s3-auth Change type of num_sids to uint32_t
[samba.git] / source3 / winbindd / winbindd_pam.c
index a0254331213f6d8258fdaf38cffbb6a2d2ceda76..83f75f5e5649c1ce35761b8de6f26edff8564bbc 100644 (file)
 #include "winbindd.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "../librpc/gen_ndr/cli_samr.h"
+#include "rpc_client/cli_samr.h"
 #include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_netlogon.h"
 #include "smb_krb5.h"
+#include "../lib/crypto/arcfour.h"
+#include "../libcli/security/dom_sid.h"
+#include "ads.h"
+#include "../librpc/gen_ndr/krb5pac.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
@@ -122,7 +128,7 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
        DATA_BLOB blob;
        enum ndr_err_code ndr_err;
 
-       ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, info3,
+       ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
                                       (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                DEBUG(0,("append_info3_as_ndr: failed to append\n"));
@@ -193,7 +199,7 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
                                    "%U", name_user);
 
        {
-               DOM_SID user_sid;
+               struct dom_sid user_sid;
                fstring sidstr;
 
                sid_compose(&user_sid, info3->base.domain_sid,
@@ -249,11 +255,11 @@ static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
  */
 {
-       DOM_SID *require_membership_of_sid;
-       size_t num_require_membership_of_sid;
+       struct dom_sid *require_membership_of_sid;
+       uint32_t num_require_membership_of_sid;
        char *req_sid;
        const char *p;
-       DOM_SID sid;
+       struct dom_sid sid;
        size_t i;
        struct nt_user_token *token;
        TALLOC_CTX *frame = talloc_stackframe();
@@ -297,7 +303,7 @@ static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
        }
 
        status = sid_array_from_info3(talloc_tos(), info3,
-                                     &token->user_sids,
+                                     &token->sids,
                                      &token->num_sids,
                                      true, false);
        if (!NT_STATUS_IS_OK(status)) {
@@ -457,7 +463,7 @@ static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
                                        const char *type,
                                        uid_t uid,
-                                       bool *internal_ccache)
+                                       const char **user_ccache_file)
 {
        /* accept FILE and WRFILE as krb5_cc_type from the client and then
         * build the full ccname string based on the user's uid here -
@@ -465,62 +471,33 @@ static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 
        const char *gen_cc = NULL;
 
-       *internal_ccache = true;
-
-       if (uid == -1) {
-               goto memory_ccache;
+       if (uid != -1) {
+               if (strequal(type, "FILE")) {
+                       gen_cc = talloc_asprintf(
+                               mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
+               }
+               if (strequal(type, "WRFILE")) {
+                       gen_cc = talloc_asprintf(
+                               mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
+               }
        }
 
-       if (!type || type[0] == '\0') {
-               goto memory_ccache;
-       }
+       *user_ccache_file = gen_cc;
 
-       if (strequal(type, "FILE")) {
-               gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
-       } else if (strequal(type, "WRFILE")) {
-               gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
-       } else {
-               DEBUG(10,("we don't allow to set a %s type ccache\n", type));
-               goto memory_ccache;
+       if (gen_cc == NULL) {
+               gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
        }
-
-       *internal_ccache = false;
-       goto done;
-
-  memory_ccache:
-       gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
-
-  done:
        if (gen_cc == NULL) {
                DEBUG(0,("out of memory\n"));
                return NULL;
        }
 
-       DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
+       DEBUG(10, ("using ccache: %s%s\n", gen_cc,
+                  (*user_ccache_file == NULL) ? " (internal)":""));
 
        return gen_cc;
 }
 
-static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
-{
-       const char *type = state->request->data.auth.krb5_cc_type;
-
-       state->response->data.auth.krb5ccname[0] = '\0';
-
-       if (type[0] == '\0') {
-               return;
-       }
-
-       if (!strequal(type, "FILE") &&
-           !strequal(type, "WRFILE")) {
-               DEBUG(10,("won't return krbccname for a %s type ccache\n",
-                       type));
-               return;
-       }
-
-       fstrcpy(state->response->data.auth.krb5ccname, cc);
-}
-
 #endif
 
 uid_t get_uid_from_request(struct winbindd_request *request)
@@ -563,9 +540,8 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
        uid_t uid = -1;
        ADS_STRUCT *ads;
        time_t time_offset = 0;
-       bool internal_ccache = true;
-
-       ZERO_STRUCTP(info3);
+       const char *user_ccache_file;
+       struct PAC_LOGON_INFO *logon_info = NULL;
 
        *info3 = NULL;
 
@@ -580,7 +556,7 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
        cc = generate_krb5_ccache(state->mem_ctx,
                                  state->request->data.auth.krb5_cc_type,
                                  state->request->data.auth.uid,
-                                 &internal_ccache);
+                                 &user_ccache_file);
        if (cc == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -618,24 +594,24 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 
        /************************ ENTERING NON-ROOT **********************/
 
-       if (!internal_ccache) {
+       if (user_ccache_file != NULL) {
                set_effective_uid(uid);
                DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
        }
 
-       result = kerberos_return_info3_from_pac(state->mem_ctx,
-                                               principal_s,
-                                               state->request->data.auth.pass,
-                                               time_offset,
-                                               &ticket_lifetime,
-                                               &renewal_until,
-                                               cc,
-                                               true,
-                                               true,
-                                               WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
-                                               NULL,
-                                               info3);
-       if (!internal_ccache) {
+       result = kerberos_return_pac(state->mem_ctx,
+                                    principal_s,
+                                    state->request->data.auth.pass,
+                                    time_offset,
+                                    &ticket_lifetime,
+                                    &renewal_until,
+                                    cc,
+                                    true,
+                                    true,
+                                    WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+                                    NULL,
+                                    &logon_info);
+       if (user_ccache_file != NULL) {
                gain_root_privilege();
        }
 
@@ -645,15 +621,18 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
                goto failed;
        }
 
+       *info3 = &logon_info->info3;
+
        DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
                principal_s));
 
        /* if we had a user's ccache then return that string for the pam
         * environment */
 
-       if (!internal_ccache) {
+       if (user_ccache_file != NULL) {
 
-               setup_return_cc_name(state, cc);
+               fstrcpy(state->response->data.auth.krb5ccname,
+                       user_ccache_file);
 
                result = add_ccache_to_list(principal_s,
                                            cc,
@@ -808,7 +787,7 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
        NTSTATUS result = NT_STATUS_LOGON_FAILURE;
        uint16 max_allowed_bad_attempts;
        fstring name_domain, name_user;
-       DOM_SID sid;
+       struct dom_sid sid;
        enum lsa_SidType type;
        uchar new_nt_pass[NT_HASH_LEN];
        const uint8 *cached_nt_pass;
@@ -831,8 +810,7 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
        parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 
-       if (!lookup_cached_name(state->mem_ctx,
-                               name_domain,
+       if (!lookup_cached_name(name_domain,
                                name_user,
                                &sid,
                                &type)) {
@@ -938,7 +916,7 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                        char *realm = NULL;
                        const char *principal_s = NULL;
                        const char *service = NULL;
-                       bool internal_ccache = false;
+                       const char *user_ccache_file;
 
                        uid = get_uid_from_state(state);
                        if (uid == -1) {
@@ -949,7 +927,7 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                        cc = generate_krb5_ccache(state->mem_ctx,
                                                state->request->data.auth.krb5_cc_type,
                                                state->request->data.auth.uid,
-                                               &internal_ccache);
+                                               &user_ccache_file);
                        if (cc == NULL) {
                                return NT_STATUS_NO_MEMORY;
                        }
@@ -967,9 +945,10 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                                return NT_STATUS_NO_MEMORY;
                        }
 
-                       if (!internal_ccache) {
+                       if (user_ccache_file != NULL) {
 
-                               setup_return_cc_name(state, cc);
+                               fstrcpy(state->response->data.auth.krb5ccname,
+                                       user_ccache_file);
 
                                result = add_ccache_to_list(principal_s,
                                                            cc,
@@ -998,7 +977,6 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                my_info3->base.bad_password_count = 0;
 
                result = winbindd_update_creds_by_info3(domain,
-                                                       state->mem_ctx,
                                                        state->request->data.auth.user,
                                                        state->request->data.auth.pass,
                                                        my_info3);
@@ -1038,7 +1016,7 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                        DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
                }
 
-               if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
+               if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
                    (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
                        my_info3->base.acct_flags |= ACB_AUTOLOCK;
                }
@@ -1046,7 +1024,6 @@ static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
 failed:
        result = winbindd_update_creds_by_info3(domain,
-                                               state->mem_ctx,
                                                state->request->data.auth.user,
                                                NULL,
                                                my_info3);
@@ -1126,42 +1103,23 @@ static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
                                          struct netr_SamInfo3 **pinfo3)
 {
        struct auth_usersupplied_info *user_info = NULL;
-       struct auth_serversupplied_info *server_info = NULL;
-       struct netr_SamInfo3 *info3;
        NTSTATUS status;
 
        status = make_user_info(&user_info, user, user, domain, domain,
                                global_myname(), lm_resp, nt_resp, NULL, NULL,
-                               NULL, True);
+                               NULL, AUTH_PASSWORD_RESPONSE);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
                return status;
        }
 
-       status = check_sam_security(challenge, talloc_tos(), user_info,
-                                   &server_info);
-       free_user_info(&user_info);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("check_ntlm_password failed: %s\n",
-                          nt_errstr(status)));
-               return status;
-       }
-
-       info3 = TALLOC_ZERO_P(mem_ctx, struct netr_SamInfo3);
-       if (info3 == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       status = serverinfo_to_SamInfo3(server_info, NULL, 0, info3);
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("serverinfo_to_SamInfo3 failed: %s\n",
-                          nt_errstr(status)));
-               return status;
-       }
+       /* We don't want any more mapping of the username */
+       user_info->mapped_state = True;
 
+       status = check_sam_security_info3(challenge, talloc_tos(), user_info,
+                                         pinfo3);
+       free_user_info(&user_info);
        DEBUG(10, ("Authenticated user %s\\%s successfully\n", domain, user));
-       *pinfo3 = info3;
        return NT_STATUS_OK;
 }
 
@@ -1326,7 +1284,6 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
                                  "retrying with NetSamLogon\n"));
                        domain->can_do_samlogon_ex = false;
-                       retry = true;
                        continue;
                }
 
@@ -1335,7 +1292,6 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                   our connection. */
 
                if (!rpccli_is_connected(netlogon_pipe)) {
-                       retry = true;
                        continue;
                }
 
@@ -1441,11 +1397,6 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
                  state->request->data.auth.user));
 
-       if (!check_request_flags(state->request->flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
-
        /* Parse domain and username */
 
        name_map_status = normalize_name_unmap(state->mem_ctx,
@@ -1464,12 +1415,14 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        parse_domain_user(mapped_user, name_domain, name_user);
 
        if ( mapped_user != state->request->data.auth.user ) {
-               fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
+               fstr_sprintf( domain_user, "%s%c%s", name_domain,
+                       *lp_winbind_separator(),
+                       name_user );
                safe_strcpy( state->request->data.auth.user, domain_user,
                             sizeof(state->request->data.auth.user)-1 );
        }
 
-       if (domain->online == false) {
+       if (!domain->online) {
                result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
                if (domain->startup) {
                        /* Logons are very important to users. If we're offline and
@@ -1586,7 +1539,7 @@ process_result:
 
        if (NT_STATUS_IS_OK(result)) {
 
-               DOM_SID user_sid;
+               struct dom_sid user_sid;
 
                /* In all codepaths where result == NT_STATUS_OK info3 must have
                   been initialized. */
@@ -1627,18 +1580,15 @@ process_result:
                        goto done;
                }
 
-               if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
+               if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
+                   && lp_winbind_offline_logon()) {
 
-                       if (lp_winbind_offline_logon()) {
-                               result = winbindd_store_creds(domain,
-                                                     state->mem_ctx,
+                       result = winbindd_store_creds(domain,
                                                      state->request->data.auth.user,
                                                      state->request->data.auth.pass,
-                                                     info3, NULL);
-                       }
+                                                     info3);
                }
 
-
                if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
                        struct winbindd_domain *our_domain = find_our_domain();
 
@@ -1703,33 +1653,13 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
        state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
        state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
 
-       if (!check_request_flags(state->request->flags)) {
-               result = NT_STATUS_INVALID_PARAMETER_MIX;
-               goto done;
-       }
-
        name_user = state->request->data.auth_crap.user;
-
-       if (*state->request->data.auth_crap.domain) {
-               name_domain = state->request->data.auth_crap.domain;
-       } else if (lp_winbind_use_default_domain()) {
-               name_domain = lp_workgroup();
-       } else {
-               DEBUG(5,("no domain specified with username (%s) - failing auth\n",
-                        name_user));
-               result = NT_STATUS_NO_SUCH_USER;
-               goto done;
-       }
+       name_domain = state->request->data.auth_crap.domain;
+       workstation = state->request->data.auth_crap.workstation;
 
        DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
                  name_domain, name_user));
 
-       if (*state->request->data.auth_crap.workstation) {
-               workstation = state->request->data.auth_crap.workstation;
-       } else {
-               workstation = global_myname();
-       }
-
        if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
                || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
                if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
@@ -1802,7 +1732,6 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
                                  "retrying with NetSamLogon\n"));
                        domain->can_do_samlogon_ex = false;
-                       retry = true;
                        continue;
                }
 
@@ -1813,7 +1742,6 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                   our connection. */
 
                if (!rpccli_is_connected(netlogon_pipe)) {
-                       retry = true;
                        continue;
                }
 
@@ -1890,13 +1818,15 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
        char *oldpass;
        char *newpass = NULL;
        struct policy_handle dom_pol;
-       struct rpc_pipe_client *cli;
+       struct rpc_pipe_client *cli = NULL;
        bool got_info = false;
        struct samr_DomInfo1 *info = NULL;
        struct userPwdChangeFailureInformation *reject = NULL;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        fstring domain, user;
 
+       ZERO_STRUCT(dom_pol);
+
        DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
                  state->request->data.auth.user));
 
@@ -1912,53 +1842,6 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
        /* Initialize reject reason */
        state->response->data.auth.reject_reason = Undefined;
 
-       if (strequal(domain, get_global_sam_name())) {
-               struct samr_CryptPassword new_nt_password;
-               struct samr_CryptPassword new_lm_password;
-               struct samr_Password old_nt_hash_enc;
-               struct samr_Password old_lanman_hash_enc;
-               enum samPwdChangeReason rejectReason;
-
-               uchar old_nt_hash[16];
-               uchar old_lanman_hash[16];
-               uchar new_nt_hash[16];
-               uchar new_lanman_hash[16];
-
-               contact_domain = NULL;
-
-               E_md4hash(oldpass, old_nt_hash);
-               E_md4hash(newpass, new_nt_hash);
-
-               if (lp_client_lanman_auth() &&
-                   E_deshash(newpass, new_lanman_hash) &&
-                   E_deshash(oldpass, old_lanman_hash)) {
-
-                       /* E_deshash returns false for 'long' passwords (> 14
-                          DOS chars).  This allows us to match Win2k, which
-                          does not store a LM hash for these passwords (which
-                          would reduce the effective password length to 14) */
-
-                       encode_pw_buffer(new_lm_password.data, newpass, STR_UNICODE);
-                       arcfour_crypt(new_lm_password.data, old_nt_hash, 516);
-                       E_old_pw_hash(new_nt_hash, old_lanman_hash, old_lanman_hash_enc.hash);
-               } else {
-                       ZERO_STRUCT(new_lm_password);
-                       ZERO_STRUCT(old_lanman_hash_enc);
-               }
-
-               encode_pw_buffer(new_nt_password.data, newpass, STR_UNICODE);
-
-               arcfour_crypt(new_nt_password.data, old_nt_hash, 516);
-               E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
-
-               result = pass_oem_change(
-                       user,
-                       new_lm_password.data, old_lanman_hash_enc.hash,
-                       new_nt_password.data, old_nt_hash_enc.hash,
-                       &rejectReason);
-               goto done;
-       }
-
        /* Get sam handle */
 
        result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
@@ -2016,8 +1899,7 @@ done:
        if (NT_STATUS_IS_OK(result) && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
                if (lp_winbind_offline_logon()) {
                        result = winbindd_update_creds_by_name(contact_domain,
-                                                        state->mem_ctx, user,
-                                                        newpass);
+                                                              user, newpass);
                        /* Again, this happens when we login from gdm or xdm
                         * and the password expires, *BUT* cached crendentials
                         * doesn't exist. winbindd_update_creds_by_name()
@@ -2054,6 +1936,16 @@ done:
 
 process_result:
 
+       if (strequal(contact_domain->name, get_global_sam_name())) {
+               /* FIXME: internal rpc pipe does not cache handles yet */
+               if (cli) {
+                       if (is_valid_policy_hnd(&dom_pol)) {
+                               rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+                       }
+                       TALLOC_FREE(cli);
+               }
+       }
+
        set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
@@ -2138,7 +2030,9 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
        fstring  domain,user;
        struct policy_handle dom_pol;
        struct winbindd_domain *contact_domain = domainSt;
-       struct rpc_pipe_client *cli;
+       struct rpc_pipe_client *cli = NULL;
+
+       ZERO_STRUCT(dom_pol);
 
        /* Ensure null termination */
        state->request->data.chng_pswd_auth_crap.user[
@@ -2186,21 +2080,6 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
        DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
                  (unsigned long)state->pid, domain, user));
 
-       if (strequal(domain, get_global_sam_name())) {
-               enum samPwdChangeReason reject_reason;
-
-               result = pass_oem_change(
-                       user,
-                       state->request->data.chng_pswd_auth_crap.new_lm_pswd,
-                       state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
-                       state->request->data.chng_pswd_auth_crap.new_nt_pswd,
-                       state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
-                       &reject_reason);
-               DEBUG(10, ("pass_oem_change returned %s\n",
-                          nt_errstr(result)));
-               goto done;
-       }
-
        /* Change password */
        new_nt_password = data_blob_const(
                state->request->data.chng_pswd_auth_crap.new_nt_pswd,
@@ -2237,6 +2116,16 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 
  done:
 
+       if (strequal(contact_domain->name, get_global_sam_name())) {
+               /* FIXME: internal rpc pipe does not cache handles yet */
+               if (cli) {
+                       if (is_valid_policy_hnd(&dom_pol)) {
+                               rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+                       }
+                       TALLOC_FREE(cli);
+               }
+       }
+
        set_auth_errors(state->response, result);
 
        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,