X-Git-Url: http://git.samba.org/?p=samba.git;a=blobdiff_plain;f=source3%2Fwinbindd%2Fwinbindd_pam.c;h=83f75f5e5649c1ce35761b8de6f26edff8564bbc;hp=54bcac2b0485b7ddf908e75517d43d4f589a0e4e;hb=4bf783d4d6693f927f5e7ef7a9855766c91983f2;hpb=0e3339a46b1747156f35d136dbbc93b503b85b1c

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 54bcac2b048..83f75f5e564 100644
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -24,6 +24,17 @@
 
 #include "includes.h"
 #include "winbindd.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/cli_samr.h"
+#include "rpc_client/cli_samr.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_netlogon.h"
+#include "smb_krb5.h"
+#include "../lib/crypto/arcfour.h"
+#include "../libcli/security/dom_sid.h"
+#include "ads.h"
+#include "../librpc/gen_ndr/krb5pac.h"
+
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
@@ -34,54 +45,53 @@ static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
 				    struct netr_SamInfo3 *info3)
 {
 	char *ex;
-	size_t size;
 	uint32_t i;
 
-	state->response.data.auth.info3.logon_time =
+	state->response->data.auth.info3.logon_time =
 		nt_time_to_unix(info3->base.last_logon);
-	state->response.data.auth.info3.logoff_time =
+	state->response->data.auth.info3.logoff_time =
 		nt_time_to_unix(info3->base.last_logoff);
-	state->response.data.auth.info3.kickoff_time =
+	state->response->data.auth.info3.kickoff_time =
 		nt_time_to_unix(info3->base.acct_expiry);
-	state->response.data.auth.info3.pass_last_set_time =
+	state->response->data.auth.info3.pass_last_set_time =
 		nt_time_to_unix(info3->base.last_password_change);
-	state->response.data.auth.info3.pass_can_change_time =
+	state->response->data.auth.info3.pass_can_change_time =
 		nt_time_to_unix(info3->base.allow_password_change);
-	state->response.data.auth.info3.pass_must_change_time =
+	state->response->data.auth.info3.pass_must_change_time =
 		nt_time_to_unix(info3->base.force_password_change);
 
-	state->response.data.auth.info3.logon_count = info3->base.logon_count;
-	state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
+	state->response->data.auth.info3.logon_count = info3->base.logon_count;
+	state->response->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
 
-	state->response.data.auth.info3.user_rid = info3->base.rid;
-	state->response.data.auth.info3.group_rid = info3->base.primary_gid;
-	sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
+	state->response->data.auth.info3.user_rid = info3->base.rid;
+	state->response->data.auth.info3.group_rid = info3->base.primary_gid;
+	sid_to_fstring(state->response->data.auth.info3.dom_sid, info3->base.domain_sid);
 
-	state->response.data.auth.info3.num_groups = info3->base.groups.count;
-	state->response.data.auth.info3.user_flgs = info3->base.user_flags;
+	state->response->data.auth.info3.num_groups = info3->base.groups.count;
+	state->response->data.auth.info3.user_flgs = info3->base.user_flags;
 
-	state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
-	state->response.data.auth.info3.num_other_sids = info3->sidcount;
+	state->response->data.auth.info3.acct_flags = info3->base.acct_flags;
+	state->response->data.auth.info3.num_other_sids = info3->sidcount;
 
-	fstrcpy(state->response.data.auth.info3.user_name,
+	fstrcpy(state->response->data.auth.info3.user_name,
 		info3->base.account_name.string);
-	fstrcpy(state->response.data.auth.info3.full_name,
+	fstrcpy(state->response->data.auth.info3.full_name,
 		info3->base.full_name.string);
-	fstrcpy(state->response.data.auth.info3.logon_script,
+	fstrcpy(state->response->data.auth.info3.logon_script,
 		info3->base.logon_script.string);
-	fstrcpy(state->response.data.auth.info3.profile_path,
+	fstrcpy(state->response->data.auth.info3.profile_path,
 		info3->base.profile_path.string);
-	fstrcpy(state->response.data.auth.info3.home_dir,
+	fstrcpy(state->response->data.auth.info3.home_dir,
 		info3->base.home_directory.string);
-	fstrcpy(state->response.data.auth.info3.dir_drive,
+	fstrcpy(state->response->data.auth.info3.dir_drive,
 		info3->base.home_drive.string);
 
-	fstrcpy(state->response.data.auth.info3.logon_srv,
+	fstrcpy(state->response->data.auth.info3.logon_srv,
 		info3->base.logon_server.string);
-	fstrcpy(state->response.data.auth.info3.logon_dom,
+	fstrcpy(state->response->data.auth.info3.logon_dom,
 		info3->base.domain.string);
 
-	ex = talloc_strdup(mem_ctx, "");
+	ex = talloc_strdup(state->mem_ctx, "");
 	NT_STATUS_HAVE_NO_MEMORY(ex);
 
 	for (i=0; i < info3->base.groups.count; i++) {
@@ -105,17 +115,8 @@ static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
 		talloc_free(sid);
 	}
 
-	size = talloc_get_size(ex);
-
-	SAFE_FREE(state->response.extra_data.data);
-	state->response.extra_data.data = SMB_MALLOC(size);
-	if (!state->response.extra_data.data) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	memcpy(state->response.extra_data.data, ex, size);
-	talloc_free(ex);
-
-	state->response.length += size;
+	state->response->extra_data.data = ex;
+	state->response->length += talloc_get_size(ex);
 
 	return NT_STATUS_OK;
 }
@@ -127,25 +128,15 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 	DATA_BLOB blob;
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, info3,
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
 				       (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		DEBUG(0,("append_info3_as_ndr: failed to append\n"));
 		return ndr_map_error2ntstatus(ndr_err);
 	}
 
-	SAFE_FREE(state->response.extra_data.data);
-	state->response.extra_data.data = SMB_MALLOC(blob.length);
-	if (!state->response.extra_data.data) {
-		data_blob_free(&blob);
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	memset(state->response.extra_data.data, '\0', blob.length);
-	memcpy(state->response.extra_data.data, blob.data, blob.length);
-	state->response.length += blob.length;
-
-	data_blob_free(&blob);
+	state->response->extra_data.data = blob.data;
+	state->response->length += blob.length;
 
 	return NT_STATUS_OK;
 }
@@ -175,11 +166,11 @@ static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 		nt_username = name_user;
 	}
 
-	fill_domain_username(state->response.data.auth.unix_username,
+	fill_domain_username(state->response->data.auth.unix_username,
 			     nt_domain, nt_username, true);
 
 	DEBUG(5,("Setting unix username to [%s]\n",
-		state->response.data.auth.unix_username));
+		state->response->data.auth.unix_username));
 
 	return NT_STATUS_OK;
 }
@@ -192,6 +183,7 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 {
 	char *afsname = NULL;
 	char *cell;
+	char *token;
 
 	afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 	if (afsname == NULL) {
@@ -207,11 +199,11 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 				    "%U", name_user);
 
 	{
-		DOM_SID user_sid;
+		struct dom_sid user_sid;
 		fstring sidstr;
 
-		sid_copy(&user_sid, info3->base.domain_sid);
-		sid_append_rid(&user_sid, info3->base.rid);
+		sid_compose(&user_sid, info3->base.domain_sid,
+			    info3->base.rid);
 		sid_to_fstring(sidstr, &user_sid);
 		afsname = talloc_string_sub(mem_ctx, afsname,
 					    "%s", sidstr);
@@ -234,21 +226,22 @@ static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 	*cell = '\0';
 	cell += 1;
 
-	/* Append an AFS token string */
-	SAFE_FREE(state->response.extra_data.data);
-	state->response.extra_data.data =
-		afs_createtoken_str(afsname, cell);
-
-	if (state->response.extra_data.data != NULL) {
-		state->response.length +=
-			strlen((const char *)state->response.extra_data.data)+1;
+	token = afs_createtoken_str(afsname, cell);
+	if (token == NULL) {
+		return NT_STATUS_OK;
 	}
+	state->response->extra_data.data = talloc_strdup(state->mem_ctx,
+							 token);
+	if (state->response->extra_data.data == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	state->response->length +=
+		strlen((const char *)state->response->extra_data.data)+1;
 
 	return NT_STATUS_OK;
 }
 
-static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
-				     struct netr_SamInfo3 *info3,
+static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
 				     const char *group_sid)
 /**
  * Check whether a user belongs to a group or list of groups.
@@ -262,14 +255,14 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
  */
 {
-	DOM_SID *require_membership_of_sid;
-	size_t num_require_membership_of_sid;
+	struct dom_sid *require_membership_of_sid;
+	uint32_t num_require_membership_of_sid;
 	char *req_sid;
 	const char *p;
-	DOM_SID sid;
+	struct dom_sid sid;
 	size_t i;
 	struct nt_user_token *token;
-	TALLOC_CTX *frame = NULL;
+	TALLOC_CTX *frame = talloc_stackframe();
 	NTSTATUS status;
 
 	/* Parse the 'required group' SID */
@@ -279,8 +272,10 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
+	token = talloc_zero(talloc_tos(), struct nt_user_token);
+	if (token == NULL) {
 		DEBUG(0, ("talloc failed\n"));
+		TALLOC_FREE(frame);
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -289,8 +284,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 
 	p = group_sid;
 
-	frame = talloc_stackframe();
-	while (next_token_talloc(frame, &p, &req_sid, ",")) {
+	while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
 		if (!string_to_sid(&sid, req_sid)) {
 			DEBUG(0, ("check_info3_in_group: could not parse %s "
 				  "as a SID!", req_sid));
@@ -298,7 +292,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 			return NT_STATUS_INVALID_PARAMETER;
 		}
 
-		status = add_sid_to_array(mem_ctx, &sid,
+		status = add_sid_to_array(talloc_tos(), &sid,
 					  &require_membership_of_sid,
 					  &num_require_membership_of_sid);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -308,13 +302,12 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 		}
 	}
 
-	TALLOC_FREE(frame);
-
-	status = sid_array_from_info3(mem_ctx, info3,
-				      &token->user_sids,
+	status = sid_array_from_info3(talloc_tos(), info3,
+				      &token->sids,
 				      &token->num_sids,
 				      true, false);
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -324,6 +317,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 						     token))) {
 		DEBUG(3, ("could not add aliases: %s\n",
 			  nt_errstr(status)));
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -335,17 +329,19 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 		if (nt_token_check_sid(&require_membership_of_sid[i],
 				       token)) {
 			DEBUG(10, ("Access ok\n"));
+			TALLOC_FREE(frame);
 			return NT_STATUS_OK;
 		}
 	}
 
 	/* Do not distinguish this error from a wrong username/pw */
 
+	TALLOC_FREE(frame);
 	return NT_STATUS_LOGON_FAILURE;
 }
 
-struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
-					const char *domain_name)
+struct winbindd_domain *find_auth_domain(uint8_t flags,
+					 const char *domain_name)
 {
 	struct winbindd_domain *domain;
 
@@ -359,15 +355,12 @@ struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
 		return domain;
 	}
 
-	if (is_myname(domain_name)) {
-		DEBUG(3, ("Authentication for domain %s (local domain "
-			  "to this server) not supported at this "
-			  "stage\n", domain_name));
-		return NULL;
+	if (strequal(domain_name, get_global_sam_name())) {
+		return find_domain_from_name_noinit(domain_name);
 	}
 
 	/* we can auth against trusted domains */
-	if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
+	if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 		domain = find_domain_from_name_noinit(domain_name);
 		if (domain == NULL) {
 			DEBUG(3, ("Authentication for domain [%s] skipped "
@@ -416,7 +409,7 @@ static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 		return status;
 	}
 
-	fill_in_password_policy(&state->response, &password_policy);
+	fill_in_password_policy(state->response, &password_policy);
 
 	return NT_STATUS_OK;
 }
@@ -470,7 +463,7 @@ static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 					const char *type,
 					uid_t uid,
-					bool *internal_ccache)
+					const char **user_ccache_file)
 {
 	/* accept FILE and WRFILE as krb5_cc_type from the client and then
 	 * build the full ccname string based on the user's uid here -
@@ -478,77 +471,53 @@ static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 
 	const char *gen_cc = NULL;
 
-	*internal_ccache = true;
-
-	if (uid == -1) {
-		goto memory_ccache;
+	if (uid != -1) {
+		if (strequal(type, "FILE")) {
+			gen_cc = talloc_asprintf(
+				mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
+		}
+		if (strequal(type, "WRFILE")) {
+			gen_cc = talloc_asprintf(
+				mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
+		}
 	}
 
-	if (!type || type[0] == '\0') {
-		goto memory_ccache;
-	}
+	*user_ccache_file = gen_cc;
 
-	if (strequal(type, "FILE")) {
-		gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
-	} else if (strequal(type, "WRFILE")) {
-		gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
-	} else {
-		DEBUG(10,("we don't allow to set a %s type ccache\n", type));
-		goto memory_ccache;
+	if (gen_cc == NULL) {
+		gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 	}
-
-	*internal_ccache = false;
-	goto done;
-
-  memory_ccache:
-  	gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
-
-  done:
   	if (gen_cc == NULL) {
 		DEBUG(0,("out of memory\n"));
 		return NULL;
 	}
 
-	DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
+	DEBUG(10, ("using ccache: %s%s\n", gen_cc,
+		   (*user_ccache_file == NULL) ? " (internal)":""));
 
 	return gen_cc;
 }
 
-static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
-{
-	const char *type = state->request.data.auth.krb5_cc_type;
-
-	state->response.data.auth.krb5ccname[0] = '\0';
-
-	if (type[0] == '\0') {
-		return;
-	}
-
-	if (!strequal(type, "FILE") &&
-	    !strequal(type, "WRFILE")) {
-		DEBUG(10,("won't return krbccname for a %s type ccache\n",
-			type));
-		return;
-	}
-
-	fstrcpy(state->response.data.auth.krb5ccname, cc);
-}
-
 #endif
 
-static uid_t get_uid_from_state(struct winbindd_cli_state *state)
+uid_t get_uid_from_request(struct winbindd_request *request)
 {
-	uid_t uid = -1;
+	uid_t uid;
 
-	uid = state->request.data.auth.uid;
+	uid = request->data.auth.uid;
 
 	if (uid < 0) {
-		DEBUG(1,("invalid uid: '%d'\n", uid));
+		DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
 		return -1;
 	}
 	return uid;
 }
 
+static uid_t get_uid_from_state(struct winbindd_cli_state *state)
+{
+	return get_uid_from_request(state->request);
+}
+
 /**********************************************************************
  Authenticate a user with a clear text password using Kerberos and fill up
  ccache if required
@@ -571,9 +540,8 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 	uid_t uid = -1;
 	ADS_STRUCT *ads;
 	time_t time_offset = 0;
-	bool internal_ccache = true;
-
-	ZERO_STRUCTP(info3);
+	const char *user_ccache_file;
+	struct PAC_LOGON_INFO *logon_info = NULL;
 
 	*info3 = NULL;
 
@@ -586,9 +554,9 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 	}
 
 	cc = generate_krb5_ccache(state->mem_ctx,
-				  state->request.data.auth.krb5_cc_type,
-				  state->request.data.auth.uid,
-				  &internal_ccache);
+				  state->request->data.auth.krb5_cc_type,
+				  state->request->data.auth.uid,
+				  &user_ccache_file);
 	if (cc == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -606,7 +574,7 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 	/* 3rd step:
 	 * do kerberos auth and setup ccache as the user */
 
-	parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+	parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 	realm = domain->alt_name;
 	strupper_m(realm);
@@ -626,23 +594,24 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 
 	/************************ ENTERING NON-ROOT **********************/
 
-	if (!internal_ccache) {
+	if (user_ccache_file != NULL) {
 		set_effective_uid(uid);
 		DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 	}
 
-	result = kerberos_return_info3_from_pac(state->mem_ctx,
-						principal_s,
-						state->request.data.auth.pass,
-						time_offset,
-						&ticket_lifetime,
-						&renewal_until,
-						cc,
-						true,
-						true,
-						WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
-						info3);
-	if (!internal_ccache) {
+	result = kerberos_return_pac(state->mem_ctx,
+				     principal_s,
+				     state->request->data.auth.pass,
+				     time_offset,
+				     &ticket_lifetime,
+				     &renewal_until,
+				     cc,
+				     true,
+				     true,
+				     WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
+				     NULL,
+				     &logon_info);
+	if (user_ccache_file != NULL) {
 		gain_root_privilege();
 	}
 
@@ -652,20 +621,23 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 		goto failed;
 	}
 
+	*info3 = &logon_info->info3;
+
 	DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 		principal_s));
 
 	/* if we had a user's ccache then return that string for the pam
 	 * environment */
 
-	if (!internal_ccache) {
+	if (user_ccache_file != NULL) {
 
-		setup_return_cc_name(state, cc);
+		fstrcpy(state->response->data.auth.krb5ccname,
+			user_ccache_file);
 
 		result = add_ccache_to_list(principal_s,
 					    cc,
 					    service,
-					    state->request.data.auth.user,
+					    state->request->data.auth.user,
 					    realm,
 					    uid,
 					    time(NULL),
@@ -706,10 +678,10 @@ failed:
 			 "%s\n", error_message(krb5_ret)));
 	}
 
-	if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
+	if (!NT_STATUS_IS_OK(remove_ccache(state->request->data.auth.user))) {
 		DEBUG(3,("winbindd_raw_kerberos_login: "
 			  "could not remove ccache for user %s\n",
-			state->request.data.auth.user));
+			state->request->data.auth.user));
 	}
 
 	return result;
@@ -721,7 +693,7 @@ failed:
 /****************************************************************
 ****************************************************************/
 
-static bool check_request_flags(uint32_t flags)
+bool check_request_flags(uint32_t flags)
 {
 	uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 			       WBFLAG_PAM_INFO3_TEXT |
@@ -734,7 +706,8 @@ static bool check_request_flags(uint32_t flags)
 		return true;
 	}
 
-	DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
+	DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
+		  flags));
 
 	return false;
 }
@@ -742,32 +715,33 @@ static bool check_request_flags(uint32_t flags)
 /****************************************************************
 ****************************************************************/
 
-static NTSTATUS append_data(struct winbindd_cli_state *state,
-			    struct netr_SamInfo3 *info3,
-			    const char *name_domain,
-			    const char *name_user)
+static NTSTATUS append_auth_data(struct winbindd_cli_state *state,
+				 struct netr_SamInfo3 *info3,
+				 const char *name_domain,
+				 const char *name_user)
 {
 	NTSTATUS result;
-	uint32_t flags = state->request.flags;
+	uint32_t flags = state->request->flags;
 
 	if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
-		memcpy(state->response.data.auth.user_session_key,
+		memcpy(state->response->data.auth.user_session_key,
 		       info3->base.key.key,
-		       sizeof(state->response.data.auth.user_session_key)
+		       sizeof(state->response->data.auth.user_session_key)
 		       /* 16 */);
 	}
 
 	if (flags & WBFLAG_PAM_LMKEY) {
-		memcpy(state->response.data.auth.first_8_lm_hash,
+		memcpy(state->response->data.auth.first_8_lm_hash,
 		       info3->base.LMSessKey.key,
-		       sizeof(state->response.data.auth.first_8_lm_hash)
+		       sizeof(state->response->data.auth.first_8_lm_hash)
 		       /* 8 */);
 	}
 
-	if (flags & WBFLAG_PAM_INFO3_TEXT) {
-		result = append_info3_as_txt(state->mem_ctx, state, info3);
+	if (flags & WBFLAG_PAM_UNIX_NAME) {
+		result = append_unix_username(state->mem_ctx, state, info3,
+					      name_domain, name_user);
 		if (!NT_STATUS_IS_OK(result)) {
-			DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
+			DEBUG(10,("Failed to append Unix Username: %s\n",
 				nt_errstr(result)));
 			return result;
 		}
@@ -784,11 +758,10 @@ static NTSTATUS append_data(struct winbindd_cli_state *state,
 		}
 	}
 
-	if (flags & WBFLAG_PAM_UNIX_NAME) {
-		result = append_unix_username(state->mem_ctx, state, info3,
-					      name_domain, name_user);
+	if (flags & WBFLAG_PAM_INFO3_TEXT) {
+		result = append_info3_as_txt(state->mem_ctx, state, info3);
 		if (!NT_STATUS_IS_OK(result)) {
-			DEBUG(10,("Failed to append Unix Username: %s\n",
+			DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 				nt_errstr(result)));
 			return result;
 		}
@@ -807,77 +780,14 @@ static NTSTATUS append_data(struct winbindd_cli_state *state,
 	return NT_STATUS_OK;
 }
 
-void winbindd_pam_auth(struct winbindd_cli_state *state)
-{
-	struct winbindd_domain *domain;
-	fstring name_domain, name_user;
-	char *mapped_user = NULL;
-	NTSTATUS result;
-	NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
-
-	/* Ensure null termination */
-	state->request.data.auth.user
-		[sizeof(state->request.data.auth.user)-1]='\0';
-
-	/* Ensure null termination */
-	state->request.data.auth.pass
-		[sizeof(state->request.data.auth.pass)-1]='\0';
-
-	DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
-		  state->request.data.auth.user));
-
-	if (!check_request_flags(state->request.flags)) {
-		result = NT_STATUS_INVALID_PARAMETER_MIX;
-		goto done;
-	}
-
-	/* Parse domain and username */
-
-	name_map_status = normalize_name_unmap(state->mem_ctx,
-					       state->request.data.auth.user,
-					       &mapped_user);
-
-	/* If the name normalization didnt' actually do anything,
-	   just use the original name */
-
-	if (!NT_STATUS_IS_OK(name_map_status) &&
-	    !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
-	{
-		mapped_user = state->request.data.auth.user;
-	}
-
-	if (!canonicalize_username(mapped_user, name_domain, name_user)) {
-		result = NT_STATUS_NO_SUCH_USER;
-		goto done;
-	}
-
-	domain = find_auth_domain(state, name_domain);
-
-	if (domain == NULL) {
-		result = NT_STATUS_NO_SUCH_USER;
-		goto done;
-	}
-
-	sendto_domain(state, domain);
-	return;
- done:
-	set_auth_errors(&state->response, result);
-	DEBUG(5, ("Plain text authentication for %s returned %s "
-		  "(PAM: %d)\n",
-		  state->request.data.auth.user,
-		  state->response.data.auth.nt_status_string,
-		  state->response.data.auth.pam_error));
-	request_error(state);
-}
-
-NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
-				       struct winbindd_cli_state *state,
-				       struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
+					      struct winbindd_cli_state *state,
+					      struct netr_SamInfo3 **info3)
 {
 	NTSTATUS result = NT_STATUS_LOGON_FAILURE;
 	uint16 max_allowed_bad_attempts;
 	fstring name_domain, name_user;
-	DOM_SID sid;
+	struct dom_sid sid;
 	enum lsa_SidType type;
 	uchar new_nt_pass[NT_HASH_LEN];
 	const uint8 *cached_nt_pass;
@@ -897,11 +807,10 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
 	/* Parse domain and username */
 
-	parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+	parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 
-	if (!lookup_cached_name(state->mem_ctx,
-	                        name_domain,
+	if (!lookup_cached_name(name_domain,
 				name_user,
 				&sid,
 				&type)) {
@@ -927,7 +836,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
 	*info3 = my_info3;
 
-	E_md4hash(state->request.data.auth.pass, new_nt_pass);
+	E_md4hash(state->request->data.auth.pass, new_nt_pass);
 
 	dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
 	dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
@@ -941,12 +850,12 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 		uchar salted_hash[NT_HASH_LEN];
 		E_md5hash(cached_salt, new_nt_pass, salted_hash);
 
-		password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
-			true : false;
+		password_good = (memcmp(cached_nt_pass, salted_hash,
+					NT_HASH_LEN) == 0);
 	} else {
 		/* Old cached cred - direct store of nt_hash (bad bad bad !). */
-		password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
-			true : false;
+		password_good = (memcmp(cached_nt_pass, new_nt_pass,
+					NT_HASH_LEN) == 0);
 	}
 
 	if (password_good) {
@@ -996,16 +905,18 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 		}
 
 #ifdef HAVE_KRB5
-		if ((state->request.flags & WBFLAG_PAM_KRB5) &&
+		if ((state->request->flags & WBFLAG_PAM_KRB5) &&
 		    ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
-		    (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
+		    ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
+		    /* used to cope with the case winbindd starting without network. */
+		    !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
 
 			uid_t uid = -1;
 			const char *cc = NULL;
 			char *realm = NULL;
 			const char *principal_s = NULL;
 			const char *service = NULL;
-			bool internal_ccache = false;
+			const char *user_ccache_file;
 
 			uid = get_uid_from_state(state);
 			if (uid == -1) {
@@ -1014,9 +925,9 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 			}
 
 			cc = generate_krb5_ccache(state->mem_ctx,
-						state->request.data.auth.krb5_cc_type,
-						state->request.data.auth.uid,
-						&internal_ccache);
+						state->request->data.auth.krb5_cc_type,
+						state->request->data.auth.uid,
+						&user_ccache_file);
 			if (cc == NULL) {
 				return NT_STATUS_NO_MEMORY;
 			}
@@ -1034,14 +945,15 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 				return NT_STATUS_NO_MEMORY;
 			}
 
-			if (!internal_ccache) {
+			if (user_ccache_file != NULL) {
 
-				setup_return_cc_name(state, cc);
+				fstrcpy(state->response->data.auth.krb5ccname,
+					user_ccache_file);
 
 				result = add_ccache_to_list(principal_s,
 							    cc,
 							    service,
-							    state->request.data.auth.user,
+							    state->request->data.auth.user,
 							    domain->alt_name,
 							    uid,
 							    time(NULL),
@@ -1065,9 +977,8 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 		my_info3->base.bad_password_count = 0;
 
 		result = winbindd_update_creds_by_info3(domain,
-							state->mem_ctx,
-							state->request.data.auth.user,
-							state->request.data.auth.pass,
+							state->request->data.auth.user,
+							state->request->data.auth.pass,
 							my_info3);
 		if (!NT_STATUS_IS_OK(result)) {
 			DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
@@ -1105,7 +1016,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 			DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
 		}
 
-		if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
+		if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
 		    (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
 			my_info3->base.acct_flags |= ACB_AUTOLOCK;
 		}
@@ -1113,8 +1024,7 @@ NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 
 failed:
 	result = winbindd_update_creds_by_info3(domain,
-						state->mem_ctx,
-						state->request.data.auth.user,
+						state->request->data.auth.user,
 						NULL,
 						my_info3);
 
@@ -1126,9 +1036,9 @@ failed:
 	return NT_STATUS_LOGON_FAILURE;
 }
 
-NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
-					 struct winbindd_cli_state *state,
-					 struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
+						struct winbindd_cli_state *state,
+						struct netr_SamInfo3 **info3)
 {
 	struct winbindd_domain *contact_domain;
 	fstring name_domain, name_user;
@@ -1138,14 +1048,14 @@ NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
 
 	/* Parse domain and username */
 
-	parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+	parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 	/* what domain should we contact? */
 
 	if ( IS_DC ) {
 		if (!(contact_domain = find_domain_from_name(name_domain))) {
 			DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-				  state->request.data.auth.user, name_domain, name_user, name_domain));
+				  state->request->data.auth.user, name_domain, name_user, name_domain));
 			result = NT_STATUS_NO_SUCH_USER;
 			goto done;
 		}
@@ -1160,7 +1070,7 @@ NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
 		contact_domain = find_domain_from_name(name_domain);
 		if (contact_domain == NULL) {
 			DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-				  state->request.data.auth.user, name_domain, name_user, name_domain));
+				  state->request->data.auth.user, name_domain, name_user, name_domain));
 
 			contact_domain = find_our_domain();
 		}
@@ -1185,6 +1095,34 @@ done:
 	return result;
 }
 
+static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
+					  const char *domain, const char *user,
+					  const DATA_BLOB *challenge,
+					  const DATA_BLOB *lm_resp,
+					  const DATA_BLOB *nt_resp,
+					  struct netr_SamInfo3 **pinfo3)
+{
+	struct auth_usersupplied_info *user_info = NULL;
+	NTSTATUS status;
+
+	status = make_user_info(&user_info, user, user, domain, domain,
+				global_myname(), lm_resp, nt_resp, NULL, NULL,
+				NULL, AUTH_PASSWORD_RESPONSE);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
+		return status;
+	}
+
+	/* We don't want any more mapping of the username */
+	user_info->mapped_state = True;
+
+	status = check_sam_security_info3(challenge, talloc_tos(), user_info,
+					  pinfo3);
+	free_user_info(&user_info);
+	DEBUG(10, ("Authenticated user %s\\%s successfully\n", domain, user));
+	return NT_STATUS_OK;
+}
+
 typedef	NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
 				  TALLOC_CTX *mem_ctx,
 				  uint32 logon_parameters,
@@ -1197,9 +1135,9 @@ typedef	NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
 				  DATA_BLOB nt_response,
 				  struct netr_SamInfo3 **info3);
 
-NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
-					 struct winbindd_cli_state *state,
-					 struct netr_SamInfo3 **info3)
+static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
+						struct winbindd_cli_state *state,
+						struct netr_SamInfo3 **info3)
 {
 
 	struct rpc_pipe_client *netlogon_pipe;
@@ -1209,7 +1147,6 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 	int attempts = 0;
 	unsigned char local_lm_response[24];
 	unsigned char local_nt_response[24];
-	struct winbindd_domain *contact_domain;
 	fstring name_domain, name_user;
 	bool retry;
 	NTSTATUS result;
@@ -1221,12 +1158,12 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 
 	/* Parse domain and username */
 
-	parse_domain_user(state->request.data.auth.user, name_domain, name_user);
+	parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 
 	/* do password magic */
 
+	generate_random_buffer(chal, sizeof(chal));
 
-	generate_random_buffer(chal, 8);
 	if (lp_client_ntlmv2_auth()) {
 		DATA_BLOB server_chal;
 		DATA_BLOB names_blob;
@@ -1238,13 +1175,13 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		   the server's domain at this point.  The 'server name' is also
 		   dodgy...
 		*/
-		names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
+		names_blob = NTLMv2_generate_names_blob(state->mem_ctx, global_myname(), lp_workgroup());
 
-		if (!SMBNTLMv2encrypt(name_user, name_domain,
-				      state->request.data.auth.pass,
+		if (!SMBNTLMv2encrypt(NULL, name_user, name_domain,
+				      state->request->data.auth.pass,
 				      &server_chal,
 				      &names_blob,
-				      &lm_response, &nt_response, NULL)) {
+				      &lm_response, &nt_response, NULL, NULL)) {
 			data_blob_free(&names_blob);
 			data_blob_free(&server_chal);
 			DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
@@ -1262,7 +1199,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 
 	} else {
 		if (lp_client_lanman_auth()
-		    && SMBencrypt(state->request.data.auth.pass,
+		    && SMBencrypt(state->request->data.auth.pass,
 				  chal,
 				  local_lm_response)) {
 			lm_resp = data_blob_talloc(state->mem_ctx,
@@ -1271,7 +1208,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		} else {
 			lm_resp = data_blob_null;
 		}
-		SMBNTencrypt(state->request.data.auth.pass,
+		SMBNTencrypt(state->request->data.auth.pass,
 			     chal,
 			     local_nt_response);
 
@@ -1280,24 +1217,13 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 					   sizeof(local_nt_response));
 	}
 
-	/* what domain should we contact? */
-
-	if ( IS_DC ) {
-		if (!(contact_domain = find_domain_from_name(name_domain))) {
-			DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-				  state->request.data.auth.user, name_domain, name_user, name_domain));
-			result = NT_STATUS_NO_SUCH_USER;
-			goto done;
-		}
-
-	} else {
-		if (is_myname(name_domain)) {
-			DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
-			result =  NT_STATUS_NO_SUCH_USER;
-			goto done;
-		}
+	if (strequal(name_domain, get_global_sam_name())) {
+		DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
 
-		contact_domain = find_our_domain();
+		result = winbindd_dual_auth_passdb(
+			state->mem_ctx, name_domain, name_user,
+			&chal_blob, &lm_resp, &nt_resp, info3);
+		goto done;
 	}
 
 	/* check authentication loop */
@@ -1308,7 +1234,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		ZERO_STRUCTP(my_info3);
 		retry = false;
 
-		result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
+		result = cm_connect_netlogon(domain, &netlogon_pipe);
 
 		if (!NT_STATUS_IS_OK(result)) {
 			DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
@@ -1336,14 +1262,14 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		 *  -- abartlet 21 April 2008
 		 */
 
-		logon_fn = contact_domain->can_do_samlogon_ex
+		logon_fn = domain->can_do_samlogon_ex
 			? rpccli_netlogon_sam_network_logon_ex
 			: rpccli_netlogon_sam_network_logon;
 
 		result = logon_fn(netlogon_pipe,
 				  state->mem_ctx,
 				  0,
-				  contact_domain->dcname, /* server name */
+				  domain->dcname,	  /* server name */
 				  name_user,              /* user name */
 				  name_domain,            /* target domain */
 				  global_myname(),        /* workstation */
@@ -1354,11 +1280,10 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		attempts += 1;
 
 		if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-		    && contact_domain->can_do_samlogon_ex) {
+		    && domain->can_do_samlogon_ex) {
 			DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
 				  "retrying with NetSamLogon\n"));
-			contact_domain->can_do_samlogon_ex = false;
-			retry = true;
+			domain->can_do_samlogon_ex = false;
 			continue;
 		}
 
@@ -1366,8 +1291,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		   might not yet have noticed that the DC has killed
 		   our connection. */
 
-		if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
-			retry = true;
+		if (!rpccli_is_connected(netlogon_pipe)) {
 			continue;
 		}
 
@@ -1382,7 +1306,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 				"password was changed and we didn't know it. "
 				 "Killing connections to domain %s\n",
 				name_domain));
-			invalidate_cm_connection(&contact_domain->conn);
+			invalidate_cm_connection(&domain->conn);
 			retry = true;
 		}
 
@@ -1392,7 +1316,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 	 * the samlogon reply info3. When accurate info3 is required by the
 	 * caller, we look up the account flags ourselve - gd */
 
-	if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
+	if ((state->request->flags & WBFLAG_PAM_INFO3_TEXT) &&
 	    NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
 
 		struct rpc_pipe_client *samr_pipe;
@@ -1401,7 +1325,7 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 		NTSTATUS status_tmp;
 		uint32 acct_flags;
 
-		status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
+		status_tmp = cm_connect_sam(domain, state->mem_ctx,
 					    &samr_pipe, &samr_domain_handle);
 
 		if (!NT_STATUS_IS_OK(status_tmp)) {
@@ -1465,23 +1389,18 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
 	NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 
 	/* Ensure null termination */
-	state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
+	state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
 
 	/* Ensure null termination */
-	state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
+	state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
 
 	DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
-		  state->request.data.auth.user));
-
-	if (!check_request_flags(state->request.flags)) {
-		result = NT_STATUS_INVALID_PARAMETER_MIX;
-		goto done;
-	}
+		  state->request->data.auth.user));
 
 	/* Parse domain and username */
 
 	name_map_status = normalize_name_unmap(state->mem_ctx,
-					       state->request.data.auth.user,
+					       state->request->data.auth.user,
 					       &mapped_user);
 
 	/* If the name normalization didnt' actually do anything,
@@ -1490,18 +1409,20 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
 	if (!NT_STATUS_IS_OK(name_map_status) &&
 	    !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 	{
-		mapped_user = state->request.data.auth.user;
+		mapped_user = state->request->data.auth.user;
 	}
 
 	parse_domain_user(mapped_user, name_domain, name_user);
 
-	if ( mapped_user != state->request.data.auth.user ) {
-		fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
-		safe_strcpy( state->request.data.auth.user, domain_user,
-			     sizeof(state->request.data.auth.user)-1 );
+	if ( mapped_user != state->request->data.auth.user ) {
+		fstr_sprintf( domain_user, "%s%c%s", name_domain,
+			*lp_winbind_separator(),
+			name_user );
+		safe_strcpy( state->request->data.auth.user, domain_user,
+			     sizeof(state->request->data.auth.user)-1 );
 	}
 
-	if (domain->online == false) {
+	if (!domain->online) {
 		result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 		if (domain->startup) {
 			/* Logons are very important to users. If we're offline and
@@ -1519,7 +1440,7 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
 	DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
 
 	/* Check for Kerberos authentication */
-	if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
+	if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
 
 		result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
 		/* save for later */
@@ -1555,10 +1476,10 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
 		    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
 		    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
 		    NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
-			goto process_result;
+			goto done;
 		}
 
-		if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
+		if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
 			DEBUG(3,("falling back to samlogon\n"));
 			goto sam_logon;
 		} else {
@@ -1600,7 +1521,7 @@ sam_logon:
 
 cached_logon:
 	/* Check for Cached logons */
-	if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
+	if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
 	    lp_winbind_offline_logon()) {
 
 		result = winbindd_dual_pam_auth_cached(domain, state, &info3);
@@ -1618,7 +1539,7 @@ process_result:
 
 	if (NT_STATUS_IS_OK(result)) {
 
-		DOM_SID user_sid;
+		struct dom_sid user_sid;
 
 		/* In all codepaths where result == NT_STATUS_OK info3 must have
 		   been initialized. */
@@ -1643,50 +1564,32 @@ process_result:
 
 		/* Check if the user is in the right group */
 
-		if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
-					state->request.data.auth.require_membership_of_sid))) {
+		result = check_info3_in_group(
+			info3,
+			state->request->data.auth.require_membership_of_sid);
+		if (!NT_STATUS_IS_OK(result)) {
 			DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
-				  state->request.data.auth.user,
-				  state->request.data.auth.require_membership_of_sid));
+				  state->request->data.auth.user,
+				  state->request->data.auth.require_membership_of_sid));
 			goto done;
 		}
 
-		result = append_data(state, info3, name_domain, name_user);
+		result = append_auth_data(state, info3, name_domain,
+					  name_user);
 		if (!NT_STATUS_IS_OK(result)) {
 			goto done;
 		}
 
-		if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
-
-			/* Store in-memory creds for single-signon using ntlm_auth. */
-			result = winbindd_add_memory_creds(state->request.data.auth.user,
-							get_uid_from_state(state),
-							state->request.data.auth.pass);
-
-			if (!NT_STATUS_IS_OK(result)) {
-				DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
-				goto done;
-			}
-
-			if (lp_winbind_offline_logon()) {
-				result = winbindd_store_creds(domain,
-						      state->mem_ctx,
-						      state->request.data.auth.user,
-						      state->request.data.auth.pass,
-						      info3, NULL);
-				if (!NT_STATUS_IS_OK(result)) {
+		if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
+		    && lp_winbind_offline_logon()) {
 
-					/* Release refcount. */
-					winbindd_delete_memory_creds(state->request.data.auth.user);
-
-					DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
-					goto done;
-				}
-			}
+			result = winbindd_store_creds(domain,
+						      state->request->data.auth.user,
+						      state->request->data.auth.pass,
+						      info3);
 		}
 
-
-		if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
+		if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
 			struct winbindd_domain *our_domain = find_our_domain();
 
 			/* This is not entirely correct I believe, but it is
@@ -1719,90 +1622,16 @@ done:
 		result = NT_STATUS_NO_LOGON_SERVERS;
 	}
 
-	set_auth_errors(&state->response, result);
+	set_auth_errors(state->response, result);
 
 	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
-	      state->request.data.auth.user,
-	      state->response.data.auth.nt_status_string,
-	      state->response.data.auth.pam_error));
+	      state->request->data.auth.user,
+	      state->response->data.auth.nt_status_string,
+	      state->response->data.auth.pam_error));
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-
-/**********************************************************************
- Challenge Response Authentication Protocol
-**********************************************************************/
-
-void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
-{
-	struct winbindd_domain *domain = NULL;
-	const char *domain_name = NULL;
-	NTSTATUS result;
-
-	if (!check_request_flags(state->request.flags)) {
-		result = NT_STATUS_INVALID_PARAMETER_MIX;
-		goto done;
-	}
-
-	if (!state->privileged) {
-		char *error_string = NULL;
-		DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
-			  "denied.  !\n"));
-		DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
-			     "on %s are set correctly.\n",
-			     get_winbind_priv_pipe_dir()));
-		/* send a better message than ACCESS_DENIED */
-		error_string = talloc_asprintf(state->mem_ctx,
-					       "winbind client not authorized "
-					       "to use winbindd_pam_auth_crap."
-					       " Ensure permissions on %s "
-					       "are set correctly.",
-					       get_winbind_priv_pipe_dir());
-		fstrcpy(state->response.data.auth.error_string, error_string);
-		result = NT_STATUS_ACCESS_DENIED;
-		goto done;
-	}
-
-	/* Ensure null termination */
-	state->request.data.auth_crap.user
-		[sizeof(state->request.data.auth_crap.user)-1]=0;
-	state->request.data.auth_crap.domain
-		[sizeof(state->request.data.auth_crap.domain)-1]=0;
-
-	DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
-		  (unsigned long)state->pid,
-		  state->request.data.auth_crap.domain,
-		  state->request.data.auth_crap.user));
-
-	if (*state->request.data.auth_crap.domain != '\0') {
-		domain_name = state->request.data.auth_crap.domain;
-	} else if (lp_winbind_use_default_domain()) {
-		domain_name = lp_workgroup();
-	}
-
-	if (domain_name != NULL)
-		domain = find_auth_domain(state, domain_name);
-
-	if (domain != NULL) {
-		sendto_domain(state, domain);
-		return;
-	}
-
-	result = NT_STATUS_NO_SUCH_USER;
-
- done:
-	set_auth_errors(&state->response, result);
-	DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
-		  state->request.data.auth_crap.domain,
-		  state->request.data.auth_crap.user,
-		  state->response.data.auth.nt_status_string,
-		  state->response.data.auth.pam_error));
-	request_error(state);
-	return;
-}
-
-
 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 						 struct winbindd_cli_state *state)
 {
@@ -1812,7 +1641,6 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 	const char *name_user = NULL;
 	const char *name_domain = NULL;
 	const char *workstation;
-	struct winbindd_domain *contact_domain;
 	int attempts = 0;
 	bool retry;
 
@@ -1822,77 +1650,50 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 	   anymore */
 
 	/* Ensure null termination */
-	state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
-	state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
+	state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
+	state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
 
-	if (!check_request_flags(state->request.flags)) {
-		result = NT_STATUS_INVALID_PARAMETER_MIX;
-		goto done;
-	}
-
-	name_user = state->request.data.auth_crap.user;
-
-	if (*state->request.data.auth_crap.domain) {
-		name_domain = state->request.data.auth_crap.domain;
-	} else if (lp_winbind_use_default_domain()) {
-		name_domain = lp_workgroup();
-	} else {
-		DEBUG(5,("no domain specified with username (%s) - failing auth\n",
-			 name_user));
-		result = NT_STATUS_NO_SUCH_USER;
-		goto done;
-	}
+	name_user = state->request->data.auth_crap.user;
+	name_domain = state->request->data.auth_crap.domain;
+	workstation = state->request->data.auth_crap.workstation;
 
 	DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
 		  name_domain, name_user));
 
-	if (*state->request.data.auth_crap.workstation) {
-		workstation = state->request.data.auth_crap.workstation;
-	} else {
-		workstation = global_myname();
-	}
-
-	if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
-		|| state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
-		if (!(state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) ||
-		     state->request.extra_len != state->request.data.auth_crap.nt_resp_len) {
+	if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
+		|| state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
+		if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
+		     state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
 			DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
-				  state->request.data.auth_crap.lm_resp_len,
-				  state->request.data.auth_crap.nt_resp_len));
+				  state->request->data.auth_crap.lm_resp_len,
+				  state->request->data.auth_crap.nt_resp_len));
 			result = NT_STATUS_INVALID_PARAMETER;
 			goto done;
 		}
 	}
 
-	lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
-					state->request.data.auth_crap.lm_resp_len);
+	lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
+					state->request->data.auth_crap.lm_resp_len);
 
-	if (state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) {
+	if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
 		nt_resp = data_blob_talloc(state->mem_ctx,
-					   state->request.extra_data.data,
-					   state->request.data.auth_crap.nt_resp_len);
+					   state->request->extra_data.data,
+					   state->request->data.auth_crap.nt_resp_len);
 	} else {
 		nt_resp = data_blob_talloc(state->mem_ctx,
-					   state->request.data.auth_crap.nt_resp,
-					   state->request.data.auth_crap.nt_resp_len);
+					   state->request->data.auth_crap.nt_resp,
+					   state->request->data.auth_crap.nt_resp_len);
 	}
 
-	/* what domain should we contact? */
+	if (strequal(name_domain, get_global_sam_name())) {
+		DATA_BLOB chal_blob = data_blob_const(
+			state->request->data.auth_crap.chal,
+			sizeof(state->request->data.auth_crap.chal));
 
-	if ( IS_DC ) {
-		if (!(contact_domain = find_domain_from_name(name_domain))) {
-			DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
-				  state->request.data.auth_crap.user, name_domain, name_user, name_domain));
-			result = NT_STATUS_NO_SUCH_USER;
-			goto done;
-		}
-	} else {
-		if (is_myname(name_domain)) {
-			DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
-			result =  NT_STATUS_NO_SUCH_USER;
-			goto done;
-		}
-		contact_domain = find_our_domain();
+		result = winbindd_dual_auth_passdb(
+			state->mem_ctx, name_domain, name_user,
+			&chal_blob, &lm_resp, &nt_resp, &info3);
+		goto process_result;
 	}
 
 	do {
@@ -1901,7 +1702,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 		retry = false;
 
 		netlogon_pipe = NULL;
-		result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
+		result = cm_connect_netlogon(domain, &netlogon_pipe);
 
 		if (!NT_STATUS_IS_OK(result)) {
 			DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
@@ -1909,29 +1710,28 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 			goto done;
 		}
 
-		logon_fn = contact_domain->can_do_samlogon_ex
+		logon_fn = domain->can_do_samlogon_ex
 			? rpccli_netlogon_sam_network_logon_ex
 			: rpccli_netlogon_sam_network_logon;
 
 		result = logon_fn(netlogon_pipe,
 				  state->mem_ctx,
-				  state->request.data.auth_crap.logon_parameters,
-				  contact_domain->dcname,
+				  state->request->data.auth_crap.logon_parameters,
+				  domain->dcname,
 				  name_user,
 				  name_domain,
 				  /* Bug #3248 - found by Stefan Burkei. */
 				  workstation, /* We carefully set this above so use it... */
-				  state->request.data.auth_crap.chal,
+				  state->request->data.auth_crap.chal,
 				  lm_resp,
 				  nt_resp,
 				  &info3);
 
 		if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-		    && contact_domain->can_do_samlogon_ex) {
+		    && domain->can_do_samlogon_ex) {
 			DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
 				  "retrying with NetSamLogon\n"));
-			contact_domain->can_do_samlogon_ex = false;
-			retry = true;
+			domain->can_do_samlogon_ex = false;
 			continue;
 		}
 
@@ -1941,8 +1741,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 		   might not yet have noticed that the DC has killed
 		   our connection. */
 
-		if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
-			retry = true;
+		if (!rpccli_is_connected(netlogon_pipe)) {
 			continue;
 		}
 
@@ -1956,12 +1755,14 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 				"password was changed and we didn't know it. "
 				 "Killing connections to domain %s\n",
 				name_domain));
-			invalidate_cm_connection(&contact_domain->conn);
+			invalidate_cm_connection(&domain->conn);
 			retry = true;
 		}
 
 	} while ( (attempts < 2) && retry );
 
+process_result:
+
 	if (NT_STATUS_IS_OK(result)) {
 
 		wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
@@ -1969,16 +1770,19 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
 
 		/* Check if the user is in the right group */
 
-		if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
-							state->request.data.auth_crap.require_membership_of_sid))) {
+		result = check_info3_in_group(
+			info3,
+			state->request->data.auth_crap.require_membership_of_sid);
+		if (!NT_STATUS_IS_OK(result)) {
 			DEBUG(3, ("User %s is not in the required group (%s), so "
 				  "crap authentication is rejected\n",
-				  state->request.data.auth_crap.user,
-				  state->request.data.auth_crap.require_membership_of_sid));
+				  state->request->data.auth_crap.user,
+				  state->request->data.auth_crap.require_membership_of_sid));
 			goto done;
 		}
 
-		result = append_data(state, info3, name_domain, name_user);
+		result = append_auth_data(state, info3, name_domain,
+					  name_user);
 		if (!NT_STATUS_IS_OK(result)) {
 			goto done;
 		}
@@ -1992,102 +1796,51 @@ done:
 		result = NT_STATUS_NO_LOGON_SERVERS;
 	}
 
-	if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
+	if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
 		result = nt_status_squash(result);
 	}
 
-	set_auth_errors(&state->response, result);
+	set_auth_errors(state->response, result);
 
 	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
 	      ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
 	       name_domain,
 	       name_user,
-	       state->response.data.auth.nt_status_string,
-	       state->response.data.auth.pam_error));
+	       state->response->data.auth.nt_status_string,
+	       state->response->data.auth.pam_error));
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-/* Change a user password */
-
-void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
-{
-	fstring domain, user;
-	char *mapped_user;
-	struct winbindd_domain *contact_domain;
-	NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
-
-	DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
-		state->request.data.chauthtok.user));
-
-	/* Setup crap */
-
-	nt_status = normalize_name_unmap(state->mem_ctx,
-					 state->request.data.chauthtok.user,
-					 &mapped_user);
-
-	/* Update the chauthtok name if we did any mapping */
-
-	if (NT_STATUS_IS_OK(nt_status) ||
-	    NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
-	{
-		fstrcpy(state->request.data.chauthtok.user, mapped_user);
-	}
-
-	/* Must pass in state->...chauthtok.user because
-	   canonicalize_username() assumes an fstring().  Since
-	   we have already copied it (if necessary), this is ok. */
-
-	if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
-		set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-		DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
-			  "(PAM: %d)\n",
-			  state->request.data.auth.user,
-			  state->response.data.auth.nt_status_string,
-			  state->response.data.auth.pam_error));
-		request_error(state);
-		return;
-	}
-
-	contact_domain = find_domain_from_name(domain);
-	if (!contact_domain) {
-		set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-		DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
-			  state->request.data.chauthtok.user, domain, user, domain));
-		request_error(state);
-		return;
-	}
-
-	sendto_domain(state, contact_domain);
-}
-
 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
 						 struct winbindd_cli_state *state)
 {
 	char *oldpass;
 	char *newpass = NULL;
 	struct policy_handle dom_pol;
-	struct rpc_pipe_client *cli;
+	struct rpc_pipe_client *cli = NULL;
 	bool got_info = false;
 	struct samr_DomInfo1 *info = NULL;
-	struct samr_ChangeReject *reject = NULL;
+	struct userPwdChangeFailureInformation *reject = NULL;
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 	fstring domain, user;
 
+	ZERO_STRUCT(dom_pol);
+
 	DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
-		  state->request.data.auth.user));
+		  state->request->data.auth.user));
 
-	if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
+	if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
 		goto done;
 	}
 
 	/* Change password */
 
-	oldpass = state->request.data.chauthtok.oldpass;
-	newpass = state->request.data.chauthtok.newpass;
+	oldpass = state->request->data.chauthtok.oldpass;
+	newpass = state->request->data.chauthtok.newpass;
 
 	/* Initialize reject reason */
-	state->response.data.auth.reject_reason = Undefined;
+	state->response->data.auth.reject_reason = Undefined;
 
 	/* Get sam handle */
 
@@ -2109,10 +1862,10 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
 
 	if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
 
-		fill_in_password_policy(&state->response, info);
+		fill_in_password_policy(state->response, info);
 
-		state->response.data.auth.reject_reason =
-			reject->reason;
+		state->response->data.auth.reject_reason =
+			reject->extendedFailureReason;
 
 		got_info = true;
 	}
@@ -2143,31 +1896,10 @@ enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact
 
 done:
 
-	if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
-
-		/* Update the single sign-on memory creds. */
-		result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
-							newpass);
-
-		/* When we login from gdm or xdm and password expires,
-		 * we change password, but there are no memory crendentials
-		 * So, winbindd_replace_memory_creds() returns
-		 * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
-		 * --- BoYang
-		 * */
-		if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
-			result = NT_STATUS_OK;
-		}
-
-		if (!NT_STATUS_IS_OK(result)) {
-			DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
-			goto process_result;
-		}
-
+	if (NT_STATUS_IS_OK(result) && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
 		if (lp_winbind_offline_logon()) {
 			result = winbindd_update_creds_by_name(contact_domain,
-							 state->mem_ctx, user,
-							 newpass);
+							       user, newpass);
 			/* Again, this happens when we login from gdm or xdm
 			 * and the password expires, *BUT* cached crendentials
 			 * doesn't exist. winbindd_update_creds_by_name()
@@ -2204,104 +1936,49 @@ done:
 
 process_result:
 
-	set_auth_errors(&state->response, result);
+	if (strequal(contact_domain->name, get_global_sam_name())) {
+		/* FIXME: internal rpc pipe does not cache handles yet */
+		if (cli) {
+			if (is_valid_policy_hnd(&dom_pol)) {
+				rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+			}
+			TALLOC_FREE(cli);
+		}
+	}
+
+	set_auth_errors(state->response, result);
 
 	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
 	      ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
 	       domain,
 	       user,
-	       state->response.data.auth.nt_status_string,
-	       state->response.data.auth.pam_error));
+	       state->response->data.auth.nt_status_string,
+	       state->response->data.auth.pam_error));
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
-void winbindd_pam_logoff(struct winbindd_cli_state *state)
-{
-	struct winbindd_domain *domain;
-	fstring name_domain, user;
-	uid_t caller_uid = (uid_t)-1;
-	uid_t request_uid = state->request.data.logoff.uid;
-
-	DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
-		state->request.data.logoff.user));
-
-	/* Ensure null termination */
-	state->request.data.logoff.user
-		[sizeof(state->request.data.logoff.user)-1]='\0';
-
-	state->request.data.logoff.krb5ccname
-		[sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
-
-	if (request_uid == (gid_t)-1) {
-		goto failed;
-	}
-
-	if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
-		goto failed;
-	}
-
-	if ((domain = find_auth_domain(state, name_domain)) == NULL) {
-		goto failed;
-	}
-
-	if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
-		DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
-			strerror(errno)));
-		goto failed;
-	}
-
-	switch (caller_uid) {
-		case -1:
-			goto failed;
-		case 0:
-			/* root must be able to logoff any user - gd */
-			state->request.data.logoff.uid = request_uid;
-			break;
-		default:
-			if (caller_uid != request_uid) {
-				DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
-				goto failed;
-			}
-			state->request.data.logoff.uid = caller_uid;
-			break;
-	}
-
-	sendto_domain(state, domain);
-	return;
-
- failed:
-	set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-	DEBUG(5, ("Pam Logoff for %s returned %s "
-		  "(PAM: %d)\n",
-		  state->request.data.logoff.user,
-		  state->response.data.auth.nt_status_string,
-		  state->response.data.auth.pam_error));
-	request_error(state);
-	return;
-}
-
 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
 					      struct winbindd_cli_state *state)
 {
 	NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
 
 	DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
-		state->request.data.logoff.user));
+		state->request->data.logoff.user));
 
-	if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
+	if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
 		result = NT_STATUS_OK;
 		goto process_result;
 	}
 
-	if (state->request.data.logoff.krb5ccname[0] == '\0') {
+	if (state->request->data.logoff.krb5ccname[0] == '\0') {
 		result = NT_STATUS_OK;
 		goto process_result;
 	}
 
 #ifdef HAVE_KRB5
 
-	if (state->request.data.logoff.uid < 0) {
+	if (state->request->data.logoff.uid < 0) {
 		DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
 		goto process_result;
 	}
@@ -2309,20 +1986,20 @@ enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
 	/* what we need here is to find the corresponding krb5 ccache name *we*
 	 * created for a given username and destroy it */
 
-	if (!ccache_entry_exists(state->request.data.logoff.user)) {
+	if (!ccache_entry_exists(state->request->data.logoff.user)) {
 		result = NT_STATUS_OK;
 		DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
 		goto process_result;
 	}
 
-	if (!ccache_entry_identical(state->request.data.logoff.user,
-					state->request.data.logoff.uid,
-					state->request.data.logoff.krb5ccname)) {
+	if (!ccache_entry_identical(state->request->data.logoff.user,
+					state->request->data.logoff.uid,
+					state->request->data.logoff.krb5ccname)) {
 		DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
 		goto process_result;
 	}
 
-	result = remove_ccache(state->request.data.logoff.user);
+	result = remove_ccache(state->request->data.logoff.user);
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
 			nt_errstr(result)));
@@ -2335,57 +2012,14 @@ enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
 
 process_result:
 
-	winbindd_delete_memory_creds(state->request.data.logoff.user);
 
-	set_auth_errors(&state->response, result);
+	set_auth_errors(state->response, result);
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
 /* Change user password with auth crap*/
 
-void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
-{
-	struct winbindd_domain *domain = NULL;
-	const char *domain_name = NULL;
-
-	/* Ensure null termination */
-	state->request.data.chng_pswd_auth_crap.user[
-		sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
-	state->request.data.chng_pswd_auth_crap.domain[
-		sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
-
-	DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
-		  (unsigned long)state->pid,
-		  state->request.data.chng_pswd_auth_crap.domain,
-		  state->request.data.chng_pswd_auth_crap.user));
-
-	if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
-		domain_name = state->request.data.chng_pswd_auth_crap.domain;
-	} else if (lp_winbind_use_default_domain()) {
-		domain_name = lp_workgroup();
-	}
-
-	if (domain_name != NULL)
-		domain = find_domain_from_name(domain_name);
-
-	if (domain != NULL) {
-		DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
-			  "%s\n", (unsigned long)state->pid,domain->name));
-		sendto_domain(state, domain);
-		return;
-	}
-
-	set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-	DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
-		  state->request.data.chng_pswd_auth_crap.domain,
-		  state->request.data.chng_pswd_auth_crap.user,
-		  state->response.data.auth.nt_status_string,
-		  state->response.data.auth.pam_error));
-	request_error(state);
-	return;
-}
-
 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
 {
 	NTSTATUS result;
@@ -2396,20 +2030,22 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 	fstring  domain,user;
 	struct policy_handle dom_pol;
 	struct winbindd_domain *contact_domain = domainSt;
-	struct rpc_pipe_client *cli;
+	struct rpc_pipe_client *cli = NULL;
+
+	ZERO_STRUCT(dom_pol);
 
 	/* Ensure null termination */
-	state->request.data.chng_pswd_auth_crap.user[
-		sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
-	state->request.data.chng_pswd_auth_crap.domain[
-		sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
+	state->request->data.chng_pswd_auth_crap.user[
+		sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
+	state->request->data.chng_pswd_auth_crap.domain[
+		sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
 	*domain = 0;
 	*user = 0;
 
 	DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
 		  (unsigned long)state->pid,
-		  state->request.data.chng_pswd_auth_crap.domain,
-		  state->request.data.chng_pswd_auth_crap.user));
+		  state->request->data.chng_pswd_auth_crap.domain,
+		  state->request->data.chng_pswd_auth_crap.user));
 
 	if (lp_winbind_offline_logon()) {
 		DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
@@ -2418,16 +2054,16 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 		goto done;
 	}
 
-	if (*state->request.data.chng_pswd_auth_crap.domain) {
-		fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
+	if (*state->request->data.chng_pswd_auth_crap.domain) {
+		fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
 	} else {
-		parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
+		parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
 				  domain, user);
 
 		if(!*domain) {
 			DEBUG(3,("no domain specified with username (%s) - "
 				 "failing auth\n",
-				 state->request.data.chng_pswd_auth_crap.user));
+				 state->request->data.chng_pswd_auth_crap.user));
 			result = NT_STATUS_NO_SUCH_USER;
 			goto done;
 		}
@@ -2438,33 +2074,29 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 	}
 
 	if(!*user) {
-		fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
+		fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
 	}
 
 	DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
 		  (unsigned long)state->pid, domain, user));
 
 	/* Change password */
-	new_nt_password = data_blob_talloc(
-		state->mem_ctx,
-		state->request.data.chng_pswd_auth_crap.new_nt_pswd,
-		state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
-
-	old_nt_hash_enc = data_blob_talloc(
-		state->mem_ctx,
-		state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
-		state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
-
-	if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0)	{
-		new_lm_password = data_blob_talloc(
-			state->mem_ctx,
-			state->request.data.chng_pswd_auth_crap.new_lm_pswd,
-			state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
-
-		old_lm_hash_enc = data_blob_talloc(
-			state->mem_ctx,
-			state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
-			state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
+	new_nt_password = data_blob_const(
+		state->request->data.chng_pswd_auth_crap.new_nt_pswd,
+		state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
+
+	old_nt_hash_enc = data_blob_const(
+		state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
+		state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
+
+	if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0)	{
+		new_lm_password = data_blob_const(
+			state->request->data.chng_pswd_auth_crap.new_lm_pswd,
+			state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
+
+		old_lm_hash_enc = data_blob_const(
+			state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
+			state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
 	} else {
 		new_lm_password.length = 0;
 		old_lm_hash_enc.length = 0;
@@ -2484,13 +2116,23 @@ enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domai
 
  done:
 
-	set_auth_errors(&state->response, result);
+	if (strequal(contact_domain->name, get_global_sam_name())) {
+		/* FIXME: internal rpc pipe does not cache handles yet */
+		if (cli) {
+			if (is_valid_policy_hnd(&dom_pol)) {
+				rpccli_samr_Close(cli, state->mem_ctx, &dom_pol);
+			}
+			TALLOC_FREE(cli);
+		}
+	}
+
+	set_auth_errors(state->response, result);
 
 	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
 	      ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
 	       domain, user,
-	       state->response.data.auth.nt_status_string,
-	       state->response.data.auth.pam_error));
+	       state->response->data.auth.nt_status_string,
+	       state->response->data.auth.pam_error));
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }