s3-auth Change type of num_sids to uint32_t
[samba.git] / source3 / winbindd / winbindd_pam.c
index 597d48aad0b88e545fb0f9098cedb27f831a9e28..83f75f5e5649c1ce35761b8de6f26edff8564bbc 100644 (file)
 
 #include "includes.h"
 #include "winbindd.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/cli_samr.h"
+#include "rpc_client/cli_samr.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_netlogon.h"
+#include "smb_krb5.h"
+#include "../lib/crypto/arcfour.h"
+#include "../libcli/security/dom_sid.h"
+#include "ads.h"
+#include "../librpc/gen_ndr/krb5pac.h"
+
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
@@ -34,54 +45,53 @@ static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
                                    struct netr_SamInfo3 *info3)
 {
        char *ex;
-       size_t size;
        uint32_t i;
 
-       state->response.data.auth.info3.logon_time =
+       state->response->data.auth.info3.logon_time =
                nt_time_to_unix(info3->base.last_logon);
-       state->response.data.auth.info3.logoff_time =
+       state->response->data.auth.info3.logoff_time =
                nt_time_to_unix(info3->base.last_logoff);
-       state->response.data.auth.info3.kickoff_time =
+       state->response->data.auth.info3.kickoff_time =
                nt_time_to_unix(info3->base.acct_expiry);
-       state->response.data.auth.info3.pass_last_set_time =
+       state->response->data.auth.info3.pass_last_set_time =
                nt_time_to_unix(info3->base.last_password_change);
-       state->response.data.auth.info3.pass_can_change_time =
+       state->response->data.auth.info3.pass_can_change_time =
                nt_time_to_unix(info3->base.allow_password_change);
-       state->response.data.auth.info3.pass_must_change_time =
+       state->response->data.auth.info3.pass_must_change_time =
                nt_time_to_unix(info3->base.force_password_change);
 
-       state->response.data.auth.info3.logon_count = info3->base.logon_count;
-       state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
+       state->response->data.auth.info3.logon_count = info3->base.logon_count;
+       state->response->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
 
-       state->response.data.auth.info3.user_rid = info3->base.rid;
-       state->response.data.auth.info3.group_rid = info3->base.primary_gid;
-       sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
+       state->response->data.auth.info3.user_rid = info3->base.rid;
+       state->response->data.auth.info3.group_rid = info3->base.primary_gid;
+       sid_to_fstring(state->response->data.auth.info3.dom_sid, info3->base.domain_sid);
 
-       state->response.data.auth.info3.num_groups = info3->base.groups.count;
-       state->response.data.auth.info3.user_flgs = info3->base.user_flags;
+       state->response->data.auth.info3.num_groups = info3->base.groups.count;
+       state->response->data.auth.info3.user_flgs = info3->base.user_flags;
 
-       state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
-       state->response.data.auth.info3.num_other_sids = info3->sidcount;
+       state->response->data.auth.info3.acct_flags = info3->base.acct_flags;
+       state->response->data.auth.info3.num_other_sids = info3->sidcount;
 
-       fstrcpy(state->response.data.auth.info3.user_name,
+       fstrcpy(state->response->data.auth.info3.user_name,
                info3->base.account_name.string);
-       fstrcpy(state->response.data.auth.info3.full_name,
+       fstrcpy(state->response->data.auth.info3.full_name,
                info3->base.full_name.string);
-       fstrcpy(state->response.data.auth.info3.logon_script,
+       fstrcpy(state->response->data.auth.info3.logon_script,
                info3->base.logon_script.string);
-       fstrcpy(state->response.data.auth.info3.profile_path,
+       fstrcpy(state->response->data.auth.info3.profile_path,
                info3->base.profile_path.string);
-       fstrcpy(state->response.data.auth.info3.home_dir,
+       fstrcpy(state->response->data.auth.info3.home_dir,
                info3->base.home_directory.string);
-       fstrcpy(state->response.data.auth.info3.dir_drive,
+       fstrcpy(state->response->data.auth.info3.dir_drive,
                info3->base.home_drive.string);
 
-       fstrcpy(state->response.data.auth.info3.logon_srv,
+       fstrcpy(state->response->data.auth.info3.logon_srv,
                info3->base.logon_server.string);
-       fstrcpy(state->response.data.auth.info3.logon_dom,
+       fstrcpy(state->response->data.auth.info3.logon_dom,
                info3->base.domain.string);
 
-       ex = talloc_strdup(mem_ctx, "");
+       ex = talloc_strdup(state->mem_ctx, "");
        NT_STATUS_HAVE_NO_MEMORY(ex);
 
        for (i=0; i < info3->base.groups.count; i++) {
@@ -105,17 +115,8 @@ static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
                talloc_free(sid);
        }
 
-       size = talloc_get_size(ex);
-
-       SAFE_FREE(state->response.extra_data.data);
-       state->response.extra_data.data = SMB_MALLOC(size);
-       if (!state->response.extra_data.data) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       memcpy(state->response.extra_data.data, ex, size);
-       talloc_free(ex);
-
-       state->response.length += size;
+       state->response->extra_data.data = ex;
+       state->response->length += talloc_get_size(ex);
 
        return NT_STATUS_OK;
 }
@@ -127,25 +128,15 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
        DATA_BLOB blob;
        enum ndr_err_code ndr_err;
 
-       ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, info3,
+       ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
                                       (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                DEBUG(0,("append_info3_as_ndr: failed to append\n"));
                return ndr_map_error2ntstatus(ndr_err);
        }
 
-       SAFE_FREE(state->response.extra_data.data);
-       state->response.extra_data.data = SMB_MALLOC(blob.length);
-       if (!state->response.extra_data.data) {
-               data_blob_free(&blob);
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       memset(state->response.extra_data.data, '\0', blob.length);
-       memcpy(state->response.extra_data.data, blob.data, blob.length);
-       state->response.length += blob.length;
-
-       data_blob_free(&blob);
+       state->response->extra_data.data = blob.data;
+       state->response->length += blob.length;
 
        return NT_STATUS_OK;
 }
@@ -175,11 +166,11 @@ static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
                nt_username = name_user;
        }
 
-       fill_domain_username(state->response.data.auth.unix_username,
+       fill_domain_username(state->response->data.auth.unix_username,
                             nt_domain, nt_username, true);
 
        DEBUG(5,("Setting unix username to [%s]\n",
-               state->response.data.auth.unix_username));
+               state->response->data.auth.unix_username));
 
        return NT_STATUS_OK;
 }
@@ -192,6 +183,7 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 {
        char *afsname = NULL;
        char *cell;
+       char *token;
 
        afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
        if (afsname == NULL) {
@@ -207,11 +199,11 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
                                    "%U", name_user);
 
        {
-               DOM_SID user_sid;
+               struct dom_sid user_sid;
                fstring sidstr;
 
-               sid_copy(&user_sid, info3->base.domain_sid);
-               sid_append_rid(&user_sid, info3->base.rid);
+               sid_compose(&user_sid, info3->base.domain_sid,
+                           info3->base.rid);
                sid_to_fstring(sidstr, &user_sid);
                afsname = talloc_string_sub(mem_ctx, afsname,
                                            "%s", sidstr);
@@ -234,21 +226,22 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
        *cell = '\0';
        cell += 1;
 
-       /* Append an AFS token string */
-       SAFE_FREE(state->response.extra_data.data);
-       state->response.extra_data.data =
-               afs_createtoken_str(afsname, cell);
-
-       if (state->response.extra_data.data != NULL) {
-               state->response.length +=
-                       strlen((const char *)state->response.extra_data.data)+1;
+       token = afs_createtoken_str(afsname, cell);
+       if (token == NULL) {
+               return NT_STATUS_OK;
        }
+       state->response->extra_data.data = talloc_strdup(state->mem_ctx,
+                                                        token);
+       if (state->response->extra_data.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       state->response->length +=
+               strlen((const char *)state->response->extra_data.data)+1;
 
        return NT_STATUS_OK;
 }
 
-static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
-                                    struct netr_SamInfo3 *info3,
+static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
                                     const char *group_sid)
 /**
  * Check whether a user belongs to a group or list of groups.
@@ -262,14 +255,14 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
  */
 {
-       DOM_SID *require_membership_of_sid;
-       size_t num_require_membership_of_sid;
+       struct dom_sid *require_membership_of_sid;
+       uint32_t num_require_membership_of_sid;
        char *req_sid;
        const char *p;
-       DOM_SID sid;
+       struct dom_sid sid;
        size_t i;
        struct nt_user_token *token;
-       TALLOC_CTX *frame = NULL;
+       TALLOC_CTX *frame = talloc_stackframe();
        NTSTATUS status;
 
        /* Parse the 'required group' SID */
@@ -279,8 +272,10 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                return NT_STATUS_OK;
        }
 
-       if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
+       token = talloc_zero(talloc_tos(), struct nt_user_token);
+       if (token == NULL) {
                DEBUG(0, ("talloc failed\n"));
+               TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -289,8 +284,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 
        p = group_sid;
 
-       frame = talloc_stackframe();
-       while (next_token_talloc(frame, &p, &req_sid, ",")) {
+       while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
                if (!string_to_sid(&sid, req_sid)) {
                        DEBUG(0, ("check_info3_in_group: could not parse %s "
                                  "as a SID!", req_sid));
@@ -298,7 +292,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                        return NT_STATUS_INVALID_PARAMETER;
                }
 
-               status = add_sid_to_array(mem_ctx, &sid,
+               status = add_sid_to_array(talloc_tos(), &sid,
                                          &require_membership_of_sid,
                                          &num_require_membership_of_sid);
                if (!NT_STATUS_IS_OK(status)) {
@@ -308,13 +302,12 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                }
        }
 
-       TALLOC_FREE(frame);
-
-       status = sid_array_from_info3(mem_ctx, info3,
-                                     &token->user_sids,
+       status = sid_array_from_info3(talloc_tos(), info3,
+                                     &token->sids,
                                      &token->num_sids,
                                      true, false);
        if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(frame);
                return status;
        }
 
@@ -324,6 +317,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                                                     token))) {
                DEBUG(3, ("could not add aliases: %s\n",
                          nt_errstr(status)));
+               TALLOC_FREE(frame);
                return status;
        }
 
@@ -335,17 +329,19 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                if (nt_token_check_sid(&require_membership_of_sid[i],
                                       token)) {
                        DEBUG(10, ("Access ok\n"));
+                       TALLOC_FREE(frame);
                        return NT_STATUS_OK;
                }
        }
 
        /* Do not distinguish this error from a wrong username/pw */
 
+       TALLOC_FREE(frame);
        return NT_STATUS_LOGON_FAILURE;
 }
 
-struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
-                                       const char *domain_name)
+struct winbindd_domain *find_auth_domain(uint8_t flags,
+                                        const char *domain_name)
 {
        struct winbindd_domain *domain;
 
@@ -359,15 +355,12 @@ struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
                return domain;
        }
 
-       if (is_myname(domain_name)) {
-               DEBUG(3, ("Authentication for domain %s (local domain "
-                         "to this server) not supported at this "
-                         "stage\n", domain_name));
-               return NULL;
+       if (strequal(domain_name, get_global_sam_name())) {
+               return find_domain_from_name_noinit(domain_name);
        }
 
        /* we can auth against trusted domains */
-       if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
+       if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
                domain = find_domain_from_name_noinit(domain_name);
                if (domain == NULL) {
                        DEBUG(3, ("Authentication for domain [%s] skipped "
@@ -416,7 +409,7 @@ static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
                return status;
        }
 
-       fill_in_password_policy(&state->response, &password_policy);
+       fill_in_password_policy(state->response, &password_policy);
 
        return NT_STATUS_OK;
 }
@@ -470,7 +463,7 @@ static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
                                        const char *type,
                                        uid_t uid,
-                                       bool *internal_ccache)
+                                       const char **user_ccache_file)
 {
        /* accept FILE and WRFILE as krb5_cc_type from the client and then
         * build the full ccname string based on the user's uid here -
@@ -478,77 +471,53 @@ static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 
        const char *gen_cc = NULL;
 
-       *internal_ccache = true;
-
-       if (uid == -1) {
-               goto memory_ccache;
+       if (uid != -1) {
+               if (strequal(type, "FILE")) {
+                       gen_cc = talloc_asprintf(
+                               mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
+               }
+               if (strequal(type, "WRFILE")) {
+                       gen_cc = talloc_asprintf(
+                               mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
+               }
        }
 
-       if (!type || type[0] == '\0') {
-               goto memory_ccache;
-       }
+       *user_ccache_file = gen_cc;
 
-       if (strequal(type, "FILE")) {
-               gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
-       } else if (strequal(type, "WRFILE")) {
-               gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
-       } else {
-               DEBUG(10,("we don't allow to set a %s type ccache\n", type));
-               goto memory_ccache;
+       if (gen_cc == NULL) {
+               gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
        }
-
-       *internal_ccache = false;
-       goto done;
-
-  memory_ccache:
-       gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
-
-  done:
        if (gen_cc == NULL) {
                DEBUG(0,("out of memory\n"));
                return NULL;
        }
 
-       DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
+       DEBUG(10, ("using ccache: %s%s\n", gen_cc,
+                  (*user_ccache_file == NULL) ? " (internal)":""));
 
        return gen_cc;
 }
 
-static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
-{
-       const char *type = state->request.data.auth.krb5_cc_type;
-
-       state->response.data.auth.krb5ccname[0] = '\0';
-
-       if (type[0] == '\0') {
-               return;
-       }
-
-       if (!strequal(type, "FILE") &&
-           !strequal(type, "WRFILE")) {
-               DEBUG(10,("won't return krbccname for a %s type ccache\n",
-                       type));
-               return;
-       }
-
-       fstrcpy(state->response.data.auth.krb5ccname, cc);
-}
-
 #endif
 
-static uid_t get_uid_from_state(struct winbindd_cli_state *state)
+uid_t get_uid_from_request(struct winbindd_request *request)
 {
-       uid_t uid = -1;
+       uid_t uid;
 
-       uid = state->request.data.auth.uid;
+       uid = request->data.auth.uid;
 
        if (uid < 0) {
-               DEBUG(1,("invalid uid: '%d'\n", uid));
+               DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
                return -1;
        }
        return uid;
 }
 
+static uid_t get_uid_from_state(struct winbindd_cli_state *state)
+{
+       return get_uid_from_request(state->request);
+}
+
 /**********************************************************************
  Authenticate a user with a clear text password using Kerberos and fill up
  ccache if required
@@ -571,9 +540,8 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
        uid_t uid = -1;
        ADS_STRUCT *ads;
        time_t time_offset = 0;
-       bool internal_ccache = true;
-
-       ZERO_STRUCTP(info3);
+       const char *user_ccache_file;
+       struct PAC_LOGON_INFO *logon_info = NULL;
 
        *info3 = NULL;
 
@@ -586,9 +554,9 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
        }
 
        cc = generate_krb5_ccache(state->mem_ctx,
-                                 state->request.data.auth.krb5_cc_type,
-                                 state->request.data.auth.uid,
-                                 &internal_ccache);
+                                 state->request->data.auth.krb5_cc_type,
+                                 state->request->data.auth.uid,
+                                 &user_ccache_file);
        if (cc == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -606,7 +574,7 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
        /* 3rd step:
         * do kerberos auth and setup ccache as the user */
 
-       parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+       parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
        realm = domain->alt_name;
        strupper_m(realm);
@@ -626,23 +594,24 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 
        /************************ ENTERING NON-ROOT **********************/
 
-       if (!internal_ccache) {
+       if (user_ccache_file != NULL) {
                set_effective_uid(uid);
                DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
        }
 
-       result = kerberos_return_info3_from_pac(state->mem_ctx,
-                                               principal_s,
-                                               state->request.data.auth.pass,
-                                               time_offset,
-                                               &ticket_lifetime,
-                                               &renewal_until,
-                                               cc,
-                                               true,
-                                               true,
-                                               WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
-                                               info3);
-       if (!internal_ccache) {
+       result = kerberos_return_pac(state->mem_ctx,
+                                    principal_s,
+                                    state->request->data.auth.pass,
+                                    time_offset,
+                                    &ticket_lifetime,
+                                    &renewal_until,
+                                    cc,
+                                    true,
+                                    true,
+                                    WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+                                    NULL,
+                                    &logon_info);
+       if (user_ccache_file != NULL) {
                gain_root_privilege();
        }
 
@@ -652,20 +621,23 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
                goto failed;
        }
 
+       *info3 = &logon_info->info3;
+
        DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
                principal_s));
 
        /* if we had a user's ccache then return that string for the pam
         * environment */
 
-       if (!internal_ccache) {
+       if (user_ccache_file != NULL) {
 
-               setup_return_cc_name(state, cc);
+               fstrcpy(state->response->data.auth.krb5ccname,
+                       user_ccache_file);
 
                result = add_ccache_to_list(principal_s,
                                            cc,
                                            service,
-                                           state->request.data.auth.user,
+                                           state->request->data.auth.user,
                                            realm,
                                            uid,
                                            time(NULL),
@@ -706,10 +678,10 @@ failed:
                         "%s\n", error_message(krb5_ret)));
        }
 
-       if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
+       if (!NT_STATUS_IS_OK(remove_ccache(state->request->data.auth.user))) {
                DEBUG(3,("winbindd_raw_kerberos_login: "
                          "could not remove ccache for user %s\n",
-                       state->request.data.auth.user));
+                       state->request->data.auth.user));
        }
 
        return result;
@@ -721,7 +693,7 @@ failed:
 /****************************************************************
 ****************************************************************/
 
-static bool check_request_flags(uint32_t flags)
+bool check_request_flags(uint32_t flags)
 {
        uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
                               WBFLAG_PAM_INFO3_TEXT |
@@ -734,7 +706,8 @@ static bool check_request_flags(uint32_t flags)
                return true;
        }
 
-       DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
+       DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
+                 flags));
 
        return false;
 }
@@ -742,32 +715,33 @@ static bool check_request_flags(uint32_t flags)
 /****************************************************************
 ****************************************************************/
 
-static NTSTATUS append_data(struct winbindd_cli_state *state,
-                           struct netr_SamInfo3 *info3,
-                           const char *name_domain,
-                           const char *name_user)
+static NTSTATUS append_auth_data(struct winbindd_cli_state *state,
+                                struct netr_SamInfo3 *info3,
+                                const char *name_domain,
+                                const char *name_user)
 {
        NTSTATUS result;
-       uint32_t flags = state->request.flags;
+       uint32_t flags = state->request->flags;
 
        if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
-               memcpy(state->response.data.auth.user_session_key,
+               memcpy(state->response->data.auth.user_session_key,
                       info3->base.key.key,
-                      sizeof(state->response.data.auth.user_session_key)
+                      sizeof(state->response->data.auth.user_session_key)
                       /* 16 */);
        }
 
        if (flags & WBFLAG_PAM_LMKEY) {
-               memcpy(state->response.data.auth.first_8_lm_hash,
+               memcpy(state->response->data.auth.first_8_lm_hash,
                       info3->base.LMSessKey.key,
-                      sizeof(state->response.data.auth.first_8_lm_hash)
+                      sizeof(state->response->data.auth.first_8_lm_hash)
                       /* 8 */);
        }
 
-       if (flags & WBFLAG_PAM_INFO3_TEXT) {
-               result = append_info3_as_txt(state->mem_ctx, state, info3);
+       if (flags & WBFLAG_PAM_UNIX_NAME) {
+               result = append_unix_username(state->mem_ctx, state, info3,
+                                             name_domain, name_user);
                if (!NT_STATUS_IS_OK(result)) {
-                       DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
+                       DEBUG(10,("Failed to append Unix Username: %s\n",
                                nt_errstr(result)));
                        return result;
                }
@@ -784,11 +758,10 @@ static NTSTATUS append_data(struct winbindd_cli_state *state,
                }
        }
 
-       if (flags & WBFLAG_PAM_UNIX_NAME) {
-               result = append_unix_username(state->mem_ctx, state, info3,
-                                             name_domain, name_user);
+       if (flags & WBFLAG_PAM_INFO3_TEXT) {
+               result = append_info3_as_txt(state->mem_ctx, state, info3);
                if (!NT_STATUS_IS_OK(result)) {
-                       DEBUG(10,("Failed to append Unix Username: %s\n",
+                       DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
                                nt_errstr(result)));
                        return result;
                }
@@ -807,77 +780,14 @@ static NTSTATUS append_data(struct winbindd_cli_state *state,
        return NT_STATUS_OK;
 }
 
-void winbindd_pam_auth(struct winbindd_cli_state *state)
-{
-       struct winbindd_domain *domain;
-       fstring name_domain, name_user;
-       char *mapped_user = NULL;
-       NTSTATUS result;
-       NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
-
-       /* Ensure null termination */
-       state->request.data.auth.user
-               [sizeof(state->request.data.auth.user)-1]='\0';
-
-       /* Ensure null termination */
-       state->request.data.auth.pass
-               [sizeof(state->request.data.auth.pass)-1]='\0';
-
-       DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
-                 state->request.data.auth.user));
-
-       if (!check_request_flags(state->request.flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
-
-       /* Parse domain and username */
-
-       name_map_status = normalize_name_unmap(state->mem_ctx,
-                                              state->request.data.auth.user,
-                                              &mapped_user);
-
-       /* If the name normalization didnt' actually do anything,
-          just use the original name */
-
-       if (!NT_STATUS_IS_OK(name_map_status) &&
-           !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
-       {
-               mapped_user = state->request.data.auth.user;
-       }
-
-       if (!canonicalize_username(mapped_user, name_domain, name_user)) {
-               result = NT_STATUS_NO_SUCH_USER;
-               goto done;
-       }
-
-       domain = find_auth_domain(state, name_domain);
-
-       if (domain == NULL) {
-               result = NT_STATUS_NO_SUCH_USER;
-               goto done;
-       }
-
-       sendto_domain(state, domain);
-       return;
- done:
-       set_auth_errors(&state->response, result);
-       DEBUG(5, ("Plain text authentication for %s returned %s "
-                 "(PAM: %d)\n",
-                 state->request.data.auth.user,
-                 state->response.data.auth.nt_status_string,
-                 state->response.data.auth.pam_error));
-       request_error(state);
-}
-
-NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
-                                      struct winbindd_cli_state *state,
-                                      struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
+                                             struct winbindd_cli_state *state,
+                                             struct netr_SamInfo3 **info3)
 {
        NTSTATUS result = NT_STATUS_LOGON_FAILURE;
        uint16 max_allowed_bad_attempts;
        fstring name_domain, name_user;
-       DOM_SID sid;
+       struct dom_sid sid;
        enum lsa_SidType type;
        uchar new_nt_pass[NT_HASH_LEN];
        const uint8 *cached_nt_pass;
@@ -897,11 +807,10 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
        /* Parse domain and username */
 
-       parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+       parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 
-       if (!lookup_cached_name(state->mem_ctx,
-                               name_domain,
+       if (!lookup_cached_name(name_domain,
                                name_user,
                                &sid,
                                &type)) {
@@ -927,7 +836,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
        *info3 = my_info3;
 
-       E_md4hash(state->request.data.auth.pass, new_nt_pass);
+       E_md4hash(state->request->data.auth.pass, new_nt_pass);
 
        dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
        dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
@@ -941,12 +850,12 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                uchar salted_hash[NT_HASH_LEN];
                E_md5hash(cached_salt, new_nt_pass, salted_hash);
 
-               password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
-                       true : false;
+               password_good = (memcmp(cached_nt_pass, salted_hash,
+                                       NT_HASH_LEN) == 0);
        } else {
                /* Old cached cred - direct store of nt_hash (bad bad bad !). */
-               password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
-                       true : false;
+               password_good = (memcmp(cached_nt_pass, new_nt_pass,
+                                       NT_HASH_LEN) == 0);
        }
 
        if (password_good) {
@@ -996,16 +905,18 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                }
 
 #ifdef HAVE_KRB5
-               if ((state->request.flags & WBFLAG_PAM_KRB5) &&
+               if ((state->request->flags & WBFLAG_PAM_KRB5) &&
                    ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
-                   (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
+                   ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
+                   /* used to cope with the case winbindd starting without network. */
+                   !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
 
                        uid_t uid = -1;
                        const char *cc = NULL;
                        char *realm = NULL;
                        const char *principal_s = NULL;
                        const char *service = NULL;
-                       bool internal_ccache = false;
+                       const char *user_ccache_file;
 
                        uid = get_uid_from_state(state);
                        if (uid == -1) {
@@ -1014,9 +925,9 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                        }
 
                        cc = generate_krb5_ccache(state->mem_ctx,
-                                               state->request.data.auth.krb5_cc_type,
-                                               state->request.data.auth.uid,
-                                               &internal_ccache);
+                                               state->request->data.auth.krb5_cc_type,
+                                               state->request->data.auth.uid,
+                                               &user_ccache_file);
                        if (cc == NULL) {
                                return NT_STATUS_NO_MEMORY;
                        }
@@ -1034,14 +945,15 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                                return NT_STATUS_NO_MEMORY;
                        }
 
-                       if (!internal_ccache) {
+                       if (user_ccache_file != NULL) {
 
-                               setup_return_cc_name(state, cc);
+                               fstrcpy(state->response->data.auth.krb5ccname,
+                                       user_ccache_file);
 
                                result = add_ccache_to_list(principal_s,
                                                            cc,
                                                            service,
-                                                           state->request.data.auth.user,
+                                                           state->request->data.auth.user,
                                                            domain->alt_name,
                                                            uid,
                                                            time(NULL),
@@ -1065,9 +977,8 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                my_info3->base.bad_password_count = 0;
 
                result = winbindd_update_creds_by_info3(domain,
-                                                       state->mem_ctx,
-                                                       state->request.data.auth.user,
-                                                       state->request.data.auth.pass,
+                                                       state->request->data.auth.user,
+                                                       state->request->data.auth.pass,
                                                        my_info3);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
@@ -1105,7 +1016,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                        DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
                }
 
-               if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
+               if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
                    (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
                        my_info3->base.acct_flags |= ACB_AUTOLOCK;
                }
@@ -1113,8 +1024,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
 failed:
        result = winbindd_update_creds_by_info3(domain,
-                                               state->mem_ctx,
-                                               state->request.data.auth.user,
+                                               state->request->data.auth.user,
                                                NULL,
                                                my_info3);
 
@@ -1126,9 +1036,9 @@ failed:
        return NT_STATUS_LOGON_FAILURE;
 }
 
-NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
-                                        struct winbindd_cli_state *state,
-                                        struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
+                                               struct winbindd_cli_state *state,
+                                               struct netr_SamInfo3 **info3)
 {
        struct winbindd_domain *contact_domain;
        fstring name_domain, name_user;
@@ -1138,14 +1048,14 @@ NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
 
        /* Parse domain and username */
 
-       parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+       parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
        /* what domain should we contact? */
 
        if ( IS_DC ) {
                if (!(contact_domain = find_domain_from_name(name_domain))) {
                        DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-                                 state->request.data.auth.user, name_domain, name_user, name_domain));
+                                 state->request->data.auth.user, name_domain, name_user, name_domain));
                        result = NT_STATUS_NO_SUCH_USER;
                        goto done;
                }
@@ -1160,7 +1070,7 @@ NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
                contact_domain = find_domain_from_name(name_domain);
                if (contact_domain == NULL) {
                        DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-                                 state->request.data.auth.user, name_domain, name_user, name_domain));
+                                 state->request->data.auth.user, name_domain, name_user, name_domain));
 
                        contact_domain = find_our_domain();
                }
@@ -1185,6 +1095,34 @@ done:
        return result;
 }
 
+static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
+                                         const char *domain, const char *user,
+                                         const DATA_BLOB *challenge,
+                                         const DATA_BLOB *lm_resp,
+                                         const DATA_BLOB *nt_resp,
+                                         struct netr_SamInfo3 **pinfo3)
+{
+       struct auth_usersupplied_info *user_info = NULL;
+       NTSTATUS status;
+
+       status = make_user_info(&user_info, user, user, domain, domain,
+                               global_myname(), lm_resp, nt_resp, NULL, NULL,
+                               NULL, AUTH_PASSWORD_RESPONSE);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
+               return status;
+       }
+
+       /* We don't want any more mapping of the username */
+       user_info->mapped_state = True;
+
+       status = check_sam_security_info3(challenge, talloc_tos(), user_info,
+                                         pinfo3);
+       free_user_info(&user_info);
+       DEBUG(10, ("Authenticated user %s\\%s successfully\n", domain, user));
+       return NT_STATUS_OK;
+}
+
 typedef        NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
                                  TALLOC_CTX *mem_ctx,
                                  uint32 logon_parameters,
@@ -1197,9 +1135,9 @@ typedef   NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
                                  DATA_BLOB nt_response,
                                  struct netr_SamInfo3 **info3);
 
-NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
-                                        struct winbindd_cli_state *state,
-                                        struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
+                                               struct winbindd_cli_state *state,
+                                               struct netr_SamInfo3 **info3)
 {
 
        struct rpc_pipe_client *netlogon_pipe;
@@ -1209,7 +1147,6 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
        int attempts = 0;
        unsigned char local_lm_response[24];
        unsigned char local_nt_response[24];
-       struct winbindd_domain *contact_domain;
        fstring name_domain, name_user;
        bool retry;
        NTSTATUS result;
@@ -1221,12 +1158,12 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 
        /* Parse domain and username */
 
-       parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+       parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
        /* do password magic */
 
+       generate_random_buffer(chal, sizeof(chal));
 
-       generate_random_buffer(chal, 8);
        if (lp_client_ntlmv2_auth()) {
                DATA_BLOB server_chal;
                DATA_BLOB names_blob;
@@ -1238,13 +1175,13 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                   the server's domain at this point.  The 'server name' is also
                   dodgy...
                */
-               names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
+               names_blob = NTLMv2_generate_names_blob(state->mem_ctx, global_myname(), lp_workgroup());
 
-               if (!SMBNTLMv2encrypt(name_user, name_domain,
-                                     state->request.data.auth.pass,
+               if (!SMBNTLMv2encrypt(NULL, name_user, name_domain,
+                                     state->request->data.auth.pass,
                                      &server_chal,
                                      &names_blob,
-                                     &lm_response, &nt_response, NULL)) {
+                                     &lm_response, &nt_response, NULL, NULL)) {
                        data_blob_free(&names_blob);
                        data_blob_free(&server_chal);
                        DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
@@ -1262,7 +1199,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 
        } else {
                if (lp_client_lanman_auth()
-                   && SMBencrypt(state->request.data.auth.pass,
+                   && SMBencrypt(state->request->data.auth.pass,
                                  chal,
                                  local_lm_response)) {
                        lm_resp = data_blob_talloc(state->mem_ctx,
@@ -1271,7 +1208,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                } else {
                        lm_resp = data_blob_null;
                }
-               SMBNTencrypt(state->request.data.auth.pass,
+               SMBNTencrypt(state->request->data.auth.pass,
                             chal,
                             local_nt_response);
 
@@ -1280,24 +1217,13 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                                           sizeof(local_nt_response));
        }
 
-       /* what domain should we contact? */
-
-       if ( IS_DC ) {
-               if (!(contact_domain = find_domain_from_name(name_domain))) {
-                       DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-                                 state->request.data.auth.user, name_domain, name_user, name_domain));
-                       result = NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
-
-       } else {
-               if (is_myname(name_domain)) {
-                       DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
-                       result =  NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
+       if (strequal(name_domain, get_global_sam_name())) {
+               DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
 
-               contact_domain = find_our_domain();
+               result = winbindd_dual_auth_passdb(
+                       state->mem_ctx, name_domain, name_user,
+                       &chal_blob, &lm_resp, &nt_resp, info3);
+               goto done;
        }
 
        /* check authentication loop */
@@ -1308,7 +1234,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                ZERO_STRUCTP(my_info3);
                retry = false;
 
-               result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
+               result = cm_connect_netlogon(domain, &netlogon_pipe);
 
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
@@ -1336,14 +1262,14 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                 *  -- abartlet 21 April 2008
                 */
 
-               logon_fn = contact_domain->can_do_samlogon_ex
+               logon_fn = domain->can_do_samlogon_ex
                        ? rpccli_netlogon_sam_network_logon_ex
                        : rpccli_netlogon_sam_network_logon;
 
                result = logon_fn(netlogon_pipe,
                                  state->mem_ctx,
                                  0,
-                                 contact_domain->dcname, /* server name */
+                                 domain->dcname,         /* server name */
                                  name_user,              /* user name */
                                  name_domain,            /* target domain */
                                  global_myname(),        /* workstation */
@@ -1354,11 +1280,10 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                attempts += 1;
 
                if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-                   && contact_domain->can_do_samlogon_ex) {
+                   && domain->can_do_samlogon_ex) {
                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
                                  "retrying with NetSamLogon\n"));
-                       contact_domain->can_do_samlogon_ex = false;
-                       retry = true;
+                       domain->can_do_samlogon_ex = false;
                        continue;
                }
 
@@ -1366,8 +1291,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                   might not yet have noticed that the DC has killed
                   our connection. */
 
-               if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
-                       retry = true;
+               if (!rpccli_is_connected(netlogon_pipe)) {
                        continue;
                }
 
@@ -1382,7 +1306,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                                "password was changed and we didn't know it. "
                                 "Killing connections to domain %s\n",
                                name_domain));
-                       invalidate_cm_connection(&contact_domain->conn);
+                       invalidate_cm_connection(&domain->conn);
                        retry = true;
                }
 
@@ -1392,16 +1316,16 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
         * the samlogon reply info3. When accurate info3 is required by the
         * caller, we look up the account flags ourselve - gd */
 
-       if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
+       if ((state->request->flags & WBFLAG_PAM_INFO3_TEXT) &&
            NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
 
                struct rpc_pipe_client *samr_pipe;
-               POLICY_HND samr_domain_handle, user_pol;
+               struct policy_handle samr_domain_handle, user_pol;
                union samr_UserInfo *info = NULL;
                NTSTATUS status_tmp;
                uint32 acct_flags;
 
-               status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
+               status_tmp = cm_connect_sam(domain, state->mem_ctx,
                                            &samr_pipe, &samr_domain_handle);
 
                if (!NT_STATUS_IS_OK(status_tmp)) {
@@ -1465,23 +1389,18 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 
        /* Ensure null termination */
-       state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
+       state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
 
        /* Ensure null termination */
-       state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
+       state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
 
        DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
-                 state->request.data.auth.user));
-
-       if (!check_request_flags(state->request.flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
+                 state->request->data.auth.user));
 
        /* Parse domain and username */
 
        name_map_status = normalize_name_unmap(state->mem_ctx,
-                                              state->request.data.auth.user,
+                                              state->request->data.auth.user,
                                               &mapped_user);
 
        /* If the name normalization didnt' actually do anything,
@@ -1490,18 +1409,20 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        if (!NT_STATUS_IS_OK(name_map_status) &&
            !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
        {
-               mapped_user = state->request.data.auth.user;
+               mapped_user = state->request->data.auth.user;
        }
 
        parse_domain_user(mapped_user, name_domain, name_user);
 
-       if ( mapped_user != state->request.data.auth.user ) {
-               fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
-               safe_strcpy( state->request.data.auth.user, domain_user,
-                            sizeof(state->request.data.auth.user)-1 );
+       if ( mapped_user != state->request->data.auth.user ) {
+               fstr_sprintf( domain_user, "%s%c%s", name_domain,
+                       *lp_winbind_separator(),
+                       name_user );
+               safe_strcpy( state->request->data.auth.user, domain_user,
+                            sizeof(state->request->data.auth.user)-1 );
        }
 
-       if (domain->online == false) {
+       if (!domain->online) {
                result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
                if (domain->startup) {
                        /* Logons are very important to users. If we're offline and
@@ -1519,7 +1440,7 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
 
        /* Check for Kerberos authentication */
-       if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
+       if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
 
                result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
                /* save for later */
@@ -1555,10 +1476,10 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
                    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
-                       goto process_result;
+                       goto done;
                }
 
-               if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
+               if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
                        DEBUG(3,("falling back to samlogon\n"));
                        goto sam_logon;
                } else {
@@ -1600,7 +1521,7 @@ sam_logon:
 
 cached_logon:
        /* Check for Cached logons */
-       if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
+       if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
            lp_winbind_offline_logon()) {
 
                result = winbindd_dual_pam_auth_cached(domain, state, &info3);
@@ -1618,7 +1539,7 @@ process_result:
 
        if (NT_STATUS_IS_OK(result)) {
 
-               DOM_SID user_sid;
+               struct dom_sid user_sid;
 
                /* In all codepaths where result == NT_STATUS_OK info3 must have
                   been initialized. */
@@ -1643,50 +1564,32 @@ process_result:
 
                /* Check if the user is in the right group */
 
-               if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
-                                       state->request.data.auth.require_membership_of_sid))) {
+               result = check_info3_in_group(
+                       info3,
+                       state->request->data.auth.require_membership_of_sid);
+               if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
-                                 state->request.data.auth.user,
-                                 state->request.data.auth.require_membership_of_sid));
+                                 state->request->data.auth.user,
+                                 state->request->data.auth.require_membership_of_sid));
                        goto done;
                }
 
-               result = append_data(state, info3, name_domain, name_user);
+               result = append_auth_data(state, info3, name_domain,
+                                         name_user);
                if (!NT_STATUS_IS_OK(result)) {
                        goto done;
                }
 
-               if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
-
-                       /* Store in-memory creds for single-signon using ntlm_auth. */
-                       result = winbindd_add_memory_creds(state->request.data.auth.user,
-                                                       get_uid_from_state(state),
-                                                       state->request.data.auth.pass);
-
-                       if (!NT_STATUS_IS_OK(result)) {
-                               DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
-                               goto done;
-                       }
-
-                       if (lp_winbind_offline_logon()) {
-                               result = winbindd_store_creds(domain,
-                                                     state->mem_ctx,
-                                                     state->request.data.auth.user,
-                                                     state->request.data.auth.pass,
-                                                     info3, NULL);
-                               if (!NT_STATUS_IS_OK(result)) {
+               if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
+                   && lp_winbind_offline_logon()) {
 
-                                       /* Release refcount. */
-                                       winbindd_delete_memory_creds(state->request.data.auth.user);
-
-                                       DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
-                                       goto done;
-                               }
-                       }
+                       result = winbindd_store_creds(domain,
+                                                     state->request->data.auth.user,
+                                                     state->request->data.auth.pass,
+                                                     info3);
                }
 
-
-               if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
+               if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
                        struct winbindd_domain *our_domain = find_our_domain();
 
                        /* This is not entirely correct I believe, but it is
@@ -1719,90 +1622,16 @@ done:
                result = NT_STATUS_NO_LOGON_SERVERS;
        }
 
-       set_auth_errors(&state->response, result);
+       set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
-             state->request.data.auth.user,
-             state->response.data.auth.nt_status_string,
-             state->response.data.auth.pam_error));
+             state->request->data.auth.user,
+             state->response->data.auth.nt_status_string,
+             state->response->data.auth.pam_error));
 
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-
-/**********************************************************************
- Challenge Response Authentication Protocol
-**********************************************************************/
-
-void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
-{
-       struct winbindd_domain *domain = NULL;
-       const char *domain_name = NULL;
-       NTSTATUS result;
-
-       if (!check_request_flags(state->request.flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
-
-       if (!state->privileged) {
-               char *error_string = NULL;
-               DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
-                         "denied.  !\n"));
-               DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
-                            "on %s are set correctly.\n",
-                            get_winbind_priv_pipe_dir()));
-               /* send a better message than ACCESS_DENIED */
-               error_string = talloc_asprintf(state->mem_ctx,
-                                              "winbind client not authorized "
-                                              "to use winbindd_pam_auth_crap."
-                                              " Ensure permissions on %s "
-                                              "are set correctly.",
-                                              get_winbind_priv_pipe_dir());
-               fstrcpy(state->response.data.auth.error_string, error_string);
-               result = NT_STATUS_ACCESS_DENIED;
-               goto done;
-       }
-
-       /* Ensure null termination */
-       state->request.data.auth_crap.user
-               [sizeof(state->request.data.auth_crap.user)-1]=0;
-       state->request.data.auth_crap.domain
-               [sizeof(state->request.data.auth_crap.domain)-1]=0;
-
-       DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
-                 (unsigned long)state->pid,
-                 state->request.data.auth_crap.domain,
-                 state->request.data.auth_crap.user));
-
-       if (*state->request.data.auth_crap.domain != '\0') {
-               domain_name = state->request.data.auth_crap.domain;
-       } else if (lp_winbind_use_default_domain()) {
-               domain_name = lp_workgroup();
-       }
-
-       if (domain_name != NULL)
-               domain = find_auth_domain(state, domain_name);
-
-       if (domain != NULL) {
-               sendto_domain(state, domain);
-               return;
-       }
-
-       result = NT_STATUS_NO_SUCH_USER;
-
- done:
-       set_auth_errors(&state->response, result);
-       DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
-                 state->request.data.auth_crap.domain,
-                 state->request.data.auth_crap.user,
-                 state->response.data.auth.nt_status_string,
-                 state->response.data.auth.pam_error));
-       request_error(state);
-       return;
-}
-
-
 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                                                 struct winbindd_cli_state *state)
 {
@@ -1812,7 +1641,6 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
        const char *name_user = NULL;
        const char *name_domain = NULL;
        const char *workstation;
-       struct winbindd_domain *contact_domain;
        int attempts = 0;
        bool retry;
 
@@ -1822,77 +1650,50 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
           anymore */
 
        /* Ensure null termination */
-       state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
-       state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
+       state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
+       state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
 
-       if (!check_request_flags(state->request.flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
-
-       name_user = state->request.data.auth_crap.user;
-
-       if (*state->request.data.auth_crap.domain) {
-               name_domain = state->request.data.auth_crap.domain;
-       } else if (lp_winbind_use_default_domain()) {
-               name_domain = lp_workgroup();
-       } else {
-               DEBUG(5,("no domain specified with username (%s) - failing auth\n",
-                        name_user));
-               result = NT_STATUS_NO_SUCH_USER;
-               goto done;
-       }
+       name_user = state->request->data.auth_crap.user;
+       name_domain = state->request->data.auth_crap.domain;
+       workstation = state->request->data.auth_crap.workstation;
 
        DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
                  name_domain, name_user));
 
-       if (*state->request.data.auth_crap.workstation) {
-               workstation = state->request.data.auth_crap.workstation;
-       } else {
-               workstation = global_myname();
-       }
-
-       if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
-               || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
-               if (!state->request.flags & WBFLAG_BIG_NTLMV2_BLOB ||
-                    state->request.extra_len != state->request.data.auth_crap.nt_resp_len) {
+       if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
+               || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
+               if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
+                    state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
                        DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
-                                 state->request.data.auth_crap.lm_resp_len,
-                                 state->request.data.auth_crap.nt_resp_len));
+                                 state->request->data.auth_crap.lm_resp_len,
+                                 state->request->data.auth_crap.nt_resp_len));
                        result = NT_STATUS_INVALID_PARAMETER;
                        goto done;
                }
        }
 
-       lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
-                                       state->request.data.auth_crap.lm_resp_len);
+       lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
+                                       state->request->data.auth_crap.lm_resp_len);
 
-       if (state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) {
+       if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
                nt_resp = data_blob_talloc(state->mem_ctx,
-                                          state->request.extra_data.data,
-                                          state->request.data.auth_crap.nt_resp_len);
+                                          state->request->extra_data.data,
+                                          state->request->data.auth_crap.nt_resp_len);
        } else {
                nt_resp = data_blob_talloc(state->mem_ctx,
-                                          state->request.data.auth_crap.nt_resp,
-                                          state->request.data.auth_crap.nt_resp_len);
+                                          state->request->data.auth_crap.nt_resp,
+                                          state->request->data.auth_crap.nt_resp_len);
        }
 
-       /* what domain should we contact? */
+       if (strequal(name_domain, get_global_sam_name())) {
+               DATA_BLOB chal_blob = data_blob_const(
+                       state->request->data.auth_crap.chal,
+                       sizeof(state->request->data.auth_crap.chal));
 
-       if ( IS_DC ) {
-               if (!(contact_domain = find_domain_from_name(name_domain))) {
-                       DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-                                 state->request.data.auth_crap.user, name_domain, name_user, name_domain));
-                       result = NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
-       } else {
-               if (is_myname(name_domain)) {
-                       DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
-                       result =  NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
-               contact_domain = find_our_domain();
+               result = winbindd_dual_auth_passdb(
+                       state->mem_ctx, name_domain, name_user,
+                       &chal_blob, &lm_resp, &nt_resp, &info3);
+               goto process_result;
        }
 
        do {
@@ -1901,7 +1702,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                retry = false;
 
                netlogon_pipe = NULL;
-               result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
+               result = cm_connect_netlogon(domain, &netlogon_pipe);
 
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
@@ -1909,29 +1710,28 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                        goto done;
                }
 
-               logon_fn = contact_domain->can_do_samlogon_ex
+               logon_fn = domain->can_do_samlogon_ex
                        ? rpccli_netlogon_sam_network_logon_ex
                        : rpccli_netlogon_sam_network_logon;
 
                result = logon_fn(netlogon_pipe,
                                  state->mem_ctx,
-                                 state->request.data.auth_crap.logon_parameters,
-                                 contact_domain->dcname,
+                                 state->request->data.auth_crap.logon_parameters,
+                                 domain->dcname,
                                  name_user,
                                  name_domain,
                                  /* Bug #3248 - found by Stefan Burkei. */
                                  workstation, /* We carefully set this above so use it... */
-                                 state->request.data.auth_crap.chal,
+                                 state->request->data.auth_crap.chal,
                                  lm_resp,
                                  nt_resp,
                                  &info3);
 
                if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-                   && contact_domain->can_do_samlogon_ex) {
+                   && domain->can_do_samlogon_ex) {
                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
                                  "retrying with NetSamLogon\n"));
-                       contact_domain->can_do_samlogon_ex = false;
-                       retry = true;
+                       domain->can_do_samlogon_ex = false;
                        continue;
                }
 
@@ -1941,8 +1741,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                   might not yet have noticed that the DC has killed
                   our connection. */
 
-               if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
-                       retry = true;
+               if (!rpccli_is_connected(netlogon_pipe)) {
                        continue;
                }
 
@@ -1956,12 +1755,14 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                                "password was changed and we didn't know it. "
                                 "Killing connections to domain %s\n",
                                name_domain));
-                       invalidate_cm_connection(&contact_domain->conn);
+                       invalidate_cm_connection(&domain->conn);
                        retry = true;
                }
 
        } while ( (attempts < 2) && retry );
 
+process_result:
+
        if (NT_STATUS_IS_OK(result)) {
 
                wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
@@ -1969,16 +1770,19 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 
                /* Check if the user is in the right group */
 
-               if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
-                                                       state->request.data.auth_crap.require_membership_of_sid))) {
+               result = check_info3_in_group(
+                       info3,
+                       state->request->data.auth_crap.require_membership_of_sid);
+               if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(3, ("User %s is not in the required group (%s), so "
                                  "crap authentication is rejected\n",
-                                 state->request.data.auth_crap.user,
-                                 state->request.data.auth_crap.require_membership_of_sid));
+                                 state->request->data.auth_crap.user,
+                                 state->request->data.auth_crap.require_membership_of_sid));
                        goto done;
                }
 
-               result = append_data(state, info3, name_domain, name_user);
+               result = append_auth_data(state, info3, name_domain,
+                                         name_user);
                if (!NT_STATUS_IS_OK(result)) {
                        goto done;
                }
@@ -1992,102 +1796,51 @@ done:
                result = NT_STATUS_NO_LOGON_SERVERS;
        }
 
-       if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
+       if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
                result = nt_status_squash(result);
        }
 
-       set_auth_errors(&state->response, result);
+       set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
               name_domain,
               name_user,
-              state->response.data.auth.nt_status_string,
-              state->response.data.auth.pam_error));
+              state->response->data.auth.nt_status_string,
+              state->response->data.auth.pam_error));
 
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-/* Change a user password */
-
-void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
-{
-       fstring domain, user;
-       char *mapped_user;
-       struct winbindd_domain *contact_domain;
-       NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
-
-       DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
-               state->request.data.chauthtok.user));
-
-       /* Setup crap */
-
-       nt_status = normalize_name_unmap(state->mem_ctx,
-                                        state->request.data.chauthtok.user,
-                                        &mapped_user);
-
-       /* Update the chauthtok name if we did any mapping */
-
-       if (NT_STATUS_IS_OK(nt_status) ||
-           NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
-       {
-               fstrcpy(state->request.data.chauthtok.user, mapped_user);
-       }
-
-       /* Must pass in state->...chauthtok.user because
-          canonicalize_username() assumes an fstring().  Since
-          we have already copied it (if necessary), this is ok. */
-
-       if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
-               set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-               DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
-                         "(PAM: %d)\n",
-                         state->request.data.auth.user,
-                         state->response.data.auth.nt_status_string,
-                         state->response.data.auth.pam_error));
-               request_error(state);
-               return;
-       }
-
-       contact_domain = find_domain_from_name(domain);
-       if (!contact_domain) {
-               set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-               DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
-                         state->request.data.chauthtok.user, domain, user, domain));
-               request_error(state);
-               return;
-       }
-
-       sendto_domain(state, contact_domain);
-}
-
 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
                                                 struct winbindd_cli_state *state)
 {
        char *oldpass;
        char *newpass = NULL;
-       POLICY_HND dom_pol;
-       struct rpc_pipe_client *cli;
+       struct policy_handle dom_pol;
+       struct rpc_pipe_client *cli = NULL;
        bool got_info = false;
        struct samr_DomInfo1 *info = NULL;
-       struct samr_ChangeReject *reject = NULL;
+       struct userPwdChangeFailureInformation *reject = NULL;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        fstring domain, user;
 
+       ZERO_STRUCT(dom_pol);
+
        DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
-                 state->request.data.auth.user));
+                 state->request->data.auth.user));
 
-       if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
+       if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
                goto done;
        }
 
        /* Change password */
 
-       oldpass = state->request.data.chauthtok.oldpass;
-       newpass = state->request.data.chauthtok.newpass;
+       oldpass = state->request->data.chauthtok.oldpass;
+       newpass = state->request->data.chauthtok.newpass;
 
        /* Initialize reject reason */
-       state->response.data.auth.reject_reason = Undefined;
+       state->response->data.auth.reject_reason = Undefined;
 
        /* Get sam handle */
 
@@ -2109,10 +1862,10 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
 
        if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
 
-               fill_in_password_policy(&state->response, info);
+               fill_in_password_policy(state->response, info);
 
-               state->response.data.auth.reject_reason =
-                       reject->reason;
+               state->response->data.auth.reject_reason =
+                       reject->extendedFailureReason;
 
                got_info = true;
        }
@@ -2143,31 +1896,10 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
 
 done:
 
-       if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
-
-               /* Update the single sign-on memory creds. */
-               result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
-                                                       newpass);
-
-               /* When we login from gdm or xdm and password expires,
-                * we change password, but there are no memory crendentials
-                * So, winbindd_replace_memory_creds() returns
-                * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
-                * --- BoYang
-                * */
-               if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
-                       result = NT_STATUS_OK;
-               }
-
-               if (!NT_STATUS_IS_OK(result)) {
-                       DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
-                       goto process_result;
-               }
-
+       if (NT_STATUS_IS_OK(result) && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
                if (lp_winbind_offline_logon()) {
                        result = winbindd_update_creds_by_name(contact_domain,
-                                                        state->mem_ctx, user,
-                                                        newpass);
+                                                              user, newpass);
                        /* Again, this happens when we login from gdm or xdm
                         * and the password expires, *BUT* cached crendentials
                         * doesn't exist. winbindd_update_creds_by_name()
@@ -2204,104 +1936,49 @@ done:
 
 process_result:
 
-       set_auth_errors(&state->response, result);
+       if (strequal(contact_domain->name, get_global_sam_name())) {
+               /* FIXME: internal rpc pipe does not cache handles yet */
+               if (cli) {
+                       if (is_valid_policy_hnd(&dom_pol)) {
+                               rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+                       }
+                       TALLOC_FREE(cli);
+               }
+       }
+
+       set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
               domain,
               user,
-              state->response.data.auth.nt_status_string,
-              state->response.data.auth.pam_error));
+              state->response->data.auth.nt_status_string,
+              state->response->data.auth.pam_error));
 
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-void winbindd_pam_logoff(struct winbindd_cli_state *state)
-{
-       struct winbindd_domain *domain;
-       fstring name_domain, user;
-       uid_t caller_uid = (uid_t)-1;
-       uid_t request_uid = state->request.data.logoff.uid;
-
-       DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
-               state->request.data.logoff.user));
-
-       /* Ensure null termination */
-       state->request.data.logoff.user
-               [sizeof(state->request.data.logoff.user)-1]='\0';
-
-       state->request.data.logoff.krb5ccname
-               [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
-
-       if (request_uid == (gid_t)-1) {
-               goto failed;
-       }
-
-       if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
-               goto failed;
-       }
-
-       if ((domain = find_auth_domain(state, name_domain)) == NULL) {
-               goto failed;
-       }
-
-       if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
-               DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
-                       strerror(errno)));
-               goto failed;
-       }
-
-       switch (caller_uid) {
-               case -1:
-                       goto failed;
-               case 0:
-                       /* root must be able to logoff any user - gd */
-                       state->request.data.logoff.uid = request_uid;
-                       break;
-               default:
-                       if (caller_uid != request_uid) {
-                               DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
-                               goto failed;
-                       }
-                       state->request.data.logoff.uid = caller_uid;
-                       break;
-       }
-
-       sendto_domain(state, domain);
-       return;
-
- failed:
-       set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-       DEBUG(5, ("Pam Logoff for %s returned %s "
-                 "(PAM: %d)\n",
-                 state->request.data.logoff.user,
-                 state->response.data.auth.nt_status_string,
-                 state->response.data.auth.pam_error));
-       request_error(state);
-       return;
-}
-
 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
                                              struct winbindd_cli_state *state)
 {
        NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
 
        DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
-               state->request.data.logoff.user));
+               state->request->data.logoff.user));
 
-       if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
+       if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
                result = NT_STATUS_OK;
                goto process_result;
        }
 
-       if (state->request.data.logoff.krb5ccname[0] == '\0') {
+       if (state->request->data.logoff.krb5ccname[0] == '\0') {
                result = NT_STATUS_OK;
                goto process_result;
        }
 
 #ifdef HAVE_KRB5
 
-       if (state->request.data.logoff.uid < 0) {
+       if (state->request->data.logoff.uid < 0) {
                DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
                goto process_result;
        }
@@ -2309,20 +1986,20 @@ enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
        /* what we need here is to find the corresponding krb5 ccache name *we*
         * created for a given username and destroy it */
 
-       if (!ccache_entry_exists(state->request.data.logoff.user)) {
+       if (!ccache_entry_exists(state->request->data.logoff.user)) {
                result = NT_STATUS_OK;
                DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
                goto process_result;
        }
 
-       if (!ccache_entry_identical(state->request.data.logoff.user,
-                                       state->request.data.logoff.uid,
-                                       state->request.data.logoff.krb5ccname)) {
+       if (!ccache_entry_identical(state->request->data.logoff.user,
+                                       state->request->data.logoff.uid,
+                                       state->request->data.logoff.krb5ccname)) {
                DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
                goto process_result;
        }
 
-       result = remove_ccache(state->request.data.logoff.user);
+       result = remove_ccache(state->request->data.logoff.user);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
                        nt_errstr(result)));
@@ -2335,57 +2012,14 @@ enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
 
 process_result:
 
-       winbindd_delete_memory_creds(state->request.data.logoff.user);
 
-       set_auth_errors(&state->response, result);
+       set_auth_errors(state->response, result);
 
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
 /* Change user password with auth crap*/
 
-void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
-{
-       struct winbindd_domain *domain = NULL;
-       const char *domain_name = NULL;
-
-       /* Ensure null termination */
-       state->request.data.chng_pswd_auth_crap.user[
-               sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
-       state->request.data.chng_pswd_auth_crap.domain[
-               sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
-
-       DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
-                 (unsigned long)state->pid,
-                 state->request.data.chng_pswd_auth_crap.domain,
-                 state->request.data.chng_pswd_auth_crap.user));
-
-       if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
-               domain_name = state->request.data.chng_pswd_auth_crap.domain;
-       } else if (lp_winbind_use_default_domain()) {
-               domain_name = lp_workgroup();
-       }
-
-       if (domain_name != NULL)
-               domain = find_domain_from_name(domain_name);
-
-       if (domain != NULL) {
-               DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
-                         "%s\n", (unsigned long)state->pid,domain->name));
-               sendto_domain(state, domain);
-               return;
-       }
-
-       set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-       DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
-                 state->request.data.chng_pswd_auth_crap.domain,
-                 state->request.data.chng_pswd_auth_crap.user,
-                 state->response.data.auth.nt_status_string,
-                 state->response.data.auth.pam_error));
-       request_error(state);
-       return;
-}
-
 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
 {
        NTSTATUS result;
@@ -2394,22 +2028,24 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
        DATA_BLOB new_lm_password;
        DATA_BLOB old_lm_hash_enc;
        fstring  domain,user;
-       POLICY_HND dom_pol;
+       struct policy_handle dom_pol;
        struct winbindd_domain *contact_domain = domainSt;
-       struct rpc_pipe_client *cli;
+       struct rpc_pipe_client *cli = NULL;
+
+       ZERO_STRUCT(dom_pol);
 
        /* Ensure null termination */
-       state->request.data.chng_pswd_auth_crap.user[
-               sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
-       state->request.data.chng_pswd_auth_crap.domain[
-               sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
+       state->request->data.chng_pswd_auth_crap.user[
+               sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
+       state->request->data.chng_pswd_auth_crap.domain[
+               sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
        *domain = 0;
        *user = 0;
 
        DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
                  (unsigned long)state->pid,
-                 state->request.data.chng_pswd_auth_crap.domain,
-                 state->request.data.chng_pswd_auth_crap.user));
+                 state->request->data.chng_pswd_auth_crap.domain,
+                 state->request->data.chng_pswd_auth_crap.user));
 
        if (lp_winbind_offline_logon()) {
                DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
@@ -2418,16 +2054,16 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
                goto done;
        }
 
-       if (*state->request.data.chng_pswd_auth_crap.domain) {
-               fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
+       if (*state->request->data.chng_pswd_auth_crap.domain) {
+               fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
        } else {
-               parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
+               parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
                                  domain, user);
 
                if(!*domain) {
                        DEBUG(3,("no domain specified with username (%s) - "
                                 "failing auth\n",
-                                state->request.data.chng_pswd_auth_crap.user));
+                                state->request->data.chng_pswd_auth_crap.user));
                        result = NT_STATUS_NO_SUCH_USER;
                        goto done;
                }
@@ -2438,33 +2074,29 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
        }
 
        if(!*user) {
-               fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
+               fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
        }
 
        DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
                  (unsigned long)state->pid, domain, user));
 
        /* Change password */
-       new_nt_password = data_blob_talloc(
-               state->mem_ctx,
-               state->request.data.chng_pswd_auth_crap.new_nt_pswd,
-               state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
-
-       old_nt_hash_enc = data_blob_talloc(
-               state->mem_ctx,
-               state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
-               state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
-
-       if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
-               new_lm_password = data_blob_talloc(
-                       state->mem_ctx,
-                       state->request.data.chng_pswd_auth_crap.new_lm_pswd,
-                       state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
-
-               old_lm_hash_enc = data_blob_talloc(
-                       state->mem_ctx,
-                       state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
-                       state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
+       new_nt_password = data_blob_const(
+               state->request->data.chng_pswd_auth_crap.new_nt_pswd,
+               state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
+
+       old_nt_hash_enc = data_blob_const(
+               state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
+               state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
+
+       if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0)        {
+               new_lm_password = data_blob_const(
+                       state->request->data.chng_pswd_auth_crap.new_lm_pswd,
+                       state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
+
+               old_lm_hash_enc = data_blob_const(
+                       state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
+                       state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
        } else {
                new_lm_password.length = 0;
                old_lm_hash_enc.length = 0;
@@ -2484,13 +2116,23 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 
  done:
 
-       set_auth_errors(&state->response, result);
+       if (strequal(contact_domain->name, get_global_sam_name())) {
+               /* FIXME: internal rpc pipe does not cache handles yet */
+               if (cli) {
+                       if (is_valid_policy_hnd(&dom_pol)) {
+                               rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+                       }
+                       TALLOC_FREE(cli);
+               }
+       }
+
+       set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
               domain, user,
-              state->response.data.auth.nt_status_string,
-              state->response.data.auth.pam_error));
+              state->response->data.auth.nt_status_string,
+              state->response->data.auth.pam_error));
 
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }