Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3

Conflicts:

	source/auth/credentials/config.mk
	source/auth/gensec/config.mk
	source/build/smb_build/makefile.pm
	source/heimdal_build/config.mk
	source/lib/events/config.mk
	source/lib/nss_wrapper/config.mk
	source/lib/policy/config.mk
	source/lib/registry/config.mk
	source/lib/socket_wrapper/config.mk
	source/lib/tdb/config.mk
	source/lib/tls/config.mk
	source/lib/util/config.mk
	source/libcli/config.mk
	source/libcli/ldap/config.mk
	source/libnet/config.mk
	source/librpc/config.mk
	source/param/config.mk
	source/rpc_server/config.mk
	source/scripting/ejs/config.mk
	source/smbd/process_model.mk
(This used to be commit 760378e0294dd0cd4523a83448328478632d7e3d)

388 files changed, 4443 insertions, 1944 deletions

diff --git a/.gitignore b/.gitignore
index 3a2e5642e7..1ad2e2501f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -66,7 +66,6 @@ source/lib/tdr/tdr_proto.h
 source/lib/util/pidfile.h
 source/lib/util/unix_privs.h
 source/lib/util/util_proto.h
-source/lib/util/wrap_xattr.h
 source/lib/util/asn1_proto.h
 source/libcli/finddcs.h
 source/libcli/libcli_proto.h
@@ -190,8 +189,6 @@ source/dsdb/schema/proto.h
 source/lib/crypto/test_proto.h
 source/lib/registry/tests/proto.h
 source/lib/util/apidocs
-source/lib/util/util_ldb.h
-source/libcli/ldap/ldap_ndr.h
 source/libcli/resolve/lp_proto.h
 source/apidocs
 *.swp
diff --git a/NEWS b/NEWS
index dd01091921..8a63719a0e 100644
--- a/NEWS
+++ b/NEWS
@@ -22,12 +22,9 @@ Introduction of LDB
 Samba now stores most of its persistent data in a LDAP-like database 
 called LDB (see ldb(7) for more info). 
 
-Much improved SWAT
+Removed SWAT
 ==================
-SWAT has had some rather large improvements and is now more than just a 
-direct editor for smb.conf. Its layout has been improved. SWAT can now also 
-be used for editing run-time data - maintaining user information, provisioning,
-etc. TLS is supported out of the box.
+Unlike previous versions, Samba4 does not provide a web interface at this time.
 
 Built-in KDC
 ============
@@ -251,7 +248,6 @@ The following parameters have been removed:
 - locking
 - lock spin count
 - lock spin time
-- oplocks
 - level2 oplocks
 - oplock break wait time
 - oplock contention limit
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 52f3055572..f58df497f5 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -10,9 +10,9 @@ Samba 4 is currently not yet in a state where it is usable in
 production environments. Note the WARNINGS below, and the STATUS file,
 which aims to document what should and should not work.
 
-Samba4 alpha3 follows on from our first alpha release, made in
-September, and the Technology Preview series we have offered for some
-time now. 
+Samba4 alpha3 follows on from our second alpha release (made in
+December), the first alpha release (made in September), and the
+Technology Preview series we have offered for some time now. 
 
 WARNINGS
 ========
@@ -70,9 +70,11 @@ CHANGES SINCE Alpha2
 In the time since Samba4 Alpha2 was released in December 2007, Samba has
 continued to evolve, but you may particularly notice these areas:
 
-  Python Bindings:  Bindings for Python are now in place, and used for
+  Python Bindings: Bindings for Python are now in place, and used for
   Samba's provision script, slowly displacing EJS as the embedded
-  scripting language
+  scripting language.  With its increased use, Python is no longer
+  optional, and configure will generate an error if it cannot locate
+  an appropriate Python installation.
 
   SWAT Disabled: Due to a lack of developer time and without a
   long-term web developer to maintain it, the SWAT web UI has been
@@ -83,6 +85,23 @@ continued to evolve, but you may particularly notice these areas:
   GNU Make: To try and simplfy our build system, we rely on GNU Make
   to avoid autogenerating a massive single makefile. 
 
+  Account Expiry: Samba4 now better handles installations over 30 days
+  old (thanks to our long-suffering testers for keeping installations
+  around that long!)
+
+  Registry: Samba4 registry interoperability has been improved in
+  both the client utilities and in the registry service exposed by
+  the Samba4 server itself.
+
+  Administrative Tools: Many enhancements have been made that allow
+  better integration with Windows administrative tools, especially
+  Active Directory Users and Computers.
+
+  ID mapping: Samba4 now handles ID mapping via winbind. The mappings
+  are stored in a central ldb that could be shared across multiple
+  machines using LDAP. Internal callers access this interface via a new
+  wbclient library.
+
 These are just some of the highlights of the work done in the past few
 months.  More details can be found in our GIT history.
 
diff --git a/howto.txt b/howto.txt
index 78bed1316a..d128baa5bd 100644
--- a/howto.txt
+++ b/howto.txt
@@ -16,6 +16,13 @@ aimed at production use of Samba4.
 Step 1: download Samba4
 -----------------------
 
+If you have downloaded the Samba4 code via a tarball released from the
+samba.org website, Step 1 has already been completed for you.  For testing
+with the version released in the tarball, you may continue on to Step 2.  Note
+that the references below to the top-level directory named "samba4" will
+instead be based on the name of the tarball downloaded (e.g.
+"samba-4.0.0alpha3" for the tarball samba-4.0.0alpha3.tar.gz).
+
 There are 2 methods of doing this:
 
   method 1:  "rsync -avz samba.org::ftp/unpacked/samba_4_0_test/ samba4"
@@ -50,10 +57,7 @@ Run this::
 
   $ cd samba4/source
   $ ./configure
-  $ make proto all
-
-If you have gcc 3.4 or newer, then substitute "pch" for "proto" to
-greatly speed up the compile process (about 5x faster).
+  $ make
 
 Step 3: install Samba4
 ----------------------
@@ -120,14 +124,10 @@ in your $PATH. Make sure you run the right version!
 Step 7: testing Samba4
 ----------------------
 
-try these commands::
+try this command::
 
   $ smbclient //localhost/test -Uadministrator%SOMEPASSWORD
 
-or::
-
-  $ ./script/tests/test_posix.sh //localhost/test administrator SOMEPASSWORD
-
 
 NOTE about filesystem support
 -----------------------------
diff --git a/source4/Makefile b/source4/Makefile
index 982808e8b6..8c74b4899d 100644
--- a/source4/Makefile
+++ b/source4/Makefile
@@ -82,8 +82,8 @@ libraries:: $(STATIC_LIBS) $(SHARED_LIBS)
 modules:: $(PLUGINS)
 headers:: $(PUBLIC_HEADERS) $(DEFAULT_HEADERS)
 manpages:: $(MANPAGES)
-all:: showflags $(ALL_PREDEP) bin/asn1_compile bin/compile_et binaries modules pythonmods
-everything:: all libraries headers
+all:: showflags $(ALL_PREDEP) bin/asn1_compile bin/compile_et binaries modules pythonmods libraries headers
+everything:: all
 
 LD_LIBPATH_OVERRIDE = $(LIB_PATH_VAR)=$(builddir)/bin/shared
 
diff --git a/source4/VERSION b/source4/VERSION
index 29ff51638e..d40eba4e8a 100644
--- a/source4/VERSION
+++ b/source4/VERSION
@@ -57,7 +57,7 @@ SAMBA_VERSION_TP_RELEASE=
 # e.g. SAMBA_VERSION_ALPHA_RELEASE=1                   #
 #  ->  "4.0.0alpha1"                                   #
 ########################################################
-SAMBA_VERSION_ALPHA_RELEASE=3
+SAMBA_VERSION_ALPHA_RELEASE=4
 
 ########################################################
 # For 'pre' releases the version will be               #
diff --git a/source4/auth/auth.c b/source4/auth/auth.c
index f5149286b9..c4cb42779b 100644
--- a/source4/auth/auth.c
+++ b/source4/auth/auth.c
@@ -21,13 +21,14 @@
 #include "includes.h"
 #include "lib/util/dlinklist.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "lib/events/events.h"
 #include "param/param.h"
 
 /***************************************************************************
  Set a fixed challenge
 ***************************************************************************/
-NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by) 
+_PUBLIC_ NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by) 
 {
 	auth_ctx->challenge.set_by = talloc_strdup(auth_ctx, set_by);
 	NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.set_by);
@@ -145,7 +146,7 @@ static void auth_check_password_sync_callback(struct auth_check_password_request
  *
  **/
 
-NTSTATUS auth_check_password(struct auth_context *auth_ctx,
+_PUBLIC_ NTSTATUS auth_check_password(struct auth_context *auth_ctx,
 			     TALLOC_CTX *mem_ctx,
 			     const struct auth_usersupplied_info *user_info, 
 			     struct auth_serversupplied_info **server_info)
@@ -217,7 +218,7 @@ static void auth_check_password_async_timed_handler(struct event_context *ev, st
  *
  **/
 
-void auth_check_password_send(struct auth_context *auth_ctx,
+_PUBLIC_ void auth_check_password_send(struct auth_context *auth_ctx,
 			      const struct auth_usersupplied_info *user_info,
 			      void (*callback)(struct auth_check_password_request *req, void *private_data),
 			      void *private_data)
@@ -319,7 +320,7 @@ failed:
  *
  **/
 
-NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+_PUBLIC_ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
 				  TALLOC_CTX *mem_ctx,
 				  struct auth_serversupplied_info **server_info)
 {
@@ -349,7 +350,7 @@ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
  Make a auth_info struct for the auth subsystem
  - Allow the caller to specify the methods to use
 ***************************************************************************/
-NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
+_PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
 				     struct event_context *ev,
 				     struct messaging_context *msg,
 				     struct loadparm_context *lp_ctx,
@@ -412,7 +413,7 @@ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods,
  Make a auth_info struct for the auth subsystem
  - Uses default auth_methods, depending on server role and smb.conf settings
 ***************************************************************************/
-NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
 			     struct event_context *ev,
 			     struct messaging_context *msg,
 			     struct loadparm_context *lp_ctx,
@@ -446,7 +447,7 @@ static int num_backends;
   The 'name' can be later used by other backends to find the operations
   structure for this backend.
 */
-NTSTATUS auth_register(const struct auth_operations *ops)
+_PUBLIC_ NTSTATUS auth_register(const struct auth_operations *ops)
 {
 	struct auth_operations *new_ops;
 	
@@ -511,7 +512,7 @@ const struct auth_critical_sizes *auth_interface_version(void)
 	return &critical_sizes;
 }
 
-NTSTATUS auth_init(void)
+_PUBLIC_ NTSTATUS auth_init(void)
 {
 	static bool initialized = false;
 	extern NTSTATUS auth_developer_init(void);
diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index ff7132c3ff..da8aac48ef 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -190,6 +190,63 @@ struct auth_critical_sizes {
 
 #include "auth/session.h"
 #include "auth/system_session_proto.h"
-#include "auth/auth_proto.h"
+
+struct ldb_message;
+struct ldb_context;
+NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, const uint8_t **_chal);
+NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
+			    struct ldb_context *sam_ctx,
+			    uint32_t logon_parameters,
+			    struct ldb_message *msg,
+			    struct ldb_message *msg_domain_ref,
+			    const char *logon_workstation,
+			    const char *name_for_logs);
+struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
+					   const char *netbios_name,
+					   struct ldb_message *msg,
+					   struct ldb_message *msg_domain_ref,
+					   DATA_BLOB user_sess_key, DATA_BLOB lm_sess_key,
+					   struct auth_serversupplied_info **_server_info);
+NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx, 
+					   struct loadparm_context *lp_ctx,
+					   struct auth_session_info **_session_info) ;
+NTSTATUS auth_nt_status_squash(NTSTATUS nt_status);
+
+NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
+				     struct event_context *ev,
+				     struct messaging_context *msg,
+				     struct loadparm_context *lp_ctx,
+				     struct auth_context **auth_ctx);
+
+NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
+			     struct event_context *ev,
+			     struct messaging_context *msg,
+			     struct loadparm_context *lp_ctx,
+			     struct auth_context **auth_ctx);
+
+NTSTATUS auth_check_password(struct auth_context *auth_ctx,
+			     TALLOC_CTX *mem_ctx,
+			     const struct auth_usersupplied_info *user_info, 
+			     struct auth_serversupplied_info **server_info);
+NTSTATUS auth_init(void);
+NTSTATUS auth_register(const struct auth_operations *ops);
+NTSTATUS authenticate_username_pw(TALLOC_CTX *mem_ctx,
+					   struct event_context *ev,
+					   struct messaging_context *msg,
+					   struct loadparm_context *lp_ctx,
+					   const char *nt4_domain,
+					   const char *nt4_username,
+					   const char *password,
+					   struct auth_session_info **session_info);
+NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+				  TALLOC_CTX *mem_ctx,
+				  struct auth_serversupplied_info **server_info);
+
+void auth_check_password_send(struct auth_context *auth_ctx,
+			      const struct auth_usersupplied_info *user_info,
+			      void (*callback)(struct auth_check_password_request *req, void *private_data),
+			      void *private_data);
+NTSTATUS auth_context_set_challenge(struct auth_context *auth_ctx, const uint8_t chal[8], const char *set_by);
 
 #endif /* _SMBAUTH_H_ */
diff --git a/source4/auth/auth_anonymous.c b/source4/auth/auth_anonymous.c
index 38c13d4b65..b93c7c2008 100644
--- a/source4/auth/auth_anonymous.c
+++ b/source4/auth/auth_anonymous.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "param/param.h"
 
 /**
diff --git a/source4/auth/auth_developer.c b/source4/auth/auth_developer.c
index 0da947b68d..a2c9cbc828 100644
--- a/source4/auth/auth_developer.c
+++ b/source4/auth/auth_developer.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "libcli/security/security.h"
 #include "librpc/gen_ndr/ndr_samr.h"
 
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 4cb8d2b304..4b467cee75 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -25,6 +25,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "util/util_ldb.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "auth/auth_sam.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
diff --git a/source4/auth/auth_simple.c b/source4/auth/auth_simple.c
index 3c7bf5433a..50be02a353 100644
--- a/source4/auth/auth_simple.c
+++ b/source4/auth/auth_simple.c
@@ -25,6 +25,7 @@
 #include "auth/auth.h"
 #include "lib/events/events.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
 /*
  It's allowed to pass NULL as session_info,
diff --git a/source4/auth/auth_unix.c b/source4/auth/auth_unix.c
index 20e198701d..a417107025 100644
--- a/source4/auth/auth_unix.c
+++ b/source4/auth/auth_unix.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "system/passwd.h" /* needed by some systems for struct passwd */
 #include "lib/socket/socket.h" 
 #include "auth/pam_errors.h"
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 5d2bc6bac0..1d86b858cf 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -246,7 +246,7 @@ NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_contex
  * @param nt_status NTSTATUS input for squashing.
  * @return the 'squashed' nt_status
  **/
-NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
+_PUBLIC_ NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
 {
 	if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 		/* Match WinXP and don't give the game away */
diff --git a/source4/auth/auth_winbind.c b/source4/auth/auth_winbind.c
index 2f8074d3cb..149f549afa 100644
--- a/source4/auth/auth_winbind.c
+++ b/source4/auth/auth_winbind.c
@@ -23,6 +23,8 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
+#include "auth/session_proto.h"
 #include "nsswitch/winbind_client.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_winbind.h"
diff --git a/source4/auth/config.mk b/source4/auth/config.mk
index b82a1af8fa..14f5da0eb7 100644
--- a/source4/auth/config.mk
+++ b/source4/auth/config.mk
@@ -8,7 +8,7 @@ mkinclude credentials/config.mk
 PRIVATE_PROTO_HEADER = session_proto.h
 PUBLIC_DEPENDENCIES = CREDENTIALS
 
-PUBLIC_HEADERS += auth/session.h
+# PUBLIC_HEADERS += auth/session.h
 
 auth_session_OBJ_FILES = $(addprefix auth/, session.o)
 
@@ -95,7 +95,7 @@ PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSECURITY SAMDB CREDENTIALS
 
 service_auth_OBJ_FILES = $(addprefix auth/, auth.o auth_util.o auth_simple.o)
 
-PUBLIC_HEADERS += auth/auth.h
+# PUBLIC_HEADERS += auth/auth.h
 
 [PYTHON::swig_auth]
 PUBLIC_DEPENDENCIES = auth_system_session
diff --git a/source4/auth/credentials/config.mk b/source4/auth/credentials/config.mk
index d8c02ebea8..6f3ec3997c 100644
--- a/source4/auth/credentials/config.mk
+++ b/source4/auth/credentials/config.mk
@@ -9,7 +9,7 @@ PRIVATE_DEPENDENCIES = \
 
 CREDENTIALS_OBJ_FILES = $(addprefix auth/credentials/, credentials.o credentials_files.o credentials_ntlm.o credentials_krb5.o ../kerberos/kerberos_util.o)
 
-PUBLIC_HEADERS += $(addprefix auth/credentials/, credentials.h credentials_krb5.h)
+PUBLIC_HEADERS += auth/credentials/credentials.h
 
 [PYTHON::swig_credentials]
 PUBLIC_DEPENDENCIES = CREDENTIALS LIBCMDLINE_CREDENTIALS
diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index 6d5c1210c9..89dddc9e05 100644
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -33,7 +33,7 @@
  * Create a new credentials structure
  * @param mem_ctx TALLOC_CTX parent for credentials structure 
  */
-struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) 
+_PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) 
 {
 	struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
 	if (!cred) {
@@ -77,7 +77,7 @@ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
  * Create a new anonymous credential
  * @param mem_ctx TALLOC_CTX parent for credentials structure 
  */
-struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
+_PUBLIC_ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
 {
 	struct cli_credentials *anon_credentials;
 
@@ -87,23 +87,23 @@ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
 	return anon_credentials;
 }
 
-void cli_credentials_set_kerberos_state(struct cli_credentials *creds, 
+_PUBLIC_ void cli_credentials_set_kerberos_state(struct cli_credentials *creds, 
 					enum credentials_use_kerberos use_kerberos)
 {
 	creds->use_kerberos = use_kerberos;
 }
 
-enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
+_PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
 {
 	return creds->use_kerberos;
 }
 
-void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features)
+_PUBLIC_ void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features)
 {
 	creds->gensec_features = gensec_features;
 }
 
-uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
+_PUBLIC_ uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
 {
 	return creds->gensec_features;
 }
@@ -115,7 +115,7 @@ uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
  * @retval The username set on this context.
  * @note Return value will never be NULL except by programmer error.
  */
-const char *cli_credentials_get_username(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_username(struct cli_credentials *cred)
 {
 	if (cred->machine_account_pending) {
 		cli_credentials_set_machine_account(cred, 
@@ -134,7 +134,7 @@ const char *cli_credentials_get_username(struct cli_credentials *cred)
 	return cred->username;
 }
 
-bool cli_credentials_set_username(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_username(struct cli_credentials *cred, 
 				  const char *val, enum credentials_obtained obtained)
 {
 	if (obtained >= cred->username_obtained) {
@@ -159,7 +159,7 @@ bool cli_credentials_set_username_callback(struct cli_credentials *cred,
 	return false;
 }
 
-bool cli_credentials_set_bind_dn(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_bind_dn(struct cli_credentials *cred, 
 				 const char *bind_dn)
 {
 	cred->bind_dn = talloc_strdup(cred, bind_dn);
@@ -172,7 +172,7 @@ bool cli_credentials_set_bind_dn(struct cli_credentials *cred,
  * @retval The username set on this context.
  * @note Return value will be NULL if not specified explictly
  */
-const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
 {
 	return cred->bind_dn;
 }
@@ -184,7 +184,7 @@ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
  * @retval The username set on this context.
  * @note Return value will never be NULL except by programmer error.
  */
-const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
+_PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
 {
 	if (cred->machine_account_pending) {
 		cli_credentials_set_machine_account(cred,
@@ -246,7 +246,7 @@ bool cli_credentials_set_principal_callback(struct cli_credentials *cred,
  * function to determine if authentication has been explicitly
  * requested */
 
-bool cli_credentials_authentication_requested(struct cli_credentials *cred) 
+_PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *cred) 
 {
 	if (cred->bind_dn) {
 		return true;
@@ -275,7 +275,7 @@ bool cli_credentials_authentication_requested(struct cli_credentials *cred)
  * @param cred credentials context
  * @retval If set, the cleartext password, otherwise NULL
  */
-const char *cli_credentials_get_password(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_password(struct cli_credentials *cred)
 {
 	if (cred->machine_account_pending) {
 		cli_credentials_set_machine_account(cred,
@@ -297,7 +297,7 @@ const char *cli_credentials_get_password(struct cli_credentials *cred)
 /* Set a password on the credentials context, including an indication
  * of 'how' the password was obtained */
 
-bool cli_credentials_set_password(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_password(struct cli_credentials *cred, 
 				  const char *val, 
 				  enum credentials_obtained obtained)
 {
@@ -313,7 +313,7 @@ bool cli_credentials_set_password(struct cli_credentials *cred,
 	return false;
 }
 
-bool cli_credentials_set_password_callback(struct cli_credentials *cred,
+_PUBLIC_ bool cli_credentials_set_password_callback(struct cli_credentials *cred,
 					   const char *(*password_cb) (struct cli_credentials *))
 {
 	if (cred->password_obtained < CRED_CALLBACK) {
@@ -358,7 +358,7 @@ bool cli_credentials_set_old_password(struct cli_credentials *cred,
  * @param cred credentials context
  * @retval If set, the cleartext password, otherwise NULL
  */
-const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred, 
+_PUBLIC_ const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred, 
 							TALLOC_CTX *mem_ctx)
 {
 	const char *password = cli_credentials_get_password(cred);
@@ -377,7 +377,7 @@ const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *
 	}
 }
 
-bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
+_PUBLIC_ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
 				 const struct samr_Password *nt_hash, 
 				 enum credentials_obtained obtained)
 {
@@ -401,7 +401,7 @@ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
  * @retval The domain set on this context. 
  * @note Return value will never be NULL except by programmer error.
  */
-const char *cli_credentials_get_domain(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_domain(struct cli_credentials *cred)
 {
 	if (cred->machine_account_pending) {
 		cli_credentials_set_machine_account(cred,
@@ -421,7 +421,7 @@ const char *cli_credentials_get_domain(struct cli_credentials *cred)
 }
 
 
-bool cli_credentials_set_domain(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_domain(struct cli_credentials *cred, 
 				const char *val, 
 				enum credentials_obtained obtained)
 {
@@ -456,7 +456,7 @@ bool cli_credentials_set_domain_callback(struct cli_credentials *cred,
  * @retval The realm set on this context. 
  * @note Return value will never be NULL except by programmer error.
  */
-const char *cli_credentials_get_realm(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_realm(struct cli_credentials *cred)
 {	
 	if (cred->machine_account_pending) {
 		cli_credentials_set_machine_account(cred,
@@ -479,7 +479,7 @@ const char *cli_credentials_get_realm(struct cli_credentials *cred)
  * Set the realm for this credentials context, and force it to
  * uppercase for the sainity of our local kerberos libraries 
  */
-bool cli_credentials_set_realm(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_realm(struct cli_credentials *cred, 
 			       const char *val, 
 			       enum credentials_obtained obtained)
 {
@@ -512,7 +512,7 @@ bool cli_credentials_set_realm_callback(struct cli_credentials *cred,
  * @retval The workstation name set on this context. 
  * @note Return value will never be NULL except by programmer error.
  */
-const char *cli_credentials_get_workstation(struct cli_credentials *cred)
+_PUBLIC_ const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 {
 	if (cred->workstation_obtained == CRED_CALLBACK && 
 	    !cred->callback_running) {
@@ -525,7 +525,7 @@ const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 	return cred->workstation;
 }
 
-bool cli_credentials_set_workstation(struct cli_credentials *cred, 
+_PUBLIC_ bool cli_credentials_set_workstation(struct cli_credentials *cred, 
 				     const char *val, 
 				     enum credentials_obtained obtained)
 {
@@ -560,7 +560,7 @@ bool cli_credentials_set_workstation_callback(struct cli_credentials *cred,
  * @param obtained This enum describes how 'specified' this password is
  */
 
-void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
+_PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
 {
 	char *uname, *p;
 
@@ -597,7 +597,7 @@ void cli_credentials_parse_string(struct cli_credentials *credentials, const cha
  * @param mem_ctx The memory context to place the result on
  */
 
-const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
+_PUBLIC_ const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
 {
 	const char *bind_dn = cli_credentials_get_bind_dn(credentials);
 	const char *domain;
@@ -625,7 +625,7 @@ const char *cli_credentials_get_unparsed_name(struct cli_credentials *credential
  *
  * @param cred Credentials structure to fill in
  */
-void cli_credentials_set_conf(struct cli_credentials *cred, 
+_PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, 
 			      struct loadparm_context *lp_ctx)
 {
 	cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
@@ -640,7 +640,7 @@ void cli_credentials_set_conf(struct cli_credentials *cred,
  * 
  * @param cred Credentials structure to fill in
  */
-void cli_credentials_guess(struct cli_credentials *cred,
+_PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred,
 			   struct loadparm_context *lp_ctx)
 {
 	char *p;
@@ -683,7 +683,7 @@ void cli_credentials_guess(struct cli_credentials *cred,
  * Attach NETLOGON credentials for use with SCHANNEL
  */
 
-void cli_credentials_set_netlogon_creds(struct cli_credentials *cred, 
+_PUBLIC_ void cli_credentials_set_netlogon_creds(struct cli_credentials *cred, 
 					struct creds_CredentialState *netlogon_creds)
 {
 	cred->netlogon_creds = talloc_reference(cred, netlogon_creds);
@@ -702,7 +702,7 @@ struct creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_cred
  * Set NETLOGON secure channel type
  */
 
-void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
+_PUBLIC_ void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
 					     enum netr_SchannelType secure_channel_type)
 {
 	cred->secure_channel_type = secure_channel_type;
@@ -712,7 +712,7 @@ void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
  * Return NETLOGON secure chanel type
  */
 
-enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
+_PUBLIC_ enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
 {
 	return cred->secure_channel_type;
 }
@@ -720,7 +720,7 @@ enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_creden
 /**
  * Fill in a credentials structure as the anonymous user
  */
-void cli_credentials_set_anonymous(struct cli_credentials *cred) 
+_PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred) 
 {
 	cli_credentials_set_username(cred, "", CRED_SPECIFIED);
 	cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
@@ -734,7 +734,7 @@ void cli_credentials_set_anonymous(struct cli_credentials *cred)
  * @retval true if anonymous, false if a username is specified
  */
 
-bool cli_credentials_is_anonymous(struct cli_credentials *cred)
+_PUBLIC_ bool cli_credentials_is_anonymous(struct cli_credentials *cred)
 {
 	const char *username;
 	
@@ -763,7 +763,7 @@ bool cli_credentials_is_anonymous(struct cli_credentials *cred)
  *
  * @retval whether the credentials struct is finished
  */
-bool cli_credentials_wrong_password(struct cli_credentials *cred)
+_PUBLIC_ bool cli_credentials_wrong_password(struct cli_credentials *cred)
 {
 	if (cred->password_obtained != CRED_CALLBACK_RESULT) {
 		return false;
@@ -779,7 +779,7 @@ bool cli_credentials_wrong_password(struct cli_credentials *cred)
 /*
   set the common event context for this set of credentials
  */
-void cli_credentials_set_event_context(struct cli_credentials *cred, struct event_context *ev)
+_PUBLIC_ void cli_credentials_set_event_context(struct cli_credentials *cred, struct event_context *ev)
 {
 	cred->ev = ev;
 }
@@ -787,7 +787,7 @@ void cli_credentials_set_event_context(struct cli_credentials *cred, struct even
 /*
   set the common event context for this set of credentials
  */
-struct event_context *cli_credentials_get_event_context(struct cli_credentials *cred)
+_PUBLIC_ struct event_context *cli_credentials_get_event_context(struct cli_credentials *cred)
 {
 	if (cred->ev == NULL) {
 		cred->ev = event_context_find(cred);
diff --git a/source4/auth/credentials/credentials.h b/source4/auth/credentials/credentials.h
index 1b205c61ce..afcb300638 100644
--- a/source4/auth/credentials/credentials.h
+++ b/source4/auth/credentials/credentials.h
@@ -132,6 +132,117 @@ struct ccache_container;
 
 struct gssapi_creds_container;
 
-#include "auth/credentials/credentials_proto.h"
+const char *cli_credentials_get_workstation(struct cli_credentials *cred);
+bool cli_credentials_set_workstation(struct cli_credentials *cred, 
+				     const char *val, 
+				     enum credentials_obtained obtained);
+bool cli_credentials_is_anonymous(struct cli_credentials *cred);
+struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx);
+void cli_credentials_set_anonymous(struct cli_credentials *cred);
+bool cli_credentials_wrong_password(struct cli_credentials *cred);
+const char *cli_credentials_get_password(struct cli_credentials *cred);
+void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+					      const char **username, 
+					      const char **domain);
+NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+					   int *flags,
+					   DATA_BLOB challenge, DATA_BLOB target_info, 
+					   DATA_BLOB *_lm_response, DATA_BLOB *_nt_response, 
+					   DATA_BLOB *_lm_session_key, DATA_BLOB *_session_key);
+const char *cli_credentials_get_realm(struct cli_credentials *cred);
+const char *cli_credentials_get_username(struct cli_credentials *cred);
+int cli_credentials_get_krb5_context(struct cli_credentials *cred, 
+				     struct loadparm_context *lp_ctx,
+				     struct smb_krb5_context **smb_krb5_context);
+int cli_credentials_get_ccache(struct cli_credentials *cred, 
+			       struct loadparm_context *lp_ctx,
+			       struct ccache_container **ccc);
+int cli_credentials_get_keytab(struct cli_credentials *cred, 
+			       struct loadparm_context *lp_ctx,
+			       struct keytab_container **_ktc);
+const char *cli_credentials_get_domain(struct cli_credentials *cred);
+struct creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred);
+void cli_credentials_set_machine_account_pending(struct cli_credentials *cred,
+						 struct loadparm_context *lp_ctx);
+void cli_credentials_set_conf(struct cli_credentials *cred, 
+			      struct loadparm_context *lp_ctx);
+const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx);
+int cli_credentials_get_server_gss_creds(struct cli_credentials *cred, 
+					 struct loadparm_context *lp_ctx,
+					 struct gssapi_creds_container **_gcc);
+int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, 
+					 struct loadparm_context *lp_ctx,
+					 struct gssapi_creds_container **_gcc);
+void cli_credentials_set_event_context(struct cli_credentials *cred, struct event_context *ev);
+void cli_credentials_set_kerberos_state(struct cli_credentials *creds, 
+					enum credentials_use_kerberos use_kerberos);
+struct event_context *cli_credentials_get_event_context(struct cli_credentials *cred);
+bool cli_credentials_set_domain(struct cli_credentials *cred, 
+				const char *val, 
+				enum credentials_obtained obtained);
+bool cli_credentials_set_username(struct cli_credentials *cred, 
+				  const char *val, enum credentials_obtained obtained);
+bool cli_credentials_set_password(struct cli_credentials *cred, 
+				  const char *val, 
+				  enum credentials_obtained obtained);
+struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx);
+void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained);
+const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred, 
+							TALLOC_CTX *mem_ctx);
+bool cli_credentials_set_realm(struct cli_credentials *cred, 
+			       const char *val, 
+			       enum credentials_obtained obtained);
+void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
+				     enum netr_SchannelType secure_channel_type);
+void cli_credentials_set_netlogon_creds(struct cli_credentials *cred, 
+					struct creds_CredentialState *netlogon_creds);
+NTSTATUS cli_credentials_set_krb5_context(struct cli_credentials *cred, 
+					  struct smb_krb5_context *smb_krb5_context);
+NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
+					      struct loadparm_context *lp_ctx,
+					      const char *serviceprincipal);
+NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred,
+					     struct loadparm_context *lp_ctx);
+bool cli_credentials_authentication_requested(struct cli_credentials *cred);
+void cli_credentials_guess(struct cli_credentials *cred,
+			   struct loadparm_context *lp_ctx);
+bool cli_credentials_set_bind_dn(struct cli_credentials *cred, 
+				 const char *bind_dn);
+const char *cli_credentials_get_bind_dn(struct cli_credentials *cred);
+bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained);
+const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx);
+bool cli_credentials_set_password_callback(struct cli_credentials *cred,
+					   const char *(*password_cb) (struct cli_credentials *));
+enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred);
+void cli_credentials_set_kvno(struct cli_credentials *cred,
+			      int kvno);
+bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
+				 const struct samr_Password *nt_hash, 
+				 enum credentials_obtained obtained);
+int cli_credentials_set_keytab_name(struct cli_credentials *cred, 
+				    struct loadparm_context *lp_ctx,
+				    const char *keytab_name, 
+				    enum credentials_obtained obtained);
+int cli_credentials_update_keytab(struct cli_credentials *cred, 
+				  struct loadparm_context *lp_ctx);
+void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features);
+uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds);
+int cli_credentials_set_ccache(struct cli_credentials *cred, 
+			       struct loadparm_context *lp_ctx,
+			       const char *name, 
+			       enum credentials_obtained obtained);
+bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained);
+bool cli_credentials_parse_password_fd(struct cli_credentials *credentials, 
+				       int fd, enum credentials_obtained obtained);
+void cli_credentials_invalidate_ccache(struct cli_credentials *cred, 
+				       enum credentials_obtained obtained);
+void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal);
+enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds);
+NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, 
+				     struct loadparm_context *lp_ctx,
+				     struct ldb_context *ldb,
+				     const char *base,
+				     const char *filter);
+ int cli_credentials_get_kvno(struct cli_credentials *cred);
 
 #endif /* __CREDENTIALS_H__ */
diff --git a/source4/auth/credentials/credentials.i b/source4/auth/credentials/credentials.i
index 41ec67580e..0a604cf002 100644
--- a/source4/auth/credentials/credentials.i
+++ b/source4/auth/credentials/credentials.i
@@ -39,6 +39,10 @@ typedef struct cli_credentials cli_credentials;
     $1 = NULL;
 }
 
+%constant int AUTO_USE_KERBEROS = CRED_AUTO_USE_KERBEROS;
+%constant int DONT_USE_KERBEROS = CRED_DONT_USE_KERBEROS;
+%constant int MUST_USE_KERBEROS = CRED_MUST_USE_KERBEROS;
+
 %{
 #include "librpc/gen_ndr/samr.h" /* for struct samr_Password */
 %}
@@ -52,7 +56,7 @@ typedef struct cli_credentials cli_credentials;
 typedef struct cli_credentials {
     %extend {
         cli_credentials(void) {
-            return cli_credentials_init_anon(NULL);
+            return cli_credentials_init(NULL);
         }
         /* username */
         const char *get_username(void);
@@ -74,13 +78,18 @@ typedef struct cli_credentials {
         bool set_realm(const char *val, 
                        enum credentials_obtained=CRED_SPECIFIED);
 
+	/* Kerberos */
+        void set_kerberos_state(enum credentials_use_kerberos use_kerberos);
+
         void parse_string(const char *text,
-                       enum credentials_obtained=CRED_SPECIFIED);
+ 	                  enum credentials_obtained=CRED_SPECIFIED);
 
         /* bind dn */
         const char *get_bind_dn(void);
         bool set_bind_dn(const char *bind_dn);
 
+   	void set_anonymous();
+
         /* workstation name */
         const char *get_workstation(void);
         bool set_workstation(const char *workstation, 
diff --git a/source4/auth/credentials/credentials.py b/source4/auth/credentials/credentials.py
index 14526af910..2b40fbeead 100644
--- a/source4/auth/credentials/credentials.py
+++ b/source4/auth/credentials/credentials.py
@@ -58,6 +58,9 @@ def _swig_setattr_nondynamic_method(set):
 
 
 import param
+AUTO_USE_KERBEROS = _credentials.AUTO_USE_KERBEROS
+DONT_USE_KERBEROS = _credentials.DONT_USE_KERBEROS
+MUST_USE_KERBEROS = _credentials.MUST_USE_KERBEROS
 class Credentials(object):
     thisown = _swig_property(lambda x: x.this.own(), lambda x, v: x.this.own(v), doc='The membership flag')
     __repr__ = _swig_repr
@@ -72,9 +75,11 @@ Credentials.get_domain = new_instancemethod(_credentials.Credentials_get_domain,
 Credentials.set_domain = new_instancemethod(_credentials.Credentials_set_domain,None,Credentials)
 Credentials.get_realm = new_instancemethod(_credentials.Credentials_get_realm,None,Credentials)
 Credentials.set_realm = new_instancemethod(_credentials.Credentials_set_realm,None,Credentials)
+Credentials.set_kerberos_state = new_instancemethod(_credentials.Credentials_set_kerberos_state,None,Credentials)
 Credentials.parse_string = new_instancemethod(_credentials.Credentials_parse_string,None,Credentials)
 Credentials.get_bind_dn = new_instancemethod(_credentials.Credentials_get_bind_dn,None,Credentials)
 Credentials.set_bind_dn = new_instancemethod(_credentials.Credentials_set_bind_dn,None,Credentials)
+Credentials.set_anonymous = new_instancemethod(_credentials.Credentials_set_anonymous,None,Credentials)
 Credentials.get_workstation = new_instancemethod(_credentials.Credentials_get_workstation,None,Credentials)
 Credentials.set_workstation = new_instancemethod(_credentials.Credentials_set_workstation,None,Credentials)
 Credentials.guess = new_instancemethod(_credentials.Credentials_guess,None,Credentials)
diff --git a/source4/auth/credentials/credentials_files.c b/source4/auth/credentials/credentials_files.c
index c1001c9622..8bcbc65575 100644
--- a/source4/auth/credentials/credentials_files.c
+++ b/source4/auth/credentials/credentials_files.c
@@ -39,7 +39,7 @@
  * @param obtained This enum describes how 'specified' this password is
  */
 
-bool cli_credentials_parse_password_fd(struct cli_credentials *credentials, 
+_PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials, 
 				       int fd, enum credentials_obtained obtained)
 {
 	char *p;
@@ -83,7 +83,7 @@ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
  * @param obtained This enum describes how 'specified' this password is
  */
 
-bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
+_PUBLIC_ bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
 {
 	int fd = open(file, O_RDONLY, 0);
 	bool ret;
@@ -109,7 +109,7 @@ bool cli_credentials_parse_password_file(struct cli_credentials *credentials, co
  * @param obtained This enum describes how 'specified' this password is
  */
 
-bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained) 
+_PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained) 
 {
 	uint16_t len = 0;
 	char *ptr, *val, *param;
@@ -168,7 +168,7 @@ bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file,
  * @param cred Credentials structure to fill in
  * @retval NTSTATUS error detailing any failure
  */
-NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, 
+_PUBLIC_ NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred, 
 				     struct loadparm_context *lp_ctx,
 				     struct ldb_context *ldb,
 				     const char *base,
@@ -326,7 +326,7 @@ NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
  * @param cred Credentials structure to fill in
  * @retval NTSTATUS error detailing any failure
  */
-NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred,
+_PUBLIC_ NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred,
 					     struct loadparm_context *lp_ctx)
 {
 	char *filter;
@@ -369,7 +369,7 @@ NTSTATUS cli_credentials_set_krbtgt(struct cli_credentials *cred,
  * @param cred Credentials structure to fill in
  * @retval NTSTATUS error detailing any failure
  */
-NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
+_PUBLIC_ NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
 					      struct loadparm_context *lp_ctx,
 					      const char *serviceprincipal)
 {
@@ -395,7 +395,7 @@ NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
  *       than during, popt processing.
  *
  */
-void cli_credentials_set_machine_account_pending(struct cli_credentials *cred,
+_PUBLIC_ void cli_credentials_set_machine_account_pending(struct cli_credentials *cred,
 						 struct loadparm_context *lp_ctx)
 {
 	cred->machine_account_pending = true;
diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index 52bf9f124f..cd9285b09d 100644
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -25,10 +25,11 @@
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_proto.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "param/param.h"
 
-int cli_credentials_get_krb5_context(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_get_krb5_context(struct cli_credentials *cred, 
 				     struct loadparm_context *lp_ctx,
 				     struct smb_krb5_context **smb_krb5_context) 
 {
@@ -52,7 +53,7 @@ int cli_credentials_get_krb5_context(struct cli_credentials *cred,
  * otherwise we might have problems with the krb5 context already
  * being here.
  */
-NTSTATUS cli_credentials_set_krb5_context(struct cli_credentials *cred, 
+_PUBLIC_ NTSTATUS cli_credentials_set_krb5_context(struct cli_credentials *cred, 
 					  struct smb_krb5_context *smb_krb5_context)
 {
 	if (!talloc_reference(cred, smb_krb5_context)) {
@@ -126,7 +127,7 @@ static int free_dccache(struct ccache_container *ccc) {
 	return 0;
 }
 
-int cli_credentials_set_ccache(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_set_ccache(struct cli_credentials *cred, 
 			       struct loadparm_context *lp_ctx,
 			       const char *name, 
 			       enum credentials_obtained obtained)
@@ -251,7 +252,7 @@ static int cli_credentials_new_ccache(struct cli_credentials *cred,
 	return ret;
 }
 
-int cli_credentials_get_ccache(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_get_ccache(struct cli_credentials *cred, 
 			       struct loadparm_context *lp_ctx,
 			       struct ccache_container **ccc)
 {
@@ -315,7 +316,7 @@ void cli_credentials_invalidate_client_gss_creds(struct cli_credentials *cred,
 	}
 }
 
-void cli_credentials_invalidate_ccache(struct cli_credentials *cred, 
+_PUBLIC_ void cli_credentials_invalidate_ccache(struct cli_credentials *cred, 
 				       enum credentials_obtained obtained)
 {
 	/* If the caller just changed the username/password etc, then
@@ -346,7 +347,7 @@ static int free_gssapi_creds(struct gssapi_creds_container *gcc)
 	return 0;
 }
 
-int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, 
 					 struct loadparm_context *lp_ctx,
 					 struct gssapi_creds_container **_gcc) 
 {
@@ -454,7 +455,7 @@ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
  * attached to this context.  If this hasn't been done or set before,
  * it will be generated from the password.
  */
-int cli_credentials_get_keytab(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_get_keytab(struct cli_credentials *cred, 
 			       struct loadparm_context *lp_ctx,
 			       struct keytab_container **_ktc)
 {
@@ -508,7 +509,7 @@ int cli_credentials_get_keytab(struct cli_credentials *cred,
 /* Given the name of a keytab (presumably in the format
  * FILE:/etc/krb5.keytab), open it and attach it */
 
-int cli_credentials_set_keytab_name(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_set_keytab_name(struct cli_credentials *cred, 
 				    struct loadparm_context *lp_ctx,
 				    const char *keytab_name, 
 				    enum credentials_obtained obtained) 
@@ -547,7 +548,7 @@ int cli_credentials_set_keytab_name(struct cli_credentials *cred,
 	return ret;
 }
 
-int cli_credentials_update_keytab(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_update_keytab(struct cli_credentials *cred, 
 				  struct loadparm_context *lp_ctx) 
 {
 	krb5_error_code ret;
@@ -583,7 +584,7 @@ int cli_credentials_update_keytab(struct cli_credentials *cred,
 
 /* Get server gss credentials (in gsskrb5, this means the keytab) */
 
-int cli_credentials_get_server_gss_creds(struct cli_credentials *cred, 
+_PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred, 
 					 struct loadparm_context *lp_ctx,
 					 struct gssapi_creds_container **_gcc) 
 {
@@ -657,7 +658,7 @@ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
  * Set Kerberos KVNO
  */
 
-void cli_credentials_set_kvno(struct cli_credentials *cred,
+_PUBLIC_ void cli_credentials_set_kvno(struct cli_credentials *cred,
 			      int kvno)
 {
 	cred->kvno = kvno;
@@ -667,7 +668,7 @@ void cli_credentials_set_kvno(struct cli_credentials *cred,
  * Return Kerberos KVNO
  */
 
-int cli_credentials_get_kvno(struct cli_credentials *cred)
+_PUBLIC_ int cli_credentials_get_kvno(struct cli_credentials *cred)
 {
 	return cred->kvno;
 }
@@ -693,7 +694,7 @@ const char *cli_credentials_get_salt_principal(struct cli_credentials *cred)
 	return cred->salt_principal;
 }
 
-void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal) 
+_PUBLIC_ void cli_credentials_set_salt_principal(struct cli_credentials *cred, const char *principal) 
 {
 	cred->salt_principal = talloc_strdup(cred, principal);
 }
diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c
index 04f1d312e6..b88f2018df 100644
--- a/source4/auth/credentials/credentials_ntlm.c
+++ b/source4/auth/credentials/credentials_ntlm.c
@@ -27,7 +27,7 @@
 #include "libcli/auth/libcli_auth.h"
 #include "auth/credentials/credentials.h"
 
-void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+_PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
 					      const char **username, 
 					      const char **domain) 
 {
@@ -40,7 +40,7 @@ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALL
 	}
 }
 
-NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
 					   int *flags,
 					   DATA_BLOB challenge, DATA_BLOB target_info, 
 					   DATA_BLOB *_lm_response, DATA_BLOB *_nt_response, 
diff --git a/source4/auth/credentials/credentials_wrap.c b/source4/auth/credentials/credentials_wrap.c
index b1b904c8a3..909233aaff 100644
--- a/source4/auth/credentials/credentials_wrap.c
+++ b/source4/auth/credentials/credentials_wrap.c
@@ -2462,7 +2462,7 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 #define SWIGTYPE_p_int swig_types[3]
 #define SWIGTYPE_p_loadparm_context swig_types[4]
 #define SWIGTYPE_p_loadparm_service swig_types[5]
-#define SWIGTYPE_p_long_long swig_types[6]
+#define SWIGTYPE_p_long swig_types[6]
 #define SWIGTYPE_p_param_context swig_types[7]
 #define SWIGTYPE_p_param_opt swig_types[8]
 #define SWIGTYPE_p_param_section swig_types[9]
@@ -2470,7 +2470,7 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 #define SWIGTYPE_p_signed_char swig_types[11]
 #define SWIGTYPE_p_unsigned_char swig_types[12]
 #define SWIGTYPE_p_unsigned_int swig_types[13]
-#define SWIGTYPE_p_unsigned_long_long swig_types[14]
+#define SWIGTYPE_p_unsigned_long swig_types[14]
 #define SWIGTYPE_p_unsigned_short swig_types[15]
 static swig_type_info *swig_types[17];
 static swig_module_info swig_module = {swig_types, 16, 0, 0, 0, 0};
@@ -2525,10 +2525,20 @@ static swig_module_info swig_module = {swig_types, 16, 0, 0, 0, 0};
 typedef struct cli_credentials cli_credentials;
 
 
+  #define SWIG_From_long   PyInt_FromLong 
+
+
+SWIGINTERNINLINE PyObject *
+SWIG_From_int  (int value)
+{    
+  return SWIG_From_long  (value);
+}
+
+
 #include "librpc/gen_ndr/samr.h" /* for struct samr_Password */
 
 SWIGINTERN cli_credentials *new_cli_credentials(){
-            return cli_credentials_init_anon(NULL);
+            return cli_credentials_init(NULL);
         }
 
 SWIGINTERN swig_type_info*
@@ -3131,6 +3141,44 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Credentials_set_kerberos_state(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  cli_credentials *arg1 = (cli_credentials *) 0 ;
+  enum credentials_use_kerberos arg2 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int val2 ;
+  int ecode2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "use_kerberos", NULL 
+  };
+  
+  arg1 = NULL;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|OO:Credentials_set_kerberos_state",kwnames,&obj0,&obj1)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_cli_credentials, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Credentials_set_kerberos_state" "', argument " "1"" of type '" "cli_credentials *""'"); 
+    }
+    arg1 = (cli_credentials *)(argp1);
+  }
+  if (obj1) {
+    ecode2 = SWIG_AsVal_int(obj1, &val2);
+    if (!SWIG_IsOK(ecode2)) {
+      SWIG_exception_fail(SWIG_ArgError(ecode2), "in method '" "Credentials_set_kerberos_state" "', argument " "2"" of type '" "enum credentials_use_kerberos""'");
+    } 
+    arg2 = (enum credentials_use_kerberos)(val2);
+  }
+  cli_credentials_set_kerberos_state(arg1,arg2);
+  resultobj = SWIG_Py_Void();
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_Credentials_parse_string(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   cli_credentials *arg1 = (cli_credentials *) 0 ;
@@ -3253,6 +3301,33 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Credentials_set_anonymous(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  cli_credentials *arg1 = (cli_credentials *) 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self", NULL 
+  };
+  
+  arg1 = NULL;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:Credentials_set_anonymous",kwnames,&obj0)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_cli_credentials, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Credentials_set_anonymous" "', argument " "1"" of type '" "cli_credentials *""'"); 
+    }
+    arg1 = (cli_credentials *)(argp1);
+  }
+  cli_credentials_set_anonymous(arg1);
+  resultobj = SWIG_Py_Void();
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_Credentials_get_workstation(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   cli_credentials *arg1 = (cli_credentials *) 0 ;
@@ -3564,9 +3639,11 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"Credentials_set_domain", (PyCFunction) _wrap_Credentials_set_domain, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_get_realm", (PyCFunction) _wrap_Credentials_get_realm, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_set_realm", (PyCFunction) _wrap_Credentials_set_realm, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Credentials_set_kerberos_state", (PyCFunction) _wrap_Credentials_set_kerberos_state, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_parse_string", (PyCFunction) _wrap_Credentials_parse_string, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_get_bind_dn", (PyCFunction) _wrap_Credentials_get_bind_dn, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_set_bind_dn", (PyCFunction) _wrap_Credentials_set_bind_dn, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Credentials_set_anonymous", (PyCFunction) _wrap_Credentials_set_anonymous, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_get_workstation", (PyCFunction) _wrap_Credentials_get_workstation, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_set_workstation", (PyCFunction) _wrap_Credentials_set_workstation, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_guess", (PyCFunction) _wrap_Credentials_guess, METH_VARARGS | METH_KEYWORDS, NULL},
@@ -3587,18 +3664,18 @@ static PyMethodDef SwigMethods[] = {
 static swig_type_info _swigt__p_TALLOC_CTX = {"_p_TALLOC_CTX", "TALLOC_CTX *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_char = {"_p_char", "char *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_cli_credentials = {"_p_cli_credentials", "struct cli_credentials *|cli_credentials *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_int = {"_p_int", "intptr_t *|int *|int_least32_t *|int_fast32_t *|int32_t *|int_fast16_t *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_int = {"_p_int", "int *|int_least32_t *|int32_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_loadparm_context = {"_p_loadparm_context", "struct loadparm_context *|loadparm_context *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_loadparm_service = {"_p_loadparm_service", "struct loadparm_service *|loadparm_service *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_long_long = {"_p_long_long", "int_least64_t *|int_fast64_t *|int64_t *|long long *|intmax_t *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_long = {"_p_long", "intptr_t *|int_least64_t *|int_fast32_t *|int_fast64_t *|int64_t *|long *|int_fast16_t *|intmax_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_param_context = {"_p_param_context", "struct param_context *|param *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_param_opt = {"_p_param_opt", "struct param_opt *|param_opt *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_param_section = {"_p_param_section", "struct param_section *|param_section *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_short = {"_p_short", "short *|int_least16_t *|int16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_signed_char = {"_p_signed_char", "signed char *|int_least8_t *|int_fast8_t *|int8_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_char = {"_p_unsigned_char", "unsigned char *|uint_least8_t *|uint_fast8_t *|uint8_t *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_unsigned_int = {"_p_unsigned_int", "uintptr_t *|uint_least32_t *|uint_fast32_t *|uint32_t *|unsigned int *|uint_fast16_t *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_unsigned_long_long = {"_p_unsigned_long_long", "uint_least64_t *|uint_fast64_t *|uint64_t *|unsigned long long *|uintmax_t *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_unsigned_int = {"_p_unsigned_int", "uint_least32_t *|uint32_t *|unsigned int *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_unsigned_long = {"_p_unsigned_long", "uintptr_t *|uint_least64_t *|uint_fast32_t *|uint_fast64_t *|uint64_t *|unsigned long *|uint_fast16_t *|uintmax_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_short = {"_p_unsigned_short", "unsigned short *|uint_least16_t *|uint16_t *", 0, 0, (void*)0, 0};
 
 static swig_type_info *swig_type_initial[] = {
@@ -3608,7 +3685,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_int,
   &_swigt__p_loadparm_context,
   &_swigt__p_loadparm_service,
-  &_swigt__p_long_long,
+  &_swigt__p_long,
   &_swigt__p_param_context,
   &_swigt__p_param_opt,
   &_swigt__p_param_section,
@@ -3616,7 +3693,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_signed_char,
   &_swigt__p_unsigned_char,
   &_swigt__p_unsigned_int,
-  &_swigt__p_unsigned_long_long,
+  &_swigt__p_unsigned_long,
   &_swigt__p_unsigned_short,
 };
 
@@ -3626,7 +3703,7 @@ static swig_cast_info _swigc__p_cli_credentials[] = {  {&_swigt__p_cli_credentia
 static swig_cast_info _swigc__p_int[] = {  {&_swigt__p_int, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_loadparm_context[] = {  {&_swigt__p_loadparm_context, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_loadparm_service[] = {  {&_swigt__p_loadparm_service, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_long_long[] = {  {&_swigt__p_long_long, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_long[] = {  {&_swigt__p_long, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_param_context[] = {  {&_swigt__p_param_context, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_param_opt[] = {  {&_swigt__p_param_opt, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_param_section[] = {  {&_swigt__p_param_section, 0, 0, 0},{0, 0, 0, 0}};
@@ -3634,7 +3711,7 @@ static swig_cast_info _swigc__p_short[] = {  {&_swigt__p_short, 0, 0, 0},{0, 0,
 static swig_cast_info _swigc__p_signed_char[] = {  {&_swigt__p_signed_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_char[] = {  {&_swigt__p_unsigned_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_int[] = {  {&_swigt__p_unsigned_int, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_unsigned_long_long[] = {  {&_swigt__p_unsigned_long_long, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_unsigned_long[] = {  {&_swigt__p_unsigned_long, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_short[] = {  {&_swigt__p_unsigned_short, 0, 0, 0},{0, 0, 0, 0}};
 
 static swig_cast_info *swig_cast_initial[] = {
@@ -3644,7 +3721,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_int,
   _swigc__p_loadparm_context,
   _swigc__p_loadparm_service,
-  _swigc__p_long_long,
+  _swigc__p_long,
   _swigc__p_param_context,
   _swigc__p_param_opt,
   _swigc__p_param_section,
@@ -3652,7 +3729,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_signed_char,
   _swigc__p_unsigned_char,
   _swigc__p_unsigned_int,
-  _swigc__p_unsigned_long_long,
+  _swigc__p_unsigned_long,
   _swigc__p_unsigned_short,
 };
 
@@ -4174,5 +4251,8 @@ SWIGEXPORT void SWIG_init(void) {
   SWIG_InstallConstants(d,swig_const_table);
   
   
+  SWIG_Python_SetConstant(d, "AUTO_USE_KERBEROS",SWIG_From_int((int)(CRED_AUTO_USE_KERBEROS)));
+  SWIG_Python_SetConstant(d, "DONT_USE_KERBEROS",SWIG_From_int((int)(CRED_DONT_USE_KERBEROS)));
+  SWIG_Python_SetConstant(d, "MUST_USE_KERBEROS",SWIG_From_int((int)(CRED_MUST_USE_KERBEROS)));
 }
 
diff --git a/source4/auth/credentials/tests/bindings.py b/source4/auth/credentials/tests/bindings.py
index d2ca68d115..d0a99502c1 100644
--- a/source4/auth/credentials/tests/bindings.py
+++ b/source4/auth/credentials/tests/bindings.py
@@ -67,6 +67,8 @@ class CredentialsTests(unittest.TestCase):
         self.assertTrue(self.creds.is_anonymous())
         self.creds.set_username("somebody")
         self.assertFalse(self.creds.is_anonymous())
+        self.creds.set_anonymous()
+        self.assertTrue(self.creds.is_anonymous())
 
     def test_workstation(self):
         # FIXME: This is uninitialised, it should be None
diff --git a/source4/auth/gensec/config.mk b/source4/auth/gensec/config.mk
index 243725b235..61663d9633 100644
--- a/source4/auth/gensec/config.mk
+++ b/source4/auth/gensec/config.mk
@@ -13,7 +13,7 @@ gensec_VERSION = 0.0.1
 gensec_SOVERSION = 0
 gensec_OBJ_FILES = $(addprefix auth/gensec/, gensec.o socket.o)
 
-PUBLIC_HEADERS += $(addprefix auth/gensec/, gensec.h spnego.h)
+PUBLIC_HEADERS += auth/gensec/gensec.h
 
 ################################################
 # Start MODULE gensec_krb5
diff --git a/source4/auth/gensec/cyrus_sasl.c b/source4/auth/gensec/cyrus_sasl.c
index cb7bcb71d8..06a7b8a382 100644
--- a/source4/auth/gensec/cyrus_sasl.c
+++ b/source4/auth/gensec/cyrus_sasl.c
@@ -23,6 +23,7 @@
 #include "auth/auth.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "lib/socket/socket.h"
 #include <sasl/sasl.h>
 
diff --git a/source4/auth/gensec/gensec.c b/source4/auth/gensec/gensec.c
index b07a92d4d1..3393ce0178 100644
--- a/source4/auth/gensec/gensec.c
+++ b/source4/auth/gensec/gensec.c
@@ -26,6 +26,7 @@
 #include "librpc/rpc/dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "param/param.h"
 
 /* the list of currently registered GENSEC backends */
@@ -34,7 +35,7 @@ static int gensec_num_backends;
 
 /* Return all the registered mechs.  Don't modify the return pointer,
  * but you may talloc_reference it if convient */
-struct gensec_security_ops **gensec_security_all(void)
+_PUBLIC_ struct gensec_security_ops **gensec_security_all(void)
 {
 	return generic_security_ops;
 }
@@ -44,7 +45,7 @@ struct gensec_security_ops **gensec_security_all(void)
  * gensec_security_all(), or from cli_credentials_gensec_list() (ie,
  * an existing list we have trimmed down) */
 
-struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, 
 						       struct gensec_security_ops **old_gensec_list, 
 						       struct cli_credentials *creds)
 {
@@ -571,7 +572,7 @@ _PUBLIC_ NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx,
   @param gensec_security Returned GENSEC context pointer.
   @note  The mem_ctx is only a parent and may be NULL.
 */
-NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, 
 			     struct event_context *ev,
 			     struct loadparm_context *lp_ctx,
 			     struct messaging_context *msg,
@@ -636,7 +637,7 @@ static NTSTATUS gensec_start_mech(struct gensec_security *gensec_security)
  * @param auth_level DCERPC auth level 
  */
 
-NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security, 
 				       uint8_t auth_type, uint8_t auth_level) 
 {
 	gensec_security->ops = gensec_security_by_authtype(gensec_security, auth_type);
@@ -662,7 +663,7 @@ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
 	return gensec_start_mech(gensec_security);
 }
 
-const char *gensec_get_name_by_authtype(uint8_t authtype) 
+_PUBLIC_ const char *gensec_get_name_by_authtype(uint8_t authtype) 
 {
 	const struct gensec_security_ops *ops;
 	ops = gensec_security_by_authtype(NULL, authtype);
@@ -673,7 +674,7 @@ const char *gensec_get_name_by_authtype(uint8_t authtype)
 }
 	
 
-const char *gensec_get_name_by_oid(const char *oid_string) 
+_PUBLIC_ const char *gensec_get_name_by_oid(const char *oid_string) 
 {
 	const struct gensec_security_ops *ops;
 	ops = gensec_security_by_oid(NULL, oid_string);
@@ -703,7 +704,7 @@ NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security,
  *       well-known #define to hook it in.
  */
 
-NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security, 
 				  const char *mech_oid) 
 {
 	gensec_security->ops = gensec_security_by_oid(gensec_security, mech_oid);
@@ -719,7 +720,7 @@ NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security,
  *
  */
 
-NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, 
 					const char *sasl_name) 
 {
 	gensec_security->ops = gensec_security_by_sasl_name(gensec_security, sasl_name);
@@ -768,7 +769,7 @@ _PUBLIC_ NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_
  *
  */
 
-NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security, 
 					const char *name) 
 {
 	gensec_security->ops = gensec_security_by_name(gensec_security, name);
@@ -782,7 +783,7 @@ NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security,
 /*
   wrappers for the gensec function pointers
 */
-NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security, 
 			      TALLOC_CTX *mem_ctx, 
 			      uint8_t *data, size_t length, 
 			      const uint8_t *whole_pdu, size_t pdu_length, 
@@ -801,7 +802,7 @@ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
 						   sig);
 }
 
-NTSTATUS gensec_check_packet(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security, 
 			     TALLOC_CTX *mem_ctx, 
 			     const uint8_t *data, size_t length, 
 			     const uint8_t *whole_pdu, size_t pdu_length, 
@@ -817,7 +818,7 @@ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
 	return gensec_security->ops->check_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 }
 
-NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security, 
 			    TALLOC_CTX *mem_ctx, 
 			    uint8_t *data, size_t length, 
 			    const uint8_t *whole_pdu, size_t pdu_length, 
@@ -833,7 +834,7 @@ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
 	return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 }
 
-NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security, 
 			    TALLOC_CTX *mem_ctx, 
 			    const uint8_t *data, size_t length, 
 			    const uint8_t *whole_pdu, size_t pdu_length, 
@@ -849,7 +850,7 @@ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
 	return gensec_security->ops->sign_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 }
 
-size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size) 
+_PUBLIC_ size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size) 
 {
 	if (!gensec_security->ops->sig_size) {
 		return 0;
@@ -879,7 +880,7 @@ size_t gensec_max_input_size(struct gensec_security *gensec_security)
 	return gensec_security->ops->max_input_size(gensec_security);
 }
 
-NTSTATUS gensec_wrap(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_wrap(struct gensec_security *gensec_security, 
 		     TALLOC_CTX *mem_ctx, 
 		     const DATA_BLOB *in, 
 		     DATA_BLOB *out) 
@@ -890,7 +891,7 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security,
 	return gensec_security->ops->wrap(gensec_security, mem_ctx, in, out);
 }
 
-NTSTATUS gensec_unwrap(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security, 
 		       TALLOC_CTX *mem_ctx, 
 		       const DATA_BLOB *in, 
 		       DATA_BLOB *out) 
@@ -901,7 +902,7 @@ NTSTATUS gensec_unwrap(struct gensec_security *gensec_security,
 	return gensec_security->ops->unwrap(gensec_security, mem_ctx, in, out);
 }
 
-NTSTATUS gensec_session_key(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security, 
 			    DATA_BLOB *session_key)
 {
 	if (!gensec_security->ops->session_key) {
@@ -924,7 +925,7 @@ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
  *
  */
 
-NTSTATUS gensec_session_info(struct gensec_security *gensec_security, 
+_PUBLIC_ NTSTATUS gensec_session_info(struct gensec_security *gensec_security, 
 			     struct auth_session_info **session_info)
 {
 	if (!gensec_security->ops->session_info) {
@@ -1064,7 +1065,7 @@ _PUBLIC_ NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security
  *
  */
 
-struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security) 
+_PUBLIC_ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security) 
 {
 	if (!gensec_security) {
 		return NULL;
@@ -1134,7 +1135,7 @@ _PUBLIC_ const char *gensec_get_target_hostname(struct gensec_security *gensec_s
  * cryptographic tokens, to avoid certain attacks.
  */
 
-NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr) 
+_PUBLIC_ NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr) 
 {
 	gensec_security->my_addr = my_addr;
 	if (my_addr && !talloc_reference(gensec_security, my_addr)) {
@@ -1143,7 +1144,7 @@ NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct sock
 	return NT_STATUS_OK;
 }
 
-NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr) 
+_PUBLIC_ NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr) 
 {
 	gensec_security->peer_addr = peer_addr;
 	if (peer_addr && !talloc_reference(gensec_security, peer_addr)) {
@@ -1163,7 +1164,7 @@ struct socket_address *gensec_get_my_addr(struct gensec_security *gensec_securit
 	return NULL;
 }
 
-struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security) 
+_PUBLIC_ struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security) 
 {
 	if (gensec_security->peer_addr) {
 		return gensec_security->peer_addr;
@@ -1263,7 +1264,7 @@ static int sort_gensec(struct gensec_security_ops **gs1, struct gensec_security_
 /*
   initialise the GENSEC subsystem
 */
-NTSTATUS gensec_init(struct loadparm_context *lp_ctx)
+_PUBLIC_ NTSTATUS gensec_init(struct loadparm_context *lp_ctx)
 {
 	static bool initialized = false;
 	extern NTSTATUS gensec_sasl_init(void);
diff --git a/source4/auth/gensec/gensec.h b/source4/auth/gensec/gensec.h
index 3413e5c8ce..7a1abfbc3b 100644
--- a/source4/auth/gensec/gensec.h
+++ b/source4/auth/gensec/gensec.h
@@ -199,6 +199,96 @@ NTSTATUS gensec_packet_full_request(struct gensec_security *gensec_security,
 
 struct loadparm_context;
 
-#include "auth/gensec/gensec_proto.h"
+NTSTATUS gensec_subcontext_start(TALLOC_CTX *mem_ctx, 
+				 struct gensec_security *parent, 
+				 struct gensec_security **gensec_security);
+NTSTATUS gensec_client_start(TALLOC_CTX *mem_ctx, 
+			     struct gensec_security **gensec_security,
+			     struct event_context *ev,
+			     struct loadparm_context *lp_ctx);
+NTSTATUS gensec_start_mech_by_sasl_list(struct gensec_security *gensec_security, 
+						 const char **sasl_names);
+NTSTATUS gensec_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, 
+		       const DATA_BLOB in, DATA_BLOB *out);
+void gensec_update_send(struct gensec_security *gensec_security, const DATA_BLOB in,
+				 void (*callback)(struct gensec_update_request *req, void *private_data),
+				 void *private_data);
+NTSTATUS gensec_update_recv(struct gensec_update_request *req, TALLOC_CTX *out_mem_ctx, DATA_BLOB *out);
+void gensec_want_feature(struct gensec_security *gensec_security,
+			 uint32_t feature);
+bool gensec_have_feature(struct gensec_security *gensec_security,
+			 uint32_t feature);
+NTSTATUS gensec_set_credentials(struct gensec_security *gensec_security, struct cli_credentials *credentials);
+NTSTATUS gensec_set_target_service(struct gensec_security *gensec_security, const char *service);
+const char *gensec_get_target_service(struct gensec_security *gensec_security);
+NTSTATUS gensec_set_target_hostname(struct gensec_security *gensec_security, const char *hostname);
+const char *gensec_get_target_hostname(struct gensec_security *gensec_security);
+NTSTATUS gensec_session_key(struct gensec_security *gensec_security, 
+			    DATA_BLOB *session_key);
+NTSTATUS gensec_start_mech_by_oid(struct gensec_security *gensec_security, 
+				  const char *mech_oid);
+const char *gensec_get_name_by_oid(const char *oid_string);
+struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_security);
+struct socket_address *gensec_get_peer_addr(struct gensec_security *gensec_security);
+NTSTATUS gensec_init(struct loadparm_context *lp_ctx);
+NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security, 
+			      TALLOC_CTX *mem_ctx, 
+			      uint8_t *data, size_t length, 
+			      const uint8_t *whole_pdu, size_t pdu_length, 
+			      const DATA_BLOB *sig);
+NTSTATUS gensec_check_packet(struct gensec_security *gensec_security, 
+			     TALLOC_CTX *mem_ctx, 
+			     const uint8_t *data, size_t length, 
+			     const uint8_t *whole_pdu, size_t pdu_length, 
+			     const DATA_BLOB *sig);
+size_t gensec_sig_size(struct gensec_security *gensec_security, size_t data_size);
+NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security, 
+			    TALLOC_CTX *mem_ctx, 
+			    uint8_t *data, size_t length, 
+			    const uint8_t *whole_pdu, size_t pdu_length, 
+			    DATA_BLOB *sig);
+NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security, 
+			    TALLOC_CTX *mem_ctx, 
+			    const uint8_t *data, size_t length, 
+			    const uint8_t *whole_pdu, size_t pdu_length, 
+			    DATA_BLOB *sig);
+NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security, 
+				       uint8_t auth_type, uint8_t auth_level);
+const char *gensec_get_name_by_authtype(uint8_t authtype);
+NTSTATUS gensec_server_start(TALLOC_CTX *mem_ctx, 
+			     struct event_context *ev,
+			     struct loadparm_context *lp_ctx,
+			     struct messaging_context *msg,
+			     struct gensec_security **gensec_security);
+NTSTATUS gensec_session_info(struct gensec_security *gensec_security, 
+			     struct auth_session_info **session_info);
+NTSTATUS auth_nt_status_squash(NTSTATUS nt_status);
+struct creds_CredentialState;
+NTSTATUS dcerpc_schannel_creds(struct gensec_security *gensec_security,
+			       TALLOC_CTX *mem_ctx,
+			       struct creds_CredentialState **creds);
+NTSTATUS gensec_set_peer_addr(struct gensec_security *gensec_security, struct socket_address *peer_addr);
+NTSTATUS gensec_set_my_addr(struct gensec_security *gensec_security, struct socket_address *my_addr);
+
+NTSTATUS gensec_start_mech_by_name(struct gensec_security *gensec_security, 
+					const char *name);
+
+NTSTATUS gensec_unwrap(struct gensec_security *gensec_security, 
+		       TALLOC_CTX *mem_ctx, 
+		       const DATA_BLOB *in, 
+		       DATA_BLOB *out);
+NTSTATUS gensec_wrap(struct gensec_security *gensec_security, 
+		     TALLOC_CTX *mem_ctx, 
+		     const DATA_BLOB *in, 
+		     DATA_BLOB *out);
+
+struct gensec_security_ops **gensec_security_all(void);
+struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, 
+						       struct gensec_security_ops **old_gensec_list, 
+						       struct cli_credentials *creds);
+
+NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, 
+					const char *sasl_name);
+
 
 #endif /* __GENSEC_H__ */
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index d8cdb90197..e7dcb4ea68 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -34,7 +34,9 @@
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
 enum gensec_gssapi_sasl_state 
 {
diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index 88432c7f89..ae601b19c2 100644
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -36,7 +36,9 @@
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_krb5.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
 enum GENSEC_KRB5_STATE {
 	GENSEC_KRB5_SERVER_START,
diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 96e3478982..b3117ee9b2 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -25,11 +25,13 @@
 #include "auth/auth.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "auth/gensec/schannel.h"
 #include "auth/gensec/schannel_state.h"
 #include "auth/gensec/schannel_proto.h"
 #include "librpc/rpc/dcerpc.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
 static size_t schannel_sig_size(struct gensec_security *gensec_security, size_t data_size)
 {
diff --git a/source4/auth/gensec/socket.c b/source4/auth/gensec/socket.c
index 4dc05e8cc4..27449bf610 100644
--- a/source4/auth/gensec/socket.c
+++ b/source4/auth/gensec/socket.c
@@ -24,6 +24,7 @@
 #include "lib/socket/socket.h"
 #include "lib/stream/packet.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 
 static const struct socket_ops gensec_socket_ops;
 
diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index f593d17d4b..1544326bb1 100644
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -26,6 +26,7 @@
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 
 enum spnego_state_position {
 	SPNEGO_SERVER_START,
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index e905e3e704..9002715065 100644
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -24,6 +24,7 @@
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_proto.h"
 #include "auth/credentials/credentials_krb5.h"
 
 struct principal_container {
@@ -634,7 +635,7 @@ int smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
 	return ret;
 }
 
-_PUBLIC_ int smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
+int smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
 					   struct cli_credentials *machine_account,
 					   struct smb_krb5_context *smb_krb5_context,
 					   const char **enctype_strings,
diff --git a/source4/auth/ntlmssp/ntlmssp.c b/source4/auth/ntlmssp/ntlmssp.c
index 8901488004..64bfebd3d1 100644
--- a/source4/auth/ntlmssp/ntlmssp.c
+++ b/source4/auth/ntlmssp/ntlmssp.c
@@ -27,7 +27,9 @@
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "param/param.h"
 
 /**
diff --git a/source4/auth/ntlmssp/ntlmssp.h b/source4/auth/ntlmssp/ntlmssp.h
index 5efc0a2eb1..df950e4756 100644
--- a/source4/auth/ntlmssp/ntlmssp.h
+++ b/source4/auth/ntlmssp/ntlmssp.h
@@ -186,4 +186,5 @@ struct gensec_ntlmssp_state
 
 struct loadparm_context;
 struct auth_session_info;
+
 #include "auth/ntlmssp/proto.h"
diff --git a/source4/auth/ntlmssp/ntlmssp_server.c b/source4/auth/ntlmssp/ntlmssp_server.c
index eb6dbc5bca..12802b7e79 100644
--- a/source4/auth/ntlmssp/ntlmssp_server.c
+++ b/source4/auth/ntlmssp/ntlmssp_server.c
@@ -30,7 +30,9 @@
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "auth/auth.h"
+#include "auth/auth_proto.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
 /** 
  * Set a username on an NTLMSSP context - ensures it is talloc()ed 
diff --git a/source4/auth/ntlmssp/ntlmssp_sign.c b/source4/auth/ntlmssp/ntlmssp_sign.c
index b003dc865f..063b16f539 100644
--- a/source4/auth/ntlmssp/ntlmssp_sign.c
+++ b/source4/auth/ntlmssp/ntlmssp_sign.c
@@ -134,7 +134,7 @@ static NTSTATUS ntlmssp_make_packet_signature(struct gensec_ntlmssp_state *gense
 }
 
 /* TODO: make this non-public */
-_PUBLIC_ NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security, 
+NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security, 
 				    TALLOC_CTX *sig_mem_ctx, 
 				    const uint8_t *data, size_t length, 
 				    const uint8_t *whole_pdu, size_t pdu_length, 
@@ -306,7 +306,7 @@ NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
    Initialise the state for NTLMSSP signing.
 */
 /* TODO: make this non-public */
-_PUBLIC_ NTSTATUS ntlmssp_sign_init(struct gensec_ntlmssp_state *gensec_ntlmssp_state)
+NTSTATUS ntlmssp_sign_init(struct gensec_ntlmssp_state *gensec_ntlmssp_state)
 {
 	TALLOC_CTX *mem_ctx = talloc_new(gensec_ntlmssp_state);
 
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index b171fc57b9..ed44754993 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -383,7 +383,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	return NT_STATUS_OK;
 }
 
-_PUBLIC_ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
+NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
 				   TALLOC_CTX *mem_ctx, const char *principal,
 				   struct ldb_message ***msgs,
 				   struct ldb_message ***msgs_domain_ref)
diff --git a/source4/auth/session.c b/source4/auth/session.c
index c86fff90df..112eac95d8 100644
--- a/source4/auth/session.c
+++ b/source4/auth/session.c
@@ -28,8 +28,9 @@
 #include "dsdb/samdb/samdb.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
+#include "auth/session_proto.h"
 
-struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx, 
 					    struct loadparm_context *lp_ctx) 
 {
 	NTSTATUS nt_status;
@@ -41,7 +42,7 @@ struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx,
 	return session_info;
 }
 
-NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx, 
+_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx, 
 				     struct loadparm_context *lp_ctx,
 				     struct auth_session_info **_session_info) 
 {
@@ -77,7 +78,7 @@ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
 	return NT_STATUS_OK;
 }
 
-NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx, 
 				    const char *netbios_name,
 				    struct auth_serversupplied_info **_server_info) 
 {
@@ -149,7 +150,7 @@ NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx,
 	return NT_STATUS_OK;
 }
 
-NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx, 
 				    struct loadparm_context *lp_ctx,
 				    struct auth_serversupplied_info *server_info, 
 				    struct auth_session_info **_session_info) 
@@ -199,7 +200,7 @@ void auth_session_info_debug(int dbg_lev,
 /**
  * Make a server_info struct from the info3 returned by a domain logon 
  */
-NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
 					      const char *account_name,
 					      uint16_t validation_level,
 					      union netr_Validation *validation,
diff --git a/source4/auth/session.h b/source4/auth/session.h
index 039c005bb0..87fc47791a 100644
--- a/source4/auth/session.h
+++ b/source4/auth/session.h
@@ -29,6 +29,28 @@ struct auth_session_info {
 };
 
 #include "librpc/gen_ndr/netlogon.h"
-#include "auth/session_proto.h"
+
+struct auth_session_info *system_session_anon(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx) ;
+NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx, 
+				    const char *netbios_name,
+				    struct auth_serversupplied_info **_server_info) ;
+NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx, 
+				    struct loadparm_context *lp_ctx,
+				    struct auth_serversupplied_info *server_info, 
+				    struct auth_session_info **_session_info) ;
+
+NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
+					      const char *account_name,
+					      uint16_t validation_level,
+					      union netr_Validation *validation,
+					      struct auth_serversupplied_info **_server_info);
+NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx, 
+				     struct loadparm_context *lp_ctx,
+				     struct auth_session_info **_session_info);
+
+struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx, 
+					    struct loadparm_context *lp_ctx);
+
 
 #endif /* _SAMBA_AUTH_SESSION_H */
diff --git a/source4/build/make/rules.mk b/source4/build/make/rules.mk
index 3ff9f2b933..faefb4e323 100644
--- a/source4/build/make/rules.mk
+++ b/source4/build/make/rules.mk
@@ -122,7 +122,7 @@ endef
 define proto_header_template
 $(1): $(2) ;
 	@echo "Creating $$@"
-	@$$(PERL) $$(srcdir)/script/mkproto.pl --srcdir=$$(srcdir) --builddir=$$(builddir) --all=$$@ $$^
+	@$$(PERL) $$(srcdir)/script/mkproto.pl --srcdir=$$(srcdir) --builddir=$$(builddir) --public=/dev/null --private=$$@ $$^
 endef
 
 # Shared module
diff --git a/source4/build/pasn1/asn1.yp b/source4/build/pasn1/asn1.yp
index 9a77bbc31a..7fc834ff2b 100644
--- a/source4/build/pasn1/asn1.yp
+++ b/source4/build/pasn1/asn1.yp
@@ -1,7 +1,7 @@
 ########################
 # ASN.1 Parse::Yapp parser
 # Copyright (C) Stefan (metze) Metzmacher <metze@samba.org>
-# released under the GNU GPL version 2 or later
+# released under the GNU GPL version 3 or later
 
 
 
diff --git a/source4/cldap_server/cldap_server.h b/source4/cldap_server/cldap_server.h
index e683d2b83f..da2bd20050 100644
--- a/source4/cldap_server/cldap_server.h
+++ b/source4/cldap_server/cldap_server.h
@@ -29,4 +29,6 @@ struct cldapd_server {
 	struct ldb_context *samctx;
 };
 
+struct ldap_SearchRequest;
+
 #include "cldap_server/proto.h"
diff --git a/source4/client/client.c b/source4/client/client.c
index d9478a3a8a..775aa69d37 100644
--- a/source4/client/client.c
+++ b/source4/client/client.c
@@ -50,6 +50,7 @@
 #include "lib/smbreadline/smbreadline.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
 #include "param/param.h"
+#include "librpc/rpc/dcerpc.h"
 
 struct smbclient_context {
 	char *remote_cur_dir;
diff --git a/source4/client/config.mk b/source4/client/config.mk
index 513c05dfb3..5cfa542fba 100644
--- a/source4/client/config.mk
+++ b/source4/client/config.mk
@@ -5,7 +5,7 @@
 [BINARY::smbclient]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		SMBREADLINE \
 		LIBSAMBA-UTIL \
 		LIBCLI_SMB \
@@ -25,7 +25,7 @@ smbclient_OBJ_FILES = client/client.o
 [BINARY::cifsdd]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBCLI_SMB \
 		LIBPOPT \
 		POPT_SAMBA \
diff --git a/source4/configure.ac b/source4/configure.ac
index 41f1bcf054..66fb69694e 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -26,14 +26,16 @@ m4_include(lib/popt/samba.m4)
 m4_include(lib/charset/config.m4)
 m4_include(lib/socket/config.m4)
 m4_include(nsswitch/nsstest.m4)
+m4_include(pidl/config.m4)
 
 AC_CONFIG_FILES(lib/registry/registry.pc)
 AC_CONFIG_FILES(librpc/dcerpc.pc)
 AC_CONFIG_FILES(librpc/ndr.pc)
 AC_CONFIG_FILES(torture/torture.pc)
 AC_CONFIG_FILES(auth/gensec/gensec.pc)
-AC_CONFIG_FILES(param/samba-config.pc)
+AC_CONFIG_FILES(param/samba-hostconfig.pc)
 AC_CONFIG_FILES(librpc/dcerpc_samr.pc)
+AC_CONFIG_FILES(librpc/dcerpc_atsvc.pc)
 
 SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= 1.2.0,
 	[],
diff --git a/source4/dsdb/common/sidmap.c b/source4/dsdb/common/sidmap.c
index 088dc6bd96..2144d61dfc 100644
--- a/source4/dsdb/common/sidmap.c
+++ b/source4/dsdb/common/sidmap.c
@@ -49,7 +49,7 @@ struct sidmap_context {
 /*
   open a sidmap context - use talloc_free to close
 */
-_PUBLIC_ struct sidmap_context *sidmap_open(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+struct sidmap_context *sidmap_open(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
 	struct sidmap_context *sidmap;
 	sidmap = talloc(mem_ctx, struct sidmap_context);
@@ -123,7 +123,7 @@ static NTSTATUS sidmap_primary_domain_sid(struct sidmap_context *sidmap,
 /*
   map a sid to a unix uid
 */
-_PUBLIC_ NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap,
+NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap,
 					const struct dom_sid *sid, uid_t *uid)
 {
 	const char *attrs[] = { "sAMAccountName", "uidNumber",
@@ -221,7 +221,7 @@ allocated_sid:
 /*
   see if a sid is a group - very inefficient!
 */
-_PUBLIC_ bool sidmap_sid_is_group(struct sidmap_context *sidmap, struct dom_sid *sid)
+bool sidmap_sid_is_group(struct sidmap_context *sidmap, struct dom_sid *sid)
 {
 	const char *attrs[] = { "sAMAccountType", NULL };
 	int ret;
@@ -262,7 +262,7 @@ _PUBLIC_ bool sidmap_sid_is_group(struct sidmap_context *sidmap, struct dom_sid
 /*
   map a sid to a unix gid
 */
-_PUBLIC_ NTSTATUS sidmap_sid_to_unixgid(struct sidmap_context *sidmap,
+NTSTATUS sidmap_sid_to_unixgid(struct sidmap_context *sidmap,
 					const struct dom_sid *sid, gid_t *gid)
 {
 	const char *attrs[] = { "sAMAccountName", "gidNumber",
@@ -355,7 +355,7 @@ allocated_sid:
   map a unix uid to a dom_sid
   the returned sid is allocated in the supplied mem_ctx
 */
-_PUBLIC_ NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap,
+NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap,
 				    TALLOC_CTX *mem_ctx,
 				    const uid_t uid, struct dom_sid **sid)
 {
@@ -453,7 +453,7 @@ allocate_sid:
   map a unix gid to a dom_sid
   the returned sid is allocated in the supplied mem_ctx
 */
-_PUBLIC_ NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap,
+NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap,
 				    TALLOC_CTX *mem_ctx,
 				    const gid_t gid, struct dom_sid **sid)
 {
@@ -550,7 +550,7 @@ allocate_sid:
   check if a sid is in the range of auto-allocated SIDs from our primary domain,
   and if it is, then return the name and atype
 */
-_PUBLIC_ NTSTATUS sidmap_allocated_sid_lookup(struct sidmap_context *sidmap, 
+NTSTATUS sidmap_allocated_sid_lookup(struct sidmap_context *sidmap, 
 					      TALLOC_CTX *mem_ctx, 
 					      const struct dom_sid *sid,
 					      const char **name,
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index 1220a5c855..5164f7d181 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -28,6 +28,7 @@
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
 #include "librpc/gen_ndr/ndr_security.h"
+#include "librpc/gen_ndr/ndr_misc.h"
 #include "dsdb/common/flags.h"
 #include "dsdb/common/proto.h"
 #include "libcli/ldap/ldap_ndr.h"
@@ -1530,7 +1531,7 @@ static bool samdb_password_complexity_ok(const char *pass)
 
   The caller should probably have a transaction wrapping this
 */
-_PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
+NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
 			    struct ldb_dn *user_dn,
 			    struct ldb_dn *domain_dn,
 			    struct ldb_message *mod,
@@ -1770,7 +1771,7 @@ _PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ct
   and actually performs the password change
 
 */
-_PUBLIC_ NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
+NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
 				const struct dom_sid *user_sid,
 				const char *new_pass,
 				struct samr_Password *lmNewHash, 
diff --git a/source4/dsdb/config.mk b/source4/dsdb/config.mk
index 7e943c3634..e621391617 100644
--- a/source4/dsdb/config.mk
+++ b/source4/dsdb/config.mk
@@ -18,7 +18,7 @@ SAMDB_OBJ_FILES = $(addprefix dsdb/, \
 		samdb/cracknames.o \
 		repl/replicated_objects.o)
 
-PUBLIC_HEADERS += dsdb/samdb/samdb.h
+# PUBLIC_HEADERS += dsdb/samdb/samdb.h
 
 [SUBSYSTEM::SAMDB_COMMON]
 PRIVATE_PROTO_HEADER = common/proto.h
@@ -38,7 +38,7 @@ SAMDB_SCHEMA_OBJ_FILES = $(addprefix dsdb/schema/, \
 		schema_syntax.o \
 		schema_constructed.o)
 
-PUBLIC_HEADERS += dsdb/schema/schema.h
+# PUBLIC_HEADERS += dsdb/schema/schema.h
 
 #######################
 # Start SUBSYSTEM DREPL_SRV
diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index 8685c722aa..04b9987071 100644
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -520,6 +520,12 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, attrs);
 			
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+
 			/* Create a spot in the list for the requests */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
 						      struct ldb_request *, ac->num_requests + 1);
@@ -568,6 +574,12 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, attrs);
 			
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+
 			/* Create a spot in the list for the requests */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
 						      struct ldb_request *, ac->num_requests + 1);
@@ -629,7 +641,11 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, new_msg);
 			
-			ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
 			
 			/* Now add it to the list */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
@@ -752,6 +768,12 @@ static int linked_attributes_rename(struct ldb_module *module, struct ldb_reques
 
 	talloc_steal(new_req, attrs);
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->search_req = new_req;
 	ac->step = LA_SEARCH;
 	return ldb_next_request(module, new_req);
@@ -805,6 +827,12 @@ static int linked_attributes_delete(struct ldb_module *module, struct ldb_reques
 
 	talloc_steal(new_req, attrs);
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->search_req = new_req;
 	ac->step = LA_SEARCH;
 	return ldb_next_request(module, new_req);
diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index 78b5a09f78..7f136338be 100644
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -6,7 +6,7 @@
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
 
    * NOTICE: this module is NOT released under the GNU LGPL license as
-   * other ldb code. This module is release under the GNU GPL v2 or
+   * other ldb code. This module is release under the GNU GPL v3 or
    * later license.
 
    This program is free software; you can redistribute it and/or modify
@@ -87,7 +87,7 @@ static struct ldb_module *make_module_for_next_request(TALLOC_CTX *mem_ctx,
 						       struct ldb_module *module)
 {
 	struct ldb_module *current;
-_PUBLIC_ 	static const struct ldb_module_ops ops; /* zero */
+	static const struct ldb_module_ops ops; /* zero */
 	current = talloc_zero(mem_ctx, struct ldb_module);
 	if (current == NULL) {
 		return module;
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 5407db9956..3b67ca19d3 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -5,7 +5,7 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
 
    * NOTICE: this module is NOT released under the GNU LGPL license as
-   * other ldb code. This module is release under the GNU GPL v2 or
+   * other ldb code. This module is release under the GNU GPL v3 or
    * later license.
 
    This program is free software; you can redistribute it and/or modify
diff --git a/source4/dsdb/samdb/ldb_modules/schema.c b/source4/dsdb/samdb/ldb_modules/schema.c
index ff9530ca92..f2c4d38305 100644
--- a/source4/dsdb/samdb/ldb_modules/schema.c
+++ b/source4/dsdb/samdb/ldb_modules/schema.c
@@ -25,8 +25,6 @@
  *  Description: add schema check functionality
  *
  *  Author: Simo Sorce
- *
- *  License: GNU GPL v2 or Later
  */
 
 #include "includes.h"
diff --git a/source4/dsdb/samdb/ldb_modules/schema_syntax.c b/source4/dsdb/samdb/ldb_modules/schema_syntax.c
index f737cc6fdc..d800e4b6d2 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_syntax.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_syntax.c
@@ -25,8 +25,6 @@
  *  Description: add schema syntax functionality
  *
  *  Author: Simo Sorce
- *
- *  License: GNU GPL v2 or Later
  */
 
 #include "includes.h"
diff --git a/source4/dsdb/samdb/ldb_modules/schema_syntax.h b/source4/dsdb/samdb/ldb_modules/schema_syntax.h
index fa3fdbe5a2..37f7584d41 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_syntax.h
+++ b/source4/dsdb/samdb/ldb_modules/schema_syntax.h
@@ -25,8 +25,6 @@
  *  Description: add schema syntax functionality
  *
  *  Author: Simo Sorce
- *
- *  License: GNU GPL v2 or Later
  */
 
 
diff --git a/source4/dsdb/samdb/ldb_modules/subtree_delete.c b/source4/dsdb/samdb/ldb_modules/subtree_delete.c
index 56ae7b239a..9c332d2969 100644
--- a/source4/dsdb/samdb/ldb_modules/subtree_delete.c
+++ b/source4/dsdb/samdb/ldb_modules/subtree_delete.c
@@ -160,6 +160,12 @@ static int subtree_delete(struct ldb_module *module, struct ldb_request *req)
 		return ret;
 	}
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->search_req = new_req;
 	if (req == NULL) {
 		ldb_oom(ac->module->ldb);
diff --git a/source4/dsdb/samdb/ldb_modules/subtree_rename.c b/source4/dsdb/samdb/ldb_modules/subtree_rename.c
index bf8124e253..fd1388d416 100644
--- a/source4/dsdb/samdb/ldb_modules/subtree_rename.c
+++ b/source4/dsdb/samdb/ldb_modules/subtree_rename.c
@@ -117,7 +117,15 @@ static int subtree_rename_search_callback(struct ldb_context *ldb, void *context
 					   NULL,
 					   NULL);
 		
-		if (ret != LDB_SUCCESS) return ret;
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		ret = ldb_set_timeout_from_prev_req(ldb, ac->orig_req, req);
+		
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
 
 		talloc_steal(req, newdn);
 
@@ -186,6 +194,12 @@ static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 		return ret;
 	}
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+	
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->down_req = talloc_realloc(ac, ac->down_req, 
 					struct ldb_request *, ac->num_requests + 1);
 	if (!ac->down_req) {
diff --git a/source4/dsdb/samdb/samdb_privilege.c b/source4/dsdb/samdb/samdb_privilege.c
index 3945dbb14b..5c2de81816 100644
--- a/source4/dsdb/samdb/samdb_privilege.c
+++ b/source4/dsdb/samdb/samdb_privilege.c
@@ -73,7 +73,7 @@ static NTSTATUS samdb_privilege_setup_sid(void *samctx, TALLOC_CTX *mem_ctx,
   setup the privilege mask for this security token based on our
   local SAM
 */
-_PUBLIC_ NTSTATUS samdb_privilege_setup(struct loadparm_context *lp_ctx, struct security_token *token)
+NTSTATUS samdb_privilege_setup(struct loadparm_context *lp_ctx, struct security_token *token)
 {
 	void *samctx;
 	TALLOC_CTX *mem_ctx;
diff --git a/source4/headermap.txt b/source4/headermap.txt
index 70ca92c01c..fbfc56e127 100644
--- a/source4/headermap.txt
+++ b/source4/headermap.txt
@@ -1,6 +1,5 @@
 # FIXME: This file should be autogenerated by the build system at some 
 # point
-lib/talloc/talloc.h: talloc.h
 lib/util/util.h: util.h
 lib/util/debug.h: util/debug.h
 lib/util/mutex.h: util/mutex.h
@@ -10,114 +9,65 @@ lib/util/safe_string.h: util/safe_string.h
 lib/util/xfile.h: util/xfile.h
 lib/tdr/tdr.h: tdr.h
 librpc/rpc/dcerpc.h: dcerpc.h
-lib/socket_wrapper/socket_wrapper.h: socket_wrapper.h
-lib/nss_wrapper/nss_wrapper.h: nss_wrapper.h
-libnet/libnet.h: libnet.h
-libnet/libnet_join.h: libnet/join.h
-libnet/libnet_lookup.h: libnet/lookup.h
-libnet/libnet_passwd.h: libnet/passwd.h
-libnet/libnet_rpc.h: libnet/rpc.h
-libnet/libnet_share.h: libnet/share.h
-libnet/libnet_time.h: libnet/time.h
-libnet/libnet_user.h: libnet/user.h
-libnet/libnet_site.h: libnet/site.h
-libnet/libnet_vampire.h: libnet/vampire.h
-libnet/userinfo.h: libnet/userinfo.h
-libnet/userman.h: libnet/userman.h
 lib/ldb/include/ldb.h: ldb.h
 lib/ldb/include/ldb_errors.h: ldb_errors.h
-ntvfs/ntvfs.h: ntvfs.h
-lib/tdb/include/tdb.h: tdb.h
 auth/gensec/gensec.h: gensec.h
-gtk/common/gtk-smb.h: gtk-smb.h
-gtk/common/select.h: gtk/select.h
 librpc/ndr/libndr.h: ndr.h
-lib/registry/registry.h: registry/registry.h
-lib/registry/hive.h: registry/hive.h
-lib/registry/patchfile.h: registry/patchfile.h
+lib/registry/registry.h: registry.h
 libcli/util/werror.h: core/werror.h
 libcli/util/doserr.h: core/doserr.h
 libcli/util/ntstatus.h: core/ntstatus.h
 libcli/cldap/cldap.h: cldap.h
-lib/samba3/samba3.h: samba3.h
 librpc/gen_ndr/dcerpc.h: gen_ndr/dcerpc.h
 librpc/gen_ndr/netlogon.h: gen_ndr/netlogon.h
 librpc/gen_ndr/ndr_misc.h: gen_ndr/ndr_misc.h
 librpc/gen_ndr/ndr_dcerpc.h: gen_ndr/ndr_dcerpc.h
-librpc/gen_ndr/mgmt.h: dcerpc/mgmt.h
-librpc/gen_ndr/ndr_mgmt.h: dcerpc/ndr_mgmt.h
-librpc/gen_ndr/ndr_mgmt_c.h: dcerpc/ndr_mgmt_c.h
-librpc/gen_ndr/epmapper.h: dcerpc/epmapper.h
-librpc/gen_ndr/ndr_epmapper.h: dcerpc/ndr_epmapper.h
-librpc/gen_ndr/ndr_epmapper_c.h: dcerpc/ndr_epmapper_c.h
-librpc/gen_ndr/ndr_atsvc.h: dcerpc/ndr_atsvc.h
-librpc/gen_ndr/atsvc.h: dcerpc/atsvc.h
-librpc/gen_ndr/ndr_atsvc_c.h: dcerpc/ndr_atsvc_c.h
+librpc/gen_ndr/mgmt.h: gen_ndr/mgmt.h
+librpc/gen_ndr/ndr_mgmt.h: gen_ndr/ndr_mgmt.h
+librpc/gen_ndr/ndr_mgmt_c.h: gen_ndr/ndr_mgmt_c.h
+librpc/gen_ndr/epmapper.h: gen_ndr/epmapper.h
+librpc/gen_ndr/ndr_epmapper.h: gen_ndr/ndr_epmapper.h
+librpc/gen_ndr/ndr_epmapper_c.h: gen_ndr/ndr_epmapper_c.h
+librpc/gen_ndr/ndr_atsvc.h: gen_ndr/ndr_atsvc.h
+librpc/gen_ndr/atsvc.h: gen_ndr/atsvc.h
+librpc/gen_ndr/ndr_atsvc_c.h: gen_ndr/ndr_atsvc_c.h
 librpc/gen_ndr/misc.h: gen_ndr/misc.h
 librpc/gen_ndr/lsa.h: gen_ndr/lsa.h
-librpc/gen_ndr/samr.h: dcerpc/samr.h
-librpc/gen_ndr/ndr_samr.h: dcerpc/ndr_samr.h
-librpc/gen_ndr/ndr_samr_c.h: dcerpc/ndr_samr_c.h
+librpc/gen_ndr/samr.h: gen_ndr/samr.h
+librpc/gen_ndr/ndr_samr.h: gen_ndr/ndr_samr.h
+librpc/gen_ndr/ndr_samr_c.h: gen_ndr/ndr_samr_c.h
 librpc/gen_ndr/security.h: gen_ndr/security.h
-librpc/ndr/libndr_proto.h: ndr/proto.h
-librpc/rpc/dcerpc_proto.h: dcerpc/proto.h
-lib/tdr/tdr_proto.h: tdr/proto.h
 auth/credentials/credentials.h: credentials.h
-auth/credentials/credentials_proto.h: credentials/proto.h
 auth/credentials/credentials_krb5.h: credentials/krb5.h
-auth/credentials/credentials_krb5_proto.h: credentials/krb5_proto.h
 rpc_server/dcerpc_server.h: dcerpc_server.h
 rpc_server/common/common.h: dcerpc_server/common.h
-rpc_server/common/proto.h: dcerpc_server/common_proto.h
-rpc_server/dcerpc_server_proto.h: dcerpc_server/proto.h
-auth/auth.h: auth.h
-auth/auth_proto.h: auth/proto.h
-auth/system_session_proto.h: auth/system_session.h
-auth/session_proto.h: auth/session_proto.h
-auth/session.h: auth/session.h
-auth/gensec/spnego.h: gensec/spnego.h
-auth/gensec/gensec_proto.h: gensec/proto.h
 libcli/auth/credentials.h: domain_credentials.h
 lib/charset/charset.h: charset.h
-lib/charset/charset_proto.h: charset/proto.h
 libcli/ldap/ldap.h: ldap.h
-libcli/ldap/ldap_proto.h: ldap_proto.h
 torture/torture.h: torture.h
-torture/proto.h: torture/proto.h
-torture/util.h: torture/util.h
 libcli/libcli.h: client.h
-libcli/libcli_proto.h: client/proto.h
 librpc/gen_ndr/nbt.h: gen_ndr/nbt.h
-librpc/gen_ndr/svcctl.h: dcerpc/svcctl.h
-librpc/gen_ndr/ndr_svcctl.h: dcerpc/ndr_svcctl.h
-librpc/gen_ndr/ndr_svcctl_c.h: dcerpc/ndr_svcctl_c.h
+librpc/gen_ndr/svcctl.h: gen_ndr/svcctl.h
+librpc/gen_ndr/ndr_svcctl.h: gen_ndr/ndr_svcctl.h
+librpc/gen_ndr/ndr_svcctl_c.h: gen_ndr/ndr_svcctl_c.h
 lib/cmdline/popt_common.h: samba/popt.h
 lib/util/dlinklist.h: dlinklist.h
 lib/util/data_blob.h: util/data_blob.h
 lib/util/time.h: util/time.h
 version.h: samba/version.h
-param/proto.h: param/proto.h
 param/param.h: param.h
-dsdb/samdb/samdb.h: samdb.h
-dsdb/samdb/samdb_proto.h: samdb/proto.h
-dsdb/schema/schema.h: samdb/schema.h
-dsdb/schema/proto.h: samdb/schema_proto.h
-dsdb/common/proto.h: samdb/common_proto.h
 lib/util/asn1.h: samba/asn1.h
-lib/util/asn1_proto.h: samba/asn1/proto.h
 libcli/util/error.h: core/error.h
-libcli/util/proto.h: core/error_proto.h
 lib/tdb_wrap.h: tdb_wrap.h
 lib/ldb_wrap.h: ldb_wrap.h
 torture/ui.h: torture/ui.h
-torture/torture.h: torture/torture.h
-librpc/gen_ndr/winbind.h: winbind.h
-param/share.h: param/share.h
-param/share_proto.h: param/share_proto.h
+librpc/gen_ndr/winbind.h: gen_ndr/winbind.h
+param/share.h: share.h
 lib/util/util_tdb.h: util_tdb.h
 lib/util/util_ldb.h: util_ldb.h
 lib/util/wrap_xattr.h: wrap_xattr.h
 lib/events/events.h: events/events.h
 lib/events/events_internal.h: events/events_internal.h
-libcli/ldap/ldap_ndr.h: ldb/ldap_ndr.h
-lib/gencache/gencache.h: gencache.h
+libcli/ldap/ldap_ndr.h: ldap_ndr.h
+lib/events/events.h: events.h
+lib/events/events_internal.h: events_internal.h
diff --git a/source4/heimdal_build/config.mk b/source4/heimdal_build/config.mk
index d58d06f909..33d2edb67b 100644
--- a/source4/heimdal_build/config.mk
+++ b/source4/heimdal_build/config.mk
@@ -466,7 +466,7 @@ HEIMDAL_ROKEN_OBJ_FILES = \
 # Start SUBSYSTEM HEIMDAL_GLUE
 [SUBSYSTEM::HEIMDAL_GLUE]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/krb5 -Iheimdal/lib/asn1 -Iheimdal/lib/com_err 
-PUBLIC_DEPENDENCIES = LIBNETIF LIBSAMBA-CONFIG
+PUBLIC_DEPENDENCIES = LIBNETIF LIBSAMBA-HOSTCONFIG
 # End SUBSYSTEM HEIMDAL_GLUE
 #######################
 
diff --git a/source4/ldap_server/config.mk b/source4/ldap_server/config.mk
index 2535cf3e68..47eb85cab9 100644
--- a/source4/ldap_server/config.mk
+++ b/source4/ldap_server/config.mk
@@ -10,7 +10,7 @@ PRIVATE_DEPENDENCIES = CREDENTIALS \
 		LIBCLI_LDAP SAMDB \
 		process_model \
 		gensec \
-		LIBSAMBA-CONFIG
+		LIBSAMBA-HOSTCONFIG
 # End SUBSYSTEM SMB
 #######################
 
diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
index 346aacaa99..9b43d7bd74 100644
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -216,9 +216,6 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
 	lreq = talloc(local_ctx, struct ldb_request);
 	NT_STATUS_HAVE_NO_MEMORY(lreq);
 
-	res = talloc_zero(local_ctx, struct ldb_result);
-	NT_STATUS_HAVE_NO_MEMORY(res);
-	
 	lreq->operation = LDB_SEARCH;
 	lreq->op.search.base = basedn;
 	lreq->op.search.scope = scope;
@@ -242,6 +239,9 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
 		}
 	}
 
+	res = talloc_zero(lreq, struct ldb_result);
+	NT_STATUS_HAVE_NO_MEMORY(res);
+	
 	lreq->context = res;
 	lreq->callback = ldb_search_default_callback;
 
@@ -261,6 +261,11 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
 			ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultEntry);
 			NT_STATUS_HAVE_NO_MEMORY(ent_r);
 
+			/* Better to have the whole message kept here,
+			 * than to find someone further up didn't put
+			 * a value in the right spot in the talloc tree */
+			talloc_steal(ent_r, res->msgs[i]);
+			
 			ent = &ent_r->msg->r.SearchResultEntry;
 			ent->dn = ldb_dn_alloc_linearized(ent_r, res->msgs[i]->dn);
 			ent->num_attributes = 0;
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 5b2519c035..11cb63e07b 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -37,6 +37,8 @@
 #include "lib/messaging/irpc.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
+#include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_proto.h"
 #include "system/network.h"
 #include "lib/socket/netif.h"
 #include "dsdb/samdb/samdb.h"
@@ -155,8 +157,10 @@ static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
 	}
 
 	data_blob_free(&blob);
-	ldapsrv_process_message(conn, msg);
+	talloc_steal(conn, msg);
 	asn1_free(asn1);
+
+	ldapsrv_process_message(conn, msg);
 	return NT_STATUS_OK;
 }
 
diff --git a/source4/lib/basic.mk b/source4/lib/basic.mk
index f6a8731a21..f9c0ee0665 100644
--- a/source4/lib/basic.mk
+++ b/source4/lib/basic.mk
@@ -27,7 +27,7 @@ PRIVATE_DEPENDENCIES = TDB_WRAP
 
 GENCACHE_OBJ_FILES = gencache/gencache.o
 
-PUBLIC_HEADERS += lib/gencache/gencache.h
+# PUBLIC_HEADERS += lib/gencache/gencache.h
 
 [SUBSYSTEM::LDB_WRAP]
 PUBLIC_DEPENDENCIES = LIBLDB
diff --git a/source4/lib/charset/charcnv.c b/source4/lib/charset/charcnv.c
index 0465be689e..3e384304cf 100644
--- a/source4/lib/charset/charcnv.c
+++ b/source4/lib/charset/charcnv.c
@@ -83,7 +83,7 @@ static int close_iconv(struct smb_iconv_convenience *data)
 	return 0;
 }
 
-struct smb_iconv_convenience *smb_iconv_convenience_init(TALLOC_CTX *mem_ctx,
+_PUBLIC_ struct smb_iconv_convenience *smb_iconv_convenience_init(TALLOC_CTX *mem_ctx,
 							 const char *dos_charset,
 							 const char *unix_charset,
 							 bool native_iconv)
diff --git a/source4/lib/charset/charset.h b/source4/lib/charset/charset.h
index 1d42a0ad91..baa7df532b 100644
--- a/source4/lib/charset/charset.h
+++ b/source4/lib/charset/charset.h
@@ -18,6 +18,10 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+/* This is a public header file that is installed as part of Samba. 
+ * If you remove any functions or change their signature, update 
+ * the so version number. */
+
 #ifndef __CHARSET_H__
 #define __CHARSET_H__
 
@@ -74,11 +78,71 @@ struct loadparm_context;
 struct smb_iconv_convenience;
 extern struct smb_iconv_convenience *global_smb_iconv_convenience;
 
-#include "lib/charset/charset_proto.h"
-
 /* replace some string functions with multi-byte
    versions */
 #define strlower(s) strlower_m(s)
 #define strupper(s) strupper_m(s)
 
+char *strchr_m(const char *s, char c);
+size_t strlen_m_term(const char *s);
+size_t strlen_m(const char *s);
+char *alpha_strcpy(char *dest, const char *src, const char *other_safe_chars, size_t maxlength);
+void string_replace_w(char *s, char oldc, char newc);
+bool strcsequal_w(const char *s1,const char *s2);
+bool strequal_w(const char *s1, const char *s2);
+int strncasecmp_m(const char *s1, const char *s2, size_t n);
+bool next_token(const char **ptr,char *buff, const char *sep, size_t bufsize);
+int strcasecmp_m(const char *s1, const char *s2);
+size_t count_chars_w(const char *s, char c);
+void strupper_m(char *s);
+void strlower_m(char *s);
+char *strupper_talloc(TALLOC_CTX *ctx, const char *src);
+char *strlower_talloc(TALLOC_CTX *ctx, const char *src);
+bool strhasupper(const char *string);
+bool strhaslower(const char *string);
+char *strrchr_m(const char *s, char c);
+char *strchr_m(const char *s, char c);
+
+/* codepoints */
+codepoint_t next_codepoint(struct smb_iconv_convenience *ic, 
+			    const char *str, size_t *size);
+ssize_t push_codepoint(struct smb_iconv_convenience *ic, 
+				char *str, codepoint_t c);
+codepoint_t toupper_w(codepoint_t val);
+codepoint_t tolower_w(codepoint_t val);
+int codepoint_cmpi(codepoint_t c1, codepoint_t c2);
+ssize_t push_string(struct smb_iconv_convenience *ic, void *dest, const char *src, size_t dest_len, int flags);
+ssize_t pull_string(struct smb_iconv_convenience *ic,
+		    char *dest, const void *src, size_t dest_len, size_t src_len, int flags);
+ssize_t convert_string(struct smb_iconv_convenience *ic,
+				charset_t from, charset_t to,
+				void const *src, size_t srclen, 
+				void *dest, size_t destlen);
+ssize_t convert_string_talloc_descriptor(TALLOC_CTX *ctx, smb_iconv_t descriptor, void const *src, size_t srclen, void **dest);
+ssize_t convert_string_talloc(TALLOC_CTX *ctx, 
+				       struct smb_iconv_convenience *ic, 
+				       charset_t from, charset_t to, 
+				       void const *src, size_t srclen, 
+				       void **dest);
+ssize_t push_ascii_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, char **dest, const char *src);
+ssize_t push_ucs2_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, void **dest, const char *src);
+ssize_t push_utf8_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, char **dest, const char *src);
+ssize_t pull_ascii_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, char **dest, const char *src);
+ssize_t pull_ucs2_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, char **dest, const void *src);
+ssize_t pull_utf8_talloc(TALLOC_CTX *ctx, struct smb_iconv_convenience *ic, char **dest, const char *src);
+
+/* iconv */
+smb_iconv_t smb_iconv_open(const char *tocode, const char *fromcode);
+int smb_iconv_close(smb_iconv_t cd);
+size_t smb_iconv(smb_iconv_t cd, 
+		 const char **inbuf, size_t *inbytesleft,
+		 char **outbuf, size_t *outbytesleft);
+smb_iconv_t smb_iconv_open_ex(TALLOC_CTX *mem_ctx, const char *tocode, 
+			      const char *fromcode, bool native_iconv);
+
+/* iconv convenience */
+struct smb_iconv_convenience *smb_iconv_convenience_init(TALLOC_CTX *mem_ctx,
+							 const char *dos_charset,
+							 const char *unix_charset,
+							 bool native_iconv);
 #endif /* __CHARSET_H__ */
diff --git a/source4/lib/charset/iconv.c b/source4/lib/charset/iconv.c
index db212a83c4..4f4bc8fd2d 100644
--- a/source4/lib/charset/iconv.c
+++ b/source4/lib/charset/iconv.c
@@ -113,7 +113,7 @@ static size_t sys_iconv(void *cd,
  * It only knows about a very small number of character sets - just
  * enough that Samba works on systems that don't have iconv.
  **/
-size_t smb_iconv(smb_iconv_t cd, 
+_PUBLIC_ size_t smb_iconv(smb_iconv_t cd, 
 		 const char **inbuf, size_t *inbytesleft,
 		 char **outbuf, size_t *outbytesleft)
 {
@@ -156,7 +156,7 @@ static bool is_utf16(const char *name)
 
 
 
-smb_iconv_t smb_iconv_open_ex(TALLOC_CTX *mem_ctx, const char *tocode, 
+_PUBLIC_ smb_iconv_t smb_iconv_open_ex(TALLOC_CTX *mem_ctx, const char *tocode, 
 			      const char *fromcode, bool native_iconv)
 {
 	smb_iconv_t ret;
@@ -263,7 +263,7 @@ failed:
 /*
   simple iconv_open() wrapper
  */
-smb_iconv_t smb_iconv_open(const char *tocode, const char *fromcode)
+_PUBLIC_ smb_iconv_t smb_iconv_open(const char *tocode, const char *fromcode)
 {
 	return smb_iconv_open_ex(NULL, tocode, fromcode, true);
 }
@@ -271,7 +271,7 @@ smb_iconv_t smb_iconv_open(const char *tocode, const char *fromcode)
 /*
   simple iconv_close() wrapper
 */
-int smb_iconv_close(smb_iconv_t cd)
+_PUBLIC_ int smb_iconv_close(smb_iconv_t cd)
 {
 #ifdef HAVE_NATIVE_ICONV
 	if (cd->cd_direct) iconv_close((iconv_t)cd->cd_direct);
diff --git a/source4/lib/charset/util_unistr.c b/source4/lib/charset/util_unistr.c
index 9b87f49800..c496c5d905 100644
--- a/source4/lib/charset/util_unistr.c
+++ b/source4/lib/charset/util_unistr.c
@@ -67,7 +67,7 @@ static void load_case_tables(void)
 /**
  Convert a codepoint_t to upper case.
 **/
-codepoint_t toupper_w(codepoint_t val)
+_PUBLIC_ codepoint_t toupper_w(codepoint_t val)
 {
 	if (val < 128) {
 		return toupper(val);
@@ -87,7 +87,7 @@ codepoint_t toupper_w(codepoint_t val)
 /**
  Convert a codepoint_t to lower case.
 **/
-codepoint_t tolower_w(codepoint_t val)
+_PUBLIC_ codepoint_t tolower_w(codepoint_t val)
 {
 	if (val < 128) {
 		return tolower(val);
@@ -107,7 +107,7 @@ codepoint_t tolower_w(codepoint_t val)
 /**
   compare two codepoints case insensitively
 */
-int codepoint_cmpi(codepoint_t c1, codepoint_t c2)
+_PUBLIC_ int codepoint_cmpi(codepoint_t c1, codepoint_t c2)
 {
 	if (c1 == c2 ||
 	    toupper_w(c1) == toupper_w(c2)) {
diff --git a/source4/lib/events/config.mk b/source4/lib/events/config.mk
index e5a1316c47..da92036342 100644
--- a/source4/lib/events/config.mk
+++ b/source4/lib/events/config.mk
@@ -33,8 +33,10 @@ EVENTS_STANDARD_OBJ_FILES = lib/events/events_standard.o
 
 ##############################
 # Start SUBSYSTEM LIBEVENTS
-[SUBSYSTEM::LIBEVENTS]
+[LIBRARY::LIBEVENTS]
 PUBLIC_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL
+SO_VERSION = 0
+VERSION = 0.0.1
 # End SUBSYSTEM LIBEVENTS
 ##############################
 
diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index f75bb8124d..ead5796b7b 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -25,7 +25,6 @@ parser.add_option_group(options.VersionOptions(parser))
 # use command line creds if available
 credopts = options.CredentialsOptions(parser)
 parser.add_option_group(credopts)
-creds = credopts.get_credentials()
 opts, args = parser.parse_args()
 
 if len(args) < 1:
@@ -35,6 +34,7 @@ if len(args) < 1:
 host = args[0]
 
 lp = sambaopts.get_loadparm()
+creds = credopts.get_credentials(lp)
 
 class BasicTests(unittest.TestCase):
     def delete_force(self, ldb, dn):
diff --git a/source4/lib/messaging/irpc.h b/source4/lib/messaging/irpc.h
index d596c6721e..f44c0af3ec 100644
--- a/source4/lib/messaging/irpc.h
+++ b/source4/lib/messaging/irpc.h
@@ -19,6 +19,9 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#ifndef IRPC_H
+#define IRPC_H
+
 #include "librpc/gen_ndr/irpc.h"
 
 /*
@@ -123,4 +126,5 @@ struct server_id *irpc_servers_byname(struct messaging_context *msg_ctx, TALLOC_
 void irpc_remove_name(struct messaging_context *msg_ctx, const char *name);
 NTSTATUS irpc_send_reply(struct irpc_message *m, NTSTATUS status);
 
+#endif
 
diff --git a/source4/lib/policy/adm.h b/source4/lib/policy/adm.h
index 90889fe5fa..c541ced6ff 100644
--- a/source4/lib/policy/adm.h
+++ b/source4/lib/policy/adm.h
@@ -5,7 +5,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/policy/config.mk b/source4/lib/policy/config.mk
index 70fb289189..9a8e60bfbe 100644
--- a/source4/lib/policy/config.mk
+++ b/source4/lib/policy/config.mk
@@ -1,6 +1,6 @@
 [SUBSYSTEM::LIBPOLICY]
 CFLAGS = -Iheimdal/lib/roken
-PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSAMBA-CONFIG LIBTALLOC CHARSET 
+PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSAMBA-HOSTCONFIG LIBTALLOC CHARSET 
 
 LIBPOLICY_OBJ_FILES = lib/policy/lex.o lib/policy/parse_adm.o 
 
@@ -9,6 +9,6 @@ lib/policy/lex.l: lib/policy/parse_adm.h
 lib/policy/parse_adm.h: lib/policy/parse_adm.c
 
 [BINARY::dumpadm]
-PRIVATE_DEPENDENCIES = LIBPOLICY LIBPOPT LIBSAMBA-CONFIG LIBTALLOC LIBSAMBA-UTIL CHARSET
+PRIVATE_DEPENDENCIES = LIBPOLICY LIBPOPT LIBSAMBA-HOSTCONFIG LIBTALLOC LIBSAMBA-UTIL CHARSET
 
 dumpadm_OBJ_FILES = lib/policy/dumpadm.o
diff --git a/source4/lib/policy/dumpadm.c b/source4/lib/policy/dumpadm.c
index 1553ce62f6..2ed5abf111 100644
--- a/source4/lib/policy/dumpadm.c
+++ b/source4/lib/policy/dumpadm.c
@@ -5,7 +5,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/policy/lex.c b/source4/lib/policy/lex.c
index c2899aa808..6d524445c9 100644
--- a/source4/lib/policy/lex.c
+++ b/source4/lib/policy/lex.c
@@ -572,7 +572,7 @@ char *yytext;
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/policy/lex.l b/source4/lib/policy/lex.l
index 199cd228c0..dc1f0aa34e 100644
--- a/source4/lib/policy/lex.l
+++ b/source4/lib/policy/lex.l
@@ -5,7 +5,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/policy/parse_adm.y b/source4/lib/policy/parse_adm.y
index 1dc21cf1d3..23c5e7730e 100644
--- a/source4/lib/policy/parse_adm.y
+++ b/source4/lib/policy/parse_adm.y
@@ -5,7 +5,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/registry/config.mk b/source4/lib/registry/config.mk
index 16e9c62c57..ce19d8512e 100644
--- a/source4/lib/registry/config.mk
+++ b/source4/lib/registry/config.mk
@@ -33,7 +33,7 @@ registry_OBJ_FILES = $(addprefix lib/registry/, interface.o util.o samba.o \
 					patchfile_dotreg.o patchfile_preg.o patchfile.o regf.o \
 					hive.o local.o ldb.o dir.o rpc.o)
 
-PUBLIC_HEADERS += $(addprefix lib/registry/, registry.h hive.h patchfile.h)
+PUBLIC_HEADERS += lib/registry/registry.h
 
 [SUBSYSTEM::registry_common]
 PUBLIC_DEPENDENCIES = registry
@@ -46,7 +46,7 @@ registry_common_OBJ_FILES = lib/registry/tools/common.o
 [BINARY::regdiff]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS
+		LIBSAMBA-HOSTCONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS
 # End BINARY regdiff
 ################################################
 
@@ -59,7 +59,7 @@ MANPAGES += lib/registry/man/regdiff.1
 [BINARY::regpatch]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS \
+		LIBSAMBA-HOSTCONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS \
 		registry_common
 # End BINARY regpatch
 ################################################
@@ -73,7 +73,7 @@ MANPAGES += lib/registry/man/regpatch.1
 [BINARY::regshell]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
+		LIBSAMBA-HOSTCONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
 		SMBREADLINE registry_common
 # End BINARY regshell
 ################################################
@@ -87,7 +87,7 @@ MANPAGES += lib/registry/man/regshell.1
 [BINARY::regtree]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
+		LIBSAMBA-HOSTCONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
 		registry_common
 # End BINARY regtree
 ################################################
diff --git a/source4/lib/registry/dir.c b/source4/lib/registry/dir.c
index dc3717e886..449ee0f6ee 100644
--- a/source4/lib/registry/dir.c
+++ b/source4/lib/registry/dir.c
@@ -18,7 +18,7 @@
 */
 
 #include "includes.h"
-#include "hive.h"
+#include "registry.h"
 #include "system/dir.h"
 #include "system/filesys.h"
 
diff --git a/source4/lib/registry/hive.c b/source4/lib/registry/hive.c
index ad6a6421ab..2a9b1a59ce 100644
--- a/source4/lib/registry/hive.c
+++ b/source4/lib/registry/hive.c
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
@@ -20,7 +20,7 @@
 */
 
 #include "includes.h"
-#include "hive.h"
+#include "registry.h"
 #include "system/filesys.h"
 #include "param/param.h"
 
diff --git a/source4/lib/registry/hive.h b/source4/lib/registry/hive.h
deleted file mode 100644
index 87f335663d..0000000000
--- a/source4/lib/registry/hive.h
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-   Registry hive interface
-   Copyright (C) Jelmer Vernooij					  2003-2007.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#ifndef __REGISTRY_HIVE_H__
-#define __REGISTRY_HIVE_H__
-
-#include <talloc.h>
-#include "libcli/util/werror.h"
-#include "librpc/gen_ndr/security.h"
-#include "libcli/util/ntstatus.h"
-
-/**
- * This file contains the hive API. This API is generally used for
- * reading a specific file that contains just one hive.
- *
- * Good examples are .DAT (NTUSER.DAT) files.
- *
- * This API does not have any notification support (that
- * should be provided by the registry implementation), nor
- * does it understand what predefined keys are.
- */
-
-struct hive_key {
-	const struct hive_operations *ops;
-};
-
-struct hive_operations {
-	const char *name;
-
-	/**
-	 * Open a specific subkey
-	 */
-	WERROR (*enum_key) (TALLOC_CTX *mem_ctx,
-			    const struct hive_key *key, uint32_t idx,
-			    const char **name,
-			    const char **classname,
-			    NTTIME *last_mod_time);
-
-	/**
-	 * Open a subkey by name
-	 */
-	WERROR (*get_key_by_name) (TALLOC_CTX *mem_ctx,
-				   const struct hive_key *key, const char *name,
-				   struct hive_key **subkey);
-
-	/**
-	 * Add a new key.
-	 */
-	WERROR (*add_key) (TALLOC_CTX *ctx,
-			   const struct hive_key *parent_key, const char *name,
-			   const char *classname,
-			   struct security_descriptor *desc,
-			   struct hive_key **key);
-	/**
-	 * Remove an existing key.
-	 */
-	WERROR (*del_key) (const struct hive_key *key, const char *name);
-
-	/**
-	 * Force write of a key to disk.
-	 */
-	WERROR (*flush_key) (struct hive_key *key);
-
-	/**
-	 * Retrieve a registry value with a specific index.
-	 */
-	WERROR (*enum_value) (TALLOC_CTX *mem_ctx,
-			      struct hive_key *key, int idx,
-			      const char **name, uint32_t *type,
-			      DATA_BLOB *data);
-
-	/**
-	 * Retrieve a registry value with the specified name
-	 */
-	WERROR (*get_value_by_name) (TALLOC_CTX *mem_ctx,
-				     struct hive_key *key, const char *name,
-				     uint32_t *type, DATA_BLOB *data);
-
-	/**
-	 * Set a value on the specified registry key.
-	 */
-	WERROR (*set_value) (struct hive_key *key, const char *name,
-			     uint32_t type, const DATA_BLOB data);
-
-	/**
-	 * Remove a value.
-	 */
-	WERROR (*delete_value) (struct hive_key *key, const char *name);
-
-	/* Security Descriptors */
-
-	/**
-	 * Change the security descriptor on a registry key.
-	 *
-	 * This should return WERR_NOT_SUPPORTED if the underlying
-	 * format does not have a mechanism for storing
-	 * security descriptors.
-	 */
-	WERROR (*set_sec_desc) (struct hive_key *key,
-				const struct security_descriptor *desc);
-
-	/**
-	 * Retrieve the security descriptor on a registry key.
-	 *
-	 * This should return WERR_NOT_SUPPORTED if the underlying
-	 * format does not have a mechanism for storing
-	 * security descriptors.
-	 */
-	WERROR (*get_sec_desc) (TALLOC_CTX *ctx,
-				const struct hive_key *key,
-				struct security_descriptor **desc);
-
-	/**
-	 * Retrieve general information about a key.
-	 */
-	WERROR (*get_key_info) (TALLOC_CTX *mem_ctx,
-				const struct hive_key *key,
-				const char **classname,
-				uint32_t *num_subkeys,
-				uint32_t *num_values,
-				NTTIME *last_change_time,
-				uint32_t *max_subkeynamelen,
-				uint32_t *max_valnamelen,
-				uint32_t *max_valbufsize);
-};
-
-struct cli_credentials;
-struct auth_session_info;
-
-WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
-		     struct auth_session_info *session_info,
-		     struct cli_credentials *credentials,
-		     struct loadparm_context *lp_ctx,
-		     struct hive_key **root);
-WERROR hive_key_get_info(TALLOC_CTX *mem_ctx, const struct hive_key *key,
-			 const char **classname, uint32_t *num_subkeys,
-			 uint32_t *num_values, NTTIME *last_change_time,
-			 uint32_t *max_subkeynamelen,
-			 uint32_t *max_valnamelen, uint32_t *max_valbufsize);
-WERROR hive_key_add_name(TALLOC_CTX *ctx, const struct hive_key *parent_key,
-			 const char *name, const char *classname,
-			 struct security_descriptor *desc,
-			 struct hive_key **key);
-WERROR hive_key_del(const struct hive_key *key, const char *name);
-WERROR hive_get_key_by_name(TALLOC_CTX *mem_ctx,
-			    const struct hive_key *key, const char *name,
-			    struct hive_key **subkey);
-WERROR hive_enum_key(TALLOC_CTX *mem_ctx,
-		     const struct hive_key *key, uint32_t idx,
-		     const char **name,
-		     const char **classname,
-		     NTTIME *last_mod_time);
-
-WERROR hive_key_set_value(struct hive_key *key, const char *name,
-		      uint32_t type, const DATA_BLOB data);
-
-WERROR hive_get_value(TALLOC_CTX *mem_ctx,
-		      struct hive_key *key, const char *name,
-		      uint32_t *type, DATA_BLOB *data);
-WERROR hive_get_value_by_index(TALLOC_CTX *mem_ctx,
-			       struct hive_key *key, uint32_t idx,
-			       const char **name,
-			       uint32_t *type, DATA_BLOB *data);
-
-WERROR hive_key_del_value(struct hive_key *key, const char *name);
-
-WERROR hive_key_flush(struct hive_key *key);
-
-
-/* Individual backends */
-WERROR reg_open_directory(TALLOC_CTX *parent_ctx,
-			  const char *location, struct hive_key **key);
-WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx,
-			  const char *location, struct smb_iconv_convenience *iconv_convenience,
-			  struct hive_key **key);
-WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
-			 struct auth_session_info *session_info,
-			 struct cli_credentials *credentials,
-			 struct loadparm_context *lp_ctx,
-			 struct hive_key **k);
-
-
-WERROR reg_create_directory(TALLOC_CTX *parent_ctx,
-			    const char *location, struct hive_key **key);
-WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx,
-			    struct smb_iconv_convenience *iconv_convenience,
-			    const char *location,
-			    int major_version,
-			    struct hive_key **key);
-
-
-#endif /* __REGISTRY_HIVE_H__ */
diff --git a/source4/lib/registry/local.c b/source4/lib/registry/local.c
index b2cdec9cdf..af235e7b04 100644
--- a/source4/lib/registry/local.c
+++ b/source4/lib/registry/local.c
@@ -5,7 +5,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/registry/patchfile.c b/source4/lib/registry/patchfile.c
index 687fd4b91b..15e3a158f2 100644
--- a/source4/lib/registry/patchfile.c
+++ b/source4/lib/registry/patchfile.c
@@ -20,7 +20,6 @@
 */
 
 #include "includes.h"
-#include "lib/registry/patchfile.h"
 #include "lib/registry/registry.h"
 #include "system/filesys.h"
 #include "param/param.h"
diff --git a/source4/lib/registry/patchfile.h b/source4/lib/registry/patchfile.h
deleted file mode 100644
index 9289390685..0000000000
--- a/source4/lib/registry/patchfile.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-   Patchfile interface
-   Copyright (C) Jelmer Vernooij 2006
-   Copyright (C) Wilco Baan Hofman 2006
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#ifndef _PATCHFILE_H
-#define _PATCHFILE_H
-
-#include "lib/registry/registry.h"
-
-struct reg_diff_callbacks {
-	WERROR (*add_key) (void *callback_data, const char *key_name);
-	WERROR (*set_value) (void *callback_data, const char *key_name,
-			     const char *value_name, uint32_t value_type,
-			     DATA_BLOB value);
-	WERROR (*del_value) (void *callback_data, const char *key_name,
-			     const char *value_name);
-	WERROR (*del_key) (void *callback_data, const char *key_name);
-	WERROR (*del_all_values) (void *callback_data, const char *key_name);
-	WERROR (*done) (void *callback_data);
-};
-
-WERROR reg_diff_apply(struct registry_context *ctx, const char *filename);
-
-WERROR reg_generate_diff(struct registry_context *ctx1,
-			 struct registry_context *ctx2,
-			 const struct reg_diff_callbacks *callbacks,
-			 void *callback_data);
-WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
-			    struct smb_iconv_convenience *iconv_convenience,
-			    struct reg_diff_callbacks **callbacks,
-			    void **callback_data);
-WERROR reg_generate_diff_key(struct registry_key *oldkey,
-			     struct registry_key *newkey,
-			     const char *path,
-			     const struct reg_diff_callbacks *callbacks,
-			     void *callback_data);
-
-#endif /* _PATCHFILE_H */
diff --git a/source4/lib/registry/patchfile_dotreg.c b/source4/lib/registry/patchfile_dotreg.c
index 6de642ecb8..59f4044713 100644
--- a/source4/lib/registry/patchfile_dotreg.c
+++ b/source4/lib/registry/patchfile_dotreg.c
@@ -7,7 +7,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
@@ -23,7 +23,6 @@
 /* FIXME Newer .REG files, created by Windows XP and above use unicode UTF-16 */
 
 #include "includes.h"
-#include "lib/registry/patchfile.h"
 #include "lib/registry/registry.h"
 #include "system/filesys.h"
 #include "param/param.h"
diff --git a/source4/lib/registry/patchfile_preg.c b/source4/lib/registry/patchfile_preg.c
index 0d39e67450..0fa367bfcb 100644
--- a/source4/lib/registry/patchfile_preg.c
+++ b/source4/lib/registry/patchfile_preg.c
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
@@ -21,7 +21,6 @@
 
 #include "includes.h"
 #include "lib/registry/registry.h"
-#include "lib/registry/patchfile.h"
 #include "system/filesys.h"
 #include "param/param.h"
 
diff --git a/source4/lib/registry/regf.c b/source4/lib/registry/regf.c
index a192f3be4d..46ccca922b 100644
--- a/source4/lib/registry/regf.c
+++ b/source4/lib/registry/regf.c
@@ -18,13 +18,13 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 #include "includes.h"
-#include "lib/registry/hive.h"
 #include "system/filesys.h"
 #include "system/time.h"
 #include "lib/registry/tdr_regf.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "librpc/gen_ndr/winreg.h"
 #include "param/param.h"
+#include "lib/registry/registry.h"
 
 static struct hive_operations reg_backend_regf;
 
diff --git a/source4/lib/registry/registry.h b/source4/lib/registry/registry.h
index 5e0b971a1d..a86294bf46 100644
--- a/source4/lib/registry/registry.h
+++ b/source4/lib/registry/registry.h
@@ -22,11 +22,196 @@
 #define _REGISTRY_H
 
 struct registry_context;
+struct loadparm_context;
+struct smb_iconv_convenience;
 
 #include <talloc.h>
+#include "libcli/util/werror.h"
 #include "librpc/gen_ndr/security.h"
-#include "lib/registry/hive.h"
 #include "libcli/util/ntstatus.h"
+#include "util/time.h"
+#include "util/data_blob.h"
+
+/**
+ * The hive API. This API is generally used for
+ * reading a specific file that contains just one hive.
+ *
+ * Good examples are .DAT (NTUSER.DAT) files.
+ *
+ * This API does not have any notification support (that
+ * should be provided by the registry implementation), nor
+ * does it understand what predefined keys are.
+ */
+
+struct hive_key {
+	const struct hive_operations *ops;
+};
+
+struct hive_operations {
+	const char *name;
+
+	/**
+	 * Open a specific subkey
+	 */
+	WERROR (*enum_key) (TALLOC_CTX *mem_ctx,
+			    const struct hive_key *key, uint32_t idx,
+			    const char **name,
+			    const char **classname,
+			    NTTIME *last_mod_time);
+
+	/**
+	 * Open a subkey by name
+	 */
+	WERROR (*get_key_by_name) (TALLOC_CTX *mem_ctx,
+				   const struct hive_key *key, const char *name,
+				   struct hive_key **subkey);
+
+	/**
+	 * Add a new key.
+	 */
+	WERROR (*add_key) (TALLOC_CTX *ctx,
+			   const struct hive_key *parent_key, const char *name,
+			   const char *classname,
+			   struct security_descriptor *desc,
+			   struct hive_key **key);
+	/**
+	 * Remove an existing key.
+	 */
+	WERROR (*del_key) (const struct hive_key *key, const char *name);
+
+	/**
+	 * Force write of a key to disk.
+	 */
+	WERROR (*flush_key) (struct hive_key *key);
+
+	/**
+	 * Retrieve a registry value with a specific index.
+	 */
+	WERROR (*enum_value) (TALLOC_CTX *mem_ctx,
+			      struct hive_key *key, int idx,
+			      const char **name, uint32_t *type,
+			      DATA_BLOB *data);
+
+	/**
+	 * Retrieve a registry value with the specified name
+	 */
+	WERROR (*get_value_by_name) (TALLOC_CTX *mem_ctx,
+				     struct hive_key *key, const char *name,
+				     uint32_t *type, DATA_BLOB *data);
+
+	/**
+	 * Set a value on the specified registry key.
+	 */
+	WERROR (*set_value) (struct hive_key *key, const char *name,
+			     uint32_t type, const DATA_BLOB data);
+
+	/**
+	 * Remove a value.
+	 */
+	WERROR (*delete_value) (struct hive_key *key, const char *name);
+
+	/* Security Descriptors */
+
+	/**
+	 * Change the security descriptor on a registry key.
+	 *
+	 * This should return WERR_NOT_SUPPORTED if the underlying
+	 * format does not have a mechanism for storing
+	 * security descriptors.
+	 */
+	WERROR (*set_sec_desc) (struct hive_key *key,
+				const struct security_descriptor *desc);
+
+	/**
+	 * Retrieve the security descriptor on a registry key.
+	 *
+	 * This should return WERR_NOT_SUPPORTED if the underlying
+	 * format does not have a mechanism for storing
+	 * security descriptors.
+	 */
+	WERROR (*get_sec_desc) (TALLOC_CTX *ctx,
+				const struct hive_key *key,
+				struct security_descriptor **desc);
+
+	/**
+	 * Retrieve general information about a key.
+	 */
+	WERROR (*get_key_info) (TALLOC_CTX *mem_ctx,
+				const struct hive_key *key,
+				const char **classname,
+				uint32_t *num_subkeys,
+				uint32_t *num_values,
+				NTTIME *last_change_time,
+				uint32_t *max_subkeynamelen,
+				uint32_t *max_valnamelen,
+				uint32_t *max_valbufsize);
+};
+
+struct cli_credentials;
+struct auth_session_info;
+
+WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
+		     struct auth_session_info *session_info,
+		     struct cli_credentials *credentials,
+		     struct loadparm_context *lp_ctx,
+		     struct hive_key **root);
+WERROR hive_key_get_info(TALLOC_CTX *mem_ctx, const struct hive_key *key,
+			 const char **classname, uint32_t *num_subkeys,
+			 uint32_t *num_values, NTTIME *last_change_time,
+			 uint32_t *max_subkeynamelen,
+			 uint32_t *max_valnamelen, uint32_t *max_valbufsize);
+WERROR hive_key_add_name(TALLOC_CTX *ctx, const struct hive_key *parent_key,
+			 const char *name, const char *classname,
+			 struct security_descriptor *desc,
+			 struct hive_key **key);
+WERROR hive_key_del(const struct hive_key *key, const char *name);
+WERROR hive_get_key_by_name(TALLOC_CTX *mem_ctx,
+			    const struct hive_key *key, const char *name,
+			    struct hive_key **subkey);
+WERROR hive_enum_key(TALLOC_CTX *mem_ctx,
+		     const struct hive_key *key, uint32_t idx,
+		     const char **name,
+		     const char **classname,
+		     NTTIME *last_mod_time);
+
+WERROR hive_key_set_value(struct hive_key *key, const char *name,
+		      uint32_t type, const DATA_BLOB data);
+
+WERROR hive_get_value(TALLOC_CTX *mem_ctx,
+		      struct hive_key *key, const char *name,
+		      uint32_t *type, DATA_BLOB *data);
+WERROR hive_get_value_by_index(TALLOC_CTX *mem_ctx,
+			       struct hive_key *key, uint32_t idx,
+			       const char **name,
+			       uint32_t *type, DATA_BLOB *data);
+
+WERROR hive_key_del_value(struct hive_key *key, const char *name);
+
+WERROR hive_key_flush(struct hive_key *key);
+
+
+/* Individual backends */
+WERROR reg_open_directory(TALLOC_CTX *parent_ctx,
+			  const char *location, struct hive_key **key);
+WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx,
+			  const char *location, struct smb_iconv_convenience *iconv_convenience,
+			  struct hive_key **key);
+WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
+			 struct auth_session_info *session_info,
+			 struct cli_credentials *credentials,
+			 struct loadparm_context *lp_ctx,
+			 struct hive_key **k);
+
+
+WERROR reg_create_directory(TALLOC_CTX *parent_ctx,
+			    const char *location, struct hive_key **key);
+WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx,
+			    struct smb_iconv_convenience *iconv_convenience,
+			    const char *location,
+			    int major_version,
+			    struct hive_key **key);
+
+
 
 /* Handles for the predefined keys */
 #define HKEY_CLASSES_ROOT		0x80000000
@@ -66,8 +251,6 @@ struct registry_key
 	struct registry_context *context;
 };
 
-#include "lib/registry/patchfile.h"
-
 struct registry_value
 {
 	const char *name;
@@ -285,5 +468,34 @@ WERROR reg_get_security(TALLOC_CTX *mem_ctx,
 WERROR reg_set_security(struct registry_key *key,
 			struct security_descriptor *security);
 
+struct reg_diff_callbacks {
+	WERROR (*add_key) (void *callback_data, const char *key_name);
+	WERROR (*set_value) (void *callback_data, const char *key_name,
+			     const char *value_name, uint32_t value_type,
+			     DATA_BLOB value);
+	WERROR (*del_value) (void *callback_data, const char *key_name,
+			     const char *value_name);
+	WERROR (*del_key) (void *callback_data, const char *key_name);
+	WERROR (*del_all_values) (void *callback_data, const char *key_name);
+	WERROR (*done) (void *callback_data);
+};
+
+WERROR reg_diff_apply(struct registry_context *ctx, const char *filename);
+
+WERROR reg_generate_diff(struct registry_context *ctx1,
+			 struct registry_context *ctx2,
+			 const struct reg_diff_callbacks *callbacks,
+			 void *callback_data);
+WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
+			    struct smb_iconv_convenience *iconv_convenience,
+			    struct reg_diff_callbacks **callbacks,
+			    void **callback_data);
+WERROR reg_generate_diff_key(struct registry_key *oldkey,
+			     struct registry_key *newkey,
+			     const char *path,
+			     const struct reg_diff_callbacks *callbacks,
+			     void *callback_data);
+
+
 
 #endif /* _REGISTRY_H */
diff --git a/source4/lib/registry/registry.i b/source4/lib/registry/registry.i
index 20ae671c75..8ab402d57d 100644
--- a/source4/lib/registry/registry.i
+++ b/source4/lib/registry/registry.i
@@ -26,7 +26,6 @@
 #include "includes.h"
 #include "registry.h"
 #include "param/param.h"
-#include "hive.h"
 
 typedef struct registry_context reg;
 typedef struct hive_key hive_key;
diff --git a/source4/lib/registry/registry.pc.in b/source4/lib/registry/registry.pc.in
index 98943a0736..d981a45b2c 100644
--- a/source4/lib/registry/registry.pc.in
+++ b/source4/lib/registry/registry.pc.in
@@ -5,8 +5,8 @@ includedir=@includedir@
 
 Name: registry
 Description: Windows-style registry library
-Requires: ldb
-Requires.private: 
+Requires: talloc
+Requires.private: ldb
 Version: 0.0.1
 Libs: -L${libdir} -lregistry 
 Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/lib/registry/registry_wrap.c b/source4/lib/registry/registry_wrap.c
index 51c255e9f7..da09ecbe08 100644
--- a/source4/lib/registry/registry_wrap.c
+++ b/source4/lib/registry/registry_wrap.c
@@ -2529,7 +2529,6 @@ static swig_module_info swig_module = {swig_types, 25, 0, 0, 0, 0};
 #include "includes.h"
 #include "registry.h"
 #include "param/param.h"
-#include "hive.h"
 
 typedef struct registry_context reg;
 typedef struct hive_key hive_key;
diff --git a/source4/lib/registry/tests/generic.c b/source4/lib/registry/tests/generic.c
index 145e599504..6eae26bc46 100644
--- a/source4/lib/registry/tests/generic.c
+++ b/source4/lib/registry/tests/generic.c
@@ -112,7 +112,7 @@ static bool test_reg_val_description_nullname(struct torture_context *ctx)
 	return true;
 }
 
-_PUBLIC_ struct torture_suite *torture_registry(TALLOC_CTX *mem_ctx)
+struct torture_suite *torture_registry(TALLOC_CTX *mem_ctx)
 {
 	struct torture_suite *suite = torture_suite_create(mem_ctx, "REGISTRY");
 	torture_suite_add_simple_test(suite, "str_regtype",
diff --git a/source4/lib/registry/tests/hive.c b/source4/lib/registry/tests/hive.c
index 1e56f125c5..70b0241b04 100644
--- a/source4/lib/registry/tests/hive.c
+++ b/source4/lib/registry/tests/hive.c
@@ -7,7 +7,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/registry/tests/registry.c b/source4/lib/registry/tests/registry.c
index 7d14b3a412..e5e34c11e0 100644
--- a/source4/lib/registry/tests/registry.c
+++ b/source4/lib/registry/tests/registry.c
@@ -7,7 +7,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
diff --git a/source4/lib/registry/tools/regpatch.c b/source4/lib/registry/tools/regpatch.c
index 71837d1807..98443e6456 100644
--- a/source4/lib/registry/tools/regpatch.c
+++ b/source4/lib/registry/tools/regpatch.c
@@ -23,7 +23,6 @@
 #include "lib/registry/registry.h"
 #include "lib/cmdline/popt_common.h"
 #include "lib/registry/tools/common.h"
-#include "lib/registry/patchfile.h"
 #include "param/param.h"
 
 int main(int argc, char **argv)
diff --git a/source4/lib/replace/samba.m4 b/source4/lib/replace/samba.m4
index e62c3d3cd1..7984ef31db 100644
--- a/source4/lib/replace/samba.m4
+++ b/source4/lib/replace/samba.m4
@@ -23,7 +23,7 @@ done
 
 SMB_SUBSYSTEM(LIBREPLACE,
 	[${LIBREPLACE_OBJS}],
-	[LIBREPLACE_EXT],
+	[LIBREPLACE_EXT LIBREPLACE_NETWORK],
 	[-Ilib/replace])
 
 LIBREPLACE_HOSTCC_OBJS=`echo ${LIBREPLACE_OBJS} |sed -e 's/\.o/\.ho/g'`
diff --git a/source4/lib/socket_wrapper/config.mk b/source4/lib/socket_wrapper/config.mk
index 75d3ade28b..2067d988cb 100644
--- a/source4/lib/socket_wrapper/config.mk
+++ b/source4/lib/socket_wrapper/config.mk
@@ -5,6 +5,4 @@ PRIVATE_DEPENDENCIES = LIBREPLACE_NETWORK
 # End SUBSYSTEM SOCKET_WRAPPER
 ##############################
 
-PUBLIC_HEADERS += lib/socket_wrapper/socket_wrapper.h
-
 SOCKET_WRAPPER_OBJ_FILES = lib/socket_wrapper/socket_wrapper.o
diff --git a/source4/lib/talloc/config.mk b/source4/lib/talloc/config.mk
index b65cb4ccf6..84848ae77a 100644
--- a/source4/lib/talloc/config.mk
+++ b/source4/lib/talloc/config.mk
@@ -5,4 +5,3 @@ CFLAGS = -Ilib/talloc
 LIBTALLOC_OBJ_FILES = lib/talloc/talloc.o
 
 MANPAGES += $(tallocdir)/talloc.3
-PUBLIC_HEADERS += $(tallocdir)/talloc.h
diff --git a/source4/lib/tdb/config.mk b/source4/lib/tdb/config.mk
index fd39074f50..b9a8f80dda 100644
--- a/source4/lib/tdb/config.mk
+++ b/source4/lib/tdb/config.mk
@@ -12,8 +12,6 @@ LIBTDB_OBJ_FILES = $(addprefix lib/tdb/common/, \
 	open.o traverse.o freelist.o \
 	error.o transaction.o)
 
-PUBLIC_HEADERS += $(tdbdir)/include/tdb.h
-
 ################################################
 # Start BINARY tdbtool
 [BINARY::tdbtool]
diff --git a/source4/lib/tls/config.mk b/source4/lib/tls/config.mk
index a92321f59f..e2d7cd517a 100644
--- a/source4/lib/tls/config.mk
+++ b/source4/lib/tls/config.mk
@@ -1,7 +1,5 @@
-################################################
-# Start SUBSYSTEM LIBTLS
 [SUBSYSTEM::LIBTLS]
 PUBLIC_DEPENDENCIES = \
-		LIBTALLOC GNUTLS LIBSAMBA-CONFIG samba-socket
+		LIBTALLOC GNUTLS LIBSAMBA-HOSTCONFIG samba-socket
 
 LIBTLS_OBJ_FILES = lib/tls/tls.o lib/tls/tlscert.o
diff --git a/source4/lib/util/config.mk b/source4/lib/util/config.mk
index 3afe398a8f..ab6b23dd6b 100644
--- a/source4/lib/util/config.mk
+++ b/source4/lib/util/config.mk
@@ -1,9 +1,8 @@
 [SUBSYSTEM::LIBSAMBA-UTIL]
 PUBLIC_DEPENDENCIES = \
 		LIBTALLOC LIBCRYPTO \
-		SOCKET_WRAPPER EXT_NSL \
-		CHARSET EXECINFO DYNCONFIG \
-		LIBREPLACE_NETWORK
+		SOCKET_WRAPPER LIBREPLACE_NETWORK \
+		CHARSET EXECINFO
 
 LIBSAMBA-UTIL_OBJ_FILES = $(addprefix lib/util/, \
 	xfile.o \
@@ -23,7 +22,8 @@ LIBSAMBA-UTIL_OBJ_FILES = $(addprefix lib/util/, \
 		ms_fnmatch.o \
 		mutex.o \
 		idtree.o \
-		become_daemon.o)
+		become_daemon.o \
+		params.o
 
 PUBLIC_HEADERS += $(addprefix lib/util/, util.h \
 				 attr.h \
@@ -33,13 +33,13 @@ PUBLIC_HEADERS += $(addprefix lib/util/, util.h \
 				 mutex.h \
 				 safe_string.h \
 				 time.h \
+				 util_ldb.h \
 				 xfile.h)
 
 [SUBSYSTEM::ASN1_UTIL]
 PRIVATE_PROTO_HEADER = asn1_proto.h
 
 ASN1_UTIL_OBJ_FILES = lib/util/asn1.o
-PUBLIC_HEADERS += lib/util/asn1.h
 
 [SUBSYSTEM::UNIX_PRIVS]
 PRIVATE_PROTO_HEADER = unix_privs.h
@@ -49,7 +49,6 @@ UNIX_PRIVS_OBJ_FILES = lib/util/unix_privs.o
 ################################################
 # Start SUBSYSTEM WRAP_XATTR
 [SUBSYSTEM::WRAP_XATTR]
-PRIVATE_PROTO_HEADER = wrap_xattr.h
 PUBLIC_DEPENDENCIES = XATTR
 #
 # End SUBSYSTEM WRAP_XATTR
@@ -64,7 +63,6 @@ PUBLIC_DEPENDENCIES = LIBTDB
 UTIL_TDB_OBJ_FILES = lib/util/util_tdb.o
 
 [SUBSYSTEM::UTIL_LDB]
-PRIVATE_PROTO_HEADER = util_ldb.h
 PUBLIC_DEPENDENCIES = LIBLDB
 
 UTIL_LDB_OBJ_FILES = lib/util/util_ldb.o
diff --git a/source4/lib/util/data_blob.h b/source4/lib/util/data_blob.h
index 1442438dd7..e9dca67772 100644
--- a/source4/lib/util/data_blob.h
+++ b/source4/lib/util/data_blob.h
@@ -16,6 +16,10 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+/* This is a public header file that is installed as part of Samba. 
+ * If you remove any functions or change their signature, update 
+ * the so version number. */
+
 #ifndef _SAMBA_DATABLOB_H_
 #define _SAMBA_DATABLOB_H_
 
diff --git a/source4/lib/util/dprintf.c b/source4/lib/util/dprintf.c
index 308d81b105..e4f02758eb 100644
--- a/source4/lib/util/dprintf.c
+++ b/source4/lib/util/dprintf.c
@@ -42,7 +42,7 @@ void d_set_iconv(smb_iconv_t cd)
 	display_cd = cd;
 }
 
-_PUBLIC_ int d_vfprintf(FILE *f, const char *format, va_list ap) _PRINTF_ATTRIBUTE(2,0)
+_PUBLIC_ int d_vfprintf(FILE *f, const char *format, va_list ap) 
 {
 	char *p, *p2;
 	int ret, clen;
@@ -85,7 +85,7 @@ _PUBLIC_ int d_vfprintf(FILE *f, const char *format, va_list ap) _PRINTF_ATTRIBU
 }
 
 
-_PUBLIC_ int d_fprintf(FILE *f, const char *format, ...) _PRINTF_ATTRIBUTE(2,3)
+_PUBLIC_ int d_fprintf(FILE *f, const char *format, ...) 
 {
 	int ret;
 	va_list ap;
@@ -97,7 +97,7 @@ _PUBLIC_ int d_fprintf(FILE *f, const char *format, ...) _PRINTF_ATTRIBUTE(2,3)
 	return ret;
 }
 
-_PUBLIC_ int d_printf(const char *format, ...) _PRINTF_ATTRIBUTE(1,2)
+_PUBLIC_ int d_printf(const char *format, ...)
 {
 	int ret;
 	va_list ap;
diff --git a/source4/lib/util/genrand.c b/source4/lib/util/genrand.c
index 5751db23d6..7df4ec4e20 100644
--- a/source4/lib/util/genrand.c
+++ b/source4/lib/util/genrand.c
@@ -37,15 +37,17 @@ static unsigned int bytes_since_reseed = 0;
 
 static int urand_fd = -1;
 
-static void (*reseed_callback)(int *newseed);
+static void (*reseed_callback)(void *userdata, int *newseed);
+static void *reseed_callback_userdata = NULL;
 
 /**
  Copy any user given reseed data.
 **/
 
-_PUBLIC_ void set_rand_reseed_callback(void (*fn)(int *))
+_PUBLIC_ void set_rand_reseed_callback(void (*fn)(void *, int *), void *userdata)
 {
 	reseed_callback = fn;
+	reseed_callback_userdata = userdata;
 	set_need_random_reseed();
 }
 
@@ -61,7 +63,7 @@ _PUBLIC_ void set_need_random_reseed(void)
 static void get_rand_reseed_data(int *reseed_data)
 {
 	if (reseed_callback) {
-		reseed_callback(reseed_data);
+		reseed_callback(reseed_callback_userdata, reseed_data);
 	} else {
 		*reseed_data = 0;
 	}
diff --git a/source4/param/params.c b/source4/lib/util/params.c
index 3a9e2b9505..3a9e2b9505 100644
--- a/source4/param/params.c
+++ b/source4/lib/util/params.c
diff --git a/source4/lib/util/tests/genrand.c b/source4/lib/util/tests/genrand.c
index 205a66352f..5fe229c089 100644
--- a/source4/lib/util/tests/genrand.c
+++ b/source4/lib/util/tests/genrand.c
@@ -22,14 +22,14 @@
 #include "includes.h"
 #include "torture/torture.h"
 
-static void dummy_reseed(int *d)
+static void dummy_reseed(void *userdata, int *d)
 {
 	*d = 42;
 }
 
 static bool test_reseed_callback(struct torture_context *tctx)
 {
-	set_rand_reseed_callback(dummy_reseed);
+	set_rand_reseed_callback(dummy_reseed, NULL);
 	return true;
 }
 
diff --git a/source4/lib/util/util.c b/source4/lib/util/util.c
index 7b6bfeeb7b..b5bb75358e 100644
--- a/source4/lib/util/util.c
+++ b/source4/lib/util/util.c
@@ -582,3 +582,18 @@ _PUBLIC_ void *realloc_array(void *ptr, size_t el_size, unsigned count)
 	return realloc(ptr, el_size * count);
 }
 
+_PUBLIC_ void *talloc_check_name_abort(const void *ptr, const char *name)
+{
+        void *result;
+
+        result = talloc_check_name(ptr, name);
+        if (result != NULL)
+                return result;
+
+        DEBUG(0, ("Talloc type mismatch, expected %s, got %s\n",
+                  name, talloc_get_name(ptr)));
+        smb_panic("talloc type mismatch");
+        /* Keep the compiler happy */
+        return NULL;
+}
+
diff --git a/source4/lib/util/util.h b/source4/lib/util/util.h
index 550b60c625..3bf6b98d2f 100644
--- a/source4/lib/util/util.h
+++ b/source4/lib/util/util.h
@@ -218,7 +218,7 @@ _PUBLIC_ struct in_addr sys_inet_makeaddr(int net, int host);
 /**
  Copy any user given reseed data.
 **/
-_PUBLIC_ void set_rand_reseed_callback(void (*fn)(int *));
+_PUBLIC_ void set_rand_reseed_callback(void (*fn)(void *, int *), void *);
 
 /**
  * Tell the random number generator it needs to reseed.
@@ -795,4 +795,19 @@ _PUBLIC_ int idr_remove(struct idr_context *idp, int id);
 **/
 _PUBLIC_ void become_daemon(bool fork);
 
+/**
+ * Load a ini-style file.
+ */
+bool pm_process( const char *fileName,
+                 bool (*sfunc)(const char *, void *),
+                 bool (*pfunc)(const char *, const char *, void *),
+				 void *userdata);
+
+/**
+ * Add-on to talloc_get_type
+ */
+_PUBLIC_ void *talloc_check_name_abort(const void *ptr, const char *name);
+#define talloc_get_type_abort(ptr, type) \
+	(type *)talloc_check_name_abort(ptr, #type)
+
 #endif /* _SAMBA_UTIL_H_ */
diff --git a/source4/lib/util/util_file.c b/source4/lib/util/util_file.c
index 836e188ac1..c3e22196c0 100644
--- a/source4/lib/util/util_file.c
+++ b/source4/lib/util/util_file.c
@@ -356,7 +356,7 @@ _PUBLIC_ bool file_save(const char *fname, const void *packet, size_t length)
 	return true;
 }
 
-_PUBLIC_ int vfdprintf(int fd, const char *format, va_list ap) _PRINTF_ATTRIBUTE(2,0)
+_PUBLIC_ int vfdprintf(int fd, const char *format, va_list ap)
 {
 	char *p;
 	int len, ret;
@@ -371,7 +371,7 @@ _PUBLIC_ int vfdprintf(int fd, const char *format, va_list ap) _PRINTF_ATTRIBUTE
 	return ret;
 }
 
-_PUBLIC_ int fdprintf(int fd, const char *format, ...) _PRINTF_ATTRIBUTE(2,3)
+_PUBLIC_ int fdprintf(int fd, const char *format, ...)
 {
 	va_list ap;
 	int ret;
diff --git a/source4/lib/util/util_ldb.c b/source4/lib/util/util_ldb.c
index f1b42effd8..38f53c2c66 100644
--- a/source4/lib/util/util_ldb.c
+++ b/source4/lib/util/util_ldb.c
@@ -33,7 +33,7 @@ int gendb_search_v(struct ldb_context *ldb,
 		   struct ldb_message ***msgs,
 		   const char * const *attrs,
 		   const char *format,
-		   va_list ap)  _PRINTF_ATTRIBUTE(6,0)
+		   va_list ap) 
 {
 	enum ldb_scope scope = LDB_SCOPE_SUBTREE;
 	struct ldb_result *res;
@@ -85,7 +85,7 @@ int gendb_search(struct ldb_context *ldb,
 		 struct ldb_dn *basedn,
 		 struct ldb_message ***res,
 		 const char * const *attrs,
-		 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
+		 const char *format, ...) 
 {
 	va_list ap;
 	int count;
diff --git a/source4/lib/util/util_ldb.h b/source4/lib/util/util_ldb.h
new file mode 100644
index 0000000000..030ba7ebee
--- /dev/null
+++ b/source4/lib/util/util_ldb.h
@@ -0,0 +1,27 @@
+#ifndef __LIB_UTIL_UTIL_LDB_H__
+#define __LIB_UTIL_UTIL_LDB_H__
+
+/* The following definitions come from lib/util/util_ldb.c  */
+
+int gendb_search_v(struct ldb_context *ldb,
+		   TALLOC_CTX *mem_ctx,
+		   struct ldb_dn *basedn,
+		   struct ldb_message ***msgs,
+		   const char * const *attrs,
+		   const char *format,
+		   va_list ap)  PRINTF_ATTRIBUTE(6,0);
+int gendb_search(struct ldb_context *ldb,
+		 TALLOC_CTX *mem_ctx,
+		 struct ldb_dn *basedn,
+		 struct ldb_message ***res,
+		 const char * const *attrs,
+		 const char *format, ...) PRINTF_ATTRIBUTE(6,7);
+int gendb_search_dn(struct ldb_context *ldb,
+		 TALLOC_CTX *mem_ctx,
+		 struct ldb_dn *dn,
+		 struct ldb_message ***res,
+		 const char * const *attrs);
+int gendb_add_ldif(struct ldb_context *ldb, const char *ldif_string);
+char *wrap_casefold(void *context, void *mem_ctx, const char *s);
+
+#endif /* __LIB_UTIL_UTIL_LDB_H__ */
diff --git a/source4/lib/util/wrap_xattr.h b/source4/lib/util/wrap_xattr.h
new file mode 100644
index 0000000000..64b28d250c
--- /dev/null
+++ b/source4/lib/util/wrap_xattr.h
@@ -0,0 +1,12 @@
+#ifndef __LIB_UTIL_WRAP_XATTR_H__
+#define __LIB_UTIL_WRAP_XATTR_H__
+
+ssize_t wrap_fgetxattr(int fd, const char *name, void *value, size_t size);
+ssize_t wrap_getxattr(const char *path, const char *name, void *value, size_t size);
+int wrap_fsetxattr(int fd, const char *name, void *value, size_t size, int flags);
+int wrap_setxattr(const char *path, const char *name, void *value, size_t size, int flags);
+int wrap_fremovexattr(int fd, const char *name);
+int wrap_removexattr(const char *path, const char *name);
+
+#endif /* __LIB_UTIL_WRAP_XATTR_H__ */
+
diff --git a/source4/libcli/auth/config.mk b/source4/libcli/auth/config.mk
index f180844d84..85fc4ab527 100644
--- a/source4/libcli/auth/config.mk
+++ b/source4/libcli/auth/config.mk
@@ -4,7 +4,7 @@
 PRIVATE_PROTO_HEADER = proto.h
 PUBLIC_DEPENDENCIES = \
 		MSRPC_PARSE \
-		LIBSAMBA-CONFIG
+		LIBSAMBA-HOSTCONFIG
 # End SUBSYSTEM LIBCLI_AUTH
 #################################
 
diff --git a/source4/libcli/auth/smbencrypt.c b/source4/libcli/auth/smbencrypt.c
index cefb55e205..7de9627302 100644
--- a/source4/libcli/auth/smbencrypt.c
+++ b/source4/libcli/auth/smbencrypt.c
@@ -63,7 +63,7 @@ bool SMBencrypt(const char *passwd, const uint8_t *c8, uint8_t p24[24])
  * @param p16 return password hashed with md4, caller allocated 16 byte buffer
  */
  
-_PUBLIC_ bool E_md4hash(const char *passwd, uint8_t p16[16])
+bool E_md4hash(const char *passwd, uint8_t p16[16])
 {
 	int len;
 	void *wpwd;
@@ -91,7 +91,7 @@ _PUBLIC_ bool E_md4hash(const char *passwd, uint8_t p16[16])
  * @note p16 is filled in regardless
  */
  
-_PUBLIC_ bool E_deshash(const char *passwd, uint8_t p16[16])
+bool E_deshash(const char *passwd, uint8_t p16[16])
 {
 	bool ret = true;
 	fstring dospwd; 
diff --git a/source4/libcli/cliconnect.c b/source4/libcli/cliconnect.c
index 666dfe8446..4858a96110 100644
--- a/source4/libcli/cliconnect.c
+++ b/source4/libcli/cliconnect.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "libcli/libcli.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/auth/libcli_auth.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "param/param.h"
diff --git a/source4/libcli/clilist.c b/source4/libcli/clilist.c
index 07393a3491..5d43606c61 100644
--- a/source4/libcli/clilist.c
+++ b/source4/libcli/clilist.c
@@ -21,6 +21,7 @@
 #include "includes.h"
 #include "libcli/libcli.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 struct search_private {
 	struct clilist_file_info *dirlist;
diff --git a/source4/libcli/climessage.c b/source4/libcli/climessage.c
index 6002ccfc59..5ed0e8e3cd 100644
--- a/source4/libcli/climessage.c
+++ b/source4/libcli/climessage.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 
 
diff --git a/source4/libcli/clireadwrite.c b/source4/libcli/clireadwrite.c
index f5ba799bbc..ae2367918c 100644
--- a/source4/libcli/clireadwrite.c
+++ b/source4/libcli/clireadwrite.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 
 /****************************************************************************
diff --git a/source4/libcli/composite/composite.h b/source4/libcli/composite/composite.h
index db0ecf9af6..f1bed20361 100644
--- a/source4/libcli/composite/composite.h
+++ b/source4/libcli/composite/composite.h
@@ -19,6 +19,9 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#ifndef __COMPOSITE_H__
+#define __COMPOSITE_H__
+
 #include "libcli/raw/interfaces.h"
 
 /*
@@ -68,4 +71,36 @@ struct smb2_request;
 struct rpc_request;
 struct nbt_name_request;
 
-#include "libcli/composite/proto.h"
+struct composite_context *composite_create(TALLOC_CTX *mem_ctx, struct event_context *ev);
+bool composite_nomem(const void *p, struct composite_context *ctx);
+void composite_continue(struct composite_context *ctx,
+				 struct composite_context *new_ctx,
+				 void (*continuation)(struct composite_context *),
+				 void *private_data);
+void composite_continue_rpc(struct composite_context *ctx,
+				     struct rpc_request *new_req,
+				     void (*continuation)(struct rpc_request *),
+				     void *private_data);
+void composite_continue_irpc(struct composite_context *ctx,
+				      struct irpc_request *new_req,
+				      void (*continuation)(struct irpc_request *),
+				      void *private_data);
+void composite_continue_smb(struct composite_context *ctx,
+				     struct smbcli_request *new_req,
+				     void (*continuation)(struct smbcli_request *),
+				     void *private_data);
+void composite_continue_smb2(struct composite_context *ctx,
+				      struct smb2_request *new_req,
+				      void (*continuation)(struct smb2_request *),
+				      void *private_data);
+void composite_continue_nbt(struct composite_context *ctx,
+				     struct nbt_name_request *new_req,
+				     void (*continuation)(struct nbt_name_request *),
+				     void *private_data);
+bool composite_is_ok(struct composite_context *ctx);
+void composite_done(struct composite_context *ctx);
+void composite_error(struct composite_context *ctx, NTSTATUS status);
+NTSTATUS composite_wait(struct composite_context *c);
+
+
+#endif /* __COMPOSITE_H__ */
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index 79b16bfd74..95b45003be 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -1,6 +1,7 @@
 mkinclude auth/config.mk
 mkinclude ldap/config.mk
 mkinclude security/config.mk
+mkinclude wbclient/config.mk
 
 [SUBSYSTEM::LIBSAMBA-ERRORS]
 
@@ -54,13 +55,13 @@ LIBCLI_NBT_OBJ_FILES = $(addprefix libcli/nbt/, \
 
 [PYTHON::python_libcli_nbt]
 SWIG_FILE = swig/libcli_nbt.i
-PUBLIC_DEPENDENCIES = LIBCLI_NBT DYNCONFIG LIBSAMBA-CONFIG
+PUBLIC_DEPENDENCIES = LIBCLI_NBT DYNCONFIG LIBSAMBA-HOSTCONFIG
 
 python_libcli_nbt_OBJ_FILES = libcli/swig/libcli_nbt_wrap.o
 
 [PYTHON::python_libcli_smb]
 SWIG_FILE = swig/libcli_smb.i
-PUBLIC_DEPENDENCIES = LIBCLI_SMB DYNCONFIG LIBSAMBA-CONFIG
+PUBLIC_DEPENDENCIES = LIBCLI_SMB DYNCONFIG LIBSAMBA-HOSTCONFIG
 
 python_libcli_smb_OBJ_FILES = libcli/swig/libcli_smb_wrap.o
 
@@ -79,7 +80,7 @@ PUBLIC_DEPENDENCIES = LIBCLI_LDAP
 PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBLDB
 
 LIBCLI_CLDAP_OBJ_FILES = libcli/cldap/cldap.o
-PUBLIC_HEADERS += libcli/cldap/cldap.h
+# PUBLIC_HEADERS += libcli/cldap/cldap.h
 
 [SUBSYSTEM::LIBCLI_WREPL]
 PRIVATE_PROTO_HEADER = wrepl/winsrepl_proto.h
@@ -96,7 +97,7 @@ LIBCLI_RESOLVE_OBJ_FILES = libcli/resolve/resolve.o
 
 [SUBSYSTEM::LP_RESOLVE]
 PRIVATE_PROTO_HEADER = resolve/lp_proto.h
-PRIVATE_DEPENDENCIES = LIBCLI_NBT LIBSAMBA-CONFIG LIBNETIF 
+PRIVATE_DEPENDENCIES = LIBCLI_NBT LIBSAMBA-HOSTCONFIG LIBNETIF 
 
 LP_RESOLVE_OBJ_FILES = $(addprefix libcli/resolve/, \
 					  bcast.o nbtlist.o wins.o \
@@ -123,7 +124,7 @@ LIBCLI_SMB_OBJ_FILES = $(addprefix libcli/, \
 		climessage.o \
 		clideltree.o)
 
-PUBLIC_HEADERS += libcli/libcli.h
+# PUBLIC_HEADERS += libcli/libcli.h
 
 [SUBSYSTEM::LIBCLI_RAW]
 PRIVATE_PROTO_HEADER = raw/raw_proto.h
diff --git a/source4/libcli/ldap/config.mk b/source4/libcli/ldap/config.mk
index cc38796ac3..33e32c7417 100644
--- a/source4/libcli/ldap/config.mk
+++ b/source4/libcli/ldap/config.mk
@@ -9,10 +9,9 @@ LIBCLI_LDAP_OBJ_FILES = $(addprefix libcli/ldap/, \
 					   ldap_msg.o ldap_ildap.o ldap_controls.o)
 
 
-PUBLIC_HEADERS += libcli/ldap/ldap.h
+PUBLIC_HEADERS += libcli/ldap/ldap.h libcli/ldap/ldap_ndr.h
 
 [SUBSYSTEM::LDAP_ENCODE]
-PRIVATE_PROTO_HEADER = ldap_ndr.h
 # FIXME PRIVATE_DEPENDENCIES = LIBLDB
 
 LDAP_ENCODE_OBJ_FILES = libcli/ldap/ldap_ndr.o
diff --git a/source4/libcli/ldap/ldap.c b/source4/libcli/ldap/ldap.c
index 00a0631753..fc6de7993e 100644
--- a/source4/libcli/ldap/ldap.c
+++ b/source4/libcli/ldap/ldap.c
@@ -25,6 +25,7 @@
 #include "includes.h"
 #include "lib/util/asn1.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_proto.h"
 
 
 static bool ldap_push_filter(struct asn1_data *data, struct ldb_parse_tree *tree)
@@ -187,7 +188,7 @@ static void ldap_encode_response(struct asn1_data *data, struct ldap_Result *res
 	}
 }
 
-bool ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ctx)
+_PUBLIC_ bool ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ctx)
 {
 	struct asn1_data *data = asn1_init(mem_ctx);
 	int i, j;
@@ -927,7 +928,7 @@ static void ldap_decode_attribs(TALLOC_CTX *mem_ctx, struct asn1_data *data,
 
 /* This routine returns LDAP status codes */
 
-NTSTATUS ldap_decode(struct asn1_data *data, struct ldap_message *msg)
+_PUBLIC_ NTSTATUS ldap_decode(struct asn1_data *data, struct ldap_message *msg)
 {
 	uint8_t tag;
 
diff --git a/source4/libcli/ldap/ldap.h b/source4/libcli/ldap/ldap.h
index 6f5e86744e..a336a7ad85 100644
--- a/source4/libcli/ldap/ldap.h
+++ b/source4/libcli/ldap/ldap.h
@@ -254,6 +254,8 @@ struct cli_credentials;
 struct dom_sid;
 struct asn1_data;
 
-#include "libcli/ldap/ldap_proto.h"
+struct ldap_message *new_ldap_message(TALLOC_CTX *mem_ctx);
+NTSTATUS ldap_decode(struct asn1_data *data, struct ldap_message *msg);
+bool ldap_encode(struct ldap_message *msg, DATA_BLOB *result, TALLOC_CTX *mem_ctx);
 
 #endif
diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index fd15ff2fc7..2c04edf950 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_proto.h"
 #include "libcli/ldap/ldap_client.h"
 #include "lib/tls/tls.h"
 #include "auth/gensec/gensec.h"
@@ -35,7 +36,7 @@ struct ldap_simple_creds {
 	const char *pw;
 };
 
-NTSTATUS ldap_rebind(struct ldap_connection *conn)
+_PUBLIC_ NTSTATUS ldap_rebind(struct ldap_connection *conn)
 {
 	NTSTATUS status;
 	struct ldap_simple_creds *creds;
@@ -88,7 +89,7 @@ static struct ldap_message *new_ldap_simple_bind_msg(struct ldap_connection *con
 /*
   perform a simple username/password bind
 */
-NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
+_PUBLIC_ NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
 			  const char *userdn, const char *password)
 {
 	struct ldap_request *req;
@@ -199,7 +200,7 @@ static struct ldap_message *new_ldap_sasl_bind_msg(struct ldap_connection *conn,
 /*
   perform a sasl bind using the given credentials
 */
-NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
+_PUBLIC_ NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
 			struct cli_credentials *creds,
 			struct loadparm_context *lp_ctx)
 {
diff --git a/source4/libcli/ldap/ldap_client.c b/source4/libcli/ldap/ldap_client.c
index d99851ee15..296a7b11f2 100644
--- a/source4/libcli/ldap/ldap_client.c
+++ b/source4/libcli/ldap/ldap_client.c
@@ -28,6 +28,7 @@
 #include "lib/events/events.h"
 #include "lib/socket/socket.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_proto.h"
 #include "libcli/ldap/ldap_client.h"
 #include "libcli/composite/composite.h"
 #include "lib/stream/packet.h"
@@ -41,7 +42,7 @@
 /**
   create a new ldap_connection stucture. The event context is optional
 */
-struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx, 
 					     struct loadparm_context *lp_ctx,
 					     struct event_context *ev)
 {
@@ -293,7 +294,7 @@ struct ldap_connect_state {
 static void ldap_connect_recv_unix_conn(struct composite_context *ctx);
 static void ldap_connect_recv_tcp_conn(struct composite_context *ctx);
 
-struct composite_context *ldap_connect_send(struct ldap_connection *conn,
+_PUBLIC_ struct composite_context *ldap_connect_send(struct ldap_connection *conn,
 					    const char *url)
 {
 	struct composite_context *result, *ctx;
@@ -476,7 +477,7 @@ _PUBLIC_ NTSTATUS ldap_connect_recv(struct composite_context *ctx)
 	return status;
 }
 
-NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
+_PUBLIC_ NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
 {
 	struct composite_context *ctx = ldap_connect_send(conn, url);
 	return ldap_connect_recv(ctx);
@@ -484,7 +485,7 @@ NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url)
 
 /* set reconnect parameters */
 
-void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries)
+_PUBLIC_ void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries)
 {
 	if (conn) {
 		conn->reconnect.max_retries = max_retries;
@@ -569,7 +570,7 @@ static void ldap_request_complete(struct event_context *ev, struct timed_event *
 /*
   send a ldap message - async interface
 */
-struct ldap_request *ldap_request_send(struct ldap_connection *conn,
+_PUBLIC_ struct ldap_request *ldap_request_send(struct ldap_connection *conn,
 				       struct ldap_message *msg)
 {
 	struct ldap_request *req;
@@ -645,7 +646,7 @@ failed:
   wait for a request to complete
   note that this does not destroy the request
 */
-NTSTATUS ldap_request_wait(struct ldap_request *req)
+_PUBLIC_ NTSTATUS ldap_request_wait(struct ldap_request *req)
 {
 	while (req->state < LDAP_REQUEST_DONE) {
 		if (event_loop_once(req->conn->event.event_ctx) != 0) {
@@ -709,7 +710,7 @@ static const struct {
 /*
   used to setup the status code from a ldap response
 */
-NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r)
+_PUBLIC_ NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r)
 {
 	int i;
 	const char *codename = "unknown";
@@ -742,7 +743,7 @@ NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r
 /*
   return error string representing the last error
 */
-const char *ldap_errstr(struct ldap_connection *conn, 
+_PUBLIC_ const char *ldap_errstr(struct ldap_connection *conn, 
 			TALLOC_CTX *mem_ctx, 
 			NTSTATUS status)
 {
@@ -756,7 +757,7 @@ const char *ldap_errstr(struct ldap_connection *conn,
 /*
   return the Nth result message, waiting if necessary
 */
-NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg)
+_PUBLIC_ NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg)
 {
 	*msg = NULL;
 
@@ -784,7 +785,7 @@ NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **ms
 /*
   return a single result message, checking if it is of the expected LDAP type
 */
-NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type)
+_PUBLIC_ NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type)
 {
 	NTSTATUS status;
 	status = ldap_result_n(req, 0, msg);
@@ -802,7 +803,7 @@ NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, in
   a simple ldap transaction, for single result requests that only need a status code
   this relies on single valued requests having the response type == request type + 1
 */
-NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg)
+_PUBLIC_ NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg)
 {
 	struct ldap_request *req = ldap_request_send(conn, msg);
 	struct ldap_message *res;
diff --git a/source4/libcli/ldap/ldap_client.h b/source4/libcli/ldap/ldap_client.h
index d5ff441aff..13b0bf725c 100644
--- a/source4/libcli/ldap/ldap_client.h
+++ b/source4/libcli/ldap/ldap_client.h
@@ -94,3 +94,47 @@ struct ldap_connection {
 
 	struct packet_context *packet;
 };
+
+struct ldap_connection *ldap4_new_connection(TALLOC_CTX *mem_ctx, 
+					     struct loadparm_context *lp_ctx,
+					     struct event_context *ev);
+
+NTSTATUS ldap_connect(struct ldap_connection *conn, const char *url);
+struct composite_context *ldap_connect_send(struct ldap_connection *conn,
+					    const char *url);
+
+NTSTATUS ldap_rebind(struct ldap_connection *conn);
+NTSTATUS ldap_bind_simple(struct ldap_connection *conn, 
+			  const char *userdn, const char *password);
+NTSTATUS ldap_bind_sasl(struct ldap_connection *conn, 
+			struct cli_credentials *creds,
+			struct loadparm_context *lp_ctx);
+struct ldap_request *ldap_request_send(struct ldap_connection *conn,
+				       struct ldap_message *msg);
+NTSTATUS ldap_request_wait(struct ldap_request *req);
+struct composite_context;
+NTSTATUS ldap_connect_recv(struct composite_context *ctx);
+NTSTATUS ldap_result_n(struct ldap_request *req, int n, struct ldap_message **msg);
+NTSTATUS ldap_result_one(struct ldap_request *req, struct ldap_message **msg, int type);
+NTSTATUS ldap_transaction(struct ldap_connection *conn, struct ldap_message *msg);
+const char *ldap_errstr(struct ldap_connection *conn, 
+			TALLOC_CTX *mem_ctx, 
+			NTSTATUS status);
+NTSTATUS ldap_check_response(struct ldap_connection *conn, struct ldap_Result *r);
+void ldap_set_reconn_params(struct ldap_connection *conn, int max_retries);
+int ildap_count_entries(struct ldap_connection *conn, struct ldap_message **res);
+NTSTATUS ildap_search_bytree(struct ldap_connection *conn, const char *basedn, 
+			     int scope, struct ldb_parse_tree *tree,
+			     const char * const *attrs, bool attributesonly, 
+			     struct ldb_control **control_req,
+			     struct ldb_control ***control_res,
+			     struct ldap_message ***results);
+NTSTATUS ildap_search(struct ldap_connection *conn, const char *basedn, 
+		      int scope, const char *expression, 
+		      const char * const *attrs, bool attributesonly, 
+		      struct ldb_control **control_req,
+		      struct ldb_control ***control_res,
+		      struct ldap_message ***results);
+
+
+
diff --git a/source4/libcli/ldap/ldap_ildap.c b/source4/libcli/ldap/ldap_ildap.c
index 7b592c65ae..8f21af0690 100644
--- a/source4/libcli/ldap/ldap_ildap.c
+++ b/source4/libcli/ldap/ldap_ildap.c
@@ -28,7 +28,7 @@
 /*
   count the returned search entries
 */
-int ildap_count_entries(struct ldap_connection *conn, struct ldap_message **res)
+_PUBLIC_ int ildap_count_entries(struct ldap_connection *conn, struct ldap_message **res)
 {
 	int i;
 	for (i=0;res && res[i];i++) /* noop */ ;
@@ -39,7 +39,7 @@ int ildap_count_entries(struct ldap_connection *conn, struct ldap_message **res)
 /*
   perform a synchronous ldap search
 */
-NTSTATUS ildap_search_bytree(struct ldap_connection *conn, const char *basedn, 
+_PUBLIC_ NTSTATUS ildap_search_bytree(struct ldap_connection *conn, const char *basedn, 
 			     int scope, struct ldb_parse_tree *tree,
 			     const char * const *attrs, bool attributesonly, 
 			     struct ldb_control **control_req,
@@ -112,7 +112,7 @@ NTSTATUS ildap_search_bytree(struct ldap_connection *conn, const char *basedn,
 /*
   perform a ldap search
 */
-NTSTATUS ildap_search(struct ldap_connection *conn, const char *basedn, 
+_PUBLIC_ NTSTATUS ildap_search(struct ldap_connection *conn, const char *basedn, 
 		      int scope, const char *expression, 
 		      const char * const *attrs, bool attributesonly, 
 		      struct ldb_control **control_req,
diff --git a/source4/libcli/ldap/ldap_msg.c b/source4/libcli/ldap/ldap_msg.c
index 12832b8ec4..c712e1e654 100644
--- a/source4/libcli/ldap/ldap_msg.c
+++ b/source4/libcli/ldap/ldap_msg.c
@@ -26,7 +26,7 @@
 #include "libcli/ldap/ldap_client.h"
 
 
-struct ldap_message *new_ldap_message(TALLOC_CTX *mem_ctx)
+_PUBLIC_ struct ldap_message *new_ldap_message(TALLOC_CTX *mem_ctx)
 {
 	return talloc_zero(mem_ctx, struct ldap_message);
 }
diff --git a/source4/libcli/ldap/ldap_ndr.h b/source4/libcli/ldap/ldap_ndr.h
new file mode 100644
index 0000000000..dfbb723c36
--- /dev/null
+++ b/source4/libcli/ldap/ldap_ndr.h
@@ -0,0 +1,10 @@
+#ifndef __LIBCLI_LDAP_LDAP_NDR_H__
+#define __LIBCLI_LDAP_LDAP_NDR_H__
+
+char *ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t value);
+char *ldap_encode_ndr_dom_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
+char *ldap_encode_ndr_GUID(TALLOC_CTX *mem_ctx, struct GUID *guid);
+NTSTATUS ldap_decode_ndr_GUID(TALLOC_CTX *mem_ctx, struct ldb_val val, struct GUID *guid);
+
+#endif /* __LIBCLI_LDAP_LDAP_NDR_H__ */
+
diff --git a/source4/libcli/nbt/libnbt.h b/source4/libcli/nbt/libnbt.h
index bc85d87b89..14cec3a024 100644
--- a/source4/libcli/nbt/libnbt.h
+++ b/source4/libcli/nbt/libnbt.h
@@ -23,6 +23,7 @@
 #define __LIBNBT_H__
 
 #include "librpc/gen_ndr/nbt.h"
+#include "librpc/ndr/libndr.h"
 
 /*
   possible states for pending requests
@@ -273,6 +274,78 @@ struct nbt_name_release {
 	} out;
 };
 
-#include "libcli/nbt/nbt_proto.h"
+struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, 
+					     struct event_context *event_ctx,
+					     struct smb_iconv_convenience *iconv_convenience);
+struct nbt_name_request *nbt_name_query_send(struct nbt_name_socket *nbtsock,
+					     struct nbt_name_query *io);
+NTSTATUS nbt_name_query_recv(struct nbt_name_request *req, 
+			     TALLOC_CTX *mem_ctx, struct nbt_name_query *io);
+NTSTATUS nbt_name_query(struct nbt_name_socket *nbtsock, 
+			TALLOC_CTX *mem_ctx, struct nbt_name_query *io);
+struct nbt_name_request *nbt_name_status_send(struct nbt_name_socket *nbtsock,
+					      struct nbt_name_status *io);
+NTSTATUS nbt_name_status_recv(struct nbt_name_request *req, 
+			     TALLOC_CTX *mem_ctx, struct nbt_name_status *io);
+NTSTATUS nbt_name_status(struct nbt_name_socket *nbtsock, 
+			TALLOC_CTX *mem_ctx, struct nbt_name_status *io);
+
+NTSTATUS nbt_name_dup(TALLOC_CTX *mem_ctx, struct nbt_name *name, struct nbt_name *newname);
+NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, DATA_BLOB *blob, struct nbt_name *name);
+NTSTATUS nbt_name_from_blob(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, struct nbt_name *name);
+void nbt_choose_called_name(TALLOC_CTX *mem_ctx, struct nbt_name *n, const char *name, int type);
+char *nbt_name_string(TALLOC_CTX *mem_ctx, const struct nbt_name *name);
+NTSTATUS nbt_name_register(struct nbt_name_socket *nbtsock, 
+			   TALLOC_CTX *mem_ctx, struct nbt_name_register *io);
+NTSTATUS nbt_name_refresh(struct nbt_name_socket *nbtsock, 
+			   TALLOC_CTX *mem_ctx, struct nbt_name_refresh *io);
+NTSTATUS nbt_name_release(struct nbt_name_socket *nbtsock, 
+			   TALLOC_CTX *mem_ctx, struct nbt_name_release *io);
+NTSTATUS nbt_name_register_wins(struct nbt_name_socket *nbtsock,
+				TALLOC_CTX *mem_ctx,
+				struct nbt_name_register_wins *io);
+NTSTATUS nbt_name_refresh_wins(struct nbt_name_socket *nbtsock,
+				TALLOC_CTX *mem_ctx,
+				struct nbt_name_refresh_wins *io);
+NTSTATUS nbt_name_register_recv(struct nbt_name_request *req, 
+				TALLOC_CTX *mem_ctx, struct nbt_name_register *io);
+struct nbt_name_request *nbt_name_register_send(struct nbt_name_socket *nbtsock,
+						struct nbt_name_register *io);
+NTSTATUS nbt_name_release_recv(struct nbt_name_request *req, 
+			       TALLOC_CTX *mem_ctx, struct nbt_name_release *io);
+
+struct nbt_name_request *nbt_name_release_send(struct nbt_name_socket *nbtsock,
+					       struct nbt_name_release *io);
+
+NTSTATUS nbt_name_refresh_recv(struct nbt_name_request *req, 
+			       TALLOC_CTX *mem_ctx, struct nbt_name_refresh *io);
+
+NTSTATUS nbt_set_incoming_handler(struct nbt_name_socket *nbtsock,
+				  void (*handler)(struct nbt_name_socket *, struct nbt_name_packet *, 
+						  struct socket_address *),
+				  void *private);
+NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock, 
+			     struct socket_address *dest,
+			     struct nbt_name_packet *request);
+
+
+NDR_SCALAR_PROTO(wrepl_nbt_name, const struct nbt_name *)
+NDR_SCALAR_PROTO(nbt_string, const char *);
+NDR_BUFFER_PROTO(nbt_name, struct nbt_name)
+NTSTATUS nbt_rcode_to_ntstatus(uint8_t rcode);
+
+struct composite_context;
+struct composite_context *nbt_name_register_bcast_send(struct nbt_name_socket *nbtsock,
+						       struct nbt_name_register_bcast *io);
+NTSTATUS nbt_name_register_bcast_recv(struct composite_context *c);
+struct composite_context *nbt_name_register_wins_send(struct nbt_name_socket *nbtsock,
+						      struct nbt_name_register_wins *io);
+NTSTATUS nbt_name_refresh_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+				     struct nbt_name_refresh_wins *io);
+struct composite_context *nbt_name_refresh_wins_send(struct nbt_name_socket *nbtsock,
+						      struct nbt_name_refresh_wins *io);
+NTSTATUS nbt_name_register_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+				     struct nbt_name_register_wins *io);
+
 
 #endif /* __LIBNBT_H__ */
diff --git a/source4/libcli/nbt/namequery.c b/source4/libcli/nbt/namequery.c
index e3432bfda1..2e1bcd818b 100644
--- a/source4/libcli/nbt/namequery.c
+++ b/source4/libcli/nbt/namequery.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/nbt/libnbt.h"
+#include "libcli/nbt/nbt_proto.h"
 #include "lib/socket/socket.h"
 #include "param/param.h"
 
diff --git a/source4/libcli/nbt/namerefresh.c b/source4/libcli/nbt/namerefresh.c
index 1157c110a1..b372e4a3f3 100644
--- a/source4/libcli/nbt/namerefresh.c
+++ b/source4/libcli/nbt/namerefresh.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/nbt/libnbt.h"
+#include "libcli/nbt/nbt_proto.h"
 #include "libcli/composite/composite.h"
 #include "lib/socket/socket.h"
 #include "param/param.h"
@@ -86,7 +87,7 @@ failed:
 /*
   wait for a refresh reply
 */
-NTSTATUS nbt_name_refresh_recv(struct nbt_name_request *req, 
+_PUBLIC_ NTSTATUS nbt_name_refresh_recv(struct nbt_name_request *req, 
 			       TALLOC_CTX *mem_ctx, struct nbt_name_refresh *io)
 {
 	NTSTATUS status;
@@ -128,7 +129,7 @@ NTSTATUS nbt_name_refresh_recv(struct nbt_name_request *req,
 /*
   synchronous name refresh request
 */
-NTSTATUS nbt_name_refresh(struct nbt_name_socket *nbtsock, 
+_PUBLIC_ NTSTATUS nbt_name_refresh(struct nbt_name_socket *nbtsock, 
 			   TALLOC_CTX *mem_ctx, struct nbt_name_refresh *io)
 {
 	struct nbt_name_request *req = nbt_name_refresh_send(nbtsock, io);
@@ -217,7 +218,7 @@ done:
 /**
   the async send call for a multi-server WINS refresh
 */
-struct composite_context *nbt_name_refresh_wins_send(struct nbt_name_socket *nbtsock,
+_PUBLIC_ struct composite_context *nbt_name_refresh_wins_send(struct nbt_name_socket *nbtsock,
 						      struct nbt_name_refresh_wins *io)
 {
 	struct composite_context *c;
@@ -274,7 +275,7 @@ failed:
 /*
   multi-homed WINS name refresh - recv side
 */
-NTSTATUS nbt_name_refresh_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS nbt_name_refresh_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
 				     struct nbt_name_refresh_wins *io)
 {
 	NTSTATUS status;
@@ -292,7 +293,7 @@ NTSTATUS nbt_name_refresh_wins_recv(struct composite_context *c, TALLOC_CTX *mem
 /*
   multi-homed WINS refresh - sync interface
 */
-NTSTATUS nbt_name_refresh_wins(struct nbt_name_socket *nbtsock,
+_PUBLIC_ NTSTATUS nbt_name_refresh_wins(struct nbt_name_socket *nbtsock,
 				TALLOC_CTX *mem_ctx,
 				struct nbt_name_refresh_wins *io)
 {
diff --git a/source4/libcli/nbt/nameregister.c b/source4/libcli/nbt/nameregister.c
index 6667564664..9c5ae43d40 100644
--- a/source4/libcli/nbt/nameregister.c
+++ b/source4/libcli/nbt/nameregister.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/nbt/libnbt.h"
+#include "libcli/nbt/nbt_proto.h"
 #include "libcli/composite/composite.h"
 #include "lib/socket/socket.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
@@ -94,7 +95,7 @@ failed:
 /*
   wait for a registration reply
 */
-NTSTATUS nbt_name_register_recv(struct nbt_name_request *req, 
+_PUBLIC_ NTSTATUS nbt_name_register_recv(struct nbt_name_request *req, 
 				TALLOC_CTX *mem_ctx, struct nbt_name_register *io)
 {
 	NTSTATUS status;
@@ -136,7 +137,7 @@ NTSTATUS nbt_name_register_recv(struct nbt_name_request *req,
 /*
   synchronous name registration request
 */
-NTSTATUS nbt_name_register(struct nbt_name_socket *nbtsock, 
+_PUBLIC_ NTSTATUS nbt_name_register(struct nbt_name_socket *nbtsock, 
 			   TALLOC_CTX *mem_ctx, struct nbt_name_register *io)
 {
 	struct nbt_name_request *req = nbt_name_register_send(nbtsock, io);
@@ -207,7 +208,7 @@ done:
 /*
   the async send call for a 4 stage name registration
 */
-struct composite_context *nbt_name_register_bcast_send(struct nbt_name_socket *nbtsock,
+_PUBLIC_ struct composite_context *nbt_name_register_bcast_send(struct nbt_name_socket *nbtsock,
 						       struct nbt_name_register_bcast *io)
 {
 	struct composite_context *c;
@@ -256,7 +257,7 @@ failed:
 /*
   broadcast 4 part name register - recv
 */
-NTSTATUS nbt_name_register_bcast_recv(struct composite_context *c)
+_PUBLIC_ NTSTATUS nbt_name_register_bcast_recv(struct composite_context *c)
 {
 	NTSTATUS status;
 	status = composite_wait(c);
@@ -355,7 +356,7 @@ done:
 /*
   the async send call for a multi-server WINS register
 */
-struct composite_context *nbt_name_register_wins_send(struct nbt_name_socket *nbtsock,
+_PUBLIC_ struct composite_context *nbt_name_register_wins_send(struct nbt_name_socket *nbtsock,
 						      struct nbt_name_register_wins *io)
 {
 	struct composite_context *c;
@@ -414,7 +415,7 @@ failed:
 /*
   multi-homed WINS name register - recv side
 */
-NTSTATUS nbt_name_register_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS nbt_name_register_wins_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
 				     struct nbt_name_register_wins *io)
 {
 	NTSTATUS status;
@@ -432,7 +433,7 @@ NTSTATUS nbt_name_register_wins_recv(struct composite_context *c, TALLOC_CTX *me
 /*
   multi-homed WINS register - sync interface
 */
-NTSTATUS nbt_name_register_wins(struct nbt_name_socket *nbtsock,
+_PUBLIC_ NTSTATUS nbt_name_register_wins(struct nbt_name_socket *nbtsock,
 				TALLOC_CTX *mem_ctx,
 				struct nbt_name_register_wins *io)
 {
diff --git a/source4/libcli/nbt/namerelease.c b/source4/libcli/nbt/namerelease.c
index d735892516..ba3af41752 100644
--- a/source4/libcli/nbt/namerelease.c
+++ b/source4/libcli/nbt/namerelease.c
@@ -21,13 +21,14 @@
 
 #include "includes.h"
 #include "libcli/nbt/libnbt.h"
+#include "libcli/nbt/nbt_proto.h"
 #include "lib/socket/socket.h"
 #include "param/param.h"
 
 /*
   send a nbt name release request
 */
-struct nbt_name_request *nbt_name_release_send(struct nbt_name_socket *nbtsock,
+_PUBLIC_ struct nbt_name_request *nbt_name_release_send(struct nbt_name_socket *nbtsock,
 					       struct nbt_name_release *io)
 {
 	struct nbt_name_request *req;
@@ -84,7 +85,7 @@ failed:
 /*
   wait for a release reply
 */
-NTSTATUS nbt_name_release_recv(struct nbt_name_request *req, 
+_PUBLIC_ NTSTATUS nbt_name_release_recv(struct nbt_name_request *req, 
 			       TALLOC_CTX *mem_ctx, struct nbt_name_release *io)
 {
 	NTSTATUS status;
@@ -126,7 +127,7 @@ NTSTATUS nbt_name_release_recv(struct nbt_name_request *req,
 /*
   synchronous name release request
 */
-NTSTATUS nbt_name_release(struct nbt_name_socket *nbtsock, 
+_PUBLIC_ NTSTATUS nbt_name_release(struct nbt_name_socket *nbtsock, 
 			   TALLOC_CTX *mem_ctx, struct nbt_name_release *io)
 {
 	struct nbt_name_request *req = nbt_name_release_send(nbtsock, io);
diff --git a/source4/libcli/nbt/nbtname.c b/source4/libcli/nbt/nbtname.c
index ae9f3f6b05..0d9073ccbb 100644
--- a/source4/libcli/nbt/nbtname.c
+++ b/source4/libcli/nbt/nbtname.c
@@ -500,7 +500,7 @@ _PUBLIC_ char *nbt_name_string(TALLOC_CTX *mem_ctx, const struct nbt_name *name)
 /**
   pull a nbt name, WINS Replication uses another on wire format for nbt name
 */
-_PUBLIC_ enum ndr_err_code ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name **_r)
+_PUBLIC_ enum ndr_err_code ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, const struct nbt_name **_r)
 {
 	struct nbt_name *r;
 	uint8_t *namebuf;
diff --git a/source4/libcli/nbt/nbtsocket.c b/source4/libcli/nbt/nbtsocket.c
index 95a1643efc..747127980a 100644
--- a/source4/libcli/nbt/nbtsocket.c
+++ b/source4/libcli/nbt/nbtsocket.c
@@ -423,7 +423,7 @@ failed:
 /*
   send off a nbt name reply
 */
-NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock, 
+_PUBLIC_ NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock, 
 			     struct socket_address *dest,
 			     struct nbt_name_packet *request)
 {
@@ -486,7 +486,7 @@ NTSTATUS nbt_name_request_recv(struct nbt_name_request *req)
 /*
   setup a handler for incoming requests
 */
-NTSTATUS nbt_set_incoming_handler(struct nbt_name_socket *nbtsock,
+_PUBLIC_ NTSTATUS nbt_set_incoming_handler(struct nbt_name_socket *nbtsock,
 				  void (*handler)(struct nbt_name_socket *, struct nbt_name_packet *, 
 						  struct socket_address *),
 				  void *private)
@@ -501,7 +501,7 @@ NTSTATUS nbt_set_incoming_handler(struct nbt_name_socket *nbtsock,
 /*
   turn a NBT rcode into a NTSTATUS
 */
-NTSTATUS nbt_rcode_to_ntstatus(uint8_t rcode)
+_PUBLIC_ NTSTATUS nbt_rcode_to_ntstatus(uint8_t rcode)
 {
 	int i;
 	struct {
diff --git a/source4/libcli/raw/clierror.c b/source4/libcli/raw/clierror.c
index c515259ee7..157bd847d4 100644
--- a/source4/libcli/raw/clierror.c
+++ b/source4/libcli/raw/clierror.c
@@ -25,7 +25,7 @@
 /***************************************************************************
  Return an error message from the last response
 ****************************************************************************/
-const char *smbcli_errstr(struct smbcli_tree *tree)
+_PUBLIC_ const char *smbcli_errstr(struct smbcli_tree *tree)
 {   
 	switch (tree->session->transport->error.etype) {
 	case ETYPE_SMB:
@@ -45,7 +45,7 @@ const char *smbcli_errstr(struct smbcli_tree *tree)
 
 
 /* Return the 32-bit NT status code from the last packet */
-NTSTATUS smbcli_nt_error(struct smbcli_tree *tree)
+_PUBLIC_ NTSTATUS smbcli_nt_error(struct smbcli_tree *tree)
 {
 	switch (tree->session->transport->error.etype) {
 	case ETYPE_SMB:
diff --git a/source4/libcli/raw/clioplock.c b/source4/libcli/raw/clioplock.c
index ae4e58ae01..47ffb6dd31 100644
--- a/source4/libcli/raw/clioplock.c
+++ b/source4/libcli/raw/clioplock.c
@@ -19,6 +19,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 /****************************************************************************
 send an ack for an oplock break request
diff --git a/source4/libcli/raw/clisession.c b/source4/libcli/raw/clisession.c
index 5a33d9cffc..ad4ca7b471 100644
--- a/source4/libcli/raw/clisession.c
+++ b/source4/libcli/raw/clisession.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/filesys.h"
 #include "param/param.h"
 
@@ -291,7 +292,7 @@ struct smbcli_request *smb_raw_exit_send(struct smbcli_session *session)
 /****************************************************************************
  Send a exit (sync interface)
 *****************************************************************************/
-NTSTATUS smb_raw_exit(struct smbcli_session *session)
+_PUBLIC_ NTSTATUS smb_raw_exit(struct smbcli_session *session)
 {
 	struct smbcli_request *req = smb_raw_exit_send(session);
 	return smbcli_request_simple_recv(req);
diff --git a/source4/libcli/raw/clisocket.c b/source4/libcli/raw/clisocket.c
index eaa02e1047..1dcf2d1c53 100644
--- a/source4/libcli/raw/clisocket.c
+++ b/source4/libcli/raw/clisocket.c
@@ -170,7 +170,7 @@ NTSTATUS smbcli_sock_connect(TALLOC_CTX *mem_ctx,
 /****************************************************************************
  mark the socket as dead
 ****************************************************************************/
-void smbcli_sock_dead(struct smbcli_socket *sock)
+_PUBLIC_ void smbcli_sock_dead(struct smbcli_socket *sock)
 {
 	talloc_free(sock->event.fde);
 	sock->event.fde = NULL;
@@ -189,7 +189,7 @@ void smbcli_sock_set_options(struct smbcli_socket *sock, const char *options)
 /****************************************************************************
 resolve a hostname and connect 
 ****************************************************************************/
-struct smbcli_socket *smbcli_sock_connect_byname(const char *host, const char **ports,
+_PUBLIC_ struct smbcli_socket *smbcli_sock_connect_byname(const char *host, const char **ports,
 						 TALLOC_CTX *mem_ctx,
 						 struct resolve_context *resolve_ctx,
 						 struct event_context *event_ctx)
diff --git a/source4/libcli/raw/clitransport.c b/source4/libcli/raw/clitransport.c
index 5c14e9f9b8..34fb96230d 100644
--- a/source4/libcli/raw/clitransport.c
+++ b/source4/libcli/raw/clitransport.c
@@ -21,12 +21,14 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "lib/socket/socket.h"
 #include "lib/util/dlinklist.h"
 #include "lib/events/events.h"
 #include "lib/stream/packet.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
 #include "param/param.h"
+#include "libcli/nbt/libnbt.h"
 
 
 /*
@@ -322,7 +324,7 @@ static void idle_handler(struct event_context *ev,
   setup the idle handler for a transport
   the period is in microseconds
 */
-void smbcli_transport_idle_handler(struct smbcli_transport *transport, 
+_PUBLIC_ void smbcli_transport_idle_handler(struct smbcli_transport *transport, 
 				   void (*idle_func)(struct smbcli_transport *, void *),
 				   uint64_t period,
 				   void *private)
@@ -502,7 +504,7 @@ error:
   process some read/write requests that are pending
   return false if the socket is dead
 */
-bool smbcli_transport_process(struct smbcli_transport *transport)
+_PUBLIC_ bool smbcli_transport_process(struct smbcli_transport *transport)
 {
 	NTSTATUS status;
 	size_t npending;
@@ -599,7 +601,7 @@ void smbcli_transport_send(struct smbcli_request *req)
 /****************************************************************************
  Send an SMBecho (async send)
 *****************************************************************************/
-struct smbcli_request *smb_raw_echo_send(struct smbcli_transport *transport,
+_PUBLIC_ struct smbcli_request *smb_raw_echo_send(struct smbcli_transport *transport,
 					 struct smb_echo *p)
 {
 	struct smbcli_request *req;
diff --git a/source4/libcli/raw/clitree.c b/source4/libcli/raw/clitree.c
index 507bde999a..d5075f9271 100644
--- a/source4/libcli/raw/clitree.c
+++ b/source4/libcli/raw/clitree.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "param/param.h"
 
@@ -33,7 +34,7 @@
 /****************************************************************************
  Initialize the tree context
 ****************************************************************************/
-struct smbcli_tree *smbcli_tree_init(struct smbcli_session *session,
+_PUBLIC_ struct smbcli_tree *smbcli_tree_init(struct smbcli_session *session,
 				     TALLOC_CTX *parent_ctx, bool primary)
 {
 	struct smbcli_tree *tree;
@@ -141,7 +142,7 @@ failed:
 /****************************************************************************
  Send a tconX (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_tcon(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS smb_raw_tcon(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, 
 		      union smb_tcon *parms)
 {
 	struct smbcli_request *req = smb_raw_tcon_send(tree, parms);
@@ -152,7 +153,7 @@ NTSTATUS smb_raw_tcon(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx,
 /****************************************************************************
  Send a tree disconnect.
 ****************************************************************************/
-NTSTATUS smb_tree_disconnect(struct smbcli_tree *tree)
+_PUBLIC_ NTSTATUS smb_tree_disconnect(struct smbcli_tree *tree)
 {
 	struct smbcli_request *req;
 
diff --git a/source4/libcli/raw/libcliraw.h b/source4/libcli/raw/libcliraw.h
index 0578a9eab1..16a98ad66e 100644
--- a/source4/libcli/raw/libcliraw.h
+++ b/source4/libcli/raw/libcliraw.h
@@ -286,6 +286,80 @@ struct smbcli_request {
 }
 
 #include "libcli/raw/interfaces.h" 
-#include "libcli/raw/raw_proto.h"
+
+NTSTATUS smb_raw_read_recv(struct smbcli_request *req, union smb_read *parms);
+struct smbcli_request *smb_raw_read_send(struct smbcli_tree *tree, union smb_read *parms);
+NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
+			     TALLOC_CTX *mem_ctx,
+			     struct smb_trans2 *parms);
+size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size);
+struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree, struct smb_trans2 *parms);
+NTSTATUS smbcli_request_destroy(struct smbcli_request *req);
+struct smbcli_request *smb_raw_write_send(struct smbcli_tree *tree, union smb_write *parms);
+struct smbcli_request *smb_raw_close_send(struct smbcli_tree *tree, union smb_close *parms);
+NTSTATUS smb_raw_open_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, union smb_open *parms);
+struct smbcli_request *smb_raw_open_send(struct smbcli_tree *tree, union smb_open *parms);
+
+bool smbcli_transport_process(struct smbcli_transport *transport);
+const char *smbcli_errstr(struct smbcli_tree *tree);
+NTSTATUS smb_raw_fsinfo(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_fsinfo *fsinfo);
+NTSTATUS smb_raw_pathinfo(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_fileinfo *parms);
+NTSTATUS smb_raw_shadow_data(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, struct smb_shadow_copy *info);
+NTSTATUS smb_raw_fileinfo(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_fileinfo *parms);
+struct smbcli_tree *smbcli_tree_init(struct smbcli_session *session, TALLOC_CTX *parent_ctx, bool primary);
+NTSTATUS smb_raw_tcon(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_tcon *parms);
+void smbcli_oplock_handler(struct smbcli_transport *transport, 
+			bool (*handler)(struct smbcli_transport *, uint16_t, uint16_t, uint8_t, void *),
+			void *private);
+void smbcli_transport_idle_handler(struct smbcli_transport *transport, 
+				   void (*idle_func)(struct smbcli_transport *, void *),
+				   uint64_t period,
+				   void *private);
+NTSTATUS smbcli_request_simple_recv(struct smbcli_request *req);
+bool smbcli_oplock_ack(struct smbcli_tree *tree, uint16_t fnum, uint16_t ack_level);
+NTSTATUS smb_raw_open(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_open *parms);
+NTSTATUS smb_raw_close(struct smbcli_tree *tree, union smb_close *parms);
+NTSTATUS smb_raw_unlink(struct smbcli_tree *tree, union smb_unlink *parms);
+NTSTATUS smb_raw_chkpath(struct smbcli_tree *tree, union smb_chkpath *parms);
+NTSTATUS smb_raw_mkdir(struct smbcli_tree *tree, union smb_mkdir *parms);
+NTSTATUS smb_raw_rmdir(struct smbcli_tree *tree, struct smb_rmdir *parms);
+NTSTATUS smb_raw_rename(struct smbcli_tree *tree, union smb_rename *parms);
+NTSTATUS smb_raw_seek(struct smbcli_tree *tree, union smb_seek *parms);
+NTSTATUS smb_raw_read(struct smbcli_tree *tree, union smb_read *parms);
+NTSTATUS smb_raw_write(struct smbcli_tree *tree, union smb_write *parms);
+NTSTATUS smb_raw_lock(struct smbcli_tree *tree, union smb_lock *parms);
+NTSTATUS smb_raw_setpathinfo(struct smbcli_tree *tree, union smb_setfileinfo *parms);
+NTSTATUS smb_raw_setfileinfo(struct smbcli_tree *tree, union smb_setfileinfo *parms);
+
+struct smbcli_request *smb_raw_changenotify_send(struct smbcli_tree *tree, union smb_notify *parms);
+NTSTATUS smb_raw_changenotify_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, union smb_notify *parms);
+
+NTSTATUS smb_tree_disconnect(struct smbcli_tree *tree);
+NTSTATUS smbcli_nt_error(struct smbcli_tree *tree);
+NTSTATUS smb_raw_exit(struct smbcli_session *session);
+NTSTATUS smb_raw_pathinfo_recv(struct smbcli_request *req,
+			       TALLOC_CTX *mem_ctx,
+			       union smb_fileinfo *parms);
+struct smbcli_request *smb_raw_pathinfo_send(struct smbcli_tree *tree,
+					     union smb_fileinfo *parms);
+struct smbcli_request *smb_raw_setpathinfo_send(struct smbcli_tree *tree,
+					     union smb_setfileinfo *parms);
+struct smbcli_request *smb_raw_echo_send(struct smbcli_transport *transport,
+					 struct smb_echo *p);
+NTSTATUS smb_raw_search_first(struct smbcli_tree *tree,
+			      TALLOC_CTX *mem_ctx,
+			      union smb_search_first *io, void *private,
+			      smbcli_search_callback callback);
+NTSTATUS smb_raw_flush(struct smbcli_tree *tree, union smb_flush *parms);
+
+NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
+		       TALLOC_CTX *mem_ctx,
+		       struct smb_trans2 *parms);
+
+struct smbcli_socket *smbcli_sock_connect_byname(const char *host, const char **ports,
+						 TALLOC_CTX *mem_ctx,
+						 struct resolve_context *resolve_ctx,
+						 struct event_context *event_ctx);
+void smbcli_sock_dead(struct smbcli_socket *sock);
 
 #endif /* __LIBCLI_RAW__H__ */
diff --git a/source4/libcli/raw/rawacl.c b/source4/libcli/raw/rawacl.c
index 847d133173..466b94f4a9 100644
--- a/source4/libcli/raw/rawacl.c
+++ b/source4/libcli/raw/rawacl.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "param/param.h"
 
diff --git a/source4/libcli/raw/rawfile.c b/source4/libcli/raw/rawfile.c
index 725034c3a9..3c5c1b742b 100644
--- a/source4/libcli/raw/rawfile.c
+++ b/source4/libcli/raw/rawfile.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "smb.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_security.h"
 
 #define SETUP_REQUEST(cmd, wct, buflen) do { \
@@ -92,7 +93,7 @@ struct smbcli_request *smb_raw_rename_send(struct smbcli_tree *tree,
 /****************************************************************************
  Rename a file - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_rename(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_rename(struct smbcli_tree *tree,
 			union smb_rename *parms)
 {
 	struct smbcli_request *req = smb_raw_rename_send(tree, parms);
@@ -123,7 +124,7 @@ struct smbcli_request *smb_raw_unlink_send(struct smbcli_tree *tree,
 /*
   delete a file - sync interface
 */
-NTSTATUS smb_raw_unlink(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_unlink(struct smbcli_tree *tree,
 			union smb_unlink *parms)
 {
 	struct smbcli_request *req = smb_raw_unlink_send(tree, parms);
@@ -201,7 +202,7 @@ struct smbcli_request *smb_raw_mkdir_send(struct smbcli_tree *tree,
 /****************************************************************************
  Create a directory - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_mkdir(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_mkdir(struct smbcli_tree *tree,
 		       union smb_mkdir *parms)
 {
 	struct smbcli_request *req = smb_raw_mkdir_send(tree, parms);
@@ -231,7 +232,7 @@ struct smbcli_request *smb_raw_rmdir_send(struct smbcli_tree *tree,
 /****************************************************************************
  Remove a directory - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_rmdir(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_rmdir(struct smbcli_tree *tree,
 		       struct smb_rmdir *parms)
 {
 	struct smbcli_request *req = smb_raw_rmdir_send(tree, parms);
@@ -448,7 +449,7 @@ static NTSTATUS smb_raw_t2open_recv(struct smbcli_request *req, TALLOC_CTX *mem_
 /****************************************************************************
  Open a file - async send
 ****************************************************************************/
-struct smbcli_request *smb_raw_open_send(struct smbcli_tree *tree, union smb_open *parms)
+_PUBLIC_ struct smbcli_request *smb_raw_open_send(struct smbcli_tree *tree, union smb_open *parms)
 {
 	int len;
 	struct smbcli_request *req = NULL; 
@@ -585,7 +586,7 @@ struct smbcli_request *smb_raw_open_send(struct smbcli_tree *tree, union smb_ope
 /****************************************************************************
  Open a file - async recv
 ****************************************************************************/
-NTSTATUS smb_raw_open_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, union smb_open *parms)
+_PUBLIC_ NTSTATUS smb_raw_open_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, union smb_open *parms)
 {
 	NTSTATUS status;
 
@@ -720,7 +721,7 @@ failed:
 /****************************************************************************
  Open a file - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_open(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_open *parms)
+_PUBLIC_ NTSTATUS smb_raw_open(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_open *parms)
 {
 	struct smbcli_request *req = smb_raw_open_send(tree, parms);
 	return smb_raw_open_recv(req, mem_ctx, parms);
@@ -730,7 +731,7 @@ NTSTATUS smb_raw_open(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_o
 /****************************************************************************
  Close a file - async send
 ****************************************************************************/
-struct smbcli_request *smb_raw_close_send(struct smbcli_tree *tree, union smb_close *parms)
+_PUBLIC_ struct smbcli_request *smb_raw_close_send(struct smbcli_tree *tree, union smb_close *parms)
 {
 	struct smbcli_request *req = NULL; 
 
@@ -766,7 +767,7 @@ struct smbcli_request *smb_raw_close_send(struct smbcli_tree *tree, union smb_cl
 /****************************************************************************
  Close a file - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_close(struct smbcli_tree *tree, union smb_close *parms)
+_PUBLIC_ NTSTATUS smb_raw_close(struct smbcli_tree *tree, union smb_close *parms)
 {
 	struct smbcli_request *req = smb_raw_close_send(tree, parms);
 	return smbcli_request_simple_recv(req);
@@ -843,7 +844,7 @@ struct smbcli_request *smb_raw_lock_send(struct smbcli_tree *tree, union smb_loc
 /****************************************************************************
  Locking calls - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_lock(struct smbcli_tree *tree, union smb_lock *parms)
+_PUBLIC_ NTSTATUS smb_raw_lock(struct smbcli_tree *tree, union smb_lock *parms)
 {
 	struct smbcli_request *req = smb_raw_lock_send(tree, parms);
 	return smbcli_request_simple_recv(req);
@@ -913,7 +914,7 @@ struct smbcli_request *smb_raw_flush_send(struct smbcli_tree *tree, union smb_fl
 /****************************************************************************
  flush a file - sync interface
 ****************************************************************************/
-NTSTATUS smb_raw_flush(struct smbcli_tree *tree, union smb_flush *parms)
+_PUBLIC_ NTSTATUS smb_raw_flush(struct smbcli_tree *tree, union smb_flush *parms)
 {
 	struct smbcli_request *req = smb_raw_flush_send(tree, parms);
 	return smbcli_request_simple_recv(req);
@@ -962,7 +963,7 @@ failed:
 /*
   seek a file - sync interface
 */
-NTSTATUS smb_raw_seek(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_seek(struct smbcli_tree *tree,
 		      union smb_seek *parms)
 {
 	struct smbcli_request *req = smb_raw_seek_send(tree, parms);
diff --git a/source4/libcli/raw/rawfileinfo.c b/source4/libcli/raw/rawfileinfo.c
index ed5475e926..71900be49c 100644
--- a/source4/libcli/raw/rawfileinfo.c
+++ b/source4/libcli/raw/rawfileinfo.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "param/param.h"
 
@@ -711,7 +712,7 @@ NTSTATUS smb_raw_fileinfo_recv(struct smbcli_request *req,
 /****************************************************************************
  Query file info (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_fileinfo(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_fileinfo(struct smbcli_tree *tree,
 			  TALLOC_CTX *mem_ctx,
 			  union smb_fileinfo *parms)
 {
@@ -722,7 +723,7 @@ NTSTATUS smb_raw_fileinfo(struct smbcli_tree *tree,
 /****************************************************************************
  Query path info (async send)
 ****************************************************************************/
-struct smbcli_request *smb_raw_pathinfo_send(struct smbcli_tree *tree,
+_PUBLIC_ struct smbcli_request *smb_raw_pathinfo_send(struct smbcli_tree *tree,
 					     union smb_fileinfo *parms)
 {
 	DATA_BLOB data;
@@ -756,7 +757,7 @@ struct smbcli_request *smb_raw_pathinfo_send(struct smbcli_tree *tree,
 /****************************************************************************
  Query path info (async recv)
 ****************************************************************************/
-NTSTATUS smb_raw_pathinfo_recv(struct smbcli_request *req,
+_PUBLIC_ NTSTATUS smb_raw_pathinfo_recv(struct smbcli_request *req,
 			       TALLOC_CTX *mem_ctx,
 			       union smb_fileinfo *parms)
 {
@@ -767,7 +768,7 @@ NTSTATUS smb_raw_pathinfo_recv(struct smbcli_request *req,
 /****************************************************************************
  Query path info (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_pathinfo(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_pathinfo(struct smbcli_tree *tree,
 			  TALLOC_CTX *mem_ctx,
 			  union smb_fileinfo *parms)
 {
diff --git a/source4/libcli/raw/rawfsinfo.c b/source4/libcli/raw/rawfsinfo.c
index bfb5db828e..43a0919e38 100644
--- a/source4/libcli/raw/rawfsinfo.c
+++ b/source4/libcli/raw/rawfsinfo.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 
 /****************************************************************************
@@ -326,7 +327,7 @@ failed:
 /****************************************************************************
  Query FSInfo raw interface (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_fsinfo(struct smbcli_tree *tree, 
+_PUBLIC_ NTSTATUS smb_raw_fsinfo(struct smbcli_tree *tree, 
 			TALLOC_CTX *mem_ctx, 
 			union smb_fsinfo *fsinfo)
 {
diff --git a/source4/libcli/raw/rawioctl.c b/source4/libcli/raw/rawioctl.c
index 957e554c6b..77c7b03f15 100644
--- a/source4/libcli/raw/rawioctl.c
+++ b/source4/libcli/raw/rawioctl.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 #define SETUP_REQUEST(cmd, wct, buflen) do { \
 	req = smbcli_request_setup(tree, cmd, wct, buflen); \
@@ -163,7 +164,7 @@ NTSTATUS smb_raw_ioctl_recv(struct smbcli_request *req,
 /* 
    send a raw ioctl - sync interface
 */
-_PUBLIC_ NTSTATUS smb_raw_ioctl(struct smbcli_tree *tree, 
+NTSTATUS smb_raw_ioctl(struct smbcli_tree *tree, 
 		TALLOC_CTX *mem_ctx, union smb_ioctl *parms)
 {
 	struct smbcli_request *req;
diff --git a/source4/libcli/raw/rawnegotiate.c b/source4/libcli/raw/rawnegotiate.c
index 6c16935f21..f0de4b48bd 100644
--- a/source4/libcli/raw/rawnegotiate.c
+++ b/source4/libcli/raw/rawnegotiate.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "param/param.h"
 
diff --git a/source4/libcli/raw/rawnotify.c b/source4/libcli/raw/rawnotify.c
index 91a12a8618..bf7578d7fc 100644
--- a/source4/libcli/raw/rawnotify.c
+++ b/source4/libcli/raw/rawnotify.c
@@ -19,12 +19,13 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "lib/util/dlinklist.h"
 
 /****************************************************************************
 change notify (async send)
 ****************************************************************************/
-struct smbcli_request *smb_raw_changenotify_send(struct smbcli_tree *tree, union smb_notify *parms)
+_PUBLIC_ struct smbcli_request *smb_raw_changenotify_send(struct smbcli_tree *tree, union smb_notify *parms)
 {
 	struct smb_nttrans nt;
 	uint8_t setup[8];
@@ -51,7 +52,7 @@ struct smbcli_request *smb_raw_changenotify_send(struct smbcli_tree *tree, union
 /****************************************************************************
 change notify (async recv)
 ****************************************************************************/
-NTSTATUS smb_raw_changenotify_recv(struct smbcli_request *req, 
+_PUBLIC_ NTSTATUS smb_raw_changenotify_recv(struct smbcli_request *req, 
 				   TALLOC_CTX *mem_ctx, union smb_notify *parms)
 {
 	struct smb_nttrans nt;
diff --git a/source4/libcli/raw/rawreadwrite.c b/source4/libcli/raw/rawreadwrite.c
index 9e4edaf99c..a8c7996310 100644
--- a/source4/libcli/raw/rawreadwrite.c
+++ b/source4/libcli/raw/rawreadwrite.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 #define SETUP_REQUEST(cmd, wct, buflen) do { \
 	req = smbcli_request_setup(tree, cmd, wct, buflen); \
@@ -29,7 +30,7 @@
 /****************************************************************************
  low level read operation (async send)
 ****************************************************************************/
-struct smbcli_request *smb_raw_read_send(struct smbcli_tree *tree, union smb_read *parms)
+_PUBLIC_ struct smbcli_request *smb_raw_read_send(struct smbcli_tree *tree, union smb_read *parms)
 {
 	bool bigoffset = false;
 	struct smbcli_request *req = NULL; 
@@ -115,7 +116,7 @@ struct smbcli_request *smb_raw_read_send(struct smbcli_tree *tree, union smb_rea
 /****************************************************************************
  low level read operation (async recv)
 ****************************************************************************/
-NTSTATUS smb_raw_read_recv(struct smbcli_request *req, union smb_read *parms)
+_PUBLIC_ NTSTATUS smb_raw_read_recv(struct smbcli_request *req, union smb_read *parms)
 {
 	if (!smbcli_request_receive(req) ||
 	    smbcli_request_is_error(req)) {
@@ -197,7 +198,7 @@ failed:
 /****************************************************************************
  low level read operation (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_read(struct smbcli_tree *tree, union smb_read *parms)
+_PUBLIC_ NTSTATUS smb_raw_read(struct smbcli_tree *tree, union smb_read *parms)
 {
 	struct smbcli_request *req = smb_raw_read_send(tree, parms);
 	return smb_raw_read_recv(req, parms);
@@ -207,7 +208,7 @@ NTSTATUS smb_raw_read(struct smbcli_tree *tree, union smb_read *parms)
 /****************************************************************************
  raw write interface (async send)
 ****************************************************************************/
-struct smbcli_request *smb_raw_write_send(struct smbcli_tree *tree, union smb_write *parms)
+_PUBLIC_ struct smbcli_request *smb_raw_write_send(struct smbcli_tree *tree, union smb_write *parms)
 {
 	bool bigoffset = false;
 	struct smbcli_request *req = NULL; 
@@ -341,7 +342,7 @@ failed:
 /****************************************************************************
  raw write interface (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_write(struct smbcli_tree *tree, union smb_write *parms)
+_PUBLIC_ NTSTATUS smb_raw_write(struct smbcli_tree *tree, union smb_write *parms)
 {
 	struct smbcli_request *req = smb_raw_write_send(tree, parms);
 	return smb_raw_write_recv(req, parms);
diff --git a/source4/libcli/raw/rawrequest.c b/source4/libcli/raw/rawrequest.c
index 355d092583..a42c710547 100644
--- a/source4/libcli/raw/rawrequest.c
+++ b/source4/libcli/raw/rawrequest.c
@@ -24,9 +24,12 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "lib/util/dlinklist.h"
 #include "lib/events/events.h"
 #include "param/param.h"
+#include "librpc/ndr/libndr.h"
+#include "librpc/gen_ndr/ndr_misc.h"
 
 /* we over allocate the data buffer to prevent too many realloc calls */
 #define REQ_OVER_ALLOCATION 0
@@ -49,7 +52,7 @@ void smb_setup_bufinfo(struct smbcli_request *req)
 
 
 /* destroy a request structure and return final status */
-NTSTATUS smbcli_request_destroy(struct smbcli_request *req)
+_PUBLIC_ NTSTATUS smbcli_request_destroy(struct smbcli_request *req)
 {
 	NTSTATUS status;
 
@@ -405,7 +408,7 @@ bool smbcli_handle_oplock_break(struct smbcli_transport *transport, uint_t len,
   wait for a reply to be received for a packet that just returns an error
   code and nothing more
 */
-NTSTATUS smbcli_request_simple_recv(struct smbcli_request *req)
+_PUBLIC_ NTSTATUS smbcli_request_simple_recv(struct smbcli_request *req)
 {
 	(void) smbcli_request_receive(req);
 	return smbcli_request_destroy(req);
diff --git a/source4/libcli/raw/rawsearch.c b/source4/libcli/raw/rawsearch.c
index fb2b09467c..99141574e2 100644
--- a/source4/libcli/raw/rawsearch.c
+++ b/source4/libcli/raw/rawsearch.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 /****************************************************************************
  Old style search backend - process output.
@@ -718,7 +719,7 @@ static NTSTATUS smb_raw_t2search_backend(struct smbcli_tree *tree,
 
 /* Implements trans2findfirst2 and old search
  */
-NTSTATUS smb_raw_search_first(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_search_first(struct smbcli_tree *tree,
 			      TALLOC_CTX *mem_ctx,
 			      union smb_search_first *io, void *private,
 			      smbcli_search_callback callback)
diff --git a/source4/libcli/raw/rawsetfileinfo.c b/source4/libcli/raw/rawsetfileinfo.c
index f1e4ee3686..16052e8708 100644
--- a/source4/libcli/raw/rawsetfileinfo.c
+++ b/source4/libcli/raw/rawsetfileinfo.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_security.h"
 
 
@@ -409,7 +410,7 @@ struct smbcli_request *smb_raw_setfileinfo_send(struct smbcli_tree *tree,
 /****************************************************************************
  Set file info (async send)
 ****************************************************************************/
-NTSTATUS smb_raw_setfileinfo(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_setfileinfo(struct smbcli_tree *tree,
 			     union smb_setfileinfo *parms)
 {
 	struct smbcli_request *req = smb_raw_setfileinfo_send(tree, parms);
@@ -420,7 +421,7 @@ NTSTATUS smb_raw_setfileinfo(struct smbcli_tree *tree,
 /****************************************************************************
  Set path info (async send)
 ****************************************************************************/
-struct smbcli_request *smb_raw_setpathinfo_send(struct smbcli_tree *tree,
+_PUBLIC_ struct smbcli_request *smb_raw_setpathinfo_send(struct smbcli_tree *tree,
 					     union smb_setfileinfo *parms)
 {
 	DATA_BLOB blob;
@@ -456,7 +457,7 @@ struct smbcli_request *smb_raw_setpathinfo_send(struct smbcli_tree *tree,
 /****************************************************************************
  Set path info (sync interface)
 ****************************************************************************/
-NTSTATUS smb_raw_setpathinfo(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_setpathinfo(struct smbcli_tree *tree,
 			     union smb_setfileinfo *parms)
 {
 	struct smbcli_request *req = smb_raw_setpathinfo_send(tree, parms);
diff --git a/source4/libcli/raw/rawshadow.c b/source4/libcli/raw/rawshadow.c
index 4c58c91383..b318c3e025 100644
--- a/source4/libcli/raw/rawshadow.c
+++ b/source4/libcli/raw/rawshadow.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/raw/ioctl.h"
 
 /* 
diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c
index 53670d22a3..29881afd2b 100644
--- a/source4/libcli/raw/rawtrans.c
+++ b/source4/libcli/raw/rawtrans.c
@@ -21,6 +21,7 @@
 #include "includes.h"
 #include "lib/util/dlinklist.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 #define TORTURE_TRANS_DATA 0
 
@@ -192,7 +193,7 @@ failed:
 	return smbcli_request_destroy(req);
 }
 
-NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
+_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
 			     TALLOC_CTX *mem_ctx,
 			     struct smb_trans2 *parms)
 {
@@ -365,7 +366,7 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
   trans/trans2 raw async interface - only BLOBs used in this interface.
   note that this doesn't yet support multi-part requests
 */
-struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
+_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
 				       struct smb_trans2 *parms)
 {
 	return smb_raw_trans_send_backend(tree, parms, SMBtrans);
@@ -394,7 +395,7 @@ NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
 /*
   trans synchronous blob interface
 */
-NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
+_PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
 		       TALLOC_CTX *mem_ctx,
 		       struct smb_trans2 *parms)
 {
@@ -631,7 +632,7 @@ NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
   TODO: we only need to avoid multi-part replies because the
   multi-part trans receive code is broken.
 */
-size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
+_PUBLIC_ size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
 {
 	return tree->session->transport->negotiate.max_xmit - (70 + param_size);
 }
diff --git a/source4/libcli/raw/smb_signing.c b/source4/libcli/raw/smb_signing.c
index 4acfb9d16d..97bb688d1a 100644
--- a/source4/libcli/raw/smb_signing.c
+++ b/source4/libcli/raw/smb_signing.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "smb.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "lib/crypto/crypto.h"
 #include "param/param.h"
 
diff --git a/source4/libcli/security/security.h b/source4/libcli/security/security.h
index c7f2a09311..46ef6186b8 100644
--- a/source4/libcli/security/security.h
+++ b/source4/libcli/security/security.h
@@ -26,4 +26,6 @@ enum security_user_level {
 	SECURITY_SYSTEM
 };
 
+struct auth_session_info;
+
 #include "libcli/security/proto.h"
diff --git a/source4/libcli/smb2/close.c b/source4/libcli/smb2/close.c
index 04c0c85499..4e6f33095f 100644
--- a/source4/libcli/smb2/close.c
+++ b/source4/libcli/smb2/close.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index 85ddafc031..d68b85ad54 100644
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "libcli/composite/composite.h"
diff --git a/source4/libcli/smb2/create.c b/source4/libcli/smb2/create.c
index cca83a040c..999c10ab08 100644
--- a/source4/libcli/smb2/create.c
+++ b/source4/libcli/smb2/create.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/find.c b/source4/libcli/smb2/find.c
index 6d0a9c8072..6b4902a026 100644
--- a/source4/libcli/smb2/find.c
+++ b/source4/libcli/smb2/find.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/getinfo.c b/source4/libcli/smb2/getinfo.c
index e9f47140f5..b462bab1de 100644
--- a/source4/libcli/smb2/getinfo.c
+++ b/source4/libcli/smb2/getinfo.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/negprot.c b/source4/libcli/smb2/negprot.c
index 6b879e2add..c1f0cf0b24 100644
--- a/source4/libcli/smb2/negprot.c
+++ b/source4/libcli/smb2/negprot.c
@@ -21,8 +21,10 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
+#include "librpc/ndr/libndr.h"
 
 /*
   send a negprot request
diff --git a/source4/libcli/smb2/notify.c b/source4/libcli/smb2/notify.c
index e7c38a27f9..096d790a31 100644
--- a/source4/libcli/smb2/notify.c
+++ b/source4/libcli/smb2/notify.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/setinfo.c b/source4/libcli/smb2/setinfo.c
index a6e22d9a68..69c0f45b63 100644
--- a/source4/libcli/smb2/setinfo.c
+++ b/source4/libcli/smb2/setinfo.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 
diff --git a/source4/libcli/smb2/transport.c b/source4/libcli/smb2/transport.c
index 1d601fdbfe..af19fcb0a9 100644
--- a/source4/libcli/smb2/transport.c
+++ b/source4/libcli/smb2/transport.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "lib/socket/socket.h"
diff --git a/source4/libcli/smb_composite/appendacl.c b/source4/libcli/smb_composite/appendacl.c
index 0fda8c4d65..1f06b96e75 100644
--- a/source4/libcli/smb_composite/appendacl.c
+++ b/source4/libcli/smb_composite/appendacl.c
@@ -1,5 +1,6 @@
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/security/security.h"
 #include "libcli/smb_composite/smb_composite.h"
diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c
index 22573442a2..c44c62f868 100644
--- a/source4/libcli/smb_composite/connect.c
+++ b/source4/libcli/smb_composite/connect.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "lib/events/events.h"
diff --git a/source4/libcli/smb_composite/fsinfo.c b/source4/libcli/smb_composite/fsinfo.c
index e4dd4436ba..2ec13df9b6 100644
--- a/source4/libcli/smb_composite/fsinfo.c
+++ b/source4/libcli/smb_composite/fsinfo.c
@@ -4,6 +4,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "param/param.h"
diff --git a/source4/libcli/smb_composite/savefile.c b/source4/libcli/smb_composite/savefile.c
index b94be9e9b1..f02ca46f06 100644
--- a/source4/libcli/smb_composite/savefile.c
+++ b/source4/libcli/smb_composite/savefile.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index 75a2a579a2..1427fe525b 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -22,8 +22,10 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
+#include "libcli/smb_composite/proto.h"
 #include "libcli/auth/libcli_auth.h"
 #include "auth/auth.h"
 #include "auth/gensec/gensec.h"
diff --git a/source4/libcli/util/error.h b/source4/libcli/util/error.h
index e054948fbe..84255448a0 100644
--- a/source4/libcli/util/error.h
+++ b/source4/libcli/util/error.h
@@ -22,7 +22,6 @@
 #include "libcli/util/werror.h"
 #include "libcli/util/doserr.h"
 #include "libcli/util/ntstatus.h"
-#include "librpc/ndr/libndr.h"
 
 /** NT error on DOS connection! (NT_STATUS_OK) */
 bool ntstatus_dos_equal(NTSTATUS status1, NTSTATUS status2);
@@ -47,6 +46,8 @@ WERROR ntstatus_to_werror(NTSTATUS error);
 *********************************************************************/
 NTSTATUS map_nt_error_from_unix(int unix_error);
 
+enum ndr_err_code;
+
 /*********************************************************************
  Map an NT error code from a NDR error code.
 *********************************************************************/
diff --git a/source4/libcli/util/errormap.c b/source4/libcli/util/errormap.c
index b8458d4bf3..2257955c76 100644
--- a/source4/libcli/util/errormap.c
+++ b/source4/libcli/util/errormap.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "param/param.h"
+#include "librpc/ndr/libndr.h"
 
 /* This map was extracted by the ERRMAPEXTRACT smbtorture command. 
    The setup was a Samba HEAD (2002-01-03) PDC and an Win2k member 
diff --git a/source4/libcli/wbclient/config.mk b/source4/libcli/wbclient/config.mk
new file mode 100644
index 0000000000..9384a172ff
--- /dev/null
+++ b/source4/libcli/wbclient/config.mk
@@ -0,0 +1,4 @@
+[SUBSYSTEM::LIBWBCLIENT]
+OBJ_FILES = wbclient.o
+PUBLIC_DEPENDENCIES = LIBSAMBA-ERRORS LIBEVENTS
+PRIVATE_DEPENDENCIES = NDR_WINBIND MESSAGING
diff --git a/source4/libcli/wbclient/wbclient.c b/source4/libcli/wbclient/wbclient.c
new file mode 100644
index 0000000000..1b2d314824
--- /dev/null
+++ b/source4/libcli/wbclient/wbclient.c
@@ -0,0 +1,210 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Winbind client library.
+
+   Copyright (C) 2008 Kai Blin  <kai@samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "libcli/wbclient/wbclient.h"
+
+/**
+ * Get the server_id of the winbind task.
+ *
+ * \param[in] msg_ctx message context to use
+ * \param[in] mem_ctx talloc context to use
+ * \param[out] ids array of server_id structs containing the winbind id
+ * \return NT_STATUS_OK on success, NT_STATUS_INTERNAL_ERROR on failure
+ */
+static NTSTATUS get_server_id(struct messaging_context *msg_ctx,
+			      TALLOC_CTX *mem_ctx, struct server_id **ids)
+{
+	*ids = irpc_servers_byname(msg_ctx, mem_ctx, "winbind_server");
+	if (*ids == NULL || (*ids)[0].id == 0) {
+		DEBUG(0, ("Geting the winbind server ID failed.\n"));
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+	return NT_STATUS_OK;
+}
+
+/**
+ * Initialize the wbclient context, talloc_free() when done.
+ *
+ * \param mem_ctx talloc context to allocate memory from
+ * \param msg_ctx message context to use
+ * \param
+ */
+struct wbc_context *wbc_init(TALLOC_CTX *mem_ctx,
+			     struct messaging_context *msg_ctx,
+			     struct event_context *event_ctx)
+{
+	struct wbc_context *ctx;
+	NTSTATUS status;
+
+	ctx = talloc(mem_ctx, struct wbc_context);
+	if (ctx == NULL) return NULL;
+
+	status = get_server_id(msg_ctx, mem_ctx, &ctx->ids);
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(ctx);
+		return NULL;
+	}
+
+	ctx->msg_ctx = msg_ctx;
+	ctx->event_ctx = event_ctx;
+
+	return ctx;
+}
+
+struct wbc_idmap_state {
+	struct composite_context *ctx;
+	struct winbind_get_idmap *req;
+	struct irpc_request *irpc_req;
+	struct id_mapping *ids;
+};
+
+static void sids_to_xids_recv_ids(struct irpc_request *req);
+
+struct composite_context *wbc_sids_to_xids_send(struct wbc_context *wbc_ctx,
+						TALLOC_CTX *mem_ctx,
+						uint32_t count,
+						struct id_mapping *ids)
+{
+	struct composite_context *ctx;
+	struct wbc_idmap_state *state;
+
+	DEBUG(5, ("wbc_sids_to_xids called\n"));
+
+	ctx = composite_create(mem_ctx, wbc_ctx->event_ctx);
+	if (ctx == NULL) return NULL;
+
+	state = talloc(ctx, struct wbc_idmap_state);
+	if (composite_nomem(state, ctx)) return ctx;
+	ctx->private_data = state;
+
+	state->req = talloc(state, struct winbind_get_idmap);
+	if (composite_nomem(state->req, ctx)) return ctx;
+
+	state->req->in.count = count;
+	state->req->in.level = WINBIND_IDMAP_LEVEL_SIDS_TO_XIDS;
+	state->req->in.ids = ids;
+	state->ctx = ctx;
+
+	state->irpc_req = IRPC_CALL_SEND(wbc_ctx->msg_ctx, wbc_ctx->ids[0],
+					 winbind, WINBIND_GET_IDMAP, state->req,
+					 state);
+	if (composite_nomem(state->irpc_req, ctx)) return ctx;
+
+	composite_continue_irpc(ctx, state->irpc_req, sids_to_xids_recv_ids,
+				state);
+	return ctx;
+}
+
+static void sids_to_xids_recv_ids(struct irpc_request *req)
+{
+	struct wbc_idmap_state *state = talloc_get_type_abort(
+							req->async.private,
+							struct wbc_idmap_state);
+
+	state->ctx->status = irpc_call_recv(state->irpc_req);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->ids = state->req->out.ids;
+	composite_done(state->ctx);
+}
+
+NTSTATUS wbc_sids_to_xids_recv(struct composite_context *ctx,
+			       struct id_mapping **ids)
+{
+	NTSTATUS status = composite_wait(ctx);
+		DEBUG(5, ("wbc_sids_to_xids_recv called\n"));
+	if (NT_STATUS_IS_OK(status)) {
+		struct wbc_idmap_state *state =	talloc_get_type_abort(
+							ctx->private_data,
+							struct wbc_idmap_state);
+		*ids = state->ids;
+	}
+
+	return status;
+}
+
+static void xids_to_sids_recv_ids(struct irpc_request *req);
+
+struct composite_context *wbc_xids_to_sids_send(struct wbc_context *wbc_ctx,
+						TALLOC_CTX *mem_ctx,
+						uint32_t count,
+						struct id_mapping *ids)
+{
+	struct composite_context *ctx;
+	struct wbc_idmap_state *state;
+
+	DEBUG(5, ("wbc_xids_to_sids called\n"));
+
+	ctx = composite_create(mem_ctx, wbc_ctx->event_ctx);
+	if (ctx == NULL) return NULL;
+
+	state = talloc(ctx, struct wbc_idmap_state);
+	if (composite_nomem(state, ctx)) return ctx;
+	ctx->private_data = state;
+
+	state->req = talloc(state, struct winbind_get_idmap);
+	if (composite_nomem(state->req, ctx)) return ctx;
+
+	state->req->in.count = count;
+	state->req->in.level = WINBIND_IDMAP_LEVEL_XIDS_TO_SIDS;
+	state->req->in.ids = ids;
+	state->ctx = ctx;
+
+	state->irpc_req = IRPC_CALL_SEND(wbc_ctx->msg_ctx, wbc_ctx->ids[0],
+					 winbind, WINBIND_GET_IDMAP, state->req,
+					 state);
+	if (composite_nomem(state->irpc_req, ctx)) return ctx;
+
+	composite_continue_irpc(ctx, state->irpc_req, xids_to_sids_recv_ids,
+			state);
+
+	return ctx;
+}
+
+static void xids_to_sids_recv_ids(struct irpc_request *req)
+{
+	struct wbc_idmap_state *state = talloc_get_type_abort(
+							req->async.private,
+							struct wbc_idmap_state);
+
+	state->ctx->status = irpc_call_recv(state->irpc_req);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->ids = state->req->out.ids;
+	composite_done(state->ctx);
+}
+
+NTSTATUS wbc_xids_to_sids_recv(struct composite_context *ctx,
+			       struct id_mapping **ids)
+{
+	NTSTATUS status = composite_wait(ctx);
+		DEBUG(5, ("wbc_xids_to_sids_recv called\n"));
+	if (NT_STATUS_IS_OK(status)) {
+		struct wbc_idmap_state *state =	talloc_get_type_abort(
+							ctx->private_data,
+							struct wbc_idmap_state);
+		*ids = state->ids;
+	}
+
+	return status;
+}
+
diff --git a/source4/libcli/wbclient/wbclient.h b/source4/libcli/wbclient/wbclient.h
new file mode 100644
index 0000000000..099abaa511
--- /dev/null
+++ b/source4/libcli/wbclient/wbclient.h
@@ -0,0 +1,50 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Winbind client library.
+
+   Copyright (C) 2008 Kai Blin  <kai@samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+#include "lib/messaging/irpc.h"
+#include "libcli/composite/composite.h"
+#include "librpc/gen_ndr/ndr_winbind.h"
+
+struct wbc_context {
+	struct messaging_context *msg_ctx;
+	struct event_context *event_ctx;
+	struct server_id *ids;
+};
+
+struct wbc_context *wbc_init(TALLOC_CTX *mem_ctx,
+			     struct messaging_context *msg_ctx,
+			     struct event_context *event_ctx);
+
+struct composite_context *wbc_sids_to_xids_send(struct wbc_context *wbc_ctx,
+						TALLOC_CTX *mem_ctx,
+						uint32_t count,
+						struct id_mapping *ids);
+
+NTSTATUS wbc_sids_to_xids_recv(struct composite_context *ctx,
+			       struct id_mapping **ids);
+
+struct composite_context *wbc_xids_to_sids_send(struct wbc_context *wbc_ctx,
+						TALLOC_CTX *mem_ctx,
+						uint32_t count,
+						struct id_mapping *ids);
+
+NTSTATUS wbc_xids_to_sids_recv(struct composite_context *ctx,
+			       struct id_mapping **ids);
+
diff --git a/source4/libnet/config.mk b/source4/libnet/config.mk
index f7ff07a7bc..1f4ab0621f 100644
--- a/source4/libnet/config.mk
+++ b/source4/libnet/config.mk
@@ -10,12 +10,6 @@ LIBSAMBA-NET_OBJ_FILES = $(addprefix libnet/, \
 	libnet_lookup.o libnet_domain.o userinfo.o groupinfo.o userman.o \
 	groupman.o prereq_domain.o)
 
-PUBLIC_HEADERS += $(addprefix libnet/, libnet.h libnet_join.h libnet_lookup.h libnet_passwd.h \
-				 libnet_rpc.h libnet_share.h libnet_time.h \
-				 libnet_user.h libnet_site.h libnet_vampire.h \
-				 userinfo.h userman.h)
-
-
 [PYTHON::swig_net]
 PRIVATE_DEPENDENCIES = LIBSAMBA-NET
 SWIG_FILE = net.i
diff --git a/source4/libnet/libnet_group.h b/source4/libnet/libnet_group.h
index 5da194c36e..3156b1f32f 100644
--- a/source4/libnet/libnet_group.h
+++ b/source4/libnet/libnet_group.h
@@ -5,7 +5,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
diff --git a/source4/libnet/libnet_rpc.c b/source4/libnet/libnet_rpc.c
index 50cc1145d2..28cbba2933 100644
--- a/source4/libnet/libnet_rpc.c
+++ b/source4/libnet/libnet_rpc.c
@@ -23,6 +23,7 @@
 #include "libcli/libcli.h"
 #include "libcli/composite/composite.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "librpc/gen_ndr/ndr_lsa_c.h"
 #include "librpc/gen_ndr/ndr_samr.h"
 
diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index bb81888d12..cb679d20bb 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -3,7 +3,7 @@
 [LIBRARY::LIBNDR]
 PRIVATE_PROTO_HEADER = ndr/libndr_proto.h
 PUBLIC_DEPENDENCIES = LIBSAMBA-ERRORS LIBTALLOC LIBSAMBA-UTIL CHARSET \
-					  LIBSAMBA-CONFIG
+					  LIBSAMBA-HOSTCONFIG
 
 LIBNDR_OBJ_FILES = $(addprefix librpc/ndr/, ndr.o ndr_basic.o ndr_string.o uuid.o)
 
@@ -21,7 +21,7 @@ PUBLIC_HEADERS += librpc/ndr/libndr.h
 [BINARY::ndrdump]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBPOPT \
 		POPT_SAMBA \
@@ -457,10 +457,13 @@ RPC_NDR_SVCCTL_OBJ_FILES = librpc/gen_ndr/ndr_svcctl_c.o
 
 PUBLIC_HEADERS += librpc/gen_ndr/ndr_svcctl_c.h
 
-[SUBSYSTEM::dcerpc_atsvc]
+[LIBRARY::dcerpc_atsvc]
 PUBLIC_DEPENDENCIES = dcerpc NDR_ATSVC
+VERSION = 0.0.1
+SO_VERSION = 0
 
 dcerpc_atsvc_OBJ_FILES = librpc/gen_ndr/ndr_atsvc_c.o
+PC_FILES += librpc/dcerpc_atsvc.pc
 
 PUBLIC_HEADERS += librpc/gen_ndr/ndr_atsvc_c.h
 
@@ -504,10 +507,10 @@ PUBLIC_DEPENDENCIES = dcerpc NDR_INITSHUTDOWN
 
 RPC_NDR_INITSHUTDOWN_OBJ_FILES = librpc/gen_ndr/ndr_initshutdown_c.o
 
-[SUBSYSTEM::dcerpc_mgmt]
+[SUBSYSTEM::RPC_NDR_MGMT]
 PRIVATE_DEPENDENCIES = NDR_MGMT
 
-dcerpc_mgmt_OBJ_FILES = librpc/gen_ndr/ndr_mgmt_c.o
+RPC_NDR_MGMT_OBJ_FILES = librpc/gen_ndr/ndr_mgmt_c.o
 
 [SUBSYSTEM::RPC_NDR_PROTECTED_STORAGE]
 PUBLIC_DEPENDENCIES = dcerpc NDR_PROTECTED_STORAGE
@@ -574,6 +577,7 @@ PRIVATE_DEPENDENCIES = \
 		samba-socket LIBCLI_RESOLVE LIBCLI_SMB LIBCLI_SMB2 \
 		LIBNDR NDR_DCERPC RPC_NDR_EPMAPPER \
 		NDR_SCHANNEL RPC_NDR_NETLOGON \
+		RPC_NDR_MGMT \
 		gensec LIBCLI_AUTH LIBCLI_RAW \
 		LP_RESOLVE
 PUBLIC_DEPENDENCIES = CREDENTIALS 
@@ -709,7 +713,7 @@ RPC_EJS_IRPC_OBJ_FILES = librpc/gen_ndr/ndr_irpc_ejs.o
 
 [PYTHON::swig_dcerpc]
 SWIG_FILE = rpc/dcerpc.i
-PUBLIC_DEPENDENCIES = LIBCLI_SMB NDR_MISC LIBSAMBA-UTIL LIBSAMBA-CONFIG dcerpc_samr RPC_NDR_LSA DYNCONFIG
+PUBLIC_DEPENDENCIES = LIBCLI_SMB NDR_MISC LIBSAMBA-UTIL LIBSAMBA-HOSTCONFIG dcerpc_samr RPC_NDR_LSA DYNCONFIG
 
 swig_dcerpc_OBJ_FILES = librpc/rpc/dcerpc_wrap.o
 
@@ -766,6 +770,21 @@ PRIVATE_DEPENDENCIES = RPC_NDR_WKSSVC
 
 python_wkssvc_OBJ_FILES = librpc/gen_ndr/py_wkssvc.o
 
+[PYTHON::python_dfs]
+PRIVATE_DEPENDENCIES = RPC_NDR_DFS
+
+python_dfs_OBJ_FILES = gen_ndr/py_dfs.o
+
+[PYTHON::python_unixinfo]
+PRIVATE_DEPENDENCIES = RPC_NDR_UNIXINFO
+
+python_unixinfo_OBJ_FILES = gen_ndr/py_unixinfo.o
+
+[PYTHON::python_drsuapi]
+PRIVATE_DEPENDENCIES = RPC_NDR_DRSUAPI
+
+python_drsuapi_OBJ_FILES = gen_ndr/py_drsuapi.o
+
 [PYTHON::python_dcerpc_security]
 
 python_dcerpc_security_OBJ_FILES = librpc/gen_ndr/py_security.o
diff --git a/source4/librpc/dcerpc_atsvc.pc.in b/source4/librpc/dcerpc_atsvc.pc.in
new file mode 100644
index 0000000000..060485c3fc
--- /dev/null
+++ b/source4/librpc/dcerpc_atsvc.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: dcerpc_atsvc
+Description: DCE/RPC client library - ATSVC
+Requires.private: dcerpc ndr
+Version: 0.0.1
+Libs: -L${libdir} -ldcerpc_atsvc
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/librpc/idl/audiosrv.idl b/source4/librpc/idl/audiosrv.idl
index 9b9399ffee..1b059868ff 100644
--- a/source4/librpc/idl/audiosrv.idl
+++ b/source4/librpc/idl/audiosrv.idl
@@ -5,19 +5,19 @@
 	helpstring("Audio Server")
 ] interface audiosrv
 {
-	void audiosrv_CreatezoneFactoriesList();
-	void audiosrv_CreateGfxFactoriesList();
-	void audiosrv_CreateGfxList();
-	void audiosrv_RemoveGfx();
-	void audiosrv_AddGfx();
-	void audiosrv_ModifyGfx();
-	void audiosrv_OpenGfx();
-	void audiosrv_Logon();
-	void audiosrv_Logoff();
-	void audiosrv_RegisterSessionNotificationEvent();
-	void audiosrv_UnregisterSessionNotificationEvent();
-	void audiosrv_SessionConnectState();
-	void audiosrv_DriverOpenDrvRegKey();
-	void audiosrv_AdvisePreferredDeviceChange();
-	void audiosrv_GetPnpInfo();
+	[todo] void audiosrv_CreatezoneFactoriesList();
+	[todo] void audiosrv_CreateGfxFactoriesList();
+	[todo] void audiosrv_CreateGfxList();
+	[todo] void audiosrv_RemoveGfx();
+	[todo] void audiosrv_AddGfx();
+	[todo] void audiosrv_ModifyGfx();
+	[todo] void audiosrv_OpenGfx();
+	[todo] void audiosrv_Logon();
+	[todo] void audiosrv_Logoff();
+	[todo] void audiosrv_RegisterSessionNotificationEvent();
+	[todo] void audiosrv_UnregisterSessionNotificationEvent();
+	[todo] void audiosrv_SessionConnectState();
+	[todo] void audiosrv_DriverOpenDrvRegKey();
+	[todo] void audiosrv_AdvisePreferredDeviceChange();
+	[todo] void audiosrv_GetPnpInfo();
 }
diff --git a/source4/librpc/idl/browser.idl b/source4/librpc/idl/browser.idl
index 5cc2475119..5b05be9cbb 100644
--- a/source4/librpc/idl/browser.idl
+++ b/source4/librpc/idl/browser.idl
@@ -9,50 +9,50 @@ interface browser
 {
 	/******************/
 	/* Function  0x00 */
-	NTSTATUS BrowserrServerEnum();
+	[todo] NTSTATUS BrowserrServerEnum();
 
 	/******************/
 	/* Function  0x01 */
-	NTSTATUS BrowserrDebugCall();
+	[todo] NTSTATUS BrowserrDebugCall();
 
 	/******************/
 	/* Function  0x02 */
-	NTSTATUS BrowserrQueryOtherDomains();
+	[todo] NTSTATUS BrowserrQueryOtherDomains();
 
 	/******************/
 	/* Function  0x03 */
-	NTSTATUS BrowserrResetNetlogonState();
+	[todo] NTSTATUS BrowserrResetNetlogonState();
 
 	/******************/
 	/* Function  0x04 */
-	NTSTATUS BrowserrDebugTrace();
+	[todo] NTSTATUS BrowserrDebugTrace();
 
 	/******************/
 	/* Function  0x05 */
-	NTSTATUS BrowserrQueryStatistics();
+	[todo] NTSTATUS BrowserrQueryStatistics();
 
 	/******************/
 	/* Function  0x06 */
-	NTSTATUS BrowserResetStatistics();
+	[todo] NTSTATUS BrowserResetStatistics();
 
 	/******************/
 	/* Function  0x07 */
-	NTSTATUS NetrBrowserStatisticsClear();
+	[todo] NTSTATUS NetrBrowserStatisticsClear();
 
 	/******************/
 	/* Function  0x08 */
-	NTSTATUS NetrBrowserStatisticsGet();
+	[todo] NTSTATUS NetrBrowserStatisticsGet();
 
 	/******************/
 	/* Function  0x09 */
-	NTSTATUS BrowserrSetNetlogonState();
+	[todo] NTSTATUS BrowserrSetNetlogonState();
 
 	/******************/
 	/* Function  0x0a */
-	NTSTATUS BrowserrQueryEmulatedDomains();
+	[todo] NTSTATUS BrowserrQueryEmulatedDomains();
 
 	/******************/
 	/* Function  0x0b */
-	NTSTATUS BrowserrServerEnumEx();
+	[todo] NTSTATUS BrowserrServerEnumEx();
 
 }
diff --git a/source4/librpc/idl/dfs.idl b/source4/librpc/idl/dfs.idl
index dbbd15039c..b279f555d9 100644
--- a/source4/librpc/idl/dfs.idl
+++ b/source4/librpc/idl/dfs.idl
@@ -308,16 +308,16 @@ import "misc.idl";
 		);
 
 	/* Function 0x06 */
-	WERROR dfs_Rename();
+	[todo] WERROR dfs_Rename();
 
 	/* Function 0x07 */
-	WERROR dfs_Move();
+	[todo] WERROR dfs_Move();
 
 	/* Function 0x08 */
-	WERROR dfs_ManagerGetConfigInfo();
+	[todo] WERROR dfs_ManagerGetConfigInfo();
 
 	/* Function 0x09 */
-	WERROR dfs_ManagerSendSiteInfo();
+	[todo] WERROR dfs_ManagerSendSiteInfo();
 
 	/* Function 0x0a */
 	typedef struct {
@@ -399,10 +399,10 @@ import "misc.idl";
 		);
 
 	/* Function 0x13 */
-	WERROR dfs_Add2();
+	[todo] WERROR dfs_Add2();
 
 	/* Function 0x14 */
-	WERROR dfs_Remove2();
+	[todo] WERROR dfs_Remove2();
 
 	/* Function 0x15 */
 	[public] WERROR dfs_EnumEx(
@@ -414,5 +414,5 @@ import "misc.idl";
 	);
 
 	/* Function 0x16 */
-	WERROR dfs_SetInfo2();
+	[todo] WERROR dfs_SetInfo2();
 }
diff --git a/source4/librpc/idl/drsblobs.idl b/source4/librpc/idl/drsblobs.idl
index eaea6aa30e..f8cbdac8c5 100644
--- a/source4/librpc/idl/drsblobs.idl
+++ b/source4/librpc/idl/drsblobs.idl
@@ -1,6 +1,6 @@
 #include "idl_types.h"
 
-import "drsuapi.idl";
+import "drsuapi.idl", "misc.idl";
 
 [
   uuid("12345778-1234-abcd-0001-00000001"),
diff --git a/source4/librpc/idl/drsuapi.idl b/source4/librpc/idl/drsuapi.idl
index fb24122e26..9652571668 100644
--- a/source4/librpc/idl/drsuapi.idl
+++ b/source4/librpc/idl/drsuapi.idl
@@ -666,7 +666,7 @@ interface drsuapi
 		/* TODO ... */
 	} drsuapi_DsReplicaAddOptions;
 
-	WERROR DRSUAPI_REPLICA_ADD();
+	[todo] WERROR DRSUAPI_REPLICA_ADD();
 
 	/*****************/
         /* Function 0x06 */
@@ -676,7 +676,7 @@ interface drsuapi
 		/* TODO ... */
 	} drsuapi_DsReplicaDeleteOptions;
 
-	WERROR DRSUAPI_REPLICA_DEL();
+	[todo] WERROR DRSUAPI_REPLICA_DEL();
 
 	/*****************/
         /* Function 0x07 */
@@ -685,11 +685,11 @@ interface drsuapi
 		DRSUAPI_DS_REPLICA_MODIFY_WRITEABLE			= 0x00000002
 	} drsuapi_DsReplicaModifyOptions;
 
-	WERROR DRSUAPI_REPLICA_MODIFY();
+	[todo] WERROR DRSUAPI_REPLICA_MODIFY();
 
 	/*****************/
         /* Function 0x08 */
-	WERROR DRSUAPI_VERIFY_NAMES();
+	[todo] WERROR DRSUAPI_VERIFY_NAMES();
 
 	/*****************/
         /* Function 0x09 */
@@ -732,7 +732,7 @@ interface drsuapi
 		[case(1)] drsuapi_DsGetMembershipsRequest1 req1;
 	} drsuapi_DsGetMembershipsRequest;
 
-	WERROR drsuapi_DsGetMemberships(
+	[todo] WERROR drsuapi_DsGetMemberships(
 		[in] policy_handle *bind_handle,
 		[in,out] int32 level,
 		[in] [switch_is(level)] drsuapi_DsGetMembershipsRequest req,
@@ -741,7 +741,7 @@ interface drsuapi
 
 	/*****************/
         /* Function 0x0a */
-	WERROR DRSUAPI_INTER_DOMAIN_MOVE();
+	[todo] WERROR DRSUAPI_INTER_DOMAIN_MOVE();
 
 	/*****************/
         /* Function 0x0b */
@@ -774,7 +774,7 @@ interface drsuapi
 		[case(1)] drsuapi_DsGetNT4ChangeLogInfo1 info1;
 	} drsuapi_DsGetNT4ChangeLogInfo;
 
-	WERROR drsuapi_DsGetNT4ChangeLog(
+	[todo] WERROR drsuapi_DsGetNT4ChangeLog(
 		[in] policy_handle *bind_handle,
 		[in,out] uint32 level,
 		[in] [switch_is(level)] drsuapi_DsGetNT4ChangeLogRequest req,
@@ -849,7 +849,7 @@ interface drsuapi
 		[case(1)] drsuapi_DsNameCtr1 *ctr1;
 	} drsuapi_DsNameCtr;
 
-	WERROR drsuapi_DsCrackNames(
+	[todo] WERROR drsuapi_DsCrackNames(
 		[in] policy_handle *bind_handle,
 		[in, out] int32 level,
 		[in,switch_is(level)] drsuapi_DsNameRequest req,
@@ -920,7 +920,7 @@ interface drsuapi
 
 	/*****************/
         /* Function 0x0f */
-	WERROR DRSUAPI_REMOVE_DS_DOMAIN();
+	[todo] WERROR DRSUAPI_REMOVE_DS_DOMAIN();
 
 	/*****************/
         /* Function 0x10 */
@@ -1138,7 +1138,7 @@ interface drsuapi
 
 	/*****************/
         /* Function 0x12 */
-	WERROR DRSUAPI_EXECUTE_KCC();
+	[todo] WERROR DRSUAPI_EXECUTE_KCC();
 
 	/*****************/
 	/* Function 0x13 */
@@ -1419,7 +1419,7 @@ interface drsuapi
 
 	/*****************/
         /* Function 0x14 */
-	WERROR DRSUAPI_ADD_SID_HISTORY();
+	[todo] WERROR DRSUAPI_ADD_SID_HISTORY();
 
 	/*****************/
         /* Function 0x15 */
@@ -1452,11 +1452,11 @@ interface drsuapi
 
 	/*****************/
         /* Function 0x16 */
-	WERROR DRSUAPI_REPLICA_VERIFY_OBJECTS();
+	[todo] WERROR DRSUAPI_REPLICA_VERIFY_OBJECTS();
 
 	/*****************/
         /* Function 0x17 */
-	WERROR DRSUAPI_GET_OBJECT_EXISTENCE();
+	[todo] WERROR DRSUAPI_GET_OBJECT_EXISTENCE();
 
 	/*****************/
         /* Function 0x18 */
diff --git a/source4/librpc/idl/dsbackup.idl b/source4/librpc/idl/dsbackup.idl
index 21dca8fa0e..72e8bf9c2b 100644
--- a/source4/librpc/idl/dsbackup.idl
+++ b/source4/librpc/idl/dsbackup.idl
@@ -5,15 +5,15 @@
 	helpstring("Backup support for Active Directory")
 ] interface ad_backup
 {
-	void HrRBackupPrepare();
-	void HrRBackupEnd();
-	void HrRBackupGetAttachmentInformation();
-	void HrRBackupOpenFile();
-	void HrRBackupRead();
-	void HrRBackupClose();
-	void HrRBackupGetBackupLogs();
-	void HrRBackupTruncateLogs();
-	void HrRBackupPing();
+	[todo] void HrRBackupPrepare();
+	[todo] void HrRBackupEnd();
+	[todo] void HrRBackupGetAttachmentInformation();
+	[todo] void HrRBackupOpenFile();
+	[todo] void HrRBackupRead();
+	[todo] void HrRBackupClose();
+	[todo] void HrRBackupGetBackupLogs();
+	[todo] void HrRBackupTruncateLogs();
+	[todo] void HrRBackupPing();
 }
 
 [
@@ -23,12 +23,12 @@
 	helpstring("Restoring Active Directory backups")
 ] interface ad_restore
 {
-	void HrRIsNTDSOnline();
-	void HrRRestorePrepare();
-	void HrRRestoreRegister();
-	void HrRRestoreRegisterComplete();
-	void HrRRestoreGetDatabaseLocations();
-	void HrRRestoreEnd();
-	void HrRRestoreSetCurrentLogNumber();
-	void HrRRestoreCheckLogsForBackup();
+	[todo] void HrRIsNTDSOnline();
+	[todo] void HrRRestorePrepare();
+	[todo] void HrRRestoreRegister();
+	[todo] void HrRRestoreRegisterComplete();
+	[todo] void HrRRestoreGetDatabaseLocations();
+	[todo] void HrRRestoreEnd();
+	[todo] void HrRRestoreSetCurrentLogNumber();
+	[todo] void HrRRestoreCheckLogsForBackup();
 }
diff --git a/source4/librpc/idl/dssetup.idl b/source4/librpc/idl/dssetup.idl
index af6350cc43..14de9f7633 100644
--- a/source4/librpc/idl/dssetup.idl
+++ b/source4/librpc/idl/dssetup.idl
@@ -88,14 +88,14 @@ import "misc.idl";
 	  These stubs are left here only as a way of documenting the names
 	  of the calls in case they ever turn up on the wire.
 	*/
-	WERROR dssetup_DsRoleDnsNameToFlatName();
-	WERROR dssetup_DsRoleDcAsDc();
-	WERROR dssetup_DsRoleDcAsReplica();
-	WERROR dssetup_DsRoleDemoteDc();
-	WERROR dssetup_DsRoleGetDcOperationProgress();
-	WERROR dssetup_DsRoleGetDcOperationResults();
-	WERROR dssetup_DsRoleCancel();
-	WERROR dssetup_DsRoleServerSaveStateForUpgrade();
-	WERROR dssetup_DsRoleUpgradeDownlevelServer();
-	WERROR dssetup_DsRoleAbortDownlevelServerUpgrade();
+	[todo] WERROR dssetup_DsRoleDnsNameToFlatName();
+	[todo] WERROR dssetup_DsRoleDcAsDc();
+	[todo] WERROR dssetup_DsRoleDcAsReplica();
+	[todo] WERROR dssetup_DsRoleDemoteDc();
+	[todo] WERROR dssetup_DsRoleGetDcOperationProgress();
+	[todo] WERROR dssetup_DsRoleGetDcOperationResults();
+	[todo] WERROR dssetup_DsRoleCancel();
+	[todo] WERROR dssetup_DsRoleServerSaveStateForUpgrade();
+	[todo] WERROR dssetup_DsRoleUpgradeDownlevelServer();
+	[todo] WERROR dssetup_DsRoleAbortDownlevelServerUpgrade();
 }
diff --git a/source4/librpc/idl/efs.idl b/source4/librpc/idl/efs.idl
index 62fefda606..4279b08d13 100644
--- a/source4/librpc/idl/efs.idl
+++ b/source4/librpc/idl/efs.idl
@@ -18,13 +18,13 @@ WERROR EfsRpcOpenFileRaw(
 	[in] uint32 Flags
 	);
 
-WERROR EfsRpcReadFileRaw(
+[todo] WERROR EfsRpcReadFileRaw(
 	[in,ref] policy_handle *pvContext
 /* incomplete */
 );
 
 
-WERROR EfsRpcWriteFileRaw(
+[todo] WERROR EfsRpcWriteFileRaw(
 	[in,ref] policy_handle *pvContext
 /* incomplete */
 );
@@ -70,12 +70,12 @@ WERROR EfsRpcQueryRecoveryAgents(
 	[out,ref,unique] ENCRYPTION_CERTIFICATE_HASH_LIST **pRecoveryAgents
 );
 
-WERROR EfsRpcRemoveUsersFromFile(
+[todo] WERROR EfsRpcRemoveUsersFromFile(
 	[in] [charset(UTF16),string] uint16 FileName[]
 	/*	[in] ENCRYPTION_CERTIFICATE_LIST Hashes*/
 );
 
-WERROR EfsRpcAddUsersToFile(
+[todo] WERROR EfsRpcAddUsersToFile(
 	[in] [charset(UTF16),string] uint16 FileName[]
 	/*	[in] ENCRYPTION_CERTIFICATE_LIST Hashes*/
 );
@@ -96,13 +96,13 @@ WERROR EfsRpcSetFileEncryptionKey(
 	[in] [unique] ENCRYPTION_CERTIFICATE *pEncryptionCertificate
 );
 
-WERROR EfsRpcNotSupported(
+[todo] WERROR EfsRpcNotSupported(
 );
 
-WERROR EfsRpcFileKeyInfo(
+[todo] WERROR EfsRpcFileKeyInfo(
 );
 
-WERROR EfsRpcDuplicateEncryptionInfoFile(
+[todo] WERROR EfsRpcDuplicateEncryptionInfoFile(
 );
 
 }
diff --git a/source4/librpc/idl/epmapper.idl b/source4/librpc/idl/epmapper.idl
index 60ff338ec4..ea04878094 100644
--- a/source4/librpc/idl/epmapper.idl
+++ b/source4/librpc/idl/epmapper.idl
@@ -310,5 +310,5 @@ interface epmapper
 
 	/**********************/
 	/* Function 0x07      */
-	error_status_t epm_MapAuth();
+	[todo] error_status_t epm_MapAuth();
 }
diff --git a/source4/librpc/idl/eventlog.idl b/source4/librpc/idl/eventlog.idl
index 3defd99400..ee42300c7c 100644
--- a/source4/librpc/idl/eventlog.idl
+++ b/source4/librpc/idl/eventlog.idl
@@ -65,7 +65,7 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x01 */
-	NTSTATUS eventlog_BackupEventLogW();
+	[todo] NTSTATUS eventlog_BackupEventLogW();
 	
 	/******************/
 	/* Function: 0x02 */
@@ -75,7 +75,7 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x03 */
-	NTSTATUS eventlog_DeregisterEventSource();
+	[todo] NTSTATUS eventlog_DeregisterEventSource();
 
 	/******************/
 	/* Function: 0x04 */
@@ -86,11 +86,11 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x05 */
-	NTSTATUS eventlog_GetOldestRecord();
+	[todo] NTSTATUS eventlog_GetOldestRecord();
 
 	/******************/
 	/* Function: 0x06 */
-	NTSTATUS eventlog_ChangeNotify();
+	[todo] NTSTATUS eventlog_ChangeNotify();
 
 	/******************/
 	/* Function: 0x07 */
@@ -105,11 +105,11 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x08 */
-	NTSTATUS eventlog_RegisterEventSourceW();
+	[todo] NTSTATUS eventlog_RegisterEventSourceW();
 
 	/******************/
 	/* Function: 0x09 */
-	NTSTATUS eventlog_OpenBackupEventLogW();
+	[todo] NTSTATUS eventlog_OpenBackupEventLogW();
 
 	/******************/
 	/* Function: 0x0a */
@@ -125,51 +125,51 @@ import "lsa.idl", "security.idl";
 
 	/*****************/
 	/* Function 0x0b */
-	NTSTATUS eventlog_ReportEventW();
+	[todo] NTSTATUS eventlog_ReportEventW();
 
 	/*****************/
 	/* Function 0x0c */
-	NTSTATUS eventlog_ClearEventLogA();
+	[todo] NTSTATUS eventlog_ClearEventLogA();
 	
 	/******************/
 	/* Function: 0x0d */
-	NTSTATUS eventlog_BackupEventLogA();
+	[todo] NTSTATUS eventlog_BackupEventLogA();
 
 	/*****************/
 	/* Function 0x0e */
-	NTSTATUS eventlog_OpenEventLogA();
+	[todo] NTSTATUS eventlog_OpenEventLogA();
 
 	/*****************/
 	/* Function 0x0f */
-	NTSTATUS eventlog_RegisterEventSourceA();
+	[todo] NTSTATUS eventlog_RegisterEventSourceA();
 
 	/*****************/
 	/* Function 0x10 */
-	NTSTATUS eventlog_OpenBackupEventLogA();
+	[todo] NTSTATUS eventlog_OpenBackupEventLogA();
 
 	/*****************/
 	/* Function 0x11 */
-	NTSTATUS eventlog_ReadEventLogA();
+	[todo] NTSTATUS eventlog_ReadEventLogA();
 
 	/*****************/
 	/* Function 0x12 */
-	NTSTATUS eventlog_ReportEventA();
+	[todo] NTSTATUS eventlog_ReportEventA();
 
 	/*****************/
 	/* Function 0x13 */
-	NTSTATUS eventlog_RegisterClusterSvc();
+	[todo] NTSTATUS eventlog_RegisterClusterSvc();
 
 	/*****************/
 	/* Function 0x14 */
-	NTSTATUS eventlog_DeregisterClusterSvc();
+	[todo] NTSTATUS eventlog_DeregisterClusterSvc();
 
 	/*****************/
 	/* Function 0x15 */
-	NTSTATUS eventlog_WriteClusterEvents();
+	[todo] NTSTATUS eventlog_WriteClusterEvents();
 
 	/*****************/
 	/* Function 0x16 */
-	NTSTATUS eventlog_GetLogIntormation();
+	[todo] NTSTATUS eventlog_GetLogIntormation();
 
 	/*****************/
 	/* Function 0x17 */
diff --git a/source4/librpc/idl/frsapi.idl b/source4/librpc/idl/frsapi.idl
index 2931a83da4..11593f479a 100644
--- a/source4/librpc/idl/frsapi.idl
+++ b/source4/librpc/idl/frsapi.idl
@@ -13,19 +13,19 @@ interface frsapi
 {
 	/****************/
 	/* Function 0x00 */
-	void FRSAPI_VERIFY_PROMOTION();
+	[todo] void FRSAPI_VERIFY_PROMOTION();
 
 	/****************/
 	/* Function 0x01 */
-	void FRSAPI_PROMOTION_STATUS();
+	[todo] void FRSAPI_PROMOTION_STATUS();
 
 	/****************/
 	/* Function 0x02 */
-	void FRSAPI_START_DEMOTION();
+	[todo] void FRSAPI_START_DEMOTION();
 
 	/****************/
 	/* Function 0x03 */
-	void FRSAPI_COMMIT_DEMOTION();
+	[todo] void FRSAPI_COMMIT_DEMOTION();
 
 	/****************/
 	/* Function 0x04 */
@@ -49,7 +49,7 @@ interface frsapi
 
 	/****************/
 	/* Function 0x06 */
-	void FRSAPI_VERIFY_PROMOTION_W();
+	[todo] void FRSAPI_VERIFY_PROMOTION_W();
 
 	/****************/
 	/* Function 0x07 */
@@ -106,7 +106,7 @@ interface frsapi
 
 	/****************/
 	/* Function 0x09 */
-	void FRSAPI_WRITER_COMMAND();
+	[todo] void FRSAPI_WRITER_COMMAND();
 
 	/****************/
 	/* Function 0x0a */
diff --git a/source4/librpc/idl/frsrpc.idl b/source4/librpc/idl/frsrpc.idl
index 6a0ec394d0..1019a25b28 100644
--- a/source4/librpc/idl/frsrpc.idl
+++ b/source4/librpc/idl/frsrpc.idl
@@ -128,41 +128,41 @@ interface frsrpc
 
 	/*****************/
 	/* Function 0x01 */
-	void FRSRPC_VERIFY_PROMOTION_PARENT();
+	[todo] void FRSRPC_VERIFY_PROMOTION_PARENT();
 
 	/*****************/
 	/* Function 0x02 */
-	void FRSRPC_START_PROMOTION_PARENT();
+	[todo] void FRSRPC_START_PROMOTION_PARENT();
 
 	/*****************/
 	/* Function 0x03 */
-	void FRSRPC_NOP();
+	[todo] void FRSRPC_NOP();
 
 	/*****************/
 	/* Function 0x04 */
-	void FRSRPC_BACKUP_COMPLETE();
+	[todo] void FRSRPC_BACKUP_COMPLETE();
 
 	/*****************/
 	/* Function 0x05 */
-	void FRSRPC_BACKUP_COMPLETE_5();
+	[todo] void FRSRPC_BACKUP_COMPLETE_5();
 
 	/*****************/
 	/* Function 0x06 */
-	void FRSRPC_BACKUP_COMPLETE_6();
+	[todo] void FRSRPC_BACKUP_COMPLETE_6();
 
 	/*****************/
 	/* Function 0x07 */
-	void FRSRPC_BACKUP_COMPLETE_7();
+	[todo] void FRSRPC_BACKUP_COMPLETE_7();
 
 	/*****************/
 	/* Function 0x08 */
-	void FRSRPC_BACKUP_COMPLETE_8();
+	[todo] void FRSRPC_BACKUP_COMPLETE_8();
 
 	/*****************/
 	/* Function 0x09 */
-	void FRSRPC_BACKUP_COMPLETE_9();
+	[todo] void FRSRPC_BACKUP_COMPLETE_9();
 
 	/*****************/
 	/* Function 0x0a */
-	void FRSRPC_VERIFY_PROMOTION_PARENT_EX();
+	[todo] void FRSRPC_VERIFY_PROMOTION_PARENT_EX();
 }
diff --git a/source4/librpc/idl/irpc.idl b/source4/librpc/idl/irpc.idl
index 0a53494049..2c659aa785 100644
--- a/source4/librpc/idl/irpc.idl
+++ b/source4/librpc/idl/irpc.idl
@@ -1,6 +1,6 @@
 #include "idl_types.h"
 
-import "security.idl", "nbt.idl";
+import "misc.idl", "security.idl", "nbt.idl";
 
 /*
   definitions for irpc primitives
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 3159a7d16d..93cfdee201 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -4,7 +4,7 @@
   lsa interface definition
 */
 
-import "security.idl";
+import "misc.idl", "security.idl";
 
 [ uuid("12345778-1234-abcd-ef00-0123456789ab"),
   version(0.0),
@@ -94,12 +94,12 @@ import "security.idl";
 
 	/******************/
 	/* Function: 0x04 */
-	NTSTATUS lsa_SetSecObj ();
+	[todo] NTSTATUS lsa_SetSecObj ();
 
 
 	/******************/
 	/* Function: 0x05 */
-	NTSTATUS lsa_ChangePassword ();
+	[todo] NTSTATUS lsa_ChangePassword ();
 
 
 	/******************/
@@ -273,7 +273,7 @@ import "security.idl";
 
 	/******************/
 	/* Function:       0x09 */
-	NTSTATUS lsa_ClearAuditLog ();
+	[todo] NTSTATUS lsa_ClearAuditLog ();
 
 	/******************/
 	/* Function: 0x0a */
@@ -338,7 +338,7 @@ import "security.idl";
 
 	/******************/
 	/* Function: 0x0e */
-	typedef enum {
+	typedef [public] enum {
 		SID_NAME_USE_NONE = 0,/* NOTUSED */
 		SID_NAME_USER     = 1, /* user */
 		SID_NAME_DOM_GRP  = 2, /* domain group */
@@ -477,15 +477,15 @@ import "security.idl";
 		);
 
 	/* Function:           0x15 */
-	NTSTATUS lsa_GetQuotasForAccount();
+	[todo] NTSTATUS lsa_GetQuotasForAccount();
 	
 	/* Function:           0x16 */
-	NTSTATUS lsa_SetQuotasForAccount();
+	[todo] NTSTATUS lsa_SetQuotasForAccount();
 	
 	/* Function:    0x17 */
-	NTSTATUS lsa_GetSystemAccessAccount();
+	[todo] NTSTATUS lsa_GetSystemAccessAccount();
 	/* Function:    0x18 */
-	NTSTATUS lsa_SetSystemAccessAccount();
+	[todo] NTSTATUS lsa_SetSystemAccessAccount();
 
 	/* Function:        0x19 */
 	NTSTATUS lsa_OpenTrustedDomain(
@@ -599,7 +599,7 @@ import "security.idl";
 		);
 
 	/* Function:     0x1b */
-	NTSTATUS lsa_SetInformationTrustedDomain();
+	[todo] NTSTATUS lsa_SetInformationTrustedDomain();
 
 	/* Function:          0x1c */
 	[public] NTSTATUS lsa_OpenSecret(
@@ -659,7 +659,7 @@ import "security.idl";
 		);
 
 	/* Function:        0x22 */
-	NTSTATUS lsa_DeleteObject();
+	[todo] NTSTATUS lsa_DeleteObject();
 
 	
 	/*******************/
@@ -713,7 +713,7 @@ import "security.idl";
         );
 
 	/* Function:     0x28 */
-	NTSTATUS lsa_SetTrustedDomainInfo();
+	[todo] NTSTATUS lsa_SetTrustedDomainInfo();
 	/* Function:      0x29 */
 	NTSTATUS lsa_DeleteTrustedDomain(
 		[in]               policy_handle         *handle,
@@ -721,9 +721,9 @@ import "security.idl";
 	);
 
 	/* Function:       0x2a */
-	NTSTATUS lsa_StorePrivateData();
+	[todo] NTSTATUS lsa_StorePrivateData();
 	/* Function:        0x2b */
-	NTSTATUS lsa_RetrievePrivateData();
+	[todo] NTSTATUS lsa_RetrievePrivateData();
 
 
 	/**********************/
@@ -800,7 +800,7 @@ import "security.idl";
 
 
 	/* Function 0x33 */
-	NTSTATUS lsa_CreateTrustedDomainEx();
+	[todo] NTSTATUS lsa_CreateTrustedDomainEx();
 
 	/* Function 0x34 */
 	NTSTATUS lsa_CloseTrustedDomainEx(
@@ -858,7 +858,7 @@ import "security.idl";
 		);
 
 	/* Function 0x38 */
-	NTSTATUS lsa_TestCall();
+	[todo] NTSTATUS lsa_TestCall();
 
 	/**********************/
 	/* Function 0x39 */
@@ -914,31 +914,31 @@ import "security.idl";
 		);
 
 	/* Function 0x3b */
-	NTSTATUS lsa_CreateTrustedDomainEx2();
+	[todo] NTSTATUS lsa_CreateTrustedDomainEx2();
 
 	/* Function 0x3c */
-	NTSTATUS lsa_CREDRWRITE();
+	[todo] NTSTATUS lsa_CREDRWRITE();
 
 	/* Function 0x3d */
-	NTSTATUS lsa_CREDRREAD();
+	[todo] NTSTATUS lsa_CREDRREAD();
 
 	/* Function 0x3e */
-	NTSTATUS lsa_CREDRENUMERATE();
+	[todo] NTSTATUS lsa_CREDRENUMERATE();
 
 	/* Function 0x3f */
-	NTSTATUS lsa_CREDRWRITEDOMAINCREDENTIALS();
+	[todo] NTSTATUS lsa_CREDRWRITEDOMAINCREDENTIALS();
 
 	/* Function 0x40 */
-	NTSTATUS lsa_CREDRREADDOMAINCREDENTIALS();
+	[todo] NTSTATUS lsa_CREDRREADDOMAINCREDENTIALS();
 
 	/* Function 0x41 */
-	NTSTATUS lsa_CREDRDELETE();
+	[todo] NTSTATUS lsa_CREDRDELETE();
 
 	/* Function 0x42 */
-	NTSTATUS lsa_CREDRGETTARGETINFO();
+	[todo] NTSTATUS lsa_CREDRGETTARGETINFO();
 
 	/* Function 0x43 */
-	NTSTATUS lsa_CREDRPROFILELOADED();
+	[todo] NTSTATUS lsa_CREDRPROFILELOADED();
 
 	/**********************/
 	/* Function 0x44 */
@@ -967,16 +967,16 @@ import "security.idl";
 		);
 
 	/* Function 0x45 */
-	NTSTATUS lsa_CREDRGETSESSIONTYPES();
+	[todo] NTSTATUS lsa_CREDRGETSESSIONTYPES();
 
 	/* Function 0x46 */
-	NTSTATUS lsa_LSARREGISTERAUDITEVENT();
+	[todo] NTSTATUS lsa_LSARREGISTERAUDITEVENT();
 
 	/* Function 0x47 */
-	NTSTATUS lsa_LSARGENAUDITEVENT();
+	[todo] NTSTATUS lsa_LSARGENAUDITEVENT();
 
 	/* Function 0x48 */
-	NTSTATUS lsa_LSARUNREGISTERAUDITEVENT();
+	[todo] NTSTATUS lsa_LSARUNREGISTERAUDITEVENT();
 
 	/* Function 0x49 */
 	typedef struct {
@@ -1024,10 +1024,10 @@ import "security.idl";
 		);
 
 	/* Function 0x4a */
-	NTSTATUS lsa_LSARSETFORESTTRUSTINFORMATION();
+	[todo] NTSTATUS lsa_LSARSETFORESTTRUSTINFORMATION();
 
 	/* Function 0x4b */
-	NTSTATUS lsa_CREDRRENAME();
+	[todo] NTSTATUS lsa_CREDRRENAME();
 
 	/*****************/
 	/* Function 0x4c */
@@ -1055,15 +1055,15 @@ import "security.idl";
 		);
 
 	/* Function 0x4e */
-	NTSTATUS lsa_LSAROPENPOLICYSCE();
+	[todo] NTSTATUS lsa_LSAROPENPOLICYSCE();
 
 	/* Function 0x4f */
-	NTSTATUS lsa_LSARADTREGISTERSECURITYEVENTSOURCE();
+	[todo] NTSTATUS lsa_LSARADTREGISTERSECURITYEVENTSOURCE();
 
 	/* Function 0x50 */
-	NTSTATUS lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE();
+	[todo] NTSTATUS lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE();
 
 	/* Function 0x51 */
-	NTSTATUS lsa_LSARADTREPORTSECURITYEVENT();
+	[todo] NTSTATUS lsa_LSARADTREPORTSECURITYEVENT();
 
 }
diff --git a/source4/librpc/idl/msgsvc.idl b/source4/librpc/idl/msgsvc.idl
index 09878ac7a4..d196daf06b 100644
--- a/source4/librpc/idl/msgsvc.idl
+++ b/source4/librpc/idl/msgsvc.idl
@@ -7,10 +7,10 @@
 	helpstring("Messaging Service")
 ] interface msgsvc
 {
-	void NetrMessageNameAdd();
-	void NetrMessageNameEnum();
-	void NetrMessageNameGetInfo();
-	void NetrMessageNameDel();
+	[todo] void NetrMessageNameAdd();
+	[todo] void NetrMessageNameEnum();
+	[todo] void NetrMessageNameGetInfo();
+	[todo] void NetrMessageNameDel();
 }
 
 [
@@ -18,5 +18,5 @@
 	version(1.0)
 ] interface msgsvcsend
 {
-	void NetrSendMessage();
+	[todo] void NetrSendMessage();
 }
diff --git a/source4/librpc/idl/nbt.idl b/source4/librpc/idl/nbt.idl
index 17304bfa0d..aa88360882 100644
--- a/source4/librpc/idl/nbt.idl
+++ b/source4/librpc/idl/nbt.idl
@@ -8,9 +8,9 @@
    encoding if it doesn't work out
 */
 
-import "security.idl", "svcctl.idl";
+import "misc.idl", "security.idl", "svcctl.idl";
 [
-helper("libcli/nbt/nbtname.h")
+helper("libcli/nbt/libnbt.h")
 ]
 interface nbt
 {
diff --git a/source4/librpc/idl/netlogon.idl b/source4/librpc/idl/netlogon.idl
index d06c2acdd4..6da496a486 100644
--- a/source4/librpc/idl/netlogon.idl
+++ b/source4/librpc/idl/netlogon.idl
@@ -4,7 +4,7 @@
   who contributed!
 */
 
-import "lsa.idl", "samr.idl", "security.idl", "nbt.idl";
+import "misc.idl", "lsa.idl", "samr.idl", "security.idl", "nbt.idl";
 
 #include "idl_types.h"
 
@@ -983,11 +983,11 @@ interface netlogon
 
 	/*****************/
 	/* Function 0x15 */
-	WERROR netr_NETRLOGONDUMMYROUTINE1();
+	[todo] WERROR netr_NETRLOGONDUMMYROUTINE1();
 
 	/****************/
 	/* Function 0x16 */
-	WERROR netr_NETRLOGONSETSERVICEBITS();
+	[todo] WERROR netr_NETRLOGONSETSERVICEBITS();
 
 	/****************/
 	/* Function 0x17 */
@@ -999,11 +999,11 @@ interface netlogon
 
 	/****************/
 	/* Function 0x18 */
-	WERROR netr_NETRLOGONCOMPUTESERVERDIGEST();
+	[todo] WERROR netr_NETRLOGONCOMPUTESERVERDIGEST();
 
 	/****************/
 	/* Function 0x19 */
-	WERROR netr_NETRLOGONCOMPUTECLIENTDIGEST();
+	[todo] WERROR netr_NETRLOGONCOMPUTECLIENTDIGEST();
 
 	/****************/
 	/* Function 0x1a */
@@ -1128,7 +1128,7 @@ interface netlogon
 
 	/****************/
 	/* Function 0x20 */
-	WERROR netr_NETRLOGONSENDTOSAM();
+	[todo] WERROR netr_NETRLOGONSENDTOSAM();
 
 	/****************/
 	/* Function 0x21 */
@@ -1164,7 +1164,7 @@ interface netlogon
 
 	/****************/
 	/* Function 0x23 */
-	WERROR netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN();
+	[todo] WERROR netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN();
 
 	/****************/
 	/* Function 0x24 */
@@ -1332,5 +1332,5 @@ interface netlogon
 
 	/****************/
 	/* Function 0x2e */
-	WERROR netr_NETRSERVERGETTRUSTINFO();
+	[todo] WERROR netr_NETRSERVERGETTRUSTINFO();
 }
diff --git a/source4/librpc/idl/ntsvcs.idl b/source4/librpc/idl/ntsvcs.idl
index 05ba68e727..1cdf8eecaa 100644
--- a/source4/librpc/idl/ntsvcs.idl
+++ b/source4/librpc/idl/ntsvcs.idl
@@ -9,69 +9,69 @@
 ]
 interface ntsvcs
 {
-	void PNP_Disconnect();
-	void PNP_Connect();
-	void PNP_GetVersion();
-	void PNP_GetGlobalState();
-	void PNP_InitDetection();
-	void PNP_ReportLogOn();
-	void PNP_ValidateDeviceInstance();
-	void PNP_GetRootDeviceInstance();
-	void PNP_GetRelatedDeviceInstance();
-	void PNP_EnumerateSubKeys();
-	void PNP_GetDeviceList();
-	void PNP_GetDeviceListSize();
-	void PNP_GetDepth();
-	void PNP_GetDeviceRegProp();
-	void PNP_SetDeviceRegProp();
-	void PNP_GetClassInstance();
-	void PNP_CreateKey();
-	void PNP_DeleteRegistryKey();
-	void PNP_GetClassCount();
-	void PNP_GetClassName();
-	void PNP_DeleteClassKey();
-	void PNP_GetInterfaceDeviceAlias();
-	void PNP_GetInterfaceDeviceList();
-	void PNP_GetInterfaceDeviceListSize();
-	void PNP_RegisterDeviceClassAssociation();
-	void PNP_UnregisterDeviceClassAssociation();
-	void PNP_GetClassRegProp();
-	void PNP_SetClassRegProp();
-	void PNP_CreateDevInst();
-	void PNP_DeviceInstanceAction();
-	void PNP_GetDeviceStatus();
-	void PNP_SetDeviceProblem();
-	void PNP_DisableDevInst();
-	void PNP_UninstallDevInst();
-	void PNP_AddID();
-	void PNP_RegisterDriver();
-	void PNP_QueryRemove();
-	void PNP_RequestDeviceEject();
-	void PNP_IsDockStationPresent();
-	void PNP_RequestEjectPC();
-	void PNP_HwProfFlags();
-	void PNP_GetHwProfInfo();
-	void PNP_AddEmptyLogConf();
-	void PNP_FreeLogConf();
-	void PNP_GetFirstLogConf();
-	void PNP_GetNextLogConf();
-	void PNP_GetLogConfPriority();
-	void PNP_AddResDes();
-	void PNP_FreeResDes();
-	void PNP_GetNextResDes();
-	void PNP_GetResDesData();
-	void PNP_GetResDesDataSize();
-	void PNP_ModifyResDes();
-	void PNP_DetectResourceLimit();
-	void PNP_QueryResConfList();
-	void PNP_SetHwProf();
-	void PNP_QueryArbitratorFreeData();
-	void PNP_QueryArbitratorFreeSize();
-	void PNP_RunDetection();
-	void PNP_RegisterNotification();
-	void PNP_UnregisterNotification();
-	void PNP_GetCustomDevProp();
-	void PNP_GetVersionInternal();
-	void PNP_GetBlockedDriverInfo();
-	void PNP_GetServerSideDeviceInstallFlags();
+	[todo] void PNP_Disconnect();
+	[todo] void PNP_Connect();
+	[todo] void PNP_GetVersion();
+	[todo] void PNP_GetGlobalState();
+	[todo] void PNP_InitDetection();
+	[todo] void PNP_ReportLogOn();
+	[todo] void PNP_ValidateDeviceInstance();
+	[todo] void PNP_GetRootDeviceInstance();
+	[todo] void PNP_GetRelatedDeviceInstance();
+	[todo] void PNP_EnumerateSubKeys();
+	[todo] void PNP_GetDeviceList();
+	[todo] void PNP_GetDeviceListSize();
+	[todo] void PNP_GetDepth();
+	[todo] void PNP_GetDeviceRegProp();
+	[todo] void PNP_SetDeviceRegProp();
+	[todo] void PNP_GetClassInstance();
+	[todo] void PNP_CreateKey();
+	[todo] void PNP_DeleteRegistryKey();
+	[todo] void PNP_GetClassCount();
+	[todo] void PNP_GetClassName();
+	[todo] void PNP_DeleteClassKey();
+	[todo] void PNP_GetInterfaceDeviceAlias();
+	[todo] void PNP_GetInterfaceDeviceList();
+	[todo] void PNP_GetInterfaceDeviceListSize();
+	[todo] void PNP_RegisterDeviceClassAssociation();
+	[todo] void PNP_UnregisterDeviceClassAssociation();
+	[todo] void PNP_GetClassRegProp();
+	[todo] void PNP_SetClassRegProp();
+	[todo] void PNP_CreateDevInst();
+	[todo] void PNP_DeviceInstanceAction();
+	[todo] void PNP_GetDeviceStatus();
+	[todo] void PNP_SetDeviceProblem();
+	[todo] void PNP_DisableDevInst();
+	[todo] void PNP_UninstallDevInst();
+	[todo] void PNP_AddID();
+	[todo] void PNP_RegisterDriver();
+	[todo] void PNP_QueryRemove();
+	[todo] void PNP_RequestDeviceEject();
+	[todo] void PNP_IsDockStationPresent();
+	[todo] void PNP_RequestEjectPC();
+	[todo] void PNP_HwProfFlags();
+	[todo] void PNP_GetHwProfInfo();
+	[todo] void PNP_AddEmptyLogConf();
+	[todo] void PNP_FreeLogConf();
+	[todo] void PNP_GetFirstLogConf();
+	[todo] void PNP_GetNextLogConf();
+	[todo] void PNP_GetLogConfPriority();
+	[todo] void PNP_AddResDes();
+	[todo] void PNP_FreeResDes();
+	[todo] void PNP_GetNextResDes();
+	[todo] void PNP_GetResDesData();
+	[todo] void PNP_GetResDesDataSize();
+	[todo] void PNP_ModifyResDes();
+	[todo] void PNP_DetectResourceLimit();
+	[todo] void PNP_QueryResConfList();
+	[todo] void PNP_SetHwProf();
+	[todo] void PNP_QueryArbitratorFreeData();
+	[todo] void PNP_QueryArbitratorFreeSize();
+	[todo] void PNP_RunDetection();
+	[todo] void PNP_RegisterNotification();
+	[todo] void PNP_UnregisterNotification();
+	[todo] void PNP_GetCustomDevProp();
+	[todo] void PNP_GetVersionInternal();
+	[todo] void PNP_GetBlockedDriverInfo();
+	[todo] void PNP_GetServerSideDeviceInstallFlags();
 }
diff --git a/source4/librpc/idl/oxidresolver.idl b/source4/librpc/idl/oxidresolver.idl
index ac028cec29..95c8a1c5f0 100644
--- a/source4/librpc/idl/oxidresolver.idl
+++ b/source4/librpc/idl/oxidresolver.idl
@@ -10,7 +10,7 @@
  (used by DCOM)
  */
 
-import "orpc.idl";
+import "misc.idl", "orpc.idl";
 
 [ 
 	uuid("99fcfec4-5260-101b-bbcb-00aa0021347a"),
diff --git a/source4/librpc/idl/remact.idl b/source4/librpc/idl/remact.idl
index 58d976e078..2165ecfc81 100644
--- a/source4/librpc/idl/remact.idl
+++ b/source4/librpc/idl/remact.idl
@@ -3,7 +3,7 @@
   http://www.grimes.demon.co.uk/DCOM/DCOMSpec.htm
  */
 
-import "orpc.idl";
+import "misc.idl", "orpc.idl";
 
 [
 	uuid("4d9f4ab8-7d1c-11cf-861e-0020af6e7c57"),
diff --git a/source4/librpc/idl/spoolss.idl b/source4/librpc/idl/spoolss.idl
index 2144393ebd..6b4b0b8a16 100644
--- a/source4/librpc/idl/spoolss.idl
+++ b/source4/librpc/idl/spoolss.idl
@@ -3,7 +3,7 @@
 /*
   spoolss interface definitions
 */
-import "security.idl", "winreg.idl";
+import "misc.idl", "security.idl", "winreg.idl";
 
 [ uuid("12345678-1234-abcd-ef00-0123456789ab"),
   version(1.0),
@@ -386,14 +386,14 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x05 */
-	WERROR spoolss_AddPrinter(
+	[todo] WERROR spoolss_AddPrinter(
  		/* This function is not implemented in Samba 3 as no
  		   clients have been observed using it. */
 	);
 
 	/******************/
 	/* Function: 0x06 */
-	WERROR spoolss_DeletePrinter(
+	[todo] WERROR spoolss_DeletePrinter(
 	);
 
 	/******************/
@@ -442,7 +442,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x09 */
-	WERROR spoolss_AddPrinterDriver(
+	[todo] WERROR spoolss_AddPrinterDriver(
 	);
 
 	typedef struct {
@@ -564,7 +564,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x0b */
-	WERROR spoolss_GetPrinterDriver(
+	[todo] WERROR spoolss_GetPrinterDriver(
 	);
 
 	/******************/
@@ -602,7 +602,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x0e */
-	WERROR spoolss_AddPrintProcessor(
+	[todo] WERROR spoolss_AddPrintProcessor(
 	);
 
 	/******************/
@@ -644,7 +644,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x10 */
-	WERROR spoolss_GetPrintProcessorDirectory(
+	[todo] WERROR spoolss_GetPrintProcessorDirectory(
 	);
 
 	/******************/
@@ -713,12 +713,12 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x18 */
-	WERROR spoolss_AddJob(
+	[todo] WERROR spoolss_AddJob(
 	);
 
 	/******************/
 	/* Function: 0x19 */
-	WERROR spoolss_ScheduleJob(
+	[todo] WERROR spoolss_ScheduleJob(
 	);
 
 	/******************/
@@ -806,7 +806,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x1c */
-	WERROR spoolss_WaitForPrinterChange(
+	[todo] WERROR spoolss_WaitForPrinterChange(
 	);
 
 	/******************/
@@ -1022,79 +1022,79 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x26 */
-	WERROR spoolss_ConfigurePort(
+	[todo] WERROR spoolss_ConfigurePort(
 	);
 
 	/******************/
 	/* Function: 0x27 */
-	WERROR spoolss_DeletePort(
+	[todo] WERROR spoolss_DeletePort(
 	);
 
 	/******************/
 	/* Function: 0x28 */
-	WERROR spoolss_CreatePrinterIC(
+	[todo] WERROR spoolss_CreatePrinterIC(
 	);
 
 	/******************/
 	/* Function: 0x29 */
-	WERROR spoolss_PlayGDIScriptOnPrinterIC(
+	[todo] WERROR spoolss_PlayGDIScriptOnPrinterIC(
 	);
 
 	/******************/
 	/* Function: 0x2a */
-	WERROR spoolss_DeletePrinterIC(
+	[todo] WERROR spoolss_DeletePrinterIC(
 	);
 
 	/******************/
 	/* Function: 0x2b */
-	WERROR spoolss_AddPrinterConnection(
+	[todo] WERROR spoolss_AddPrinterConnection(
 	);
 
 	/******************/
 	/* Function: 0x2c */
-	WERROR spoolss_DeletePrinterConnection(
+	[todo] WERROR spoolss_DeletePrinterConnection(
 	);
 
 	/******************/
 	/* Function: 0x2d */
-	WERROR spoolss_PrinterMessageBox(
+	[todo] WERROR spoolss_PrinterMessageBox(
 		/* Marked as obsolete in MSDN.  "Not necessary and has
 		   no effect". */
 	);
 
 	/******************/
 	/* Function: 0x2e */
-	WERROR spoolss_AddMonitor(
+	[todo] WERROR spoolss_AddMonitor(
 	);
 
 	/******************/
 	/* Function: 0x2f */
-	WERROR spoolss_DeleteMonitor(
+	[todo] WERROR spoolss_DeleteMonitor(
 	);
 
 	/******************/
 	/* Function: 0x30 */
-	WERROR spoolss_DeletePrintProcessor(
+	[todo] WERROR spoolss_DeletePrintProcessor(
 	);
 
 	/******************/
 	/* Function: 0x31 */
-	WERROR spoolss_AddPrintProvidor(
+	[todo] WERROR spoolss_AddPrintProvidor(
 	);
 
 	/******************/
 	/* Function: 0x32 */
-	WERROR spoolss_DeletePrintProvidor(
+	[todo] WERROR spoolss_DeletePrintProvidor(
 	);
 
 	/******************/
 	/* Function: 0x33 */
-	WERROR spoolss_EnumPrintProcDataTypes(
+	[todo] WERROR spoolss_EnumPrintProcDataTypes(
 	);
 
 	/******************/
 	/* Function: 0x34 */
-	WERROR spoolss_ResetPrinter(
+	[todo] WERROR spoolss_ResetPrinter(
 	);
 
 	/******************/
@@ -1115,12 +1115,12 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x36 */
-	WERROR spoolss_FindFirstPrinterChangeNotification(
+	[todo] WERROR spoolss_FindFirstPrinterChangeNotification(
 	);
 
 	/******************/
 	/* Function: 0x37 */
-	WERROR spoolss_FindNextPrinterChangeNotification(
+	[todo] WERROR spoolss_FindNextPrinterChangeNotification(
 	);
 
 	/******************/
@@ -1131,7 +1131,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x39 */
-	WERROR spoolss_RouterFindFirstPrinterChangeNotificationOld(
+	[todo] WERROR spoolss_RouterFindFirstPrinterChangeNotificationOld(
 	);
 
 	/******************/
@@ -1147,7 +1147,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x3b */
-	WERROR spoolss_RouterReplyPrinter(
+	[todo] WERROR spoolss_RouterReplyPrinter(
 	);
 
 	/******************/
@@ -1158,22 +1158,22 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x3d */
-	WERROR spoolss_AddPortEx(
+	[todo] WERROR spoolss_AddPortEx(
 	);
 
 	/******************/
 	/* Function: 0x3e */
-	WERROR spoolss_RouterFindFirstPrinterChangeNotification(
+	[todo] WERROR spoolss_RouterFindFirstPrinterChangeNotification(
 	);
 
 	/******************/
 	/* Function: 0x3f */
-	WERROR spoolss_SpoolerInit(
+	[todo] WERROR spoolss_SpoolerInit(
 	);
 
 	/******************/
 	/* Function: 0x40 */
-	WERROR spoolss_ResetPrinterEx(
+	[todo] WERROR spoolss_ResetPrinterEx(
 	);
 
 	typedef [enum16bit] enum {
@@ -1239,7 +1239,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x42 */
-	WERROR spoolss_RouterRefreshPrinterChangeNotification(
+	[todo] WERROR spoolss_RouterRefreshPrinterChangeNotification(
 	);
 
 	typedef struct {
@@ -1295,7 +1295,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x44 */
-	WERROR spoolss_44(
+	[todo] WERROR spoolss_44(
 	);
 
 	typedef struct {
@@ -1399,7 +1399,7 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x47 */
-	WERROR spoolss_47(
+	[todo] WERROR spoolss_47(
 	);
 
 	/******************/
@@ -1425,17 +1425,17 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x4a */
-	WERROR spoolss_4a(
+	[todo] WERROR spoolss_4a(
 	);
 
 	/******************/
 	/* Function: 0x4b */
-	WERROR spoolss_4b(
+	[todo] WERROR spoolss_4b(
 	);
 
 	/******************/
 	/* Function: 0x4c */
-	WERROR spoolss_4c(
+	[todo] WERROR spoolss_4c(
 	);
 
 	/******************/
@@ -1492,32 +1492,32 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x52 */
-	WERROR spoolss_DeletePrinterKey(
+	[todo] WERROR spoolss_DeletePrinterKey(
 	);
 
 	/******************/
 	/* Function: 0x53 */
-	WERROR spoolss_53(
+	[todo] WERROR spoolss_53(
 	);
 
 	/******************/
 	/* Function: 0x54 */
-	WERROR spoolss_DeletePrinterDriverEx(
+	[todo] WERROR spoolss_DeletePrinterDriverEx(
 	);
 
 	/******************/
 	/* Function: 0x55 */
-	WERROR spoolss_55(
+	[todo] WERROR spoolss_55(
 	);
 
 	/******************/
 	/* Function: 0x56 */
-	WERROR spoolss_56(
+	[todo] WERROR spoolss_56(
 	);
 
 	/******************/
 	/* Function: 0x57 */
-	WERROR spoolss_57(
+	[todo] WERROR spoolss_57(
 	);
 
 	/******************/
@@ -1536,36 +1536,36 @@ import "security.idl", "winreg.idl";
 
 	/******************/
 	/* Function: 0x59 */
-	[public] WERROR spoolss_AddPrinterDriverEx(
+	[public,todo] WERROR spoolss_AddPrinterDriverEx(
 	);
 
 	/******************/
 	/* Function: 0x5a */
-	WERROR spoolss_5a(
+	[todo] WERROR spoolss_5a(
 	);
 
 	/******************/
 	/* Function: 0x5b */
-	WERROR spoolss_5b(
+	[todo] WERROR spoolss_5b(
 	);
 
 	/******************/
 	/* Function: 0x5c */
-	WERROR spoolss_5c(
+	[todo] WERROR spoolss_5c(
 	);
 
 	/******************/
 	/* Function: 0x5d */
-	WERROR spoolss_5d(
+	[todo] WERROR spoolss_5d(
 	);
 
 	/******************/
 	/* Function: 0x5e */
-	WERROR spoolss_5e(
+	[todo] WERROR spoolss_5e(
 	);
 
 	/******************/
 	/* Function: 0x5f */
-	WERROR spoolss_5f(
+	[todo] WERROR spoolss_5f(
 	);
 }
diff --git a/source4/librpc/idl/srvsvc.idl b/source4/librpc/idl/srvsvc.idl
index 8ef49413bc..703f3281cf 100644
--- a/source4/librpc/idl/srvsvc.idl
+++ b/source4/librpc/idl/srvsvc.idl
@@ -1370,7 +1370,7 @@ import "security.idl", "svcctl.idl";
 
 	/******************/
 	/* Function: 0x22 */
-	WERROR srvsvc_NETRPRNAMECANONICALIZE(
+	[todo] WERROR srvsvc_NETRPRNAMECANONICALIZE(
 		);
 
 	/******************/
@@ -1464,56 +1464,56 @@ import "security.idl", "svcctl.idl";
 
 	/******************/
 	/* Function: 0x2b */
-	WERROR srvsvc_NETRDFSGETVERSION(
+	[todo] WERROR srvsvc_NETRDFSGETVERSION(
 		);
 
 	/******************/
 	/* Function: 0x2c */
-	WERROR srvsvc_NETRDFSCREATELOCALPARTITION(
+	[todo] WERROR srvsvc_NETRDFSCREATELOCALPARTITION(
 		);
 
 	/******************/
 	/* Function: 0x2d */
-	WERROR srvsvc_NETRDFSDELETELOCALPARTITION(
+	[todo] WERROR srvsvc_NETRDFSDELETELOCALPARTITION(
 		);
 
 	/******************/
 	/* Function: 0x2e */
-	WERROR srvsvc_NETRDFSSETLOCALVOLUMESTATE(
+	[todo] WERROR srvsvc_NETRDFSSETLOCALVOLUMESTATE(
 		);
 
 	/******************/
 	/* Function: 0x2f */
-	WERROR srvsvc_NETRDFSSETSERVERINFO(
+	[todo] WERROR srvsvc_NETRDFSSETSERVERINFO(
 		);
 
 	/******************/
 	/* Function: 0x30 */
-	WERROR srvsvc_NETRDFSCREATEEXITPOINT(
+	[todo] WERROR srvsvc_NETRDFSCREATEEXITPOINT(
 		);
 
 	/******************/
 	/* Function: 0x31 */
-	WERROR srvsvc_NETRDFSDELETEEXITPOINT(
+	[todo] WERROR srvsvc_NETRDFSDELETEEXITPOINT(
 		);
 
 	/******************/
 	/* Function: 0x32 */
-	WERROR srvsvc_NETRDFSMODIFYPREFIX(
+	[todo] WERROR srvsvc_NETRDFSMODIFYPREFIX(
 		);
 
 	/******************/
 	/* Function: 0x33 */
-	WERROR srvsvc_NETRDFSFIXLOCALVOLUME(
+	[todo] WERROR srvsvc_NETRDFSFIXLOCALVOLUME(
 		);
 
 	/******************/
 	/* Function: 0x34 */
-	WERROR srvsvc_NETRDFSMANAGERREPORTSITEINFO(
+	[todo] WERROR srvsvc_NETRDFSMANAGERREPORTSITEINFO(
 		);
 
 	/******************/
 	/* Function: 0x35 */
-	WERROR srvsvc_NETRSERVERTRANSPORTDELEX(
+	[todo] WERROR srvsvc_NETRSERVERTRANSPORTDELEX(
 		);
 }
diff --git a/source4/librpc/idl/svcctl.idl b/source4/librpc/idl/svcctl.idl
index 8f368ef878..615f4e3dab 100644
--- a/source4/librpc/idl/svcctl.idl
+++ b/source4/librpc/idl/svcctl.idl
@@ -115,12 +115,12 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x04 */
-	WERROR svcctl_QueryServiceObjectSecurity(
+	[todo] WERROR svcctl_QueryServiceObjectSecurity(
 	);
 
 	/*****************/
 	/* Function 0x05 */
-	WERROR svcctl_SetServiceObjectSecurity(
+	[todo] WERROR svcctl_SetServiceObjectSecurity(
 	);
 
 	/*****************/
@@ -132,7 +132,7 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x07 */
-	WERROR svcctl_SetServiceStatus(
+	[todo] WERROR svcctl_SetServiceStatus(
 	);
 
 	/*****************/
@@ -143,7 +143,7 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x09 */
-	WERROR svcctl_NotifyBootConfigStatus(
+	[todo] WERROR svcctl_NotifyBootConfigStatus(
 	);
 
 	/*****************/
@@ -408,12 +408,12 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x22 */
-	WERROR svcctl_GetCurrentGroupeStateW(
+	[todo] WERROR svcctl_GetCurrentGroupeStateW(
 	);
 
 	/*****************/
 	/* Function 0x23 */
-	WERROR svcctl_EnumServiceGroupW(
+	[todo] WERROR svcctl_EnumServiceGroupW(
 	);
 
 	/*****************/
@@ -494,6 +494,6 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x2b */
-	WERROR svcctl_SCSendTSMessage(
+	[todo] WERROR svcctl_SCSendTSMessage(
 	);
 }
diff --git a/source4/librpc/idl/w32time.idl b/source4/librpc/idl/w32time.idl
index c3c6e014de..4839899629 100644
--- a/source4/librpc/idl/w32time.idl
+++ b/source4/librpc/idl/w32time.idl
@@ -14,8 +14,8 @@ interface w32time
 
 	/*****************/
 	/* Function 0x00 */
-	WERROR w32time_SyncTime();
+	[todo] WERROR w32time_SyncTime();
 
-	WERROR w32time_GetNetLogonServiceBits();
-	WERROR w32time_QueryProviderStatus();
+	[todo] WERROR w32time_GetNetLogonServiceBits();
+	[todo] WERROR w32time_QueryProviderStatus();
 }
diff --git a/source4/librpc/idl/winbind.idl b/source4/librpc/idl/winbind.idl
index 29649c0ea7..5cefb38f75 100644
--- a/source4/librpc/idl/winbind.idl
+++ b/source4/librpc/idl/winbind.idl
@@ -3,8 +3,8 @@
 */
 
 #include "idl_types.h"
-  
-import "netlogon.idl";
+
+import "netlogon.idl", "lsa.idl", "security.idl";
 
 [
   uuid("245f3e6b-3c5d-6e21-3a2d-2a3d645b7221"),
@@ -16,6 +16,24 @@ interface winbind
 	typedef [switch_type(uint16)] union netr_LogonLevel netr_LogonLevel;
 	typedef [switch_type(uint16)] union netr_Validation netr_Validation;
 
+	typedef enum {
+		ID_TYPE_NOT_SPECIFIED,
+		ID_TYPE_UID,
+		ID_TYPE_GID,
+		ID_TYPE_BOTH
+	} id_type;
+
+	typedef struct {
+		uint32 id;
+		id_type type;
+	} unixid;
+
+	typedef struct {
+		unixid *unixid;
+		dom_sid *sid;
+		NTSTATUS status;
+	} id_mapping;
+
 	/* a call to get runtime informations */
 	void winbind_information(/* TODO */);
 
@@ -35,4 +53,16 @@ interface winbind
 		[out] [switch_is(validation_level)] netr_Validation validation,
 		[out] uint8 authoritative
 	);
+
+	typedef [v1_enum] enum {
+		WINBIND_IDMAP_LEVEL_SIDS_TO_XIDS	= 1,
+		WINBIND_IDMAP_LEVEL_XIDS_TO_SIDS	= 2
+	} winbind_get_idmap_level;
+
+	NTSTATUS winbind_get_idmap(
+		[in]     winbind_get_idmap_level level,
+		[in]     uint32 count,
+		[in,out] [size_is(count)] id_mapping ids[]
+	);
+
 }
diff --git a/source4/librpc/idl/winreg.idl b/source4/librpc/idl/winreg.idl
index 5e5d5542b6..1e01a91197 100644
--- a/source4/librpc/idl/winreg.idl
+++ b/source4/librpc/idl/winreg.idl
@@ -249,7 +249,7 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x12 */
-	WERROR winreg_ReplaceKey(
+	[todo] WERROR winreg_ReplaceKey(
 	);
 
 	/******************/
@@ -295,7 +295,7 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x17 */
-	WERROR winreg_UnLoadKey(
+	[todo] WERROR winreg_UnLoadKey(
 	);
 
 	/******************/
@@ -375,7 +375,7 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x1f */
-	WERROR winreg_SaveKeyEx(
+	[todo] WERROR winreg_SaveKeyEx(
 	);
 
 	/******************/
@@ -396,6 +396,6 @@ import "lsa.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x22 */
-	WERROR winreg_QueryMultipleValues2(
+	[todo] WERROR winreg_QueryMultipleValues2(
 	);
 }
diff --git a/source4/librpc/ndr.pc.in b/source4/librpc/ndr.pc.in
index ed4c459214..2f4d95006f 100644
--- a/source4/librpc/ndr.pc.in
+++ b/source4/librpc/ndr.pc.in
@@ -5,7 +5,7 @@ includedir=@includedir@
 
 Name: ndr
 Description: Network Data Representation Core Library
-Requires: samba-config talloc
+Requires: samba-hostconfig talloc
 Version: 0.0.1
 Libs: -L${libdir} -lndr 
 Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h
index 731ef0f60b..2439c386db 100644
--- a/source4/librpc/ndr/libndr.h
+++ b/source4/librpc/ndr/libndr.h
@@ -1,6 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    rpc interface definitions
+
    Copyright (C) Andrew Tridgell 2003
    
    This program is free software; you can redistribute it and/or modify
@@ -17,11 +18,16 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+/* This is a public header file that is installed as part of Samba. 
+ * If you remove any functions or change their signature, update 
+ * the so version number. */
+
 #ifndef __LIBNDR_H__
 #define __LIBNDR_H__
 
 #include <talloc.h>
 #include "lib/util/util.h" /* for discard_const */
+#include <sys/time.h>
 #include "lib/charset/charset.h"
 
 /*
@@ -287,8 +293,7 @@ typedef void (*ndr_print_fn_t)(struct ndr_print *, const char *, const void *);
 typedef void (*ndr_print_function_t)(struct ndr_print *, const char *, int, const void *);
 
 #include "libcli/util/error.h"
-#include "librpc/gen_ndr/ndr_misc.h"
-#include "librpc/ndr/libndr_proto.h"
+#include "librpc/gen_ndr/misc.h"
 
 extern const struct ndr_syntax_id ndr_transfer_syntax;
 extern const struct ndr_syntax_id ndr64_transfer_syntax;
@@ -333,5 +338,167 @@ void ndr_print_dom_sid28(struct ndr_print *ndr, const char *name, const struct d
 size_t ndr_size_dom_sid28(const struct dom_sid *sid, int flags);
 void ndr_print_ipv4_addr(struct ndr_print *ndr, const char *name, const struct in_addr *_ip);
 void ndr_print_GUID(struct ndr_print *ndr, const char *name, const struct GUID *guid);
+enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, const void *p, ndr_push_flags_fn_t fn);
+enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p, uint32_t level, ndr_push_flags_fn_t fn);
+size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t push);
+size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_push_flags_fn_t push);
+uint32_t ndr_push_get_relative_base_offset(struct ndr_push *ndr);
+void ndr_push_restore_relative_base_offset(struct ndr_push *ndr, uint32_t offset);
+enum ndr_err_code ndr_push_setup_relative_base_offset1(struct ndr_push *ndr, const void *p, uint32_t offset);
+enum ndr_err_code ndr_push_setup_relative_base_offset2(struct ndr_push *ndr, const void *p);
+enum ndr_err_code ndr_push_relative_ptr1(struct ndr_push *ndr, const void *p);
+enum ndr_err_code ndr_push_relative_ptr2(struct ndr_push *ndr, const void *p);
+uint32_t ndr_pull_get_relative_base_offset(struct ndr_pull *ndr);
+void ndr_pull_restore_relative_base_offset(struct ndr_pull *ndr, uint32_t offset);
+enum ndr_err_code ndr_pull_setup_relative_base_offset1(struct ndr_pull *ndr, const void *p, uint32_t offset);
+enum ndr_err_code ndr_pull_setup_relative_base_offset2(struct ndr_pull *ndr, const void *p);
+enum ndr_err_code ndr_pull_relative_ptr1(struct ndr_pull *ndr, const void *p, uint32_t rel_offset);
+enum ndr_err_code ndr_pull_relative_ptr2(struct ndr_pull *ndr, const void *p);
+size_t ndr_align_size(uint32_t offset, size_t n);
+struct ndr_pull *ndr_pull_init_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience);
+enum ndr_err_code ndr_pull_advance(struct ndr_pull *ndr, uint32_t size);
+struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience);
+DATA_BLOB ndr_push_blob(struct ndr_push *ndr);
+enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_size);
+void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr);
+void ndr_print_union_debug(ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr);
+void ndr_print_function_debug(ndr_print_function_t fn, const char *name, int flags, void *ptr);
+char *ndr_print_struct_string(TALLOC_CTX *mem_ctx, ndr_print_fn_t fn, const char *name, void *ptr);
+char *ndr_print_union_string(TALLOC_CTX *mem_ctx, ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr);
+char *ndr_print_function_string(TALLOC_CTX *mem_ctx,
+				ndr_print_function_t fn, const char *name, 
+				int flags, void *ptr);
+void ndr_set_flags(uint32_t *pflags, uint32_t new_flags);
+enum ndr_err_code ndr_pull_error(struct ndr_pull *ndr,
+				 enum ndr_err_code ndr_err,
+				 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
+enum ndr_err_code ndr_push_error(struct ndr_push *ndr,
+				 enum ndr_err_code ndr_err,
+				 const char *format, ...)  PRINTF_ATTRIBUTE(3,4);
+enum ndr_err_code ndr_pull_subcontext_start(struct ndr_pull *ndr,
+				   struct ndr_pull **_subndr,
+				   size_t header_size,
+				   ssize_t size_is);
+enum ndr_err_code ndr_pull_subcontext_end(struct ndr_pull *ndr,
+				 struct ndr_pull *subndr,
+				 size_t header_size,
+				 ssize_t size_is);
+enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
+				   struct ndr_push **_subndr,
+				   size_t header_size,
+				   ssize_t size_is);
+enum ndr_err_code ndr_push_subcontext_end(struct ndr_push *ndr,
+				 struct ndr_push *subndr,
+				 size_t header_size,
+				 ssize_t size_is);
+enum ndr_err_code ndr_token_store(TALLOC_CTX *mem_ctx,
+			 struct ndr_token_list **list, 
+			 const void *key, 
+			 uint32_t value);
+enum ndr_err_code ndr_token_retrieve_cmp_fn(struct ndr_token_list **list, const void *key, uint32_t *v, comparison_fn_t _cmp_fn, bool _remove_tok);
+enum ndr_err_code ndr_token_retrieve(struct ndr_token_list **list, const void *key, uint32_t *v);
+uint32_t ndr_token_peek(struct ndr_token_list **list, const void *key);
+enum ndr_err_code ndr_pull_array_size(struct ndr_pull *ndr, const void *p);
+uint32_t ndr_get_array_size(struct ndr_pull *ndr, const void *p);
+enum ndr_err_code ndr_check_array_size(struct ndr_pull *ndr, void *p, uint32_t size);
+enum ndr_err_code ndr_pull_array_length(struct ndr_pull *ndr, const void *p);
+uint32_t ndr_get_array_length(struct ndr_pull *ndr, const void *p);
+enum ndr_err_code ndr_check_array_length(struct ndr_pull *ndr, void *p, uint32_t length);
+enum ndr_err_code ndr_push_set_switch_value(struct ndr_push *ndr, const void *p, uint32_t val);
+enum ndr_err_code ndr_pull_set_switch_value(struct ndr_pull *ndr, const void *p, uint32_t val);
+enum ndr_err_code ndr_print_set_switch_value(struct ndr_print *ndr, const void *p, uint32_t val);
+uint32_t ndr_push_get_switch_value(struct ndr_push *ndr, const void *p);
+uint32_t ndr_pull_get_switch_value(struct ndr_pull *ndr, const void *p);
+uint32_t ndr_print_get_switch_value(struct ndr_print *ndr, const void *p);
+enum ndr_err_code ndr_pull_struct_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p, ndr_pull_flags_fn_t fn);
+enum ndr_err_code ndr_pull_struct_blob_all(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p, ndr_pull_flags_fn_t fn);
+enum ndr_err_code ndr_pull_union_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p, uint32_t level, ndr_pull_flags_fn_t fn);
+enum ndr_err_code ndr_pull_union_blob_all(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p, uint32_t level, ndr_pull_flags_fn_t fn);
+
+/* from libndr_basic.h */
+#define NDR_SCALAR_PROTO(name, type) \
+enum ndr_err_code ndr_push_ ## name(struct ndr_push *ndr, int ndr_flags, type v); \
+enum ndr_err_code ndr_pull_ ## name(struct ndr_pull *ndr, int ndr_flags, type *v); \
+void ndr_print_ ## name(struct ndr_print *ndr, const char *var_name, type v); 
+
+#define NDR_BUFFER_PROTO(name, type) \
+enum ndr_err_code ndr_push_ ## name(struct ndr_push *ndr, int ndr_flags, const type *v); \
+enum ndr_err_code ndr_pull_ ## name(struct ndr_pull *ndr, int ndr_flags, type *v); \
+void ndr_print_ ## name(struct ndr_print *ndr, const char *var_name, const type *v); 
+
+NDR_SCALAR_PROTO(uint8, uint8_t)
+NDR_SCALAR_PROTO(int8, int8_t)
+NDR_SCALAR_PROTO(uint16, uint16_t)
+NDR_SCALAR_PROTO(int16, int16_t)
+NDR_SCALAR_PROTO(uint32, uint32_t)
+NDR_SCALAR_PROTO(int32, int32_t)
+NDR_SCALAR_PROTO(udlong, uint64_t)
+NDR_SCALAR_PROTO(udlongr, uint64_t)
+NDR_SCALAR_PROTO(dlong, int64_t)
+NDR_SCALAR_PROTO(hyper, uint64_t)
+NDR_SCALAR_PROTO(pointer, void *)
+NDR_SCALAR_PROTO(time_t, time_t)
+NDR_SCALAR_PROTO(NTSTATUS, NTSTATUS)
+NDR_SCALAR_PROTO(WERROR, WERROR)
+NDR_SCALAR_PROTO(NTTIME, NTTIME)
+NDR_SCALAR_PROTO(NTTIME_1sec, NTTIME)
+NDR_SCALAR_PROTO(NTTIME_hyper, NTTIME)
+NDR_SCALAR_PROTO(DATA_BLOB, DATA_BLOB)
+NDR_SCALAR_PROTO(ipv4address, const char *)
+NDR_SCALAR_PROTO(string, const char *)
+
+enum ndr_err_code ndr_pull_policy_handle(struct ndr_pull *ndr, int ndr_flags, struct policy_handle *r);
+enum ndr_err_code ndr_push_policy_handle(struct ndr_push *ndr, int ndr_flags, const struct policy_handle *r);
+void ndr_print_policy_handle(struct ndr_print *ndr, const char *name, const struct policy_handle *r);
+bool policy_handle_empty(struct policy_handle *h);
+
+void ndr_check_padding(struct ndr_pull *ndr, size_t n);
+enum ndr_err_code ndr_pull_generic_ptr(struct ndr_pull *ndr, uint32_t *v);
+enum ndr_err_code ndr_pull_ref_ptr(struct ndr_pull *ndr, uint32_t *v);
+enum ndr_err_code ndr_pull_bytes(struct ndr_pull *ndr, uint8_t *data, uint32_t n);
+enum ndr_err_code ndr_pull_array_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *data, uint32_t n);
+enum ndr_err_code ndr_push_align(struct ndr_push *ndr, size_t size);
+enum ndr_err_code ndr_pull_align(struct ndr_pull *ndr, size_t size);
+enum ndr_err_code ndr_push_bytes(struct ndr_push *ndr, const uint8_t *data, uint32_t n);
+enum ndr_err_code ndr_push_zero(struct ndr_push *ndr, uint32_t n);
+enum ndr_err_code ndr_push_array_uint8(struct ndr_push *ndr, int ndr_flags, const uint8_t *data, uint32_t n);
+enum ndr_err_code ndr_push_unique_ptr(struct ndr_push *ndr, const void *p);
+enum ndr_err_code ndr_push_full_ptr(struct ndr_push *ndr, const void *p);
+enum ndr_err_code ndr_push_ref_ptr(struct ndr_push *ndr);
+void ndr_print_struct(struct ndr_print *ndr, const char *name, const char *type);
+void ndr_print_enum(struct ndr_print *ndr, const char *name, const char *type, const char *val, uint32_t value);
+void ndr_print_bitmap_flag(struct ndr_print *ndr, size_t size, const char *flag_name, uint32_t flag, uint32_t value);
+void ndr_print_bitmap_flag(struct ndr_print *ndr, size_t size, const char *flag_name, uint32_t flag, uint32_t value);
+void ndr_print_ptr(struct ndr_print *ndr, const char *name, const void *p);
+void ndr_print_union(struct ndr_print *ndr, const char *name, int level, const char *type);
+void ndr_print_bad_level(struct ndr_print *ndr, const char *name, uint16_t level);
+void ndr_print_array_uint8(struct ndr_print *ndr, const char *name, const uint8_t *data, uint32_t count);
+uint32_t ndr_size_DATA_BLOB(int ret, const DATA_BLOB *data, int flags);
+
+/* strings */
+uint32_t ndr_charset_length(const void *var, charset_t chset);
+size_t ndr_string_array_size(struct ndr_push *ndr, const char *s);
+uint32_t ndr_size_string(int ret, const char * const* string, int flags);
+enum ndr_err_code ndr_pull_string_array(struct ndr_pull *ndr, int ndr_flags, const char ***_a);
+enum ndr_err_code ndr_push_string_array(struct ndr_push *ndr, int ndr_flags, const char **a);
+void ndr_print_string_array(struct ndr_print *ndr, const char *name, const char **a);
+uint32_t ndr_string_length(const void *_var, uint32_t element_size);
+enum ndr_err_code ndr_check_string_terminator(struct ndr_pull *ndr, uint32_t count, uint32_t element_size);
+enum ndr_err_code ndr_pull_charset(struct ndr_pull *ndr, int ndr_flags, const char **var, uint32_t length, uint8_t byte_mul, charset_t chset);
+enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags, const char *var, uint32_t length, uint8_t byte_mul, charset_t chset);
+
+/* GUIDs */
+bool GUID_equal(const struct GUID *u1, const struct GUID *u2);
+NTSTATUS GUID_from_string(const char *s, struct GUID *guid);
+NTSTATUS NS_GUID_from_string(const char *s, struct GUID *guid);
+struct GUID GUID_zero(void);
+bool GUID_all_zero(const struct GUID *u);
+int GUID_compare(const struct GUID *u1, const struct GUID *u2);
+char *GUID_string(TALLOC_CTX *mem_ctx, const struct GUID *guid);
+char *GUID_string2(TALLOC_CTX *mem_ctx, const struct GUID *guid);
+char *NS_GUID_string(TALLOC_CTX *mem_ctx, const struct GUID *guid);
+struct GUID GUID_random(void);
 
 #endif /* __LIBNDR_H__ */
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index e6da096403..40852456bc 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -163,7 +163,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_
 	return NDR_ERR_SUCCESS;
 }
 
-_PUBLIC_ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) _PRINTF_ATTRIBUTE(2,3)
+_PUBLIC_ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...)
 {
 	va_list ap;
 	char *s = NULL;
@@ -181,7 +181,7 @@ _PUBLIC_ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format,
 	free(s);
 }
 
-_PUBLIC_ void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...) _PRINTF_ATTRIBUTE(2,3)
+_PUBLIC_ void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...)
 {
 	va_list ap;
 	int i;
@@ -346,7 +346,7 @@ _PUBLIC_ void ndr_set_flags(uint32_t *pflags, uint32_t new_flags)
 */
 _PUBLIC_ enum ndr_err_code ndr_pull_error(struct ndr_pull *ndr,
 				 enum ndr_err_code ndr_err,
-				 const char *format, ...) _PRINTF_ATTRIBUTE(3,4)
+				 const char *format, ...)
 {
 	char *s=NULL;
 	va_list ap;
@@ -367,7 +367,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_error(struct ndr_pull *ndr,
 */
 _PUBLIC_ enum ndr_err_code ndr_push_error(struct ndr_push *ndr,
 				 enum ndr_err_code ndr_err,
-				 const char *format, ...)  _PRINTF_ATTRIBUTE(3,4)
+				 const char *format, ...)
 {
 	char *s=NULL;
 	va_list ap;
diff --git a/source4/librpc/ndr/uuid.c b/source4/librpc/ndr/uuid.c
index e92df22494..1e6ee0a3db 100644
--- a/source4/librpc/ndr/uuid.c
+++ b/source4/librpc/ndr/uuid.c
@@ -110,7 +110,7 @@ _PUBLIC_ NTSTATUS NS_GUID_from_string(const char *s, struct GUID *guid)
 /**
  * generate a random GUID
  */
-struct GUID GUID_random(void)
+_PUBLIC_ struct GUID GUID_random(void)
 {
 	struct GUID guid;
 
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index a379398f19..5e32f6f5bf 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -24,13 +24,14 @@
 #include "lib/util/dlinklist.h"
 #include "lib/events/events.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "libcli/composite/composite.h"
 #include "auth/gensec/gensec.h"
 #include "param/param.h"
 
-NTSTATUS dcerpc_init(void)
+_PUBLIC_ NTSTATUS dcerpc_init(void)
 {
 	gensec_init(global_loadparm);
 
@@ -98,7 +99,7 @@ static struct dcerpc_connection *dcerpc_connection_init(TALLOC_CTX *mem_ctx,
 }
 
 /* initialise a dcerpc pipe. */
-struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct event_context *ev,
+_PUBLIC_ struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct event_context *ev,
 				     struct smb_iconv_convenience *ic)
 {
 	struct dcerpc_pipe *p;
@@ -1104,7 +1105,7 @@ static void dcerpc_ship_next_request(struct dcerpc_connection *c)
   return the event context for a dcerpc pipe
   used by callers who wish to operate asynchronously
 */
-struct event_context *dcerpc_event_context(struct dcerpc_pipe *p)
+_PUBLIC_ struct event_context *dcerpc_event_context(struct dcerpc_pipe *p)
 {
 	return p->conn->event_ctx;
 }
@@ -1503,7 +1504,7 @@ _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
   this can be used when you have ndr push/pull functions in the
   standard format
 */
-NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
 			    const struct GUID *object,
 			    const struct ndr_interface_table *table,
 			    uint32_t opnum, 
@@ -1524,7 +1525,7 @@ NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
 /*
   a useful function for retrieving the server name we connected to
 */
-const char *dcerpc_server_name(struct dcerpc_pipe *p)
+_PUBLIC_ const char *dcerpc_server_name(struct dcerpc_pipe *p)
 {
 	if (!p->conn->transport.target_hostname) {
 		if (!p->conn->transport.peer_name) {
@@ -1688,7 +1689,7 @@ NTSTATUS dcerpc_alter_context_recv(struct composite_context *ctx)
 /* 
    send a dcerpc alter_context request
 */
-NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p, 
+_PUBLIC_ NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p, 
 			      TALLOC_CTX *mem_ctx,
 			      const struct ndr_syntax_id *syntax,
 			      const struct ndr_syntax_id *transfer_syntax)
diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h
index 7c6aa7513b..805f5463a9 100644
--- a/source4/librpc/rpc/dcerpc.h
+++ b/source4/librpc/rpc/dcerpc.h
@@ -20,6 +20,10 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+/* This is a public header file that is installed as part of Samba. 
+ * If you remove any functions or change their signature, update 
+ * the so version number. */
+
 #ifndef __DCERPC_H__
 #define __DCERPC_H__
 
@@ -233,6 +237,130 @@ struct smbcli_tree;
 struct smb2_tree;
 struct socket_address;
 
-#include "librpc/rpc/dcerpc_proto.h"
+NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx, 
+			     struct dcerpc_pipe **pp, 
+			     const char *binding,
+			     const struct ndr_interface_table *table,
+			     struct cli_credentials *credentials,
+			     struct event_context *ev,
+			     struct loadparm_context *lp_ctx);
+NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req);
+struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
+						const struct GUID *object,
+						const struct ndr_interface_table *table,
+						uint32_t opnum, 
+						TALLOC_CTX *mem_ctx, 
+						void *r);
+const char *dcerpc_server_name(struct dcerpc_pipe *p);
+struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct event_context *ev,
+				     struct smb_iconv_convenience *ic);
+NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p,
+			      struct smbcli_tree *tree,
+			      const char *pipe_name);
+NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
+			       const struct ndr_interface_table *table);
+NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
+				  DATA_BLOB *session_key);
+struct composite_context;
+NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c,
+					  struct dcerpc_pipe **p2);
+NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out);
+
+struct composite_context* dcerpc_pipe_connect_b_send(TALLOC_CTX *parent_ctx,
+						     struct dcerpc_binding *binding,
+						     const struct ndr_interface_table *table,
+						     struct cli_credentials *credentials,
+						     struct event_context *ev,
+						     struct loadparm_context *lp_ctx);
+
+NTSTATUS dcerpc_pipe_connect_b_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+				    struct dcerpc_pipe **p);
+
+NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx,
+			       struct dcerpc_pipe **pp,
+			       struct dcerpc_binding *binding,
+			       const struct ndr_interface_table *table,
+			       struct cli_credentials *credentials,
+			       struct event_context *ev,
+			       struct loadparm_context *lp_ctx);
+const char *dcerpc_errstr(TALLOC_CTX *mem_ctx, uint32_t fault_code);
+
+NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
+			  struct dcerpc_pipe **p, 
+			  struct dcerpc_binding *binding,
+			  const struct ndr_interface_table *table,
+			  struct cli_credentials *credentials,
+			  struct loadparm_context *lp_ctx);
+char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b);
+NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p,
+				     struct dcerpc_pipe **p2,
+				     struct dcerpc_binding *b);
+NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx, 
+				   struct dcerpc_pipe *p,
+				   const struct ndr_interface_table *table,
+				   struct cli_credentials *credentials,
+				   struct loadparm_context *lp_ctx,
+				   uint8_t auth_level);
+struct event_context *dcerpc_event_context(struct dcerpc_pipe *p);
+NTSTATUS dcerpc_init(void);
+struct smbcli_tree *dcerpc_smb_tree(struct dcerpc_connection *c);
+uint16_t dcerpc_smb_fnum(struct dcerpc_connection *c);
+NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p, 
+				  struct dcerpc_pipe **pp2,
+				  const struct ndr_interface_table *table);
+NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p, 
+			      TALLOC_CTX *mem_ctx,
+			      const struct ndr_syntax_id *syntax,
+			      const struct ndr_syntax_id *transfer_syntax);
+
+NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p,
+			  const struct ndr_interface_table *table,
+			  struct cli_credentials *credentials,
+			  struct loadparm_context *lp_ctx,
+			  uint8_t auth_type, uint8_t auth_level,
+			  const char *service);
+struct composite_context* dcerpc_pipe_connect_send(TALLOC_CTX *parent_ctx,
+						   const char *binding,
+						   const struct ndr_interface_table *table,
+						   struct cli_credentials *credentials,
+						   struct event_context *ev, struct loadparm_context *lp_ctx);
+NTSTATUS dcerpc_pipe_connect_recv(struct composite_context *c,
+				  TALLOC_CTX *mem_ctx,
+				  struct dcerpc_pipe **pp);
+
+NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
+				const struct ndr_interface_table *table, struct event_context *ev,
+				struct loadparm_context *lp_ctx);
+struct composite_context* dcerpc_secondary_auth_connection_send(struct dcerpc_pipe *p,
+								struct dcerpc_binding *binding,
+								const struct ndr_interface_table *table,
+								struct cli_credentials *credentials,
+								struct loadparm_context *lp_ctx);
+NTSTATUS dcerpc_secondary_auth_connection_recv(struct composite_context *c, 
+					       TALLOC_CTX *mem_ctx,
+					       struct dcerpc_pipe **p);
+
+struct composite_context* dcerpc_secondary_connection_send(struct dcerpc_pipe *p,
+							   struct dcerpc_binding *b);
+void dcerpc_log_packet(const struct ndr_interface_table *ndr,
+		       uint32_t opnum, uint32_t flags, 
+		       DATA_BLOB *pkt);
+NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding, struct epm_tower *tower);
+
+NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct ndr_syntax_id *syntax);
+
+enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower);
+
+NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
+			    const struct GUID *object,
+			    const struct ndr_interface_table *table,
+			    uint32_t opnum, 
+			    TALLOC_CTX *mem_ctx, 
+			    void *r);
+
+NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, 
+				   struct epm_tower *tower, 
+				   struct dcerpc_binding **b_out);
+
 
 #endif /* __DCERPC_H__ */
diff --git a/source4/librpc/rpc/dcerpc_auth.c b/source4/librpc/rpc/dcerpc_auth.c
index f80ef86413..f990029f1d 100644
--- a/source4/librpc/rpc/dcerpc_auth.c
+++ b/source4/librpc/rpc/dcerpc_auth.c
@@ -25,6 +25,7 @@
 #include "libcli/composite/composite.h"
 #include "auth/gensec/gensec.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "param/param.h"
 
 /*
@@ -86,7 +87,7 @@ NTSTATUS dcerpc_bind_auth_none_recv(struct composite_context *ctx)
 /*
   Perform sync non-authenticated dcerpc bind
 */
-NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
 			       const struct ndr_interface_table *table)
 {
 	struct composite_context *ctx;
@@ -372,7 +373,7 @@ NTSTATUS dcerpc_bind_auth_recv(struct composite_context *creq)
    @retval NTSTATUS status code
 */
 
-NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p,
 			  const struct ndr_interface_table *table,
 			  struct cli_credentials *credentials,
 			  struct loadparm_context *lp_ctx,
diff --git a/source4/librpc/rpc/dcerpc_connect.c b/source4/librpc/rpc/dcerpc_connect.c
index 361be4adcd..cc7f2ddbaa 100644
--- a/source4/librpc/rpc/dcerpc_connect.c
+++ b/source4/librpc/rpc/dcerpc_connect.c
@@ -30,6 +30,7 @@
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
 #include "libcli/resolve/resolve.h"
@@ -705,7 +706,7 @@ static void dcerpc_connect_timeout_handler(struct event_context *ev, struct time
   start a request to open a rpc connection to a rpc pipe, using
   specified binding structure to determine the endpoint and options
 */
-struct composite_context* dcerpc_pipe_connect_b_send(TALLOC_CTX *parent_ctx,
+_PUBLIC_ struct composite_context* dcerpc_pipe_connect_b_send(TALLOC_CTX *parent_ctx,
 						     struct dcerpc_binding *binding,
 						     const struct ndr_interface_table *table,
 						     struct cli_credentials *credentials,
@@ -782,7 +783,7 @@ struct composite_context* dcerpc_pipe_connect_b_send(TALLOC_CTX *parent_ctx,
 /*
   receive result of a request to open a rpc connection to a rpc pipe
 */
-NTSTATUS dcerpc_pipe_connect_b_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS dcerpc_pipe_connect_b_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
 				    struct dcerpc_pipe **p)
 {
 	NTSTATUS status;
@@ -804,7 +805,7 @@ NTSTATUS dcerpc_pipe_connect_b_recv(struct composite_context *c, TALLOC_CTX *mem
   open a rpc connection to a rpc pipe, using the specified 
   binding structure to determine the endpoint and options - sync version
 */
-NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx,
+_PUBLIC_ NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx,
 			       struct dcerpc_pipe **pp,
 			       struct dcerpc_binding *binding,
 			       const struct ndr_interface_table *table,
@@ -833,7 +834,7 @@ static void continue_pipe_connect_b(struct composite_context *ctx);
   binding to determine the endpoint and options.
   The string is to be parsed to a binding structure first.
 */
-struct composite_context* dcerpc_pipe_connect_send(TALLOC_CTX *parent_ctx,
+_PUBLIC_ struct composite_context* dcerpc_pipe_connect_send(TALLOC_CTX *parent_ctx,
 						   const char *binding,
 						   const struct ndr_interface_table *table,
 						   struct cli_credentials *credentials,
@@ -928,7 +929,7 @@ NTSTATUS dcerpc_pipe_connect_recv(struct composite_context *c,
   Open a rpc connection to a rpc pipe, using the specified string
   binding to determine the endpoint and options - sync version
 */
-NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx, 
+_PUBLIC_ NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx, 
 			     struct dcerpc_pipe **pp, 
 			     const char *binding,
 			     const struct ndr_interface_table *table,
diff --git a/source4/librpc/rpc/dcerpc_error.c b/source4/librpc/rpc/dcerpc_error.c
index 6394f9cf26..6ea4563ae6 100644
--- a/source4/librpc/rpc/dcerpc_error.c
+++ b/source4/librpc/rpc/dcerpc_error.c
@@ -40,7 +40,7 @@ static const struct dcerpc_fault_table dcerpc_faults[] =
 	{ NULL,					0}	
 };
 
-const char *dcerpc_errstr(TALLOC_CTX *mem_ctx, uint32_t fault_code)
+_PUBLIC_ const char *dcerpc_errstr(TALLOC_CTX *mem_ctx, uint32_t fault_code)
 {
 	int idx = 0;
 
diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c
index 68e211afae..5588b43dcd 100644
--- a/source4/librpc/rpc/dcerpc_schannel.c
+++ b/source4/librpc/rpc/dcerpc_schannel.c
@@ -28,6 +28,7 @@
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_netlogon_c.h"
 #include "auth/credentials/credentials.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 struct schannel_key_state {
 	struct dcerpc_pipe *pipe;
@@ -396,7 +397,7 @@ NTSTATUS dcerpc_bind_auth_schannel_recv(struct composite_context *c)
 /*
   Perform schannel authenticated bind - sync version
  */
-NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx, 
+_PUBLIC_ NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx, 
 				   struct dcerpc_pipe *p,
 				   const struct ndr_interface_table *table,
 				   struct cli_credentials *credentials,
diff --git a/source4/librpc/rpc/dcerpc_secondary.c b/source4/librpc/rpc/dcerpc_secondary.c
index ab98215180..abc67ad38b 100644
--- a/source4/librpc/rpc/dcerpc_secondary.c
+++ b/source4/librpc/rpc/dcerpc_secondary.c
@@ -27,6 +27,7 @@
 #include "libcli/composite/composite.h"
 #include "lib/events/events.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
 #include "libcli/resolve/resolve.h"
@@ -50,7 +51,7 @@ static void continue_pipe_open(struct composite_context *c);
   Send request to create a secondary dcerpc connection from a primary
   connection
 */
-struct composite_context* dcerpc_secondary_connection_send(struct dcerpc_pipe *p,
+_PUBLIC_ struct composite_context* dcerpc_secondary_connection_send(struct dcerpc_pipe *p,
 							   struct dcerpc_binding *b)
 {
 	struct composite_context *c;
@@ -183,7 +184,7 @@ static void continue_pipe_open(struct composite_context *c)
   Receive result of secondary rpc connection request and return
   second dcerpc pipe.
 */
-NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c,
+_PUBLIC_ NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c,
 					  struct dcerpc_pipe **p2)
 {
 	NTSTATUS status = composite_wait(c);
@@ -206,7 +207,7 @@ NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c,
   If the primary is a SMB connection then the secondary connection
   will be on the same SMB connection, but using a new fnum
 */
-NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p,
 				     struct dcerpc_pipe **p2,
 				     struct dcerpc_binding *b)
 {
@@ -234,7 +235,7 @@ struct sec_auth_conn_state {
 static void dcerpc_secondary_auth_connection_bind(struct composite_context *ctx);
 static void dcerpc_secondary_auth_connection_continue(struct composite_context *ctx);
 
-struct composite_context* dcerpc_secondary_auth_connection_send(struct dcerpc_pipe *p,
+_PUBLIC_ struct composite_context* dcerpc_secondary_auth_connection_send(struct dcerpc_pipe *p,
 								struct dcerpc_binding *binding,
 								const struct ndr_interface_table *table,
 								struct cli_credentials *credentials,
@@ -306,7 +307,7 @@ static void dcerpc_secondary_auth_connection_continue(struct composite_context *
 /*
   Receive an authenticated pipe, created as a secondary connection
 */
-NTSTATUS dcerpc_secondary_auth_connection_recv(struct composite_context *c, 
+_PUBLIC_ NTSTATUS dcerpc_secondary_auth_connection_recv(struct composite_context *c, 
 					       TALLOC_CTX *mem_ctx,
 					       struct dcerpc_pipe **p)
 {
diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
index 718ce694c5..26fe433b09 100644
--- a/source4/librpc/rpc/dcerpc_smb.c
+++ b/source4/librpc/rpc/dcerpc_smb.c
@@ -24,6 +24,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "libcli/composite/composite.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 /* transport private information used by SMB pipe transport */
 struct smb_private {
@@ -540,7 +541,7 @@ NTSTATUS dcerpc_pipe_open_smb_recv(struct composite_context *c)
 	return status;
 }
 
-NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p,
 			      struct smbcli_tree *tree,
 			      const char *pipe_name)
 {
@@ -552,7 +553,7 @@ NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_pipe *p,
 /*
   return the SMB tree used for a dcerpc over SMB pipe
 */
-struct smbcli_tree *dcerpc_smb_tree(struct dcerpc_connection *c)
+_PUBLIC_ struct smbcli_tree *dcerpc_smb_tree(struct dcerpc_connection *c)
 {
 	struct smb_private *smb;
 
@@ -567,7 +568,7 @@ struct smbcli_tree *dcerpc_smb_tree(struct dcerpc_connection *c)
 /*
   return the SMB fnum used for a dcerpc over SMB pipe (hack for torture operations)
 */
-uint16_t dcerpc_smb_fnum(struct dcerpc_connection *c)
+_PUBLIC_ uint16_t dcerpc_smb_fnum(struct dcerpc_connection *c)
 {
 	struct smb_private *smb;
 
diff --git a/source4/librpc/rpc/dcerpc_smb2.c b/source4/librpc/rpc/dcerpc_smb2.c
index a0094b8bae..8adca4caba 100644
--- a/source4/librpc/rpc/dcerpc_smb2.c
+++ b/source4/librpc/rpc/dcerpc_smb2.c
@@ -26,6 +26,7 @@
 #include "libcli/smb2/smb2_calls.h"
 #include "libcli/raw/ioctl.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 /* transport private information used by SMB2 pipe transport */
 struct smb2_private {
diff --git a/source4/librpc/rpc/dcerpc_sock.c b/source4/librpc/rpc/dcerpc_sock.c
index 76389f0d74..7480beae33 100644
--- a/source4/librpc/rpc/dcerpc_sock.c
+++ b/source4/librpc/rpc/dcerpc_sock.c
@@ -27,6 +27,7 @@
 #include "lib/stream/packet.h"
 #include "libcli/composite/composite.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "libcli/resolve/resolve.h"
 #include "param/param.h"
 
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index b8128baf43..3b8768ccc2 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -28,6 +28,7 @@
 #include "librpc/gen_ndr/ndr_epmapper_c.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "librpc/gen_ndr/ndr_misc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
 
@@ -236,7 +237,7 @@ const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
 /*
   form a binding string from a binding structure
 */
-char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
+_PUBLIC_ char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
 {
 	char *s = talloc_strdup(mem_ctx, "");
 	int i;
@@ -302,7 +303,7 @@ char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
 /*
   parse a binding string into a dcerpc_binding structure
 */
-NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out)
+_PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out)
 {
 	struct dcerpc_binding *b;
 	char *options;
@@ -437,7 +438,7 @@ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_
 	return NT_STATUS_OK;
 }
 
-NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct ndr_syntax_id *syntax)
+_PUBLIC_ NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct ndr_syntax_id *syntax)
 {
 	TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
 	struct ndr_pull *ndr = ndr_pull_init_blob(&epm_floor->lhs.lhs_data, mem_ctx, NULL);
@@ -633,7 +634,7 @@ enum dcerpc_transport_t dcerpc_transport_by_endpoint_protocol(int prot)
 	return (unsigned int)-1;
 }
 
-enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
+_PUBLIC_ enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
 {
 	int i;
 
@@ -659,7 +660,7 @@ enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
 	return (unsigned int)-1;
 }
 
-NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, 
 				   struct epm_tower *tower, 
 				   struct dcerpc_binding **b_out)
 {
@@ -715,7 +716,7 @@ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
 	return NT_STATUS_OK;
 }
 
-NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding, struct epm_tower *tower)
+_PUBLIC_ NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding, struct epm_tower *tower)
 {
 	const enum epm_protocol *protseq = NULL;
 	int num_protocols = -1, i;
@@ -1009,7 +1010,7 @@ NTSTATUS dcerpc_epm_map_binding_recv(struct composite_context *c)
 /*
   Get endpoint mapping for rpc connection
 */
-NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
+_PUBLIC_ NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
 				const struct ndr_interface_table *table, struct event_context *ev,
 				struct loadparm_context *lp_ctx)
 {
@@ -1329,7 +1330,7 @@ NTSTATUS dcerpc_pipe_auth_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
 
    This may change *p, as it rebinds to a new pipe due to authentication fallback
 */
-NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
 			  struct dcerpc_pipe **p, 
 			  struct dcerpc_binding *binding,
 			  const struct ndr_interface_table *table,
@@ -1355,7 +1356,7 @@ NTSTATUS dcerpc_generic_session_key(struct dcerpc_connection *c,
 /*
   fetch the user session key - may be default (above) or the SMB session key
 */
-NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
+_PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
 				  DATA_BLOB *session_key)
 {
 	return p->conn->security_state.session_key(p->conn, session_key);
@@ -1368,7 +1369,7 @@ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
 
   this triggers on a debug level of >= 10
 */
-void dcerpc_log_packet(const struct ndr_interface_table *ndr,
+_PUBLIC_ void dcerpc_log_packet(const struct ndr_interface_table *ndr,
 		       uint32_t opnum, uint32_t flags, 
 		       DATA_BLOB *pkt)
 {
@@ -1403,7 +1404,7 @@ void dcerpc_log_packet(const struct ndr_interface_table *ndr,
 
   this uses dcerpc_alter_context() to create a new dcerpc context_id
 */
-NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p, 
+_PUBLIC_ NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p, 
 				  struct dcerpc_pipe **pp2,
 				  const struct ndr_interface_table *table)
 {
diff --git a/source4/librpc/tests/binding_string.c b/source4/librpc/tests/binding_string.c
index 5e6fb04515..01cdfae80d 100644
--- a/source4/librpc/tests/binding_string.c
+++ b/source4/librpc/tests/binding_string.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "librpc/gen_ndr/epmapper.h"
 #include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "torture/torture.h"
 
 static bool test_BindingString(struct torture_context *tctx,
diff --git a/source4/nbt_server/config.mk b/source4/nbt_server/config.mk
index f69b73ccfb..84e6b661bf 100644
--- a/source4/nbt_server/config.mk
+++ b/source4/nbt_server/config.mk
@@ -18,7 +18,7 @@ SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 INIT_FUNCTION = LDB_MODULE(wins_ldb)
 PRIVATE_DEPENDENCIES = \
-		LIBNETIF LIBSAMBA-CONFIG LIBSAMBA-UTIL
+		LIBNETIF LIBSAMBA-HOSTCONFIG LIBSAMBA-UTIL
 # End MODULE ldb_wins_ldb
 #######################
 
diff --git a/source4/nsswitch/config.mk b/source4/nsswitch/config.mk
index 8c1eaa72eb..a0ceff0033 100644
--- a/source4/nsswitch/config.mk
+++ b/source4/nsswitch/config.mk
@@ -10,7 +10,7 @@ INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-UTIL \
 		LIBREPLACE_EXT \
-		LIBSAMBA-CONFIG
+		LIBSAMBA-HOSTCONFIG
 # End BINARY nsstest
 #################################
 
diff --git a/source4/ntvfs/cifs/vfs_cifs.c b/source4/ntvfs/cifs/vfs_cifs.c
index 3c090b5f5c..2feb1a0efe 100644
--- a/source4/ntvfs/cifs/vfs_cifs.c
+++ b/source4/ntvfs/cifs/vfs_cifs.c
@@ -26,6 +26,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "auth/auth.h"
 #include "auth/credentials/credentials.h"
diff --git a/source4/ntvfs/common/init.c b/source4/ntvfs/common/init.c
index 1889bef23d..e0f5a9d2aa 100644
--- a/source4/ntvfs/common/init.c
+++ b/source4/ntvfs/common/init.c
@@ -26,7 +26,7 @@
 #include "includes.h"
 #include "ntvfs/sysdep/sys_notify.h"
 
-_PUBLIC_ NTSTATUS ntvfs_common_init(void)
+NTSTATUS ntvfs_common_init(void)
 {
 	return sys_notify_init();
 }
diff --git a/source4/ntvfs/common/opendb.c b/source4/ntvfs/common/opendb.c
index 676706e03f..2913ea8431 100644
--- a/source4/ntvfs/common/opendb.c
+++ b/source4/ntvfs/common/opendb.c
@@ -58,7 +58,7 @@ void odb_set_ops(const struct opendb_ops *new_ops)
   talloc_free(). We need the messaging_ctx to allow for pending open
   notifications.
 */
-_PUBLIC_ struct odb_context *odb_init(TALLOC_CTX *mem_ctx, 
+struct odb_context *odb_init(TALLOC_CTX *mem_ctx, 
 				      struct ntvfs_context *ntvfs_ctx)
 {
 	if (ops == NULL) {
@@ -75,13 +75,13 @@ _PUBLIC_ struct odb_context *odb_init(TALLOC_CTX *mem_ctx,
   get a lock on a entry in the odb. This call returns a lock handle,
   which the caller should unlock using talloc_free().
 */
-_PUBLIC_ struct odb_lock *odb_lock(TALLOC_CTX *mem_ctx,
+struct odb_lock *odb_lock(TALLOC_CTX *mem_ctx,
 				   struct odb_context *odb, DATA_BLOB *file_key)
 {
 	return ops->odb_lock(mem_ctx, odb, file_key);
 }
 
-_PUBLIC_ DATA_BLOB odb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
+DATA_BLOB odb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
 {
 	return ops->odb_get_key(mem_ctx, lck);
 }
@@ -95,7 +95,7 @@ _PUBLIC_ DATA_BLOB odb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
   Note that the path is only used by the delete on close logic, not
   for comparing with other filenames
 */
-_PUBLIC_ NTSTATUS odb_open_file(struct odb_lock *lck,
+NTSTATUS odb_open_file(struct odb_lock *lck,
 				void *file_handle, const char *path,
 				int *fd, bool allow_level_II_oplock,
 				uint32_t oplock_level, uint32_t *oplock_granted)
@@ -109,7 +109,7 @@ _PUBLIC_ NTSTATUS odb_open_file(struct odb_lock *lck,
 /*
   register a pending open file in the open files database
 */
-_PUBLIC_ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
+NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
 {
 	return ops->odb_open_file_pending(lck, private);
 }
@@ -118,7 +118,7 @@ _PUBLIC_ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-_PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle,
+NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle,
 				 const char **delete_path)
 {
 	return ops->odb_close_file(lck, file_handle, delete_path);
@@ -128,7 +128,7 @@ _PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle,
 /*
   remove a pending opendb entry
 */
-_PUBLIC_ NTSTATUS odb_remove_pending(struct odb_lock *lck, void *private)
+NTSTATUS odb_remove_pending(struct odb_lock *lck, void *private)
 {
 	return ops->odb_remove_pending(lck, private);
 }
@@ -137,7 +137,7 @@ _PUBLIC_ NTSTATUS odb_remove_pending(struct odb_lock *lck, void *private)
 /*
   rename the path in a open file
 */
-_PUBLIC_ NTSTATUS odb_rename(struct odb_lock *lck, const char *path)
+NTSTATUS odb_rename(struct odb_lock *lck, const char *path)
 {
 	return ops->odb_rename(lck, path);
 }
@@ -145,7 +145,7 @@ _PUBLIC_ NTSTATUS odb_rename(struct odb_lock *lck, const char *path)
 /*
   get back the path of an open file
 */
-_PUBLIC_ NTSTATUS odb_get_path(struct odb_lock *lck, const char **path)
+NTSTATUS odb_get_path(struct odb_lock *lck, const char **path)
 {
 	return ops->odb_get_path(lck, path);
 }
@@ -153,7 +153,7 @@ _PUBLIC_ NTSTATUS odb_get_path(struct odb_lock *lck, const char **path)
 /*
   update delete on close flag on an open file
 */
-_PUBLIC_ NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_close)
+NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_close)
 {
 	return ops->odb_set_delete_on_close(lck, del_on_close);
 }
@@ -162,7 +162,7 @@ _PUBLIC_ NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_clos
   return the current value of the delete_on_close bit, and how many
   people still have the file open
 */
-_PUBLIC_ NTSTATUS odb_get_delete_on_close(struct odb_context *odb, 
+NTSTATUS odb_get_delete_on_close(struct odb_context *odb, 
 					  DATA_BLOB *key, bool *del_on_close)
 {
 	return ops->odb_get_delete_on_close(odb, key, del_on_close);
@@ -173,7 +173,7 @@ _PUBLIC_ NTSTATUS odb_get_delete_on_close(struct odb_context *odb,
   determine if a file can be opened with the given share_access,
   create_options and access_mask
 */
-_PUBLIC_ NTSTATUS odb_can_open(struct odb_lock *lck,
+NTSTATUS odb_can_open(struct odb_lock *lck,
 			       uint32_t stream_id, uint32_t share_access,
 			       uint32_t access_mask, bool delete_on_close,
 			       uint32_t open_disposition, bool break_to_none)
@@ -182,13 +182,13 @@ _PUBLIC_ NTSTATUS odb_can_open(struct odb_lock *lck,
 				 delete_on_close, open_disposition, break_to_none);
 }
 
-_PUBLIC_ NTSTATUS odb_update_oplock(struct odb_lock *lck, void *file_handle,
+NTSTATUS odb_update_oplock(struct odb_lock *lck, void *file_handle,
 				    uint32_t oplock_level)
 {
 	return ops->odb_update_oplock(lck, file_handle, oplock_level);
 }
 
-_PUBLIC_ NTSTATUS odb_break_oplocks(struct odb_lock *lck)
+NTSTATUS odb_break_oplocks(struct odb_lock *lck)
 {
 	return ops->odb_break_oplocks(lck);
 }
diff --git a/source4/ntvfs/config.mk b/source4/ntvfs/config.mk
index 436fe11522..93cbf64d8f 100644
--- a/source4/ntvfs/config.mk
+++ b/source4/ntvfs/config.mk
@@ -79,7 +79,7 @@ PRIVATE_PROTO_HEADER = ntvfs_proto.h
 
 ntvfs_OBJ_FILES = $(addprefix ntvfs/, ntvfs_base.o ntvfs_generic.o ntvfs_interface.o ntvfs_util.o)
 
-PUBLIC_HEADERS += ntvfs/ntvfs.h
+# PUBLIC_HEADERS += ntvfs/ntvfs.h
 #
 # End SUBSYSTEM NTVFS
 ################################################
diff --git a/source4/ntvfs/ntvfs_base.c b/source4/ntvfs/ntvfs_base.c
index 4cd6192c77..3706cd172c 100644
--- a/source4/ntvfs/ntvfs_base.c
+++ b/source4/ntvfs/ntvfs_base.c
@@ -43,7 +43,7 @@ static int num_backends;
 
   The 'type' is used to specify whether this is for a disk, printer or IPC$ share
 */
-_PUBLIC_ NTSTATUS ntvfs_register(const struct ntvfs_ops *ops,
+NTSTATUS ntvfs_register(const struct ntvfs_ops *ops,
 				 const struct ntvfs_critical_sizes *const sizes)
 {
 	struct ntvfs_ops *new_ops;
@@ -84,7 +84,7 @@ _PUBLIC_ NTSTATUS ntvfs_register(const struct ntvfs_ops *ops,
 /*
   return the operations structure for a named backend of the specified type
 */
-_PUBLIC_ const struct ntvfs_ops *ntvfs_backend_byname(const char *name, enum ntvfs_type type)
+const struct ntvfs_ops *ntvfs_backend_byname(const char *name, enum ntvfs_type type)
 {
 	int i;
 
@@ -107,12 +107,12 @@ _PUBLIC_ const struct ntvfs_ops *ntvfs_backend_byname(const char *name, enum ntv
 
 static const NTVFS_CURRENT_CRITICAL_SIZES(critical_sizes);
 
-_PUBLIC_ const struct ntvfs_critical_sizes *ntvfs_interface_version(void)
+const struct ntvfs_critical_sizes *ntvfs_interface_version(void)
 {
 	return &critical_sizes;
 }
 
-_PUBLIC_ bool ntvfs_interface_differs(const struct ntvfs_critical_sizes *const iface)
+bool ntvfs_interface_differs(const struct ntvfs_critical_sizes *const iface)
 {
 	/* The comparison would be easier with memcmp, but compiler-interset
 	 * alignment padding is not guaranteed to be zeroed.
diff --git a/source4/ntvfs/ntvfs_generic.c b/source4/ntvfs/ntvfs_generic.c
index 5092e732b4..e1a86c07c0 100644
--- a/source4/ntvfs/ntvfs_generic.c
+++ b/source4/ntvfs/ntvfs_generic.c
@@ -361,7 +361,7 @@ static NTSTATUS map_openx_open(uint16_t flags, uint16_t open_mode,
 /* 
    NTVFS open generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_open(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_open(struct ntvfs_module_context *ntvfs,
 				 struct ntvfs_request *req,
 				 union smb_open *io)
 {
@@ -512,7 +512,7 @@ done:
 /* 
    NTVFS fsinfo generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
 				   struct ntvfs_request *req,
 				   union smb_fsinfo *fs)
 {
@@ -641,7 +641,7 @@ _PUBLIC_ NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS fileinfo generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_fileinfo(TALLOC_CTX *mem_ctx,
+NTSTATUS ntvfs_map_fileinfo(TALLOC_CTX *mem_ctx,
 				     union smb_fileinfo *info, 
 				     union smb_fileinfo *info2)
 {
@@ -872,7 +872,7 @@ _PUBLIC_ NTSTATUS ntvfs_map_fileinfo(TALLOC_CTX *mem_ctx,
 /* 
    NTVFS fileinfo generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_qfileinfo(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_qfileinfo(struct ntvfs_module_context *ntvfs,
 				      struct ntvfs_request *req,
 				      union smb_fileinfo *info)
 {
@@ -905,7 +905,7 @@ _PUBLIC_ NTSTATUS ntvfs_map_qfileinfo(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS pathinfo generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_qpathinfo(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_qpathinfo(struct ntvfs_module_context *ntvfs,
 				      struct ntvfs_request *req,
 				      union smb_fileinfo *info)
 {
@@ -939,7 +939,7 @@ _PUBLIC_ NTSTATUS ntvfs_map_qpathinfo(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS lock generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_lock(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_lock(struct ntvfs_module_context *ntvfs,
 				 struct ntvfs_request *req,
 				 union smb_lock *lck)
 {
@@ -1114,7 +1114,7 @@ static NTSTATUS ntvfs_map_write_finish(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS write generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_write(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_write(struct ntvfs_module_context *ntvfs,
 				  struct ntvfs_request *req,
 				  union smb_write *wr)
 {
@@ -1226,7 +1226,7 @@ static NTSTATUS ntvfs_map_read_finish(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS read* to readx mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_read(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_read(struct ntvfs_module_context *ntvfs,
 				 struct ntvfs_request *req,
 				 union smb_read *rd)
 {
@@ -1322,7 +1322,7 @@ done:
 /* 
    NTVFS close generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_close(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_close(struct ntvfs_module_context *ntvfs,
 				  struct ntvfs_request *req,
 				  union smb_close *cl)
 {
@@ -1391,7 +1391,7 @@ static NTSTATUS ntvfs_map_notify_finish(struct ntvfs_module_context *ntvfs,
 /* 
    NTVFS notify generic to any mapper
 */
-_PUBLIC_ NTSTATUS ntvfs_map_notify(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_map_notify(struct ntvfs_module_context *ntvfs,
 				   struct ntvfs_request *req,
 				   union smb_notify *nt)
 {
diff --git a/source4/ntvfs/ntvfs_interface.c b/source4/ntvfs/ntvfs_interface.c
index 3bd2859388..c348558fca 100644
--- a/source4/ntvfs/ntvfs_interface.c
+++ b/source4/ntvfs/ntvfs_interface.c
@@ -22,7 +22,7 @@
 #include "ntvfs/ntvfs.h"
 
 /* connect/disconnect */
-_PUBLIC_ NTSTATUS ntvfs_connect(struct ntvfs_request *req, const char *sharename)
+NTSTATUS ntvfs_connect(struct ntvfs_request *req, const char *sharename)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->connect) {
@@ -31,7 +31,7 @@ _PUBLIC_ NTSTATUS ntvfs_connect(struct ntvfs_request *req, const char *sharename
 	return ntvfs->ops->connect(ntvfs, req, sharename);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_disconnect(struct ntvfs_context *ntvfs_ctx)
+NTSTATUS ntvfs_disconnect(struct ntvfs_context *ntvfs_ctx)
 {
 	struct ntvfs_module_context *ntvfs;
 	if (ntvfs_ctx == NULL) {
@@ -46,7 +46,7 @@ _PUBLIC_ NTSTATUS ntvfs_disconnect(struct ntvfs_context *ntvfs_ctx)
 
 /* async setup - called by a backend that wants to setup any state for
    a async request */
-_PUBLIC_ NTSTATUS ntvfs_async_setup(struct ntvfs_request *req, void *private)
+NTSTATUS ntvfs_async_setup(struct ntvfs_request *req, void *private)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->async_setup) {
@@ -56,7 +56,7 @@ _PUBLIC_ NTSTATUS ntvfs_async_setup(struct ntvfs_request *req, void *private)
 }
 
 /* filesystem operations */
-_PUBLIC_ NTSTATUS ntvfs_fsinfo(struct ntvfs_request *req, union smb_fsinfo *fs)
+NTSTATUS ntvfs_fsinfo(struct ntvfs_request *req, union smb_fsinfo *fs)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->fsinfo) {
@@ -66,7 +66,7 @@ _PUBLIC_ NTSTATUS ntvfs_fsinfo(struct ntvfs_request *req, union smb_fsinfo *fs)
 }
 
 /* path operations */
-_PUBLIC_ NTSTATUS ntvfs_unlink(struct ntvfs_request *req, union smb_unlink *unl)
+NTSTATUS ntvfs_unlink(struct ntvfs_request *req, union smb_unlink *unl)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->unlink) {
@@ -75,7 +75,7 @@ _PUBLIC_ NTSTATUS ntvfs_unlink(struct ntvfs_request *req, union smb_unlink *unl)
 	return ntvfs->ops->unlink(ntvfs, req, unl);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_chkpath(struct ntvfs_request *req, union smb_chkpath *cp)
+NTSTATUS ntvfs_chkpath(struct ntvfs_request *req, union smb_chkpath *cp)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->chkpath) {
@@ -84,7 +84,7 @@ _PUBLIC_ NTSTATUS ntvfs_chkpath(struct ntvfs_request *req, union smb_chkpath *cp
 	return ntvfs->ops->chkpath(ntvfs, req, cp);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_qpathinfo(struct ntvfs_request *req, union smb_fileinfo *st)
+NTSTATUS ntvfs_qpathinfo(struct ntvfs_request *req, union smb_fileinfo *st)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->qpathinfo) {
@@ -93,7 +93,7 @@ _PUBLIC_ NTSTATUS ntvfs_qpathinfo(struct ntvfs_request *req, union smb_fileinfo
 	return ntvfs->ops->qpathinfo(ntvfs, req, st);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_setpathinfo(struct ntvfs_request *req, union smb_setfileinfo *st)
+NTSTATUS ntvfs_setpathinfo(struct ntvfs_request *req, union smb_setfileinfo *st)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->setpathinfo) {
@@ -102,7 +102,7 @@ _PUBLIC_ NTSTATUS ntvfs_setpathinfo(struct ntvfs_request *req, union smb_setfile
 	return ntvfs->ops->setpathinfo(ntvfs, req, st);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_open(struct ntvfs_request *req, union smb_open *oi)
+NTSTATUS ntvfs_open(struct ntvfs_request *req, union smb_open *oi)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->open) {
@@ -111,7 +111,7 @@ _PUBLIC_ NTSTATUS ntvfs_open(struct ntvfs_request *req, union smb_open *oi)
 	return ntvfs->ops->open(ntvfs, req, oi);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_mkdir(struct ntvfs_request *req, union smb_mkdir *md)
+NTSTATUS ntvfs_mkdir(struct ntvfs_request *req, union smb_mkdir *md)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->mkdir) {
@@ -120,7 +120,7 @@ _PUBLIC_ NTSTATUS ntvfs_mkdir(struct ntvfs_request *req, union smb_mkdir *md)
 	return ntvfs->ops->mkdir(ntvfs, req, md);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_rmdir(struct ntvfs_request *req, struct smb_rmdir *rd)
+NTSTATUS ntvfs_rmdir(struct ntvfs_request *req, struct smb_rmdir *rd)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->rmdir) {
@@ -129,7 +129,7 @@ _PUBLIC_ NTSTATUS ntvfs_rmdir(struct ntvfs_request *req, struct smb_rmdir *rd)
 	return ntvfs->ops->rmdir(ntvfs, req, rd);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_rename(struct ntvfs_request *req, union smb_rename *ren)
+NTSTATUS ntvfs_rename(struct ntvfs_request *req, union smb_rename *ren)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->rename) {
@@ -138,7 +138,7 @@ _PUBLIC_ NTSTATUS ntvfs_rename(struct ntvfs_request *req, union smb_rename *ren)
 	return ntvfs->ops->rename(ntvfs, req, ren);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_copy(struct ntvfs_request *req, struct smb_copy *cp)
+NTSTATUS ntvfs_copy(struct ntvfs_request *req, struct smb_copy *cp)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->copy) {
@@ -148,7 +148,7 @@ _PUBLIC_ NTSTATUS ntvfs_copy(struct ntvfs_request *req, struct smb_copy *cp)
 }
 
 /* directory search */
-_PUBLIC_ NTSTATUS ntvfs_search_first(struct ntvfs_request *req, union smb_search_first *io, void *private,
+NTSTATUS ntvfs_search_first(struct ntvfs_request *req, union smb_search_first *io, void *private,
 				     bool ntvfs_callback(void *private, const union smb_search_data *file))
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
@@ -158,7 +158,7 @@ _PUBLIC_ NTSTATUS ntvfs_search_first(struct ntvfs_request *req, union smb_search
 	return ntvfs->ops->search_first(ntvfs, req, io, private, ntvfs_callback);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_search_next(struct ntvfs_request *req, union smb_search_next *io, void *private,
+NTSTATUS ntvfs_search_next(struct ntvfs_request *req, union smb_search_next *io, void *private,
 				    bool ntvfs_callback(void *private, const union smb_search_data *file))
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
@@ -168,7 +168,7 @@ _PUBLIC_ NTSTATUS ntvfs_search_next(struct ntvfs_request *req, union smb_search_
 	return ntvfs->ops->search_next(ntvfs, req, io, private, ntvfs_callback);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_search_close(struct ntvfs_request *req, union smb_search_close *io)
+NTSTATUS ntvfs_search_close(struct ntvfs_request *req, union smb_search_close *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->search_close) {
@@ -178,7 +178,7 @@ _PUBLIC_ NTSTATUS ntvfs_search_close(struct ntvfs_request *req, union smb_search
 }
 
 /* operations on open files */
-_PUBLIC_ NTSTATUS ntvfs_ioctl(struct ntvfs_request *req, union smb_ioctl *io)
+NTSTATUS ntvfs_ioctl(struct ntvfs_request *req, union smb_ioctl *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->ioctl) {
@@ -187,7 +187,7 @@ _PUBLIC_ NTSTATUS ntvfs_ioctl(struct ntvfs_request *req, union smb_ioctl *io)
 	return ntvfs->ops->ioctl(ntvfs, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_read(struct ntvfs_request *req, union smb_read *io)
+NTSTATUS ntvfs_read(struct ntvfs_request *req, union smb_read *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->read) {
@@ -196,7 +196,7 @@ _PUBLIC_ NTSTATUS ntvfs_read(struct ntvfs_request *req, union smb_read *io)
 	return ntvfs->ops->read(ntvfs, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_write(struct ntvfs_request *req, union smb_write *io)
+NTSTATUS ntvfs_write(struct ntvfs_request *req, union smb_write *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->write) {
@@ -205,7 +205,7 @@ _PUBLIC_ NTSTATUS ntvfs_write(struct ntvfs_request *req, union smb_write *io)
 	return ntvfs->ops->write(ntvfs, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_seek(struct ntvfs_request *req, union smb_seek *io)
+NTSTATUS ntvfs_seek(struct ntvfs_request *req, union smb_seek *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->seek) {
@@ -214,7 +214,7 @@ _PUBLIC_ NTSTATUS ntvfs_seek(struct ntvfs_request *req, union smb_seek *io)
 	return ntvfs->ops->seek(ntvfs, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_flush(struct ntvfs_request *req,
+NTSTATUS ntvfs_flush(struct ntvfs_request *req,
 			      union smb_flush *flush)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
@@ -224,7 +224,7 @@ _PUBLIC_ NTSTATUS ntvfs_flush(struct ntvfs_request *req,
 	return ntvfs->ops->flush(ntvfs, req, flush);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_lock(struct ntvfs_request *req, union smb_lock *lck)
+NTSTATUS ntvfs_lock(struct ntvfs_request *req, union smb_lock *lck)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->lock) {
@@ -233,7 +233,7 @@ _PUBLIC_ NTSTATUS ntvfs_lock(struct ntvfs_request *req, union smb_lock *lck)
 	return ntvfs->ops->lock(ntvfs, req, lck);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_qfileinfo(struct ntvfs_request *req, union smb_fileinfo *info)
+NTSTATUS ntvfs_qfileinfo(struct ntvfs_request *req, union smb_fileinfo *info)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->qfileinfo) {
@@ -242,7 +242,7 @@ _PUBLIC_ NTSTATUS ntvfs_qfileinfo(struct ntvfs_request *req, union smb_fileinfo
 	return ntvfs->ops->qfileinfo(ntvfs, req, info);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_setfileinfo(struct ntvfs_request *req, union smb_setfileinfo *info)
+NTSTATUS ntvfs_setfileinfo(struct ntvfs_request *req, union smb_setfileinfo *info)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->setfileinfo) {
@@ -251,7 +251,7 @@ _PUBLIC_ NTSTATUS ntvfs_setfileinfo(struct ntvfs_request *req, union smb_setfile
 	return ntvfs->ops->setfileinfo(ntvfs, req, info);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_close(struct ntvfs_request *req, union smb_close *io)
+NTSTATUS ntvfs_close(struct ntvfs_request *req, union smb_close *io)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->close) {
@@ -261,7 +261,7 @@ _PUBLIC_ NTSTATUS ntvfs_close(struct ntvfs_request *req, union smb_close *io)
 }
 
 /* trans interface - used by IPC backend for pipes and RAP calls */
-_PUBLIC_ NTSTATUS ntvfs_trans(struct ntvfs_request *req, struct smb_trans2 *trans)
+NTSTATUS ntvfs_trans(struct ntvfs_request *req, struct smb_trans2 *trans)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->trans) {
@@ -271,7 +271,7 @@ _PUBLIC_ NTSTATUS ntvfs_trans(struct ntvfs_request *req, struct smb_trans2 *tran
 }
 
 /* trans2 interface - only used by CIFS backend to prover complete passthru for testing */
-_PUBLIC_ NTSTATUS ntvfs_trans2(struct ntvfs_request *req, struct smb_trans2 *trans2)
+NTSTATUS ntvfs_trans2(struct ntvfs_request *req, struct smb_trans2 *trans2)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->trans2) {
@@ -281,7 +281,7 @@ _PUBLIC_ NTSTATUS ntvfs_trans2(struct ntvfs_request *req, struct smb_trans2 *tra
 }
 
 /* printing specific operations */
-_PUBLIC_ NTSTATUS ntvfs_lpq(struct ntvfs_request *req, union smb_lpq *lpq)
+NTSTATUS ntvfs_lpq(struct ntvfs_request *req, union smb_lpq *lpq)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->lpq) {
@@ -291,7 +291,7 @@ _PUBLIC_ NTSTATUS ntvfs_lpq(struct ntvfs_request *req, union smb_lpq *lpq)
 }
 
 /* logoff - called when a vuid is closed */
-_PUBLIC_ NTSTATUS ntvfs_logoff(struct ntvfs_request *req)
+NTSTATUS ntvfs_logoff(struct ntvfs_request *req)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->logoff) {
@@ -300,7 +300,7 @@ _PUBLIC_ NTSTATUS ntvfs_logoff(struct ntvfs_request *req)
 	return ntvfs->ops->logoff(ntvfs, req);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_exit(struct ntvfs_request *req)
+NTSTATUS ntvfs_exit(struct ntvfs_request *req)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->exit) {
@@ -312,7 +312,7 @@ _PUBLIC_ NTSTATUS ntvfs_exit(struct ntvfs_request *req)
 /*
   change notify request
 */
-_PUBLIC_ NTSTATUS ntvfs_notify(struct ntvfs_request *req, union smb_notify *info)
+NTSTATUS ntvfs_notify(struct ntvfs_request *req, union smb_notify *info)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->notify) {
@@ -324,7 +324,7 @@ _PUBLIC_ NTSTATUS ntvfs_notify(struct ntvfs_request *req, union smb_notify *info
 /*
   cancel an outstanding async request
 */
-_PUBLIC_ NTSTATUS ntvfs_cancel(struct ntvfs_request *req)
+NTSTATUS ntvfs_cancel(struct ntvfs_request *req)
 {
 	struct ntvfs_module_context *ntvfs = req->ctx->modules;
 	if (!ntvfs->ops->cancel) {
@@ -334,7 +334,7 @@ _PUBLIC_ NTSTATUS ntvfs_cancel(struct ntvfs_request *req)
 }
 
 /* initial setup */
-_PUBLIC_ NTSTATUS ntvfs_next_connect(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_connect(struct ntvfs_module_context *ntvfs, 
 				     struct ntvfs_request *req, const char *sharename)
 {
 	if (!ntvfs->next || !ntvfs->next->ops->connect) {
@@ -343,7 +343,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_connect(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->connect(ntvfs->next, req, sharename);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_disconnect(struct ntvfs_module_context *ntvfs)
+NTSTATUS ntvfs_next_disconnect(struct ntvfs_module_context *ntvfs)
 {
 	if (!ntvfs->next || !ntvfs->next->ops->disconnect) {
 		return NT_STATUS_NOT_IMPLEMENTED;
@@ -352,7 +352,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_disconnect(struct ntvfs_module_context *ntvfs)
 }
 
 /* async_setup - called when setting up for a async request */
-_PUBLIC_ NTSTATUS ntvfs_next_async_setup(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_async_setup(struct ntvfs_module_context *ntvfs, 
 					 struct ntvfs_request *req, 
 					 void *private)
 {
@@ -363,7 +363,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_async_setup(struct ntvfs_module_context *ntvfs,
 }
 
 /* filesystem operations */
-_PUBLIC_ NTSTATUS ntvfs_next_fsinfo(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_fsinfo(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req,
 				    union smb_fsinfo *fs)
 {
@@ -374,7 +374,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_fsinfo(struct ntvfs_module_context *ntvfs,
 }
 
 /* path operations */
-_PUBLIC_ NTSTATUS ntvfs_next_unlink(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_unlink(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req,
 				    union smb_unlink *unl)
 {
@@ -384,7 +384,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_unlink(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->unlink(ntvfs->next, req, unl);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_chkpath(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_chkpath(struct ntvfs_module_context *ntvfs, 
 				     struct ntvfs_request *req,
 				     union smb_chkpath *cp)
 {
@@ -394,7 +394,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_chkpath(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->chkpath(ntvfs->next, req, cp);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_qpathinfo(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_qpathinfo(struct ntvfs_module_context *ntvfs, 
 				       struct ntvfs_request *req,
 				       union smb_fileinfo *st)
 {
@@ -404,7 +404,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_qpathinfo(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->qpathinfo(ntvfs->next, req, st);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_setpathinfo(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_setpathinfo(struct ntvfs_module_context *ntvfs, 
 					 struct ntvfs_request *req,
 					 union smb_setfileinfo *st)
 {
@@ -414,7 +414,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_setpathinfo(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->setpathinfo(ntvfs->next, req, st);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_mkdir(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_mkdir(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   union smb_mkdir *md)
 {
@@ -424,7 +424,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_mkdir(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->mkdir(ntvfs->next, req, md);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_rmdir(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_rmdir(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   struct smb_rmdir *rd)
 {
@@ -434,7 +434,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_rmdir(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->rmdir(ntvfs->next, req, rd);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_rename(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_rename(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req,
 				    union smb_rename *ren)
 {
@@ -444,7 +444,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_rename(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->rename(ntvfs->next, req, ren);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_copy(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_copy(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req,
 				  struct smb_copy *cp)
 {
@@ -454,7 +454,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_copy(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->copy(ntvfs->next, req, cp);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_open(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_open(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req,
 				  union smb_open *oi)
 {
@@ -466,7 +466,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_open(struct ntvfs_module_context *ntvfs,
 
 
 /* directory search */
-_PUBLIC_ NTSTATUS ntvfs_next_search_first(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_search_first(struct ntvfs_module_context *ntvfs, 
 					  struct ntvfs_request *req,
 					  union smb_search_first *io, void *private,
 					  bool (*callback)(void *private, const union smb_search_data *file))
@@ -477,7 +477,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_search_first(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->search_first(ntvfs->next, req, io, private, callback);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_search_next(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_search_next(struct ntvfs_module_context *ntvfs, 
 					 struct ntvfs_request *req,
 					 union smb_search_next *io, void *private,
 					 bool (*callback)(void *private, const union smb_search_data *file))
@@ -488,7 +488,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_search_next(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->search_next(ntvfs->next, req, io, private, callback);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_search_close(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_search_close(struct ntvfs_module_context *ntvfs, 
 					  struct ntvfs_request *req,
 					  union smb_search_close *io)
 {
@@ -499,7 +499,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_search_close(struct ntvfs_module_context *ntvfs,
 }
 
 /* operations on open files */
-_PUBLIC_ NTSTATUS ntvfs_next_ioctl(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_ioctl(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   union smb_ioctl *io)
 {
@@ -509,7 +509,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_ioctl(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->ioctl(ntvfs->next, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_read(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_read(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req,
 				  union smb_read *io)
 {
@@ -519,7 +519,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_read(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->read(ntvfs->next, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_write(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_write(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   union smb_write *io)
 {
@@ -529,7 +529,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_write(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->write(ntvfs->next, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_seek(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_seek(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req,
 				  union smb_seek *io)
 {
@@ -539,7 +539,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_seek(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->seek(ntvfs->next, req, io);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_flush(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_flush(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   union smb_flush *flush)
 {
@@ -549,7 +549,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_flush(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->flush(ntvfs->next, req, flush);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_lock(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_lock(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req,
 				  union smb_lock *lck)
 {
@@ -559,7 +559,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_lock(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->lock(ntvfs->next, req, lck);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_qfileinfo(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_qfileinfo(struct ntvfs_module_context *ntvfs, 
 				       struct ntvfs_request *req,
 				       union smb_fileinfo *info)
 {
@@ -569,7 +569,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_qfileinfo(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->qfileinfo(ntvfs->next, req, info);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_setfileinfo(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_setfileinfo(struct ntvfs_module_context *ntvfs, 
 					 struct ntvfs_request *req,
 					 union smb_setfileinfo *info)
 {
@@ -579,7 +579,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_setfileinfo(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->setfileinfo(ntvfs->next, req, info);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_close(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_close(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   union smb_close *io)
 {
@@ -590,7 +590,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_close(struct ntvfs_module_context *ntvfs,
 }
 
 /* trans interface - used by IPC backend for pipes and RAP calls */
-_PUBLIC_ NTSTATUS ntvfs_next_trans(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_trans(struct ntvfs_module_context *ntvfs, 
 				   struct ntvfs_request *req,
 				   struct smb_trans2 *trans)
 {
@@ -601,7 +601,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_trans(struct ntvfs_module_context *ntvfs,
 }
 
 /* trans2 interface - only used by CIFS backend to prover complete passthru for testing */
-_PUBLIC_ NTSTATUS ntvfs_next_trans2(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_trans2(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req,
 				    struct smb_trans2 *trans2)
 {
@@ -614,7 +614,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_trans2(struct ntvfs_module_context *ntvfs,
 /*
   change notify request
 */
-_PUBLIC_ NTSTATUS ntvfs_next_notify(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_next_notify(struct ntvfs_module_context *ntvfs,
 				    struct ntvfs_request *req,
 				    union smb_notify *info)
 {
@@ -625,7 +625,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_notify(struct ntvfs_module_context *ntvfs,
 }
 
 /* cancel - called to cancel an outstanding async request */
-_PUBLIC_ NTSTATUS ntvfs_next_cancel(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_cancel(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req)
 {
 	if (!ntvfs->next || !ntvfs->next->ops->cancel) {
@@ -635,7 +635,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_cancel(struct ntvfs_module_context *ntvfs,
 }
 
 /* printing specific operations */
-_PUBLIC_ NTSTATUS ntvfs_next_lpq(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_lpq(struct ntvfs_module_context *ntvfs, 
 				 struct ntvfs_request *req,
 				 union smb_lpq *lpq)
 {
@@ -647,7 +647,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_lpq(struct ntvfs_module_context *ntvfs,
 
 
 /* logoff - called when a vuid is closed */
-_PUBLIC_ NTSTATUS ntvfs_next_logoff(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_logoff(struct ntvfs_module_context *ntvfs, 
 				    struct ntvfs_request *req)
 {
 	if (!ntvfs->next || !ntvfs->next->ops->logoff) {
@@ -656,7 +656,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_logoff(struct ntvfs_module_context *ntvfs,
 	return ntvfs->next->ops->logoff(ntvfs->next, req);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_next_exit(struct ntvfs_module_context *ntvfs, 
+NTSTATUS ntvfs_next_exit(struct ntvfs_module_context *ntvfs, 
 				  struct ntvfs_request *req)
 {
 	if (!ntvfs->next || !ntvfs->next->ops->exit) {
@@ -666,7 +666,7 @@ _PUBLIC_ NTSTATUS ntvfs_next_exit(struct ntvfs_module_context *ntvfs,
 }
 
 /* oplock helpers */
-_PUBLIC_ NTSTATUS ntvfs_set_oplock_handler(struct ntvfs_context *ntvfs,
+NTSTATUS ntvfs_set_oplock_handler(struct ntvfs_context *ntvfs,
 					   NTSTATUS (*handler)(void *private_data, struct ntvfs_handle *handle, uint8_t level),
 					   void *private_data)
 {
@@ -675,7 +675,7 @@ _PUBLIC_ NTSTATUS ntvfs_set_oplock_handler(struct ntvfs_context *ntvfs,
 	return NT_STATUS_OK;
 }
 
-_PUBLIC_ NTSTATUS ntvfs_send_oplock_break(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_send_oplock_break(struct ntvfs_module_context *ntvfs,
 					  struct ntvfs_handle *handle, uint8_t level)
 {
 	if (!ntvfs->ctx->oplock.handler) {
@@ -686,7 +686,7 @@ _PUBLIC_ NTSTATUS ntvfs_send_oplock_break(struct ntvfs_module_context *ntvfs,
 }
 
 /* client connection callback */
-_PUBLIC_ NTSTATUS ntvfs_set_addr_callbacks(struct ntvfs_context *ntvfs,
+NTSTATUS ntvfs_set_addr_callbacks(struct ntvfs_context *ntvfs,
 					   struct socket_address *(*my_addr)(void *private_data, TALLOC_CTX *mem_ctx),
 					   struct socket_address *(*peer_addr)(void *private_data, TALLOC_CTX *mem_ctx),
 					   void *private_data)
@@ -697,7 +697,7 @@ _PUBLIC_ NTSTATUS ntvfs_set_addr_callbacks(struct ntvfs_context *ntvfs,
 	return NT_STATUS_OK;
 }
 
-_PUBLIC_ struct socket_address *ntvfs_get_my_addr(struct ntvfs_module_context *ntvfs, TALLOC_CTX *mem_ctx)
+struct socket_address *ntvfs_get_my_addr(struct ntvfs_module_context *ntvfs, TALLOC_CTX *mem_ctx)
 {
 	if (!ntvfs->ctx->client.get_my_addr) {
 		return NULL;
@@ -706,7 +706,7 @@ _PUBLIC_ struct socket_address *ntvfs_get_my_addr(struct ntvfs_module_context *n
 	return ntvfs->ctx->client.get_my_addr(ntvfs->ctx->client.private_data, mem_ctx);
 }
 
-_PUBLIC_ struct socket_address *ntvfs_get_peer_addr(struct ntvfs_module_context *ntvfs, TALLOC_CTX *mem_ctx)
+struct socket_address *ntvfs_get_peer_addr(struct ntvfs_module_context *ntvfs, TALLOC_CTX *mem_ctx)
 {
 	if (!ntvfs->ctx->client.get_peer_addr) {
 		return NULL;
diff --git a/source4/ntvfs/ntvfs_util.c b/source4/ntvfs/ntvfs_util.c
index ebe8008edd..fadbe2b80a 100644
--- a/source4/ntvfs/ntvfs_util.c
+++ b/source4/ntvfs/ntvfs_util.c
@@ -25,7 +25,7 @@
 #include "ntvfs/ntvfs.h"
 
 
-_PUBLIC_ struct ntvfs_request *ntvfs_request_create(struct ntvfs_context *ctx, TALLOC_CTX *mem_ctx,
+struct ntvfs_request *ntvfs_request_create(struct ntvfs_context *ctx, TALLOC_CTX *mem_ctx,
 						    struct auth_session_info *session_info,
 						    uint16_t smbpid,
 						    struct timeval request_time,
@@ -62,7 +62,7 @@ failed:
 	return NULL;
 }
 
-_PUBLIC_ NTSTATUS ntvfs_async_state_push(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_async_state_push(struct ntvfs_module_context *ntvfs,
 					 struct ntvfs_request *req,
 					 void *private_data,
 					 void (*send_fn)(struct ntvfs_request *))
@@ -84,7 +84,7 @@ _PUBLIC_ NTSTATUS ntvfs_async_state_push(struct ntvfs_module_context *ntvfs,
 	return NT_STATUS_OK;
 }
 
-_PUBLIC_ void ntvfs_async_state_pop(struct ntvfs_request *req)
+void ntvfs_async_state_pop(struct ntvfs_request *req)
 {
 	struct ntvfs_async_state *async;
 
@@ -98,7 +98,7 @@ _PUBLIC_ void ntvfs_async_state_pop(struct ntvfs_request *req)
 	talloc_free(async);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_handle_new(struct ntvfs_module_context *ntvfs,
+NTSTATUS ntvfs_handle_new(struct ntvfs_module_context *ntvfs,
 				   struct ntvfs_request *req,
 				   struct ntvfs_handle **h)
 {
@@ -108,7 +108,7 @@ _PUBLIC_ NTSTATUS ntvfs_handle_new(struct ntvfs_module_context *ntvfs,
 	return ntvfs->ctx->handles.create_new(ntvfs->ctx->handles.private_data, req, h);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_handle_set_backend_data(struct ntvfs_handle *h,
+NTSTATUS ntvfs_handle_set_backend_data(struct ntvfs_handle *h,
 						struct ntvfs_module_context *ntvfs,
 						TALLOC_CTX *private_data)
 {
@@ -137,7 +137,7 @@ _PUBLIC_ NTSTATUS ntvfs_handle_set_backend_data(struct ntvfs_handle *h,
 	return NT_STATUS_OK;
 }
 
-_PUBLIC_ void *ntvfs_handle_get_backend_data(struct ntvfs_handle *h,
+void *ntvfs_handle_get_backend_data(struct ntvfs_handle *h,
 					     struct ntvfs_module_context *ntvfs)
 {
 	struct ntvfs_handle_data *d;
@@ -150,7 +150,7 @@ _PUBLIC_ void *ntvfs_handle_get_backend_data(struct ntvfs_handle *h,
 	return NULL;
 }
 
-_PUBLIC_ void ntvfs_handle_remove_backend_data(struct ntvfs_handle *h,
+void ntvfs_handle_remove_backend_data(struct ntvfs_handle *h,
 					       struct ntvfs_module_context *ntvfs)
 {
 	struct ntvfs_handle_data *d,*n;
@@ -169,7 +169,7 @@ _PUBLIC_ void ntvfs_handle_remove_backend_data(struct ntvfs_handle *h,
 	h->ctx->handles.destroy(h->ctx->handles.private_data, h);
 }
 
-_PUBLIC_ struct ntvfs_handle *ntvfs_handle_search_by_wire_key(struct ntvfs_module_context *ntvfs,
+struct ntvfs_handle *ntvfs_handle_search_by_wire_key(struct ntvfs_module_context *ntvfs,
 							      struct ntvfs_request *req,
 							      const DATA_BLOB *key)
 {
@@ -179,12 +179,12 @@ _PUBLIC_ struct ntvfs_handle *ntvfs_handle_search_by_wire_key(struct ntvfs_modul
 	return ntvfs->ctx->handles.search_by_wire_key(ntvfs->ctx->handles.private_data, req, key);
 }
 
-_PUBLIC_ DATA_BLOB ntvfs_handle_get_wire_key(struct ntvfs_handle *h, TALLOC_CTX *mem_ctx)
+DATA_BLOB ntvfs_handle_get_wire_key(struct ntvfs_handle *h, TALLOC_CTX *mem_ctx)
 {
 	return h->ctx->handles.get_wire_key(h->ctx->handles.private_data, h, mem_ctx);
 }
 
-_PUBLIC_ NTSTATUS ntvfs_set_handle_callbacks(struct ntvfs_context *ntvfs,
+NTSTATUS ntvfs_set_handle_callbacks(struct ntvfs_context *ntvfs,
 					     NTSTATUS (*create_new)(void *private_data, struct ntvfs_request *req, struct ntvfs_handle **h),
 					     NTSTATUS (*make_valid)(void *private_data, struct ntvfs_handle *h),
 					     void (*destroy)(void *private_data, struct ntvfs_handle *h),
diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index f19dc1f41f..2393a2e7a3 100644
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -38,7 +38,7 @@ static int num_backends;
   The 'name' can be later used by other backends to find the operations
   structure for this backend.  
 */
-_PUBLIC_ NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
+NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
 {
 	struct pvfs_acl_ops *new_ops;
 
@@ -66,7 +66,7 @@ _PUBLIC_ NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
 /*
   return the operations structure for a named backend
 */
-_PUBLIC_ const struct pvfs_acl_ops *pvfs_acl_backend_byname(const char *name)
+const struct pvfs_acl_ops *pvfs_acl_backend_byname(const char *name)
 {
 	int i;
 
@@ -126,6 +126,8 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 	NTSTATUS status;
 	struct security_ace ace;
 	mode_t mode;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
 	*psd = security_descriptor_initialise(req);
 	if (*psd == NULL) {
@@ -133,15 +135,33 @@ static NTSTATUS pvfs_default_acl(struct pvfs_state *pvfs,
 	}
 	sd = *psd;
 
-	status = sidmap_uid_to_sid(pvfs->sidmap, sd, name->st.st_uid, &sd->owner_sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-	status = sidmap_gid_to_sid(pvfs->sidmap, sd, name->st.st_gid, &sd->group_sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
+	ids = talloc_array(sd, struct id_mapping, 2);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids[0].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
+
+	ids[0].unixid->id = name->st.st_uid;
+	ids[0].unixid->type = ID_TYPE_UID;
+	ids[0].sid = NULL;
 
+	ids[1].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
+
+	ids[1].unixid->id = name->st.st_gid;
+	ids[1].unixid->type = ID_TYPE_GID;
+	ids[1].sid = NULL;
+
+	ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, ids, 2, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_xids_to_sids_recv(ctx, &ids);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	sd->owner_sid = talloc_steal(sd, ids[0].sid);
+	sd->group_sid = talloc_steal(sd, ids[1].sid);
+
+	talloc_free(ids);
 	sd->type |= SEC_DESC_DACL_PRESENT;
 
 	mode = name->st.st_mode;
@@ -248,6 +268,8 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 	gid_t old_gid = -1;
 	uid_t new_uid = -1;
 	gid_t new_gid = -1;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
 	if (pvfs->acl_ops != NULL) {
 		status = pvfs->acl_ops->acl_load(pvfs, name, fd, req, &sd);
@@ -259,6 +281,12 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 		return status;
 	}
 
+	ids = talloc(req, struct id_mapping);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+	ids->unixid = NULL;
+	ids->sid = NULL;
+	ids->status = NT_STATUS_NONE_MAPPED;
+
 	new_sd = info->set_secdesc.in.sd;
 	orig_sd = *sd;
 
@@ -271,8 +299,16 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 			return NT_STATUS_ACCESS_DENIED;
 		}
 		if (!dom_sid_equal(sd->owner_sid, new_sd->owner_sid)) {
-			status = sidmap_sid_to_unixuid(pvfs->sidmap, new_sd->owner_sid, &new_uid);
+			ids->sid = new_sd->owner_sid;
+			ctx = wbc_sids_to_xids_send(pvfs->wbc_ctx, ids, 1, ids);
+			NT_STATUS_HAVE_NO_MEMORY(ctx);
+			status = wbc_sids_to_xids_recv(ctx, &ids);
 			NT_STATUS_NOT_OK_RETURN(status);
+
+			if (ids->unixid->type == ID_TYPE_BOTH ||
+			    ids->unixid->type == ID_TYPE_UID) {
+				new_uid = ids->unixid->id;
+			}
 		}
 		sd->owner_sid = new_sd->owner_sid;
 	}
@@ -281,8 +317,17 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 			return NT_STATUS_ACCESS_DENIED;
 		}
 		if (!dom_sid_equal(sd->group_sid, new_sd->group_sid)) {
-			status = sidmap_sid_to_unixgid(pvfs->sidmap, new_sd->group_sid, &new_gid);
+			ids->sid = new_sd->group_sid;
+			ctx = wbc_sids_to_xids_send(pvfs->wbc_ctx, ids, 1, ids);
+			NT_STATUS_HAVE_NO_MEMORY(ctx);
+			status = wbc_sids_to_xids_recv(ctx, &ids);
 			NT_STATUS_NOT_OK_RETURN(status);
+
+			if (ids->unixid->type == ID_TYPE_BOTH ||
+			    ids->unixid->type == ID_TYPE_GID) {
+				new_gid = ids->unixid->id;
+			}
+
 		}
 		sd->group_sid = new_sd->group_sid;
 	}
@@ -664,6 +709,8 @@ NTSTATUS pvfs_acl_inherit(struct pvfs_state *pvfs,
 	struct pvfs_filename *parent;
 	struct security_descriptor *parent_sd, *sd;
 	bool container;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
 	/* form the parents path */
 	status = pvfs_resolve_parent(pvfs, req, name, &parent);
@@ -705,14 +752,31 @@ NTSTATUS pvfs_acl_inherit(struct pvfs_state *pvfs,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = sidmap_uid_to_sid(pvfs->sidmap, sd, name->st.st_uid, &sd->owner_sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-	status = sidmap_gid_to_sid(pvfs->sidmap, sd, name->st.st_gid, &sd->group_sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
+	ids = talloc_array(sd, struct id_mapping, 2);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids[0].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
+	ids[0].unixid->id = name->st.st_uid;
+	ids[0].unixid->type = ID_TYPE_UID;
+	ids[0].sid = NULL;
+	ids[0].status = NT_STATUS_NONE_MAPPED;
+
+	ids[1].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
+	ids[1].unixid->id = name->st.st_gid;
+	ids[1].unixid->type = ID_TYPE_GID;
+	ids[1].sid = NULL;
+	ids[1].status = NT_STATUS_NONE_MAPPED;
+
+	ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, ids, 2, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_xids_to_sids_recv(ctx, &ids);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	sd->owner_sid = talloc_steal(sd, ids[0].sid);
+	sd->group_sid = talloc_steal(sd, ids[1].sid);
 
 	sd->type |= SEC_DESC_DACL_PRESENT;
 
diff --git a/source4/ntvfs/posix/pvfs_acl_nfs4.c b/source4/ntvfs/posix/pvfs_acl_nfs4.c
index 2abb1482a4..fa855555b2 100644
--- a/source4/ntvfs/posix/pvfs_acl_nfs4.c
+++ b/source4/ntvfs/posix/pvfs_acl_nfs4.c
@@ -38,7 +38,9 @@ static NTSTATUS pvfs_acl_load_nfs4(struct pvfs_state *pvfs, struct pvfs_filename
 	NTSTATUS status;
 	struct nfs4acl *acl;
 	struct security_descriptor *sd;
-	int i;
+	int i, num_ids;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
 	acl = talloc_zero(mem_ctx, struct nfs4acl);
 	NT_STATUS_HAVE_NO_MEMORY(acl);
@@ -57,25 +59,57 @@ static NTSTATUS pvfs_acl_load_nfs4(struct pvfs_state *pvfs, struct pvfs_filename
 	sd = *psd;
 
 	sd->type |= acl->a_flags;
-	status = sidmap_uid_to_sid(pvfs->sidmap, sd, name->st.st_uid, &sd->owner_sid);
-	NT_STATUS_NOT_OK_RETURN(status);
-	status = sidmap_gid_to_sid(pvfs->sidmap, sd, name->st.st_gid, &sd->group_sid);
+
+	/* the number of ids to map is the acl count plus uid and gid */
+	num_ids = acl->a_count +2;
+	ids = talloc_array(sd, struct id_mapping, num_ids);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids[0].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[0].unixid);
+	ids[0].unixid->id = name->st.st_uid;
+	ids[0].unixid->type = ID_TYPE_UID;
+	ids[0].sid = NULL;
+	ids[0].status = NT_STATUS_NONE_MAPPED;
+
+	ids[1].unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids[1].unixid);
+	ids[1].unixid->id = name->st.st_gid;
+	ids[1].unixid->type = ID_TYPE_GID;
+	ids[1].sid = NULL;
+	ids[1].status = NT_STATUS_NONE_MAPPED;
+
+	for (i=0;i<acl->a_count;i++) {
+		struct nfs4ace *a = &acl->ace[i];
+		ids[i+2].unixid = talloc(ids, struct unixid);
+		NT_STATUS_HAVE_NO_MEMORY(ids[i+2].unixid);
+		ids[i+2].unixid->id = a->e_id;
+		if (a->e_flags & ACE4_IDENTIFIER_GROUP) {
+			ids[i+2].unixid->type = ID_TYPE_GID;
+		} else {
+			ids[i+2].unixid->type = ID_TYPE_UID;
+		}
+		ids[i+2].sid = NULL;
+		ids[i+2].status = NT_STATUS_NONE_MAPPED;
+	}
+
+	/* Allocate memory for the sids from the security descriptor to be on
+	 * the safe side. */
+	ctx = wbc_xids_to_sids_send(pvfs->wbc_ctx, sd, num_ids, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+	status = wbc_xids_to_sids_recv(ctx, &ids);
 	NT_STATUS_NOT_OK_RETURN(status);
 
+	sd->owner_sid = talloc_steal(sd, ids[0].sid);
+	sd->group_sid = talloc_steal(sd, ids[1].sid);
+
 	for (i=0;i<acl->a_count;i++) {
 		struct nfs4ace *a = &acl->ace[i];
 		struct security_ace ace;
-		struct dom_sid *sid;
 		ace.type = a->e_type;
 		ace.flags = a->e_flags;
 		ace.access_mask = a->e_mask;
-		if (a->e_flags & ACE4_IDENTIFIER_GROUP) {
-			status = sidmap_gid_to_sid(pvfs->sidmap, sd, a->e_id, &sid);
-		} else {
-			status = sidmap_uid_to_sid(pvfs->sidmap, sd, a->e_id, &sid);
-		}
-		NT_STATUS_NOT_OK_RETURN(status);
-		ace.trustee = *sid;
+		ace.trustee = *ids[i+2].sid;
 		security_descriptor_dacl_add(sd, &ace);
 	}
 
@@ -93,6 +127,8 @@ static NTSTATUS pvfs_acl_save_nfs4(struct pvfs_state *pvfs, struct pvfs_filename
 	struct nfs4acl acl;
 	int i;
 	TALLOC_CTX *tmp_ctx;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
 	tmp_ctx = talloc_new(pvfs);
 	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
@@ -110,30 +146,44 @@ static NTSTATUS pvfs_acl_save_nfs4(struct pvfs_state *pvfs, struct pvfs_filename
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	ids = talloc_array(tmp_ctx, struct id_mapping, acl.a_count);
+	if (ids == NULL) {
+		talloc_free(tmp_ctx);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	for (i=0;i<acl.a_count;i++) {
+		struct security_ace *ace = &sd->dacl->aces[i];
+		ids[i].unixid = NULL;
+		ids[i].sid = dom_sid_dup(ids, &ace->trustee);
+		if (ids[i].sid == NULL) {
+			talloc_free(tmp_ctx);
+			return NT_STATUS_NO_MEMORY;
+		}
+		ids[i].status = NT_STATUS_NONE_MAPPED;
+	}
+
+	ctx = wbc_sids_to_xids_send(pvfs->wbc_ctx,ids, acl.a_count, ids);
+	if (ctx == NULL) {
+		talloc_free(tmp_ctx);
+		return NT_STATUS_NO_MEMORY;
+	}
+	status = wbc_sids_to_xids_recv(ctx, &ids);
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(tmp_ctx);
+		return status;
+	}
+
 	for (i=0;i<acl.a_count;i++) {
 		struct nfs4ace *a = &acl.ace[i];
 		struct security_ace *ace = &sd->dacl->aces[i];
 		a->e_type  = ace->type;
 		a->e_flags = ace->flags;
 		a->e_mask  = ace->access_mask;
-		if (sidmap_sid_is_group(pvfs->sidmap, &ace->trustee)) {
-			gid_t gid;
+		if (ids[i].unixid->type != ID_TYPE_UID) {
 			a->e_flags |= ACE4_IDENTIFIER_GROUP;
-			status = sidmap_sid_to_unixgid(pvfs->sidmap, &ace->trustee, &gid);
-			if (!NT_STATUS_IS_OK(status)) {
-				talloc_free(tmp_ctx);
-				return status;
-			}
-			a->e_id = gid;
-		} else {
-			uid_t uid;
-			status = sidmap_sid_to_unixuid(pvfs->sidmap, &ace->trustee, &uid);
-			if (!NT_STATUS_IS_OK(status)) {
-				talloc_free(tmp_ctx);
-				return status;
-			}
-			a->e_id = uid;
 		}
+		a->e_id = ids[i].unixid->id;
 		a->e_who   = "";
 	}
 
diff --git a/source4/ntvfs/posix/pvfs_xattr.c b/source4/ntvfs/posix/pvfs_xattr.c
index b66d252a45..3043b80538 100644
--- a/source4/ntvfs/posix/pvfs_xattr.c
+++ b/source4/ntvfs/posix/pvfs_xattr.c
@@ -101,7 +101,7 @@ NTSTATUS pvfs_xattr_unlink_hook(struct pvfs_state *pvfs, const char *fname)
 /*
   load a NDR structure from a xattr
 */
-_PUBLIC_ NTSTATUS pvfs_xattr_ndr_load(struct pvfs_state *pvfs,
+NTSTATUS pvfs_xattr_ndr_load(struct pvfs_state *pvfs,
 			     TALLOC_CTX *mem_ctx,
 			     const char *fname, int fd, const char *attr_name,
 			     void *p, void *pull_fn)
@@ -131,7 +131,7 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_load(struct pvfs_state *pvfs,
 /*
   save a NDR structure into a xattr
 */
-_PUBLIC_ NTSTATUS pvfs_xattr_ndr_save(struct pvfs_state *pvfs,
+NTSTATUS pvfs_xattr_ndr_save(struct pvfs_state *pvfs,
 			     const char *fname, int fd, const char *attr_name, 
 			     void *p, void *push_fn)
 {
diff --git a/source4/ntvfs/posix/vfs_posix.c b/source4/ntvfs/posix/vfs_posix.c
index ca874d1db1..ebc2d88e70 100644
--- a/source4/ntvfs/posix/vfs_posix.c
+++ b/source4/ntvfs/posix/vfs_posix.c
@@ -222,8 +222,10 @@ static NTSTATUS pvfs_connect(struct ntvfs_module_context *ntvfs,
 					   event_context_find(pvfs),
 					   pvfs->ntvfs->ctx->config);
 
-	pvfs->sidmap = sidmap_open(pvfs, pvfs->ntvfs->ctx->lp_ctx);
-	if (pvfs->sidmap == NULL) {
+	pvfs->wbc_ctx = wbc_init(pvfs,
+				 pvfs->ntvfs->ctx->msg_ctx,
+				 pvfs->ntvfs->ctx->event_ctx);
+	if (pvfs->wbc_ctx == NULL) {
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
diff --git a/source4/ntvfs/posix/vfs_posix.h b/source4/ntvfs/posix/vfs_posix.h
index 4d22a91714..441424142f 100644
--- a/source4/ntvfs/posix/vfs_posix.h
+++ b/source4/ntvfs/posix/vfs_posix.h
@@ -26,6 +26,7 @@
 #include "system/filesys.h"
 #include "ntvfs/ntvfs.h"
 #include "ntvfs/common/ntvfs_common.h"
+#include "libcli/wbclient/wbclient.h"
 #include "dsdb/samdb/samdb.h"
 
 struct pvfs_wait;
@@ -46,7 +47,7 @@ struct pvfs_state {
 	struct brl_context *brl_context;
 	struct odb_context *odb_context;
 	struct notify_context *notify_context;
-	struct sidmap_context *sidmap;
+	struct wbc_context *wbc_ctx;
 
 	/* a list of pending async requests. Needed to support
 	   ntcancel */
diff --git a/source4/ntvfs/unixuid/vfs_unixuid.c b/source4/ntvfs/unixuid/vfs_unixuid.c
index 63889c6677..66c2cfaf4c 100644
--- a/source4/ntvfs/unixuid/vfs_unixuid.c
+++ b/source4/ntvfs/unixuid/vfs_unixuid.c
@@ -25,11 +25,11 @@
 #include "system/passwd.h"
 #include "auth/auth.h"
 #include "ntvfs/ntvfs.h"
-#include "dsdb/samdb/samdb.h"
+#include "libcli/wbclient/wbclient.h"
 #include "param/param.h"
 
 struct unixuid_private {
-	struct sidmap_context *sidmap;
+	struct wbc_context *wbc_ctx;
 	struct unix_sec_ctx *last_sec_ctx;
 	struct security_token *last_token;
 };
@@ -100,9 +100,11 @@ static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
 					  struct security_token *token,
 					  struct unix_sec_ctx **sec)
 {
-	struct unixuid_private *private = ntvfs->private_data;
+	struct unixuid_private *priv = ntvfs->private_data;
 	int i;
 	NTSTATUS status;
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 	*sec = talloc(req, struct unix_sec_ctx);
 
 	/* we can't do unix security without a user and group */
@@ -110,29 +112,53 @@ static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	status = sidmap_sid_to_unixuid(private->sidmap, 
-				       token->user_sid, &(*sec)->uid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
+	ids = talloc_array(req, struct id_mapping, token->num_sids);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
 
-	status = sidmap_sid_to_unixgid(private->sidmap, 
-				       token->group_sid, &(*sec)->gid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
+	ids[0].unixid = NULL;
+	ids[0].sid = token->user_sid;
+	ids[0].status = NT_STATUS_NONE_MAPPED;
+
+	ids[1].unixid = NULL;
+	ids[1].sid = token->group_sid;
+	ids[1].status = NT_STATUS_NONE_MAPPED;
 
 	(*sec)->ngroups = token->num_sids - 2;
 	(*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
-	if ((*sec)->groups == NULL) {
-		return NT_STATUS_NO_MEMORY;
+	NT_STATUS_HAVE_NO_MEMORY((*sec)->groups);
+
+	for (i=0;i<(*sec)->ngroups;i++) {
+		ids[i+2].unixid = NULL;
+		ids[i+2].sid = token->sids[i+2];
+		ids[i+2].status = NT_STATUS_NONE_MAPPED;
+	}
+
+	ctx = wbc_sids_to_xids_send(priv->wbc_ctx, ids, token->num_sids, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_sids_to_xids_recv(ctx, &ids);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	if (ids[0].unixid->type == ID_TYPE_BOTH ||
+	    ids[0].unixid->type == ID_TYPE_UID) {
+		(*sec)->uid = ids[0].unixid->id;
+	} else {
+		return NT_STATUS_INVALID_SID;
+	}
+
+	if (ids[1].unixid->type == ID_TYPE_BOTH ||
+	    ids[1].unixid->type == ID_TYPE_GID) {
+		(*sec)->gid = ids[1].unixid->id;
+	} else {
+		return NT_STATUS_INVALID_SID;
 	}
 
 	for (i=0;i<(*sec)->ngroups;i++) {
-		status = sidmap_sid_to_unixgid(private->sidmap, 
-					       token->sids[i+2], &(*sec)->groups[i]);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
+		if (ids[i+2].unixid->type == ID_TYPE_BOTH ||
+		    ids[i+2].unixid->type == ID_TYPE_GID) {
+			(*sec)->groups[i] = ids[i+2].unixid->id;
+		} else {
+			return NT_STATUS_INVALID_SID;
 		}
 	}
 
@@ -216,9 +242,11 @@ static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	private->sidmap = sidmap_open(private, ntvfs->ctx->lp_ctx);
-	if (private->sidmap == NULL) {
-		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	private->wbc_ctx = wbc_init(private, ntvfs->ctx->msg_ctx,
+				    ntvfs->ctx->event_ctx);
+	if (private->wbc_ctx == NULL) {
+		talloc_free(private);
+		return NT_STATUS_INTERNAL_ERROR;
 	}
 
 	ntvfs->private_data = private;
diff --git a/source4/param/README b/source4/param/README
new file mode 100644
index 0000000000..403a217588
--- /dev/null
+++ b/source4/param/README
@@ -0,0 +1,4 @@
+This directory contains "libsamba-hostconfig". 
+
+The libsamba-hostconfig library provides access to all host-wide configuration
+such as the configured shares, default parameter values and host secret keys.
diff --git a/source4/param/config.mk b/source4/param/config.mk
index 4b5af9b6cb..bc8f7a5dc7 100644
--- a/source4/param/config.mk
+++ b/source4/param/config.mk
@@ -1,4 +1,6 @@
-[SUBSYSTEM::LIBSAMBA-CONFIG]
+[LIBRARY::LIBSAMBA-HOSTCONFIG]
+VERSION = 0.0.1
+SO_VERSION = 1
 PUBLIC_DEPENDENCIES = LIBSAMBA-UTIL 
 PRIVATE_DEPENDENCIES = DYNCONFIG LIBREPLACE_EXT CHARSET
 PRIVATE_PROTO_HEADER = proto.h
@@ -11,6 +13,8 @@ LIBSAMBA-CONFIG_OBJ_FILES = param/loadparm.o \
 
 PUBLIC_HEADERS += param/param.h
 
+PC_FILES += param/samba-hostconfig.pc
+
 #################################
 # Start SUBSYSTEM share
 [SUBSYSTEM::share]
@@ -52,6 +56,6 @@ SECRETS_OBJ_FILES = param/secrets.o
 
 [PYTHON::param]
 SWIG_FILE = param.i
-PRIVATE_DEPENDENCIES = LIBSAMBA-CONFIG
+PRIVATE_DEPENDENCIES = LIBSAMBA-HOSTCONFIG
 
 param_OBJ_FILES = param/param_wrap.o
diff --git a/source4/param/param.h b/source4/param/param.h
index 84f864edaa..0b276cdff2 100644
--- a/source4/param/param.h
+++ b/source4/param/param.h
@@ -61,8 +61,367 @@ struct loadparm_context;
 struct loadparm_service;
 struct smbcli_options;
 
-#include "param/proto.h"
+void reload_charcnv(struct loadparm_context *lp_ctx);
 
 extern struct loadparm_context *global_loadparm;
 
+struct loadparm_service *lp_default_service(struct loadparm_context *lp_ctx);
+struct parm_struct *lp_parm_table(void);
+int lp_server_role(struct loadparm_context *);
+const char **lp_smb_ports(struct loadparm_context *);
+int lp_nbt_port(struct loadparm_context *);
+int lp_dgram_port(struct loadparm_context *);
+int lp_cldap_port(struct loadparm_context *);
+int lp_krb5_port(struct loadparm_context *);
+int lp_kpasswd_port(struct loadparm_context *);
+int lp_web_port(struct loadparm_context *);
+const char *lp_swat_directory(struct loadparm_context *);
+bool lp_tls_enabled(struct loadparm_context *);
+const char *lp_tls_keyfile(struct loadparm_context *);
+const char *lp_tls_certfile(struct loadparm_context *);
+const char *lp_tls_cafile(struct loadparm_context *);
+const char *lp_tls_crlfile(struct loadparm_context *);
+const char *lp_tls_dhpfile(struct loadparm_context *);
+const char *lp_share_backend(struct loadparm_context *);
+const char *lp_sam_url(struct loadparm_context *);
+const char *lp_idmap_url(struct loadparm_context *);
+const char *lp_secrets_url(struct loadparm_context *);
+const char *lp_spoolss_url(struct loadparm_context *);
+const char *lp_wins_config_url(struct loadparm_context *);
+const char *lp_wins_url(struct loadparm_context *);
+const char *lp_winbind_separator(struct loadparm_context *);
+const char *lp_winbindd_socket_directory(struct loadparm_context *);
+const char *lp_template_shell(struct loadparm_context *);
+const char *lp_template_homedir(struct loadparm_context *);
+bool lp_winbind_sealed_pipes(struct loadparm_context *);
+bool lp_idmap_trusted_only(struct loadparm_context *);
+const char *lp_private_dir(struct loadparm_context *);
+const char *lp_serverstring(struct loadparm_context *);
+const char *lp_lockdir(struct loadparm_context *);
+const char *lp_modulesdir(struct loadparm_context *);
+const char *lp_setupdir(struct loadparm_context *);
+const char *lp_ncalrpc_dir(struct loadparm_context *);
+const char *lp_dos_charset(struct loadparm_context *);
+const char *lp_unix_charset(struct loadparm_context *);
+const char *lp_display_charset(struct loadparm_context *);
+const char *lp_piddir(struct loadparm_context *);
+const char **lp_dcerpc_endpoint_servers(struct loadparm_context *);
+const char **lp_server_services(struct loadparm_context *);
+const char *lp_ntptr_providor(struct loadparm_context *);
+const char *lp_auto_services(struct loadparm_context *);
+const char *lp_passwd_chat(struct loadparm_context *);
+const char **lp_passwordserver(struct loadparm_context *);
+const char **lp_name_resolve_order(struct loadparm_context *);
+const char *lp_realm(struct loadparm_context *);
+const char *lp_socket_options(struct loadparm_context *);
+const char *lp_workgroup(struct loadparm_context *);
+const char *lp_netbios_name(struct loadparm_context *);
+const char *lp_netbios_scope(struct loadparm_context *);
+const char **lp_wins_server_list(struct loadparm_context *);
+const char **lp_interfaces(struct loadparm_context *);
+const char *lp_socket_address(struct loadparm_context *);
+const char **lp_netbios_aliases(struct loadparm_context *);
+bool lp_disable_netbios(struct loadparm_context *);
+bool lp_wins_support(struct loadparm_context *);
+bool lp_wins_dns_proxy(struct loadparm_context *);
+const char *lp_wins_hook(struct loadparm_context *);
+bool lp_local_master(struct loadparm_context *);
+bool lp_readraw(struct loadparm_context *);
+bool lp_large_readwrite(struct loadparm_context *);
+bool lp_writeraw(struct loadparm_context *);
+bool lp_null_passwords(struct loadparm_context *);
+bool lp_obey_pam_restrictions(struct loadparm_context *);
+bool lp_encrypted_passwords(struct loadparm_context *);
+bool lp_time_server(struct loadparm_context *);
+bool lp_bind_interfaces_only(struct loadparm_context *);
+bool lp_unicode(struct loadparm_context *);
+bool lp_nt_status_support(struct loadparm_context *);
+bool lp_lanman_auth(struct loadparm_context *);
+bool lp_ntlm_auth(struct loadparm_context *);
+bool lp_client_plaintext_auth(struct loadparm_context *);
+bool lp_client_lanman_auth(struct loadparm_context *);
+bool lp_client_ntlmv2_auth(struct loadparm_context *);
+bool lp_client_use_spnego_principal(struct loadparm_context *);
+bool lp_host_msdfs(struct loadparm_context *);
+bool lp_unix_extensions(struct loadparm_context *);
+bool lp_use_spnego(struct loadparm_context *);
+bool lp_rpc_big_endian(struct loadparm_context *);
+int lp_max_wins_ttl(struct loadparm_context *);
+int lp_min_wins_ttl(struct loadparm_context *);
+int lp_maxmux(struct loadparm_context *);
+int lp_max_xmit(struct loadparm_context *);
+int lp_passwordlevel(struct loadparm_context *);
+int lp_srv_maxprotocol(struct loadparm_context *);
+int lp_srv_minprotocol(struct loadparm_context *);
+int lp_cli_maxprotocol(struct loadparm_context *);
+int lp_cli_minprotocol(struct loadparm_context *);
+int lp_security(struct loadparm_context *);
+bool lp_paranoid_server_security(struct loadparm_context *);
+int lp_announce_as(struct loadparm_context *);
+const char **lp_js_include(struct loadparm_context *);
+
+const char *lp_servicename(const struct loadparm_service *service);
+const char *lp_pathname(struct loadparm_service *, struct loadparm_service *);
+const char **lp_hostsallow(struct loadparm_service *, struct loadparm_service *);
+const char **lp_hostsdeny(struct loadparm_service *, struct loadparm_service *);
+const char *lp_comment(struct loadparm_service *, struct loadparm_service *);
+const char *lp_fstype(struct loadparm_service *, struct loadparm_service *);
+const char **lp_ntvfs_handler(struct loadparm_service *, struct loadparm_service *);
+bool lp_msdfs_root(struct loadparm_service *, struct loadparm_service *);
+bool lp_browseable(struct loadparm_service *, struct loadparm_service *);
+bool lp_readonly(struct loadparm_service *, struct loadparm_service *);
+bool lp_print_ok(struct loadparm_service *, struct loadparm_service *);
+bool lp_map_hidden(struct loadparm_service *, struct loadparm_service *);
+bool lp_map_archive(struct loadparm_service *, struct loadparm_service *);
+bool lp_strict_locking(struct loadparm_service *, struct loadparm_service *);
+bool lp_oplocks(struct loadparm_service *, struct loadparm_service *);
+bool lp_strict_sync(struct loadparm_service *, struct loadparm_service *);
+bool lp_ci_filesystem(struct loadparm_service *, struct loadparm_service *);
+bool lp_map_system(struct loadparm_service *, struct loadparm_service *);
+int lp_max_connections(struct loadparm_service *, struct loadparm_service *);
+int lp_csc_policy(struct loadparm_service *, struct loadparm_service *);
+int lp_create_mask(struct loadparm_service *, struct loadparm_service *);
+int lp_force_create_mode(struct loadparm_service *, struct loadparm_service *);
+int lp_dir_mask(struct loadparm_service *, struct loadparm_service *);
+int lp_force_dir_mode(struct loadparm_service *, struct loadparm_service *);
+int lp_server_signing(struct loadparm_context *);
+int lp_client_signing(struct loadparm_context *);
+const char *lp_get_parametric(struct loadparm_context *lp_ctx,
+			      struct loadparm_service *service,
+			      const char *type, const char *option);
+
+const char *lp_parm_string(struct loadparm_context *lp_ctx,
+			   struct loadparm_service *service, const char *type,
+			   const char *option);
+const char **lp_parm_string_list(TALLOC_CTX *mem_ctx,
+				 struct loadparm_context *lp_ctx,
+				 struct loadparm_service *service,
+				 const char *type,
+				 const char *option, const char *separator);
+int lp_parm_int(struct loadparm_context *lp_ctx,
+		struct loadparm_service *service, const char *type,
+		const char *option, int default_v);
+int lp_parm_bytes(struct loadparm_context *lp_ctx,
+		  struct loadparm_service *service, const char *type,
+		  const char *option, int default_v);
+unsigned long lp_parm_ulong(struct loadparm_context *lp_ctx,
+			    struct loadparm_service *service, const char *type,
+			    const char *option, unsigned long default_v);
+double lp_parm_double(struct loadparm_context *lp_ctx,
+		      struct loadparm_service *service, const char *type,
+		      const char *option, double default_v);
+bool lp_parm_bool(struct loadparm_context *lp_ctx,
+		  struct loadparm_service *service, const char *type,
+		  const char *option, bool default_v);
+struct loadparm_service *lp_add_service(struct loadparm_context *lp_ctx,
+				     const struct loadparm_service *pservice,
+				     const char *name);
+bool lp_add_home(struct loadparm_context *lp_ctx,
+		 const char *pszHomename,
+		 struct loadparm_service *default_service,
+		 const char *user, const char *pszHomedir);
+bool lp_add_printer(struct loadparm_context *lp_ctx,
+		    const char *pszPrintername,
+		    struct loadparm_service *default_service);
+struct parm_struct *lp_parm_struct(const char *name);
+void *lp_parm_ptr(struct loadparm_context *lp_ctx,
+		  struct loadparm_service *service, struct parm_struct *parm);
+bool lp_file_list_changed(struct loadparm_context *lp_ctx);
+
+bool lp_do_global_parameter(struct loadparm_context *lp_ctx,
+			    const char *pszParmName, const char *pszParmValue);
+bool lp_do_service_parameter(struct loadparm_context *lp_ctx,
+			     struct loadparm_service *service,
+			     const char *pszParmName, const char *pszParmValue);
+
+/**
+ * Process a parameter.
+ */
+bool lp_do_global_parameter_var(struct loadparm_context *lp_ctx,
+				const char *pszParmName, const char *fmt, ...);
+bool lp_set_cmdline(struct loadparm_context *lp_ctx, const char *pszParmName,
+		    const char *pszParmValue);
+bool lp_set_option(struct loadparm_context *lp_ctx, const char *option);
+
+/**
+ * Display the contents of a single services record.
+ */
+bool lp_dump_a_parameter(struct loadparm_context *lp_ctx,
+			 struct loadparm_service *service,
+			 const char *parm_name, FILE * f);
+
+/**
+ * Return info about the next service  in a service. snum==-1 gives the globals.
+ * Return NULL when out of parameters.
+ */
+struct parm_struct *lp_next_parameter(struct loadparm_context *lp_ctx, int snum, int *i, 
+				      int allparameters);
+
+/**
+ * Unload unused services.
+ */
+void lp_killunused(struct loadparm_context *lp_ctx,
+		   struct smbsrv_connection *smb,
+		   bool (*snumused) (struct smbsrv_connection *, int));
+
+/**
+ * Initialise the global parameter structure.
+ */
+struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx);
+const char *lp_configfile(struct loadparm_context *lp_ctx);
+bool lp_load_default(struct loadparm_context *lp_ctx);
+
+/**
+ * Load the services array from the services file.
+ *
+ * Return True on success, False on failure.
+ */
+bool lp_load(struct loadparm_context *lp_ctx, const char *filename);
+
+/**
+ * Return the max number of services.
+ */
+int lp_numservices(struct loadparm_context *lp_ctx);
+
+/**
+ * Display the contents of the services array in human-readable form.
+ */
+void lp_dump(struct loadparm_context *lp_ctx, FILE *f, bool show_defaults,
+	     int maxtoprint);
+
+/**
+ * Display the contents of one service in human-readable form.
+ */
+void lp_dump_one(FILE *f, bool show_defaults, struct loadparm_service *service, struct loadparm_service *sDefault);
+struct loadparm_service *lp_servicebynum(struct loadparm_context *lp_ctx,
+					 int snum);
+struct loadparm_service *lp_service(struct loadparm_context *lp_ctx,
+				    const char *service_name);
+
+/**
+ * A useful volume label function.
+ */
+const char *volume_label(struct loadparm_service *service, struct loadparm_service *sDefault);
+
+/**
+ * If we are PDC then prefer us as DMB
+ */
+const char *lp_printername(struct loadparm_service *service, struct loadparm_service *sDefault);
+
+/**
+ * Return the max print jobs per queue.
+ */
+int lp_maxprintjobs(struct loadparm_service *service, struct loadparm_service *sDefault);
+struct smb_iconv_convenience *lp_iconv_convenience(struct loadparm_context *lp_ctx);
+void lp_smbcli_options(struct loadparm_context *lp_ctx,
+			 struct smbcli_options *options);
+
+/* The following definitions come from param/generic.c  */
+
+struct param_section *param_get_section(struct param_context *ctx, const char *name);
+struct param_opt *param_section_get(struct param_section *section, 
+				    const char *name);
+struct param_opt *param_get (struct param_context *ctx, const char *name, const char *section_name);
+struct param_section *param_add_section(struct param_context *ctx, const char *section_name);
+struct param_opt *param_get_add(struct param_context *ctx, const char *name, const char *section_name);
+const char *param_get_string(struct param_context *ctx, const char *param, const char *section);
+int param_set_string(struct param_context *ctx, const char *param, const char *value, const char *section);
+const char **param_get_string_list(struct param_context *ctx, const char *param, const char *separator, const char *section);
+int param_set_string_list(struct param_context *ctx, const char *param, const char **list, const char *section);
+int param_get_int(struct param_context *ctx, const char *param, int default_v, const char *section);
+void param_set_int(struct param_context *ctx, const char *param, int value, const char *section);
+unsigned long param_get_ulong(struct param_context *ctx, const char *param, unsigned long default_v, const char *section);
+void param_set_ulong(struct param_context *ctx, const char *name, unsigned long value, const char *section);
+struct param_context *param_init(TALLOC_CTX *mem_ctx);
+int param_read(struct param_context *ctx, const char *fn);
+int param_use(struct loadparm_context *lp_ctx, struct param_context *ctx);
+int param_write(struct param_context *ctx, const char *fn);
+
+/* The following definitions come from param/util.c  */
+
+
+/**
+ * @file
+ * @brief Misc utility functions
+ */
+bool lp_is_mydomain(struct loadparm_context *lp_ctx, 
+			     const char *domain);
+
+/**
+  see if a string matches either our primary or one of our secondary 
+  netbios aliases. do a case insensitive match
+*/
+bool lp_is_myname(struct loadparm_context *lp_ctx, const char *name);
+
+/**
+ A useful function for returning a path in the Samba lock directory.
+**/
+char *lock_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
+			 const char *name);
+
+/**
+ * @brief Returns an absolute path to a file in the directory containing the current config file
+ *
+ * @param name File to find, relative to the config file directory.
+ *
+ * @retval Pointer to a talloc'ed string containing the full path.
+ **/
+char *config_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
+			   const char *name);
+
+/**
+ * @brief Returns an absolute path to a file in the Samba private directory.
+ *
+ * @param name File to find, relative to PRIVATEDIR.
+ * if name is not relative, then use it as-is
+ *
+ * @retval Pointer to a talloc'ed string containing the full path.
+ **/
+char *private_path(TALLOC_CTX* mem_ctx, 
+			    struct loadparm_context *lp_ctx,
+			    const char *name);
+
+/**
+  return a path in the smbd.tmp directory, where all temporary file
+  for smbd go. If NULL is passed for name then return the directory 
+  path itself
+*/
+char *smbd_tmp_path(TALLOC_CTX *mem_ctx, 
+			     struct loadparm_context *lp_ctx, 
+			     const char *name);
+
+/**
+ * Obtain the init function from a shared library file
+ */
+init_module_fn load_module(TALLOC_CTX *mem_ctx, const char *path);
+
+/**
+ * Obtain list of init functions from the modules in the specified
+ * directory
+ */
+init_module_fn *load_modules(TALLOC_CTX *mem_ctx, const char *path);
+
+/**
+ * Run the specified init functions.
+ *
+ * @return true if all functions ran successfully, false otherwise
+ */
+bool run_init_functions(init_module_fn *fns);
+
+/**
+ * Load the initialization functions from DSO files for a specific subsystem.
+ *
+ * Will return an array of function pointers to initialization functions
+ */
+init_module_fn *load_samba_modules(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, const char *subsystem);
+const char *lp_messaging_path(TALLOC_CTX *mem_ctx, 
+				       struct loadparm_context *lp_ctx);
+struct smb_iconv_convenience *smb_iconv_convenience_init_lp(TALLOC_CTX *mem_ctx,
+							 struct loadparm_context *lp_ctx);
+
+/* The following definitions come from lib/version.c  */
+
+const char *samba_version_string(void);
+
+
 #endif /* _PARAM_H */
diff --git a/source4/param/samba-config.pc.in b/source4/param/samba-hostconfig.pc.in
index 801f6aeda4..b8ba24096d 100644
--- a/source4/param/samba-config.pc.in
+++ b/source4/param/samba-hostconfig.pc.in
@@ -3,8 +3,8 @@ exec_prefix=@exec_prefix@
 libdir=@libdir@
 includedir=@includedir@
 
-Name: samba-config
-Description: Reading Samba configuration files
+Name: samba-hostconfig
+Description: Host-wide Samba configuration
 Version: 0.0.1
-Libs: -L${libdir} -lsamba-config 
+Libs: -L${libdir} -lsamba-hostconfig 
 Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/param/secrets.c b/source4/param/secrets.c
index bc4327188a..06dc850c8e 100644
--- a/source4/param/secrets.c
+++ b/source4/param/secrets.c
@@ -32,8 +32,6 @@
 #include "lib/util/util_ldb.h"
 #include "librpc/gen_ndr/ndr_security.h"
 
-static struct tdb_wrap *tdb;
-
 /**
  * Use a TDB to store an incrementing random seed.
  *
@@ -42,42 +40,31 @@ static struct tdb_wrap *tdb;
  * 
  * @note Not called by systems with a working /dev/urandom.
  */
-static void get_rand_seed(int *new_seed) 
+static void get_rand_seed(struct tdb_wrap *secretsdb, int *new_seed) 
 {
 	*new_seed = getpid();
-	if (tdb != NULL) {
-		tdb_change_int32_atomic(tdb->tdb, "INFO/random_seed", new_seed, 1);
+	if (secretsdb != NULL) {
+		tdb_change_int32_atomic(secretsdb->tdb, "INFO/random_seed", new_seed, 1);
 	}
 }
 
 /**
- * close the secrets database
- */
-void secrets_shutdown(void)
-{
-       talloc_free(tdb);
-}
-
-/**
  * open up the secrets database
  */
-bool secrets_init(struct loadparm_context *lp_ctx)
+struct tdb_wrap *secrets_init(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
 	char *fname;
 	uint8_t dummy;
+	struct tdb_wrap *tdb;
 
-	if (tdb != NULL)
-		return true;
+	fname = private_path(mem_ctx, lp_ctx, "secrets.tdb");
 
-	fname = private_path(NULL, lp_ctx, "secrets.tdb");
-
-	tdb = tdb_wrap_open(talloc_autofree_context(), fname, 0, TDB_DEFAULT, 
-						O_RDWR|O_CREAT, 0600);
+	tdb = tdb_wrap_open(mem_ctx, fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
 
 	if (!tdb) {
 		DEBUG(0,("Failed to open %s\n", fname));
 		talloc_free(fname);
-		return false;
+		return NULL;
 	}
 	talloc_free(fname);
 
@@ -87,12 +74,12 @@ bool secrets_init(struct loadparm_context *lp_ctx)
 	 * This avoids a problem where systems without /dev/urandom
 	 * could send the same challenge to multiple clients
 	 */
-	set_rand_reseed_callback(get_rand_seed);
+	set_rand_reseed_callback((void (*) (void *, int *))get_rand_seed, tdb);
 
 	/* Ensure that the reseed is done now, while we are root, etc */
 	generate_random_buffer(&dummy, sizeof(dummy));
 
-	return true;
+	return tdb;
 }
 
 /**
diff --git a/source4/param/secrets.h b/source4/param/secrets.h
index 4a9eb25e7e..bd6ff4a401 100644
--- a/source4/param/secrets.h
+++ b/source4/param/secrets.h
@@ -43,8 +43,7 @@ struct machine_acct_pass {
  * @note Not called by systems with a working /dev/urandom.
  */
 struct loadparm_context;
-void secrets_shutdown(void);
-bool secrets_init(struct loadparm_context *lp_ctx);
+struct tdb_wrap *secrets_init(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
 struct ldb_context *secrets_db_connect(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
 struct dom_sid *secrets_get_domain_sid(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, const char *domain);
 
diff --git a/source4/param/util.c b/source4/param/util.c
index 1cf05d4fa7..2baaefda8b 100644
--- a/source4/param/util.c
+++ b/source4/param/util.c
@@ -35,7 +35,7 @@
  */
 
 
-_PUBLIC_ bool lp_is_mydomain(struct loadparm_context *lp_ctx, 
+bool lp_is_mydomain(struct loadparm_context *lp_ctx, 
 			     const char *domain)
 {
 	return strequal(lp_workgroup(lp_ctx), domain);
@@ -45,7 +45,7 @@ _PUBLIC_ bool lp_is_mydomain(struct loadparm_context *lp_ctx,
   see if a string matches either our primary or one of our secondary 
   netbios aliases. do a case insensitive match
 */
-_PUBLIC_ bool lp_is_myname(struct loadparm_context *lp_ctx, const char *name)
+bool lp_is_myname(struct loadparm_context *lp_ctx, const char *name)
 {
 	const char **aliases;
 	int i;
@@ -68,7 +68,7 @@ _PUBLIC_ bool lp_is_myname(struct loadparm_context *lp_ctx, const char *name)
 /**
  A useful function for returning a path in the Samba lock directory.
 **/
-_PUBLIC_ char *lock_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
+char *lock_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
 			 const char *name)
 {
 	char *fname, *dname;
@@ -101,7 +101,7 @@ _PUBLIC_ char *lock_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
  * @retval Pointer to a talloc'ed string containing the full path.
  **/
 
-_PUBLIC_ char *config_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
+char *config_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
 			   const char *name)
 {
 	char *fname, *config_dir, *p;
@@ -127,7 +127,7 @@ _PUBLIC_ char *config_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
  *
  * @retval Pointer to a talloc'ed string containing the full path.
  **/
-_PUBLIC_ char *private_path(TALLOC_CTX* mem_ctx, 
+char *private_path(TALLOC_CTX* mem_ctx, 
 			    struct loadparm_context *lp_ctx,
 			    const char *name)
 {
@@ -147,7 +147,7 @@ _PUBLIC_ char *private_path(TALLOC_CTX* mem_ctx,
   for smbd go. If NULL is passed for name then return the directory 
   path itself
 */
-_PUBLIC_ char *smbd_tmp_path(TALLOC_CTX *mem_ctx, 
+char *smbd_tmp_path(TALLOC_CTX *mem_ctx, 
 			     struct loadparm_context *lp_ctx, 
 			     const char *name)
 {
@@ -171,7 +171,7 @@ _PUBLIC_ char *smbd_tmp_path(TALLOC_CTX *mem_ctx,
 /**
  * Obtain the init function from a shared library file
  */
-_PUBLIC_ init_module_fn load_module(TALLOC_CTX *mem_ctx, const char *path)
+init_module_fn load_module(TALLOC_CTX *mem_ctx, const char *path)
 {
 	void *handle;
 	void *init_fn;
@@ -198,7 +198,7 @@ _PUBLIC_ init_module_fn load_module(TALLOC_CTX *mem_ctx, const char *path)
  * Obtain list of init functions from the modules in the specified
  * directory
  */
-_PUBLIC_ init_module_fn *load_modules(TALLOC_CTX *mem_ctx, const char *path)
+init_module_fn *load_modules(TALLOC_CTX *mem_ctx, const char *path)
 {
 	DIR *dir;
 	struct dirent *entry;
@@ -240,7 +240,7 @@ _PUBLIC_ init_module_fn *load_modules(TALLOC_CTX *mem_ctx, const char *path)
  *
  * @return true if all functions ran successfully, false otherwise
  */
-_PUBLIC_ bool run_init_functions(init_module_fn *fns)
+bool run_init_functions(init_module_fn *fns)
 {
 	int i;
 	bool ret = true;
@@ -268,7 +268,7 @@ static char *modules_path(TALLOC_CTX* mem_ctx, struct loadparm_context *lp_ctx,
  * Will return an array of function pointers to initialization functions
  */
 
-_PUBLIC_ init_module_fn *load_samba_modules(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, const char *subsystem)
+init_module_fn *load_samba_modules(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, const char *subsystem)
 {
 	char *path = modules_path(mem_ctx, lp_ctx, subsystem);
 	init_module_fn *ret;
@@ -280,7 +280,7 @@ _PUBLIC_ init_module_fn *load_samba_modules(TALLOC_CTX *mem_ctx, struct loadparm
 	return ret;
 }
 
-_PUBLIC_ const char *lp_messaging_path(TALLOC_CTX *mem_ctx, 
+const char *lp_messaging_path(TALLOC_CTX *mem_ctx, 
 				       struct loadparm_context *lp_ctx)
 {
 	return smbd_tmp_path(mem_ctx, lp_ctx, "messaging");
diff --git a/source4/pidl/config.m4 b/source4/pidl/config.m4
new file mode 100644
index 0000000000..8b8bc5acf0
--- /dev/null
+++ b/source4/pidl/config.m4
@@ -0,0 +1,9 @@
+# Check whether ExtUtils::ExtMaker is available
+
+if perl -e "use ExtUtils::MakeMaker" 2>/dev/null; then
+	HAVE_PERL_EXTUTILS_MAKEMAKER=1
+else
+	HAVE_PERL_EXTUTILS_MAKEMAKER=0
+fi
+
+AC_SUBST(HAVE_PERL_EXTUTILS_MAKEMAKER)
diff --git a/source4/pidl/config.mk b/source4/pidl/config.mk
index 3793008319..0d36473ade 100644
--- a/source4/pidl/config.mk
+++ b/source4/pidl/config.mk
@@ -5,10 +5,11 @@ pidl-testcov: pidl/Makefile
 	cd pidl && cover -test
 
 installpidl:: pidl/Makefile
-	$(MAKE) -C pidl install
+	$(MAKE) -C pidl install_vendor PREFIX=$(prefix)
 
-uninstallpidl:: pidl/Makefile
-	$(MAKE) -C pidl uninstall
+ifeq ($(HAVE_PERL_EXTUTILS_MAKEMAKER),1)
+install:: installpidl
+endif
 
 idl_full:: pidl/lib/Parse/Pidl/IDL.pm pidl/lib/Parse/Pidl/Expr.pm 
 	@CPP="$(CPP)" PERL="$(PERL)" srcdir=$(srcdir) $(srcdir)/script/build_idl.sh FULL
diff --git a/source4/pidl/idl.yp b/source4/pidl/idl.yp
index c7ca0c7604..a0323af8ee 100644
--- a/source4/pidl/idl.yp
+++ b/source4/pidl/idl.yp
@@ -1,7 +1,7 @@
 ########################
 # IDL Parse::Yapp parser
 # Copyright (C) Andrew Tridgell <tridge@samba.org>
-# released under the GNU GPL version 2 or later
+# released under the GNU GPL version 3 or later
 
 
 
diff --git a/source4/pidl/lib/Parse/Pidl/NDR.pm b/source4/pidl/lib/Parse/Pidl/NDR.pm
index 86ed1a8d10..33e5ad3196 100644
--- a/source4/pidl/lib/Parse/Pidl/NDR.pm
+++ b/source4/pidl/lib/Parse/Pidl/NDR.pm
@@ -866,6 +866,7 @@ my %property_list = (
 	"nosize"		=> ["FUNCTION", "TYPEDEF"],
 	"noprint"		=> ["FUNCTION", "TYPEDEF"],
 	"noejs"			=> ["FUNCTION", "TYPEDEF"],
+	"todo"			=> ["FUNCTION"],
 
 	# union
 	"switch_is"		=> ["ELEMENT"],
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index a959dc84f6..0d1806a0fa 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -2190,6 +2190,26 @@ sub ParseFunctionPull($$)
 	$self->pidl("");
 }
 
+sub AuthServiceStruct($$$)
+{
+	my ($self, $ifacename, $authservice) = @_;
+	my @a = split /,/, $authservice;
+	my $authservice_count = $#a + 1;
+
+	$self->pidl("static const char * const $ifacename\_authservice_strings[] = {");
+	foreach my $ap (@a) {
+		$self->pidl("\t$ap, ");
+	}
+	$self->pidl("};");
+	$self->pidl("");
+
+	$self->pidl("static const struct ndr_interface_string_array $ifacename\_authservices = {");
+	$self->pidl("\t.count\t= $authservice_count,");
+	$self->pidl("\t.names\t= $ifacename\_authservice_strings");
+	$self->pidl("};");
+	$self->pidl("");
+}
+
 #####################################################################
 # produce a function call table
 sub FunctionTable($$)
@@ -2237,21 +2257,8 @@ sub FunctionTable($$)
 		$interface->{PROPERTIES}->{authservice} = "\"host\"";
 	}
 
-	my @a = split /,/, $interface->{PROPERTIES}->{authservice};
-	my $authservice_count = $#a + 1;
-
-	$self->pidl("static const char * const $interface->{NAME}\_authservice_strings[] = {");
-	foreach my $ap (@a) {
-		$self->pidl("\t$ap, ");
-	}
-	$self->pidl("};");
-	$self->pidl("");
-
-	$self->pidl("static const struct ndr_interface_string_array $interface->{NAME}\_authservices = {");
-	$self->pidl("\t.count\t= $endpoint_count,");
-	$self->pidl("\t.names\t= $interface->{NAME}\_authservice_strings");
-	$self->pidl("};");
-	$self->pidl("");
+	$self->AuthServiceStruct($interface->{NAME}, 
+		                     $interface->{PROPERTIES}->{authservice});
 
 	$self->pidl("\nconst struct ndr_interface_table ndr_table_$interface->{NAME} = {");
 	$self->pidl("\t.name\t\t= \"$interface->{NAME}\",");
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/Python.pm b/source4/pidl/lib/Parse/Pidl/Samba4/Python.pm
index 2475925377..c04324e992 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/Python.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/Python.pm
@@ -21,7 +21,7 @@ $VERSION = '0.01';
 sub new($) {
 	my ($class) = @_;
 	my $self = { res => "", res_hdr => "", tabs => "", constants => {},
-	             module_methods => []};
+	             module_methods => [], module_objects => [], module_types => []};
 	bless($self, $class);
 }
 
@@ -163,46 +163,35 @@ sub FromPythonToUnionFunction($$$$$)
 	$self->pidl("return ret;");
 }
 
-sub PythonStruct($$$$)
+sub PythonStruct($$$$$$)
 {
-	my ($self, $name, $cname, $d) = @_;
+	my ($self, $modulename, $prettyname, $name, $cname, $d) = @_;
 
 	my $env = GenerateStructEnv($d, "object");
 
 	$self->pidl("");
 
-	$self->pidl("static PyObject *py_$name\_getattr(PyObject *obj, char *name)");
-	$self->pidl("{");
-	$self->indent;
+	my $getsetters = "NULL";
+
 	if ($#{$d->{ELEMENTS}} > -1) {
-		$self->pidl("$cname *object = py_talloc_get_ptr(obj);");
 		foreach my $e (@{$d->{ELEMENTS}}) {
-			$self->pidl("if (!strcmp(name, \"$e->{NAME}\")) {");
 			my $varname = "object->$e->{NAME}";
+			$self->pidl("static PyObject *py_$name\_get_$e->{NAME}(PyObject *obj, void *closure)");
+			$self->pidl("{");
 			$self->indent;
+			$self->pidl("$cname *object = py_talloc_get_ptr(obj);");
 			$self->pidl("PyObject *py_$e->{NAME};");
 			$self->ConvertObjectToPython("py_talloc_get_mem_ctx(obj)", $env, $e, $varname, "py_$e->{NAME}");
 			$self->pidl("return py_$e->{NAME};");
 			$self->deindent;
 			$self->pidl("}");
-		}
-	}
-	$self->pidl("PyErr_SetString(PyExc_AttributeError, \"no such attribute\");");
-	$self->pidl("return NULL;");
-	$self->deindent;
-	$self->pidl("}");
-	$self->pidl("");
+			$self->pidl("");
 
-	$self->pidl("static int py_$name\_setattr(PyObject *py_obj, char *name, PyObject *value)");
-	$self->pidl("{");
-	$self->indent;
-	if ($#{$d->{ELEMENTS}} > -1) {
-		$self->pidl("$cname *object = py_talloc_get_ptr(py_obj);");
-		my $mem_ctx = "py_talloc_get_mem_ctx(py_obj)";
-		foreach my $e (@{$d->{ELEMENTS}}) {
-			$self->pidl("if (!strcmp(name, \"$e->{NAME}\")) {");
-			my $varname = "object->$e->{NAME}";
+			$self->pidl("static int py_$name\_set_$e->{NAME}(PyObject *py_obj, PyObject *value, void *closure)");
+			$self->pidl("{");
 			$self->indent;
+			$self->pidl("$cname *object = py_talloc_get_ptr(py_obj);");
+			my $mem_ctx = "py_talloc_get_mem_ctx(py_obj)";
 			my $l = $e->{LEVELS}[0];
 			my $nl = GetNextLevel($e, $l);
 			if ($l->{TYPE} eq "POINTER" and 
@@ -214,52 +203,60 @@ sub PythonStruct($$$$)
 			$self->pidl("return 0;");
 			$self->deindent;
 			$self->pidl("}");
+		$self->pidl("");
+		}
+
+		$getsetters = "py_$name\_getsetters";
+		$self->pidl("static PyGetSetDef ".$getsetters."[] = {");
+		$self->indent;
+		foreach my $e (@{$d->{ELEMENTS}}) {
+			$self->pidl("{ discard_const_p(char, \"$e->{NAME}\"), py_$name\_get_$e->{NAME}, py_$name\_set_$e->{NAME} },");
 		}
+		$self->pidl("{ NULL }");
+		$self->deindent;
+		$self->pidl("};");
+		$self->pidl("");
 	}
-	$self->pidl("PyErr_SetString(PyExc_AttributeError, \"no such attribute\");");
-	$self->pidl("return -1;");
+
+	$self->pidl("static PyObject *py_$name\_new(PyTypeObject *self, PyObject *args, PyObject *kwargs)");
+	$self->pidl("{");
+	$self->indent;
+	$self->pidl("$cname *ret = talloc_zero(NULL, $cname);");
+	$self->pidl("return py_talloc_import(&$name\_Type, ret);");
 	$self->deindent;
 	$self->pidl("}");
+
 	$self->pidl("");
 
 	$self->pidl_hdr("PyAPI_DATA(PyTypeObject) $name\_Type;\n");
 	$self->pidl_hdr("#define $name\_Check(op) PyObject_TypeCheck(op, &$name\_Type)\n");
 	$self->pidl_hdr("#define $name\_CheckExact(op) ((op)->ob_type == &$name\_Type)\n");
 	$self->pidl_hdr("\n");
-	$self->pidl("PyTypeObject $name\_Type = {");
+	my $docstring = ($self->DocString($d, $name) or "NULL");
+	my $typeobject = "$name\_Type";
+	$self->pidl("PyTypeObject $typeobject = {");
 	$self->indent;
 	$self->pidl("PyObject_HEAD_INIT(NULL) 0,");
-	$self->pidl(".tp_name = \"$name\",");
+	$self->pidl(".tp_name = \"$modulename.$prettyname\",");
 	$self->pidl(".tp_basicsize = sizeof(py_talloc_Object),");
 	$self->pidl(".tp_dealloc = py_talloc_dealloc,");
-	$self->pidl(".tp_getattr = py_$name\_getattr,");
-	$self->pidl(".tp_setattr = py_$name\_setattr,");
+	$self->pidl(".tp_getset = $getsetters,");
 	$self->pidl(".tp_repr = py_talloc_default_repr,");
+	$self->pidl(".tp_doc = $docstring,");
+	$self->pidl(".tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,");
+	$self->pidl(".tp_new = py_$name\_new,");
 	$self->deindent;
 	$self->pidl("};");
 
 	$self->pidl("");
 
-	my $py_fnname = "py_$name";
-	$self->pidl("static PyObject *$py_fnname(PyObject *self, PyObject *args)");
-	$self->pidl("{");
-	$self->indent;
-	$self->pidl("$cname *ret = talloc_zero(NULL, $cname);");
-	$self->pidl("return py_talloc_import(&$name\_Type, ret);");
-	$self->deindent;
-	$self->pidl("}");
-	$self->pidl("");
-
-	return $py_fnname;
+	return "&$typeobject";
 }
 
-sub PythonFunction($$$)
+sub PythonFunctionBody($$$)
 {
-	my ($self, $fn, $iface) = @_;
+	my ($self, $fn, $iface, $prettyname) = @_;
 
-	$self->pidl("static PyObject *py_$fn->{NAME}(PyObject *self, PyObject *args, PyObject *kwargs)");
-	$self->pidl("{");
-	$self->indent;
 	$self->pidl("$iface\_InterfaceObject *iface = ($iface\_InterfaceObject *)self;");
 	$self->pidl("NTSTATUS status;");
 	$self->pidl("TALLOC_CTX *mem_ctx = talloc_new(NULL);");
@@ -273,6 +270,8 @@ sub PythonFunction($$$)
 	my $args_string = "";
 	my $args_names = "";
 
+	my $signature = "S.$prettyname(";
+
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		$self->pidl("PyObject *py_$e->{NAME};");
 		if (grep(/out/,@{$e->{DIRECTION}})) {
@@ -282,8 +281,14 @@ sub PythonFunction($$$)
 			$args_format .= "O";
 			$args_string .= ", &py_$e->{NAME}";
 			$args_names .= "\"$e->{NAME}\", ";
+			$signature .= "$e->{NAME}, ";
 		}
 	}
+	if (substr($signature, -2) eq ", ") {
+		$signature = substr($signature, 0, -2);
+	}
+	$signature.= ") -> ";
+
 	$self->pidl("const char *kwnames[] = {");
 	$self->indent;
 	$self->pidl($args_names . "NULL");
@@ -314,6 +319,9 @@ sub PythonFunction($$$)
 
 	if ($result_size > 1) {
 		$self->pidl("result = PyTuple_New($result_size);");
+		$signature .= "(";
+	} elsif ($result_size == 0) {
+		$signature .= "None";
 	}
 
 	foreach my $e (@{$fn->{ELEMENTS}}) {
@@ -323,8 +331,10 @@ sub PythonFunction($$$)
 			if ($result_size > 1) {
 				$self->pidl("PyTuple_SetItem(result, $i, $py_name);");
 				$i++;
+				$signature .= "$e->{NAME}, ";
 			} else {
 				$self->pidl("result = $py_name;");
+				$signature .= "result";
 			}
 		}
 	}
@@ -337,16 +347,55 @@ sub PythonFunction($$$)
 		my $conv = $self->ConvertObjectToPythonData("r", $fn->{RETURN_TYPE}, "r->out.result");
 		if ($result_size > 1) {
 			$self->pidl("PyTuple_SetItem(result, $i, $conv);");
+			$signature .= "result";
 		} else {
 			$self->pidl("result = $conv;");
+			$signature .= "result";
 		}
 	}
 
+	if (substr($signature, -2) eq ", ") {
+		$signature = substr($signature, 0, -2);
+	}
+	if ($result_size > 1) {
+		$signature .= ")";
+	}
+
 	$self->pidl("talloc_free(mem_ctx);");
 	$self->pidl("return result;");
+
+	return $signature;
+}
+
+sub PythonFunction($$$)
+{
+	my ($self, $fn, $iface, $prettyname) = @_;
+
+	my $fnname = "py_$fn->{NAME}";
+	my $docstring = $self->DocString($fn, $fn->{NAME});
+
+	$self->pidl("static PyObject *$fnname(PyObject *self, PyObject *args, PyObject *kwargs)");
+	$self->pidl("{");
+	$self->indent;
+	if (has_property($fn, "todo")) {
+		$self->pidl("PyErr_SetString(PyExc_NotImplementedError, \"No marshalling code available yet for $prettyname\");");
+		$self->pidl("return NULL;");
+		unless ($docstring) { $docstring = "NULL"; }
+	} else {
+		my $signature = $self->PythonFunctionBody($fn, $iface, $prettyname);
+
+		if ($docstring) {
+			$docstring = "\"$signature\\n\\n\"$docstring";
+		} else {
+			$docstring = "\"$signature\"";
+		}
+	}
+
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("");
+
+	return ($fnname, $docstring);
 }
 
 sub handle_werror($$$$)
@@ -377,9 +426,9 @@ sub handle_ntstatus($$$$)
 	$self->pidl("");
 }
 
-sub PythonType($$$)
+sub PythonType($$$$)
 {
-	my ($self, $d, $interface, $basename) = @_;
+	my ($self, $modulename, $d, $interface, $basename) = @_;
 
 	my $actual_ctype = $d;
 	if ($actual_ctype->{TYPE} eq "TYPEDEF") {
@@ -387,19 +436,20 @@ sub PythonType($$$)
 	}
 
 	if ($actual_ctype->{TYPE} eq "STRUCT") {
-		my $py_fnname;
-		if ($d->{TYPE} eq "STRUCT") {
-			$py_fnname = $self->PythonStruct($d->{NAME}, mapTypeName($d), $d);
-		} else {
-			$py_fnname = $self->PythonStruct($d->{NAME}, mapTypeName($d), $d->{DATA});
-		}
-
+		my $typeobject;
 		my $fn_name = $d->{NAME};
 
 		$fn_name =~ s/^$interface->{NAME}_//;
 		$fn_name =~ s/^$basename\_//;
 
-		$self->register_module_method($fn_name, $py_fnname, "METH_NOARGS", "NULL");
+
+		if ($d->{TYPE} eq "STRUCT") {
+			$typeobject = $self->PythonStruct($modulename, $fn_name, $d->{NAME}, mapTypeName($d), $d);
+		} else {
+			$typeobject = $self->PythonStruct($modulename, $fn_name, $d->{NAME}, mapTypeName($d), $d->{DATA});
+		}
+
+		$self->register_module_typeobject($fn_name, $typeobject);
 	}
 
 	if ($d->{TYPE} eq "ENUM" or $d->{TYPE} eq "BITMAP") {
@@ -429,6 +479,18 @@ sub PythonType($$$)
 	}
 }
 
+sub DocString($$$)
+{
+	my ($self, $d, $name) = @_;
+	if (has_property($d, "helpstring")) {
+		my $docstring = uc("py_doc_$name");
+		$self->pidl("#define $docstring ".has_property($d, "helpstring"));
+		return $docstring;
+	}
+
+	return undef;
+}
+
 sub Interface($$$)
 {
 	my($self,$interface,$basename) = @_;
@@ -443,7 +505,7 @@ sub Interface($$$)
 	foreach my $d (@{$interface->{TYPES}}) {
 		next if has_property($d, "nopython");
 
-		$self->PythonType($d, $interface, $basename);
+		$self->PythonType($basename, $d, $interface, $basename);
 	}
 
 	if (defined $interface->{PROPERTIES}->{uuid}) {
@@ -457,25 +519,27 @@ sub Interface($$$)
 
 		$self->pidl("");
 
+		my @fns = ();
+
 		foreach my $d (@{$interface->{FUNCTIONS}}) {
 			next if not defined($d->{OPNUM});
 			next if has_property($d, "nopython");
 
-			$self->PythonFunction($d, $interface->{NAME});
-		}
+			my $prettyname = $d->{NAME};
 
-		$self->pidl("static PyMethodDef interface_$interface->{NAME}\_methods[] = {");
-		$self->indent;
-		foreach my $d (@{$interface->{FUNCTIONS}}) {
-			next if not defined($d->{OPNUM});
-			next if has_property($d, "nopython");
+			$prettyname =~ s/^$interface->{NAME}_//;
+			$prettyname =~ s/^$basename\_//;
 
-			my $fn_name = $d->{NAME};
+			my ($fnname, $fndocstring) = $self->PythonFunction($d, $interface->{NAME}, $prettyname);
 
-			$fn_name =~ s/^$interface->{NAME}_//;
-			$fn_name =~ s/^$basename\_//;
+			push (@fns, [$fnname, $prettyname, $fndocstring]);
+		}
 
-			$self->pidl("{ \"$fn_name\", (PyCFunction)py_$d->{NAME}, METH_VARARGS|METH_KEYWORDS, NULL },");
+		$self->pidl("static PyMethodDef interface_$interface->{NAME}\_methods[] = {");
+		$self->indent;
+		foreach my $d (@fns) {
+			my ($c_fn, $prettyname, $docstring) = @$d;
+			$self->pidl("{ \"$prettyname\", (PyCFunction)$c_fn, METH_VARARGS|METH_KEYWORDS, $docstring },");
 		}
 		$self->pidl("{ NULL, NULL, 0, NULL }");
 		$self->deindent;
@@ -492,29 +556,7 @@ sub Interface($$$)
 		$self->pidl("}");
 		$self->pidl("");
 
-		$self->pidl("static PyObject *interface_$interface->{NAME}_getattr(PyObject *obj, char *name)");
-		$self->pidl("{");
-		$self->indent;
-		$self->pidl("return Py_FindMethod(interface_$interface->{NAME}\_methods, obj, name);");
-		$self->deindent;
-		$self->pidl("}");
-
-		$self->pidl("");
-
-		$self->pidl("PyTypeObject $interface->{NAME}_InterfaceType = {");
-		$self->indent;
-		$self->pidl("PyObject_HEAD_INIT(NULL) 0,");
-		$self->pidl(".tp_name = \"$interface->{NAME}\",");
-		$self->pidl(".tp_basicsize = sizeof($interface->{NAME}_InterfaceObject),");
-		$self->pidl(".tp_dealloc = interface_$interface->{NAME}_dealloc,");
-		$self->pidl(".tp_getattr = interface_$interface->{NAME}_getattr,");
-		$self->deindent;
-		$self->pidl("};");
-
-		$self->pidl("");
-
-		$self->register_module_method($interface->{NAME}, "interface_$interface->{NAME}", "METH_VARARGS|METH_KEYWORDS", "NULL");
-		$self->pidl("static PyObject *interface_$interface->{NAME}(PyObject *self, PyObject *args, PyObject *kwargs)");
+		$self->pidl("static PyObject *interface_$interface->{NAME}_new(PyTypeObject *self, PyObject *args, PyObject *kwargs)");
 		$self->pidl("{");
 		$self->indent;
 		$self->pidl("$interface->{NAME}_InterfaceObject *ret;");
@@ -574,6 +616,38 @@ sub Interface($$$)
 		$self->pidl("}");
 		
 		$self->pidl("");
+
+		my $signature = 
+"\"$interface->{NAME}(binding, lp_ctx=None, credentials=None) -> Connection to DCE/RPC interface.\\n\"
+\"\\n\"
+\"binding should be a DCE/RPC binding string (for example: ncacn_ip_tcp:127.0.0.1)\\n\"
+\"lp_ctx should be a path to a smb.conf file or a param.LoadParm object\\n\"
+\"credentials should be a credentials.Credentials object.\\n\\n\"";
+
+		my $docstring = $self->DocString($interface, $interface->{NAME});
+
+		if ($docstring) {
+			$docstring = "$signature$docstring";
+		} else {
+			$docstring = $signature;
+		}
+
+		$self->pidl("PyTypeObject $interface->{NAME}_InterfaceType = {");
+		$self->indent;
+		$self->pidl("PyObject_HEAD_INIT(NULL) 0,");
+		$self->pidl(".tp_name = \"$basename.$interface->{NAME}\",");
+		$self->pidl(".tp_basicsize = sizeof($interface->{NAME}_InterfaceObject),");
+		$self->pidl(".tp_dealloc = interface_$interface->{NAME}_dealloc,");
+		$self->pidl(".tp_methods = interface_$interface->{NAME}_methods,");
+		$self->pidl(".tp_doc = $docstring,");
+		$self->pidl(".tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,");
+		$self->pidl(".tp_new = interface_$interface->{NAME}_new,");
+		$self->deindent;
+		$self->pidl("};");
+
+		$self->pidl("");
+
+		$self->register_module_typeobject($interface->{NAME}, "&$interface->{NAME}_InterfaceType");
 	}
 
 	$self->pidl_hdr("\n");
@@ -587,6 +661,22 @@ sub register_module_method($$$$$)
 	push (@{$self->{module_methods}}, [$fn_name, $pyfn_name, $flags, $doc])
 }
 
+sub register_module_typeobject($$$)
+{
+	my ($self, $name, $py_name) = @_;
+
+	$self->register_module_object($name, "(PyObject *)$py_name");
+
+	push (@{$self->{module_types}}, [$name, $py_name])
+}
+
+sub register_module_object($$$)
+{
+	my ($self, $name, $py_name) = @_;
+
+	push (@{$self->{module_objects}}, [$name, $py_name])
+}
+
 sub assign($$$)
 {
 	my ($self, $dest, $src) = @_;
@@ -929,7 +1019,20 @@ sub Parse($$$$$)
 	$self->pidl("{");
 	$self->indent;
 	$self->pidl("PyObject *m;");
-	$self->pidl("m = Py_InitModule(\"$basename\", $basename\_methods);");
+	$self->pidl("");
+
+	foreach (@{$self->{module_types}}) {
+		my ($object_name, $c_name) = @$_;
+		$self->pidl("if (PyType_Ready($c_name) < 0)");
+		$self->pidl("\treturn;");
+	}
+
+	$self->pidl("");
+
+	$self->pidl("m = Py_InitModule3(\"$basename\", $basename\_methods, \"$basename DCE/RPC\");");
+	$self->pidl("if (m == NULL)");
+	$self->pidl("\treturn;");
+	$self->pidl("");
 	foreach my $name (keys %{$self->{constants}}) {
 		my $py_obj;
 		my ($ctype, $cvar) = @{$self->{constants}->{$name}};
@@ -943,6 +1046,13 @@ sub Parse($$$$$)
 
 		$self->pidl("PyModule_AddObject(m, \"$name\", $py_obj);");
 	}
+
+	foreach (@{$self->{module_objects}}) {
+		my ($object_name, $c_name) = @$_;
+		$self->pidl("Py_INCREF($c_name);");
+		$self->pidl("PyModule_AddObject(m, \"$object_name\", $c_name);");
+	}
+
 	$self->deindent;
 	$self->pidl("}");
     return ($self->{res_hdr}, $self->{res});
diff --git a/source4/pidl/pidl b/source4/pidl/pidl
index 220d62cd71..b7a22f0499 100755
--- a/source4/pidl/pidl
+++ b/source4/pidl/pidl
@@ -403,8 +403,8 @@ pidl README by Andrew Tridgell.
 
 use strict;
 use FindBin qw($RealBin $Script);
-use lib "$RealBin";
 use lib "$RealBin/lib";
+use lib "$RealBin/../share/perl5";
 use Getopt::Long;
 use File::Basename;
 use Parse::Pidl qw ( $VERSION );
diff --git a/source4/pidl/tests/samba-ndr.pl b/source4/pidl/tests/samba-ndr.pl
index a14111961f..114ca01cfa 100755
--- a/source4/pidl/tests/samba-ndr.pl
+++ b/source4/pidl/tests/samba-ndr.pl
@@ -4,7 +4,7 @@
 use strict;
 use warnings;
 
-use Test::More tests => 30;
+use Test::More tests => 31;
 use FindBin qw($RealBin);
 use lib "$RealBin";
 use Util;
@@ -277,3 +277,17 @@ $generator->ParseElementPrint({ NAME => "x", TYPE => "uint32", REPRESENTATION_TY
 				    PROPERTIES => { value => "23" },
 				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "uint32"} ]}, "var", { "x" => "r->foobar" } );
 is($generator->{res}, "ndr_print_uint32(ndr, \"x\", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?23:var);\n");
+
+$generator = new Parse::Pidl::Samba4::NDR::Parser();
+$generator->AuthServiceStruct("bridge", "\"rot13\",\"onetimepad\"");
+is($generator->{res}, "static const char * const bridge_authservice_strings[] = {
+	\"rot13\", 
+	\"onetimepad\", 
+};
+
+static const struct ndr_interface_string_array bridge_authservices = {
+	.count	= 2,
+	.names	= bridge_authservice_strings
+};
+
+");
diff --git a/source4/rpc_server/common/common.h b/source4/rpc_server/common/common.h
index 5ddfca43b5..af2d96cb3e 100644
--- a/source4/rpc_server/common/common.h
+++ b/source4/rpc_server/common/common.h
@@ -20,44 +20,18 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-/* a useful macro for generating a RPC fault in the backend code */
-#define DCESRV_FAULT(code) do { \
-	dce_call->fault_code = code; \
-	return r->out.result; \
-} while(0)
-
-/* a useful macro for generating a RPC fault in the backend code */
-#define DCESRV_FAULT_VOID(code) do { \
-	dce_call->fault_code = code; \
-	return; \
-} while(0)
-
-/* a useful macro for checking the validity of a dcerpc policy handle
-   and giving the right fault code if invalid */
-#define DCESRV_CHECK_HANDLE(h) do {if (!(h)) DCESRV_FAULT(DCERPC_FAULT_CONTEXT_MISMATCH); } while (0)
-
-/* this checks for a valid policy handle, and gives a fault if an
-   invalid handle or retval if the handle is of the
-   wrong type */
-#define DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, retval) do { \
-	(h) = dcesrv_handle_fetch(dce_call->context, (inhandle), DCESRV_HANDLE_ANY); \
-	DCESRV_CHECK_HANDLE(h); \
-	if ((t) != DCESRV_HANDLE_ANY && (h)->wire_handle.handle_type != (t)) { \
-		return retval; \
-	} \
-} while (0)
-
-/* this checks for a valid policy handle and gives a dcerpc fault 
-   if its the wrong type of handle */
-#define DCESRV_PULL_HANDLE_FAULT(h, inhandle, t) do { \
-	(h) = dcesrv_handle_fetch(dce_call->context, (inhandle), t); \
-	DCESRV_CHECK_HANDLE(h); \
-} while (0)
-
-#define DCESRV_PULL_HANDLE(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, NT_STATUS_INVALID_HANDLE)
-#define DCESRV_PULL_HANDLE_WERR(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, WERR_BADFID)
-
+struct share_config;
 struct dcesrv_context;
+enum srvsvc_ShareType dcesrv_common_get_share_type(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, struct share_config *scfg);
+enum srvsvc_PlatformId dcesrv_common_get_platform_id(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx);
+const char *dcesrv_common_get_domain_name(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx);
+const char *dcesrv_common_get_lan_root(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx);
+const char *dcesrv_common_get_server_name(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, const char *server_unc);
+uint32_t dcesrv_common_get_version_major(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+uint32_t dcesrv_common_get_version_minor(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+uint32_t dcesrv_common_get_version_build(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx);
+uint32_t dcesrv_common_get_share_permissions(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, struct share_config *scfg);
+uint32_t dcesrv_common_get_share_current_users(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, struct share_config *scfg);
+const char *dcesrv_common_get_share_path(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, struct share_config *scfg);
 
-#include "param/share.h"
-#include "rpc_server/common/proto.h"
+struct dcesrv_context;
diff --git a/source4/rpc_server/common/server_info.c b/source4/rpc_server/common/server_info.c
index 0a44493df5..646879ad0d 100644
--- a/source4/rpc_server/common/server_info.c
+++ b/source4/rpc_server/common/server_info.c
@@ -32,7 +32,7 @@
 */
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ enum srvsvc_PlatformId dcesrv_common_get_platform_id(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+enum srvsvc_PlatformId dcesrv_common_get_platform_id(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	enum srvsvc_PlatformId id;
 
@@ -41,7 +41,7 @@ _PUBLIC_ enum srvsvc_PlatformId dcesrv_common_get_platform_id(TALLOC_CTX *mem_ct
 	return id;
 }
 
-_PUBLIC_ const char *dcesrv_common_get_server_name(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, const char *server_unc)
+const char *dcesrv_common_get_server_name(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx, const char *server_unc)
 {
 	const char *p = server_unc;
 
@@ -64,25 +64,25 @@ const char *dcesrv_common_get_domain_name(TALLOC_CTX *mem_ctx, struct dcesrv_con
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_version_major(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+uint32_t dcesrv_common_get_version_major(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
 	return lp_parm_int(lp_ctx, NULL, "server_info", "version_major", 5);
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_version_minor(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+uint32_t dcesrv_common_get_version_minor(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
 	return lp_parm_int(lp_ctx, NULL, "server_info", "version_minor", 2);
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_version_build(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+uint32_t dcesrv_common_get_version_build(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 {
 	return lp_parm_int(lp_ctx, NULL, "server_info", "version_build", 3790);
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_server_type(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_server_type(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	int default_server_announce = 0;
 	default_server_announce |= SV_TYPE_WORKSTATION;
@@ -158,56 +158,56 @@ _PUBLIC_ uint32_t dcesrv_common_get_server_type(TALLOC_CTX *mem_ctx, struct dces
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ const char *dcesrv_common_get_lan_root(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+const char *dcesrv_common_get_lan_root(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return talloc_strdup(mem_ctx, "");
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_users(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_users(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return -1;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_disc(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_disc(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return 15;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_hidden(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_hidden(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return 0;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_announce(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_announce(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return 240;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_anndelta(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_anndelta(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return 3000;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ uint32_t dcesrv_common_get_licenses(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+uint32_t dcesrv_common_get_licenses(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return 0;
 }
 
 /* This hardcoded value should go into a ldb database! */
-_PUBLIC_ const char *dcesrv_common_get_userpath(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
+const char *dcesrv_common_get_userpath(TALLOC_CTX *mem_ctx, struct dcesrv_context *dce_ctx)
 {
 	return talloc_strdup(mem_ctx, "c:\\");
 }
 
 #define INVALID_SHARE_NAME_CHARS " \"*+,./:;<=>?[\\]|"
 
-_PUBLIC_ bool dcesrv_common_validate_share_name(TALLOC_CTX *mem_ctx, const char *share_name)
+bool dcesrv_common_validate_share_name(TALLOC_CTX *mem_ctx, const char *share_name)
 {
 	if (strpbrk(share_name, INVALID_SHARE_NAME_CHARS)) {
 		return false;
diff --git a/source4/rpc_server/config.mk b/source4/rpc_server/config.mk
index ea30533922..974d12c882 100644
--- a/source4/rpc_server/config.mk
+++ b/source4/rpc_server/config.mk
@@ -80,7 +80,8 @@ PRIVATE_DEPENDENCIES = \
 		DCERPC_COMMON \
 		SAMDB \
 		NDR_UNIXINFO \
-		NSS_WRAPPER
+		NSS_WRAPPER \
+		LIBWBCLIENT
 # End MODULE dcerpc_unixinfo
 ################################################
 
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index cc9819e40c..1962a97d5b 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -26,6 +26,8 @@
 #include "auth/gensec/gensec.h"
 #include "lib/util/dlinklist.h"
 #include "rpc_server/dcerpc_server.h"
+#include "rpc_server/dcerpc_server_proto.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "lib/events/events.h"
 #include "smbd/service_task.h"
 #include "smbd/service_stream.h"
@@ -298,7 +300,7 @@ static int dcesrv_endpoint_destructor(struct dcesrv_connection *p)
 /*
   connect to a dcerpc endpoint
 */
-NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
+_PUBLIC_ NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
 				 TALLOC_CTX *mem_ctx,
 				 const struct dcesrv_endpoint *ep,
 				 struct auth_session_info *session_info,
diff --git a/source4/rpc_server/dcerpc_server.h b/source4/rpc_server/dcerpc_server.h
index 5d4accc538..058dfe3ab2 100644
--- a/source4/rpc_server/dcerpc_server.h
+++ b/source4/rpc_server/dcerpc_server.h
@@ -282,6 +282,90 @@ struct dcesrv_critical_sizes {
 
 struct model_ops;
 
-#include "rpc_server/dcerpc_server_proto.h"
+NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
+				   const char *ep_name,
+				   const struct dcesrv_interface *iface,
+				   const struct security_descriptor *sd);
+NTSTATUS dcerpc_register_ep_server(const void *_ep_server);
+NTSTATUS dcesrv_init_context(TALLOC_CTX *mem_ctx, 
+				      struct loadparm_context *lp_ctx,
+				      const char **endpoint_servers, struct dcesrv_context **_dce_ctx);
+NTSTATUS dcesrv_init_ipc_context(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx,
+					  struct dcesrv_context **_dce_ctx);
+NTSTATUS dcesrv_endpoint_search_connect(struct dcesrv_context *dce_ctx,
+					TALLOC_CTX *mem_ctx,
+					const struct dcerpc_binding *ep_description,
+					struct auth_session_info *session_info,
+					struct event_context *event_ctx,
+					struct messaging_context *msg_ctx,
+					struct server_id server_id,
+					uint32_t state_flags,
+					struct dcesrv_connection **dce_conn_p);
+NTSTATUS dcesrv_output(struct dcesrv_connection *dce_conn, 
+		       void *private_data,
+		       NTSTATUS (*write_fn)(void *private_data, DATA_BLOB *output, size_t *nwritten));
+NTSTATUS dcesrv_input(struct dcesrv_connection *dce_conn, const DATA_BLOB *data);
+NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
+				 TALLOC_CTX *mem_ctx,
+				 const struct dcesrv_endpoint *ep,
+				 struct auth_session_info *session_info,
+				 struct event_context *event_ctx,
+				 struct messaging_context *msg_ctx,
+				 struct server_id server_id,
+				 uint32_t state_flags,
+				 struct dcesrv_connection **_p);
+
+NTSTATUS dcesrv_reply(struct dcesrv_call_state *call);
+struct dcesrv_handle *dcesrv_handle_new(struct dcesrv_connection_context *context, 
+					uint8_t handle_type);
+
+struct dcesrv_handle *dcesrv_handle_fetch(
+					  struct dcesrv_connection_context *context, 
+					  struct policy_handle *p,
+					  uint8_t handle_type);
+struct socket_address *dcesrv_connection_get_my_addr(struct dcesrv_connection *conn, TALLOC_CTX *mem_ctx);
+
+struct socket_address *dcesrv_connection_get_peer_addr(struct dcesrv_connection *conn, TALLOC_CTX *mem_ctx);
+
+NTSTATUS dcesrv_fetch_session_key(struct dcesrv_connection *p, DATA_BLOB *session_key);
+
+/* a useful macro for generating a RPC fault in the backend code */
+#define DCESRV_FAULT(code) do { \
+	dce_call->fault_code = code; \
+	return r->out.result; \
+} while(0)
+
+/* a useful macro for generating a RPC fault in the backend code */
+#define DCESRV_FAULT_VOID(code) do { \
+	dce_call->fault_code = code; \
+	return; \
+} while(0)
+
+/* a useful macro for checking the validity of a dcerpc policy handle
+   and giving the right fault code if invalid */
+#define DCESRV_CHECK_HANDLE(h) do {if (!(h)) DCESRV_FAULT(DCERPC_FAULT_CONTEXT_MISMATCH); } while (0)
+
+/* this checks for a valid policy handle, and gives a fault if an
+   invalid handle or retval if the handle is of the
+   wrong type */
+#define DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, retval) do { \
+	(h) = dcesrv_handle_fetch(dce_call->context, (inhandle), DCESRV_HANDLE_ANY); \
+	DCESRV_CHECK_HANDLE(h); \
+	if ((t) != DCESRV_HANDLE_ANY && (h)->wire_handle.handle_type != (t)) { \
+		return retval; \
+	} \
+} while (0)
+
+/* this checks for a valid policy handle and gives a dcerpc fault 
+   if its the wrong type of handle */
+#define DCESRV_PULL_HANDLE_FAULT(h, inhandle, t) do { \
+	(h) = dcesrv_handle_fetch(dce_call->context, (inhandle), t); \
+	DCESRV_CHECK_HANDLE(h); \
+} while (0)
+
+#define DCESRV_PULL_HANDLE(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, NT_STATUS_INVALID_HANDLE)
+#define DCESRV_PULL_HANDLE_WERR(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, WERR_BADFID)
+
+
 
 #endif /* SAMBA_DCERPC_SERVER_H */
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 75b13bb824..1d89441170 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -22,6 +22,8 @@
 
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
+#include "rpc_server/dcerpc_server_proto.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
diff --git a/source4/rpc_server/lsa/lsa.h b/source4/rpc_server/lsa/lsa.h
index db148d3dcb..b7c41486a2 100644
--- a/source4/rpc_server/lsa/lsa.h
+++ b/source4/rpc_server/lsa/lsa.h
@@ -40,7 +40,6 @@
 struct lsa_policy_state {
 	struct dcesrv_handle *handle;
 	struct ldb_context *sam_ldb;
-	struct sidmap_context *sidmap;
 	uint32_t access_mask;
 	struct ldb_dn *domain_dn;
 	struct ldb_dn *forest_dn;
diff --git a/source4/rpc_server/lsa/lsa_init.c b/source4/rpc_server/lsa/lsa_init.c
index 57599b96a2..4dcd606435 100644
--- a/source4/rpc_server/lsa/lsa_init.c
+++ b/source4/rpc_server/lsa/lsa_init.c
@@ -57,11 +57,6 @@ NTSTATUS dcesrv_lsa_get_policy_state(struct dcesrv_call_state *dce_call, TALLOC_
 
 	partitions_basedn = samdb_partitions_dn(state->sam_ldb, mem_ctx);
 
-	state->sidmap = sidmap_open(state, dce_call->conn->dce_ctx->lp_ctx);
-	if (state->sidmap == NULL) {
-		return NT_STATUS_INVALID_SYSTEM_SERVICE;
-	}
-
 	/* work out the domain_dn - useful for so many calls its worth
 	   fetching here */
 	state->domain_dn = samdb_base_dn(state->sam_ldb);
diff --git a/source4/rpc_server/lsa/lsa_lookup.c b/source4/rpc_server/lsa/lsa_lookup.c
index e01efa8233..c6b9e3bd40 100644
--- a/source4/rpc_server/lsa/lsa_lookup.c
+++ b/source4/rpc_server/lsa/lsa_lookup.c
@@ -360,7 +360,7 @@ static NTSTATUS dcesrv_lsa_lookup_name(struct loadparm_context *lp_ctx,
 		return NT_STATUS_OK;
 	}
 
-	/* need to add a call into sidmap to check for a allocated sid */
+	/* need to check for an allocated sid */
 
 	return NT_STATUS_INVALID_SID;
 }
@@ -466,8 +466,7 @@ static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX
 		return NT_STATUS_OK;
 	}
 
-	/* need to re-add a call into sidmap to check for a allocated sid */
-	/* status = sidmap_allocated_sid_lookup(state->sidmap, mem_ctx, sid, name, rtype); */
+	/* need to re-add a check for an allocated sid */
 
 	return NT_STATUS_NOT_FOUND;
 }
diff --git a/source4/rpc_server/srvsvc/dcesrv_srvsvc.c b/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
index ebbeb2d0df..23e40d9976 100644
--- a/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
+++ b/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
@@ -24,6 +24,7 @@
 #include "rpc_server/dcerpc_server.h"
 #include "librpc/gen_ndr/ndr_srvsvc.h"
 #include "rpc_server/common/common.h"
+#include "rpc_server/common/proto.h"
 #include "auth/auth.h"
 #include "libcli/security/security.h"
 #include "system/time.h"
diff --git a/source4/rpc_server/unixinfo/dcesrv_unixinfo.c b/source4/rpc_server/unixinfo/dcesrv_unixinfo.c
index 2c08d501d1..e6313b771c 100644
--- a/source4/rpc_server/unixinfo/dcesrv_unixinfo.c
+++ b/source4/rpc_server/unixinfo/dcesrv_unixinfo.c
@@ -23,53 +23,100 @@
 #include "rpc_server/dcerpc_server.h"
 #include "rpc_server/common/common.h"
 #include "librpc/gen_ndr/ndr_unixinfo.h"
+#include "libcli/wbclient/wbclient.h"
 #include "lib/events/events.h"
-#include "dsdb/samdb/samdb.h"
 #include "system/passwd.h"
 #include "param/param.h"
 
+static NTSTATUS dcerpc_unixinfo_bind(struct dcesrv_call_state *dce_call,
+				     const struct dcesrv_interface *iface)
+{
+	struct wbc_context *wbc_ctx;
+
+	wbc_ctx = wbc_init(dce_call->context, dce_call->msg_ctx,
+			   dce_call->event_ctx);
+	NT_STATUS_HAVE_NO_MEMORY(wbc_ctx);
+
+	dce_call->context->private = wbc_ctx;
+
+	return NT_STATUS_OK;
+}
+
+#define DCESRV_INTERFACE_UNIXINFO_BIND dcerpc_unixinfo_bind
+
 static NTSTATUS dcesrv_unixinfo_SidToUid(struct dcesrv_call_state *dce_call,
 				  TALLOC_CTX *mem_ctx,
 				  struct unixinfo_SidToUid *r)
 {
 	NTSTATUS status;
-	struct sidmap_context *sidmap;
-	uid_t uid;
+	struct wbc_context *wbc_ctx = talloc_get_type_abort(
+						dce_call->context->private,
+						struct wbc_context);
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
-	sidmap = sidmap_open(mem_ctx, dce_call->conn->dce_ctx->lp_ctx);
-	if (sidmap == NULL) {
-		DEBUG(10, ("sidmap_open failed\n"));
-		return NT_STATUS_NO_MEMORY;
-	}
+	DEBUG(5, ("dcesrv_unixinfo_SidToUid called\n"));
+
+	ids = talloc(mem_ctx, struct  id_mapping);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
 
-	status = sidmap_sid_to_unixuid(sidmap, &r->in.sid, &uid);
+	ids->sid = &r->in.sid;
+	ids->status = NT_STATUS_NONE_MAPPED;
+	ids->unixid = NULL;
+	ctx = wbc_sids_to_xids_send(wbc_ctx, ids, 1, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_sids_to_xids_recv(ctx, &ids);
 	NT_STATUS_NOT_OK_RETURN(status);
 
-	*r->out.uid = uid;
-	return NT_STATUS_OK;
+	if (ids->unixid->type == ID_TYPE_BOTH ||
+	    ids->unixid->type == ID_TYPE_UID) {
+		*r->out.uid = ids->unixid->id;
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_INVALID_SID;
+	}
 }
 
 static NTSTATUS dcesrv_unixinfo_UidToSid(struct dcesrv_call_state *dce_call,
 				  TALLOC_CTX *mem_ctx,
 				  struct unixinfo_UidToSid *r)
 {
-	struct sidmap_context *sidmap;
-	uid_t uid;
-
-	sidmap = sidmap_open(mem_ctx, dce_call->conn->dce_ctx->lp_ctx);
-	if (sidmap == NULL) {
-		DEBUG(10, ("sidmap_open failed\n"));
-		return NT_STATUS_NO_MEMORY;
-	}
+	struct wbc_context *wbc_ctx = talloc_get_type_abort(
+						dce_call->context->private,
+						struct wbc_context);
+	struct id_mapping *ids;
+	struct composite_context *ctx;
+	uint32_t uid;
+	NTSTATUS status;
 
-	uid = r->in.uid; 	/* This cuts uid to (probably) 32 bit */
+	DEBUG(5, ("dcesrv_unixinfo_UidToSid called\n"));
 
+	uid = r->in.uid; 	/* This cuts uid to 32 bit */
 	if ((uint64_t)uid != r->in.uid) {
 		DEBUG(10, ("uid out of range\n"));
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	return sidmap_uid_to_sid(sidmap, mem_ctx, uid, &r->out.sid);
+	ids = talloc(mem_ctx, struct id_mapping);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids->sid = NULL;
+	ids->status = NT_STATUS_NONE_MAPPED;
+	ids->unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids->unixid);
+
+	ids->unixid->id = uid;
+	ids->unixid->type = ID_TYPE_UID;
+
+	ctx = wbc_xids_to_sids_send(wbc_ctx, ids, 1, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_xids_to_sids_recv(ctx, &ids);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	r->out.sid = ids->sid;
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS dcesrv_unixinfo_SidToGid(struct dcesrv_call_state *dce_call,
@@ -77,43 +124,74 @@ static NTSTATUS dcesrv_unixinfo_SidToGid(struct dcesrv_call_state *dce_call,
 				  struct unixinfo_SidToGid *r)
 {
 	NTSTATUS status;
-	struct sidmap_context *sidmap;
-	gid_t gid;
+	struct wbc_context *wbc_ctx = talloc_get_type_abort(
+						dce_call->context->private,
+						struct wbc_context);
+	struct id_mapping *ids;
+	struct composite_context *ctx;
 
-	sidmap = sidmap_open(mem_ctx, dce_call->conn->dce_ctx->lp_ctx);
-	if (sidmap == NULL) {
-		DEBUG(10, ("sidmap_open failed\n"));
-		return NT_STATUS_NO_MEMORY;
-	}
+	DEBUG(5, ("dcesrv_unixinfo_SidToGid called\n"));
 
-	status = sidmap_sid_to_unixgid(sidmap, &r->in.sid, &gid);
+	ids = talloc(mem_ctx, struct  id_mapping);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids->sid = &r->in.sid;
+	ids->status = NT_STATUS_NONE_MAPPED;
+	ids->unixid = NULL;
+	ctx = wbc_sids_to_xids_send(wbc_ctx, ids, 1, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_sids_to_xids_recv(ctx, &ids);
 	NT_STATUS_NOT_OK_RETURN(status);
 
-	*r->out.gid = gid;
-	return NT_STATUS_OK;
+	if (ids->unixid->type == ID_TYPE_BOTH ||
+	    ids->unixid->type == ID_TYPE_GID) {
+		*r->out.gid = ids->unixid->id;
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_INVALID_SID;
+	}
 }
 
 static NTSTATUS dcesrv_unixinfo_GidToSid(struct dcesrv_call_state *dce_call,
 				  TALLOC_CTX *mem_ctx,
 				  struct unixinfo_GidToSid *r)
 {
-	struct sidmap_context *sidmap;
-	gid_t gid;
-
-	sidmap = sidmap_open(mem_ctx, dce_call->conn->dce_ctx->lp_ctx);
-	if (sidmap == NULL) {
-		DEBUG(10, ("sidmap_open failed\n"));
-		return NT_STATUS_NO_MEMORY;
-	}
+	struct wbc_context *wbc_ctx = talloc_get_type_abort(
+						dce_call->context->private,
+						struct wbc_context);
+	struct id_mapping *ids;
+	struct composite_context *ctx;
+	uint32_t gid;
+	NTSTATUS status;
 
-	gid = r->in.gid; 	/* This cuts gid to (probably) 32 bit */
+	DEBUG(5, ("dcesrv_unixinfo_GidToSid called\n"));
 
+	gid = r->in.gid; 	/* This cuts gid to 32 bit */
 	if ((uint64_t)gid != r->in.gid) {
 		DEBUG(10, ("gid out of range\n"));
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	return sidmap_gid_to_sid(sidmap, mem_ctx, gid, &r->out.sid);
+	ids = talloc(mem_ctx, struct id_mapping);
+	NT_STATUS_HAVE_NO_MEMORY(ids);
+
+	ids->sid = NULL;
+	ids->status = NT_STATUS_NONE_MAPPED;
+	ids->unixid = talloc(ids, struct unixid);
+	NT_STATUS_HAVE_NO_MEMORY(ids->unixid);
+
+	ids->unixid->id = gid;
+	ids->unixid->type = ID_TYPE_GID;
+
+	ctx = wbc_xids_to_sids_send(wbc_ctx, ids, 1, ids);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = wbc_xids_to_sids_recv(ctx, &ids);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	r->out.sid = ids->sid;
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS dcesrv_unixinfo_GetPWUid(struct dcesrv_call_state *dce_call,
diff --git a/source4/samba4-skip b/source4/samba4-skip
index 4d2da6ed64..19ff924794 100644
--- a/source4/samba4-skip
+++ b/source4/samba4-skip
@@ -46,3 +46,4 @@ nss.test						# Fails
 samba4.samba3sam.python		# Conversion from EJS not yet finished
 samba4.samdb.python			# Not finished yet
 raw.offline 			# Samba 4 doesn't have much offline support yet
+winreg*  #Does not authenticate against the target server
diff --git a/source4/script/mkproto.pl b/source4/script/mkproto.pl
index 87a68e33fa..e1b790d41d 100755
--- a/source4/script/mkproto.pl
+++ b/source4/script/mkproto.pl
@@ -192,6 +192,7 @@ sub process_file($$$)
 
 		if ($line =~ /^_PUBLIC_ FN_/) {
 			handle_loadparm($public_file, $line);
+			handle_loadparm($private_file, $line);
 			next;
 		}
 
diff --git a/source4/script/mkrelease.sh b/source4/script/mkrelease.sh
index a6e7c8493b..0af738deb5 100755
--- a/source4/script/mkrelease.sh
+++ b/source4/script/mkrelease.sh
@@ -1,10 +1,15 @@
 #!/bin/sh
 
-TMPDIR=`mktemp samba-XXXXX`
-rm $TMPDIR || exit 1
-svn export . $TMPDIR || exit 1
+if [ ! -d ".git" -o `dirname $0` != "./source/script" ]; then
+	echo "Run this script from the top-level directory in the"
+	echo "repository as: ./source/script/mkrelease.sh"
+	exit 1
+fi
 
-( cd $TMPDIR/source
+TMPDIR=`mktemp -d samba-XXXXX`
+(git archive --format=tar HEAD | (cd $TMPDIR/ && tar xf -))
+
+( cd $TMPDIR/source || exit 1
  ./autogen.sh || exit 1
  ./configure || exit 1
  make dist  || exit 1
@@ -12,7 +17,8 @@ svn export . $TMPDIR || exit 1
 
 VERSION=`sed -n 's/^SAMBA_VERSION_STRING=//p' $TMPDIR/source/version.h`
 mv $TMPDIR samba-$VERSION || exit 1
-tar -cf samba-$VERSION.tar samba-$VERSION || exit 1
+tar -cf samba-$VERSION.tar samba-$VERSION || (rm -rf samba-$VERSION; exit 1)
+rm -rf samba-$VERSION || exit 1
 echo "Now run: "
 echo "gpg --detach-sign --armor samba-$VERSION.tar"
 echo "gzip samba-$VERSION.tar" 
diff --git a/source4/scripting/bin/smbstatus b/source4/scripting/bin/smbstatus
index ea41289dce..4dfc3365a1 100755
--- a/source4/scripting/bin/smbstatus
+++ b/source4/scripting/bin/smbstatus
@@ -3,7 +3,7 @@ exec smbscript "$0" ${1+"$@"}
 /*
   provide information on connected users and open files
   Copyright Andrew Tridgell 2005
-  Released under the GNU GPL v2 or later
+  Released under the GNU GPL version 3 or later
 */	
 
 libinclude("base.js");
diff --git a/source4/scripting/bin/winreg b/source4/scripting/bin/winreg
index 2114394f45..883c6d7ee3 100755
--- a/source4/scripting/bin/winreg
+++ b/source4/scripting/bin/winreg
@@ -3,7 +3,7 @@ exec smbscript "$0" ${1+"$@"}
 /*
   tool to manipulate a remote registry
   Copyright Andrew Tridgell 2005
-  Released under the GNU GPL v2 or later
+  Released under the GNU GPL version 3 or later
 */	
 
 var options = GetOptions(ARGV,
diff --git a/source4/scripting/ejs/config.mk b/source4/scripting/ejs/config.mk
index 0d10fc6e3a..4eef0207f9 100644
--- a/source4/scripting/ejs/config.mk
+++ b/source4/scripting/ejs/config.mk
@@ -102,7 +102,7 @@ smbcalls_OBJ_FILES = $(addprefix scripting/ejs/, \
 # Start BINARY SMBSCRIPT
 [BINARY::smbscript]
 INSTALLDIR = BINDIR
-PRIVATE_DEPENDENCIES = EJS LIBSAMBA-UTIL smbcalls LIBSAMBA-CONFIG
+PRIVATE_DEPENDENCIES = EJS LIBSAMBA-UTIL smbcalls LIBSAMBA-HOSTCONFIG
 # End BINARY SMBSCRIPT
 #######################
 
diff --git a/source4/scripting/ejs/smbcalls_rand.c b/source4/scripting/ejs/smbcalls_rand.c
index a2db1f0d6d..58e0fa1fd1 100644
--- a/source4/scripting/ejs/smbcalls_rand.c
+++ b/source4/scripting/ejs/smbcalls_rand.c
@@ -23,6 +23,7 @@
 #include "scripting/ejs/smbcalls.h"
 #include "lib/appweb/ejs/ejs.h"
 #include "librpc/gen_ndr/ndr_misc.h"
+#include "librpc/ndr/libndr.h"
 
 /*
   usage:
diff --git a/source4/scripting/libjs/auth.js b/source4/scripting/libjs/auth.js
index 73d8645218..3fe81d0ea7 100644
--- a/source4/scripting/libjs/auth.js
+++ b/source4/scripting/libjs/auth.js
@@ -1,7 +1,7 @@
 /*
 	auth js library functions
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL v2 or later
+	released under the GNU GPL version 3 or later
 */
 
 
diff --git a/source4/scripting/libjs/base.js b/source4/scripting/libjs/base.js
index df0bfe0ce9..d861073a07 100644
--- a/source4/scripting/libjs/base.js
+++ b/source4/scripting/libjs/base.js
@@ -1,7 +1,7 @@
 /*
 	base js library functions
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL v2 or later
+	released under the GNU GPL version 3 or later
 */
 
 if (global["HAVE_BASE_JS"] != undefined) {
diff --git a/source4/scripting/libjs/encoder.js b/source4/scripting/libjs/encoder.js
index d96b859547..6cb780c00d 100644
--- a/source4/scripting/libjs/encoder.js
+++ b/source4/scripting/libjs/encoder.js
@@ -2,7 +2,7 @@
 	server side js functions for encoding/decoding objects into linear strings
 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 /*
 	usage:
diff --git a/source4/scripting/libjs/management.js b/source4/scripting/libjs/management.js
index e54b5e283b..4a43275156 100644
--- a/source4/scripting/libjs/management.js
+++ b/source4/scripting/libjs/management.js
@@ -1,7 +1,7 @@
 /*
 	backend code for Samba4 management
 	Copyright Andrew Tridgell 2005
-	Released under the GNU GPL v2 or later
+	Released under the GNU GPL version 3 or later
 */
 
 
diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js
index 86baa0c003..51e2785762 100644
--- a/source4/scripting/libjs/provision.js
+++ b/source4/scripting/libjs/provision.js
@@ -1,7 +1,7 @@
 /*
 	backend code for provisioning a Samba4 server
 	Copyright Andrew Tridgell 2005
-	Released under the GNU GPL v2 or later
+	Released under the GNU GPL version 3 or later
 */
 
 sys = sys_init();
diff --git a/source4/scripting/libjs/samr.js b/source4/scripting/libjs/samr.js
index a7d7d964fb..6e8c70af3c 100644
--- a/source4/scripting/libjs/samr.js
+++ b/source4/scripting/libjs/samr.js
@@ -1,7 +1,7 @@
 /*
 	samr rpc utility functions 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL v2 or later
+	released under the GNU GPL version 3 or later
 */	
 
 if (global["HAVE_SAMR_JS"] != undefined) {
diff --git a/source4/scripting/libjs/server_call.js b/source4/scripting/libjs/server_call.js
index a8c08780f9..46414a90dd 100644
--- a/source4/scripting/libjs/server_call.js
+++ b/source4/scripting/libjs/server_call.js
@@ -2,7 +2,7 @@
 	server side js functions for handling async calls from js clients
 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 
 libinclude("encoder.js");
diff --git a/source4/scripting/libjs/winreg.js b/source4/scripting/libjs/winreg.js
index 29338abc5a..9db415694d 100644
--- a/source4/scripting/libjs/winreg.js
+++ b/source4/scripting/libjs/winreg.js
@@ -1,7 +1,7 @@
 /*
 	winreg rpc utility functions 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL v2 or later
+	released under the GNU GPL version 3 or later
 */	
 
 libinclude("base.js");
diff --git a/source4/scripting/python/misc.i b/source4/scripting/python/misc.i
index a11b2fb825..e04e6a6906 100644
--- a/source4/scripting/python/misc.i
+++ b/source4/scripting/python/misc.i
@@ -25,6 +25,7 @@
 #include "auth/credentials/credentials.h"
 #include "dsdb/samdb/samdb.h"
 #include "lib/ldb-samba/ldif_handlers.h"
+#include "librpc/ndr/libndr.h"
 %}
 
 %import "stdint.i"
diff --git a/source4/scripting/python/misc_wrap.c b/source4/scripting/python/misc_wrap.c
index cf85e91e1e..579d1f379f 100644
--- a/source4/scripting/python/misc_wrap.c
+++ b/source4/scripting/python/misc_wrap.c
@@ -2533,6 +2533,7 @@ static swig_module_info swig_module = {swig_types, 27, 0, 0, 0, 0};
 #include "auth/credentials/credentials.h"
 #include "dsdb/samdb/samdb.h"
 #include "lib/ldb-samba/ldif_handlers.h"
+#include "librpc/ndr/libndr.h"
 
 
 SWIGINTERN int
diff --git a/source4/scripting/python/modules.c b/source4/scripting/python/modules.c
index 2c10a35c60..08f3c1156c 100644
--- a/source4/scripting/python/modules.c
+++ b/source4/scripting/python/modules.c
@@ -34,6 +34,8 @@ extern void init_events(void);
 extern void inituuid(void);
 extern void init_net(void);
 extern void initecho(void);
+extern void initdfs(void);
+extern void initdrsuapi(void);
 extern void initwinreg(void);
 extern void initepmapper(void);
 extern void initinitshutdown(void);
@@ -45,6 +47,7 @@ static void initdcerpc_security(void) {}
 extern void initlsa(void);
 extern void initsvcctl(void);
 extern void initwkssvc(void);
+extern void initunixinfo(void);
 extern void init_libcli_nbt(void);
 extern void init_libcli_smb(void);
 
diff --git a/source4/scripting/python/pyrpc.h b/source4/scripting/python/pyrpc.h
index 3a5d235cfc..f4d0f37c39 100644
--- a/source4/scripting/python/pyrpc.h
+++ b/source4/scripting/python/pyrpc.h
@@ -26,7 +26,7 @@
 #define dom_sid2_Type dom_sid_Type
 #define dom_sid28_Type dom_sid_Type
 #define dom_sid2_Check dom_sid_Check
-#define dom_sid28_Check dom_sid28_Check
+#define dom_sid28_Check dom_sid_Check
 
 /* This macro is only provided by Python >= 2.3 */
 #ifndef PyAPI_DATA
diff --git a/source4/scripting/python/samba/getopt.py b/source4/scripting/python/samba/getopt.py
index 088a5acf6f..82cb004b62 100644
--- a/source4/scripting/python/samba/getopt.py
+++ b/source4/scripting/python/samba/getopt.py
@@ -18,7 +18,7 @@
 #
 
 import optparse
-from credentials import Credentials
+from credentials import Credentials, AUTO_USE_KERBEROS, DONT_USE_KERBEROS, MUST_USE_KERBEROS
 
 class SambaOptions(optparse.OptionGroup):
     def __init__(self, parser):
@@ -65,6 +65,9 @@ class CredentialsOptions(optparse.OptionGroup):
                         help="Workgroup", callback=self._parse_workgroup)
         self.add_option("-N", "--no-pass", action="store_true",
                         help="Don't ask for a password")
+        self.add_option("-k", "--kerberos", metavar="KERBEROS", 
+                        action="callback", type=str,
+                        help="Use Kerberos", callback=self._set_kerberos)
         self.creds = Credentials()
 
     def _parse_username(self, option, opt_str, arg, parser):
@@ -76,11 +79,17 @@ class CredentialsOptions(optparse.OptionGroup):
     def _set_password(self, option, opt_str, arg, parser):
         self.creds.set_password(arg)
 
+    def _set_kerberos(self, option, opt_str, arg, parser):
+        if bool(arg) or arg.lower() == "yes":
+            self.creds.set_kerberos_state(MUST_USE_KERBEROS)
+        else:
+            self.creds.set_kerberos_state(DONT_USE_KERBEROS)
+
     def _set_simple_bind_dn(self, option, opt_str, arg, parser):
         self.creds.set_bind_dn(arg)
 
-    def get_credentials(self):
-        self.creds.guess()
+    def get_credentials(self, lp):
+        self.creds.guess(lp)
         if not self.no_pass:
             self.creds.set_cmdline_callbacks()
         return self.creds
diff --git a/source4/scripting/python/samba/idmap.py b/source4/scripting/python/samba/idmap.py
new file mode 100644
index 0000000000..355565968a
--- /dev/null
+++ b/source4/scripting/python/samba/idmap.py
@@ -0,0 +1,73 @@
+#!/usr/bin/python
+
+# Unix SMB/CIFS implementation.
+# Copyright (C) 2008 Kai Blin <kai@samba.org>
+#
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""Convenience functions for using the idmap database."""
+
+import samba
+import ldb
+
+class IDmapDB(samba.Ldb):
+    """The IDmap database."""
+
+    # Mappings for ID_TYPE_UID, ID_TYPE_GID and ID_TYPE_BOTH
+    TYPE_UID = 1
+    TYPE_GID = 2
+    TYPE_BOTH = 3
+
+    def __init__(self, url=None, session_info=None, credentials=None,
+                 modules_dir=None, lp=None):
+        """Open the IDmap Database.
+
+        :param url: URL of the database.
+        """
+        super(IDmapDB, self).__init__(session_info=session_info, credentials=credentials,
+                                    modules_dir=modules_dir, lp=lp)
+        if url:
+            self.connect(url)
+
+
+    def setup_name_mapping(self, sid, type, unixid):
+        """Setup a mapping between a sam name and a unix name.
+
+        :param sid: SID of the NT-side of the mapping.
+        :param unixname: Unix name to map to.
+        """
+        type_string = ""
+        if type == self.TYPE_UID:
+            type_string = "ID_TYPE_UID"
+        elif type == self.TYPE_GID:
+            type_string = "ID_TYPE_GID"
+        elif type == self.TYPE_BOTH:
+            type_string = "ID_TYPE_BOTH"
+        else:
+            return
+
+        mod = """
+dn: CN=%s
+xidNumber: %s
+objectSid: %s
+objectClass: sidMap
+type: %s
+cn: %s
+
+""" % (sid, unixid, sid, type_string, sid)
+        self.add(self.parse_ldif(mod).next()[1])
+
+
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index d5e66d842c..6917aa1a54 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -28,13 +28,14 @@ import pwd
 import grp
 import time
 import uuid, misc
-from socket import gethostname, gethostbyname
+import socket
 import param
 import registry
 import samba
 from auth import system_session
 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
 from samba.samdb import SamDB
+from samba.idmap import IDmapDB
 import security
 import urllib
 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
@@ -267,7 +268,7 @@ def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=
               rootdn=None, domaindn=None, configdn=None, schemadn=None, sitename=None):
 
     if hostname is None:
-        hostname = gethostname().split(".")[0].lower()
+        hostname = socket.gethostname().split(".")[0].lower()
 
     netbiosname = hostname.upper()
     if not valid_netbios_name(netbiosname):
@@ -348,7 +349,7 @@ def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrol
 
     if not os.path.exists(smbconf):
         if hostname is None:
-            hostname = gethostname().split(".")[0].lower()
+            hostname = socket.gethostname().split(".")[0].lower()
 
         if serverrole is None:
             serverrole = "standalone"
@@ -397,45 +398,30 @@ def load_or_make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrol
 
     return lp
 
-def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users, 
-                        wheel, backup):
+def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
+                        users_gid, wheel_gid):
     """setup reasonable name mappings for sam names to unix names.
-    
-    :param ldb: SamDB object.
+
+    :param samdb: SamDB object.
+    :param idmap: IDmap db object.
     :param sid: The domain sid.
     :param domaindn: The domain DN.
-    :param root: Name of the UNIX root user.
-    :param nobody: Name of the UNIX nobody user.
-    :param nogroup: Name of the unix nobody group.
-    :param users: Name of the unix users group.
-    :param wheel: Name of the wheel group (users that can become root).
-    :param backup: Name of the backup group."""
+    :param root_uid: uid of the UNIX root user.
+    :param nobody_uid: uid of the UNIX nobody user.
+    :param users_gid: gid of the UNIX users group.
+    :param wheel_gid: gid of the UNIX wheel group."""
     # add some foreign sids if they are not present already
-    ldb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
-    ldb.add_foreign(domaindn, "S-1-1-0", "World")
-    ldb.add_foreign(domaindn, "S-1-5-2", "Network")
-    ldb.add_foreign(domaindn, "S-1-5-18", "System")
-    ldb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
-
-    # some well known sids
-    ldb.setup_name_mapping(domaindn, "S-1-5-7", nobody)
-    ldb.setup_name_mapping(domaindn, "S-1-1-0", nogroup)
-    ldb.setup_name_mapping(domaindn, "S-1-5-2", nogroup)
-    ldb.setup_name_mapping(domaindn, "S-1-5-18", root)
-    ldb.setup_name_mapping(domaindn, "S-1-5-11", users)
-    ldb.setup_name_mapping(domaindn, "S-1-5-32-544", wheel)
-    ldb.setup_name_mapping(domaindn, "S-1-5-32-545", users)
-    ldb.setup_name_mapping(domaindn, "S-1-5-32-546", nogroup)
-    ldb.setup_name_mapping(domaindn, "S-1-5-32-551", backup)
-
-    # and some well known domain rids
-    ldb.setup_name_mapping(domaindn, sid + "-500", root)
-    ldb.setup_name_mapping(domaindn, sid + "-518", wheel)
-    ldb.setup_name_mapping(domaindn, sid + "-519", wheel)
-    ldb.setup_name_mapping(domaindn, sid + "-512", wheel)
-    ldb.setup_name_mapping(domaindn, sid + "-513", users)
-    ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
+    samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
+    samdb.add_foreign(domaindn, "S-1-1-0", "World")
+    samdb.add_foreign(domaindn, "S-1-5-2", "Network")
+    samdb.add_foreign(domaindn, "S-1-5-18", "System")
+    samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
+
+    idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
+    idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
 
+    idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
+    idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
 
 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
                            credentials, names,
@@ -663,8 +649,8 @@ def setup_idmapdb(path, setup_path, session_info, credentials, lp):
     if os.path.exists(path):
         os.unlink(path)
 
-    idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
-                    lp=lp)
+    idmap_ldb = IDmapDB(path, session_info=session_info,
+                        credentials=credentials, lp=lp)
 
     idmap_ldb.erase()
     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
@@ -695,13 +681,8 @@ def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
 def setup_self_join(samdb, names,
                     machinepass, dnspass, 
                     domainsid, invocationid, setup_path,
-                    policyguid, hostguid=None):
+                    policyguid):
     """Join a host to its own domain."""
-    if hostguid is not None:
-        hostguid_add = "objectGUID: %s" % hostguid
-    else:
-        hostguid_add = ""
-
     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
               "CONFIGDN": names.configdn, 
               "SCHEMADN": names.schemadn,
@@ -714,7 +695,6 @@ def setup_self_join(samdb, names,
               "DNSPASS_B64": b64encode(dnspass),
               "REALM": names.realm,
               "DOMAIN": names.domain,
-              "HOSTGUID_ADD": hostguid_add,
               "DNSDOMAIN": names.dnsdomain})
     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), { 
               "POLICYGUID": policyguid,
@@ -727,7 +707,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
                 names, message, 
                 domainsid, aci, domainguid, policyguid, 
                 fill, adminpass, krbtgtpass, 
-                machinepass, hostguid, invocationid, dnspass,
+                machinepass, invocationid, dnspass,
                 serverrole, ldap_backend=None, 
                 ldap_backend_type=None):
     """Setup a complete SAM Database.
@@ -880,7 +860,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
                                 dnspass=dnspass,  
                                 machinepass=machinepass, 
                                 domainsid=domainsid, policyguid=policyguid,
-                                hostguid=hostguid, 
                                 setup_path=setup_path)
 
     #We want to setup the index last, as adds are faster unindexed
@@ -901,8 +880,8 @@ FILL_DRS = "DRS"
 def provision(setup_dir, message, session_info, 
               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
               rootdn=None, domaindn=None, schemadn=None, configdn=None,
-              domain=None, hostname=None, hostip=None, domainsid=None, 
-              hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
+              domain=None, hostname=None, hostip=None, hostip6=None, 
+              domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
               policyguid=None, invocationid=None, machinepass=None, 
               dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
               wheel=None, backup=None, aci=None, serverrole=None, 
@@ -931,18 +910,21 @@ def provision(setup_dir, message, session_info,
     if dnspass is None:
         dnspass = misc.random_password(12)
     if root is None:
-        root = findnss(pwd.getpwnam, ["root"])[0]
+        root_uid = findnss(pwd.getpwnam, ["root"])[2]
+    else:
+        root_uid = findnss(pwd.getpwnam, [root])[2]
     if nobody is None:
-        nobody = findnss(pwd.getpwnam, ["nobody"])[0]
-    if nogroup is None:
-        nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
+        nobody_uid = findnss(pwd.getpwnam, ["nobody"])[2]
+    else:
+        nobody_uid = findnss(pwd.getpwnam, [nobody])[2]
     if users is None:
-        users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
-                        "usr"])[0]
+        users_gid = findnss(grp.getgrnam, ["users"])[2]
+    else:
+        users_gid = findnss(grp.getgrnam, [users])[2]
     if wheel is None:
-        wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
-    if backup is None:
-        backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
+        wheel_gid = findnss(grp.getgrnam, ["wheel", "adm"])[2]
+    else:
+        wheel_gid = findnss(grp.getgrnam, [wheel])[2]
     if aci is None:
         aci = "# no aci for local ldb"
 
@@ -955,7 +937,12 @@ def provision(setup_dir, message, session_info,
     paths = provision_paths_from_lp(lp, names.dnsdomain)
 
     if hostip is None:
-        hostip = gethostbyname(names.hostname)
+        hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+
+    if hostip6 is None:
+        try:
+            hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+        except socket.gaierror: pass
 
     if serverrole is None:
         serverrole = lp.get("server role")
@@ -974,10 +961,6 @@ def provision(setup_dir, message, session_info,
             # provision-backend will set this path suggested slapd command line / fedorads.inf
             ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
              
-    message("set DOMAIN SID: %s" % str(domainsid))
-    message("Provisioning for %s in realm %s" % (names.domain, realm))
-    message("Using administrator password: %s" % adminpass)
-
     # only install a new shares config db if there is none
     if not os.path.exists(paths.shareconf):
         message("Setting up share.ldb")
@@ -1000,8 +983,8 @@ def provision(setup_dir, message, session_info,
                       credentials=credentials, lp=lp)
 
     message("Setting up idmap db")
-    setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
-                  credentials=credentials, lp=lp)
+    idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
+                          credentials=credentials, lp=lp)
 
     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
                         credentials=credentials, lp=lp, names=names,
@@ -1010,7 +993,7 @@ def provision(setup_dir, message, session_info,
                         aci=aci, domainguid=domainguid, policyguid=policyguid, 
                         fill=samdb_fill, 
                         adminpass=adminpass, krbtgtpass=krbtgtpass,
-                        hostguid=hostguid, invocationid=invocationid, 
+                        invocationid=invocationid, 
                         machinepass=machinepass, dnspass=dnspass,
                         serverrole=serverrole, ldap_backend=ldap_backend, 
                         ldap_backend_type=ldap_backend_type)
@@ -1032,10 +1015,10 @@ def provision(setup_dir, message, session_info,
                            machinepass=machinepass, dnsdomain=names.dnsdomain)
 
     if samdb_fill == FILL_FULL:
-        setup_name_mappings(samdb, str(domainsid), names.domaindn, root=root, 
-                            nobody=nobody, nogroup=nogroup, wheel=wheel, 
-                            users=users, backup=backup)
-   
+        setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
+                            root_uid=root_uid, nobody_uid=nobody_uid,
+                            users_gid=users_gid, wheel_gid=wheel_gid)
+
         message("Setting up sam.ldb rootDSE marking as synchronized")
         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
 
@@ -1051,19 +1034,26 @@ def provision(setup_dir, message, session_info,
                                        scope=SCOPE_SUBTREE)
             assert isinstance(hostguid, str)
             
-            message("Setting up DNS zone: %s" % names.dnsdomain)
             create_zone_file(paths.dns, setup_path, samdb, 
-                             hostname=names.hostname, hostip=hostip, dnsdomain=names.dnsdomain,
+                             hostname=names.hostname, hostip=hostip,
+                             hostip6=hostip6, dnsdomain=names.dnsdomain,
                              domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
                              domainguid=domainguid, hostguid=hostguid)
             message("Please install the zone located in %s into your DNS server" % paths.dns)
             
-    message("Setting up phpLDAPadmin configuration")
     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
                                ldapi_url)
 
     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
 
+    message("Once the above files are installed, your server will be ready to use")
+    message("Server Type:    %s" % serverrole)
+    message("Hostname:       %s" % names.hostname)
+    message("NetBIOS Domain: %s" % names.domain)
+    message("DNS Domain:     %s" % names.dnsdomain)
+    message("DOMAIN SID:     %s" % str(domainsid))
+    message("Admin password: %s" % adminpass)
+
     result = ProvisionResult()
     result.domaindn = domaindn
     result.paths = paths
@@ -1075,7 +1065,7 @@ def provision_become_dc(setup_dir=None,
                         smbconf=None, targetdir=None, realm=None, 
                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
                         domain=None, hostname=None, domainsid=None, 
-                        hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
+                        adminpass=None, krbtgtpass=None, domainguid=None, 
                         policyguid=None, invocationid=None, machinepass=None, 
                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
                         wheel=None, backup=None, aci=None, serverrole=None, 
@@ -1112,7 +1102,7 @@ def provision_backend(setup_dir=None, message=None,
         return os.path.join(setup_dir, file)
 
     if hostname is None:
-        hostname = gethostname().split(".")[0].lower()
+        hostname = socket.gethostname().split(".")[0].lower()
 
     if root is None:
         root = findnss(pwd.getpwnam, ["root"])[0]
@@ -1245,7 +1235,7 @@ def create_phpldapadmin_config(path, setup_path, ldapi_uri):
 
 
 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
-                  hostip, hostname, dnspass, realm, domainguid, hostguid):
+                  hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
     """Write out a DNS zone file, from the info in the current database.
     
     :param path: Path of the new file.
@@ -1253,7 +1243,8 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
     :param samdb: SamDB object
     :param dnsdomain: DNS Domain name
     :param domaindn: DN of the Domain
-    :param hostip: Local IP
+    :param hostip: Local IPv4 IP
+    :param hostip6: Local IPv6 IP
     :param hostname: Local hostname
     :param dnspass: Password for DNS
     :param realm: Realm name
@@ -1262,6 +1253,13 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
     """
     assert isinstance(domainguid, str)
 
+    hostip6_base_line = ""
+    hostip6_host_line = ""
+
+    if hostip6 is not None:
+        hostip6_base_line = "			IN AAAA	" + hostip6
+        hostip6_host_line = hostname + "		IN AAAA	" + hostip6
+
     setup_file(setup_path("provision.zone"), path, {
             "DNSPASS_B64": b64encode(dnspass),
             "HOSTNAME": hostname,
@@ -1272,6 +1270,8 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
             "DATESTRING": time.strftime("%Y%m%d%H"),
             "DEFAULTSITE": DEFAULTSITE,
             "HOSTGUID": hostguid,
+            "HOSTIP6_BASE_LINE": hostip6_base_line,
+            "HOSTIP6_HOST_LINE": hostip6_host_line,
         })
 
 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
diff --git a/source4/scripting/python/samba/samdb.py b/source4/scripting/python/samba/samdb.py
index 3c6bb23c02..bc3eef7879 100644
--- a/source4/scripting/python/samba/samdb.py
+++ b/source4/scripting/python/samba/samdb.py
@@ -53,34 +53,20 @@ description: %s
         for msg in self.parse_ldif(add):
             self.add(msg[1])
 
-    def setup_name_mapping(self, domaindn, sid, unixname):
-        """Setup a mapping between a sam name and a unix name.
-        
-        :param domaindn: DN of the domain.
-        :param sid: SID of the NT-side of the mapping.
-        :param unixname: Unix name to map to.
-        """
-        res = self.search(domaindn, ldb.SCOPE_SUBTREE, 
-                         "objectSid=%s" % sid, ["dn"])
-        assert len(res) == 1, "Failed to find record for objectSid %s" % sid
-
-        mod = """
-dn: %s
-changetype: modify
-replace: unixName
-unixName: %s
-""" % (res[0].dn, unixname)
-        self.modify(self.parse_ldif(mod).next()[1])
-
     def enable_account(self, user_dn):
         """Enable an account.
         
         :param user_dn: Dn of the account to enable.
         """
-        res = self.search(user_dn, SCOPE_ONELEVEL, None, ["userAccountControl"])
+        res = self.search(user_dn, ldb.SCOPE_BASE, None, ["userAccountControl"])
         assert len(res) == 1
-        userAccountControl = res[0].userAccountControl
-        userAccountControl = userAccountControl - 2 # remove disabled bit
+        userAccountControl = res[0]["userAccountControl"][0]
+        userAccountControl = int(userAccountControl)
+        if (userAccountControl & 0x2):
+            userAccountControl = userAccountControl & ~0x2 # remove disabled bit
+        if (userAccountControl & 0x20):
+            userAccountControl = userAccountControl & ~0x20 # remove 'no password required' bit
+
         mod = """
 dn: %s
 changetype: modify
@@ -103,13 +89,9 @@ userAccountControl: %u
         res = self.search("", scope=ldb.SCOPE_BASE, 
                           expression="(defaultNamingContext=*)", 
                           attrs=["defaultNamingContext"])
-        assert(len(res) == 1 and res[0].defaultNamingContext is not None)
+        assert(len(res) == 1 and res[0]["defaultNamingContext"] is not None)
         domain_dn = res[0]["defaultNamingContext"][0]
         assert(domain_dn is not None)
-        dom_users = self.searchone(basedn=domain_dn, attribute="dn", 
-                                   expression="name=Domain Users")
-        assert(dom_users is not None)
-
         user_dn = "CN=%s,CN=Users,%s" % (username, domain_dn)
 
         #
@@ -123,19 +105,44 @@ userAccountControl: %u
             "sambaPassword": password,
             "objectClass": "user"})
 
-        #  add the user to the users group as well
-        modgroup = """
+        #  modify the userAccountControl to remove the disabled bit
+        self.enable_account(user_dn)
+        self.transaction_commit()
+
+    def setpassword(self, filter, password):
+        """Set a password on a user record
+        
+        :param filter: LDAP filter to find the user (eg samccountname=name)
+        :param password: Password for the user
+        """
+        # connect to the sam 
+        self.transaction_start()
+
+        # find the DNs for the domain
+        res = self.search("", scope=ldb.SCOPE_BASE, 
+                          expression="(defaultNamingContext=*)", 
+                          attrs=["defaultNamingContext"])
+        assert(len(res) == 1 and res[0]["defaultNamingContext"] is not None)
+        domain_dn = res[0]["defaultNamingContext"][0]
+        assert(domain_dn is not None)
+
+        res = self.search(domain_dn, scope=ldb.SCOPE_SUBTREE, 
+                          expression=filter,
+                          attrs=[])
+        assert(len(res) == 1)
+        user_dn = res[0].dn
+
+        setpw = """
 dn: %s
 changetype: modify
-add: member
-member: %s
-""" % (dom_users, user_dn)
-
+replace: sambaPassword
+sambaPassword: %s
+""" % (user_dn, password)
 
-        self.modify(modgroup)
+        self.modify_ldif(setpw)
 
         #  modify the userAccountControl to remove the disabled bit
-        enable_account(self, user_dn)
+        self.enable_account(user_dn)
         self.transaction_commit()
 
     def set_domain_sid(self, sid):
diff --git a/source4/scripting/python/samba/tests/dcerpc/unix.py b/source4/scripting/python/samba/tests/dcerpc/unix.py
new file mode 100644
index 0000000000..99c84c08da
--- /dev/null
+++ b/source4/scripting/python/samba/tests/dcerpc/unix.py
@@ -0,0 +1,30 @@
+#!/usr/bin/python
+
+# Unix SMB/CIFS implementation.
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2008
+#   
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#   
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#   
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import unixinfo
+import unittest
+from samba.tests import get_loadparm
+
+class UnixinfoTests(unittest.TestCase):
+    def setUp(self):
+        self.conn = unixinfo.unixinfo("ncalrpc:", get_loadparm())
+
+    def test_getpwuid(self):
+        (count, infos) = self.conn.GetPWUid(1, [0])
+        self.assertEquals(1, len(infos))
diff --git a/source4/scripting/python/samba/tests/samdb.py b/source4/scripting/python/samba/tests/samdb.py
index 40e56bebb5..3745dba6fc 100644
--- a/source4/scripting/python/samba/tests/samdb.py
+++ b/source4/scripting/python/samba/tests/samdb.py
@@ -38,6 +38,7 @@ class SamDBTestCase(TestCaseInTempDir):
         policyguid = uuid.random()
         setup_path = lambda x: os.path.join("setup", x)
         creds = Credentials()
+        creds.set_anonymous()
         domainsid = security.random_sid()
         hostguid = uuid.random()
         path = os.path.join(self.tempdir, "samdb.ldb")
diff --git a/source4/scripting/python/subunit/__init__.py b/source4/scripting/python/subunit/__init__.py
index 3abfbf522e..ac3d0c3a40 100644
--- a/source4/scripting/python/subunit/__init__.py
+++ b/source4/scripting/python/subunit/__init__.py
@@ -5,7 +5,7 @@
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation; either version 2 of the License, or
+#  the Free Software Foundation; either version 3 of the License, or
 #  (at your option) any later version.
 #
 #  This program is distributed in the hope that it will be useful,
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index 8102095958..7e545664d1 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -266,7 +266,7 @@ fi
 bbdir=$incdir/../../testprogs/blackbox
 
 plantest "blackbox.smbclient" dc $bbdir/test_smbclient.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$DOMAIN" "$PREFIX" 
-plantest "blackbox.kinit" dc $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" 
+plantest "blackbox.kinit" dc $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" $CONFIGURATION 
 plantest "blackbox.cifsdd" dc $bbdir/test_cifsdd.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$DOMAIN" 
 plantest "blackbox.nmblookup" dc $samba4srcdir/utils/tests/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP" 
 plantest "blackbox.nmblookup" member $samba4srcdir/utils/tests/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP"
@@ -338,6 +338,7 @@ plantest "provision.python" none $SUBUNITRUN samba.tests.provision
 plantest "samba3.python" none $SUBUNITRUN samba.tests.samba3
 plantest "samr.python" dc $SUBUNITRUN samba.tests.dcerpc.sam
 plantest "samdb.python" dc $SUBUNITRUN samba.tests.samdb
+plantest "unixinfo.python" dc $SUBUNITRUN samba.tests.dcerpc.unix
 plantest "events.python" none PYTHONPATH="$PYTHONPATH:lib/events" $SUBUNITRUN tests
 plantest "samba3sam.python" none PYTHONPATH="$PYTHONPATH:dsdb/samdb/ldb_modules/tests" $SUBUNITRUN samba3sam
 plantest "rpcecho.python" dc $SUBUNITRUN samba.tests.dcerpc.rpcecho
diff --git a/source4/selftest/test_win.sh b/source4/selftest/test_win.sh
index 960bd20ded..bc40620af5 100755
--- a/source4/selftest/test_win.sh
+++ b/source4/selftest/test_win.sh
@@ -5,7 +5,7 @@
 # run the test,
 # and remove the previously configured directory and share.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 . selftest/test_functions.sh
 
diff --git a/source4/selftest/win/VMHost.pm b/source4/selftest/win/VMHost.pm
index 359d8df315..1f02f21c28 100644
--- a/source4/selftest/win/VMHost.pm
+++ b/source4/selftest/win/VMHost.pm
@@ -3,7 +3,7 @@
 # A perl object to provide a simple, unified method of handling some
 # VMware Server VM management functions using the perl and VIX API's.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 # VMware Perl API
 use VMware::VmPerl;
diff --git a/source4/selftest/win/common.exp b/source4/selftest/win/common.exp
index a7ba95d722..28a3d7a6a1 100644
--- a/source4/selftest/win/common.exp
+++ b/source4/selftest/win/common.exp
@@ -1,6 +1,6 @@
 # A library of commonly used functions written in expect.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 # This function maps a drive letter to a share point.
 proc map_share { remote_prompt share_drive sharepoint username domain password } {
diff --git a/source4/selftest/win/vm_get_ip.pl b/source4/selftest/win/vm_get_ip.pl
index 9286786155..9657a34790 100644
--- a/source4/selftest/win/vm_get_ip.pl
+++ b/source4/selftest/win/vm_get_ip.pl
@@ -2,7 +2,7 @@
 
 # A perl script to connect to a VMware server and get the IP address of a VM.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 use VMHost;
 
diff --git a/source4/selftest/win/vm_load_snapshot.pl b/source4/selftest/win/vm_load_snapshot.pl
index e8ba9b39cf..35e80badce 100644
--- a/source4/selftest/win/vm_load_snapshot.pl
+++ b/source4/selftest/win/vm_load_snapshot.pl
@@ -2,7 +2,7 @@
 
 # A perl script to connect to a VMware server and revert a VM snapshot.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 use VMHost;
 
diff --git a/source4/selftest/win/wintest_client.exp b/source4/selftest/win/wintest_client.exp
index 5b45eb2bb0..ccf5d06ea9 100644
--- a/source4/selftest/win/wintest_client.exp
+++ b/source4/selftest/win/wintest_client.exp
@@ -1,7 +1,7 @@
 # An expect script to create a temporary file, map a share, copy the file to the share,
 # and compare the contents of the two files.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 proc run_test { remote_prompt tmp_filename share_drive host_drive buildhost_ip buildhost_share username domain password } {
 
diff --git a/source4/selftest/win/wintest_remove.exp b/source4/selftest/win/wintest_remove.exp
index a361db2958..36dc4a7d24 100644
--- a/source4/selftest/win/wintest_remove.exp
+++ b/source4/selftest/win/wintest_remove.exp
@@ -1,7 +1,7 @@
 # An expect script to remove a directory and share which was
 # previously setup for an smbtorture test.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 proc remove_test { remote_prompt sharepath sharename hosts_file_path \
 			backup_hosts_filename } {
diff --git a/source4/selftest/win/wintest_setup.exp b/source4/selftest/win/wintest_setup.exp
index 1dcbabb488..f55732ac00 100644
--- a/source4/selftest/win/wintest_setup.exp
+++ b/source4/selftest/win/wintest_setup.exp
@@ -1,6 +1,6 @@
 # An expect script to setup a directory and share for an smbtorture test.
 # Copyright Brad Henry <brad@samba.org> 2006
-# Released under the GNU GPL v2 or later.
+# Released under the GNU GPL version 3 or later.
 
 proc setup_test { remote_prompt sharepath sharename username local_hostname \
 			local_ip hosts_file_path backup_hosts_filename } {
diff --git a/source4/setup/enableaccount b/source4/setup/enableaccount
new file mode 100644
index 0000000000..849b515675
--- /dev/null
+++ b/source4/setup/enableaccount
@@ -0,0 +1,75 @@
+#!/usr/bin/python
+#
+#	add a new user to a Samba4 server
+#	Copyright Andrew Tridgell 2005
+#	Copyright Jelmer Vernooij 2008
+#	Released under the GNU GPL version 3 or later
+#
+
+import samba.getopt as options
+import optparse
+import pwd
+import sys
+import ldb
+
+from auth import system_session
+from samba.samdb import SamDB
+
+parser = optparse.OptionParser("setpassword [username] [options]")
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+parser.add_option("-H", help="LDB URL for database or target server", type=str)
+parser.add_option("--base", help="Base DN to search for user under", type=str)
+
+opts, args = parser.parse_args()
+
+#
+#  print a message if quiet is not set
+#
+def message(text):
+	if not opts.quiet:
+		print text
+
+if len(args) == 0:
+	parser.print_usage()
+	sys.exit(1)
+
+username = args[0]
+
+if username is None:
+	print "username must be specified"
+
+lp = sambaopts.get_loadparm()
+
+creds = credopts.get_credentials(lp)
+
+if opts.H is not None:
+	url = opts.H
+else:
+	url = lp.get("sam database")
+
+samdb = SamDB(url=url, session_info=system_session(), 
+              credentials=creds, lp=lp)
+
+domain_dn = opts.base
+if opts.base is None:
+	res = samdb.search("", scope=ldb.SCOPE_BASE, 
+			  expression="(defaultNamingContext=*)", 
+			  attrs=["defaultNamingContext"])
+	assert(len(res) == 1 and res[0]["defaultNamingContext"] is not None)
+	domain_dn = res[0]["defaultNamingContext"][0]
+else:
+	domain_dn = opts.base
+
+filter = "(&(objectClass=user)(samAccountName=%s))" % username
+
+res = samdb.search(domain_dn, scope=ldb.SCOPE_SUBTREE, 
+		  expression=filter,
+		  attrs=[])
+assert(len(res) == 1)
+user_dn = res[0].dn
+
+samdb.enable_account(user_dn)
diff --git a/source4/setup/newuser b/source4/setup/newuser
index 03ae4e5ffb..f622058a5d 100755
--- a/source4/setup/newuser
+++ b/source4/setup/newuser
@@ -3,14 +3,14 @@
 #	add a new user to a Samba4 server
 #	Copyright Andrew Tridgell 2005
 #	Copyright Jelmer Vernooij 2008
-#	Released under the GNU GPL v2 or later
+#	Released under the GNU GPL version 3 or later
 #
 
 import samba.getopt as options
 import optparse
 import pwd
 import sys
-
+from getpass import getpass
 from auth import system_session
 from samba.samdb import SamDB
 
@@ -40,9 +40,7 @@ username = args[0]
 if len(args) > 1:
 	password = args[1]
 else:
-	random_init(local)
-	options.password = randpass(12)
-	print "chose random password %s\n" % password
+	password = getpass("New Password: ")
 
 if opts.unixname is None:
 	opts.unixname = username
diff --git a/source4/setup/provision b/source4/setup/provision
index b0363d8a8f..259bd814a4 100755
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -52,14 +52,14 @@ parser.add_option("--domain-sid", type="string", metavar="SID",
 		help="set domainsid (otherwise random)")
 parser.add_option("--policy-guid", type="string", metavar="GUID",
 				  help="set policy guid")
+parser.add_option("--invocationid", type="string", metavar="GUID", 
+		  help="set invocationid (otherwise random)")
 parser.add_option("--host-name", type="string", metavar="HOSTNAME", 
 		help="set hostname")
 parser.add_option("--host-ip", type="string", metavar="IPADDRESS", 
-		help="set ipaddress")
-parser.add_option("--host-guid", type="string", metavar="GUID", 
-		help="set hostguid (otherwise random)")
-parser.add_option("--invocationid", type="string", metavar="GUID", 
-		help="set invocationid (otherwise random)")
+		help="set IPv4 ipaddress")
+parser.add_option("--host-ip6", type="string", metavar="IP6ADDRESS", 
+		help="set IPv6 ipaddress")
 parser.add_option("--adminpass", type="string", metavar="PASSWORD", 
 		help="choose admin password (otherwise random)")
 parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD", 
@@ -111,7 +111,8 @@ if opts.realm is None or opts.domain is None:
 	parser.print_usage()
 	sys.exit(1)
 
-smbconf = sambaopts.get_loadparm().configfile()
+lp = sambaopts.get_loadparm()
+smbconf = lp.configfile()
 
 if opts.aci is not None:
 	print "set ACI: %s" % opts.aci
@@ -123,7 +124,7 @@ elif opts.server_role == "member":
 else:
         server_role = opts.server_role
 
-creds = credopts.get_credentials()
+creds = credopts.get_credentials(lp)
 
 setup_dir = opts.setupdir
 if setup_dir is None:
@@ -140,7 +141,7 @@ provision(setup_dir, message,
           samdb_fill=samdb_fill, realm=opts.realm, domain=opts.domain,
           domainguid=opts.domain_guid, domainsid=opts.domain_sid,
           policyguid=opts.policy_guid, hostname=opts.host_name,
-          hostip=opts.host_ip, hostguid=opts.host_guid, 
+          hostip=opts.host_ip, hostip6=opts.host_ip6,
           invocationid=opts.invocationid, adminpass=opts.adminpass,
           krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
           dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
@@ -148,12 +149,3 @@ provision(setup_dir, message,
           aci=opts.aci, serverrole=server_role, 
           ldap_backend=opts.ldap_backend, 
           ldap_backend_type=opts.ldap_backend_type)
-
-message("To reproduce this provision, run with:")
-def shell_escape(arg):
-    if " " in arg:
-        return '"%s"' % arg
-    return arg
-message(" ".join([shell_escape(arg) for arg in sys.argv]))
-
-message("All OK")
diff --git a/source4/setup/provision-backend.js b/source4/setup/provision-backend.js
index edc09907a8..9482d8c435 100644
--- a/source4/setup/provision-backend.js
+++ b/source4/setup/provision-backend.js
@@ -3,7 +3,7 @@ exec smbscript "$0" ${1+"$@"}
 /*
 	provision a Samba4 server
 	Copyright Andrew Tridgell 2005
-	Released under the GNU GPL v2 or later
+	Released under the GNU GPL version 3 or later
 */
 
 options = GetOptions(ARGV,
diff --git a/source4/setup/provision.zone b/source4/setup/provision.zone
index 371dfd9e72..28c1c29762 100644
--- a/source4/setup/provision.zone
+++ b/source4/setup/provision.zone
@@ -9,8 +9,10 @@ $TTL 1W
                                 6W              ; expiry
                                 1W )            ; minimum
 			IN NS	${HOSTNAME}
+${HOSTIP6_BASE_LINE}
 			IN A	${HOSTIP}
 ;
+${HOSTIP6_HOST_LINE}
 ${HOSTNAME}		IN A	${HOSTIP}
 ${HOSTGUID}._msdcs	IN CNAME ${HOSTNAME}
 ;
diff --git a/source4/setup/provision_self_join.ldif b/source4/setup/provision_self_join.ldif
index 503656a9bf..a0cfa7eb23 100644
--- a/source4/setup/provision_self_join.ldif
+++ b/source4/setup/provision_self_join.ldif
@@ -19,7 +19,6 @@ servicePrincipalName: HOST/${DNSNAME}/${REALM}
 servicePrincipalName: HOST/${NETBIOSNAME}/${REALM}
 servicePrincipalName: HOST/${DNSNAME}/${DOMAIN}
 servicePrincipalName: HOST/${NETBIOSNAME}/${DOMAIN}
-${HOSTGUID_ADD}
 
 #Provide a account for DNS keytab export
 dn: CN=dns,CN=Users,${DOMAINDN}
diff --git a/source4/setup/setpassword b/source4/setup/setpassword
index 618e304077..31b2f73a25 100644
--- a/source4/setup/setpassword
+++ b/source4/setup/setpassword
@@ -1,123 +1,58 @@
-#!/bin/sh
-exec smbscript "$0" ${1+"$@"}
-/*
-	set a user's password on a Samba4 server
-	Copyright Andrew Tridgell 2005
-	Copyright Andrew Bartlett 2006
-	Released under the GNU GPL v2 or later
-*/
-
-options = GetOptions(ARGV,
-		"POPT_AUTOHELP",
-		'username=s',
-		'filter=s',
-		'newpassword=s',
-		"POPT_COMMON_SAMBA",
-		"POPT_COMMON_VERSION",
-		"POPT_COMMON_CREDENTIALS",
-		'quiet');
-
-if (options == undefined) {
-   println("Failed to parse options");
-   return -1;
-}
-
-libinclude("base.js");
-libinclude("provision.js");
-
-/*
-  print a message if quiet is not set
-*/
-function message() 
-{
-	if (options["quiet"] == undefined) {
-		print(vsprintf(arguments));
-	}
-}
-
-/*
- show some help
-*/
-function ShowHelp()
-{
-	print("
-Samba4 newuser
-
-newuser [options]
-  --username     USERNAME     username
-  --filter       LDAPFILTER   LDAP Filter to set password on
-  --newpassword  PASSWORD     set password
-
-You must provide either a filter or a username, as well as password
-");
-	exit(1);
-}
-
-if (options['username'] == undefined && options['filter'] == undefined) {
-	ShowHelp();
-}
-
-if (options['newpassword'] == undefined) {
-	ShowHelp();
-}
-
-	var lp = loadparm_init();
-	var samdb = lp.get("sam database");
-	var ldb = ldb_init();
-	random_init(local);
-	ldb.session_info = system_session();
-	ldb.credentials = options.get_credentials();
-
-	/* connect to the sam */
-	var ok = ldb.connect(samdb);
-	assert(ok);
-
-	ldb.transaction_start();
-
-/* find the DNs for the domain and the domain users group */
-var attrs = new Array("defaultNamingContext");
-var attrs2 = new Array("cn");
-res = ldb.search("defaultNamingContext=*", "", ldb.SCOPE_BASE, attrs);
-assert(res.error == 0);
-assert(res.msgs.length == 1 && res.msgs[0].defaultNamingContext != undefined);
-var domain_dn = res.msgs[0].defaultNamingContext;
-assert(domain_dn != undefined);
-
-if (options['filter'] != undefined) {
-    var res = ldb.search(options['filter'],
-	domain_dn, ldb.SCOPE_SUBTREE, attrs2);
-    if (res.error != 0 || res.msgs.length != 1) {
-	message("Failed to find record for filter %s\n", options['filter']);
-	exit(1);
-    }
-} else {
-    var res = ldb.search(sprintf("samAccountName=%s", options['username']), 
-    domain_dn, ldb.SCOPE_SUBTREE, attrs2);
-    if (res.error != 0 || res.msgs.length != 1) {
-	message("Failed to find record for user %s\n", options['username']);
-	exit(1);
-    }
-}
-
-var mod = sprintf("
-dn: %s
-changetype: modify
-replace: sambaPassword
-sambaPassword: %s
-",
-    res[0].dn, options['newpassword']);
-var ok = ldb.modify(mod);
-if (ok.error != 0) {
-	message("set password for %s failed - %s\n",
-	    res[0].dn, ok.errstr);
-	ldb.transaction_cancel();
-	exit(1);
-} else {
-	message("set password for %s (%s) succeded\n",
-	    res[0].dn, res[0].cn);
-	
-	ldb.transaction_commit();
-}
-
-
-return 0;
+#!/usr/bin/python
+#
+#	add a new user to a Samba4 server
+#	Copyright Andrew Tridgell 2005
+#	Copyright Jelmer Vernooij 2008
+#	Released under the GNU GPL version 3 or later
+#
+
+import samba.getopt as options
+import optparse
+import pwd
+import sys
+from getpass import getpass
+from auth import system_session
+from samba.samdb import SamDB
+
+parser = optparse.OptionParser("setpassword [username] [options]")
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+parser.add_option("--filter", help="LDAP Filter to set password on", type=str)
+parser.add_option("--newpassword", help="Set password", type=str)
+
+opts, args = parser.parse_args()
+
+#
+#  print a message if quiet is not set
+#
+def message(text):
+	if not opts.quiet:
+		print text
+
+if len(args) == 0:
+	parser.print_usage()
+	sys.exit(1)
+
+password = opts.password;
+if password is None:
+	password = getpass("New Password: ")
+
+filter = opts.filter
+
+if filter is None:
+	username = args[0]
+	if username is None:
+		print "Either username or --filter must be specified"
+
+	filter = "(&(objectclass=user)(samAccountName=" + username + "))"
+
+
+creds = credopts.get_credentials()
+
+lp = sambaopts.get_loadparm()
+samdb = SamDB(url=lp.get("sam database"), session_info=system_session(), 
+              credentials=creds, lp=lp)
+samdb.setpassword(filter, password)
diff --git a/source4/setup/upgrade.py b/source4/setup/upgrade.py
index 569b179544..3bcc57ab64 100755
--- a/source4/setup/upgrade.py
+++ b/source4/setup/upgrade.py
@@ -57,7 +57,9 @@ setup_dir = opts.setupdir
 if setup_dir is None:
 	setup_dir = "setup"
 
-creds = credopts.get_credentials()
+lp = sambaopts.get_loadparm()
+smbconf = lp.configfile()
+creds = credopts.get_credentials(lp)
 
 upgrade_provision(samba3, setup_dir, message, credentials=creds, session_info=system_session(), 
-                  smbconf=sambaopts.get_loadparm_path(), targetdir=opts.targetdir)
+                  smbconf=smbconf, targetdir=opts.targetdir)
diff --git a/source4/smb_server/blob.c b/source4/smb_server/blob.c
index 8c813204f3..8834c4483c 100644
--- a/source4/smb_server/blob.c
+++ b/source4/smb_server/blob.c
@@ -24,6 +24,7 @@
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "ntvfs/ntvfs.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "param/param.h"
 
 #define BLOB_CHECK(cmd) do { \
diff --git a/source4/smb_server/smb/nttrans.c b/source4/smb_server/smb/nttrans.c
index 1b49e23511..b31e026946 100644
--- a/source4/smb_server/smb/nttrans.c
+++ b/source4/smb_server/smb/nttrans.c
@@ -25,6 +25,7 @@
 #include "smb_server/smb_server.h"
 #include "ntvfs/ntvfs.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "param/param.h"
 
diff --git a/source4/smb_server/smb/signing.c b/source4/smb_server/smb/signing.c
index 3693579c46..186f5548ab 100644
--- a/source4/smb_server/smb/signing.c
+++ b/source4/smb_server/smb/signing.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "smb_server/smb_server.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "param/param.h"
 
 
diff --git a/source4/smb_server/smb/trans2.c b/source4/smb_server/smb/trans2.c
index 3336169bb0..e5ba814cb2 100644
--- a/source4/smb_server/smb/trans2.c
+++ b/source4/smb_server/smb/trans2.c
@@ -26,6 +26,7 @@
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "ntvfs/ntvfs.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 #define TRANS2_CHECK_ASYNC_STATUS_SIMPLE do { \
 	if (!NT_STATUS_IS_OK(req->ntvfs->async_states->status)) { \
diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c
index 5bbd7f7d5e..e7352f7c42 100644
--- a/source4/smb_server/smb2/negprot.c
+++ b/source4/smb_server/smb2/negprot.c
@@ -22,6 +22,7 @@
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "smb_server/smb_server.h"
@@ -29,6 +30,7 @@
 #include "smb_server/smb2/smb2_server.h"
 #include "smbd/service_stream.h"
 #include "param/param.h"
+#include "librpc/ndr/libndr.h"
 
 static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB *_blob)
 {
diff --git a/source4/smbd/config.mk b/source4/smbd/config.mk
index dc8afeba78..006135f818 100644
--- a/source4/smbd/config.mk
+++ b/source4/smbd/config.mk
@@ -22,7 +22,7 @@ INSTALLDIR = SBINDIR
 PRIVATE_DEPENDENCIES = \
 		process_model \
 		service \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		POPT_SAMBA \
 		PIDFILE \
diff --git a/source4/smbd/process_model.c b/source4/smbd/process_model.c
index e267995596..e631975b37 100644
--- a/source4/smbd/process_model.c
+++ b/source4/smbd/process_model.c
@@ -79,7 +79,7 @@ _PUBLIC_ NTSTATUS register_process_model(const void *_ops)
 	return NT_STATUS_OK;
 }
 
-NTSTATUS process_model_init(struct loadparm_context *lp_ctx)
+_PUBLIC_ NTSTATUS process_model_init(struct loadparm_context *lp_ctx)
 {
 	extern NTSTATUS process_model_standard_init(void);
 	extern NTSTATUS process_model_prefork_init(void);
@@ -98,7 +98,7 @@ NTSTATUS process_model_init(struct loadparm_context *lp_ctx)
 /*
   return the operations structure for a named backend of the specified type
 */
-const struct model_ops *process_model_byname(const char *name)
+_PUBLIC_ const struct model_ops *process_model_byname(const char *name)
 {
 	int i;
 
diff --git a/source4/smbd/process_model.h b/source4/smbd/process_model.h
index 796c8ee17b..b545212091 100644
--- a/source4/smbd/process_model.h
+++ b/source4/smbd/process_model.h
@@ -77,6 +77,9 @@ struct process_model_critical_sizes {
 
 extern const struct model_ops single_ops;
 
-#include "smbd/process_model_proto.h"
+const struct model_ops *process_model_startup(struct event_context *ev, const char *model);
+const struct model_ops *process_model_byname(const char *name);
+NTSTATUS register_process_model(const void *_ops);
+NTSTATUS process_model_init(struct loadparm_context *lp_ctx);
 
 #endif /* __PROCESS_MODEL_H__ */
diff --git a/source4/smbd/process_model.mk b/source4/smbd/process_model.mk
index 638b280564..48899078f7 100644
--- a/source4/smbd/process_model.mk
+++ b/source4/smbd/process_model.mk
@@ -44,6 +44,6 @@ process_model_prefork_OBJ_FILES = smbd/process_prefork.o
 
 [SUBSYSTEM::process_model]
 PRIVATE_PROTO_HEADER = process_model_proto.h
-PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSAMBA-CONFIG
+PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSAMBA-HOSTCONFIG
 
 process_model_OBJ_FILES = smbd/process_model.o
diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index deb44c0a68..820859400e 100644
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -204,9 +204,6 @@ _NORETURN_ static void standard_terminate(struct event_context *ev, const char *
 	   which makes leak checking easier */
 	reload_charcnv(global_loadparm);
 
-	/* the secrets db should really hang off the connection structure */
-	secrets_shutdown();
-
 	talloc_free(ev);
 
 	/* terminate this process */
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index ded84f2426..e1ebd133ce 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -289,7 +289,7 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
 	/* Do *not* remove this, until you have removed
 	 * passdb/secrets.c, and proved that Samba still builds... */
 	/* Setup the SECRETS subsystem */
-	if (!secrets_init(cmdline_lp_ctx)) {
+	if (secrets_init(talloc_autofree_context(), cmdline_lp_ctx) == NULL) {
 		exit(1);
 	}
 
diff --git a/source4/torture/auth/ntlmssp.c b/source4/torture/auth/ntlmssp.c
index f2cc0a9182..9366de986a 100644
--- a/source4/torture/auth/ntlmssp.c
+++ b/source4/torture/auth/ntlmssp.c
@@ -19,6 +19,7 @@
 
 #include "includes.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "lib/cmdline/popt_common.h"
 #include "torture/torture.h"
@@ -141,7 +142,7 @@ static bool torture_ntlmssp_self_check(struct torture_context *tctx)
 	return true;
 }
 
-_PUBLIC_ struct torture_suite *torture_ntlmssp(TALLOC_CTX *mem_ctx)
+struct torture_suite *torture_ntlmssp(TALLOC_CTX *mem_ctx)
 {
 	struct torture_suite *suite = torture_suite_create(mem_ctx, 
 													   "NTLMSSP");
diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index 68bbd3483a..7fdd7e58bf 100644
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -28,6 +28,7 @@
 #include "samba3/samba3.h"
 #include "libcli/security/security.h"
 #include "torture/torture.h"
+#include "auth/session_proto.h"
 
 static bool torture_pac_self_check(struct torture_context *tctx)
 {
@@ -659,7 +660,7 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	return true;
 }
 
-_PUBLIC_ struct torture_suite *torture_pac(TALLOC_CTX *mem_ctx)
+struct torture_suite *torture_pac(TALLOC_CTX *mem_ctx)
 {
 	struct torture_suite *suite = torture_suite_create(mem_ctx, "PAC");
 
diff --git a/source4/torture/basic/aliases.c b/source4/torture/basic/aliases.c
index 660009704b..89146de99d 100644
--- a/source4/torture/basic/aliases.c
+++ b/source4/torture/basic/aliases.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "lib/util/dlinklist.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "torture/torture.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
diff --git a/source4/torture/basic/base.c b/source4/torture/basic/base.c
index 66f9359744..ac71d14116 100644
--- a/source4/torture/basic/base.c
+++ b/source4/torture/basic/base.c
@@ -22,6 +22,7 @@
 #include "torture/torture.h"
 #include "torture/basic/proto.h"
 #include "libcli/libcli.h"
+#include "libcli/raw/raw_proto.h"
 #include "torture/util.h"
 #include "system/filesys.h"
 #include "system/time.h"
diff --git a/source4/torture/basic/delaywrite.c b/source4/torture/basic/delaywrite.c
index 8644c656eb..e3d63c09ec 100644
--- a/source4/torture/basic/delaywrite.c
+++ b/source4/torture/basic/delaywrite.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/basic/delete.c b/source4/torture/basic/delete.c
index 8b84880c06..b71c85aeb8 100644
--- a/source4/torture/basic/delete.c
+++ b/source4/torture/basic/delete.c
@@ -25,6 +25,7 @@
 #include "torture/util.h"
 #include "system/filesys.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 
 #include "torture/raw/proto.h"
 
diff --git a/source4/torture/basic/disconnect.c b/source4/torture/basic/disconnect.c
index 09f54ed6a7..89e05d6839 100644
--- a/source4/torture/basic/disconnect.c
+++ b/source4/torture/basic/disconnect.c
@@ -23,6 +23,7 @@
 #include "torture/torture.h"
 #include "system/filesys.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
diff --git a/source4/torture/basic/misc.c b/source4/torture/basic/misc.c
index d991f117cd..188fc1bc69 100644
--- a/source4/torture/basic/misc.c
+++ b/source4/torture/basic/misc.c
@@ -20,6 +20,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/wait.h"
 #include "system/filesys.h"
diff --git a/source4/torture/basic/scanner.c b/source4/torture/basic/scanner.c
index d462f97da4..6ccd4ba1cc 100644
--- a/source4/torture/basic/scanner.c
+++ b/source4/torture/basic/scanner.c
@@ -22,6 +22,7 @@
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/filesys.h"
 #include "param/param.h"
 
diff --git a/source4/torture/basic/secleak.c b/source4/torture/basic/secleak.c
index d0c048425d..4caeee72a4 100644
--- a/source4/torture/basic/secleak.c
+++ b/source4/torture/basic/secleak.c
@@ -22,10 +22,12 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "system/time.h"
 #include "libcli/smb_composite/smb_composite.h"
+#include "libcli/smb_composite/proto.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
 
diff --git a/source4/torture/config.mk b/source4/torture/config.mk
index 8c61771e9b..7209838d33 100644
--- a/source4/torture/config.mk
+++ b/source4/torture/config.mk
@@ -2,7 +2,7 @@
 [LIBRARY::torture]
 PRIVATE_PROTO_HEADER = proto.h
 PUBLIC_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBTALLOC \
 		LIBPOPT
@@ -263,7 +263,7 @@ MANPAGES += torture/man/smbtorture.1
 [BINARY::gentest]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBPOPT \
 		POPT_SAMBA \
@@ -282,7 +282,7 @@ MANPAGES += torture/man/gentest.1
 [BINARY::masktest]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBPOPT \
 		POPT_SAMBA \
@@ -305,7 +305,7 @@ PRIVATE_DEPENDENCIES = \
 		POPT_CREDENTIALS \
 		LIBSAMBA-UTIL \
 		LIBCLI_SMB \
-		LIBSAMBA-CONFIG
+		LIBSAMBA-HOSTCONFIG
 # End BINARY locktest
 #################################
 
diff --git a/source4/torture/ldap/common.c b/source4/torture/ldap/common.c
index 11b11dcc00..65b02ed5e8 100644
--- a/source4/torture/ldap/common.c
+++ b/source4/torture/ldap/common.c
@@ -21,7 +21,7 @@
 */
 
 #include "includes.h"
-#include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_client.h"
 #include "torture/torture.h"
 #include "torture/ldap/proto.h"
 
@@ -38,7 +38,7 @@ NTSTATUS torture_ldap_bind(struct ldap_connection *conn, const char *userdn, con
 	return status;
 }
 
-_PUBLIC_ NTSTATUS torture_ldap_bind_sasl(struct ldap_connection *conn, 
+NTSTATUS torture_ldap_bind_sasl(struct ldap_connection *conn, 
 				struct cli_credentials *creds, 
 				struct loadparm_context *lp_ctx)
 {
@@ -54,7 +54,7 @@ _PUBLIC_ NTSTATUS torture_ldap_bind_sasl(struct ldap_connection *conn,
 }
 
 /* open a ldap connection to a server */
-_PUBLIC_ NTSTATUS torture_ldap_connection(struct torture_context *tctx, 
+NTSTATUS torture_ldap_connection(struct torture_context *tctx, 
 					  struct ldap_connection **conn, 
 					  const char *url)
 {
diff --git a/source4/torture/rap/rap.c b/source4/torture/rap/rap.c
index edc74ee23e..4b5f4b582c 100644
--- a/source4/torture/rap/rap.c
+++ b/source4/torture/rap/rap.c
@@ -443,7 +443,7 @@ static bool test_netserverenum(struct torture_context *tctx,
 	return true;
 }
 
-_PUBLIC_ NTSTATUS smbcli_rap_netservergetinfo(struct smbcli_tree *tree,
+NTSTATUS smbcli_rap_netservergetinfo(struct smbcli_tree *tree,
 					      struct smb_iconv_convenience *iconv_convenience, 
 				     TALLOC_CTX *mem_ctx,
 				     struct rap_WserverGetInfo *r)
diff --git a/source4/torture/raw/chkpath.c b/source4/torture/raw/chkpath.c
index 7fd74e3cbe..2ed83d308c 100644
--- a/source4/torture/raw/chkpath.c
+++ b/source4/torture/raw/chkpath.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
diff --git a/source4/torture/raw/close.c b/source4/torture/raw/close.c
index 6f139f8530..01175836df 100644
--- a/source4/torture/raw/close.c
+++ b/source4/torture/raw/close.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "system/time.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
diff --git a/source4/torture/raw/context.c b/source4/torture/raw/context.c
index 20135d2fa9..15e736fff5 100644
--- a/source4/torture/raw/context.c
+++ b/source4/torture/raw/context.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "lib/cmdline/popt_common.h"
diff --git a/source4/torture/raw/ioctl.c b/source4/torture/raw/ioctl.c
index c4dd4c5bf2..4cb366f807 100644
--- a/source4/torture/raw/ioctl.c
+++ b/source4/torture/raw/ioctl.c
@@ -22,6 +22,7 @@
 #include "torture/torture.h"
 #include "libcli/raw/ioctl.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
diff --git a/source4/torture/raw/lock.c b/source4/torture/raw/lock.c
index 6eb43bd538..cd8d606795 100644
--- a/source4/torture/raw/lock.c
+++ b/source4/torture/raw/lock.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/raw/lockbench.c b/source4/torture/raw/lockbench.c
index 16e9f0ec75..86030c538a 100644
--- a/source4/torture/raw/lockbench.c
+++ b/source4/torture/raw/lockbench.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/raw/mkdir.c b/source4/torture/raw/mkdir.c
index 93e94150d7..cea959347d 100644
--- a/source4/torture/raw/mkdir.c
+++ b/source4/torture/raw/mkdir.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "param/param.h"
diff --git a/source4/torture/raw/mux.c b/source4/torture/raw/mux.c
index 846a9787cb..5b5db3a557 100644
--- a/source4/torture/raw/mux.c
+++ b/source4/torture/raw/mux.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "system/filesys.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
diff --git a/source4/torture/raw/notify.c b/source4/torture/raw/notify.c
index 2967abdbe3..25c91eb88b 100644
--- a/source4/torture/raw/notify.c
+++ b/source4/torture/raw/notify.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "system/filesys.h"
 #include "torture/util.h"
diff --git a/source4/torture/raw/open.c b/source4/torture/raw/open.c
index 76bc0ca53d..d28a8bd14e 100644
--- a/source4/torture/raw/open.c
+++ b/source4/torture/raw/open.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "librpc/gen_ndr/security.h"
diff --git a/source4/torture/raw/openbench.c b/source4/torture/raw/openbench.c
index e8b2f56813..a5b1434a47 100644
--- a/source4/torture/raw/openbench.c
+++ b/source4/torture/raw/openbench.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/raw/oplock.c b/source4/torture/raw/oplock.c
index 8b2e4fb177..1927a0f027 100644
--- a/source4/torture/raw/oplock.c
+++ b/source4/torture/raw/oplock.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/security.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "lib/events/events.h"
diff --git a/source4/torture/raw/qfileinfo.c b/source4/torture/raw/qfileinfo.c
index 65d803882c..c7673be526 100644
--- a/source4/torture/raw/qfileinfo.c
+++ b/source4/torture/raw/qfileinfo.c
@@ -21,6 +21,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "librpc/rpc/dcerpc.h"
diff --git a/source4/torture/raw/read.c b/source4/torture/raw/read.c
index b052da2d69..c8420c279e 100644
--- a/source4/torture/raw/read.c
+++ b/source4/torture/raw/read.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/raw/samba3misc.c b/source4/torture/raw/samba3misc.c
index 749b10cc07..15a7f6c4a3 100644
--- a/source4/torture/raw/samba3misc.c
+++ b/source4/torture/raw/samba3misc.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/raw/search.c b/source4/torture/raw/search.c
index 725ed261aa..2a6aef20b5 100644
--- a/source4/torture/raw/search.c
+++ b/source4/torture/raw/search.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "system/filesys.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 
@@ -42,7 +43,7 @@ static bool single_search_callback(void *private, const union smb_search_data *f
 /*
   do a single file (non-wildcard) search 
 */
-_PUBLIC_ NTSTATUS torture_single_search(struct smbcli_state *cli, 
+NTSTATUS torture_single_search(struct smbcli_state *cli, 
 			       TALLOC_CTX *tctx,
 			       const char *pattern,
 			       enum smb_search_level level,
diff --git a/source4/torture/raw/setfileinfo.c b/source4/torture/raw/setfileinfo.c
index 90ccde7213..10eaa6710d 100644
--- a/source4/torture/raw/setfileinfo.c
+++ b/source4/torture/raw/setfileinfo.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "system/time.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "torture/raw/proto.h"
diff --git a/source4/torture/raw/unlink.c b/source4/torture/raw/unlink.c
index d34bbeb9a5..ddddeba41b 100644
--- a/source4/torture/raw/unlink.c
+++ b/source4/torture/raw/unlink.c
@@ -21,6 +21,7 @@
 #include "torture/torture.h"
 #include "system/filesys.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/libcli.h"
 #include "torture/util.h"
 #include "param/param.h"
diff --git a/source4/torture/raw/write.c b/source4/torture/raw/write.c
index 98a0dde8c7..5d3628ca86 100644
--- a/source4/torture/raw/write.c
+++ b/source4/torture/raw/write.c
@@ -21,6 +21,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "libcli/libcli.h"
diff --git a/source4/torture/rpc/autoidl.c b/source4/torture/rpc/autoidl.c
index 71965397f6..5ae0201855 100644
--- a/source4/torture/rpc/autoidl.c
+++ b/source4/torture/rpc/autoidl.c
@@ -25,6 +25,7 @@
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "librpc/ndr/ndr_table.h"
 #include "torture/rpc/rpc.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 
 #if 1
diff --git a/source4/torture/rpc/countcalls.c b/source4/torture/rpc/countcalls.c
index f70649d558..205ee1ec86 100644
--- a/source4/torture/rpc/countcalls.c
+++ b/source4/torture/rpc/countcalls.c
@@ -26,6 +26,7 @@
 #include "librpc/ndr/ndr_table.h"
 #include "torture/rpc/rpc.h"
 #include "param/param.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 
 	
diff --git a/source4/torture/rpc/dfs.c b/source4/torture/rpc/dfs.c
index dc2601d86e..9cfdd80578 100644
--- a/source4/torture/rpc/dfs.c
+++ b/source4/torture/rpc/dfs.c
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
diff --git a/source4/torture/rpc/epmapper.c b/source4/torture/rpc/epmapper.c
index 830b77aed9..708d46a5dc 100644
--- a/source4/torture/rpc/epmapper.c
+++ b/source4/torture/rpc/epmapper.c
@@ -22,6 +22,7 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/ndr_epmapper_c.h"
 #include "librpc/ndr/ndr_table.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "torture/rpc/rpc.h"
 
 
diff --git a/source4/torture/rpc/frsapi.c b/source4/torture/rpc/frsapi.c
index a39c91f853..c8e421a674 100644
--- a/source4/torture/rpc/frsapi.c
+++ b/source4/torture/rpc/frsapi.c
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
diff --git a/source4/torture/rpc/mgmt.c b/source4/torture/rpc/mgmt.c
index d4b5fa9c6f..fed432f31c 100644
--- a/source4/torture/rpc/mgmt.c
+++ b/source4/torture/rpc/mgmt.c
@@ -25,6 +25,7 @@
 #include "librpc/ndr/ndr_table.h"
 #include "torture/rpc/rpc.h"
 #include "param/param.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 
 /*
diff --git a/source4/torture/rpc/rpc.h b/source4/torture/rpc/rpc.h
index 385c734d9c..d0a0727787 100644
--- a/source4/torture/rpc/rpc.h
+++ b/source4/torture/rpc/rpc.h
@@ -42,6 +42,48 @@ struct torture_rpc_tcase_data {
 	struct cli_credentials *credentials;
 };
 
+NTSTATUS torture_rpc_connection(struct torture_context *tctx,
+				struct dcerpc_pipe **p, 
+				const struct ndr_interface_table *table);
+
+struct test_join *torture_join_domain(struct torture_context *tctx,
+					       const char *machine_name, 
+				      uint32_t acct_flags,
+				      struct cli_credentials **machine_credentials);
+const struct dom_sid *torture_join_sid(struct test_join *join);
+void torture_leave_domain(struct test_join *join);
+struct torture_rpc_tcase *torture_suite_add_rpc_iface_tcase(struct torture_suite *suite, 
+								const char *name,
+								const struct ndr_interface_table *table);
+
+struct torture_test *torture_rpc_tcase_add_test(
+					struct torture_rpc_tcase *tcase, 
+					const char *name, 
+					bool (*fn) (struct torture_context *, struct dcerpc_pipe *));
+struct torture_rpc_tcase *torture_suite_add_anon_rpc_iface_tcase(struct torture_suite *suite, 
+								const char *name,
+								const struct ndr_interface_table *table);
+
+struct torture_test *torture_rpc_tcase_add_test_ex(
+					struct torture_rpc_tcase *tcase, 
+					const char *name, 
+					bool (*fn) (struct torture_context *, struct dcerpc_pipe *,
+								void *),
+					void *userdata);
+struct torture_rpc_tcase *torture_suite_add_machine_rpc_iface_tcase(
+				struct torture_suite *suite, 
+				const char *name,
+				const struct ndr_interface_table *table,
+				const char *machine_name);
+struct torture_test *torture_rpc_tcase_add_test_creds(
+					struct torture_rpc_tcase *tcase, 
+					const char *name, 
+					bool (*fn) (struct torture_context *, struct dcerpc_pipe *, struct cli_credentials *));
+bool torture_suite_init_rpc_tcase(struct torture_suite *suite, 
+					   struct torture_rpc_tcase *tcase, 
+					   const char *name,
+					   const struct ndr_interface_table *table);
+
 
 
 #endif /* __TORTURE_RPC_H__ */
diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
index 204a9f2865..8eb1f54b4f 100644
--- a/source4/torture/rpc/samba3rpc.c
+++ b/source4/torture/rpc/samba3rpc.c
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/rap/rap.h"
 #include "torture/torture.h"
 #include "torture/util.h"
diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index aba7147716..24b2511bc7 100644
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -30,6 +30,7 @@
 #include "lib/cmdline/popt_common.h"
 #include "torture/rpc/rpc.h"
 #include "auth/gensec/schannel_proto.h"
+#include "auth/gensec/gensec.h"
 #include "libcli/auth/libcli_auth.h"
 #include "param/param.h"
 
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 865ebf9fd2..3b152d92aa 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -29,6 +29,7 @@
 #include "system/time.h"
 #include "torture/rpc/rpc.h"
 #include "auth/gensec/schannel_proto.h"
+#include "auth/gensec/gensec.h"
 #include "libcli/auth/libcli_auth.h"
 #include "libcli/security/security.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
diff --git a/source4/torture/rpc/scanner.c b/source4/torture/rpc/scanner.c
index 03a2c9fd07..b761f406ec 100644
--- a/source4/torture/rpc/scanner.c
+++ b/source4/torture/rpc/scanner.c
@@ -25,6 +25,7 @@
 #include "librpc/ndr/ndr_table.h"
 #include "torture/rpc/rpc.h"
 #include "param/param.h"
+#include "librpc/rpc/dcerpc_proto.h"
 
 /*
   work out how many calls there are for an interface
diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index 5a91366980..19b871f9c0 100644
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -31,6 +31,8 @@
 #include "libcli/security/security.h"
 #include "system/filesys.h"
 #include "param/param.h"
+#include "librpc/rpc/dcerpc_proto.h"
+#include "auth/gensec/gensec.h"
 
 #define TEST_MACHINE_NAME "schannel"
 
diff --git a/source4/torture/rpc/spoolss_notify.c b/source4/torture/rpc/spoolss_notify.c
index 96db7d1ec5..19cff53d84 100644
--- a/source4/torture/rpc/spoolss_notify.c
+++ b/source4/torture/rpc/spoolss_notify.c
@@ -6,7 +6,7 @@
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -28,6 +28,7 @@
 #include "lib/events/events.h"
 #include "smbd/process_model.h"
 #include "smb_server/smb_server.h"
+#include "librpc/rpc/dcerpc_proto.h"
 #include "lib/socket/netif.h"
 #include "util/dlinklist.h"
 #include "ntvfs/ntvfs.h"
diff --git a/source4/torture/smb2/smb2.c b/source4/torture/smb2/smb2.c
index f234700cb8..d07611264b 100644
--- a/source4/torture/smb2/smb2.c
+++ b/source4/torture/smb2/smb2.c
@@ -46,7 +46,7 @@ static bool wrap_simple_1smb2_test(struct torture_context *torture_ctx,
 	return ret;
 }
 
-_PUBLIC_ struct torture_test *torture_suite_add_1smb2_test(struct torture_suite *suite,
+struct torture_test *torture_suite_add_1smb2_test(struct torture_suite *suite,
 							   const char *name,
 							   bool (*run) (struct torture_context *,
 									struct smb2_tree *))
diff --git a/source4/torture/torture.c b/source4/torture/torture.c
index 8f6dae7665..39d85e0572 100644
--- a/source4/torture/torture.c
+++ b/source4/torture/torture.c
@@ -45,7 +45,7 @@ bool torture_register_suite(struct torture_suite *suite)
 }
 
 
-int torture_init(void)
+_PUBLIC_ int torture_init(void)
 {
 	extern NTSTATUS torture_base_init(void);
 	extern NTSTATUS torture_ldap_init(void);
diff --git a/source4/torture/torture.h b/source4/torture/torture.h
index e191fb3629..26ecdb567b 100644
--- a/source4/torture/torture.h
+++ b/source4/torture/torture.h
@@ -34,7 +34,8 @@ extern int torture_failures;
 extern int torture_numasync;
 
 struct torture_test;
+int torture_init(void);
+bool torture_register_suite(struct torture_suite *suite);
 
-#include "torture/proto.h"
 
 #endif /* __TORTURE_H__ */
diff --git a/source4/torture/ui.h b/source4/torture/ui.h
index 503a4f4dec..6645d9b012 100644
--- a/source4/torture/ui.h
+++ b/source4/torture/ui.h
@@ -368,5 +368,20 @@ bool torture_setting_bool(struct torture_context *test,
 struct torture_suite *torture_find_suite(struct torture_suite *parent, 
 										 const char *name);
 
+NTSTATUS torture_temp_dir(struct torture_context *tctx, 
+				   const char *prefix, 
+				   char **tempdir);
+
+struct torture_test *torture_tcase_add_simple_test(struct torture_tcase *tcase,
+		const char *name,
+		bool (*run) (struct torture_context *test, void *tcase_data));
+
+
+bool torture_suite_init_tcase(struct torture_suite *suite, 
+			      struct torture_tcase *tcase, 
+			      const char *name);
+
+struct torture_context *torture_context_init(TALLOC_CTX *mem_ctx, 
+					     const struct torture_ui_ops *ui_ops);
 
 #endif /* __TORTURE_UI_H__ */
diff --git a/source4/torture/unix/whoami.c b/source4/torture/unix/whoami.c
index 3203f91bc0..a1333ac5bd 100644
--- a/source4/torture/unix/whoami.c
+++ b/source4/torture/unix/whoami.c
@@ -22,6 +22,7 @@
 #include "torture/basic/proto.h"
 #include "libcli/libcli.h"
 #include "libcli/raw/interfaces.h"
+#include "libcli/raw/raw_proto.h"
 #include "lib/cmdline/popt_common.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
diff --git a/source4/torture/util_provision.c b/source4/torture/util_provision.c
index d7c8f479e6..cce8e18fdc 100644
--- a/source4/torture/util_provision.c
+++ b/source4/torture/util_provision.c
@@ -20,19 +20,19 @@
 #include "includes.h"
 #include "auth/auth.h"
 #include "lib/ldb_wrap.h"
+#include "torture/torture.h"
+#include "libcli/raw/libcliraw.h"
 #include "torture/util.h"
+#include "librpc/ndr/libndr.h"
 
 #include "param/param.h"
 #include <Python.h>
 #include "scripting/python/modules.h"
 
 NTSTATUS provision_bare(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx,
-						struct provision_settings *settings)
+			struct provision_settings *settings)
 {
-	bool ok;
 	PyObject *provision_mod, *provision_dict, *provision_fn, *result, *parameters;
-	struct ldb_context *ldb;
-	char *sam_ldb_path;
 	
 	DEBUG(0,("Provision for Become-DC test using python\n"));
 
diff --git a/source4/torture/util_smb.c b/source4/torture/util_smb.c
index ba62f3789c..513070500e 100644
--- a/source4/torture/util_smb.c
+++ b/source4/torture/util_smb.c
@@ -21,6 +21,7 @@
 #include "includes.h"
 #include "lib/cmdline/popt_common.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
 #include "libcli/raw/ioctl.h"
 #include "libcli/libcli.h"
 #include "system/filesys.h"
diff --git a/source4/utils/config.mk b/source4/utils/config.mk
index 9e79898373..a7d82684e4 100644
--- a/source4/utils/config.mk
+++ b/source4/utils/config.mk
@@ -5,7 +5,7 @@
 [BINARY::ntlm_auth]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBPOPT \
 		POPT_SAMBA \
@@ -27,7 +27,7 @@ MANPAGES += utils/man/ntlm_auth.1
 [BINARY::getntacl]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		NDR_XATTR \
 		WRAP_XATTR \
@@ -65,7 +65,7 @@ setnttoken_OBJ_FILES = utils/setnttoken.o
 [BINARY::nmblookup]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBCLI_NBT \
 		LIBPOPT \
@@ -82,7 +82,7 @@ nmblookup_OBJ_FILES = utils/nmblookup.o
 [BINARY::testparm]
 INSTALLDIR = BINDIR
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBPOPT \
 		samba-socket \
diff --git a/source4/utils/net/config.mk b/source4/utils/net/config.mk
index d3ed02b50e..4423c44c15 100644
--- a/source4/utils/net/config.mk
+++ b/source4/utils/net/config.mk
@@ -6,7 +6,7 @@
 INSTALLDIR = BINDIR
 PRIVATE_PROTO_HEADER = net_proto.h
 PRIVATE_DEPENDENCIES = \
-		LIBSAMBA-CONFIG \
+		LIBSAMBA-HOSTCONFIG \
 		LIBSAMBA-UTIL \
 		LIBSAMBA-NET \
 		LIBPOPT \
diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index de8a43ec02..92ac41f1d2 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -210,13 +210,26 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	NTSTATUS status = NT_STATUS_NONE_MAPPED;
 	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
 	struct ldb_result *res = NULL;
-	uint32_t low, high;
 	struct dom_sid *unix_sid, *new_sid;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+	const char *id_type;
+
+	switch (unixid->type) {
+		case ID_TYPE_UID:
+			id_type = "ID_TYPE_UID";
+			break;
+		case ID_TYPE_GID:
+			id_type = "ID_TYPE_GID";
+			break;
+		default:
+			DEBUG(1, ("unixid->type must be type gid or uid\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+	}
 
 	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
-				 unixid->id);
+				 NULL, "(&(|(type=ID_TYPE_BOTH)(type=%s))"
+				 "(xidNumber=%u))", id_type, unixid->id);
 	if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
 		status = NT_STATUS_NONE_MAPPED;
@@ -235,40 +248,9 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	DEBUG(6, ("xid not found in idmap db, trying to allocate SID.\n"));
-
-	/* Now redo the search to make sure noone added a mapping for that SID
-	 * while we weren't looking.*/
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
-				 unixid->id);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count > 0) {
-		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
-		status = NT_STATUS_RETRY;
-		goto failed;
-	}
-
-	ret = idmap_get_bounds(idmap_ctx, &low, &high);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (unixid->id >= low && unixid->id <= high) {
-		/* An existing xid would have been mapped before */
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
+	DEBUG(6, ("xid not found in idmap db, create S-1-22- SID.\n"));
 
-	/* For local users, we just create a rid = uid +1, so root doesn't end
-	 * up with a 0 rid */
+	/* For local users/groups , we just create a rid = uid/gid */
 	if (unixid->type == ID_TYPE_UID) {
 		unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
 	} else {
@@ -279,7 +261,7 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id + 1);
+	new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id);
 	if (new_sid == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto failed;
@@ -326,42 +308,27 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	bool hwm_entry_exists;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
-				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count == 1) {
-		new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
-						    -1);
-		if (new_xid == (uint32_t) -1) {
-			DEBUG(1, ("Invalid xid mapping.\n"));
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
-		}
+	if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+		uint32_t rid;
+		DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
+		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
+		if (!NT_STATUS_IS_OK(status)) goto failed;
 
 		*unixid = talloc(mem_ctx, struct unixid);
 		if (*unixid == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-
-		(*unixid)->id = new_xid;
-		(*unixid)->type = ID_TYPE_BOTH;
+		(*unixid)->id = rid;
+		(*unixid)->type = ID_TYPE_UID;
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
 	}
 
-	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
-
-	if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+	if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
 		uint32_t rid;
-		DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
+		DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
 		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
 		if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -370,30 +337,60 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-		(*unixid)->id = rid - 1;
-		(*unixid)->type = ID_TYPE_UID;
+		(*unixid)->id = rid;
+		(*unixid)->type = ID_TYPE_GID;
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
+	 }
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
 	}
 
-	if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
-		uint32_t rid;
-		DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
-		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
-		if (!NT_STATUS_IS_OK(status)) goto failed;
+	if (res->count == 1) {
+		const char *type = ldb_msg_find_attr_as_string(res->msgs[0],
+							       "type", NULL);
+		new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
+						    -1);
+		if (new_xid == (uint32_t) -1) {
+			DEBUG(1, ("Invalid xid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		if (type == NULL) {
+			DEBUG(1, ("Invalid type for mapping entry.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
 
 		*unixid = talloc(mem_ctx, struct unixid);
 		if (*unixid == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-		(*unixid)->id = rid - 1;
-		(*unixid)->type = ID_TYPE_GID;
+
+		(*unixid)->id = new_xid;
+
+		if (strcmp(type, "ID_TYPE_BOTH") == 0) {
+			(*unixid)->type = ID_TYPE_BOTH;
+		} else if (strcmp(type, "ID_TYPE_UID") == 0) {
+			(*unixid)->type = ID_TYPE_UID;
+		} else {
+			(*unixid)->type = ID_TYPE_GID;
+		}
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
-	 }
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
 
 	trans = ldb_transaction_start(ldb);
 	if (trans != LDB_SUCCESS) {
@@ -585,6 +582,12 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
+	ret = ldb_msg_add_string(map_msg, "type", "ID_TYPE_BOTH");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
 	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
 	if (ret != LDB_SUCCESS) {
 		status = NT_STATUS_NONE_MAPPED;
diff --git a/source4/winbind/idmap.h b/source4/winbind/idmap.h
index 045d50c568..6eae92cc68 100644
--- a/source4/winbind/idmap.h
+++ b/source4/winbind/idmap.h
@@ -22,6 +22,8 @@
 #ifndef _IDMAP_H_
 #define _IDMAP_H_
 
+#include "librpc/gen_ndr/winbind.h"
+
 struct idmap_context {
 	struct loadparm_context *lp_ctx;
 	struct ldb_context *ldb_ctx;
@@ -29,24 +31,6 @@ struct idmap_context {
 	struct dom_sid *unix_users_sid;
 };
 
-enum id_type {
-        ID_TYPE_NOT_SPECIFIED = 0,
-        ID_TYPE_UID,
-        ID_TYPE_GID,
-	ID_TYPE_BOTH
-};
-
-struct unixid {
-        uint32_t id;
-        enum id_type type;
-};
-
-struct id_mapping {
-	struct unixid *unixid;
-	struct dom_sid *sid;
-	NTSTATUS status;
-};
-
 #include "winbind/idmap_proto.h"
 
 #endif
diff --git a/source4/winbind/wb_irpc.c b/source4/winbind/wb_irpc.c
index 5d7f7fd7a6..0535045adb 100644
--- a/source4/winbind/wb_irpc.c
+++ b/source4/winbind/wb_irpc.c
@@ -22,6 +22,7 @@
 #include "winbind/wb_server.h"
 #include "lib/messaging/irpc.h"
 #include "libcli/composite/composite.h"
+#include "libcli/security/proto.h"
 #include "librpc/gen_ndr/ndr_winbind.h"
 #include "smbd/service_task.h"
 
@@ -71,6 +72,71 @@ static void wb_irpc_SamLogon_callback(struct composite_context *ctx)
 	irpc_send_reply(s->msg, status);
 }
 
+struct wb_irpc_get_idmap_state {
+	struct irpc_message *msg;
+	struct winbind_get_idmap *req;
+	int level;
+};
+
+static void wb_irpc_get_idmap_callback(struct composite_context *ctx);
+
+static NTSTATUS wb_irpc_get_idmap(struct irpc_message *msg,
+				  struct winbind_get_idmap *req)
+{
+	struct wbsrv_service *service = talloc_get_type(msg->private,
+					struct wbsrv_service);
+	struct wb_irpc_get_idmap_state *s;
+	struct composite_context *ctx;
+
+	DEBUG(5, ("wb_irpc_get_idmap called\n"));
+
+	s = talloc(msg, struct wb_irpc_get_idmap_state);
+	NT_STATUS_HAVE_NO_MEMORY(s);
+
+	s->msg = msg;
+	s->req = req;
+	s->level = req->in.level;
+
+	switch(s->level) {
+		case WINBIND_IDMAP_LEVEL_SIDS_TO_XIDS:
+			ctx = wb_sids2xids_send(msg, service, req->in.count,
+						req->in.ids);
+			break;
+		case WINBIND_IDMAP_LEVEL_XIDS_TO_SIDS:
+			ctx = wb_xids2sids_send(msg, service, req->in.count,
+						req->in.ids);
+			break;
+	}
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	composite_continue(ctx, ctx, wb_irpc_get_idmap_callback, s);
+	msg->defer_reply = true;
+
+	return NT_STATUS_OK;
+}
+
+static void wb_irpc_get_idmap_callback(struct composite_context *ctx)
+{
+	struct wb_irpc_get_idmap_state *s;
+	NTSTATUS status;
+
+	DEBUG(5, ("wb_irpc_get_idmap_callback called\n"));
+
+	s = talloc_get_type(ctx->async.private_data,
+			    struct wb_irpc_get_idmap_state);
+
+	switch(s->level) {
+		case WINBIND_IDMAP_LEVEL_SIDS_TO_XIDS:
+			status = wb_sids2xids_recv(ctx, &s->req->out.ids);
+			break;
+		case WINBIND_IDMAP_LEVEL_XIDS_TO_SIDS:
+			status = wb_xids2sids_recv(ctx, &s->req->out.ids);
+			break;
+	}
+
+	irpc_send_reply(s->msg, status);
+}
+
 NTSTATUS wbsrv_init_irpc(struct wbsrv_service *service)
 {
 	NTSTATUS status;
@@ -81,5 +147,9 @@ NTSTATUS wbsrv_init_irpc(struct wbsrv_service *service)
 			       wb_irpc_SamLogon, service);
 	NT_STATUS_NOT_OK_RETURN(status);
 
+	status = IRPC_REGISTER(service->task->msg_ctx, winbind, WINBIND_GET_IDMAP,
+			       wb_irpc_get_idmap, service);
+	NT_STATUS_NOT_OK_RETURN(status);
+
 	return NT_STATUS_OK;
 }
diff --git a/source4/winbind/wb_xids2sids.c b/source4/winbind/wb_xids2sids.c
index 843d292c07..1be394d276 100644
--- a/source4/winbind/wb_xids2sids.c
+++ b/source4/winbind/wb_xids2sids.c
@@ -41,7 +41,7 @@ struct composite_context *wb_xids2sids_send(TALLOC_CTX *mem_ctx,
 	struct composite_context *result;
 	struct xids2sids_state *state;
 
-	DEBUG(0, ("wb_xids2sids_send called\n"));
+	DEBUG(5, ("wb_xids2sids_send called\n"));
 
 	result = composite_create(mem_ctx, service->task->event_ctx);
 	if (!result) return NULL;
@@ -68,7 +68,7 @@ NTSTATUS wb_xids2sids_recv(struct composite_context *ctx,
 {
 	NTSTATUS status = composite_wait(ctx);
 
-	DEBUG(0, ("wb_xids2sids_recv called.\n"));
+	DEBUG(5, ("wb_xids2sids_recv called.\n"));
 
 	if (NT_STATUS_IS_OK(status)) {
 		struct xids2sids_state *state =
diff --git a/swat/scripting/client/call.js b/swat/scripting/client/call.js
index 2886471db2..316dec5bb1 100644
--- a/swat/scripting/client/call.js
+++ b/swat/scripting/client/call.js
@@ -2,7 +2,7 @@
 	client side js functions for remote calls into the server
 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 
 var __call = new Object();
diff --git a/swat/scripting/client/desktop.js b/swat/scripting/client/desktop.js
index 9e1a342936..8e55cc94ee 100644
--- a/swat/scripting/client/desktop.js
+++ b/swat/scripting/client/desktop.js
@@ -2,7 +2,7 @@
    Windows, tabs, and general widgetry for SWAT.
 
    Copyright (C) Deryck Hodge 2005
-   released under the GNU GPL Version 2 or later
+   released under the GNU GPL Version 3 or later
 */
 
 /* Qooxdoo's browser sniffer doesn't distinguish IE version.
diff --git a/swat/scripting/client/encoder.js b/swat/scripting/client/encoder.js
index 4aa4cc0954..2a4d174b0e 100644
--- a/swat/scripting/client/encoder.js
+++ b/swat/scripting/client/encoder.js
@@ -2,7 +2,7 @@
 	client side js functions for encoding/decoding objects into linear strings
 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 /*
 	usage:
diff --git a/swat/scripting/client/js_scripts.js b/swat/scripting/client/js_scripts.js
index 1c6e5806f4..ea87df02c8 100644
--- a/swat/scripting/client/js_scripts.js
+++ b/swat/scripting/client/js_scripts.js
@@ -2,7 +2,7 @@
    Beginnnigs of a script manager for SWAT.
 
    Copyright (C) Deryck Hodge 2005
-   released under the GNU GPL Version 2 or later
+   released under the GNU GPL Version 3 or later
 */
 
 var head = document.getElementsByTagName('head')[0];
diff --git a/swat/scripting/client/regedit.js b/swat/scripting/client/regedit.js
index 9175017c2e..555ba9fb90 100644
--- a/swat/scripting/client/regedit.js
+++ b/swat/scripting/client/regedit.js
@@ -2,7 +2,7 @@
 	client side js functions for registry editing
 
 	Copyright Andrew Tridgell 2005
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 
 
diff --git a/swat/scripting/client/status.js b/swat/scripting/client/status.js
index 31ee31c43b..a41038d5e9 100644
--- a/swat/scripting/client/status.js
+++ b/swat/scripting/client/status.js
@@ -1,7 +1,7 @@
 /*
 	server status library for SWAT
 
-	released under the GNU GPL Version 2 or later
+	released under the GNU GPL Version 3 or later
 */
 
 
diff --git a/testprogs/blackbox/test_kinit.sh b/testprogs/blackbox/test_kinit.sh
index d4eff07c8d..dbcdcf1112 100755
--- a/testprogs/blackbox/test_kinit.sh
+++ b/testprogs/blackbox/test_kinit.sh
@@ -23,6 +23,7 @@ samba4bindir=`dirname $0`/../../source/bin
 smbclient=$samba4bindir/smbclient
 samba4kinit=$samba4bindir/samba4kinit
 net=$samba4bindir/net
+enableaccount="$samba4bindir/smbpython `dirname $0`/../../source/setup/enableaccount"
 
 testit() {
 	name="$1"
@@ -60,8 +61,10 @@ KRB5CCNAME="$PREFIX/tmpccache"
 export KRB5CCNAME
 
 echo $PASSWORD > ./tmppassfile
+#testit "kinit with keytab" $samba4kinit --keytab=$PREFIX/dc/private/secrets.keytab $SERVER\$@$REALM   || failed=`expr $failed + 1`
 testit "kinit with password" $samba4kinit --password-file=./tmppassfile --request-pac $USERNAME@$REALM   || failed=`expr $failed + 1`
-testit "kinit with pkinit" $samba4kinit --request-pac --pk-user=FILE:$PREFIX/dc/private/tls/admincert.pem,$PREFIX/dc/private/tls/adminkey.pem $USERNAME@$REALM || failed=`expr $failed + 1`
+testit "kinit with pkinit" $samba4kinit --request-pac --renewable --pk-user=FILE:$PREFIX/dc/private/tls/admincert.pem,$PREFIX/dc/private/tls/adminkey.pem $USERNAME@$REALM || failed=`expr $failed + 1`
+testit "kinit renew ticket" $samba4kinit --request-pac -R
 
 test_smbclient "Test login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 
@@ -70,18 +73,23 @@ testit "check time with kerberos ccache" $VALGRIND $net time $SERVER $CONFIGURAT
 
 testit "add user with kerberos ccache" $VALGRIND $net user add nettestuser $CONFIGURATION  -k yes $@ || failed=`expr $failed + 1`
 USERPASS=testPass@12%
+echo $USERPASS > ./tmpuserpassfile
 
 testit "set user password with kerberos ccache" $VALGRIND $net password set $DOMAIN\\nettestuser $USERPASS $CONFIGURATION  -k yes $@ || failed=`expr $failed + 1`
 
-#KRB5CCNAME=`pwd`/tmpuserccache
-#export KRB5CCNAME
-#
-#testit "kinit with user password" bin/samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
-#
-#KRB5CCNAME=`pwd`/tmpccache
-#export KRB5CCNAME
+testit "enable user with kerberos cache" $VALGRIND $enableaccount nettestuser -H ldap://$SERVER -k yes $@ || failed=`expr $failed + 1`
 
-testit "del user with kerberos ccache" $VALGRIND $net user delete nettestuser $CONFIGURATION  -k yes $@ || failed=`expr $failed + 1`
+KRB5CCNAME="$PREFIX/tmpuserccache"
+export KRB5CCNAME
+
+testit "kinit with user password" $samba4bindir/samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
+
+test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
+
+KRB5CCNAME="$PREFIX/tmpccache"
+export KRB5CCNAME
+
+testit "del user with kerberos ccache" $VALGRIND $net user delete nettestuser $CONFIGURATION -k yes $@ || failed=`expr $failed + 1`
 
-rm -f tmpccfile tmppassfile tmpuserccache
+rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache
 exit $failed