r19598: Ahead of a merge to current lorikeet-heimdal:

Break up auth/auth.h not to include the world.

Add credentials_krb5.h with the kerberos dependent prototypes.

Andrew Bartlett
(This used to be commit 2b569c42e0fbb596ea82484d0e1cb22e193037b9)

76 files changed, 163 insertions, 65 deletions

diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index badfe14762..4c172af1fe 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -22,10 +22,7 @@
 #ifndef _SAMBA_AUTH_H
 #define _SAMBA_AUTH_H
 
-#include "libcli/auth/credentials.h"
-#include "auth/gensec/gensec.h"
-#include "auth/gensec/spnego.h"
-#include "lib/ldb/include/ldb.h"
+union netr_Validation;
 
 /* modules can use the following to determine if the interface has changed
  * please increment the version number after each interface change
diff --git a/source4/auth/auth_developer.c b/source4/auth/auth_developer.c
index 76044d4361..f3a984ce30 100644
--- a/source4/auth/auth_developer.c
+++ b/source4/auth/auth_developer.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "auth/auth.h"
 #include "libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_samr.h"
 
 static NTSTATUS name_to_ntstatus_want_check(struct auth_method_context *ctx,
 			      		    TALLOC_CTX *mem_ctx,
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 3d28b88446..8bfcab1eaf 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -21,8 +21,10 @@
 */
 
 #include "includes.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "system/time.h"
 #include "db_wrap.h"
+#include "lib/ldb/include/ldb.h"
 #include "auth/auth.h"
 #include "auth/auth_sam.h"
 #include "dsdb/samdb/samdb.h"
diff --git a/source4/auth/auth_sam_reply.c b/source4/auth/auth_sam_reply.c
index 0ea501d585..b6e740a128 100644
--- a/source4/auth/auth_sam_reply.c
+++ b/source4/auth/auth_sam_reply.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "auth/auth.h"
 #include "libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 
 NTSTATUS auth_convert_server_info_sambaseinfo(TALLOC_CTX *mem_ctx, 
 					      struct auth_serversupplied_info *server_info, 
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 7d24028083..a3f51846b6 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -27,6 +27,8 @@
 #include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
 #include "dsdb/samdb/samdb.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 /* this default function can be used by mostly all backends
  * which don't want to set a challenge
diff --git a/source4/auth/config.mk b/source4/auth/config.mk
index 968072b918..b34dbac21e 100644
--- a/source4/auth/config.mk
+++ b/source4/auth/config.mk
@@ -74,6 +74,6 @@ OBJ_FILES = \
 		auth.o \
 		auth_util.o \
 		auth_simple.o
-PUBLIC_DEPENDENCIES = LIBSECURITY process_model SAMDB
+PUBLIC_DEPENDENCIES = LIBSECURITY process_model SAMDB CREDENTIALS
 # End SUBSYSTEM auth
 #######################
diff --git a/source4/auth/credentials/config.mk b/source4/auth/credentials/config.mk
index aa1fdf896d..5bf7aa891f 100644
--- a/source4/auth/credentials/config.mk
+++ b/source4/auth/credentials/config.mk
@@ -5,10 +5,20 @@ PUBLIC_PROTO_HEADER = credentials_proto.h
 PUBLIC_HEADERS = credentials.h
 OBJ_FILES = credentials.o \
 		credentials_files.o \
-		credentials_krb5.o \
 		credentials_ntlm.o
 PUBLIC_DEPENDENCIES = \
-		LIBCLI_AUTH SECRETS LIBCRYPTO HEIMDAL_GSSAPI
+		LIBCLI_AUTH SECRETS LIBCRYPTO
+PRIVATE_DEPENDENCIES = CREDENTIALS_KRB5
 # End SUBSYSTEM CREDENTIALS
 #################################
 
+#################################
+# Start SUBSYSTEM CREDENTIALS
+[SUBSYSTEM::CREDENTIALS_KRB5]
+PUBLIC_PROTO_HEADER = credentials_krb5_proto.h
+PUBLIC_HEADERS = credentials_krb5.h
+OBJ_FILES = credentials_krb5.o
+PUBLIC_DEPENDENCIES = \
+		HEIMDAL_GSSAPI
+# End SUBSYSTEM CREDENTIALS
+#################################
diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index caaef3e0c2..d4db0a0180 100644
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -24,7 +24,8 @@
 
 #include "includes.h"
 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
-#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 #include "libcli/auth/libcli_auth.h"
 
 /**
diff --git a/source4/auth/credentials/credentials_files.c b/source4/auth/credentials/credentials_files.c
index 53a6f39cd4..ecd89d2259 100644
--- a/source4/auth/credentials/credentials_files.c
+++ b/source4/auth/credentials/credentials_files.c
@@ -29,6 +29,7 @@
 #include "system/filesys.h"
 #include "db_wrap.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 /**
  * Read a file descriptor, and parse it for a password (eg from a file or stdin)
diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index 7d53caddfa..f0305fd360 100644
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -25,6 +25,8 @@
 #include "includes.h"
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 int cli_credentials_get_krb5_context(struct cli_credentials *cred, 
 				     struct smb_krb5_context **smb_krb5_context) 
@@ -333,9 +335,9 @@ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
    to the credentials system.
 */
 
- int cli_credentials_set_client_gss_creds(struct cli_credentials *cred, 
-					  gss_cred_id_t gssapi_cred,
-					  enum credentials_obtained obtained) 
+int cli_credentials_set_client_gss_creds(struct cli_credentials *cred, 
+					 gss_cred_id_t gssapi_cred,
+					 enum credentials_obtained obtained) 
 {
 	int ret;
 	OM_uint32 maj_stat, min_stat;
diff --git a/source4/auth/credentials/credentials_krb5.h b/source4/auth/credentials/credentials_krb5.h
new file mode 100644
index 0000000000..2bd38af5c7
--- /dev/null
+++ b/source4/auth/credentials/credentials_krb5.h
@@ -0,0 +1,34 @@
+/* 
+   samba -- Unix SMB/CIFS implementation.
+
+   Client credentials structure
+
+   Copyright (C) Jelmer Vernooij 2004-2006
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+struct EncryptionKey;
+
+#include "heimdal/lib/gssapi/gssapi.h"
+
+struct ccache_container;
+
+struct gssapi_creds_container {
+	gss_cred_id_t creds;
+};
+
+#include "auth/credentials/credentials_krb5_proto.h"
diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c
index 23838da888..5317032683 100644
--- a/source4/auth/credentials/credentials_ntlm.c
+++ b/source4/auth/credentials/credentials_ntlm.c
@@ -26,6 +26,7 @@
 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
 #include "lib/crypto/crypto.h"
 #include "libcli/auth/libcli_auth.h"
+#include "auth/credentials/credentials.h"
 
 void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
 					      const char **username, 
diff --git a/source4/auth/gensec/config.mk b/source4/auth/gensec/config.mk
index 84947785db..a395dd205f 100644
--- a/source4/auth/gensec/config.mk
+++ b/source4/auth/gensec/config.mk
@@ -18,7 +18,7 @@ PUBLIC_DEPENDENCIES = \
 SUBSYSTEM = gensec
 INIT_FUNCTION = gensec_krb5_init
 OBJ_FILES = gensec_krb5.o 
-PUBLIC_DEPENDENCIES = KERBEROS auth auth_sam
+PUBLIC_DEPENDENCIES = CREDENTIALS_KRB5 KERBEROS auth auth_sam
 # End MODULE gensec_krb5
 ################################################
 
@@ -28,7 +28,7 @@ PUBLIC_DEPENDENCIES = KERBEROS auth auth_sam
 SUBSYSTEM = gensec
 INIT_FUNCTION = gensec_gssapi_init
 OBJ_FILES = gensec_gssapi.o 
-PUBLIC_DEPENDENCIES = KERBEROS auth HEIMDAL_GSSAPI
+PUBLIC_DEPENDENCIES = CREDENTIALS_KRB5 KERBEROS auth HEIMDAL_GSSAPI
 # End MODULE gensec_gssapi
 ################################################
 
@@ -38,7 +38,7 @@ PUBLIC_DEPENDENCIES = KERBEROS auth HEIMDAL_GSSAPI
 SUBSYSTEM = gensec
 INIT_FUNCTION = gensec_sasl_init
 OBJ_FILES = cyrus_sasl.o 
-PUBLIC_DEPENDENCIES = SASL auth
+PUBLIC_DEPENDENCIES = CREDENTIALS SASL auth
 # End MODULE cyrus_sasl
 ################################################
 
@@ -49,6 +49,7 @@ SUBSYSTEM = gensec
 INIT_FUNCTION = gensec_spnego_init
 PRIVATE_PROTO_HEADER = spnego_proto.h
 PRIVATE_DEPENDENCIES = ASN1_UTIL GENSEC_SOCKET
+PUBLIC_DEPENDENCIES = CREDENTIALS
 OBJ_FILES = spnego.o \
 			spnego_parse.o
 # End MODULE gensec_spnego
@@ -62,7 +63,7 @@ PRIVATE_PROTO_HEADER = schannel_proto.h
 INIT_FUNCTION = gensec_schannel_init
 OBJ_FILES = schannel.o \
 			schannel_sign.o
-PUBLIC_DEPENDENCIES = auth SCHANNELDB NDR_SCHANNEL
+PUBLIC_DEPENDENCIES = auth SCHANNELDB NDR_SCHANNEL CREDENTIALS
 OUTPUT_TYPE = INTEGRATED
 # End MODULE gensec_schannel
 ################################################
diff --git a/source4/auth/gensec/cyrus_sasl.c b/source4/auth/gensec/cyrus_sasl.c
index 17a0162e8d..c0dd314d3d 100644
--- a/source4/auth/gensec/cyrus_sasl.c
+++ b/source4/auth/gensec/cyrus_sasl.c
@@ -22,6 +22,8 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "lib/socket/socket.h"
 #include <sasl/sasl.h>
 
diff --git a/source4/auth/gensec/gensec.c b/source4/auth/gensec/gensec.c
index 619cf7c350..8c97a871ad 100644
--- a/source4/auth/gensec/gensec.c
+++ b/source4/auth/gensec/gensec.c
@@ -26,6 +26,8 @@
 #include "lib/events/events.h"
 #include "build.h"
 #include "librpc/rpc/dcerpc.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 
 /* the list of currently registered GENSEC backends */
 static struct gensec_security_ops **generic_security_ops;
diff --git a/source4/auth/gensec/gensec.h b/source4/auth/gensec/gensec.h
index 97d9577d83..c70424800c 100644
--- a/source4/auth/gensec/gensec.h
+++ b/source4/auth/gensec/gensec.h
@@ -42,6 +42,8 @@ enum gensec_priority {
 	GENSEC_OTHER = 0
 };
 
+enum credentials_use_kerberos;
+
 struct gensec_security;
 struct gensec_target {
 	const char *principal;
@@ -167,7 +169,6 @@ struct gensec_critical_sizes {
 	int sizeof_gensec_security;
 };
 
-#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec_proto.h"
 
 #endif /* __GENSEC_H__ */
diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index 3695454c76..d84f3dedf5 100644
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -34,6 +34,9 @@
 #include "system/network.h"
 #include "lib/socket/socket.h"
 #include "librpc/rpc/dcerpc.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "auth/gensec/gensec.h"
 
 enum GENSEC_KRB5_STATE {
 	GENSEC_KRB5_SERVER_START,
diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 9bcb307548..18c6222e13 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -24,6 +24,8 @@
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_schannel.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/gensec/schannel.h"
 #include "auth/gensec/schannel_state.h"
 #include "auth/gensec/schannel_proto.h"
diff --git a/source4/auth/gensec/schannel.h b/source4/auth/gensec/schannel.h
index c109387c7c..4a05f8ab1a 100644
--- a/source4/auth/gensec/schannel.h
+++ b/source4/auth/gensec/schannel.h
@@ -21,6 +21,8 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
+#include "libcli/auth/credentials.h"
+
 enum schannel_position {
 	SCHANNEL_STATE_START = 0,
 	SCHANNEL_STATE_UPDATE_1
diff --git a/source4/auth/gensec/schannel_sign.c b/source4/auth/gensec/schannel_sign.c
index b4549ddefd..ad424f0299 100644
--- a/source4/auth/gensec/schannel_sign.c
+++ b/source4/auth/gensec/schannel_sign.c
@@ -25,6 +25,8 @@
 #include "lib/crypto/crypto.h"
 #include "auth/auth.h"
 #include "auth/gensec/schannel.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 
 #define NETSEC_SIGN_SIGNATURE { 0x77, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00 }
 #define NETSEC_SEAL_SIGNATURE { 0x77, 0x00, 0x7a, 0x00, 0xff, 0xff, 0x00, 0x00 }
diff --git a/source4/auth/gensec/schannel_state.c b/source4/auth/gensec/schannel_state.c
index e9c81f370c..3c9ff64147 100644
--- a/source4/auth/gensec/schannel_state.c
+++ b/source4/auth/gensec/schannel_state.c
@@ -21,11 +21,12 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "dsdb/samdb/samdb.h"
 #include "db_wrap.h"
+#include "libcli/auth/libcli_auth.h"
+#include "auth/auth.h"
 
 /**
   connect to the schannel ldb
diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index f989455a72..c647ba5333 100644
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -23,10 +23,10 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
-#include "auth/gensec/spnego_proto.h"
+#include "auth/gensec/spnego.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
-#include "lib/socket/socket.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/gensec/socket.h"
 
 enum spnego_state_position {
diff --git a/source4/auth/gensec/spnego.h b/source4/auth/gensec/spnego.h
index 1064370146..78afbe0107 100644
--- a/source4/auth/gensec/spnego.h
+++ b/source4/auth/gensec/spnego.h
@@ -21,9 +21,6 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-#ifndef SAMBA_SPNEGO_H
-#define SAMBA_SPNEGO_H
-
 #define SPNEGO_DELEG_FLAG    0x01
 #define SPNEGO_MUTUAL_FLAG   0x02
 #define SPNEGO_REPLAY_FLAG   0x04
@@ -66,4 +63,4 @@ enum spnego_message_type {
 	SPNEGO_NEG_TOKEN_TARG = 1,
 };
 
-#endif
+#include "auth/gensec/spnego_proto.h"
diff --git a/source4/auth/gensec/spnego_parse.c b/source4/auth/gensec/spnego_parse.c
index 8dde78da48..66e24bdbe5 100644
--- a/source4/auth/gensec/spnego_parse.c
+++ b/source4/auth/gensec/spnego_parse.c
@@ -22,7 +22,8 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
+#include "auth/gensec/spnego.h"
+#include "auth/gensec/gensec.h"
 #include "libcli/util/asn_1.h"
 
 static BOOL read_negTokenInit(struct asn1_data *asn1, struct spnego_negTokenInit *token)
diff --git a/source4/auth/kerberos/config.mk b/source4/auth/kerberos/config.mk
index f65ebec63a..689130d567 100644
--- a/source4/auth/kerberos/config.mk
+++ b/source4/auth/kerberos/config.mk
@@ -10,6 +10,6 @@ OBJ_FILES = kerberos.o \
 			gssapi_parse.o \
 			krb5_init_context.o
 PUBLIC_DEPENDENCIES = HEIMDAL_KRB5 NDR_KRB5PAC samba-socket LIBCLI_RESOLVE
-PRIVATE_DEPENDENCIES = ASN1_UTIL HEIMDAL_ROKEN_ADDRINFO auth_sam
+PRIVATE_DEPENDENCIES = ASN1_UTIL HEIMDAL_ROKEN_ADDRINFO auth_sam CREDENTIALS_KRB5
 # End SUBSYSTEM KERBEROS
 #################################
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 3e724c29a5..b82dd3f75a 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -21,23 +21,17 @@
 
 #if defined(HAVE_KRB5)
 
-#include "auth/credentials/credentials.h"
 #include "auth/kerberos/krb5_init_context.h"
 #include "librpc/gen_ndr/krb5pac.h"
 
 struct auth_serversupplied_info;
+struct cli_credentials;
 
 struct ccache_container {
 	struct smb_krb5_context *smb_krb5_context;
 	krb5_ccache ccache;
 };
 
-
-struct gssapi_creds_container {
-	gss_cred_id_t creds;
-};
-
-
 struct keytab_container {
 	struct smb_krb5_context *smb_krb5_context;
 	krb5_keytab keytab;
@@ -159,10 +153,6 @@ NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
 				     time_t tgs_authtime,
 				     DATA_BLOB *pac);
 
- int cli_credentials_set_client_gss_creds(struct cli_credentials *cred, 
-					  gss_cred_id_t gssapi_cred,
-					  enum credentials_obtained obtained); 
-
 #include "auth/kerberos/proto.h"
 
 #endif /* HAVE_KRB5 */
diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 0be0ebaad7..dcfe16c896 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -28,7 +28,7 @@
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
-#include "auth/auth.h"
+#include "lib/ldb/include/ldb.h"
 #include "auth/auth_sam.h"
 
 static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx, 
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index 02d5cf8a99..66002e2f71 100644
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -25,6 +25,7 @@
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 struct principal_container {
 	struct smb_krb5_context *smb_krb5_context;
diff --git a/source4/auth/kerberos/kerberos_verify.c b/source4/auth/kerberos/kerberos_verify.c
index 29d704b148..2111e22aa3 100644
--- a/source4/auth/kerberos/kerberos_verify.c
+++ b/source4/auth/kerberos/kerberos_verify.c
@@ -26,8 +26,8 @@
 #include "includes.h"
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
-
-#ifdef HAVE_KRB5
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 /**********************************************************************************
  Verify an incoming ticket and parse out the principal name and 
@@ -100,5 +100,3 @@
 
 	return NT_STATUS_OK;
 }
-
-#endif /* HAVE_KRB5 */
diff --git a/source4/auth/ntlmssp/ntlmssp.c b/source4/auth/ntlmssp/ntlmssp.c
index 806532911a..6fbbd7d638 100644
--- a/source4/auth/ntlmssp/ntlmssp.c
+++ b/source4/auth/ntlmssp/ntlmssp.c
@@ -23,10 +23,12 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "auth/ntlmssp/msrpc_parse.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/auth.h"
 
 /**
  * Callbacks for NTLMSSP - for both client and server operating modes
diff --git a/source4/auth/ntlmssp/ntlmssp_client.c b/source4/auth/ntlmssp/ntlmssp_client.c
index 1244c0dfbc..23d96fb90b 100644
--- a/source4/auth/ntlmssp/ntlmssp_client.c
+++ b/source4/auth/ntlmssp/ntlmssp_client.c
@@ -23,11 +23,12 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "auth/ntlmssp/msrpc_parse.h"
 #include "lib/crypto/crypto.h"
 #include "libcli/auth/libcli_auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 
 /*********************************************************************
  Client side NTLMSSP
diff --git a/source4/auth/ntlmssp/ntlmssp_server.c b/source4/auth/ntlmssp/ntlmssp_server.c
index eab5838113..31c2ac63f4 100644
--- a/source4/auth/ntlmssp/ntlmssp_server.c
+++ b/source4/auth/ntlmssp/ntlmssp_server.c
@@ -23,13 +23,15 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "auth/ntlmssp/msrpc_parse.h"
 #include "lib/crypto/crypto.h"
 #include "pstring.h"
 #include "system/filesys.h"
 #include "libcli/auth/libcli_auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/auth.h"
 
 /** 
  * Set a username on an NTLMSSP context - ensures it is talloc()ed 
diff --git a/source4/auth/ntlmssp/ntlmssp_sign.c b/source4/auth/ntlmssp/ntlmssp_sign.c
index 90550f3a14..316bb257ff 100644
--- a/source4/auth/ntlmssp/ntlmssp_sign.c
+++ b/source4/auth/ntlmssp/ntlmssp_sign.c
@@ -25,6 +25,8 @@
 #include "auth/ntlmssp/ntlmssp.h"
 #include "auth/ntlmssp/msrpc_parse.h"
 #include "lib/crypto/crypto.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 
 #define CLI_SIGN "session key to client-to-server signing key magic constant"
 #define CLI_SEAL "session key to client-to-server sealing key magic constant"
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 0284cb9a19..c7f0a74ac9 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -27,6 +27,7 @@
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
 #include "libcli/ldap/ldap.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 
 const char *user_attrs[] = {
 	/* required for the krb5 kdc */
diff --git a/source4/client/client.c b/source4/client/client.c
index 32f39c8571..557767022c 100644
--- a/source4/client/client.c
+++ b/source4/client/client.c
@@ -34,6 +34,7 @@
 #include "system/filesys.h"
 #include "lib/util/dlinklist.h"
 #include "system/readline.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "system/time.h" /* needed by some systems for asctime() */
 #include "libcli/resolve/resolve.h"
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index 5578cdd7d6..f9ef3bc907 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -29,8 +29,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "libcli/security/security.h"
-#include "auth/credentials/credentials.h"
-#include "libcli/auth/proto.h"
+#include "libcli/auth/libcli_auth.h"
 #include "libcli/ldap/ldap.h"
 #include "system/time.h"
 #include "system/filesys.h"
diff --git a/source4/heimdal_build/config.mk b/source4/heimdal_build/config.mk
index ed94b17e55..e955c28fa6 100644
--- a/source4/heimdal_build/config.mk
+++ b/source4/heimdal_build/config.mk
@@ -96,7 +96,7 @@ OBJ_FILES = \
 	../heimdal/lib/gssapi/get_mic.o \
 	../heimdal/lib/gssapi/import_name.o \
 	../heimdal/lib/gssapi/init.o
-PUBLIC_DEPENDENCIES = KERBEROS HEIMDAL_KRB5 
+PUBLIC_DEPENDENCIES = HEIMDAL_KRB5 
 # End SUBSYSTEM HEIMDAL_GSSAPI
 #######################
 
@@ -483,7 +483,7 @@ SO_VERSION = 0
 CFLAGS = -Iheimdal_build
 OBJ_FILES = ../heimdal/lib/vers/print_version.o
 PUBLIC_DEPENDENCIES = \
-		HEIMDAL_GSSAPI HEIMDAL_KRB5 KERBEROS
+		HEIMDAL_GSSAPI HEIMDAL_KRB5
 # End SUBSYSTEM HEIMDAL
 #######################
 
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 827c66b86d..7359fe63c3 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -37,10 +37,12 @@
 #include "kdc.h"
 #include "dsdb/common/flags.h"
 #include "hdb.h"
+#include "krb5_locl.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "librpc/gen_ndr/netlogon.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
 #include "auth/auth_sam.h"
 #include "db_wrap.h"
 #include "dsdb/samdb/samdb.h"
diff --git a/source4/kdc/kpasswdd.c b/source4/kdc/kpasswdd.c
index b98304c12d..0dcbf9833d 100644
--- a/source4/kdc/kpasswdd.c
+++ b/source4/kdc/kpasswdd.c
@@ -31,6 +31,9 @@
 #include "lib/ldb/include/ldb.h"
 #include "heimdal/lib/krb5/krb5_locl.h"
 #include "heimdal/lib/krb5/krb5-private.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
 #include "rpc_server/dcerpc_server.h"
diff --git a/source4/ldap_server/ldap_bind.c b/source4/ldap_server/ldap_bind.c
index 9736def3bf..f88d08e822 100644
--- a/source4/ldap_server/ldap_bind.c
+++ b/source4/ldap_server/ldap_bind.c
@@ -26,6 +26,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "dsdb/samdb/samdb.h"
+#include "auth/gensec/gensec.h"
 #include "auth/gensec/socket.h"
 
 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 89f7bf0bfb..29555b14e1 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -25,6 +25,8 @@
 #include "includes.h"
 #include "lib/events/events.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "librpc/gen_ndr/ndr_samr.h"
 #include "lib/util/dlinklist.h"
 #include "libcli/util/asn_1.h"
 #include "ldap_server/ldap_server.h"
diff --git a/source4/lib/cmdline/config.mk b/source4/lib/cmdline/config.mk
index 2c392865aa..f8502596fa 100644
--- a/source4/lib/cmdline/config.mk
+++ b/source4/lib/cmdline/config.mk
@@ -11,5 +11,5 @@ PUBLIC_DEPENDENCIES = LIBPOPT
 [SUBSYSTEM::POPT_CREDENTIALS]
 PRIVATE_PROTO_HEADER = popt_credentials.h
 OBJ_FILES = popt_credentials.o
-PUBLIC_DEPENDENCIES = CREDENTIALS LIBCMDLINE_CREDENTIALS LIBPOPT
+PUBLIC_DEPENDENCIES = CREDENTIALS_KRB5 LIBCMDLINE_CREDENTIALS LIBPOPT
 
diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c
index 5e9b6e97a5..ab1d11bfbf 100644
--- a/source4/lib/cmdline/popt_credentials.c
+++ b/source4/lib/cmdline/popt_credentials.c
@@ -22,6 +22,8 @@
 #include "includes.h"
 #include "lib/cmdline/popt_common.h"
 #include "lib/cmdline/credentials.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 #include "auth/gensec/gensec.h"
 
 /* Handle command line options:
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index 5a3ccd6977..51ae031cf9 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -49,6 +49,7 @@
 #include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
 
 struct ildb_private {
 	struct ldap_connection *ldap;
diff --git a/source4/lib/ldb/tools/cmdline.c b/source4/lib/ldb/tools/cmdline.c
index 09bb99c096..928519f3bb 100644
--- a/source4/lib/ldb/tools/cmdline.c
+++ b/source4/lib/ldb/tools/cmdline.c
@@ -29,6 +29,7 @@
 #if (_SAMBA_BUILD_ >= 4)
 #include "lib/cmdline/popt_common.h"
 #include "lib/ldb/samba/ldif_handlers.h"
+#include "auth/gensec/gensec.h"
 #include "auth/auth.h"
 #include "db_wrap.h"
 #endif
diff --git a/source4/lib/registry/registry.h b/source4/lib/registry/registry.h
index e5cf7d9111..4c1eb8f39e 100644
--- a/source4/lib/registry/registry.h
+++ b/source4/lib/registry/registry.h
@@ -23,7 +23,6 @@
 #define _REGISTRY_H 
 
 #include "librpc/gen_ndr/security.h"
-#include "auth/credentials/credentials.h"
 
 /* Handles for the predefined keys */
 #define HKEY_CLASSES_ROOT		 0x80000000
@@ -128,6 +127,8 @@ struct hive_operations {
 	WERROR (*del_value)(const struct registry_key *, const char *valname);
 };
 
+struct cli_credentials;
+
 struct registry_hive
 {
 	const struct hive_operations *functions;
diff --git a/source4/lib/replace/system/kerberos.h b/source4/lib/replace/system/kerberos.h
index b24196fc25..1617b96aad 100644
--- a/source4/lib/replace/system/kerberos.h
+++ b/source4/lib/replace/system/kerberos.h
@@ -126,7 +126,6 @@
 #define KRB5_PRINC_REALM_RETURNS_REALM 1
 
 #include "heimdal/lib/krb5/krb5.h"
-#include "heimdal/lib/gssapi/gssapi.h"
 #include "heimdal/lib/com_err/com_err.h"
 #endif
 
diff --git a/source4/libcli/auth/libcli_auth.h b/source4/libcli/auth/libcli_auth.h
index f8f07e8337..e6e00568ff 100644
--- a/source4/libcli/auth/libcli_auth.h
+++ b/source4/libcli/auth/libcli_auth.h
@@ -19,7 +19,7 @@
 #define __LIBCLI_AUTH_H__
 
 #include "librpc/gen_ndr/netlogon.h"
-#include "auth/credentials/credentials.h"
+#include "libcli/auth/credentials.h"
 #include "libcli/auth/proto.h"
 
 #endif /* __LIBCLI_AUTH_H__ */
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index 46f3336fd1..a64f41dbf4 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -36,7 +36,7 @@ OBJ_FILES = \
 	smb_composite/fetchfile.o \
 	smb_composite/appendacl.o \
 	smb_composite/fsinfo.o 
-PUBLIC_DEPENDENCIES = LIBCLI_COMPOSITE
+PUBLIC_DEPENDENCIES = LIBCLI_COMPOSITE CREDENTIALS
 
 [SUBSYSTEM::NDR_NBT_BUF]
 PRIVATE_PROTO_HEADER = nbt/nbtname.h
diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index f617cbe102..c4c731e4f5 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -26,7 +26,7 @@
 #include "libcli/ldap/ldap.h"
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
-#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
 #include "auth/gensec/socket.h"
 #include "lib/stream/packet.h"
 
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index d264f588da..8528ac2ef7 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -27,6 +27,8 @@
 #include "libcli/smb_composite/smb_composite.h"
 #include "libcli/auth/libcli_auth.h"
 #include "auth/auth.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
 #include "version.h"
 
 struct sesssetup_state {
diff --git a/source4/libnet/libnet_join.c b/source4/libnet/libnet_join.c
index b0907c5461..01872eb7fc 100644
--- a/source4/libnet/libnet_join.c
+++ b/source4/libnet/libnet_join.c
@@ -30,6 +30,7 @@
 #include "db_wrap.h"
 #include "libcli/security/security.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 #include "librpc/gen_ndr/ndr_samr_c.h"
 
 /*
diff --git a/source4/libnet/libnet_samdump_keytab.c b/source4/libnet/libnet_samdump_keytab.c
index ff527e2dfb..b61469ea00 100644
--- a/source4/libnet/libnet_samdump_keytab.c
+++ b/source4/libnet/libnet_samdump_keytab.c
@@ -25,6 +25,7 @@
 #include "libnet/libnet.h"
 #include "system/kerberos.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 static NTSTATUS samdump_keytab_handle_user(TALLOC_CTX *mem_ctx,
 					    const char *keytab_name,
diff --git a/source4/libnet/libnet_vampire.c b/source4/libnet/libnet_vampire.c
index f5a326c676..bda80db90f 100644
--- a/source4/libnet/libnet_vampire.c
+++ b/source4/libnet/libnet_vampire.c
@@ -25,6 +25,7 @@
 #include "libnet/libnet.h"
 #include "libcli/auth/libcli_auth.h"
 #include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/schannel_proto.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"
diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index 02e6f9c2e5..91c9a499aa 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -620,7 +620,7 @@ PRIVATE_DEPENDENCIES = \
 		LIBNDR NDR_DCERPC \
 		RPC_NDR_EPMAPPER \
 		NDR_SCHANNEL RPC_NDR_NETLOGON \
-		gensec LIBCLI_AUTH LIBCLI_RAW
+		gensec LIBCLI_AUTH LIBCLI_RAW CREDENTIALS
 # End SUBSYSTEM dcerpc
 ################################################
 
diff --git a/source4/librpc/rpc/dcerpc_connect.c b/source4/librpc/rpc/dcerpc_connect.c
index 22c0d384aa..38a707725d 100644
--- a/source4/librpc/rpc/dcerpc_connect.c
+++ b/source4/librpc/rpc/dcerpc_connect.c
@@ -32,6 +32,7 @@
 #include "libcli/smb2/smb2_calls.h"
 #include "librpc/rpc/dcerpc.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
 
 
 struct pipe_np_smb_state {
diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c
index 9286707618..d5a83b1bfa 100644
--- a/source4/librpc/rpc/dcerpc_schannel.c
+++ b/source4/librpc/rpc/dcerpc_schannel.c
@@ -28,7 +28,7 @@
 #include "libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"
-
+#include "auth/credentials/credentials.h"
 
 struct schannel_key_state {
 	struct dcerpc_pipe *pipe;
diff --git a/source4/ntvfs/cifs/vfs_cifs.c b/source4/ntvfs/cifs/vfs_cifs.c
index bfdb5b92fc..185e9a3438 100644
--- a/source4/ntvfs/cifs/vfs_cifs.c
+++ b/source4/ntvfs/cifs/vfs_cifs.c
@@ -29,6 +29,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
 #include "ntvfs/ntvfs.h"
 #include "lib/util/dlinklist.h"
 
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index a78c424eaa..08b68b2318 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/auth.h"
+#include "auth/gensec/gensec.h"
 #include "lib/util/dlinklist.h"
 #include "rpc_server/dcerpc_server.h"
 #include "lib/events/events.h"
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index b73143ce34..6be90f2ea0 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 
 /*
diff --git a/source4/rpc_server/remote/dcesrv_remote.c b/source4/rpc_server/remote/dcesrv_remote.c
index 60dddfbfb3..b15d830c6d 100644
--- a/source4/rpc_server/remote/dcesrv_remote.c
+++ b/source4/rpc_server/remote/dcesrv_remote.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
 #include "librpc/rpc/dcerpc_table.h"
 
 
diff --git a/source4/scripting/ejs/config.mk b/source4/scripting/ejs/config.mk
index 09ad510a12..0326bca857 100644
--- a/source4/scripting/ejs/config.mk
+++ b/source4/scripting/ejs/config.mk
@@ -78,7 +78,7 @@ PUBLIC_DEPENDENCIES = \
 		EJS LIBSAMBA-UTIL \
 		EJSRPC MESSAGING \
 		LIBSAMBA-NET LIBCLI_SMB LIBPOPT \
-		POPT_CREDENTIALS POPT_SAMBA \
+		CREDENTIALS POPT_CREDENTIALS POPT_SAMBA \
 		dcerpc \
 		NDR_TABLE
 # End SUBSYSTEM smbcalls
diff --git a/source4/scripting/ejs/smbcalls_auth.c b/source4/scripting/ejs/smbcalls_auth.c
index 281f35bb20..7b9fe2fc17 100644
--- a/source4/scripting/ejs/smbcalls_auth.c
+++ b/source4/scripting/ejs/smbcalls_auth.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "lib/appweb/ejs/ejs.h"
 #include "auth/auth.h"
+#include "auth/credentials/credentials.h"
 #include "scripting/ejs/smbcalls.h"
 #include "lib/events/events.h"
 #include "lib/messaging/irpc.h"
diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c
index 4aecca53ba..ea7e5797a1 100644
--- a/source4/smb_server/smb/negprot.c
+++ b/source4/smb_server/smb/negprot.c
@@ -19,6 +19,8 @@
 */
 
 #include "includes.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/auth.h"
 #include "smb_server/smb_server.h"
 #include "libcli/smb2/smb2.h"
diff --git a/source4/smb_server/smb/sesssetup.c b/source4/smb_server/smb/sesssetup.c
index 25655fc14f..b6bddaa5b1 100644
--- a/source4/smb_server/smb/sesssetup.c
+++ b/source4/smb_server/smb/sesssetup.c
@@ -25,6 +25,8 @@
 
 #include "includes.h"
 #include "version.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/auth.h"
 #include "smb_server/smb_server.h"
 #include "smbd/service_stream.h"
diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c
index 8e3f6156ea..fe65917275 100644
--- a/source4/smb_server/smb2/negprot.c
+++ b/source4/smb_server/smb2/negprot.c
@@ -20,7 +20,8 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "smb_server/smb_server.h"
diff --git a/source4/smb_server/smb2/sesssetup.c b/source4/smb_server/smb2/sesssetup.c
index 2615eed683..c99b443a35 100644
--- a/source4/smb_server/smb2/sesssetup.c
+++ b/source4/smb_server/smb2/sesssetup.c
@@ -20,6 +20,8 @@
 */
 
 #include "includes.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/auth.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
diff --git a/source4/torture/auth/ntlmssp.c b/source4/torture/auth/ntlmssp.c
index b6d1ccee62..a7c3b03c39 100644
--- a/source4/torture/auth/ntlmssp.c
+++ b/source4/torture/auth/ntlmssp.c
@@ -19,7 +19,7 @@
 */
 
 #include "includes.h"
-#include "auth/auth.h"
+#include "auth/gensec/gensec.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "lib/cmdline/popt_common.h"
 #include "torture/torture.h"
diff --git a/source4/torture/gentest.c b/source4/torture/gentest.c
index b8dc2362ea..9ad41f77e5 100644
--- a/source4/torture/gentest.c
+++ b/source4/torture/gentest.c
@@ -25,6 +25,7 @@
 #include "libcli/libcli.h"
 #include "libcli/raw/libcliraw.h"
 #include "librpc/gen_ndr/security.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 
 #define NSERVERS 2
diff --git a/source4/torture/locktest.c b/source4/torture/locktest.c
index 4554f52e41..608974ec65 100644
--- a/source4/torture/locktest.c
+++ b/source4/torture/locktest.c
@@ -22,6 +22,7 @@
 #include "system/filesys.h"
 #include "system/time.h"
 #include "pstring.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "libcli/libcli.h"
 
diff --git a/source4/torture/masktest.c b/source4/torture/masktest.c
index 8facd6a3eb..d76a205f7c 100644
--- a/source4/torture/masktest.c
+++ b/source4/torture/masktest.c
@@ -25,6 +25,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "system/time.h"
 #include "pstring.h"
+#include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 
 static struct cli_credentials *credentials;
diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
index b95c255662..66e941c3cf 100644
--- a/source4/torture/rpc/samba3rpc.c
+++ b/source4/torture/rpc/samba3rpc.c
@@ -47,7 +47,6 @@
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "libcli/auth/libcli_auth.h"
-#include "libcli/auth/credentials.h"
 #include "lib/crypto/crypto.h"
 #include "libcli/security/proto.h"
 
diff --git a/source4/utils/ntlm_auth.c b/source4/utils/ntlm_auth.c
index 68ee70fdbb..a0c02af447 100644
--- a/source4/utils/ntlm_auth.c
+++ b/source4/utils/ntlm_auth.c
@@ -25,12 +25,15 @@
 #include "includes.h"
 #include "system/filesys.h"
 #include "lib/cmdline/popt_common.h"
+#include "lib/ldb/include/ldb.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
 #include "auth/auth.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "auth/auth_sam.h"
 #include "pstring.h"
 #include "libcli/auth/libcli_auth.h"
 #include "libcli/security/security.h"
-#include "lib/ldb/include/ldb.h"
 #include "lib/events/events.h"
 #include "lib/messaging/messaging.h"
 #include "lib/messaging/irpc.h"
diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c
index 53abcf5f65..3a560a9a94 100644
--- a/source4/winbind/wb_async_helpers.c
+++ b/source4/winbind/wb_async_helpers.c
@@ -27,7 +27,7 @@
 
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/irpc.h"
-#include "libcli/auth/credentials.h"
+#include "auth/credentials/credentials.h"
 #include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index 3eb49e2def..97798861ca 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -25,7 +25,7 @@
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
-#include "libcli/auth/credentials.h"
+#include "auth/credentials/credentials.h"
 #include "libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"
diff --git a/source4/winbind/wb_sam_logon.c b/source4/winbind/wb_sam_logon.c
index 7906f3f525..bf8b4c7ad4 100644
--- a/source4/winbind/wb_sam_logon.c
+++ b/source4/winbind/wb_sam_logon.c
@@ -26,7 +26,7 @@
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
-#include "libcli/auth/credentials.h"
+#include "auth/credentials/credentials.h"
 #include "libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"