s3-netapi: Fix Coverity #670: FORWARD_NULL.
[ira/wip.git] / source3 / lib / netapi / user.c
index fcb87b77befc30490bb0adf70a0474ffc03d5314..e23587d6aa4b6f826569dfaed6a3b41e8f0aa175 100644 (file)
@@ -46,7 +46,7 @@ static void convert_USER_INFO_X_to_samr_user_info21(struct USER_INFO_X *infoX,
                fields_present |= SAMR_FIELD_ACCOUNT_NAME;
        }
        if (infoX->usriX_password) {
-               fields_present |= SAMR_FIELD_PASSWORD;
+               fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
        }
        if (infoX->usriX_flags) {
                fields_present |= SAMR_FIELD_ACCT_FLAGS;
@@ -91,35 +91,41 @@ static void convert_USER_INFO_X_to_samr_user_info21(struct USER_INFO_X *infoX,
        unix_to_nt_time_abs(&password_age, infoX->usriX_password_age);
 
        /* TODO: infoX->usriX_priv */
-       init_samr_user_info21(info21,
-                             0,
-                             0,
-                             0,
-                             0,
-                             0,
-                             password_age,
-                             infoX->usriX_name,
-                             infoX->usriX_full_name,
-                             infoX->usriX_home_dir,
-                             infoX->usriX_home_dir_drive,
-                             infoX->usriX_script_path,
-                             infoX->usriX_profile,
-                             infoX->usriX_comment,
-                             infoX->usriX_workstations,
-                             infoX->usriX_usr_comment,
-                             &zero_parameters,
-                             infoX->usriX_user_id,
-                             infoX->usriX_primary_group_id,
-                             infoX->usriX_flags,
-                             fields_present,
-                             zero_logon_hours,
-                             infoX->usriX_bad_pw_count,
-                             infoX->usriX_num_logons,
-                             infoX->usriX_country_code,
-                             infoX->usriX_code_page,
-                             0,
-                             0,
-                             infoX->usriX_password_expired);
+
+       info21->last_logon              = 0;
+       info21->last_logoff             = 0;
+       info21->last_password_change    = 0;
+       info21->acct_expiry             = 0;
+       info21->allow_password_change   = 0;
+       info21->force_password_change   = 0;
+       info21->account_name.string     = infoX->usriX_name;
+       info21->full_name.string        = infoX->usriX_full_name;
+       info21->home_directory.string   = infoX->usriX_home_dir;
+       info21->home_drive.string       = infoX->usriX_home_dir_drive;
+       info21->logon_script.string     = infoX->usriX_script_path;
+       info21->profile_path.string     = infoX->usriX_profile;
+       info21->description.string      = infoX->usriX_comment;
+       info21->workstations.string     = infoX->usriX_workstations;
+       info21->comment.string          = infoX->usriX_usr_comment;
+       info21->parameters              = zero_parameters;
+       info21->lm_owf_password         = zero_parameters;
+       info21->nt_owf_password         = zero_parameters;
+       info21->unknown3.string         = NULL;
+       info21->buf_count               = 0;
+       info21->buffer                  = NULL;
+       info21->rid                     = infoX->usriX_user_id;
+       info21->primary_gid             = infoX->usriX_primary_group_id;
+       info21->acct_flags              = infoX->usriX_flags;
+       info21->fields_present          = fields_present;
+       info21->logon_hours             = zero_logon_hours;
+       info21->bad_password_count      = infoX->usriX_bad_pw_count;
+       info21->logon_count             = infoX->usriX_num_logons;
+       info21->country_code            = infoX->usriX_country_code;
+       info21->code_page               = infoX->usriX_code_page;
+       info21->lm_password_set         = 0;
+       info21->nt_password_set         = 0;
+       info21->password_expired        = infoX->usriX_password_expired;
+       info21->unknown4                = 0;
 }
 
 /****************************************************************
@@ -343,11 +349,10 @@ static NTSTATUS set_user_info_USER_INFO_X(TALLOC_CTX *ctx,
 WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
                    struct NetUserAdd *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, domain_handle, user_handle;
+       struct policy_handle connect_handle, domain_handle, user_handle;
        struct lsa_String lsa_account_name;
        struct dom_sid2 *domain_sid = NULL;
        union samr_UserInfo *user_info = NULL;
@@ -377,7 +382,6 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -391,7 +395,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
                                          SAMR_DOMAIN_ACCESS_CREATE_USER |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -446,7 +450,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
        uX.usriX_flags |= ACB_NORMAL;
 
        status = set_user_info_USER_INFO_X(ctx, pipe_cli,
-                                          &cli->user_session_key,
+                                          &pipe_cli->auth->user_session_key,
                                           &user_handle,
                                           &uX);
        if (!NT_STATUS_IS_OK(status)) {
@@ -462,10 +466,6 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
                               &user_handle);
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&user_handle)) {
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
        }
@@ -493,11 +493,10 @@ WERROR NetUserAdd_l(struct libnetapi_ctx *ctx,
 WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
                    struct NetUserDel *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
-       POLICY_HND connect_handle, builtin_handle, domain_handle, user_handle;
+       struct policy_handle connect_handle, builtin_handle, domain_handle, user_handle;
        struct lsa_String lsa_account_name;
        struct samr_Ids user_rids, name_types;
        struct dom_sid2 *domain_sid = NULL;
@@ -510,7 +509,6 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
 
        if (!W_ERROR_IS_OK(werr)) {
@@ -519,7 +517,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -553,7 +551,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
                                      &domain_handle,
-                                     STD_RIGHT_DELETE_ACCESS,
+                                     SEC_STD_DELETE,
                                      user_rids.ids[0],
                                      &user_handle);
        if (!NT_STATUS_IS_OK(status)) {
@@ -581,10 +579,6 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&user_handle)) {
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
        }
@@ -776,7 +770,7 @@ static uint32_t samr_acb_flags_to_netapi_flags(uint32_t acb)
 {
        uint32_t fl = UF_SCRIPT; /* god knows why */
 
-       fl |= ads_acb2uf(acb);
+       fl |= ds_acb2uf(acb);
 
        return fl;
 }
@@ -1182,7 +1176,6 @@ static NTSTATUS libnetapi_samr_lookup_user_map_USER_INFO(TALLOC_CTX *mem_ctx,
 WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
                     struct NetUserEnum *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle;
        struct dom_sid2 *domain_sid = NULL;
@@ -1223,7 +1216,6 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1231,7 +1223,7 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
                                                  SAMR_ACCESS_ENUM_DOMAINS |
-                                                 SAMR_ACCESS_OPEN_DOMAIN,
+                                                 SAMR_ACCESS_LOOKUP_DOMAIN,
                                                  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
                                                  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                                  &connect_handle,
@@ -1242,7 +1234,7 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
                                          SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1304,10 +1296,6 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
        }
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        /* if last query */
        if (NT_STATUS_IS_OK(status) ||
            NT_STATUS_IS_ERR(status)) {
@@ -1486,10 +1474,10 @@ static WERROR convert_samr_dispinfo_to_NET_DISPLAY(TALLOC_CTX *mem_ctx,
                                                                          entries_read,
                                                                          buffer);
                default:
-                       return WERR_UNKNOWN_LEVEL;
+                       break;
        }
 
-       return WERR_OK;
+       return WERR_UNKNOWN_LEVEL;
 }
 
 /****************************************************************
@@ -1498,7 +1486,6 @@ static WERROR convert_samr_dispinfo_to_NET_DISPLAY(TALLOC_CTX *mem_ctx,
 WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
                                    struct NetQueryDisplayInformation *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle;
        struct dom_sid2 *domain_sid = NULL;
@@ -1510,6 +1497,9 @@ WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
 
        NTSTATUS status = NT_STATUS_OK;
        WERROR werr;
+       WERROR werr_tmp;
+
+       *r->out.entries_read = 0;
 
        ZERO_STRUCT(connect_handle);
        ZERO_STRUCT(domain_handle);
@@ -1525,7 +1515,6 @@ WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1533,7 +1522,7 @@ WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
                                          SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1554,20 +1543,19 @@ WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
                                               &total_size,
                                               &returned_size,
                                               &info);
-       if (!NT_STATUS_IS_OK(status)) {
-               werr = ntstatus_to_werror(status);
+       werr = ntstatus_to_werror(status);
+       if (NT_STATUS_IS_ERR(status)) {
                goto done;
        }
 
-       werr = convert_samr_dispinfo_to_NET_DISPLAY(ctx, &info,
-                                                   r->in.level,
-                                                   r->out.entries_read,
-                                                   r->out.buffer);
- done:
-       if (!cli) {
-               return werr;
+       werr_tmp = convert_samr_dispinfo_to_NET_DISPLAY(ctx, &info,
+                                                       r->in.level,
+                                                       r->out.entries_read,
+                                                       r->out.buffer);
+       if (!W_ERROR_IS_OK(werr_tmp)) {
+               werr = werr_tmp;
        }
-
+ done:
        /* if last query */
        if (NT_STATUS_IS_OK(status) ||
            NT_STATUS_IS_ERR(status)) {
@@ -1616,7 +1604,6 @@ WERROR NetUserChangePassword_l(struct libnetapi_ctx *ctx,
 WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
                        struct NetUserGetInfo *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
@@ -1654,7 +1641,6 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1662,7 +1648,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -1673,7 +1659,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
                                                  SAMR_ACCESS_ENUM_DOMAINS |
-                                                 SAMR_ACCESS_OPEN_DOMAIN,
+                                                 SAMR_ACCESS_LOOKUP_DOMAIN,
                                                  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
                                                  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                                  &connect_handle,
@@ -1710,10 +1696,6 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
        }
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&user_handle)) {
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
        }
@@ -1741,7 +1723,6 @@ WERROR NetUserGetInfo_l(struct libnetapi_ctx *ctx,
 WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
                        struct NetUserSetInfo *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
@@ -1765,6 +1746,8 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
        switch (r->in.level) {
                case 0:
+                       user_mask = SAMR_USER_ACCESS_SET_ATTRIBUTES;
+                       break;
                case 1003:
                        user_mask = SAMR_USER_ACCESS_SET_PASSWORD;
                        break;
@@ -1812,7 +1795,6 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -1820,7 +1802,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
@@ -1832,7 +1814,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
                                                  SAMR_ACCESS_ENUM_DOMAINS |
-                                                 SAMR_ACCESS_OPEN_DOMAIN,
+                                                 SAMR_ACCESS_LOOKUP_DOMAIN,
                                                  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
                                                  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                                  &connect_handle,
@@ -1871,7 +1853,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
        }
 
        status = set_user_info_USER_INFO_X(ctx, pipe_cli,
-                                          &cli->user_session_key,
+                                          &pipe_cli->auth->user_session_key,
                                           &user_handle,
                                           &uX);
        if (!NT_STATUS_IS_OK(status)) {
@@ -1882,11 +1864,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
-       if (is_valid_policy_hnd(&user_handle)) {
+       if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
        }
 
@@ -2203,7 +2181,6 @@ static NTSTATUS query_USER_MODALS_INFO_to_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetUserModalsGet_r(struct libnetapi_ctx *ctx,
                          struct NetUserModalsGet *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
@@ -2238,7 +2215,6 @@ WERROR NetUserModalsGet_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -2246,7 +2222,7 @@ WERROR NetUserModalsGet_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          access_mask,
                                          &connect_handle,
                                          &domain_handle,
@@ -2272,10 +2248,6 @@ WERROR NetUserModalsGet_r(struct libnetapi_ctx *ctx,
        }
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (ctx->disable_policy_handle_cache) {
                libnetapi_samr_close_domain_handle(ctx, &domain_handle);
                libnetapi_samr_close_connect_handle(ctx, &connect_handle);
@@ -2674,7 +2646,6 @@ static NTSTATUS set_USER_MODALS_INFO_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetUserModalsSet_r(struct libnetapi_ctx *ctx,
                          struct NetUserModalsSet *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        NTSTATUS status;
        WERROR werr;
@@ -2722,7 +2693,6 @@ WERROR NetUserModalsSet_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -2730,7 +2700,7 @@ WERROR NetUserModalsSet_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          access_mask,
                                          &connect_handle,
                                          &domain_handle,
@@ -2751,10 +2721,6 @@ WERROR NetUserModalsSet_r(struct libnetapi_ctx *ctx,
        }
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (ctx->disable_policy_handle_cache) {
                libnetapi_samr_close_domain_handle(ctx, &domain_handle);
                libnetapi_samr_close_connect_handle(ctx, &connect_handle);
@@ -2787,15 +2753,23 @@ NTSTATUS add_GROUP_USERS_INFO_X_buffer(TALLOC_CTX *mem_ctx,
 
        switch (level) {
                case 0:
-                       u0.grui0_name = talloc_strdup(mem_ctx, group_name);
-                       NT_STATUS_HAVE_NO_MEMORY(u0.grui0_name);
+                       if (group_name) {
+                               u0.grui0_name = talloc_strdup(mem_ctx, group_name);
+                               NT_STATUS_HAVE_NO_MEMORY(u0.grui0_name);
+                       } else {
+                               u0.grui0_name = NULL;
+                       }
 
                        ADD_TO_ARRAY(mem_ctx, struct GROUP_USERS_INFO_0, u0,
                                     (struct GROUP_USERS_INFO_0 **)buffer, num_entries);
                        break;
                case 1:
-                       u1.grui1_name = talloc_strdup(mem_ctx, group_name);
-                       NT_STATUS_HAVE_NO_MEMORY(u1.grui1_name);
+                       if (group_name) {
+                               u1.grui1_name = talloc_strdup(mem_ctx, group_name);
+                               NT_STATUS_HAVE_NO_MEMORY(u1.grui1_name);
+                       } else {
+                               u1.grui1_name = NULL;
+                       }
 
                        u1.grui1_attributes = attributes;
 
@@ -2815,7 +2789,6 @@ NTSTATUS add_GROUP_USERS_INFO_X_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
                          struct NetUserGetGroups *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle, domain_handle, user_handle;
        struct lsa_String lsa_account_name;
@@ -2841,6 +2814,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 
        *r->out.buffer = NULL;
        *r->out.entries_read = 0;
+       *r->out.total_entries = 0;
 
        switch (r->in.level) {
                case 0:
@@ -2852,7 +2826,6 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -2860,7 +2833,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -2916,12 +2889,13 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
                                        rids,
                                        &names,
                                        &types);
-       if (!NT_STATUS_IS_OK(status)) {
+       if (!NT_STATUS_IS_OK(status) &&
+           !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
                werr = ntstatus_to_werror(status);
                goto done;
        }
 
-       for (i=0; i < rid_array->count; i++) {
+       for (i=0; i < names.count; i++) {
                status = add_GROUP_USERS_INFO_X_buffer(ctx,
                                                       r->in.level,
                                                       names.names[i].string,
@@ -2934,18 +2908,10 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
                }
        }
 
-       if (r->out.entries_read) {
-               *r->out.entries_read = entries_read;
-       }
-       if (r->out.total_entries) {
-               *r->out.total_entries = entries_read;
-       }
+       *r->out.entries_read = entries_read;
+       *r->out.total_entries = entries_read;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (ctx->disable_policy_handle_cache) {
                libnetapi_samr_close_domain_handle(ctx, &domain_handle);
                libnetapi_samr_close_connect_handle(ctx, &connect_handle);
@@ -2969,7 +2935,6 @@ WERROR NetUserGetGroups_l(struct libnetapi_ctx *ctx,
 WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
                          struct NetUserSetGroups *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle, domain_handle, user_handle, group_handle;
        struct lsa_String lsa_account_name;
@@ -3012,7 +2977,6 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -3020,7 +2984,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                          &connect_handle,
                                          &domain_handle,
@@ -3199,10 +3163,6 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
        werr = WERR_OK;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (is_valid_policy_hnd(&group_handle)) {
                rpccli_samr_Close(pipe_cli, ctx, &group_handle);
        }
@@ -3256,7 +3216,6 @@ static NTSTATUS add_LOCALGROUP_USERS_INFO_X_buffer(TALLOC_CTX *mem_ctx,
 WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
                               struct NetUserGetLocalGroups *r)
 {
-       struct cli_state *cli = NULL;
        struct rpc_pipe_client *pipe_cli = NULL;
        struct policy_handle connect_handle, domain_handle, user_handle,
        builtin_handle;
@@ -3288,6 +3247,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
        *r->out.buffer = NULL;
        *r->out.entries_read = 0;
+       *r->out.total_entries = 0;
 
        switch (r->in.level) {
                case 0:
@@ -3299,7 +3259,6 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_open_pipe(ctx, r->in.server_name,
                                   &ndr_table_samr.syntax_id,
-                                  &cli,
                                   &pipe_cli);
        if (!W_ERROR_IS_OK(werr)) {
                goto done;
@@ -3307,7 +3266,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_domain(ctx, pipe_cli,
                                          SAMR_ACCESS_ENUM_DOMAINS |
-                                         SAMR_ACCESS_OPEN_DOMAIN,
+                                         SAMR_ACCESS_LOOKUP_DOMAIN,
                                          SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
                                          SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                          &connect_handle,
@@ -3319,7 +3278,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
        werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
                                                  SAMR_ACCESS_ENUM_DOMAINS |
-                                                 SAMR_ACCESS_OPEN_DOMAIN,
+                                                 SAMR_ACCESS_LOOKUP_DOMAIN,
                                                  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
                                                  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                                  &connect_handle,
@@ -3449,18 +3408,10 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
                }
        }
 
-       if (r->out.entries_read) {
-               *r->out.entries_read = entries_read;
-       }
-       if (r->out.total_entries) {
-               *r->out.total_entries = entries_read;
-       }
+       *r->out.entries_read = entries_read;
+       *r->out.total_entries = entries_read;
 
  done:
-       if (!cli) {
-               return werr;
-       }
-
        if (ctx->disable_policy_handle_cache) {
                libnetapi_samr_close_domain_handle(ctx, &domain_handle);
                libnetapi_samr_close_connect_handle(ctx, &connect_handle);