tevent_req_poll(subreq, ev);
+        if (!ok) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        status = auth_check_password_recv(subreq, mem_ctx, user_info_dc);
+        TALLOC_FREE(subreq);
+
         return status;
 }
 
-struct auth_check_password_request {
+struct auth_check_password_state {
         struct auth_context *auth_ctx;
         const struct auth_usersupplied_info *user_info;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         struct auth_method_context *method;
-        NTSTATUS status;
-        struct {
-                void (*fn)(struct auth_check_password_request *req, void *private_data);
-                void *private_data;
-        } callback;
 };
 
-static void auth_check_password_async_timed_handler(struct tevent_context *ev, struct tevent_timer *te,
-                                                    struct timeval t, void *ptr)
-{
-        struct auth_check_password_request *req = talloc_get_type(ptr, struct auth_check_password_request);
-        req->status = req->method->ops->check_password(req->method, req, req->user_info, &req->server_info);
-        req->callback.fn(req, req->callback.private_data);
-}
-
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data);
 /**
  * Check a user's Plaintext, LM or NTLM password.
@@ -229 +203 @@
  *
  * Check a user's password, as given in the user_info struct and return various
- * interesting details in the server_info struct.
- *
- * The return value takes precedence over the contents of the server_info 
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
+ *
+ * @param mem_ctx The memory context the request should operate on
+ *
+ * @param ev The tevent context the request should operate on
  *
  * @param auth_ctx Supplies the challenges and some other data. 
@@ -242 +220 @@
  * @param user_info Contains the user supplied components, including the passwords.
  *
- * @param callback A callback function which will be called when the operation is finished.
- *                 The callback function needs to call auth_check_password_recv() to get the return values
- *
- * @param private_data A private pointer which will ba passed to the callback function
+ * @return The request handle or NULL on no memory error.
  *
  **/
 
-_PUBLIC_ void auth_check_password_send(struct auth_context *auth_ctx,
-                              const struct auth_usersupplied_info *user_info,
-                              void (*callback)(struct auth_check_password_request *req, void *private_data),
-                              void *private_data)
-{
+_PUBLIC_ struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
+                                struct tevent_context *ev,
+                                struct auth_context *auth_ctx,
+                                const struct auth_usersupplied_info *user_info)
+{
+        struct tevent_req *req;
+        struct auth_check_password_state *state;
         /* if all the modules say 'not for me' this is reasonable */
         NTSTATUS nt_status;
+        uint8_t chal[8];
+        struct auth_usersupplied_info *user_info_tmp;
+        struct tevent_immediate *im;
+
+        DEBUG(3,("auth_check_password_send: "
+                 "Checking password for unmapped user [%s]\\[%s]@[%s]\n",
+                 user_info->client.domain_name, user_info->client.account_name,
+                 user_info->workstation_name));
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct auth_check_password_state);
+        if (req == NULL) {
+                return NULL;
+        }
+
+        state->auth_ctx         = auth_ctx;
+        state->user_info        = user_info;
+
+        if (!user_info->mapped_state) {
+                nt_status = map_user_info(req, lpcfg_workgroup(auth_ctx->lp_ctx),
+                                          user_info, &user_info_tmp);
+                if (tevent_req_nterror(req, nt_status)) {
+                        return tevent_req_post(req, ev);
+                }
+                user_info = user_info_tmp;
+                state->user_info = user_info_tmp;
+        }
+
+        DEBUGADD(3,("auth_check_password_send: "
+                    "mapped user is: [%s]\\[%s]@[%s]\n",
+                    user_info->mapped.domain_name,
+                    user_info->mapped.account_name,
+                    user_info->workstation_name));
+
+        nt_status = auth_get_challenge(auth_ctx, chal);
+        if (tevent_req_nterror(req, nt_status)) {
+                DEBUG(0,("auth_check_password_send: "
+                         "Invalid challenge (length %u) stored for "
+                         "this auth context set_by %s - cannot continue: %s\n",
+                        (unsigned)auth_ctx->challenge.data.length,
+                        auth_ctx->challenge.set_by,
+                        nt_errstr(nt_status)));
+                return tevent_req_post(req, ev);
+        }
+
+        if (auth_ctx->challenge.set_by) {
+                DEBUG(10,("auth_check_password_send: "
+                          "auth_context challenge created by %s\n",
+                          auth_ctx->challenge.set_by));
+        }
+
+        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
+        dump_data(5, auth_ctx->challenge.data.data,
+                  auth_ctx->challenge.data.length);
+
+        im = tevent_create_immediate(state);
+        if (tevent_req_nomem(im, req)) {
+                return tevent_req_post(req, ev);
+        }
+
+        tevent_schedule_immediate(im,
+                                  auth_ctx->event_ctx,
+                                  auth_check_password_async_trigger,
+                                  req);
+        return req;
+}
+
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data)
+{
+        struct tevent_req *req =
+                talloc_get_type_abort(private_data, struct tevent_req);
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
+        NTSTATUS status;
         struct auth_method_context *method;
-        const uint8_t *challenge;
-        struct auth_usersupplied_info *user_info_tmp;
-        struct auth_check_password_request *req = NULL;
-
-        DEBUG(3,   ("auth_check_password_send:  Checking password for unmapped user [%s]\\[%s]@[%s]\n", 
-                    user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
-
-        req = talloc_zero(auth_ctx, struct auth_check_password_request);
-        if (!req) {
-                callback(NULL, private_data);
+
+        status = NT_STATUS_OK;
+
+        for (method=state->auth_ctx->methods; method; method = method->next) {
+
+                /* we fill in state->method here so debug messages in
+                   the callers know which method failed */
+                state->method = method;
+
+                /* check if the module wants to check the password */
+                status = method->ops->want_check(method, req, state->user_info);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        DEBUG(11,("auth_check_password_send: "
+                                  "%s had nothing to say\n",
+                                  method->ops->name));
+                        continue;
+                }
+
+                if (tevent_req_nterror(req, status)) {
+                        return;
+                }
+
+                status = method->ops->check_password(method,
+                                                     state,
+                                                     state->user_info,
+                                                     &state->user_info_dc);
+                if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        /* the backend has handled the request */
+                        break;
+                }
+        }
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                /* don't expose the NT_STATUS_NOT_IMPLEMENTED
+                   internals */
+                status = NT_STATUS_NO_SUCH_USER;
+        }
+
+        if (tevent_req_nterror(req, status)) {
                 return;
         }
-        req->auth_ctx                   = auth_ctx;
-        req->user_info                  = user_info;
-        req->callback.fn                = callback;
-        req->callback.private_data      = private_data;
-
-        if (!user_info->mapped_state) {
-                nt_status = map_user_info(req, lp_workgroup(auth_ctx->lp_ctx), user_info, &user_info_tmp);
-                if (!NT_STATUS_IS_OK(nt_status)) goto failed;
-                user_info = user_info_tmp;
-                req->user_info  = user_info_tmp;
-        }
-
-        DEBUGADD(3,("auth_check_password_send:  mapped user is: [%s]\\[%s]@[%s]\n", 
-                    user_info->mapped.domain_name, user_info->mapped.account_name, user_info->workstation_name));
-
-        nt_status = auth_get_challenge(auth_ctx, &challenge);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(0, ("auth_check_password_send:  Invalid challenge (length %u) stored for this auth context set_by %s - cannot continue: %s\n",
-                        (unsigned)auth_ctx->challenge.data.length, auth_ctx->challenge.set_by, nt_errstr(nt_status)));
-                goto failed;
-        }
-
-        if (auth_ctx->challenge.set_by) {
-                DEBUG(10, ("auth_check_password_send: auth_context challenge created by %s\n",
-                                        auth_ctx->challenge.set_by));
-        }
-
-        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
-        dump_data(5, auth_ctx->challenge.data.data, auth_ctx->challenge.data.length);
-
-        nt_status = NT_STATUS_NO_SUCH_USER; /* If all the modules say 'not for me', then this is reasonable */
-        for (method = auth_ctx->methods; method; method = method->next) {
-                NTSTATUS result;
-                struct tevent_timer *te = NULL;
-
-                /* check if the module wants to chek the password */
-                result = method->ops->want_check(method, req, user_info);
-                if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
-                        DEBUG(11,("auth_check_password_send: %s had nothing to say\n", method->ops->name));
-                        continue;
-                }
-
-                nt_status = result;
-                req->method     = method;
-
-                if (!NT_STATUS_IS_OK(nt_status)) break;
-
-                te = event_add_timed(auth_ctx->event_ctx, req,
-                                     timeval_zero(),
-                                     auth_check_password_async_timed_handler, req);
-                if (!te) {
-                        nt_status = NT_STATUS_NO_MEMORY;
-                        goto failed;
-                }
-                return;
-        }
-
-failed:
-        req->status = nt_status;
-        req->callback.fn(req, req->callback.private_data);
+
+        tevent_req_done(req);
 }
 
@@ -335 +359 @@
  * async receive function
  *
- * The return value takes precedence over the contents of the server_info 
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
  *
  *
- * @param req The async auth_check_password state, passes to the callers callback function
- *
- * @param mem_ctx The parent memory context for the server_info structure
- *
- * @param server_info If successful, contains information about the authentication, 
+ * @param req The async request state
+ *
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
  *
@@ -351 +375 @@
  **/
 
-_PUBLIC_ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+_PUBLIC_ NTSTATUS auth_check_password_recv(struct tevent_req *req,
                                   TALLOC_CTX *mem_ctx,
-                                  struct auth_serversupplied_info **server_info)
-{
+                                  struct auth_user_info_dc **user_info_dc)
+{
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
         NTSTATUS status;
 
-        NT_STATUS_HAVE_NO_MEMORY(req);
-
-        if (NT_STATUS_IS_OK(req->status)) {
-                DEBUG(5,("auth_check_password_recv: %s authentication for user [%s\\%s] succeeded\n",
-                         req->method->ops->name, req->server_info->domain_name, req->server_info->account_name));
-
-                *server_info = talloc_steal(mem_ctx, req->server_info);
-        } else {
-                DEBUG(2,("auth_check_password_recv: %s authentication for user [%s\\%s] FAILED with error %s\n", 
-                         (req->method ? req->method->ops->name : "NO_METHOD"),
-                         req->user_info->mapped.domain_name,
-                         req->user_info->mapped.account_name, 
-                         nt_errstr(req->status)));
-        }
-
-        status = req->status;
-        talloc_free(req);
-        return status;
+        if (tevent_req_is_nterror(req, &status)) {
+                DEBUG(2,("auth_check_password_recv: "
+                         "%s authentication for user [%s\\%s] "
+                         "FAILED with error %s\n",
+                         (state->method ? state->method->ops->name : "NO_METHOD"),
+                         state->user_info->mapped.domain_name,
+                         state->user_info->mapped.account_name,
+                         nt_errstr(status)));
+                tevent_req_received(req);
+                return status;
+        }
+
+        DEBUG(5,("auth_check_password_recv: "
+                 "%s authentication for user [%s\\%s] succeeded\n",
+                 state->method->ops->name,
+                 state->user_info_dc->info->domain_name,
+                 state->user_info_dc->info->account_name));
+
+        *user_info_dc = talloc_move(mem_ctx, &state->user_info_dc);
+
+        tevent_req_received(req);
+        return NT_STATUS_OK;
+}
+
+/* Wrapper because we don't want to expose all callers to needing to
+ * know that session_info is generated from the main ldb */
+static NTSTATUS auth_generate_session_info_wrapper(TALLOC_CTX *mem_ctx,
+                                                   struct auth_context *auth_context,
+                                                   struct auth_user_info_dc *user_info_dc,
+                                                   uint32_t session_info_flags,
+                                                   struct auth_session_info **session_info)
+{
+        return auth_generate_session_info(mem_ctx, auth_context->lp_ctx,
+                                          auth_context->sam_ctx, user_info_dc,
+                                          session_info_flags, session_info);
 }
 
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
- - Allow the caller to specify the methods to use
+ - Allow the caller to specify the methods to use, including optionally the SAM to use
 ***************************************************************************/
 _PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
-                                     struct tevent_context *ev,
-                                     struct messaging_context *msg,
-                                     struct loadparm_context *lp_ctx,
-                                     struct auth_context **auth_ctx)
+                                              struct tevent_context *ev,
+                                              struct messaging_context *msg,
+                                              struct loadparm_context *lp_ctx,
+                                              struct ldb_context *sam_ctx,
+                                              struct auth_context **auth_ctx)
 {
         int i;
         struct auth_context *ctx;
 
-        auth_init();
-
-        if (!methods) {
-                DEBUG(0,("auth_context_create: No auth method list!?\n"));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
+        auth4_init();
 
         if (!ev) {
                 DEBUG(0,("auth_context_create: called with out event context\n"));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (!msg) {
-                DEBUG(0,("auth_context_create: called with out messaging context\n"));
                 return NT_STATUS_INTERNAL_ERROR;
         }
@@ -417 +451 @@
         ctx->lp_ctx                     = lp_ctx;
 
-        for (i=0; methods[i] ; i++) {
+        if (sam_ctx) {
+                ctx->sam_ctx = sam_ctx;
+        } else {
+                ctx->sam_ctx = samdb_connect(ctx, ctx->event_ctx, ctx->lp_ctx, system_session(ctx->lp_ctx), 0);
+        }
+
+        for (i=0; methods && methods[i] ; i++) {
                 struct auth_method_context *method;
 
@@ -434 +474 @@
         }
 
-        if (!ctx->methods) {
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
         ctx->check_password = auth_check_password;
         ctx->get_challenge = auth_get_challenge;
         ctx->set_challenge = auth_context_set_challenge;
         ctx->challenge_may_be_modified = auth_challenge_may_be_modified;
-        ctx->get_server_info_principal = auth_get_server_info_principal;
+        ctx->get_user_info_dc_principal = auth_get_user_info_dc_principal;
+        ctx->generate_session_info = auth_generate_session_info_wrapper;
 
         *auth_ctx = ctx;
@@ -448 +485 @@
         return NT_STATUS_OK;
 }
+
+const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+        const char **auth_methods = NULL;
+        switch (lpcfg_server_role(lp_ctx)) {
+        case ROLE_STANDALONE:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
+                break;
+        case ROLE_DOMAIN_MEMBER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
+                break;
+        case ROLE_DOMAIN_CONTROLLER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
+                break;
+        }
+        return auth_methods;
+}
+
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
  - Uses default auth_methods, depending on server role and smb.conf settings
 ***************************************************************************/
-_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
                              struct messaging_context *msg,
@@ -458 +513 @@
                              struct auth_context **auth_ctx)
 {
-        const char **auth_methods = NULL;
-        switch (lp_server_role(lp_ctx)) {
-        case ROLE_STANDALONE:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
-                break;
-        case ROLE_DOMAIN_MEMBER:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
-                break;
-        case ROLE_DOMAIN_CONTROLLER:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
-                break;
-        }
-        return auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, auth_ctx);
-}
-
+        NTSTATUS status;
+        const char **auth_methods;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, NULL, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
+
+/* Create an auth context from an open LDB.
+
+   This allows us not to re-open the LDB when we need to do a some authentication logic (such as tokenGroups)
+
+ */
+NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx)
+{
+        NTSTATUS status;
+        const char **auth_methods;
+        struct loadparm_context *lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
+        struct tevent_context *ev = ldb_get_event_context(ldb);
+
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, NULL, lp_ctx, ldb, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
 
 /* the list of currently registered AUTH backends */
@@ -545 +626 @@
                 sizeof(struct auth_context),
                 sizeof(struct auth_usersupplied_info),
-                sizeof(struct auth_serversupplied_info)
+                sizeof(struct auth_user_info_dc)
         };
 
@@ -551 +632 @@
 }
 
-_PUBLIC_ NTSTATUS auth_init(void)
+_PUBLIC_ NTSTATUS auth4_init(void)
 {
         static bool initialized = false;
-        extern NTSTATUS auth_developer_init(void);
-        extern NTSTATUS auth_winbind_init(void);
-        extern NTSTATUS auth_anonymous_init(void);
-        extern NTSTATUS auth_unix_init(void);
-        extern NTSTATUS auth_sam_init(void);
-        extern NTSTATUS auth_server_init(void);
-
-        init_module_fn static_init[] = { STATIC_auth_MODULES };
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_auth4_MODULES_PROTO;
+        init_module_fn static_init[] = { STATIC_auth4_MODULES };
         
         if (initialized) return NT_STATUS_OK;
@@ -570 +646 @@
         return NT_STATUS_OK;    
 }
-
-NTSTATUS server_service_auth_init(void)
-{
-        return auth_init();
-}