docs: fix a typo in history file
[bbaumbach/samba-autobuild/.git] / source3 / passdb / pdb_samba_dsdb.c
index 97fba0e7f89eb9cd215c8a9f91acd7b52d46afd8..8ed5799ac895c1301b813eb9d0b472221311d521 100644 (file)
@@ -155,7 +155,8 @@ static struct ldb_message *pdb_samba_dsdb_get_samu_private(
        struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
                m->private_data, struct pdb_samba_dsdb_state);
        struct ldb_message *msg;
-       char *sidstr, *filter;
+       struct dom_sid_buf sidstr;
+       char *filter;
        NTSTATUS status;
 
        msg = (struct ldb_message *)
@@ -165,14 +166,10 @@ static struct ldb_message *pdb_samba_dsdb_get_samu_private(
                return talloc_get_type_abort(msg, struct ldb_message);
        }
 
-       sidstr = dom_sid_string(talloc_tos(), pdb_get_user_sid(sam));
-       if (sidstr == NULL) {
-               return NULL;
-       }
-
        filter = talloc_asprintf(
-               talloc_tos(), "(&(objectsid=%s)(objectclass=user))", sidstr);
-       TALLOC_FREE(sidstr);
+               talloc_tos(),
+               "(&(objectsid=%s)(objectclass=user))",
+               dom_sid_str_buf(pdb_get_user_sid(sam), &sidstr));
        if (filter == NULL) {
                return NULL;
        }
@@ -725,15 +722,11 @@ static NTSTATUS pdb_samba_dsdb_getsampwsid(struct pdb_methods *m,
        NTSTATUS status;
        struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
                m->private_data, struct pdb_samba_dsdb_state);
-       char *sidstr;
-
-       sidstr = dom_sid_string(talloc_tos(), sid);
-       NT_STATUS_HAVE_NO_MEMORY(sidstr);
+       struct dom_sid_buf buf;
 
        status = pdb_samba_dsdb_getsampwfilter(m, state, sam_acct,
                                           "(&(objectsid=%s)(objectclass=user))",
-                                          sidstr);
-       talloc_free(sidstr);
+                                          dom_sid_str_buf(sid, &buf));
        return status;
 }
 
@@ -771,10 +764,15 @@ static NTSTATUS pdb_samba_dsdb_delete_user(struct pdb_methods *m,
                m->private_data, struct pdb_samba_dsdb_state);
        struct ldb_dn *dn;
        int rc;
+       struct dom_sid_buf buf;
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-       dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, pdb_get_user_sid(sam)));
+       dn = ldb_dn_new_fmt(
+               tmp_ctx,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(pdb_get_user_sid(sam), &buf));
        if (!dn || !ldb_dn_validate(dn)) {
                talloc_free(tmp_ctx);
                return NT_STATUS_NO_MEMORY;
@@ -793,7 +791,7 @@ static NTSTATUS pdb_samba_dsdb_delete_user(struct pdb_methods *m,
 
 /* This interface takes a fully populated struct samu and places it in
  * the database.  This is not implemented at this time as we need to
- * be careful around the creation of arbitary SIDs (ie, we must ensrue
+ * be careful around the creation of arbitrary SIDs (ie, we must ensure
  * they are not left in a RID pool */
 static NTSTATUS pdb_samba_dsdb_add_sam_account(struct pdb_methods *m,
                                        struct samu *sampass)
@@ -882,8 +880,8 @@ static NTSTATUS pdb_samba_dsdb_rename_sam_account(struct pdb_methods *m,
        return NT_STATUS_NOT_IMPLEMENTED;
 }
 
-/* This is not implemented, as this module is exptected to be used
- * with auth_samba_dsdb, and this is responible for login counters etc
+/* This is not implemented, as this module is expected to be used
+ * with auth_samba_dsdb, and this is responsible for login counters etc
  *
  */
 static NTSTATUS pdb_samba_dsdb_update_login_attempts(struct pdb_methods *m,
@@ -1019,10 +1017,11 @@ static NTSTATUS pdb_samba_dsdb_getgrsid(struct pdb_methods *m, GROUP_MAP *map,
 {
        char *filter;
        NTSTATUS status;
+       struct dom_sid_buf buf;
 
        filter = talloc_asprintf(talloc_tos(),
                                 "(&(objectsid=%s)(objectclass=group))",
-                                sid_string_talloc(talloc_tos(), &sid));
+                                dom_sid_str_buf(&sid, &buf));
        if (filter == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -1109,6 +1108,7 @@ static NTSTATUS pdb_samba_dsdb_delete_dom_group(struct pdb_methods *m,
        struct ldb_message *msg;
        struct ldb_dn *dn;
        int rc;
+       struct dom_sid_buf buf;
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
@@ -1119,7 +1119,11 @@ static NTSTATUS pdb_samba_dsdb_delete_dom_group(struct pdb_methods *m,
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, &sid));
+       dn = ldb_dn_new_fmt(
+               tmp_ctx,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(&sid, &buf));
        if (!dn || !ldb_dn_validate(dn)) {
                talloc_free(tmp_ctx);
                ldb_transaction_cancel(state->ldb);
@@ -1130,6 +1134,12 @@ static NTSTATUS pdb_samba_dsdb_delete_dom_group(struct pdb_methods *m,
                talloc_free(tmp_ctx);
                ldb_transaction_cancel(state->ldb);
                return NT_STATUS_NO_SUCH_GROUP;
+       } else if (rc != LDB_SUCCESS) {
+               talloc_free(tmp_ctx);
+               DEBUG(10, ("dsdb_search_one failed %s\n",
+                          ldb_errstring(state->ldb)));
+               ldb_transaction_cancel(state->ldb);
+               return NT_STATUS_LDAP(rc);
        }
        rc = ldb_delete(state->ldb, dn);
        if (rc == LDB_ERR_NO_SUCH_OBJECT) {
@@ -1192,11 +1202,16 @@ static NTSTATUS pdb_samba_dsdb_enum_group_members(struct pdb_methods *m,
        uint32_t *members;
        struct ldb_dn *dn;
        NTSTATUS status;
+       struct dom_sid_buf buf;
 
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-       dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, group));
+       dn = ldb_dn_new_fmt(
+               tmp_ctx,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(group, &buf));
        if (!dn || !ldb_dn_validate(dn)) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -1284,10 +1299,11 @@ static NTSTATUS fake_enum_group_memberships(struct pdb_samba_dsdb_state *state,
                if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
                        gids[0] = id_map.xid.id;
                } else {
+                       struct dom_sid_buf buf1, buf2;
                        DEBUG(1, (__location__
                                  "Group %s, of which %s is a member, could not be converted to a GID\n",
-                                 dom_sid_string(tmp_ctx, &group_sids[0]),
-                                 dom_sid_string(tmp_ctx, &user->user_sid)));
+                                 dom_sid_str_buf(&group_sids[0], &buf1),
+                                 dom_sid_str_buf(&user->user_sid, &buf2)));
                        talloc_free(tmp_ctx);
                        /* We must error out, otherwise a user might
                         * avoid a DENY acl based on a group they
@@ -1391,9 +1407,11 @@ static NTSTATUS pdb_samba_dsdb_enum_group_memberships(struct pdb_methods *m,
                if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
                        gids[num_groups] = id_map.xid.id;
                } else {
+                       struct dom_sid_buf buf;
                        DEBUG(1, (__location__
                                  "Group %s, of which %s is a member, could not be converted to a GID\n",
-                                 dom_sid_string(tmp_ctx, &group_sids[num_groups]),
+                                 dom_sid_str_buf(&group_sids[num_groups],
+                                                 &buf),
                                  ldb_dn_get_linearized(msg->dn)));
                        talloc_free(tmp_ctx);
                        /* We must error out, otherwise a user might
@@ -1433,6 +1451,7 @@ static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
        struct ldb_message *msg;
        int ret;
        struct ldb_message_element *el;
+       struct dom_sid_buf buf;
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
        msg = ldb_msg_new(tmp_ctx);
@@ -1441,12 +1460,20 @@ static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
                return NT_STATUS_NO_MEMORY;
        }
 
-       msg->dn = ldb_dn_new_fmt(msg, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, groupsid));
+       msg->dn = ldb_dn_new_fmt(
+               msg,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(groupsid, &buf));
        if (!msg->dn || !ldb_dn_validate(msg->dn)) {
                talloc_free(tmp_ctx);
                return NT_STATUS_NO_MEMORY;
        }
-       ret = ldb_msg_add_fmt(msg, "member", "<SID=%s>", dom_sid_string(tmp_ctx, membersid));
+       ret = ldb_msg_add_fmt(
+               msg,
+               "member",
+               "<SID=%s>",
+               dom_sid_str_buf(membersid, &buf));
        if (ret != LDB_SUCCESS) {
                talloc_free(tmp_ctx);
                return NT_STATUS_NO_MEMORY;
@@ -1550,10 +1577,15 @@ static NTSTATUS pdb_samba_dsdb_delete_alias(struct pdb_methods *m,
        struct ldb_message *msg;
        struct ldb_dn *dn;
        int rc;
+       struct dom_sid_buf buf;
        TALLOC_CTX *tmp_ctx = talloc_stackframe();
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-       dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, sid));
+       dn = ldb_dn_new_fmt(
+               tmp_ctx,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(sid, &buf));
        if (!dn || !ldb_dn_validate(dn)) {
                talloc_free(tmp_ctx);
                return NT_STATUS_NO_MEMORY;
@@ -1573,6 +1605,12 @@ static NTSTATUS pdb_samba_dsdb_delete_alias(struct pdb_methods *m,
                talloc_free(tmp_ctx);
                ldb_transaction_cancel(state->ldb);
                return NT_STATUS_NO_SUCH_ALIAS;
+       } else if (rc != LDB_SUCCESS) {
+               talloc_free(tmp_ctx);
+               DEBUG(10, ("dsdb_search_one failed %s\n",
+                          ldb_errstring(state->ldb)));
+               ldb_transaction_cancel(state->ldb);
+               return NT_STATUS_LDAP(rc);
        }
        rc = ldb_delete(state->ldb, dn);
        if (rc == LDB_ERR_NO_SUCH_OBJECT) {
@@ -1598,87 +1636,6 @@ static NTSTATUS pdb_samba_dsdb_delete_alias(struct pdb_methods *m,
        return NT_STATUS_OK;
 }
 
-#if 0
-static NTSTATUS pdb_samba_dsdb_set_aliasinfo(struct pdb_methods *m,
-                                     const struct dom_sid *sid,
-                                     struct acct_info *info)
-{
-       struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
-               m->private_data, struct pdb_samba_dsdb_state);
-       struct tldap_context *ld;
-       const char *attrs[3] = { "objectSid", "description",
-                                "samAccountName" };
-       struct ldb_message **msg;
-       char *sidstr, *dn;
-       int rc;
-       struct tldap_mod *mods;
-       int num_mods;
-       bool ok;
-
-       ld = pdb_samba_dsdb_ld(state);
-       if (ld == NULL) {
-               return NT_STATUS_LDAP(TLDAP_SERVER_DOWN);
-       }
-
-       sidstr = sid_binstring(talloc_tos(), sid);
-       NT_STATUS_HAVE_NO_MEMORY(sidstr);
-
-       rc = pdb_samba_dsdb_search_fmt(state, state->domaindn, TLDAP_SCOPE_SUB,
-                               attrs, ARRAY_SIZE(attrs), 0, talloc_tos(),
-                               &msg, "(&(objectSid=%s)(objectclass=group)"
-                               "(|(grouptype=%d)(grouptype=%d)))",
-                               sidstr, GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
-                               GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
-       TALLOC_FREE(sidstr)
-       if (rc != LDB_SUCCESS) {
-               DEBUG(10, ("ldap_search failed %s\n",
-                          ldb_errstring(state->ldb)));
-               return NT_STATUS_LDAP(rc);
-       }
-       switch talloc_array_length(msg) {
-       case 0:
-               return NT_STATUS_NO_SUCH_ALIAS;
-       case 1:
-               break;
-       default:
-               return NT_STATUS_INTERNAL_DB_CORRUPTION;
-       }
-
-       if (!tldap_entry_dn(msg[0], &dn)) {
-               TALLOC_FREE(msg);
-               return NT_STATUS_INTERNAL_DB_CORRUPTION;
-       }
-
-       mods = NULL;
-       num_mods = 0;
-       ok = true;
-
-       ok &= tldap_make_mod_fmt(
-               msg[0], msg, &num_mods, &mods, "description",
-               "%s", info->acct_desc);
-       ok &= tldap_make_mod_fmt(
-               msg[0], msg, &num_mods, &mods, "samAccountName",
-               "%s", info->acct_name);
-       if (!ok) {
-               TALLOC_FREE(msg);
-               return NT_STATUS_NO_MEMORY;
-       }
-       if (num_mods == 0) {
-               /* no change */
-               TALLOC_FREE(msg);
-               return NT_STATUS_OK;
-       }
-
-       rc = tldap_modify(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
-       TALLOC_FREE(msg);
-       if (rc != LDB_SUCCESS) {
-               DEBUG(10, ("ldap_modify failed: %s\n",
-                          ldb_errstring(state->ldb)));
-               return NT_STATUS_LDAP(rc);
-       }
-       return NT_STATUS_OK;
-}
-#endif
 static NTSTATUS pdb_samba_dsdb_add_aliasmem(struct pdb_methods *m,
                                     const struct dom_sid *alias,
                                     const struct dom_sid *member)
@@ -1712,18 +1669,22 @@ static NTSTATUS pdb_samba_dsdb_enum_aliasmem(struct pdb_methods *m,
        struct ldb_dn *dn;
        unsigned int num_members;
        NTSTATUS status;
+       struct dom_sid_buf buf;
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-       dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, alias));
+       dn = ldb_dn_new_fmt(
+               tmp_ctx,
+               state->ldb,
+               "<SID=%s>",
+               dom_sid_str_buf(alias, &buf));
        if (!dn || !ldb_dn_validate(dn)) {
                return NT_STATUS_NO_MEMORY;
        }
 
        status = dsdb_enum_group_mem(state->ldb, mem_ctx, dn, pmembers, &num_members);
-       *pnum_members = num_members;
        if (NT_STATUS_IS_OK(status)) {
-               talloc_steal(mem_ctx, pmembers);
+               *pnum_members = num_members;
        }
        talloc_free(tmp_ctx);
        return status;
@@ -1742,11 +1703,10 @@ static NTSTATUS pdb_samba_dsdb_enum_alias_memberships(struct pdb_methods *m,
        uint32_t *alias_rids = NULL;
        size_t num_alias_rids = 0;
        int i;
-       struct dom_sid *groupSIDs = NULL;
-       unsigned int num_groupSIDs = 0;
+       struct auth_SidAttr *groupSIDs = NULL;
+       uint32_t num_groupSIDs = 0;
        char *filter;
        NTSTATUS status;
-       const char *sid_string;
        const char *sid_dn;
        DATA_BLOB sid_blob;
 
@@ -1757,20 +1717,19 @@ static NTSTATUS pdb_samba_dsdb_enum_alias_memberships(struct pdb_methods *m,
         * either the SAM or BUILTIN
         */
 
-       filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
+       filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:"LDB_OID_COMPARATOR_AND":=%u))",
                                 GROUP_TYPE_BUILTIN_LOCAL_GROUP);
        if (filter == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
        for (i = 0; i < num_members; i++) {
-               sid_string = dom_sid_string(tmp_ctx, &members[i]);
-               if (sid_string == NULL) {
-                       TALLOC_FREE(tmp_ctx);
-                       return NT_STATUS_NO_MEMORY;
-               }
+               struct dom_sid_buf buf;
 
-               sid_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", sid_string);
+               sid_dn = talloc_asprintf(
+                       tmp_ctx,
+                       "<SID=%s>",
+                       dom_sid_str_buf(&members[i], &buf));
                if (sid_dn == NULL) {
                        TALLOC_FREE(tmp_ctx);
                        return NT_STATUS_NO_MEMORY;
@@ -1793,7 +1752,7 @@ static NTSTATUS pdb_samba_dsdb_enum_alias_memberships(struct pdb_methods *m,
        }
 
        for (i=0; i<num_groupSIDs; i++) {
-               if (sid_peek_check_rid(domain_sid, &groupSIDs[i],
+               if (sid_peek_check_rid(domain_sid, &groupSIDs[i].sid,
                                       &alias_rids[num_alias_rids])) {
                        num_alias_rids++;;
                }
@@ -2134,7 +2093,7 @@ static bool pdb_samba_dsdb_sid_to_id(struct pdb_methods *m, const struct dom_sid
 
 static uint32_t pdb_samba_dsdb_capabilities(struct pdb_methods *m)
 {
-       return PDB_CAP_STORE_RIDS | PDB_CAP_ADS;
+       return PDB_CAP_STORE_RIDS | PDB_CAP_ADS | PDB_CAP_TRUSTED_DOMAINS_EX;
 }
 
 static bool pdb_samba_dsdb_new_rid(struct pdb_methods *m, uint32_t *rid)
@@ -2209,17 +2168,16 @@ static bool pdb_samba_dsdb_get_trusteddom_pw(struct pdb_methods *m,
 
        trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
        if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
-               DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
-                         domain));
+               DBG_WARNING("Trusted domain %s is not an outbound trust.\n",
+                           domain);
                TALLOC_FREE(tmp_ctx);
                return false;
        }
 
        trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
        if (trust_type == LSA_TRUST_TYPE_MIT) {
-               DEBUG(1, ("Trusted domain %s is is not an AD trust "
-                         "(trustType == LSA_TRUST_TYPE_MIT).\n",
-                         domain));
+               DBG_WARNING("Trusted domain %s is not an AD trust "
+                           "(trustType == LSA_TRUST_TYPE_MIT).\n", domain);
                TALLOC_FREE(tmp_ctx);
                return false;
        }
@@ -2236,7 +2194,7 @@ static bool pdb_samba_dsdb_get_trusteddom_pw(struct pdb_methods *m,
                                (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                DEBUG(0, ("Failed to get trusted domain password for %s, "
-                         "attribute trustAuthOutgoing coult not be parsed %s.\n",
+                         "attribute trustAuthOutgoing could not be parsed %s.\n",
                          domain,
                          ndr_map_error2string(ndr_err)));
                TALLOC_FREE(tmp_ctx);
@@ -2364,17 +2322,16 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
 
        trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
        if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
-               DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
-                         domain));
+               DBG_WARNING("Trusted domain %s is not an outbound trust.\n",
+                           domain);
                TALLOC_FREE(tmp_ctx);
                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
        }
 
        trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
        if (trust_type == LSA_TRUST_TYPE_MIT) {
-               DEBUG(1, ("Trusted domain %s is is not an AD trust "
-                         "(trustType == LSA_TRUST_TYPE_MIT).\n",
-                         domain));
+               DBG_WARNING("Trusted domain %s is not an AD trust "
+                           "(trustType == LSA_TRUST_TYPE_MIT).\n", domain);
                TALLOC_FREE(tmp_ctx);
                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
        }
@@ -2391,7 +2348,7 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
                                (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                DEBUG(0, ("Failed to get trusted domain password for %s, "
-                         "attribute trustAuthOutgoing coult not be parsed %s.\n",
+                         "attribute trustAuthOutgoing could not be parsed %s.\n",
                          domain,
                          ndr_map_error2string(ndr_err)));
                TALLOC_FREE(tmp_ctx);
@@ -2573,13 +2530,15 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
                 * Force kerberos if this is an active directory domain
                 */
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_MUST_USE_KERBEROS);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        } else  {
                /*
                 * TODO: we should allow krb5 with the raw nt hash.
                 */
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_DONT_USE_KERBEROS);
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        *_creds = talloc_move(mem_ctx, &creds);
@@ -2603,7 +2562,7 @@ static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
        struct ldb_message *msg = NULL;
        int trust_direction_flags;
        int trust_type;
-       int i;
+       uint32_t i; /* The same type as old_blob.current.count */
        const struct ldb_val *old_val = NULL;
        struct trustAuthInOutBlob old_blob = {};
        uint32_t old_version = 0;
@@ -2651,8 +2610,8 @@ static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
 
        trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
        if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
-               DEBUG(2, ("Trusted domain %s is is not an outbound trust, can't set a password.\n",
-                         domain));
+               DBG_WARNING("Trusted domain %s is not an outbound trust, can't set a password.\n",
+                           domain);
                TALLOC_FREE(tmp_ctx);
                ldb_transaction_cancel(state->ldb);
                return false;
@@ -2678,7 +2637,7 @@ static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
                                (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                        DEBUG(0, ("Failed to get trusted domain password for %s, "
-                                 "attribute trustAuthOutgoing coult not be parsed %s.\n",
+                                 "attribute trustAuthOutgoing could not be parsed %s.\n",
                                  domain,
                                  ndr_map_error2string(ndr_err)));
                        TALLOC_FREE(tmp_ctx);
@@ -2829,18 +2788,10 @@ static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
        }
 
        msg->num_elements = 0;
-       ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
-                               LDB_FLAG_MOD_REPLACE, NULL);
+       ret = ldb_msg_append_value(msg, "trustAuthOutgoing",
+                                  &new_val, LDB_FLAG_MOD_REPLACE);
        if (ret != LDB_SUCCESS) {
-               DEBUG(0, ("ldb_msg_add_empty() failed\n"));
-               TALLOC_FREE(tmp_ctx);
-               ldb_transaction_cancel(state->ldb);
-               return false;
-       }
-       ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
-                               &new_val, NULL);
-       if (ret != LDB_SUCCESS) {
-               DEBUG(0, ("ldb_msg_add_value() failed\n"));
+               DEBUG(0, ("ldb_msg_append_value() failed\n"));
                TALLOC_FREE(tmp_ctx);
                ldb_transaction_cancel(state->ldb);
                return false;
@@ -2959,7 +2910,7 @@ static NTSTATUS pdb_samba_dsdb_enum_trusteddoms(struct pdb_methods *m,
                domains[di++] = d;
        }
 
-       talloc_realloc(domains, domains, struct trustdom_info *, di);
+       domains = talloc_realloc(domains, domains, struct trustdom_info *, di);
        *_domains = talloc_move(mem_ctx, &domains);
        *_num_domains = di;
        TALLOC_FREE(tmp_ctx);
@@ -3135,13 +3086,15 @@ static NTSTATUS pdb_samba_dsdb_get_trusted_domain_by_sid(struct pdb_methods *m,
        };
        struct ldb_message *msg = NULL;
        struct pdb_trusted_domain *d = NULL;
+       struct dom_sid_buf buf;
        NTSTATUS status;
 
        status = dsdb_trust_search_tdo_by_sid(state->ldb, sid,
                                              attrs, tmp_ctx, &msg);
        if (!NT_STATUS_IS_OK(status)) {
                DBG_ERR("dsdb_trust_search_tdo_by_sid(%s) - %s ",
-                       dom_sid_string(tmp_ctx, sid), nt_errstr(status));
+                       dom_sid_str_buf(sid, &buf),
+                       nt_errstr(status));
                TALLOC_FREE(tmp_ctx);
                return status;
        }
@@ -3149,7 +3102,8 @@ static NTSTATUS pdb_samba_dsdb_get_trusted_domain_by_sid(struct pdb_methods *m,
        status = pdb_samba_dsdb_msg_to_trusted_domain(msg, mem_ctx, &d);
        if (!NT_STATUS_IS_OK(status)) {
                DBG_ERR("pdb_samba_dsdb_msg_to_trusted_domain(%s) - %s ",
-                       dom_sid_string(tmp_ctx, sid), nt_errstr(status));
+                       dom_sid_str_buf(sid, &buf),
+                       nt_errstr(status));
                TALLOC_FREE(tmp_ctx);
                return status;
        }
@@ -3280,9 +3234,6 @@ static NTSTATUS pdb_samba_dsdb_set_trusted_domain(struct pdb_methods *methods,
        };
        char *netbios_encoded = NULL;
        char *dns_encoded = NULL;
-       struct dom_sid *tmp_sid1;
-       struct dom_sid *tmp_sid2;
-       uint32_t tmp_rid;
        char *sid_encoded = NULL;
        int ret;
        struct trustAuthInOutBlob taiob;
@@ -3300,39 +3251,8 @@ static NTSTATUS pdb_samba_dsdb_set_trusted_domain(struct pdb_methods *methods,
         * We expect S-1-5-21-A-B-C, but we don't
         * allow S-1-5-21-0-0-0 as this is used
         * for claims and compound identities.
-        *
-        * So we call dom_sid_split_rid() 3 times
-        * and compare the result to S-1-5-21
         */
-       status = dom_sid_split_rid(tmp_ctx,
-                                  &td->security_identifier,
-                                  &tmp_sid1, &tmp_rid);
-       if (!NT_STATUS_IS_OK(status)) {
-               goto out;
-       }
-       status = dom_sid_split_rid(tmp_ctx, tmp_sid1, &tmp_sid2, &tmp_rid);
-       if (!NT_STATUS_IS_OK(status)) {
-               goto out;
-       }
-       status = dom_sid_split_rid(tmp_ctx, tmp_sid2, &tmp_sid1, &tmp_rid);
-       if (!NT_STATUS_IS_OK(status)) {
-               goto out;
-       }
-       ok = dom_sid_parse("S-1-5-21", tmp_sid2);
-       if (!ok) {
-               status = NT_STATUS_INTERNAL_ERROR;
-               goto out;
-       }
-       ok = dom_sid_equal(tmp_sid1, tmp_sid2);
-       if (!ok) {
-               status = NT_STATUS_INVALID_PARAMETER;
-               goto out;
-       }
-       ok = dom_sid_parse("S-1-5-21-0-0-0", tmp_sid2);
-       if (!ok) {
-               return NT_STATUS_INTERNAL_ERROR;
-       }
-       ok = !dom_sid_equal(&td->security_identifier, tmp_sid2);
+       ok = dom_sid_is_valid_account_domain(&td->security_identifier);
        if (!ok) {
                status = NT_STATUS_INVALID_PARAMETER;
                goto out;
@@ -3741,7 +3661,8 @@ static NTSTATUS pdb_samba_dsdb_enum_trusted_domains(struct pdb_methods *m,
                domains[di++] = d;
        }
 
-       talloc_realloc(domains, domains, struct pdb_trusted_domain *, di);
+       domains = talloc_realloc(domains, domains, struct pdb_trusted_domain *,
+                                di);
        *_domains = talloc_move(mem_ctx, &domains);
        *_num_domains = di;
        TALLOC_FREE(tmp_ctx);
@@ -3925,8 +3846,11 @@ static NTSTATUS pdb_init_samba_dsdb(struct pdb_methods **pdb_method,
                                state->ev,
                                state->lp_ctx,
                                system_session(state->lp_ctx),
-                               0, location,
-                               &state->ldb, &errstring);
+                               0,
+                               location,
+                               NULL,
+                               &state->ldb,
+                               &errstring);
 
        if (!state->ldb) {
                DEBUG(0, ("samdb_connect failed: %s: %s\n",