s3-winbind: Make sure we crash if domain is really not found.

[amitay/samba.git] / nsswitch / wbinfo.c

diff --git a/nsswitch/wbinfo.c b/nsswitch/wbinfo.c
index 813846f138833b51d87317743936d4beebb27264..a277ede75bb6de0e0307dd75e6246ff6e38190d3 100644 (file)
--- a/nsswitch/wbinfo.c
+++ b/nsswitch/wbinfo.c
@@ -5,6 +5,7 @@
 
    Copyright (C) Tim Potter      2000-2003
    Copyright (C) Andrew Bartlett 2002-2007
+   Copyright (C) Volker Lendecke 2009
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -25,7 +26,7 @@
 #include "libwbclient/wbclient.h"
 #include "lib/popt/popt.h"
 #include "../libcli/auth/libcli_auth.h"
-#if !(_SAMBA_VERSION_) < 4
+#if (_SAMBA_BUILD_) >= 4
 #include "lib/cmdline/popt_common.h"
 #endif
 
@@ -46,7 +47,7 @@ static struct wbcInterfaceDetails *init_interface_details(void)
        wbc_status = wbcInterfaceDetails(&details);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
                d_fprintf(stderr, "could not obtain winbind interface "
-                                 "details!\n");
+                                 "details: %s\n", wbcErrorString(wbc_status));
        }
 
        return details;
@@ -171,6 +172,8 @@ static bool wbinfo_get_userinfo(char *user)
 
        wbc_status = wbcGetpwnam(user, &pwd);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetpwnam: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -194,6 +197,8 @@ static bool wbinfo_get_uidinfo(int uid)
 
        wbc_status = wbcGetpwuid(uid, &pwd);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetpwuid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -218,6 +223,8 @@ static bool wbinfo_get_user_sidinfo(const char *sid_str)
        wbc_status = wbcStringToSid(sid_str, &sid);
        wbc_status = wbcGetpwsid(&sid, &pwd);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetpwsid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -243,6 +250,8 @@ static bool wbinfo_get_groupinfo(const char *group)
 
        wbc_status = wbcGetgrnam(group, &grp);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetgrnam: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -272,6 +281,8 @@ static bool wbinfo_get_gidinfo(int gid)
 
        wbc_status = wbcGetgrgid(gid, &grp);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetgrgid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -305,6 +316,8 @@ static bool wbinfo_get_usergroups(const char *user)
 
        wbc_status = wbcGetGroups(user, &num_groups, &groups);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetGroups: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -330,11 +343,15 @@ static bool wbinfo_get_usersids(const char *user_sid_str)
 
        wbc_status = wbcStringToSid(user_sid_str, &user_sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcLookupUserSids(&user_sid, false, &num_sids, &sids);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcLookupUserSids: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -342,6 +359,8 @@ static bool wbinfo_get_usersids(const char *user_sid_str)
                char *str = NULL;
                wbc_status = wbcSidToString(&sids[i], &str);
                if (!WBC_ERROR_IS_OK(wbc_status)) {
+                       d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                                 wbcErrorString(wbc_status));
                        wbcFreeMemory(sids);
                        return false;
                }
@@ -365,11 +384,15 @@ static bool wbinfo_get_userdomgroups(const char *user_sid_str)
 
        wbc_status = wbcStringToSid(user_sid_str, &user_sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcLookupUserSids(&user_sid, true, &num_sids, &sids);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcLookupUserSids: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -377,6 +400,8 @@ static bool wbinfo_get_userdomgroups(const char *user_sid_str)
                char *str = NULL;
                wbc_status = wbcSidToString(&sids[i], &str);
                if (!WBC_ERROR_IS_OK(wbc_status)) {
+                       d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                                 wbcErrorString(wbc_status));
                        wbcFreeMemory(sids);
                        return false;
                }
@@ -410,8 +435,8 @@ static bool wbinfo_get_sidaliases(const char *domain,
 
        wbc_status = wbcDomainInfo(domain, &dinfo);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
-               d_printf("wbcDomainInfo(%s) failed: %s\n", domain,
-                        wbcErrorString(wbc_status));
+               d_fprintf(stderr, "wbcDomainInfo(%s) failed: %s\n", domain,
+                         wbcErrorString(wbc_status));
                goto done;
        }
        wbc_status = wbcStringToSid(user_sid_str, &user_sid);
@@ -456,6 +481,8 @@ static bool wbinfo_wins_byname(const char *name)
 
        wbc_status = wbcResolveWinsByName(name, &ip);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcResolveWinsByName: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -477,6 +504,8 @@ static bool wbinfo_wins_byip(const char *ip)
 
        wbc_status = wbcResolveWinsByIP(ip, &name);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcResolveWinsByIP: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -501,6 +530,8 @@ static bool wbinfo_list_domains(bool list_all_domains, bool verbose)
 
        wbc_status = wbcListTrusts(&domain_list, &num_domains);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcListTrusts: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -587,6 +618,8 @@ static bool wbinfo_show_onlinestatus(const char *domain)
 
        wbc_status = wbcListTrusts(&domain_list, &num_domains);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcListTrusts: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -627,11 +660,15 @@ static bool wbinfo_domain_info(const char *domain)
 
        wbc_status = wbcDomainInfo(domain, &dinfo);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcDomainInfo: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToString(&dinfo->sid, &sid_str);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                         wbcErrorString(wbc_status));
                wbcFreeMemory(dinfo);
                return false;
        }
@@ -688,50 +725,111 @@ static bool wbinfo_getdcname(const char *domain_name)
 /* Find a DC */
 static bool wbinfo_dsgetdcname(const char *domain_name, uint32_t flags)
 {
-       struct winbindd_request request;
-       struct winbindd_response response;
+       wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+       struct wbcDomainControllerInfoEx *dc_info;
+       char *str = NULL;
 
-       ZERO_STRUCT(request);
-       ZERO_STRUCT(response);
+       wbc_status = wbcLookupDomainControllerEx(domain_name, NULL, NULL,
+                                                flags | DS_DIRECTORY_SERVICE_REQUIRED,
+                                                &dc_info);
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               printf("Could not find dc for %s\n", domain_name);
+               return false;
+       }
 
-       fstrcpy(request.data.dsgetdcname.domain_name, domain_name);
-       request.data.dsgetdcname.flags = flags;
+       wbcGuidToString(dc_info->domain_guid, &str);
 
-       request.flags |= DS_DIRECTORY_SERVICE_REQUIRED;
+       d_printf("%s\n", dc_info->dc_unc);
+       d_printf("%s\n", dc_info->dc_address);
+       d_printf("%d\n", dc_info->dc_address_type);
+       d_printf("%s\n", str);
+       d_printf("%s\n", dc_info->domain_name);
+       d_printf("%s\n", dc_info->forest_name);
+       d_printf("0x%08x\n", dc_info->dc_flags);
+       d_printf("%s\n", dc_info->dc_site_name);
+       d_printf("%s\n", dc_info->client_site_name);
 
-       /* Send request */
+       return true;
+}
 
-       if (winbindd_request_response(WINBINDD_DSGETDCNAME, &request,
-                                     &response) != NSS_STATUS_SUCCESS) {
-               d_fprintf(stderr, "Could not find dc for %s\n", domain_name);
+/* Check trust account password */
+
+static bool wbinfo_check_secret(const char *domain)
+{
+       wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+       struct wbcAuthErrorInfo *error = NULL;
+       const char *domain_name;
+
+       if (domain) {
+               domain_name = domain;
+       } else {
+               domain_name = get_winbind_domain();
+       }
+
+       wbc_status = wbcCheckTrustCredentials(domain_name, &error);
+
+       d_printf("checking the trust secret for domain %s via RPC calls %s\n",
+               domain_name,
+               WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
+
+       if (wbc_status == WBC_ERR_AUTH_ERROR) {
+               d_fprintf(stderr, "error code was %s (0x%x)\n",
+                         error->nt_string, error->nt_status);
+               wbcFreeMemory(error);
+       }
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcCheckTrustCredentials: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
-       /* Display response */
+       return true;
+}
+
+/* Change trust account password */
+
+static bool wbinfo_change_secret(const char *domain)
+{
+       wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+       struct wbcAuthErrorInfo *error = NULL;
+       const char *domain_name;
+
+       if (domain) {
+               domain_name = domain;
+       } else {
+               domain_name = get_winbind_domain();
+       }
 
-       d_printf("%s\n", response.data.dsgetdcname.dc_unc);
-       d_printf("%s\n", response.data.dsgetdcname.dc_address);
-       d_printf("%d\n", response.data.dsgetdcname.dc_address_type);
-       d_printf("%s\n", response.data.dsgetdcname.domain_guid);
-       d_printf("%s\n", response.data.dsgetdcname.domain_name);
-       d_printf("%s\n", response.data.dsgetdcname.forest_name);
-       d_printf("0x%08x\n", response.data.dsgetdcname.dc_flags);
-       d_printf("%s\n", response.data.dsgetdcname.dc_site_name);
-       d_printf("%s\n", response.data.dsgetdcname.client_site_name);
+       wbc_status = wbcChangeTrustCredentials(domain_name, &error);
+
+       d_printf("changing the trust secret for domain %s via RPC calls %s\n",
+               domain_name,
+               WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
+
+       if (wbc_status == WBC_ERR_AUTH_ERROR) {
+               d_fprintf(stderr, "error code was %s (0x%x)\n",
+                         error->nt_string, error->nt_status);
+               wbcFreeMemory(error);
+       }
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcChangeTrustCredentials: %s",
+                         wbcErrorString(wbc_status));
+               return false;
+       }
 
        return true;
 }
 
-/* Check trust account password */
+/* Check DC connection */
 
-static bool wbinfo_check_secret(void)
+static bool wbinfo_ping_dc(void)
 {
        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
        struct wbcAuthErrorInfo *error = NULL;
 
-       wbc_status = wbcCheckTrustCredentials(NULL, &error);
+       wbc_status = wbcPingDc(NULL, &error);
 
-       d_printf("checking the trust secret via RPC calls %s\n",
+       d_printf("checking the NETLOGON dc connection %s\n",
                 WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 
        if (wbc_status == WBC_ERR_AUTH_ERROR) {
@@ -740,6 +838,8 @@ static bool wbinfo_check_secret(void)
                wbcFreeMemory(error);
        }
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcPingDc: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -758,11 +858,15 @@ static bool wbinfo_uid_to_sid(uid_t uid)
 
        wbc_status = wbcUidToSid(uid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcUidToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToString(&sid, &sid_str);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -787,11 +891,15 @@ static bool wbinfo_gid_to_sid(gid_t gid)
 
        wbc_status = wbcGidToSid(gid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGidToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToString(&sid, &sid_str);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -816,11 +924,15 @@ static bool wbinfo_sid_to_uid(const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToUid(&sid, &uid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToUid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -841,11 +953,15 @@ static bool wbinfo_sid_to_gid(const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToGid(&sid, &gid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToGid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -865,6 +981,8 @@ static bool wbinfo_allocate_uid(void)
 
        wbc_status = wbcAllocateUid(&uid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcAllocateUid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -884,6 +1002,8 @@ static bool wbinfo_allocate_gid(void)
 
        wbc_status = wbcAllocateGid(&gid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcAllocateGid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -903,11 +1023,15 @@ static bool wbinfo_set_uid_mapping(uid_t uid, const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSetUidMapping(uid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSetUidMapping: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -928,11 +1052,15 @@ static bool wbinfo_set_gid_mapping(gid_t gid, const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSetGidMapping(gid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSetGidMapping: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -953,11 +1081,15 @@ static bool wbinfo_remove_uid_mapping(uid_t uid, const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcRemoveUidMapping(uid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcRemoveUidMapping: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -978,11 +1110,15 @@ static bool wbinfo_remove_gid_mapping(gid_t gid, const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcRemoveGidMapping(gid, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcRemoveGidMapping: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -1008,11 +1144,15 @@ static bool wbinfo_lookupsid(const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcLookupSid(&sid, &domain, &name, &type);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcLookupSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -1038,11 +1178,15 @@ static bool wbinfo_lookupsid_fullname(const char *sid_str)
 
        wbc_status = wbcStringToSid(sid_str, &sid);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcStringToSid: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcGetDisplayName(&sid, &domain, &name, &type);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcGetDisplayName: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -1161,11 +1305,15 @@ static bool wbinfo_lookupname(const char *full_name)
        wbc_status = wbcLookupName(domain_name, account_name,
                                   &sid, &type);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcLookupName: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
        wbc_status = wbcSidToString(&sid, &sid_str);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcSidToString: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -1253,6 +1401,8 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
                                     (uint8_t *)&flags,
                                     sizeof(flags));
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s",
+                         wbcErrorString(wbc_status));
                goto done;
        }
 
@@ -1263,6 +1413,8 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
                                     (uint8_t *)&uid,
                                     sizeof(uid));
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s",
+                         wbcErrorString(wbc_status));
                goto done;
        }
 
@@ -1273,6 +1425,8 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
                                     (uint8_t *)local_cctype,
                                     strlen(cctype)+1);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s",
+                         wbcErrorString(wbc_status));
                goto done;
        }
 
@@ -1318,7 +1472,6 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
        }
  done:
 
-       TALLOC_FREE(frame);
        wbcFreeMemory(params.blobs);
 
        return WBC_ERROR_IS_OK(wbc_status);
@@ -1363,8 +1516,6 @@ static bool wbinfo_auth(char *username)
                         response.data.auth.error_string);
 #endif
 
-       TALLOC_FREE(frame);
-
        return WBC_ERROR_IS_OK(wbc_status);
 }
 
@@ -1424,7 +1575,7 @@ static bool wbinfo_auth_crap(char *username, bool use_ntlmv2, bool use_lanman)
                                      &lm, &nt, NULL, NULL)) {
                        data_blob_free(&names_blob);
                        data_blob_free(&server_chal);
-                       SAFE_FREE(pass);
+                       TALLOC_FREE(pass);
                        return false;
                }
                data_blob_free(&names_blob);
@@ -1471,6 +1622,111 @@ static bool wbinfo_auth_crap(char *username, bool use_ntlmv2, bool use_lanman)
 
        data_blob_free(&nt);
        data_blob_free(&lm);
+
+       return WBC_ERROR_IS_OK(wbc_status);
+}
+
+/* Authenticate a user with a plaintext password */
+
+static bool wbinfo_pam_logon(char *username)
+{
+       wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+       struct wbcLogonUserParams params;
+       struct wbcAuthErrorInfo *error;
+       char *s = NULL;
+       char *p = NULL;
+       TALLOC_CTX *frame = talloc_tos();
+       uint32_t flags;
+       uint32_t uid;
+
+       ZERO_STRUCT(params);
+
+       if ((s = talloc_strdup(frame, username)) == NULL) {
+               return false;
+       }
+
+       if ((p = strchr(s, '%')) != NULL) {
+               *p = 0;
+               p++;
+               params.password = talloc_strdup(frame, p);
+       } else {
+               params.password = wbinfo_prompt_pass(frame, NULL, username);
+       }
+       params.username = s;
+
+       flags = WBFLAG_PAM_CACHED_LOGIN;
+
+       wbc_status = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
+                                    "flags", 0,
+                                    (uint8_t *)&flags, sizeof(flags));
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_printf("wbcAddNamedBlob failed: %s\n",
+                        wbcErrorString(wbc_status));
+               return false;
+       }
+
+       uid = getuid();
+
+       wbc_status = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
+                                    "user_uid", 0,
+                                    (uint8_t *)&uid, sizeof(uid));
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_printf("wbcAddNamedBlob failed: %s\n",
+                        wbcErrorString(wbc_status));
+               return false;
+       }
+
+       wbc_status = wbcLogonUser(&params, NULL, &error, NULL);
+
+       wbcFreeMemory(params.blobs);
+
+       d_printf("plaintext password authentication %s\n",
+                WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
+
+       if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr,
+                         "error code was %s (0x%x)\nerror messsage was: %s\n",
+                         error->nt_string,
+                         (int)error->nt_status,
+                         error->display_string);
+               wbcFreeMemory(error);
+               return false;
+       }
+       return true;
+}
+
+/* Save creds with winbind */
+
+static bool wbinfo_ccache_save(char *username)
+{
+       wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+       char *s = NULL;
+       char *p = NULL;
+       char *password = NULL;
+       char *name = NULL;
+       TALLOC_CTX *frame = talloc_stackframe();
+
+       s = talloc_strdup(frame, username);
+       if (s == NULL) {
+               return false;
+       }
+
+       p = strchr(s, '%');
+       if (p != NULL) {
+               *p = 0;
+               p++;
+               password = talloc_strdup(frame, p);
+       } else {
+               password = wbinfo_prompt_pass(frame, NULL, username);
+       }
+
+       name = s;
+
+       wbc_status = wbcCredentialSave(name, password);
+
+       d_printf("saving creds %s\n",
+                WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
+
        TALLOC_FREE(frame);
 
        return WBC_ERROR_IS_OK(wbc_status);
@@ -1592,6 +1848,8 @@ static bool print_domain_groups(const char *domain)
 
        wbc_status = wbcListGroups(domain, &num_groups, &groups);
        if (!WBC_ERROR_IS_OK(wbc_status)) {
+               d_fprintf(stderr, "failed to call wbcListGroups: %s",
+                         wbcErrorString(wbc_status));
                return false;
        }
 
@@ -1650,8 +1908,6 @@ static bool wbinfo_change_user_password(const char *username)
        d_printf("Password change for user %s %s\n", username,
                WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 
-       TALLOC_FREE(frame);
-
        return WBC_ERROR_IS_OK(wbc_status);
 }
 
@@ -1683,8 +1939,14 @@ enum {
        OPT_VERBOSE,
        OPT_ONLINESTATUS,
        OPT_CHANGE_USER_PASSWORD,
+       OPT_PING_DC,
+       OPT_CCACHE_SAVE,
        OPT_SID_TO_FULLNAME,
        OPT_NTLMV2,
+       OPT_PAM_LOGON,
+       OPT_LOGOFF,
+       OPT_LOGOFF_USER,
+       OPT_LOGOFF_UID,
        OPT_LANMAN
 };
 
@@ -1702,6 +1964,8 @@ int main(int argc, char **argv, char **envp)
        bool verbose = false;
        bool use_ntlmv2 = false;
        bool use_lanman = false;
+       char *logoff_user = getenv("USER");
+       int logoff_uid = geteuid();
 
        struct poptOption long_options[] = {
                POPT_AUTOHELP
@@ -1731,10 +1995,13 @@ int main(int argc, char **argv, char **envp)
                { "remove-uid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_UID_MAPPING, "Remove uid to sid mapping in idmap", "UID,SID" },
                { "remove-gid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_GID_MAPPING, "Remove gid to sid mapping in idmap", "GID,SID" },
                { "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
+               { "change-secret", 'c', POPT_ARG_NONE, 0, 'c', "Change shared secret" },
+               { "ping-dc", 0, POPT_ARG_NONE, 0, OPT_PING_DC,
+                 "Check the NETLOGON connection" },
                { "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
                { "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS, "List all domains (trusted and own domain)" },
                { "own-domain", 0, POPT_ARG_NONE, 0, OPT_LIST_OWN_DOMAIN, "List own domain" },
-               { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Show sequence numbers of all domains" },
+               { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Deprecated command, see --online-status" },
                { "online-status", 0, POPT_ARG_NONE, 0, OPT_ONLINESTATUS, "Show whether domains are marked as online or offline"},
                { "domain-info", 'D', POPT_ARG_STRING, &string_arg, 'D', "Show most of the info we have about the domain" },
                { "user-info", 'i', POPT_ARG_STRING, &string_arg, 'i', "Get user info", "USER" },
@@ -1748,7 +2015,18 @@ int main(int argc, char **argv, char **envp)
                { "sid-aliases", 0, POPT_ARG_STRING, &string_arg, OPT_SIDALIASES, "Get sid aliases", "SID" },
                { "user-sids", 0, POPT_ARG_STRING, &string_arg, OPT_USERSIDS, "Get user group sids for user SID", "SID" },
                { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a', "authenticate user", "user%password" },
+               { "pam-logon", 0, POPT_ARG_STRING, string_arg, OPT_PAM_LOGON,
+                 "do a pam logon equivalent", "user%password" },
+               { "logoff", 0, POPT_ARG_NONE, NULL, OPT_LOGOFF,
+                 "log off user", "uid" },
+               { "logoff-user", 0, POPT_ARG_STRING, &logoff_user,
+                 OPT_LOGOFF_USER, "username to log off" },
+               { "logoff-uid", 0, POPT_ARG_INT, &logoff_uid,
+                 OPT_LOGOFF_UID, "uid to log off" },
                { "set-auth-user", 0, POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" },
+               { "ccache-save", 0, POPT_ARG_STRING, &string_arg,
+                 OPT_CCACHE_SAVE, "Store user and password for ccache "
+                 "operation", "user%password" },
                { "getdcname", 0, POPT_ARG_STRING, &string_arg, OPT_GETDCNAME,
                  "Get a DC name for a foreign domain", "domainname" },
                { "dsgetdcname", 0, POPT_ARG_STRING, &string_arg, OPT_DSGETDCNAME, "Find a DC for a domain", "domainname" },
@@ -1956,11 +2234,23 @@ int main(int argc, char **argv, char **envp)
                        }
                        break;
                case 't':
-                       if (!wbinfo_check_secret()) {
+                       if (!wbinfo_check_secret(opt_domain_name)) {
                                d_fprintf(stderr, "Could not check secret\n");
                                goto done;
                        }
                        break;
+               case 'c':
+                       if (!wbinfo_change_secret(opt_domain_name)) {
+                               d_fprintf(stderr, "Could not change secret\n");
+                               goto done;
+                       }
+                       break;
+               case OPT_PING_DC:
+                       if (!wbinfo_ping_dc()) {
+                               d_fprintf(stderr, "Could not ping our DC\n");
+                               goto done;
+                       }
+                       break;
                case 'm':
                        if (!wbinfo_list_domains(false, verbose)) {
                                d_fprintf(stderr,
@@ -2082,6 +2372,22 @@ int main(int argc, char **argv, char **envp)
                                        goto done;
                                break;
                        }
+               case OPT_PAM_LOGON:
+                       if (!wbinfo_pam_logon(string_arg)) {
+                               d_fprintf(stderr, "pam_logon failed for %s\n",
+                                         string_arg);
+                               goto done;
+                       }
+               case OPT_LOGOFF:
+               {
+                       wbcErr wbc_status;
+
+                       wbc_status = wbcLogoffUser(logoff_user, logoff_uid,
+                                                  "");
+                       d_printf("Logoff %s (%d): %s\n", logoff_user,
+                                logoff_uid, wbcErrorString(wbc_status));
+                       break;
+               }
                case 'K': {
                                uint32_t flags = WBFLAG_PAM_KRB5 |
                                                 WBFLAG_PAM_CACHED_LOGIN |
@@ -2121,6 +2427,11 @@ int main(int argc, char **argv, char **envp)
                        wbinfo_get_auth_user();
                        goto done;
                        break;
+               case OPT_CCACHE_SAVE:
+                       if (!wbinfo_ccache_save(string_arg)) {
+                               goto done;
+                       }
+                       break;
                case OPT_GETDCNAME:
                        if (!wbinfo_getdcname(string_arg)) {
                                goto done;
@@ -2160,12 +2471,11 @@ int main(int argc, char **argv, char **envp)
 
                /* generic configuration options */
                case OPT_DOMAIN_NAME:
-                       break;
                case OPT_VERBOSE:
-                       break;
                case OPT_NTLMV2:
-                       break;
                case OPT_LANMAN:
+               case OPT_LOGOFF_USER:
+               case OPT_LOGOFF_UID:
                        break;
                default:
                        d_fprintf(stderr, "Invalid option\n");