s3: Attempt to fix bug 7665

[samba.git] / source3 / lib / netapi / group.c

diff --git a/source3/lib/netapi/group.c b/source3/lib/netapi/group.c
index 8dba4b88380a59fdda6dc062d6cb3cb2c24b6bd0..f5a7e77bb23d0175153a85bf9b0bf846074a0a45 100644 (file)
--- a/source3/lib/netapi/group.c
+++ b/source3/lib/netapi/group.c
@@ -23,6 +23,7 @@
 #include "lib/netapi/netapi.h"
 #include "lib/netapi/netapi_private.h"
 #include "lib/netapi/libnetapi.h"
+#include "../librpc/gen_ndr/cli_samr.h"
 
 /****************************************************************
 ****************************************************************/
@@ -30,11 +31,10 @@
 WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
                     struct NetGroupAdd *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name;
        struct dom_sid2 *domain_sid = NULL;
        uint32_t rid = 0;
@@ -73,7 +73,6 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -81,7 +80,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_CREATE_GROUP |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
@@ -106,7 +105,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
                        break;
        }
 
-       status = rpccli_samr_CreateDomainGroup(pipe_cli, ctx,
+       status = rpccli_samr_CreateDomainGroup(pipe_cli, talloc_tos(),
                                               &domain_handle,
                                               &lsa_group_name,
                                               SEC_STD_DELETE |
@@ -125,7 +124,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
                                init_lsa_String(&info.description,
                                                info1->grpi1_comment);
 
-                               status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                               status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                                  &group_handle,
                                                                  GROUPINFODESCRIPTION,
                                                                  &info);
@@ -136,7 +135,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
                                init_lsa_String(&info.description,
                                                info2->grpi2_comment);
 
-                               status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                               status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                                  &group_handle,
                                                                  GROUPINFODESCRIPTION,
                                                                  &info);
@@ -148,7 +147,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
                        if (info2->grpi2_attributes != 0) {
                                info.attributes.attributes = info2->grpi2_attributes;
-                               status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                               status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                                  &group_handle,
                                                                  GROUPINFOATTRIBUTES,
                                                                  &info);
@@ -160,7 +159,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
                                init_lsa_String(&info.description,
                                                info3->grpi3_comment);
 
-                               status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                               status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                                  &group_handle,
                                                                  GROUPINFODESCRIPTION,
                                                                  &info);
@@ -172,7 +171,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
                        if (info3->grpi3_attributes != 0) {
                                info.attributes.attributes = info3->grpi3_attributes;
-                               status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                               status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                                  &group_handle,
                                                                  GROUPINFOATTRIBUTES,
                                                                  &info);
@@ -191,16 +190,12 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
        goto done;
 
  failed:
-       rpccli_samr_DeleteDomainGroup(pipe_cli, ctx,
+       rpccli_samr_DeleteDomainGroup(pipe_cli, talloc_tos(),
                                      &group_handle);
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -226,11 +221,10 @@ WERROR NetGroupAdd_l(struct libnetapi_ctx *ctx,
 WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
                     struct NetGroupDel *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name;
        struct dom_sid2 *domain_sid = NULL;
        int i = 0;
@@ -250,7 +244,6 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -258,7 +251,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -269,7 +262,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_group_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_group_name,
@@ -285,7 +278,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SEC_STD_DELETE |
                                       SAMR_GROUP_ACCESS_GET_MEMBERS |
@@ -299,7 +292,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
                                            &group_handle,
                                            GROUPINFOATTRIBUTES,
                                            &info);
@@ -315,7 +308,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 #endif
-       status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
                                              &group_handle,
                                              &rid_array);
        if (!NT_STATUS_IS_OK(status)) {
@@ -327,7 +320,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
        struct lsa_Strings names;
        struct samr_Ids member_types;
 
-       status = rpccli_samr_LookupRids(pipe_cli, ctx,
+       status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
                                        &domain_handle,
                                        rid_array->count,
                                        rid_array->rids,
@@ -341,7 +334,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
        for (i=0; i < rid_array->count; i++) {
 
-               status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+               status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
                                                       &group_handle,
                                                       rid_array->rids[i]);
                if (!NT_STATUS_IS_OK(status)) {
@@ -350,7 +343,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
                }
        }
 
-       status = rpccli_samr_DeleteDomainGroup(pipe_cli, ctx,
+       status = rpccli_samr_DeleteDomainGroup(pipe_cli, talloc_tos(),
                                               &group_handle);
        if (!NT_STATUS_IS_OK(status)) {
                werr = ntstatus_to_werror(status);
@@ -362,12 +355,8 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -393,11 +382,10 @@ WERROR NetGroupDel_l(struct libnetapi_ctx *ctx,
 WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                         struct NetGroupSetInfo *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name;
        struct dom_sid2 *domain_sid = NULL;
 
@@ -421,7 +409,6 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -429,7 +416,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -440,7 +427,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_group_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_group_name,
@@ -456,7 +443,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_SET_INFO |
                                       SAMR_GROUP_ACCESS_LOOKUP_INFO,
@@ -471,7 +458,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 0:
                        g0 = (struct GROUP_INFO_0 *)r->in.buffer;
                        init_lsa_String(&info.name, g0->grpi0_name);
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFONAME,
                                                          &info);
@@ -479,7 +466,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 1:
                        g1 = (struct GROUP_INFO_1 *)r->in.buffer;
                        init_lsa_String(&info.description, g1->grpi1_comment);
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFODESCRIPTION,
                                                          &info);
@@ -487,7 +474,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 2:
                        g2 = (struct GROUP_INFO_2 *)r->in.buffer;
                        init_lsa_String(&info.description, g2->grpi2_comment);
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFODESCRIPTION,
                                                          &info);
@@ -496,7 +483,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                                goto done;
                        }
                        info.attributes.attributes = g2->grpi2_attributes;
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFOATTRIBUTES,
                                                          &info);
@@ -504,7 +491,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 3:
                        g3 = (struct GROUP_INFO_3 *)r->in.buffer;
                        init_lsa_String(&info.description, g3->grpi3_comment);
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFODESCRIPTION,
                                                          &info);
@@ -513,7 +500,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                                goto done;
                        }
                        info.attributes.attributes = g3->grpi3_attributes;
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFOATTRIBUTES,
                                                          &info);
@@ -521,7 +508,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 1002:
                        g1002 = (struct GROUP_INFO_1002 *)r->in.buffer;
                        init_lsa_String(&info.description, g1002->grpi1002_comment);
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFODESCRIPTION,
                                                          &info);
@@ -529,7 +516,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
                case 1005:
                        g1005 = (struct GROUP_INFO_1005 *)r->in.buffer;
                        info.attributes.attributes = g1005->grpi1005_attributes;
-                       status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+                       status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
                                                          &group_handle,
                                                          GROUPINFOATTRIBUTES,
                                                          &info);
@@ -547,12 +534,8 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -639,11 +622,10 @@ static WERROR map_group_info_to_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
                         struct NetGroupGetInfo *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name;
        struct dom_sid2 *domain_sid = NULL;
 
@@ -662,7 +644,6 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -670,7 +651,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -681,7 +662,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_group_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_group_name,
@@ -697,7 +678,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_LOOKUP_INFO,
                                       rids.ids[0],
@@ -707,12 +688,12 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
                                            &group_handle,
                                            GROUPINFOALL2,
                                            &info);
        if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
-               status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+               status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
                                                    &group_handle,
                                                    GROUPINFOALL,
                                                    &info);
@@ -732,12 +713,8 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
                goto done;
        }
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -763,11 +740,10 @@ WERROR NetGroupGetInfo_l(struct libnetapi_ctx *ctx,
 WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
                         struct NetGroupAddUser *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name, lsa_user_name;
        struct dom_sid2 *domain_sid = NULL;
 
@@ -784,7 +760,6 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -792,7 +767,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -803,23 +778,23 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_group_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_group_name,
                                         &rids,
                                         &types);
        if (!NT_STATUS_IS_OK(status)) {
-               werr = WERR_GROUP_NOT_FOUND;
+               werr = WERR_GROUPNOTFOUND;
                goto done;
        }
 
        if (types.ids[0] != SID_NAME_DOM_GRP) {
-               werr = WERR_GROUP_NOT_FOUND;
+               werr = WERR_GROUPNOTFOUND;
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_ADD_MEMBER,
                                       rids.ids[0],
@@ -831,7 +806,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_user_name, r->in.user_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_user_name,
@@ -847,7 +822,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
+       status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
                                            &group_handle,
                                            rids.ids[0],
                                            7); /* why ? */
@@ -859,12 +834,8 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -890,11 +861,10 @@ WERROR NetGroupAddUser_l(struct libnetapi_ctx *ctx,
 WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
                         struct NetGroupDelUser *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, group_handle;
+       struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_group_name, lsa_user_name;
        struct dom_sid2 *domain_sid = NULL;
 
@@ -911,7 +881,6 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -919,7 +888,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -930,23 +899,23 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_group_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_group_name,
                                         &rids,
                                         &types);
        if (!NT_STATUS_IS_OK(status)) {
-               werr = WERR_GROUP_NOT_FOUND;
+               werr = WERR_GROUPNOTFOUND;
                goto done;
        }
 
        if (types.ids[0] != SID_NAME_DOM_GRP) {
-               werr = WERR_GROUP_NOT_FOUND;
+               werr = WERR_GROUPNOTFOUND;
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_REMOVE_MEMBER,
                                       rids.ids[0],
@@ -958,7 +927,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_user_name, r->in.user_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_user_name,
@@ -974,7 +943,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+       status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
                                               &group_handle,
                                               rids.ids[0]);
        if (!NT_STATUS_IS_OK(status)) {
@@ -985,12 +954,8 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -1166,7 +1131,6 @@ static WERROR convert_samr_disp_groups_to_GROUP_INFO_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
                      struct NetGroupEnum *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle;
        struct dom_sid2 *domain_sid = NULL;
@@ -1195,7 +1159,6 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1203,7 +1166,7 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
                                          SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1214,7 +1177,7 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_QueryDomainInfo(pipe_cli, ctx,
+       status = rpccli_samr_QueryDomainInfo(pipe_cli, talloc_tos(),
                                             &domain_handle,
                                             2,
                                             &domain_info);
@@ -1243,7 +1206,7 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       if (r->out.resume_handle) {
+       if (r->out.resume_handle && info.info3.count > 0) {
                *r->out.resume_handle =
                        info.info3.entries[info.info3.count-1].idx;
        }
@@ -1260,10 +1223,6 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
        }
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        /* if last query */
        if (NT_STATUS_IS_OK(status) ||
            NT_STATUS_IS_ERR(status)) {
@@ -1294,7 +1253,6 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 {
        /* FIXME: this call needs to cope with large replies */
 
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_account_name;
@@ -1319,6 +1277,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
        *r->out.buffer = NULL;
        *r->out.entries_read = 0;
+       *r->out.total_entries = 0;
 
        switch (r->in.level) {
                case 0:
@@ -1331,7 +1290,6 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1339,7 +1297,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -1350,7 +1308,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_account_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_account_name,
@@ -1361,7 +1319,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_GET_MEMBERS,
                                       group_rids.ids[0],
@@ -1371,7 +1329,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
                                              &group_handle,
                                              &rid_array);
        if (!NT_STATUS_IS_OK(status)) {
@@ -1379,7 +1337,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_LookupRids(pipe_cli, ctx,
+       status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
                                        &domain_handle,
                                        rid_array->count,
                                        rid_array->rids,
@@ -1408,23 +1366,14 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
                }
        }
 
-       if (r->out.entries_read) {
-               *r->out.entries_read = entries_read;
-       }
-
-       if (r->out.total_entries) {
-               *r->out.total_entries = entries_read;
-       }
+       *r->out.entries_read = entries_read;
+       *r->out.total_entries = entries_read;
 
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {
@@ -1450,7 +1399,6 @@ WERROR NetGroupGetUsers_l(struct libnetapi_ctx *ctx,
 WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
                          struct NetGroupSetUsers *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle, domain_handle, group_handle;
        struct lsa_String lsa_account_name;
@@ -1494,7 +1442,6 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1502,7 +1449,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -1513,7 +1460,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
        init_lsa_String(&lsa_account_name, r->in.group_name);
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         1,
                                         &lsa_account_name,
@@ -1524,7 +1471,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+       status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
                                       &domain_handle,
                                       SAMR_GROUP_ACCESS_GET_MEMBERS |
                                       SAMR_GROUP_ACCESS_ADD_MEMBER |
@@ -1537,7 +1484,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
                goto done;
        }
 
-       status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
                                            &group_handle,
                                            GROUPINFOATTRIBUTES,
                                            &group_info);
@@ -1575,7 +1522,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
                }
        }
 
-       status = rpccli_samr_LookupNames(pipe_cli, ctx,
+       status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
                                         &domain_handle,
                                         r->in.num_entries,
                                         lsa_names,
@@ -1589,7 +1536,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
        member_rids = user_rids.ids;
        num_member_rids = user_rids.count;
 
-       status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+       status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
                                              &group_handle,
                                              &rid_array);
        if (!NT_STATUS_IS_OK(status)) {
@@ -1640,7 +1587,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
        /* add list */
 
        for (i=0; i < num_add_rids; i++) {
-               status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
+               status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
                                                    &group_handle,
                                                    add_rids[i],
                                                    7 /* ? */);
@@ -1653,7 +1600,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
        /* del list */
 
        for (i=0; i < num_del_rids; i++) {
-               status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+               status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
                                                       &group_handle,
                                                       del_rids[i]);
                if (!NT_STATUS_IS_OK(status)) {
@@ -1665,12 +1612,8 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
-               rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+               rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
        }
 
        if (ctx->disable_policy_handle_cache) {