Replace sid_string_static by sid_string_dbg in DEBUGs

[bbaumbach/samba-autobuild/.git] / source3 / auth / auth_util.c

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 99ce6620c318f6c0ea87d2735b32fcc3fced0265..1e33869ea943b68de243fc0490f8c7c8cb5d9db7 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -9,7 +9,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by

-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or

    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,


@@ -18,8 +18,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License

-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */
 
 #include "includes.h"
 */
 
 #include "includes.h"


@@ -27,33 +26,50 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 

-static struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
-                                                  const DOM_SID *user_sid,
-                                                  const DOM_SID *group_sid,
-                                                  BOOL is_guest,
-                                                  int num_groupsids,
-                                                  const DOM_SID *groupsids);
-

 /****************************************************************************
  Create a UNIX user on demand.
 ****************************************************************************/
 
 static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
 {
 /****************************************************************************
  Create a UNIX user on demand.
 ****************************************************************************/
 
 static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
 {

-       pstring add_script;
+       TALLOC_CTX *ctx = talloc_tos();
+       char *add_script;

        int ret;
 
        int ret;
 

-       pstrcpy(add_script, lp_adduser_script());
-       if (! *add_script)
+       add_script = talloc_strdup(ctx, lp_adduser_script());
+       if (!add_script || !*add_script) {
+               return -1;
+       }
+       add_script = talloc_all_string_sub(ctx,
+                               add_script,
+                               "%u",
+                               unix_username);
+       if (!add_script) {

                return -1;
                return -1;

-       all_string_sub(add_script, "%u", unix_username, sizeof(pstring));
-       if (domain)
-               all_string_sub(add_script, "%D", domain, sizeof(pstring));
-       if (homedir)
-               all_string_sub(add_script, "%H", homedir, sizeof(pstring));
+       }
+       if (domain) {
+               add_script = talloc_all_string_sub(ctx,
+                                       add_script,
+                                       "%D",
+                                       domain);
+               if (!add_script) {
+                       return -1;
+               }
+       }
+       if (homedir) {
+               add_script = talloc_all_string_sub(ctx,
+                               add_script,
+                               "%H",
+                               homedir);
+               if (!add_script) {
+                       return -1;
+               }
+       }

        ret = smbrun(add_script,NULL);
        flush_pwnam_cache();
        ret = smbrun(add_script,NULL);
        flush_pwnam_cache();

-       DEBUG(ret ? 0 : 3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
+       DEBUG(ret ? 0 : 3,
+               ("smb_create_user: Running the command `%s' gave %d\n",
+                add_script,ret));

        return ret;
 }
 
        return ret;
 }
 


@@ -61,16 +77,16 @@ static int smb_create_user(const char *domain, const char *unix_username, const
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 

-static NTSTATUS make_user_info(auth_usersupplied_info **user_info, 
-                               const char *smb_name, 
+static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
+                               const char *smb_name,

                                const char *internal_username,
                                const char *internal_username,

-                               const char *client_domain, 
+                               const char *client_domain,

                                const char *domain,
                                const char *domain,

-                               const char *wksta_name, 
+                               const char *wksta_name,

                                DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
                                DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
                                DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
                                DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,

-                               DATA_BLOB *plaintext, 
-                               BOOL encrypted)
+                               DATA_BLOB *plaintext,
+                               bool encrypted)

 {
 
        DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
 {
 
        DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));


@@ -149,12 +165,14 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
                            DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
                            DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
                            DATA_BLOB *plaintext, 
                            DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
                            DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
                            DATA_BLOB *plaintext, 

-                           BOOL encrypted)
+                           bool encrypted)

 {
        const char *domain;
 {
        const char *domain;

+       NTSTATUS result;
+       bool was_mapped;

        fstring internal_username;
        fstrcpy(internal_username, smb_name);
        fstring internal_username;
        fstrcpy(internal_username, smb_name);

-       map_username(internal_username); 
+       was_mapped = map_username(internal_username); 

        
        DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
              client_domain, smb_name, wksta_name));
        
        DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
              client_domain, smb_name, wksta_name));


@@ -176,11 +194,15 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
        
        /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
        
        
        /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
        

-       return make_user_info(user_info, smb_name, internal_username, 
+       result = make_user_info(user_info, smb_name, internal_username, 

                              client_domain, domain, wksta_name, 
                              lm_pwd, nt_pwd,
                              lm_interactive_pwd, nt_interactive_pwd,
                              plaintext, encrypted);
                              client_domain, domain, wksta_name, 
                              lm_pwd, nt_pwd,
                              lm_interactive_pwd, nt_interactive_pwd,
                              plaintext, encrypted);

+       if (NT_STATUS_IS_OK(result)) {
+               (*user_info)->was_mapped = was_mapped;
+       }
+       return result;

 }
 
 /****************************************************************************
 }
 
 /****************************************************************************


@@ -188,7 +210,7 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 

-BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info, 
+bool make_user_info_netlogon_network(auth_usersupplied_info **user_info, 

                                     const char *smb_name, 
                                     const char *client_domain, 
                                     const char *wksta_name, 
                                     const char *smb_name, 
                                     const char *client_domain, 
                                     const char *wksta_name, 


@@ -198,7 +220,7 @@ BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
                                     const uchar *nt_network_pwd,
                                     int nt_pwd_len)
 {
                                     const uchar *nt_network_pwd,
                                     int nt_pwd_len)
 {

-       BOOL ret;
+       bool ret;

        NTSTATUS status;
        DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
        DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
        NTSTATUS status;
        DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
        DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);


@@ -226,7 +248,7 @@ BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 

-BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info, 
+bool make_user_info_netlogon_interactive(auth_usersupplied_info **user_info, 

                                         const char *smb_name, 
                                         const char *client_domain, 
                                         const char *wksta_name, 
                                         const char *smb_name, 
                                         const char *client_domain, 
                                         const char *wksta_name, 


@@ -236,8 +258,8 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
                                         const uchar nt_interactive_pwd[16], 
                                         const uchar *dc_sess_key)
 {
                                         const uchar nt_interactive_pwd[16], 
                                         const uchar *dc_sess_key)
 {

-       char lm_pwd[16];
-       char nt_pwd[16];
+       unsigned char lm_pwd[16];
+       unsigned char nt_pwd[16];

        unsigned char local_lm_response[24];
        unsigned char local_nt_response[24];
        unsigned char key[16];
        unsigned char local_lm_response[24];
        unsigned char local_nt_response[24];
        unsigned char key[16];


@@ -253,7 +275,7 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
        
 #ifdef DEBUG_PASSWORD
        DEBUG(100,("key:"));
        
 #ifdef DEBUG_PASSWORD
        DEBUG(100,("key:"));

-       dump_data(100, (char *)key, sizeof(key));
+       dump_data(100, key, sizeof(key));

        
        DEBUG(100,("lm owf password:"));
        dump_data(100, lm_pwd, sizeof(lm_pwd));
        
        DEBUG(100,("lm owf password:"));
        dump_data(100, lm_pwd, sizeof(lm_pwd));


@@ -263,10 +285,10 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 #endif
        
        if (lm_interactive_pwd)
 #endif
        
        if (lm_interactive_pwd)

-               SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
+               SamOEMhash(lm_pwd, key, sizeof(lm_pwd));

        
        if (nt_interactive_pwd)
        
        if (nt_interactive_pwd)

-               SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
+               SamOEMhash(nt_pwd, key, sizeof(nt_pwd));

        
 #ifdef DEBUG_PASSWORD
        DEBUG(100,("decrypt of lm owf password:"));
        
 #ifdef DEBUG_PASSWORD
        DEBUG(100,("decrypt of lm owf password:"));


@@ -277,18 +299,18 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 #endif
        
        if (lm_interactive_pwd)
 #endif
        
        if (lm_interactive_pwd)

-               SMBOWFencrypt((const unsigned char *)lm_pwd, chal,
+               SMBOWFencrypt(lm_pwd, chal,

                              local_lm_response);
 
        if (nt_interactive_pwd)
                              local_lm_response);
 
        if (nt_interactive_pwd)

-               SMBOWFencrypt((const unsigned char *)nt_pwd, chal,
+               SMBOWFencrypt(nt_pwd, chal,

                              local_nt_response);
        
        /* Password info paranoia */
        ZERO_STRUCT(key);
 
        {
                              local_nt_response);
        
        /* Password info paranoia */
        ZERO_STRUCT(key);
 
        {

-               BOOL ret;
+               bool ret;

                NTSTATUS nt_status;
                DATA_BLOB local_lm_blob;
                DATA_BLOB local_nt_blob;
                NTSTATUS nt_status;
                DATA_BLOB local_lm_blob;
                DATA_BLOB local_nt_blob;


@@ -339,7 +361,7 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 

-BOOL make_user_info_for_reply(auth_usersupplied_info **user_info, 
+bool make_user_info_for_reply(auth_usersupplied_info **user_info, 

                              const char *smb_name, 
                              const char *client_domain,
                              const uint8 chal[8],
                              const char *smb_name, 
                              const char *client_domain,
                              const uint8 chal[8],


@@ -363,7 +385,7 @@ BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 #ifdef DEBUG_PASSWORD
                DEBUG(10,("Unencrypted password (len %d):\n",
                          (int)plaintext_password.length));
 #ifdef DEBUG_PASSWORD
                DEBUG(10,("Unencrypted password (len %d):\n",
                          (int)plaintext_password.length));

-               dump_data(100, (const char *)plaintext_password.data,
+               dump_data(100, plaintext_password.data,

                          plaintext_password.length);
 #endif
 
                          plaintext_password.length);
 #endif
 


@@ -373,11 +395,11 @@ BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
                
                /* We can't do an NT hash here, as the password needs to be
                   case insensitive */
                
                /* We can't do an NT hash here, as the password needs to be
                   case insensitive */

-               local_nt_blob = data_blob(NULL, 0); 
+               local_nt_blob = data_blob_null; 

                
        } else {
                
        } else {

-               local_lm_blob = data_blob(NULL, 0); 
-               local_nt_blob = data_blob(NULL, 0); 
+               local_lm_blob = data_blob_null; 
+               local_nt_blob = data_blob_null; 

        }
        
        ret = make_user_info_map(
        }
        
        ret = make_user_info_map(


@@ -415,7 +437,7 @@ NTSTATUS make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
  Create a guest user_info blob, for anonymous authenticaion.
 ****************************************************************************/
 
  Create a guest user_info blob, for anonymous authenticaion.
 ****************************************************************************/
 

-BOOL make_user_info_guest(auth_usersupplied_info **user_info) 
+bool make_user_info_guest(auth_usersupplied_info **user_info) 

 {
        NTSTATUS nt_status;
 
 {
        NTSTATUS nt_status;
 


@@ -431,92 +453,9 @@ BOOL make_user_info_guest(auth_usersupplied_info **user_info)
        return NT_STATUS_IS_OK(nt_status) ? True : False;
 }
 
        return NT_STATUS_IS_OK(nt_status) ? True : False;
 }
 

-/****************************************************************************
- prints a NT_USER_TOKEN to debug output.
-****************************************************************************/
-
-void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
+static int server_info_dtor(auth_serversupplied_info *server_info)

 {
 {

-       size_t     i;
-       
-       if (!token) {
-               DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
-               return;
-       }
-       
-       DEBUGC(dbg_class, dbg_lev,
-              ("NT user token of user %s\n",
-               sid_string_static(&token->user_sids[0]) ));
-       DEBUGADDC(dbg_class, dbg_lev,
-                 ("contains %lu SIDs\n", (unsigned long)token->num_sids));
-       for (i = 0; i < token->num_sids; i++)
-               DEBUGADDC(dbg_class, dbg_lev,
-                         ("SID[%3lu]: %s\n", (unsigned long)i, 
-                          sid_string_static(&token->user_sids[i])));
-
-       dump_se_priv( dbg_class, dbg_lev, &token->privileges );
-}
-
-/****************************************************************************
- prints a UNIX 'token' to debug output.
-****************************************************************************/
-
-void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid,
-                          int n_groups, gid_t *groups)
-{
-       int     i;
-       DEBUGC(dbg_class, dbg_lev,
-              ("UNIX token of user %ld\n", (long int)uid));
-
-       DEBUGADDC(dbg_class, dbg_lev,
-                 ("Primary group is %ld and contains %i supplementary "
-                  "groups\n", (long int)gid, n_groups));
-       for (i = 0; i < n_groups; i++)
-               DEBUGADDC(dbg_class, dbg_lev, ("Group[%3i]: %ld\n", i, 
-                       (long int)groups[i]));
-}
-
-/******************************************************************************
- Create a token for the root user to be used internally by smbd.
- This is similar to running under the context of the LOCAL_SYSTEM account
- in Windows.  This is a read-only token.  Do not modify it or free() it.
- Create a copy if your need to change it.
-******************************************************************************/
-
-NT_USER_TOKEN *get_root_nt_token( void )
-{
-       static NT_USER_TOKEN *token = NULL;
-       DOM_SID u_sid, g_sid;
-       struct passwd *pw;
-       
-       if ( token )
-               return token;
-               
-       if ( !(pw = sys_getpwnam( "root" )) ) {
-               DEBUG(0,("get_root_nt_token: getpwnam\"root\") failed!\n"));
-               return NULL;
-       }
-       
-       /* get the user and primary group SIDs; although the 
-          BUILTIN\Administrators SId is really the one that matters here */
-          
-       uid_to_sid(&u_sid, pw->pw_uid);
-       gid_to_sid(&g_sid, pw->pw_gid);
-
-       token = create_local_nt_token(NULL, &u_sid, &g_sid, False,
-                                     1, &global_sid_Builtin_Administrators);
-       return token;
-}
-
-static int server_info_dtor(void *p)
-{
-       auth_serversupplied_info *server_info =
-               talloc_get_type_abort(p, auth_serversupplied_info);
-
-       if (server_info->sam_account != NULL) {
-               TALLOC_FREE(server_info->sam_account);
-       }
-
+       TALLOC_FREE(server_info->sam_account);

        ZERO_STRUCTP(server_info);
        return 0;
 }
        ZERO_STRUCTP(server_info);
        return 0;
 }


@@ -557,20 +496,28 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
        struct passwd *pwd;
        gid_t *gids;
        auth_serversupplied_info *result;
        struct passwd *pwd;
        gid_t *gids;
        auth_serversupplied_info *result;

+       int i;
+       size_t num_gids;
+       DOM_SID unix_group_sid;
+       

 
 

-       if ( !(pwd = getpwnam_alloc(NULL, pdb_get_username(sampass))) ) {
+       if ( !(result = make_server_info(NULL)) ) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if ( !(pwd = getpwnam_alloc(result, pdb_get_username(sampass))) ) {

                DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
                          pdb_get_username(sampass)));
                DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
                          pdb_get_username(sampass)));

+               TALLOC_FREE(result);

                return NT_STATUS_NO_SUCH_USER;
        }
 
                return NT_STATUS_NO_SUCH_USER;
        }
 

-       if ( !(result = make_server_info(NULL)) ) {
-               TALLOC_FREE(pwd);
-               return NT_STATUS_NO_MEMORY;
-       }
-

        result->sam_account = sampass;
        result->sam_account = sampass;

-       result->unix_name = talloc_strdup(result, pwd->pw_name);
+       /* Ensure thaat the sampass will be freed with the result */
+       talloc_steal(result, sampass);
+       result->unix_name = pwd->pw_name;
+       /* Ensure that we keep pwd->pw_name, because we will free pwd below */
+       talloc_steal(result, pwd->pw_name);

        result->gid = pwd->pw_gid;
        result->uid = pwd->pw_uid;
        
        result->gid = pwd->pw_gid;
        result->uid = pwd->pw_uid;
        


@@ -587,10 +534,33 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
                TALLOC_FREE(result);
                return status;
        }
                TALLOC_FREE(result);
                return status;
        }

+       
+       /* Add the "Unix Group" SID for each gid to catch mapped groups
+          and their Unix equivalent.  This is to solve the backwards 
+          compatibility problem of 'valid users = +ntadmin' where 
+          ntadmin has been paired with "Domain Admins" in the group 
+          mapping table.  Otherwise smb.conf would need to be changed
+          to 'valid user = "Domain Admins"'.  --jerry */
+       
+       num_gids = result->num_sids;
+       for ( i=0; i<num_gids; i++ ) {
+               if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
+                       DEBUG(1,("make_server_info_sam: Failed to create SID "
+                               "for gid %d!\n", gids[i]));
+                       continue;
+               }
+               if (!add_sid_to_array_unique( result, &unix_group_sid,
+                               &result->sids, &result->num_sids )) {
+                       result->sam_account = NULL; /* Don't free on error exit. */
+                       TALLOC_FREE(result);
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }

 
        /* For now we throw away the gids and convert via sid_to_gid
         * later. This needs fixing, but I'd like to get the code straight and
         * simple first. */
 
        /* For now we throw away the gids and convert via sid_to_gid
         * later. This needs fixing, but I'd like to get the code straight and
         * simple first. */

+        

        TALLOC_FREE(gids);
 
        DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
        TALLOC_FREE(gids);
 
        DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",


@@ -601,46 +571,6 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
        return NT_STATUS_OK;
 }
 
        return NT_STATUS_OK;
 }
 

-/*
- * Add alias SIDs from memberships within the partially created token SID list
- */
-
-static NTSTATUS add_aliases(TALLOC_CTX *tmp_ctx, const DOM_SID *domain_sid,
-                           struct nt_user_token *token)
-{
-       uint32 *aliases;
-       size_t i, num_aliases;
-       NTSTATUS status;
-
-       aliases = NULL;
-       num_aliases = 0;
-
-       status = pdb_enum_alias_memberships(tmp_ctx, domain_sid,
-                                           token->user_sids,
-                                           token->num_sids,
-                                           &aliases, &num_aliases);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("pdb_enum_alias_memberships failed: %s\n",
-                          nt_errstr(status)));
-               return status;
-       }
-
-       for (i=0; i<num_aliases; i++) {
-               DOM_SID alias_sid;
-               sid_compose(&alias_sid, domain_sid, aliases[i]);
-               add_sid_to_array_unique(token, &alias_sid,
-                                       &token->user_sids,
-                                       &token->num_sids);
-               if (token->user_sids == NULL) {
-                       DEBUG(0, ("add_sid_to_array failed\n"));
-                       return NT_STATUS_NO_MEMORY;
-               }
-       }
-
-       return NT_STATUS_OK;
-}
-

 static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
 {
        char *command;
 static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
 {
        char *command;


@@ -656,12 +586,12 @@ static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
        for (i=1; i<token->num_sids; i++) {
                group_sidstr = talloc_asprintf(
                        tmp_ctx, "%s %s", group_sidstr,
        for (i=1; i<token->num_sids; i++) {
                group_sidstr = talloc_asprintf(
                        tmp_ctx, "%s %s", group_sidstr,

-                       sid_string_static(&token->user_sids[i]));
+                       sid_string_talloc(tmp_ctx, &token->user_sids[i]));

        }
 
        command = talloc_string_sub(
                tmp_ctx, lp_log_nt_token_command(),
        }
 
        command = talloc_string_sub(
                tmp_ctx, lp_log_nt_token_command(),

-               "%s", sid_string_static(&token->user_sids[0]));
+               "%s", sid_string_talloc(tmp_ctx, &token->user_sids[0]));

        command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
 
        if (command == NULL) {
        command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
 
        if (command == NULL) {


@@ -677,126 +607,6 @@ static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
        return NT_STATUS_OK;
 }
 
        return NT_STATUS_OK;
 }
 

-/*
- * Create a NT token for the user, expanding local aliases
- */
-
-static struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
-                                                  const DOM_SID *user_sid,
-                                                  const DOM_SID *group_sid,
-                                                  BOOL is_guest,
-                                                  int num_groupsids,
-                                                  const DOM_SID *groupsids)
-{
-       TALLOC_CTX *tmp_ctx;
-       struct nt_user_token *result = NULL;
-       int i;
-       NTSTATUS status;
-
-       tmp_ctx = talloc_new(mem_ctx);
-       if (tmp_ctx == NULL) {
-               DEBUG(0, ("talloc_new failed\n"));
-               return NULL;
-       }
-
-       result = TALLOC_ZERO_P(tmp_ctx, NT_USER_TOKEN);
-       if (result == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               goto done;
-       }
-
-       /* First create the default SIDs */
-
-       add_sid_to_array(result, user_sid,
-                        &result->user_sids, &result->num_sids);
-       add_sid_to_array(result, group_sid,
-                        &result->user_sids, &result->num_sids);
-       add_sid_to_array(result, &global_sid_World,
-                        &result->user_sids, &result->num_sids);
-       add_sid_to_array(result, &global_sid_Network,
-                        &result->user_sids, &result->num_sids);
-
-       if (is_guest) {
-               add_sid_to_array(result, &global_sid_Builtin_Guests,
-                                &result->user_sids, &result->num_sids);
-       } else {
-               add_sid_to_array(result, &global_sid_Authenticated_Users,
-                                &result->user_sids, &result->num_sids);
-       }
-
-       /* Now the SIDs we got from authentication. These are the ones from
-        * the info3 struct or from the pdb_enum_group_memberships, depending
-        * on who authenticated the user. */
-
-       for (i=0; i<num_groupsids; i++) {
-               add_sid_to_array_unique(result, &groupsids[i],
-                                       &result->user_sids, &result->num_sids);
-       }
-
-       if (lp_winbind_nested_groups()) {
-
-               /* Now add the aliases. First the one from our local SAM */
-
-               status = add_aliases(tmp_ctx, get_global_sam_sid(), result);
-
-               if (!NT_STATUS_IS_OK(status)) {
-                       result = NULL;
-                       goto done;
-               }
-
-               /* Finally the builtin ones */
-
-               status = add_aliases(tmp_ctx, &global_sid_Builtin, result);
-
-               if (!NT_STATUS_IS_OK(status)) {
-                       result = NULL;
-                       goto done;
-               }
-       } else {
-
-               /* Play jerry's trick to auto-add local admins if we're a
-                * domain admin. */
-
-               DOM_SID dom_admins;
-               BOOL domain_mode = False;
-
-               if (IS_DC) {
-                       sid_compose(&dom_admins, get_global_sam_sid(),
-                                   DOMAIN_GROUP_RID_ADMINS);
-                       domain_mode = True;
-               }
-               if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
-                   (secrets_fetch_domain_sid(lp_workgroup(), &dom_admins))) {
-                       sid_append_rid(&dom_admins, DOMAIN_GROUP_RID_ADMINS);
-                       domain_mode = True;
-               }
-
-               if (domain_mode) {
-                       for (i=0; i<result->num_sids; i++) {
-                               if (sid_equal(&dom_admins,
-                                             &result->user_sids[i])) {
-                                       add_sid_to_array_unique(
-                                               result,
-                                               &global_sid_Builtin_Administrators,
-                                               &result->user_sids,
-                                               &result->num_sids);
-                                       break;
-                               }
-                       }
-                       
-               }
-       }
-
-       get_privileges_for_sids(&result->privileges, result->user_sids,
-                               result->num_sids);
-
-       talloc_steal(mem_ctx, result);
-
- done:
-       TALLOC_FREE(tmp_ctx);
-       return result;
-}
-

 /*
  * Create the token to use from server_info->sam_account and
  * server_info->sids (the info3/sam groups). Find the unix gids.
 /*
  * Create the token to use from server_info->sam_account and
  * server_info->sids (the info3/sam groups). Find the unix gids.


@@ -815,15 +625,35 @@ NTSTATUS create_local_token(auth_serversupplied_info *server_info)
                return NT_STATUS_NO_MEMORY;
        }
 
                return NT_STATUS_NO_MEMORY;
        }
 

-       server_info->ptok = create_local_nt_token(
-               server_info,
-               pdb_get_user_sid(server_info->sam_account),
-               pdb_get_group_sid(server_info->sam_account),
-               server_info->guest,
-               server_info->num_sids, server_info->sids);
+       /*
+        * If winbind is not around, we can not make much use of the SIDs the
+        * domain controller provided us with. Likewise if the user name was
+        * mapped to some local unix user.
+        */

 
 

-       if ( !server_info->ptok ) {
-               return NT_STATUS_NO_SUCH_USER;
+       if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
+           (server_info->was_mapped)) {
+               status = create_token_from_username(server_info,
+                                                   server_info->unix_name,
+                                                   server_info->guest,
+                                                   &server_info->uid,
+                                                   &server_info->gid,
+                                                   &server_info->unix_name,
+                                                   &server_info->ptok);
+               
+       } else {
+               server_info->ptok = create_local_nt_token(
+                       server_info,
+                       pdb_get_user_sid(server_info->sam_account),
+                       server_info->guest,
+                       server_info->num_sids, server_info->sids);
+               status = server_info->ptok ?
+                       NT_STATUS_OK : NT_STATUS_NO_SUCH_USER;
+       }
+
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(mem_ctx);
+               return status;

        }
        
        /* Convert the SIDs to gids. */
        }
        
        /* Convert the SIDs to gids. */


@@ -839,7 +669,7 @@ NTSTATUS create_local_token(auth_serversupplied_info *server_info)
 
                if (!sid_to_gid(sid, &gid)) {
                        DEBUG(10, ("Could not convert SID %s to gid, "
 
                if (!sid_to_gid(sid, &gid)) {
                        DEBUG(10, ("Could not convert SID %s to gid, "

-                                  "ignoring it\n", sid_string_static(sid)));
+                                  "ignoring it\n", sid_string_dbg(sid)));

                        continue;
                }
                add_gid_to_array_unique(server_info, gid, &server_info->groups,
                        continue;
                }
                add_gid_to_array_unique(server_info, gid, &server_info->groups,


@@ -874,7 +704,7 @@ NTSTATUS create_local_token(auth_serversupplied_info *server_info)
  */
 
 NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
  */
 
 NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,

-                                   BOOL is_guest,
+                                   bool is_guest,

                                    uid_t *uid, gid_t *gid,
                                    char **found_username,
                                    struct nt_user_token **token)
                                    uid_t *uid, gid_t *gid,
                                    char **found_username,
                                    struct nt_user_token **token)


@@ -882,11 +712,13 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
        NTSTATUS result = NT_STATUS_NO_SUCH_USER;
        TALLOC_CTX *tmp_ctx;
        DOM_SID user_sid;
        NTSTATUS result = NT_STATUS_NO_SUCH_USER;
        TALLOC_CTX *tmp_ctx;
        DOM_SID user_sid;

-       enum SID_NAME_USE type;
+       enum lsa_SidType type;

        gid_t *gids;
        gid_t *gids;

-       DOM_SID primary_group_sid;

        DOM_SID *group_sids;
        DOM_SID *group_sids;

+       DOM_SID unix_group_sid;

        size_t num_group_sids;
        size_t num_group_sids;

+       size_t num_gids;
+       size_t i;

 
        tmp_ctx = talloc_new(NULL);
        if (tmp_ctx == NULL) {
 
        tmp_ctx = talloc_new(NULL);
        if (tmp_ctx == NULL) {


@@ -894,9 +726,9 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
                return NT_STATUS_NO_MEMORY;
        }
 
                return NT_STATUS_NO_MEMORY;
        }
 

-       if (!lookup_name(tmp_ctx, username, LOOKUP_NAME_ALL,
+       if (!lookup_name_smbconf(tmp_ctx, username, LOOKUP_NAME_ALL,

                         NULL, NULL, &user_sid, &type)) {
                         NULL, NULL, &user_sid, &type)) {

-               DEBUG(1, ("lookup_name for %s failed\n", username));
+               DEBUG(1, ("lookup_name_smbconf for %s failed\n", username));

                goto done;
        }
 
                goto done;
        }
 


@@ -908,17 +740,68 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
        if (!sid_to_uid(&user_sid, uid)) {
                DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
 
        if (!sid_to_uid(&user_sid, uid)) {
                DEBUG(1, ("sid_to_uid for %s (%s) failed\n",

-                         username, sid_string_static(&user_sid)));
+                         username, sid_string_dbg(&user_sid)));

                goto done;
        }
 
                goto done;
        }
 

-       if (sid_check_is_in_unix_users(&user_sid)) {
+       if (sid_check_is_in_our_domain(&user_sid)) {
+               bool ret;
+
+               /* This is a passdb user, so ask passdb */
+
+               struct samu *sam_acct = NULL;
+
+               if ( !(sam_acct = samu_new( tmp_ctx )) ) {
+                       result = NT_STATUS_NO_MEMORY;
+                       goto done;
+               }
+
+               become_root();
+               ret = pdb_getsampwsid(sam_acct, &user_sid);
+               unbecome_root();
+
+               if (!ret) {
+                       DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
+                                 sid_string_dbg(&user_sid), username));
+                       DEBUGADD(1, ("Fall back to unix user %s\n", username));
+                       goto unix_user;
+               }
+
+               result = pdb_enum_group_memberships(tmp_ctx, sam_acct,
+                                                   &group_sids, &gids,
+                                                   &num_group_sids);
+               if (!NT_STATUS_IS_OK(result)) {
+                       DEBUG(10, ("enum_group_memberships failed for %s\n",
+                                  username));
+                       DEBUGADD(1, ("Fall back to unix user %s\n", username));
+                       goto unix_user;
+               }
+
+               /* see the smb_panic() in pdb_default_enum_group_memberships */
+               SMB_ASSERT(num_group_sids > 0); 
+
+               *gid = gids[0];
+
+               /* Ensure we're returning the found_username on the right context. */
+               *found_username = talloc_strdup(mem_ctx,
+                                               pdb_get_username(sam_acct));
+
+       } else  if (sid_check_is_in_unix_users(&user_sid)) {

 
                /* This is a unix user not in passdb. We need to ask nss
                 * directly, without consulting passdb */
 
                struct passwd *pass;
 
                /* This is a unix user not in passdb. We need to ask nss
                 * directly, without consulting passdb */
 
                struct passwd *pass;

-               size_t i;
+
+               /*
+                * This goto target is used as a fallback for the passdb
+                * case. The concrete bug report is when passdb gave us an
+                * unmapped gid.
+                */
+
+       unix_user:
+
+               uid_to_unix_users_sid(*uid, &user_sid);

 
                pass = getpwuid_alloc(tmp_ctx, *uid);
                if (pass == NULL) {
 
                pass = getpwuid_alloc(tmp_ctx, *uid);
                if (pass == NULL) {


@@ -927,9 +810,6 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
                        goto done;
                }
 
                        goto done;
                }
 

-               *gid = pass->pw_gid;
-               gid_to_sid(&primary_group_sid, pass->pw_gid);
-

                if (!getgroups_unix_user(tmp_ctx, username, pass->pw_gid,
                                         &gids, &num_group_sids)) {
                        DEBUG(1, ("getgroups_unix_user for user %s failed\n",
                if (!getgroups_unix_user(tmp_ctx, username, pass->pw_gid,
                                         &gids, &num_group_sids)) {
                        DEBUG(1, ("getgroups_unix_user for user %s failed\n",


@@ -937,49 +817,28 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
                        goto done;
                }
 
                        goto done;
                }
 

-               group_sids = talloc_array(tmp_ctx, DOM_SID, num_group_sids);
-               if (group_sids == NULL) {
-                       DEBUG(1, ("talloc_array failed\n"));
-                       result = NT_STATUS_NO_MEMORY;
-                       goto done;
+               if (num_group_sids) {
+                       group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
+                       if (group_sids == NULL) {
+                               DEBUG(1, ("TALLOC_ARRAY failed\n"));
+                               result = NT_STATUS_NO_MEMORY;
+                               goto done;
+                       }
+               } else {
+                       group_sids = NULL;

                }
 
                for (i=0; i<num_group_sids; i++) {
                        gid_to_sid(&group_sids[i], gids[i]);
                }
                }
 
                for (i=0; i<num_group_sids; i++) {
                        gid_to_sid(&group_sids[i], gids[i]);
                }

-               *found_username = talloc_strdup(mem_ctx, pass->pw_name);
-
-       } else if (sid_check_is_in_our_domain(&user_sid)) {

 
 

-               /* This is a passdb user, so ask passdb */
+               /* In getgroups_unix_user we always set the primary gid */
+               SMB_ASSERT(num_group_sids > 0); 

 
 

-               struct samu *sam_acct = NULL;
-
-               if ( !(sam_acct = samu_new( tmp_ctx )) ) {
-                       goto done;
-               }
-
-               if (!pdb_getsampwsid(sam_acct, &user_sid)) {
-                       DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
-                                 sid_string_static(&user_sid), username));
-                       result = NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
-
-               sid_copy(&primary_group_sid, pdb_get_group_sid(sam_acct));
-
-               result = pdb_enum_group_memberships(tmp_ctx, sam_acct,
-                                                   &group_sids, &gids,
-                                                   &num_group_sids);
-               if (!NT_STATUS_IS_OK(result)) {
-                       DEBUG(10, ("enum_group_memberships failed for %s\n",
-                                  username));
-                       goto done;
-               }
-
-               *found_username = talloc_strdup(mem_ctx,
-                                               pdb_get_username(sam_acct));
+               *gid = gids[0];

 
 

+               /* Ensure we're returning the found_username on the right context. */
+               *found_username = talloc_strdup(mem_ctx, pass->pw_name);

        } else {
 
                /* This user is from winbind, force the primary gid to the
        } else {
 
                /* This user is from winbind, force the primary gid to the


@@ -991,23 +850,60 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
                uint32 dummy;
 
 
                uint32 dummy;
 

-               sid_copy(&primary_group_sid, &user_sid);
-               sid_split_rid(&primary_group_sid, &dummy);
-               sid_append_rid(&primary_group_sid, DOMAIN_GROUP_RID_USERS);
+               num_group_sids = 1;
+               group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
+               if (group_sids == NULL) {
+                       DEBUG(1, ("TALLOC_ARRAY failed\n"));
+                       result = NT_STATUS_NO_MEMORY;
+                       goto done;
+               }
+
+               sid_copy(&group_sids[0], &user_sid);
+               sid_split_rid(&group_sids[0], &dummy);
+               sid_append_rid(&group_sids[0], DOMAIN_GROUP_RID_USERS);

 
 

-               if (!sid_to_gid(&primary_group_sid, gid)) {
+               if (!sid_to_gid(&group_sids[0], gid)) {

                        DEBUG(1, ("sid_to_gid(%s) failed\n",
                        DEBUG(1, ("sid_to_gid(%s) failed\n",

-                                 sid_string_static(&primary_group_sid)));
+                                 sid_string_dbg(&group_sids[0])));

                        goto done;
                }
 
                        goto done;
                }
 

-               num_group_sids = 0;
-               group_sids = NULL;
+               gids = gid;

 
 

+               /* Ensure we're returning the found_username on the right context. */

                *found_username = talloc_strdup(mem_ctx, username);
        }
 
                *found_username = talloc_strdup(mem_ctx, username);
        }
 

-       *token = create_local_nt_token(mem_ctx, &user_sid, &primary_group_sid,
+       /* Add the "Unix Group" SID for each gid to catch mapped groups
+          and their Unix equivalent.  This is to solve the backwards
+          compatibility problem of 'valid users = +ntadmin' where
+          ntadmin has been paired with "Domain Admins" in the group
+          mapping table.  Otherwise smb.conf would need to be changed
+          to 'valid user = "Domain Admins"'.  --jerry */
+
+       num_gids = num_group_sids;
+       for ( i=0; i<num_gids; i++ ) {
+               gid_t high, low;
+
+               /* don't pickup anything managed by Winbind */
+
+               if ( lp_idmap_gid(&low, &high) && (gids[i] >= low) && (gids[i] <= high) )
+                       continue;
+
+               if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
+                       DEBUG(1,("create_token_from_username: Failed to create SID "
+                               "for gid %d!\n", gids[i]));
+                       continue;
+               }
+               if (!add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
+                               &group_sids, &num_group_sids )) {
+                       result = NT_STATUS_NO_MEMORY;
+                       goto done;
+               }
+       }
+
+       /* Ensure we're creating the nt_token on the right context. */
+       *token = create_local_nt_token(mem_ctx, &user_sid,

                                       is_guest, num_group_sids, group_sids);
 
        if ((*token == NULL) || (*found_username == NULL)) {
                                       is_guest, num_group_sids, group_sids);
 
        if ((*token == NULL) || (*found_username == NULL)) {


@@ -1027,14 +923,15 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
  Expensive helper function to figure out whether a user given its name is
  member of a particular group.
 ***************************************************************************/
  Expensive helper function to figure out whether a user given its name is
  member of a particular group.
 ***************************************************************************/

-BOOL user_in_group_sid(const char *username, const DOM_SID *group_sid)
+
+bool user_in_group_sid(const char *username, const DOM_SID *group_sid)

 {
        NTSTATUS status;
        uid_t uid;
        gid_t gid;
        char *found_username;
        struct nt_user_token *token;
 {
        NTSTATUS status;
        uid_t uid;
        gid_t gid;
        char *found_username;
        struct nt_user_token *token;

-       BOOL result;
+       bool result;

 
        TALLOC_CTX *mem_ctx;
 
 
        TALLOC_CTX *mem_ctx;
 


@@ -1060,12 +957,11 @@ BOOL user_in_group_sid(const char *username, const DOM_SID *group_sid)
        
 }
 
        
 }
 

-BOOL user_in_group(const char *username, const char *groupname)
+bool user_in_group(const char *username, const char *groupname)

 {
        TALLOC_CTX *mem_ctx;
        DOM_SID group_sid;
 {
        TALLOC_CTX *mem_ctx;
        DOM_SID group_sid;

-       NTSTATUS status;
-       BOOL ret;
+       bool ret;

 
        mem_ctx = talloc_new(NULL);
        if (mem_ctx == NULL) {
 
        mem_ctx = talloc_new(NULL);
        if (mem_ctx == NULL) {


@@ -1078,8 +974,7 @@ BOOL user_in_group(const char *username, const char *groupname)
        TALLOC_FREE(mem_ctx);
 
        if (!ret) {
        TALLOC_FREE(mem_ctx);
 
        if (!ret) {

-               DEBUG(10, ("lookup_name(%s) failed: %s\n", groupname,
-                          nt_errstr(status)));
+               DEBUG(10, ("lookup_name for (%s) failed.\n", groupname));

                return False;
        }
 
                return False;
        }
 


@@ -1087,95 +982,6 @@ BOOL user_in_group(const char *username, const char *groupname)
 }
 
 
 }
 
 

-/***************************************************************************
- Make (and fill) a user_info struct from a Kerberos PAC logon_info by
- conversion to a struct samu
-***************************************************************************/
-
-NTSTATUS make_server_info_pac(auth_serversupplied_info **server_info, 
-                             char *unix_username,
-                             struct passwd *pwd,
-                             PAC_LOGON_INFO *logon_info)
-{
-       NTSTATUS status;
-       struct samu *sampass = NULL;
-       DOM_SID user_sid, group_sid;
-       fstring dom_name;
-       auth_serversupplied_info *result;
-       int i;
-
-       if ( !(sampass = samu_new( NULL )) ) {
-               return NT_STATUS_NO_MEMORY;
-       }
-               
-       status = samu_set_unix( sampass, pwd );
-       if ( !NT_STATUS_IS_OK(status) ) {               
-               return status;
-       }
-
-       result = make_server_info(NULL);
-       if (result == NULL) {
-               TALLOC_FREE(sampass);
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       /* only copy user_sid, group_sid and domain name out of the PAC for
-        * now, we will benefit from more later - Guenther */
-
-       sid_copy(&user_sid, &logon_info->info3.dom_sid.sid);
-       sid_append_rid(&user_sid, logon_info->info3.user_rid);
-       pdb_set_user_sid(sampass, &user_sid, PDB_SET);
-       
-       sid_copy(&group_sid, &logon_info->info3.dom_sid.sid);
-       sid_append_rid(&group_sid, logon_info->info3.group_rid);
-       pdb_set_group_sid(sampass, &group_sid, PDB_SET);
-
-       unistr2_to_ascii(dom_name, &logon_info->info3.uni_logon_dom, -1);
-       pdb_set_domain(sampass, dom_name, PDB_SET);
-
-       pdb_set_logon_count(sampass, logon_info->info3.logon_count, PDB_SET);
-
-       result->sam_account = sampass;
-       result->unix_name = talloc_strdup(result, unix_username);
-       result->uid = pwd->pw_uid;
-       result->gid = pwd->pw_gid;
-
-       result->sids = NULL;
-       result->num_sids = 0;
-
-       /* and create (by appending rids) the 'domain' sids */
-       
-       for (i = 0; i < logon_info->info3.num_groups2; i++) {
-               DOM_SID sid;
-               if (!sid_compose(&sid, &logon_info->info3.dom_sid.sid,
-                                logon_info->info3.gids[i].g_rid)) {
-                       DEBUG(3,("could not append additional group rid "
-                                "0x%x\n", logon_info->info3.gids[i].g_rid));
-                       TALLOC_FREE(result);
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-               add_sid_to_array(result, &sid, &result->sids,
-                                &result->num_sids);
-       }
-
-       /* Copy 'other' sids.  We need to do sid filtering here to
-          prevent possible elevation of privileges.  See:
-
-           http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
-         */
-
-       for (i = 0; i < logon_info->info3.num_other_sids; i++) {
-               add_sid_to_array(result, &logon_info->info3.other_sids[i].sid,
-                                &result->sids,
-                                &result->num_sids);
-       }
-
-       *server_info = result;
-
-       return NT_STATUS_OK;
-}
-
-

 /***************************************************************************
  Make (and fill) a user_info struct from a 'struct passwd' by conversion 
  to a struct samu
 /***************************************************************************
  Make (and fill) a user_info struct from a 'struct passwd' by conversion 
  to a struct samu


@@ -1188,6 +994,10 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info,
        NTSTATUS status;
        struct samu *sampass = NULL;
        gid_t *gids;
        NTSTATUS status;
        struct samu *sampass = NULL;
        gid_t *gids;

+       char *qualified_name = NULL;
+       TALLOC_CTX *mem_ctx = NULL;
+       DOM_SID u_sid;
+       enum lsa_SidType type;

        auth_serversupplied_info *result;
        
        if ( !(sampass = samu_new( NULL )) ) {
        auth_serversupplied_info *result;
        
        if ( !(sampass = samu_new( NULL )) ) {


@@ -1200,10 +1010,9 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info,
        }
 
        result = make_server_info(NULL);
        }
 
        result = make_server_info(NULL);

-
-       if (!NT_STATUS_IS_OK(status)) {
+       if (result == NULL) {

                TALLOC_FREE(sampass);
                TALLOC_FREE(sampass);

-               return status;
+               return NT_STATUS_NO_MEMORY;

        }
 
        result->sam_account = sampass;
        }
 
        result->sam_account = sampass;


@@ -1222,6 +1031,56 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info,
                return status;
        }
 
                return status;
        }
 

+       /*
+        * The SID returned in server_info->sam_account is based
+        * on our SAM sid even though for a pure UNIX account this should
+        * not be the case as it doesn't really exist in the SAM db.
+        * This causes lookups on "[in]valid users" to fail as they
+        * will lookup this name as a "Unix User" SID to check against
+        * the user token. Fix this by adding the "Unix User"\unix_username
+        * SID to the sid array. The correct fix should probably be
+        * changing the server_info->sam_account user SID to be a
+        * S-1-22 Unix SID, but this might break old configs where
+        * plaintext passwords were used with no SAM backend.
+        */
+
+       mem_ctx = talloc_init("make_server_info_pw_tmp");
+       if (!mem_ctx) {
+               TALLOC_FREE(result);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+                                       unix_users_domain_name(),
+                                       unix_username );
+       if (!qualified_name) {
+               TALLOC_FREE(result);
+               TALLOC_FREE(mem_ctx);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
+                                               NULL, NULL,
+                                               &u_sid, &type)) {
+               TALLOC_FREE(result);
+               TALLOC_FREE(mem_ctx);
+               return NT_STATUS_NO_SUCH_USER;
+       }
+
+       TALLOC_FREE(mem_ctx);
+
+       if (type != SID_NAME_USER) {
+               TALLOC_FREE(result);
+               return NT_STATUS_NO_SUCH_USER;
+       }
+
+       if (!add_sid_to_array_unique(result, &u_sid,
+                                       &result->sids,
+                                       &result->num_sids)) {
+               TALLOC_FREE(result);
+               return NT_STATUS_NO_MEMORY;
+       }
+

        /* For now we throw away the gids and convert via sid_to_gid
         * later. This needs fixing, but I'd like to get the code straight and
         * simple first. */
        /* For now we throw away the gids and convert via sid_to_gid
         * later. This needs fixing, but I'd like to get the code straight and
         * simple first. */


@@ -1236,16 +1095,15 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info,
  Make (and fill) a user_info struct for a guest login.
  This *must* succeed for smbd to start. If there is no mapping entry for
  the guest gid, then create one.
  Make (and fill) a user_info struct for a guest login.
  This *must* succeed for smbd to start. If there is no mapping entry for
  the guest gid, then create one.

-**********************
-*****************************************************/
+***************************************************************************/

 
 static NTSTATUS make_new_server_info_guest(auth_serversupplied_info **server_info)
 {
        NTSTATUS status;
        struct samu *sampass = NULL;
        DOM_SID guest_sid;
 
 static NTSTATUS make_new_server_info_guest(auth_serversupplied_info **server_info)
 {
        NTSTATUS status;
        struct samu *sampass = NULL;
        DOM_SID guest_sid;

-       BOOL ret;
-       static const char zeros[16];
+       bool ret;
+       static const char zeros[16] = { 0, };

 
        if ( !(sampass = samu_new( NULL )) ) {
                return NT_STATUS_NO_MEMORY;
 
        if ( !(sampass = samu_new( NULL )) ) {
                return NT_STATUS_NO_MEMORY;


@@ -1299,32 +1157,51 @@ static auth_serversupplied_info *copy_serverinfo(auth_serversupplied_info *src)
        dst->uid = src->uid;
        dst->gid = src->gid;
        dst->n_groups = src->n_groups;
        dst->uid = src->uid;
        dst->gid = src->gid;
        dst->n_groups = src->n_groups;

-       if (src->n_groups != 0)
-               dst->groups = talloc_memdup(dst, src->groups,
-                                           sizeof(gid_t)*dst->n_groups);
-       else
+       if (src->n_groups != 0) {
+               dst->groups = (gid_t *)TALLOC_MEMDUP(
+                       dst, src->groups, sizeof(gid_t)*dst->n_groups);
+       } else {

                dst->groups = NULL;
                dst->groups = NULL;

-               
-       dst->ptok = dup_nt_token(dst, src->ptok);
+       }
+
+       if (src->ptok) {
+               dst->ptok = dup_nt_token(dst, src->ptok);
+               if (!dst->ptok) {
+                       TALLOC_FREE(dst);
+                       return NULL;
+               }
+       }

        
        dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
        
        dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,

-               src->user_session_key.length);
-               
+                                               src->user_session_key.length);
+

        dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
        dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,

-               src->lm_session_key.length);
-               
-       if ( (dst->sam_account = samu_new( NULL )) != NULL )
-               pdb_copy_sam_account(dst->sam_account, src->sam_account);
+                                               src->lm_session_key.length);
+
+       dst->sam_account = samu_new(NULL);
+       if (!dst->sam_account) {
+               TALLOC_FREE(dst);
+               return NULL;
+       }
+
+       if (!pdb_copy_sam_account(dst->sam_account, src->sam_account)) {
+               TALLOC_FREE(dst);
+               return NULL;
+       }

        
        dst->pam_handle = NULL;
        dst->unix_name = talloc_strdup(dst, src->unix_name);
        
        dst->pam_handle = NULL;
        dst->unix_name = talloc_strdup(dst, src->unix_name);

+       if (!dst->unix_name) {
+               TALLOC_FREE(dst);
+               return NULL;
+       }

 
        return dst;
 }
 
 static auth_serversupplied_info *guest_info = NULL;
 
 
        return dst;
 }
 
 static auth_serversupplied_info *guest_info = NULL;
 

-BOOL init_guest_info(void)
+bool init_guest_info(void)

 {
        if (guest_info != NULL)
                return True;
 {
        if (guest_info != NULL)
                return True;


@@ -1338,6 +1215,66 @@ NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
        return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 }
 
        return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 }
 

+bool copy_current_user(struct current_user *dst, struct current_user *src)
+{
+       gid_t *groups;
+       NT_USER_TOKEN *nt_token;
+
+       groups = (gid_t *)memdup(src->ut.groups,
+                                sizeof(gid_t) * src->ut.ngroups);
+       if ((src->ut.ngroups != 0) && (groups == NULL)) {
+               return False;
+       }
+
+       nt_token = dup_nt_token(NULL, src->nt_user_token);
+       if (nt_token == NULL) {
+               SAFE_FREE(groups);
+               return False;
+       }
+
+       dst->conn = src->conn;
+       dst->vuid = src->vuid;
+       dst->ut.uid = src->ut.uid;
+       dst->ut.gid = src->ut.gid;
+       dst->ut.ngroups = src->ut.ngroups;
+       dst->ut.groups = groups;
+       dst->nt_user_token = nt_token;
+       return True;
+}
+
+bool set_current_user_guest(struct current_user *dst)
+{
+       gid_t *groups;
+       NT_USER_TOKEN *nt_token;
+
+       groups = (gid_t *)memdup(guest_info->groups,
+                                sizeof(gid_t) * guest_info->n_groups);
+       if (groups == NULL) {
+               return False;
+       }
+
+       nt_token = dup_nt_token(NULL, guest_info->ptok);
+       if (nt_token == NULL) {
+               SAFE_FREE(groups);
+               return False;
+       }
+
+       TALLOC_FREE(dst->nt_user_token);
+       SAFE_FREE(dst->ut.groups);
+
+       /* dst->conn is never really dereferenced, it's only tested for
+        * equality in uid.c */
+       dst->conn = NULL;
+
+       dst->vuid = UID_FIELD_INVALID;
+       dst->ut.uid = guest_info->uid;
+       dst->ut.gid = guest_info->gid;
+       dst->ut.ngroups = guest_info->n_groups;
+       dst->ut.groups = groups;
+       dst->nt_user_token = nt_token;
+       return True;
+}
+

 /***************************************************************************
  Purely internal function for make_server_info_info3
  Fill the sam account from getpwnam
 /***************************************************************************
  Purely internal function for make_server_info_info3
  Fill the sam account from getpwnam


@@ -1347,7 +1284,8 @@ static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
                                 const char *username,
                                 char **found_username,
                                 uid_t *uid, gid_t *gid,
                                 const char *username,
                                 char **found_username,
                                 uid_t *uid, gid_t *gid,

-                                struct samu *account)
+                                struct samu *account,
+                                bool *username_was_mapped)

 {
        NTSTATUS nt_status;
        fstring dom_user, lower_username;
 {
        NTSTATUS nt_status;
        fstring dom_user, lower_username;


@@ -1360,12 +1298,9 @@ static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
        fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(), 
                lower_username);
 
        fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(), 
                lower_username);
 

-       /* get the passwd struct but don't create the user if he/she 
-          does not exist.  We were explicitly called from a following
-          a winbindd authentication request so we should assume that 
-          nss_winbindd is working */
+       /* Get the passwd struct.  Try to create the account is necessary. */

 
 

-       map_username( dom_user );
+       *username_was_mapped = map_username( dom_user );

 
        if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
                return NT_STATUS_NO_SUCH_USER;
 
        if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
                return NT_STATUS_NO_SUCH_USER;


@@ -1397,7 +1332,7 @@ static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
  ****************************************************************************/
  
 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
  ****************************************************************************/
  
 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,

-                            fstring save_username, BOOL create )
+                            fstring save_username, bool create )

 {
        struct passwd *pw = NULL;
        char *p;
 {
        struct passwd *pw = NULL;
        char *p;


@@ -1453,9 +1388,12 @@ struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
        
        pw = Get_Pwnam_alloc(mem_ctx, username);
                
        
        pw = Get_Pwnam_alloc(mem_ctx, username);
                

-       /* Create local user if requested. */
+       /* Create local user if requested but only if winbindd
+          is not running.  We need to protect against cases
+          where winbindd is failing and then prematurely
+          creating users in /etc/passwd */

        
        

-       if ( !pw && create ) {
+       if ( !pw && create && !winbind_ping() ) {

                /* Don't add a machine account. */
                if (username[strlen(username)-1] == '$')
                        return NULL;
                /* Don't add a machine account. */
                if (username[strlen(username)-1] == '$')
                        return NULL;


@@ -1477,13 +1415,12 @@ struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
 ***************************************************************************/
 
 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, 
 ***************************************************************************/
 
 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, 

-                               const char *internal_username,

                                const char *sent_nt_username,
                                const char *domain,
                                auth_serversupplied_info **server_info, 
                                NET_USER_INFO_3 *info3) 
 {
                                const char *sent_nt_username,
                                const char *domain,
                                auth_serversupplied_info **server_info, 
                                NET_USER_INFO_3 *info3) 
 {

-       static const char zeros[16];
+       static const char zeros[16] = { 0, };

 
        NTSTATUS nt_status = NT_STATUS_OK;
        char *found_username;
 
        NTSTATUS nt_status = NT_STATUS_OK;
        char *found_username;


@@ -1492,12 +1429,11 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        struct samu *sam_account = NULL;
        DOM_SID user_sid;
        DOM_SID group_sid;
        struct samu *sam_account = NULL;
        DOM_SID user_sid;
        DOM_SID group_sid;

+       bool username_was_mapped;

 
        uid_t uid;
        gid_t gid;
 
 
        uid_t uid;
        gid_t gid;
 

-       size_t i;
-

        auth_serversupplied_info *result;
 
        /* 
        auth_serversupplied_info *result;
 
        /* 


@@ -1516,13 +1452,13 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
                return NT_STATUS_INVALID_PARAMETER;
        }
 

-       if (!(nt_username = unistr2_tdup(mem_ctx, &(info3->uni_user_name)))) {
+       if (!(nt_username = unistr2_to_ascii_talloc(mem_ctx, &(info3->uni_user_name)))) {

                /* If the server didn't give us one, just use the one we sent
                 * them */
                nt_username = sent_nt_username;
        }
 
                /* If the server didn't give us one, just use the one we sent
                 * them */
                nt_username = sent_nt_username;
        }
 

-       if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3->uni_logon_dom)))) {
+       if (!(nt_domain = unistr2_to_ascii_talloc(mem_ctx, &(info3->uni_logon_dom)))) {

                /* If the server didn't give us one, just use the one we sent
                 * them */
                nt_domain = domain;
                /* If the server didn't give us one, just use the one we sent
                 * them */
                nt_domain = domain;


@@ -1544,16 +1480,12 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
                return NT_STATUS_NO_MEMORY;
        }
 
                return NT_STATUS_NO_MEMORY;
        }
 

+       /* this call will try to create the user if necessary */
+

        nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,
        nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,

-                                    &found_username, &uid, &gid, sam_account);
+                                    &found_username, &uid, &gid, sam_account,
+                                    &username_was_mapped);

 
 

-       if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
-               DEBUG(3,("User %s does not exist, trying to add it\n",
-                        internal_username));
-               smb_create_user( nt_domain, sent_nt_username, NULL);
-               nt_status = fill_sam_account( mem_ctx, nt_domain, sent_nt_username, 
-                                             &found_username, &uid, &gid, sam_account );
-       }

        
        /* if we still don't have a valid unix account check for 
          'map to guest = bad uid' */
        
        /* if we still don't have a valid unix account check for 
          'map to guest = bad uid' */


@@ -1632,6 +1564,30 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
                return NT_STATUS_NO_MEMORY;
        }
 
                return NT_STATUS_NO_MEMORY;
        }
 

+       if (!pdb_set_pass_last_set_time(
+                   sam_account,
+                   nt_time_to_unix(info3->pass_last_set_time),
+                   PDB_CHANGED)) {
+               TALLOC_FREE(sam_account);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (!pdb_set_pass_can_change_time(
+                   sam_account,
+                   nt_time_to_unix(info3->pass_can_change_time),
+                   PDB_CHANGED)) {
+               TALLOC_FREE(sam_account);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (!pdb_set_pass_must_change_time(
+                   sam_account,
+                   nt_time_to_unix(info3->pass_must_change_time),
+                   PDB_CHANGED)) {
+               TALLOC_FREE(sam_account);
+               return NT_STATUS_NO_MEMORY;
+       }
+

        result = make_server_info(NULL);
        if (result == NULL) {
                DEBUG(4, ("make_server_info failed!\n"));
        result = make_server_info(NULL);
        if (result == NULL) {
                DEBUG(4, ("make_server_info failed!\n"));


@@ -1655,40 +1611,22 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        result->num_sids = 0;
        result->sids = NULL;
 
        result->num_sids = 0;
        result->sids = NULL;
 

-       /* and create (by appending rids) the 'domain' sids */
-       
-       for (i = 0; i < info3->num_groups2; i++) {
-               DOM_SID sid;
-               if (!sid_compose(&sid, &info3->dom_sid.sid,
-                                info3->gids[i].g_rid)) {
-                       DEBUG(3,("could not append additional group rid "
-                                "0x%x\n", info3->gids[i].g_rid));
-                       TALLOC_FREE(result);
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-               add_sid_to_array(result, &sid, &result->sids,
-                                &result->num_sids);
-       }
-
-       /* Copy 'other' sids.  We need to do sid filtering here to
-          prevent possible elevation of privileges.  See:
-
-           http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
-         */
-
-       for (i = 0; i < info3->num_other_sids; i++) {
-               add_sid_to_array(result, &info3->other_sids[i].sid,
-                                &result->sids,
-                                &result->num_sids);
+       nt_status = sid_array_from_info3(result, info3,
+                                        &result->sids,
+                                        &result->num_sids,
+                                        False);
+       if (!NT_STATUS_IS_OK(nt_status)) {
+               TALLOC_FREE(result);
+               return nt_status;

        }
 
        }
 

-       result->login_server = unistr2_tdup(result, 
+       result->login_server = unistr2_to_ascii_talloc(result, 

                                            &(info3->uni_logon_srv));
 
        /* ensure we are never given NULL session keys */
        
        if (memcmp(info3->user_sess_key, zeros, sizeof(zeros)) == 0) {
                                            &(info3->uni_logon_srv));
 
        /* ensure we are never given NULL session keys */
        
        if (memcmp(info3->user_sess_key, zeros, sizeof(zeros)) == 0) {

-               result->user_session_key = data_blob(NULL, 0);
+               result->user_session_key = data_blob_null;

        } else {
                result->user_session_key = data_blob_talloc(
                        result, info3->user_sess_key,
        } else {
                result->user_session_key = data_blob_talloc(
                        result, info3->user_sess_key,


@@ -1696,13 +1634,15 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        }
 
        if (memcmp(info3->lm_sess_key, zeros, 8) == 0) {
        }
 
        if (memcmp(info3->lm_sess_key, zeros, 8) == 0) {

-               result->lm_session_key = data_blob(NULL, 0);
+               result->lm_session_key = data_blob_null;

        } else {
                result->lm_session_key = data_blob_talloc(
                        result, info3->lm_sess_key,
                        sizeof(info3->lm_sess_key));
        }
 
        } else {
                result->lm_session_key = data_blob_talloc(
                        result, info3->lm_sess_key,
                        sizeof(info3->lm_sess_key));
        }
 

+       result->was_mapped = username_was_mapped;
+

        *server_info = result;
 
        return NT_STATUS_OK;
        *server_info = result;
 
        return NT_STATUS_OK;


@@ -1739,7 +1679,7 @@ void free_user_info(auth_usersupplied_info **user_info)
  Make an auth_methods struct
 ***************************************************************************/
 
  Make an auth_methods struct
 ***************************************************************************/
 

-BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method) 
+bool make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method) 

 {
        if (!auth_context) {
                smb_panic("no auth_context supplied to "
 {
        if (!auth_context) {
                smb_panic("no auth_context supplied to "


@@ -1761,86 +1701,6 @@ BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_me
        return True;
 }
 
        return True;
 }
 

-/****************************************************************************
- Duplicate a SID token.
-****************************************************************************/
-
-NT_USER_TOKEN *dup_nt_token(TALLOC_CTX *mem_ctx, NT_USER_TOKEN *ptoken)
-{
-       NT_USER_TOKEN *token;
-
-       if (!ptoken)
-               return NULL;
-
-       token = TALLOC_P(mem_ctx, NT_USER_TOKEN);
-       if (token == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               return NULL;
-       }
-
-       token->user_sids = talloc_memdup(token, ptoken->user_sids,
-                                        sizeof(DOM_SID) * ptoken->num_sids );
-
-       if ((ptoken->user_sids != NULL) && (token->user_sids == NULL)) {
-               DEBUG(0, ("talloc_memdup failed\n"));
-               TALLOC_FREE(token);
-               return NULL;
-       }
-
-       token->num_sids = ptoken->num_sids;
-       
-       /* copy the privileges; don't consider failure to be critical here */
-       
-       if ( !se_priv_copy( &token->privileges, &ptoken->privileges ) ) {
-               DEBUG(0,("dup_nt_token: Failure to copy SE_PRIV!.  "
-                        "Continuing with 0 privileges assigned.\n"));
-       }
-
-       return token;
-}
-
-/****************************************************************************
- Check for a SID in an NT_USER_TOKEN
-****************************************************************************/
-
-BOOL nt_token_check_sid ( const DOM_SID *sid, const NT_USER_TOKEN *token )
-{
-       int i;
-       
-       if ( !sid || !token )
-               return False;
-       
-       for ( i=0; i<token->num_sids; i++ ) {
-               if ( sid_equal( sid, &token->user_sids[i] ) )
-                       return True;
-       }
-
-       return False;
-}
-
-BOOL nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid ) 
-{
-       DOM_SID domain_sid;
-
-       /* if we are a domain member, the get the domain SID, else for 
-          a DC or standalone server, use our own SID */
-
-       if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
-               if ( !secrets_fetch_domain_sid( lp_workgroup(),
-                                               &domain_sid ) ) {
-                       DEBUG(1,("nt_token_check_domain_rid: Cannot lookup "
-                                "SID for domain [%s]\n", lp_workgroup()));
-                       return False;
-               }
-       } 
-       else
-               sid_copy( &domain_sid, get_global_sam_sid() );
-
-       sid_append_rid( &domain_sid, rid );
-       
-       return nt_token_check_sid( &domain_sid, token );\
-}
-

 /**
  * Verify whether or not given domain is trusted.
  *
 /**
  * Verify whether or not given domain is trusted.
  *


@@ -1849,10 +1709,10 @@ BOOL nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid )
  *         false if otherwise
  **/
 
  *         false if otherwise
  **/
 

-BOOL is_trusted_domain(const char* dom_name)
+bool is_trusted_domain(const char* dom_name)

 {
        DOM_SID trustdom_sid;
 {
        DOM_SID trustdom_sid;

-       BOOL ret;
+       bool ret;

 
        /* no trusted domains for a standalone server */
 
 
        /* no trusted domains for a standalone server */
 


@@ -1865,8 +1725,7 @@ BOOL is_trusted_domain(const char* dom_name)
                become_root();
                DEBUG (5,("is_trusted_domain: Checking for domain trust with "
                          "[%s]\n", dom_name ));
                become_root();
                DEBUG (5,("is_trusted_domain: Checking for domain trust with "
                          "[%s]\n", dom_name ));

-               ret = secrets_fetch_trusted_domain_password(dom_name, NULL,
-                                                           NULL, NULL);
+               ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);

                unbecome_root();
                if (ret)
                        return True;
                unbecome_root();
                if (ret)
                        return True;