weekend work. user / group database API.

- split sam_passwd and smb_passwd into separate higher-order function tables

- renamed struct smb_passwd's "smb_user" to "unix_user".  added "nt_user"
plus user_rid, and added a "wrap" function in both sam_passwd and smb_passwd
password databases to fill in the blank entries that are not obtained
from whatever password database API instance is being used.

NOTE: whenever a struct smb_passwd or struct sam_passwd is used, it MUST
be initialised with pwdb_sam_init() or pwd_smb_init(), see chgpasswd.c
for the only example outside of the password database APIs i could find.

- added query_useraliases code to rpcclient.

- dealt with some nasty interdependencies involving non-smbd programs
and the password database API.  this is still not satisfactorily
resolved completelely, but it's the best i can do for now.

- #ifdef'd out some password database options so that people don't
mistakenly set them unless they recompile to _use_ those options.

lots of debugging done, it's still not finished.  the unix/NT uid/gid
and user-rid/group-rid issues are better, but not perfect.  the "BUILTIN"
domain is still missing: users cannot be added to "BUILTIN" groups yet,
as we only have an "alias" db API and a "group" db API but not "builtin-alias"
db API...
(This used to be commit 5d5d7e4de7d1514ab87b07ede629de8aa00519a1)

6 files changed, 190 insertions, 201 deletions

diff --git a/source3/groupdb/aliasdb.c b/source3/groupdb/aliasdb.c
index 648700dd86..011eee0f3d 100644
--- a/source3/groupdb/aliasdb.c
+++ b/source3/groupdb/aliasdb.c
@@ -26,6 +26,7 @@
 extern int DEBUGLEVEL;
 
 extern fstring global_sam_name;
+extern DOM_SID global_sam_sid;
 
 /*
  * NOTE. All these functions are abstracted into a structure
@@ -67,7 +68,28 @@ BOOL initialise_alias_db(void)
 *************************************************************************/
 LOCAL_GRP *iterate_getaliasgid(gid_t gid, LOCAL_GRP_MEMBER **mem, int *num_mem)
 {
-	return iterate_getaliasrid(pwdb_gid_to_alias_rid(gid), mem, num_mem);
+	DOM_NAME_MAP gmep;
+	uint32 rid;
+	if (!lookupsmbgrpgid(gid, &gmep))
+	{
+		DEBUG(0,("iterate_getaliasgid: gid %d does not map to one of our Domain's Aliases\n", gid));
+		return NULL;
+	}
+
+	if (gmep.type != SID_NAME_ALIAS )
+	{
+		DEBUG(0,("iterate_getaliasgid: gid %d does not map to one of our Domain's Aliases\n", gid));
+		return NULL;
+	}
+
+	sid_split_rid(&gmep.sid, &rid);
+	if (!sid_equal(&gmep.sid, &global_sam_sid))
+	{
+		DEBUG(0,("iterate_getaliasgid: gid %d does not map into our Domain SID\n", gid));
+		return NULL;
+	}
+
+	return iterate_getaliasrid(rid, mem, num_mem);
 }
 
 /************************************************************************
@@ -108,7 +130,7 @@ LOCAL_GRP *iterate_getaliasrid(uint32 rid, LOCAL_GRP_MEMBER **mem, int *num_mem)
  Utility function to search alias database by name.  use this if your database
  does not have search facilities.
 *************************************************************************/
-LOCAL_GRP *iterate_getaliasnam(char *name, LOCAL_GRP_MEMBER **mem, int *num_mem)
+LOCAL_GRP *iterate_getaliasntnam(const char *name, LOCAL_GRP_MEMBER **mem, int *num_mem)
 {
 	LOCAL_GRP *als = NULL;
 	void *fp = NULL;
@@ -167,11 +189,11 @@ BOOL add_domain_alias(LOCAL_GRP **alss, int *num_alss, LOCAL_GRP *als)
 /*************************************************************************
  checks to see if a user is a member of a domain alias
  *************************************************************************/
-static BOOL user_is_member(char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem)
+static BOOL user_is_member(const char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem)
 {
 	int i;
 	pstring name;
-	slprintf(name, sizeof(name)-1, "\\%s\\%s", global_sam_name, user_name);
+	slprintf(name, sizeof(name)-1, "%s\\%s", global_sam_name, user_name);
 
 	for (i = 0; i < num_mem; i++)
 	{
@@ -190,7 +212,7 @@ static BOOL user_is_member(char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem)
  gets an array of aliases that a user is in.  use this if your database
  does not have search facilities
  *************************************************************************/
-BOOL iterate_getuseraliasnam(char *user_name, LOCAL_GRP **alss, int *num_alss)
+BOOL iterate_getuseraliasntnam(const char *user_name, LOCAL_GRP **alss, int *num_alss)
 {
 	LOCAL_GRP *als = NULL;
 	LOCAL_GRP_MEMBER *mem = NULL;
@@ -347,9 +369,9 @@ BOOL mod_alias_entry(LOCAL_GRP* als)
  Routine to search alias database by name.
 *************************************************************************/
 
-LOCAL_GRP *getaliasnam(char *name, LOCAL_GRP_MEMBER **mem, int *num_mem)
+LOCAL_GRP *getaliasntnam(const char *name, LOCAL_GRP_MEMBER **mem, int *num_mem)
 {
-	return aldb_ops->getaliasnam(name, mem, num_mem);
+	return aldb_ops->getaliasntnam(name, mem, num_mem);
 }
 
 /************************************************************************
@@ -373,9 +395,9 @@ LOCAL_GRP *getaliasgid(gid_t gid, LOCAL_GRP_MEMBER **mem, int *num_mem)
 /*************************************************************************
  gets an array of aliases that a user is in.
  *************************************************************************/
-BOOL getuseraliasnam(char *user_name, LOCAL_GRP **als, int *num_alss)
+BOOL getuseraliasntnam(const char *user_name, LOCAL_GRP **als, int *num_alss)
 {
-	return aldb_ops->getuseraliasnam(user_name, als, num_alss);
+	return aldb_ops->getuseraliasntnam(user_name, als, num_alss);
 }
 
 /*************************************************************
diff --git a/source3/groupdb/aliasfile.c b/source3/groupdb/aliasfile.c
index e73ff39e74..4ae2c25b94 100644
--- a/source3/groupdb/aliasfile.c
+++ b/source3/groupdb/aliasfile.c
@@ -131,6 +131,7 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem
 
 	pstring linebuf;
 	char  *p;
+	uint8 type;
 
 	aldb_init_als(&al_buf);
 
@@ -139,6 +140,8 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem
 	 */
 	while (getfileline(vp, linebuf, sizeof(linebuf)) > 0)
 	{
+		DOM_NAME_MAP gmep;
+
 		/* get alias name */
 
 		p = strncpyn(al_buf.name, linebuf, sizeof(al_buf.name), ':');
@@ -190,9 +193,25 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem
 			}
 		}
 
-		/* ok, set up the static data structure and return it */
+		/*
+		 * look up the gid, turn it into a rid.  the _correct_ type of rid */
+		 */
 
-		al_buf.rid     = pwdb_gid_to_alias_rid((gid_t)gidval);
+		if (!lookupsmbgrpgid((gid_t)gidval, &gmep))
+		{
+			continue;
+		}
+		if (gmep.type != SID_NAME_DOM_GRP &&
+		    gmep.type != SID_NAME_WKN_GRP))
+		{
+			continue;
+		}
+
+		sid_split_rid(&gmep.sid, &gp_buf.rid);
+		if (!sid_equal(&gmep.sid, &global_sam_sid))
+		{
+			continue;
+		}
 
 		make_alias_line(linebuf, sizeof(linebuf), &al_buf, mem, num_mem);
 		DEBUG(10,("line: '%s'\n", linebuf));
@@ -237,7 +256,7 @@ static struct aliasdb_ops file_ops =
 	getalsfilepwpos,
 	setalsfilepwpos,
 
-	iterate_getaliasnam,          /* In aliasdb.c */
+	iterate_getaliasntnam,          /* In aliasdb.c */
 	iterate_getaliasgid,          /* In aliasdb.c */
 	iterate_getaliasrid,          /* In aliasdb.c */
 	getalsfilepwent,
@@ -245,7 +264,7 @@ static struct aliasdb_ops file_ops =
 	add_alsfileals_entry,
 	mod_alsfileals_entry,
 
-	iterate_getuseraliasnam      /* in aliasdb.c */
+	iterate_getuseraliasntnam      /* in aliasdb.c */
 };
 
 struct aliasdb_ops *file_initialise_alias_db(void)
diff --git a/source3/groupdb/aliasunix.c b/source3/groupdb/aliasunix.c
index b9d9dc6856..715e290643 100644
--- a/source3/groupdb/aliasunix.c
+++ b/source3/groupdb/aliasunix.c
@@ -66,62 +66,13 @@ static BOOL setalsunixpwpos(void *vp, SMB_BIG_UINT tok)
 }
 
 /*************************************************************************
- maps a unix group to a domain sid and an nt alias name.  
-*************************************************************************/
-static void map_unix_grp_to_nt_als(char *unix_name,
-	struct group *unix_grp, char *nt_name, DOM_SID *sid)
-{
-	BOOL found = False;
-	uint32 rid;
-	fstring ntname;
-	fstring ntdomain;
-
-	if (isdigit(unix_name[0]))
-	{
-		unix_grp->gr_gid = get_number(unix_name);
-		unix_grp->gr_name = unix_name;
-		found = map_alias_gid(unix_grp->gr_gid, sid, ntname, ntdomain);
-	}
-	else
-	{
-		unix_grp->gr_name = unix_name;
-		found = map_unix_alias_name(unix_grp->gr_name, sid, ntname, ntdomain);
-	}
-
-	if (found)
-	{
-		/*
-		 * find the NT name represented by this UNIX gid.
-		 * then, only accept NT aliass that are in our domain
-		 */
-
-		sid_split_rid(sid, &rid);
-	}
-	else
-	{
-		/*
-		 * assume that the UNIX group is an NT alias with
-		 * the same name.  convert gid to a alias rid.
-		 */
-		
-		fstrcpy(ntdomain, global_sam_name);
-		fstrcpy(ntname, unix_grp->gr_name);
-		sid_copy(sid, &global_sam_sid);
-	}
-
-	slprintf(nt_name, sizeof(fstring)-1, "\\%s\\%s",
-	         ntdomain, ntname);
-}
-
-/*************************************************************************
  Routine to return the next entry in the smbdomainalias list.
  *************************************************************************/
-BOOL get_unixalias_members(struct group *als,
+BOOL get_unixalias_members(struct group *grp,
 				int *num_mem, LOCAL_GRP_MEMBER **members)
 {
 	int i;
 	char *unix_name;
-	fstring nt_name;
 
 	if (num_mem == NULL || members == NULL)
 	{
@@ -131,28 +82,43 @@ BOOL get_unixalias_members(struct group *als,
 	(*num_mem) = 0;
 	(*members) = NULL;
 
-	for (i = 0; (unix_name = als->gr_mem[i]) != NULL; i++)
+	for (i = 0; (unix_name = grp->gr_mem[i]) != NULL; i++)
 	{
-		DOM_SID sid;
-		struct group unix_grp;
+		fstring name;
+		DOM_NAME_MAP gmep;
+		LOCAL_GRP_MEMBER *mem;
+
+		fstrcpy(name, unix_name);
 
-		map_unix_grp_to_nt_als(unix_name, &unix_grp, nt_name, &sid);
+		if (!lookupsmbgrpnam(name, &gmep) &&
+		    !lookupsmbpwnam (name, &gmep))
+		{
+			continue;
+		}
 
-		if (!sid_equal(&sid, &global_sam_sid))
+		if (!sid_front_equal(&global_sam_sid, &gmep.sid))
 		{
-			DEBUG(0,("alias database: could not resolve name %s in domain %s\n",
-			          unix_name, global_sam_name));
+			DEBUG(0,("alias database: could not resolve name %s (wrong Domain SID)\n",
+			          name));
 			continue;
 		}
 
-		(*members) = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER));
+		(*num_mem)++;
+		(*members) = Realloc((*members), (*num_mem) * sizeof(LOCAL_GRP_MEMBER));
 		if ((*members) == NULL)
 		{
+			DEBUG(0,("get_unixalias_members: could not realloc LOCAL_GRP_MEMBERs\n"));
 			return False;
 		}
 
-		fstrcpy((*members)[(*num_mem)].name, nt_name);
-		(*num_mem)++;
+		mem = &(*members)[(*num_mem)-1];
+		slprintf(mem->name, sizeof(mem->name)-1, "%s\\%s",
+		         gmep.nt_domain, gmep.nt_name);
+		sid_copy(&mem->sid, &gmep.sid);
+		mem->sid_use = gmep.type;
+
+		DEBUG(10,("get_unixalias_members: adding alias %s\n",
+		           mem->name));
 	}
 	return True;
 }
@@ -161,7 +127,7 @@ BOOL get_unixalias_members(struct group *als,
  Routine to return the next entry in the domain alias list.
 
  when we are a PDC or BDC, then unix groups that are explicitly NOT mapped
- to aliases (map_alias_gid) are treated as DOMAIN groups (see groupunix.c).
+ to aliases are treated as DOMAIN groups (see groupunix.c).
 
  when we are a member of a domain (not a PDC or BDC) then unix groups
  that are explicitly NOT mapped to aliases (map_alias_gid) are treated
@@ -190,36 +156,36 @@ static LOCAL_GRP *getalsunixpwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem
 
 	aldb_init_als(&gp_buf);
 
-	fstrcpy(gp_buf.comment, "");
-
 	/* cycle through unix groups */
 	while ((unix_grp = getgrent()) != NULL)
 	{
-		DOM_SID sid;
-		if (map_alias_gid(unix_grp->gr_gid, &sid, gp_buf.name, NULL))
+		DOM_NAME_MAP gmep;
+		fstring sid_str;
+		DEBUG(10,("getgrpunixpwent: enum unix group entry %s\n",
+		           unix_grp->gr_name));
+			
+		if (!lookupsmbgrpgid(unix_grp->gr_gid, &gmep))
 		{
-			/*
-			 * find the NT name represented by this UNIX gid.
-			 * then, only accept NT aliases that are in our domain
-			 */
-
-			sid_split_rid(&sid, &gp_buf.rid);
-			if (sid_equal(&sid, &global_sam_sid))
-			{
-				break; /* hooray. */
-			}
+			continue;
 		}
-		else if (lp_server_role() == ROLE_DOMAIN_MEMBER)
+
+		sid_to_string(sid_str, &gmep.sid);
+		DEBUG(10,("group %s found, sid %s type %d\n",
+			gmep.nt_name, sid_str, gmep.type));
+
+		if (gmep.type != SID_NAME_ALIAS)
 		{
-			/*
-			 * if we are a member of a domain,
-			 * assume that the UNIX alias is an NT alias with
-			 * the same name.  convert gid to a alias rid.
-			 */
-			
-			fstrcpy(gp_buf.name, unix_grp->gr_name);
-			gp_buf.rid = pwdb_gid_to_alias_rid(unix_grp->gr_gid);
+			continue;
 		}
+
+		sid_split_rid(&gmep.sid, &gp_buf.rid);
+		if (!sid_equal(&global_sam_sid, &gmep.sid))
+		{
+			continue;
+		}
+
+		fstrcpy(gp_buf.name, gmep.nt_name);
+		break;
 	}
 
 	if (unix_grp == NULL)
@@ -279,7 +245,7 @@ static struct aliasdb_ops unix_ops =
 	getalsunixpwpos,
 	setalsunixpwpos,
 
-	iterate_getaliasnam,          /* In aliasdb.c */
+	iterate_getaliasntnam,          /* In aliasdb.c */
 	iterate_getaliasgid,          /* In aliasdb.c */
 	iterate_getaliasrid,          /* In aliasdb.c */
 	getalsunixpwent,
@@ -287,7 +253,7 @@ static struct aliasdb_ops unix_ops =
 	add_alsunixgrp_entry,
 	mod_alsunixgrp_entry,
 
-	iterate_getuseraliasnam      /* in aliasdb.c */
+	iterate_getuseraliasntnam      /* in aliasdb.c */
 };
 
 struct aliasdb_ops *unix_initialise_alias_db(void)
diff --git a/source3/groupdb/groupdb.c b/source3/groupdb/groupdb.c
index 7b9a14c7df..6bd6c34442 100644
--- a/source3/groupdb/groupdb.c
+++ b/source3/groupdb/groupdb.c
@@ -24,6 +24,7 @@
 #include "nterr.h"
 
 extern int DEBUGLEVEL;
+extern DOM_SID global_sam_sid;
 
 /*
  * NOTE. All these functions are abstracted into a structure
@@ -65,7 +66,28 @@ BOOL initialise_group_db(void)
 *************************************************************************/
 DOMAIN_GRP *iterate_getgroupgid(gid_t gid, DOMAIN_GRP_MEMBER **mem, int *num_mem)
 {
-	return iterate_getgrouprid(pwdb_gid_to_group_rid(gid), mem, num_mem);
+	DOM_NAME_MAP gmep;
+	uint32 rid;
+	if (!lookupsmbgrpgid(gid, &gmep))
+	{
+		DEBUG(0,("iterate_getgroupgid: gid %d does not map to one of our Domain's Groups\n", gid));
+		return NULL;
+	}
+
+	if (gmep.type != SID_NAME_DOM_GRP && gmep.type != SID_NAME_WKN_GRP)
+	{
+		DEBUG(0,("iterate_getgroupgid: gid %d does not map to one of our Domain's Groups\n", gid));
+		return NULL;
+	}
+
+	sid_split_rid(&gmep.sid, &rid);
+	if (!sid_equal(&gmep.sid, &global_sam_sid))
+	{
+		DEBUG(0,("iterate_getgroupgid: gid %d does not map into our Domain SID\n", gid));
+		return NULL;
+	}
+
+	return iterate_getgrouprid(rid, mem, num_mem);
 }
 
 /************************************************************************
@@ -105,7 +127,7 @@ DOMAIN_GRP *iterate_getgrouprid(uint32 rid, DOMAIN_GRP_MEMBER **mem, int *num_me
  Utility function to search group database by name.  use this if your database
  does not have search facilities.
 *************************************************************************/
-DOMAIN_GRP *iterate_getgroupnam(char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem)
+DOMAIN_GRP *iterate_getgroupntnam(const char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem)
 {
 	DOMAIN_GRP *grp = NULL;
 	void *fp = NULL;
@@ -165,7 +187,7 @@ BOOL add_domain_group(DOMAIN_GRP **grps, int *num_grps, DOMAIN_GRP *grp)
 /*************************************************************************
  checks to see if a user is a member of a domain group
  *************************************************************************/
-static BOOL user_is_member(char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem)
+static BOOL user_is_member(const char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem)
 {
 	int i;
 	for (i = 0; i < num_mem; i++)
@@ -185,7 +207,7 @@ static BOOL user_is_member(char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem)
  gets an array of groups that a user is in.  use this if your database
  does not have search facilities
  *************************************************************************/
-BOOL iterate_getusergroupsnam(char *user_name, DOMAIN_GRP **grps, int *num_grps)
+BOOL iterate_getusergroupsnam(const char *user_name, DOMAIN_GRP **grps, int *num_grps)
 {
 	DOMAIN_GRP *grp = NULL;
 	DOMAIN_GRP_MEMBER *mem = NULL;
@@ -342,9 +364,9 @@ BOOL mod_group_entry(DOMAIN_GRP* grp)
  Routine to search group database by name.
 *************************************************************************/
 
-DOMAIN_GRP *getgroupnam(char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem)
+DOMAIN_GRP *getgroupntnam(const char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem)
 {
-	return gpdb_ops->getgroupnam(name, mem, num_mem);
+	return gpdb_ops->getgroupntnam(name, mem, num_mem);
 }
 
 /************************************************************************
@@ -368,9 +390,9 @@ DOMAIN_GRP *getgroupgid(gid_t gid, DOMAIN_GRP_MEMBER **mem, int *num_mem)
 /*************************************************************************
  gets an array of groups that a user is in.
  *************************************************************************/
-BOOL getusergroupsnam(char *user_name, DOMAIN_GRP **grp, int *num_grps)
+BOOL getusergroupsntnam(const char *user_name, DOMAIN_GRP **grp, int *num_grps)
 {
-	return gpdb_ops->getusergroupsnam(user_name, grp, num_grps);
+	return gpdb_ops->getusergroupsntnam(user_name, grp, num_grps);
 }
 
 /*************************************************************
diff --git a/source3/groupdb/groupfile.c b/source3/groupdb/groupfile.c
index e0f791cafb..e20ba6434c 100644
--- a/source3/groupdb/groupfile.c
+++ b/source3/groupdb/groupfile.c
@@ -105,7 +105,7 @@ static char *get_group_members(char *p, int *num_mem, DOMAIN_GRP_MEMBER **member
 
 		if (!found)
 		{
-			DEBUG(0,("alias database: could not resolve name %s in domain %s\n",
+			DEBUG(0,("group database: could not resolve name %s in domain %s\n",
 			          name, global_sam_name));
 			continue;
 		}
@@ -130,6 +130,7 @@ static DOMAIN_GRP *getgrpfilepwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m
 {
 	/* Static buffers we will return. */
 	static DOMAIN_GRP gp_buf;
+	DOM_NAME_MAP gmep;
 
 	int gidval;
 
@@ -196,7 +197,22 @@ static DOMAIN_GRP *getgrpfilepwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m
 
 		/* ok, set up the static data structure and return it */
 
-		gp_buf.rid     = pwdb_gid_to_group_rid((gid_t)gidval);
+		if (!lookupsmbgrpgid((gid_t)gidval, &gmep))
+		{
+			continue;
+		}
+		if (gmep.type != SID_NAME_DOM_GRP &&
+		    gmep.type != SID_NAME_WKN_GRP))
+		{
+			continue;
+		}
+
+		sid_split_rid(&gmep.sid, &gp_buf.rid);
+		if (!sid_equal(&gmep.sid, &global_sam_sid))
+		{
+			continue;
+		}
+
 		gp_buf.attr    = 0x07;
 
 		make_group_line(linebuf, sizeof(linebuf), &gp_buf, mem, num_mem);
@@ -242,7 +258,7 @@ static struct groupdb_ops file_ops =
 	getgrpfilepwpos,
 	setgrpfilepwpos,
 
-	iterate_getgroupnam,          /* In groupdb.c */
+	iterate_getgroupntnam,          /* In groupdb.c */
 	iterate_getgroupgid,          /* In groupdb.c */
 	iterate_getgrouprid,          /* In groupdb.c */
 	getgrpfilepwent,
@@ -250,7 +266,7 @@ static struct groupdb_ops file_ops =
 	add_grpfilegrp_entry,
 	mod_grpfilegrp_entry,
 
-	iterate_getusergroupsnam      /* in groupdb.c */
+	iterate_getusergroupntnam      /* in groupdb.c */
 };
 
 struct groupdb_ops *file_initialise_group_db(void)
diff --git a/source3/groupdb/groupunix.c b/source3/groupdb/groupunix.c
index 56d9584155..e5ad029e48 100644
--- a/source3/groupdb/groupunix.c
+++ b/source3/groupdb/groupunix.c
@@ -25,7 +25,6 @@ extern int DEBUGLEVEL;
 
 
 extern DOM_SID global_sam_sid;
-extern fstring global_sam_name;
 
 /***************************************************************
  Start to enumerate the grppasswd list. Returns a void pointer
@@ -66,48 +65,6 @@ static BOOL setgrpunixpwpos(void *vp, SMB_BIG_UINT tok)
 }
 
 /*************************************************************************
- maps a unix group to a domain sid and an nt group name.  
-*************************************************************************/
-static void map_unix_grp_to_nt_grp(char *unix_name,
-	struct group *unix_grp, char *nt_name, DOM_SID *sid)
-{
-	BOOL found = False;
-	uint32 rid;
-
-	if (isdigit(unix_name[0]))
-	{
-		unix_grp->gr_gid = get_number(unix_name);
-		unix_grp->gr_name = unix_name;
-		found = map_group_gid(unix_grp->gr_gid, sid, nt_name, NULL);
-	}
-	else
-	{
-		unix_grp->gr_name = unix_name;
-		found = map_unix_group_name(unix_grp->gr_name, sid, nt_name, NULL);
-	}
-
-	if (found)
-	{
-		/*
-		 * find the NT name represented by this UNIX gid.
-		 * then, only accept NT groups that are in our domain
-		 */
-
-		sid_split_rid(sid, &rid);
-	}
-	else
-	{
-		/*
-		 * assume that the UNIX group is an NT group with
-		 * the same name.  convert gid to a group rid.
-		 */
-		
-		fstrcpy(nt_name, unix_grp->gr_name);
-		sid_copy(sid, &global_sam_sid);
-	}
-}
-
-/*************************************************************************
  Routine to return the next entry in the smbdomaingroup list.
  *************************************************************************/
 BOOL get_unixgroup_members(struct group *grp,
@@ -115,7 +72,6 @@ BOOL get_unixgroup_members(struct group *grp,
 {
 	int i;
 	char *unix_name;
-	fstring nt_name;
 
 	if (num_mem == NULL || members == NULL)
 	{
@@ -127,15 +83,27 @@ BOOL get_unixgroup_members(struct group *grp,
 
 	for (i = 0; (unix_name = grp->gr_mem[i]) != NULL; i++)
 	{
-		DOM_SID sid;
-		struct group unix_grp;
+		DOM_NAME_MAP gmep;
 
-		map_unix_grp_to_nt_grp(unix_name, &unix_grp, nt_name, &sid);
+		if (!lookupsmbgrpnam(unix_name, &gmep) &&
+		    !lookupsmbpwnam (unix_name, &gmep))
+		{
+			continue;
+		}
 
-		if (!sid_equal(&sid, &global_sam_sid))
+		if (gmep.type != SID_NAME_DOM_GRP &&
+		    gmep.type != SID_NAME_USER &&
+		    gmep.type != SID_NAME_WKN_GRP)
+		{
+			DEBUG(0,("group database: name %s is not in a Domain Group\n",
+			          unix_name));
+			continue;
+		}
+			
+		if (!sid_front_equal(&global_sam_sid, &gmep.sid))
 		{
-			DEBUG(0,("group database: could not resolve name %s in domain %s\n",
-			          unix_name, global_sam_name));
+			DEBUG(0,("group database: could not resolve name %s (wrong Domain SID)\n",
+			          unix_name));
 			continue;
 		}
 
@@ -145,7 +113,7 @@ BOOL get_unixgroup_members(struct group *grp,
 			return False;
 		}
 
-		fstrcpy((*members)[(*num_mem)].name, nt_name);
+		fstrcpy((*members)[(*num_mem)].name, gmep.nt_name);
 		(*members)[(*num_mem)].attr = 0x07;
 		(*num_mem)++;
 	}
@@ -189,53 +157,29 @@ static DOMAIN_GRP *getgrpunixpwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m
 	/* cycle through unix groups */
 	while ((unix_grp = getgrent()) != NULL)
 	{
-		DOM_SID sid;
-		BOOL is_alias;
-
+		DOM_NAME_MAP gmep;
 		DEBUG(10,("getgrpunixpwent: enum unix group entry %s\n",
 		           unix_grp->gr_name));
-		is_alias = map_alias_gid(unix_grp->gr_gid, &sid, NULL, NULL);
-		if (is_alias)
+			
+		if (!lookupsmbgrpgid(unix_grp->gr_gid, &gmep))
 		{
-			sid_split_rid(&sid, NULL);
-			is_alias = sid_equal(&sid, &global_sam_sid);
+			continue;
 		}
 
-		if (map_group_gid(unix_grp->gr_gid, &sid, gp_buf.name, NULL))
+		if (gmep.type != SID_NAME_DOM_GRP &&
+		    gmep.type != SID_NAME_WKN_GRP)
 		{
-			fstring sid_str;
-			/*
-			 * find the NT name represented by this UNIX gid.
-			 * then, only accept NT groups that are in our domain
-			 */
-
-			sid_to_string(sid_str, &sid);
-			DEBUG(10,("getgrpunixpwent: entry %s mapped to name %s, SID %s\n",
-			           unix_grp->gr_name, gp_buf.name, sid_str));
-
-			sid_split_rid(&sid, &gp_buf.rid);
-			if (sid_equal(&sid, &global_sam_sid))
-			{
-				if (!is_alias)
-				{
-					break; /* hooray. */
-				}
-				DEBUG(0,("configuration mistake: unix group %s is mapped to both an NT alias and an NT group\n",
-				          gp_buf.name));
-			}
+			continue;
 		}
-		else if (!is_alias)
-		{
-			/*
-			 * assume that the UNIX group is an NT group with
-			 * the same name.  convert gid to a group rid.
-			 */
-			
-			fstrcpy(gp_buf.name, unix_grp->gr_name);
-			gp_buf.rid = pwdb_gid_to_group_rid(unix_grp->gr_gid);
 
-			break;
+		sid_split_rid(&gmep.sid, &gp_buf.rid);
+		if (!sid_equal(&gmep.sid, &global_sam_sid))
+		{
+			continue;
 		}
+
+		fstrcpy(gp_buf.name, gmep.nt_name);
+		break;
 	}
 
 	if (unix_grp == NULL)
@@ -295,7 +239,7 @@ static struct groupdb_ops unix_ops =
 	getgrpunixpwpos,
 	setgrpunixpwpos,
 
-	iterate_getgroupnam,          /* In groupdb.c */
+	iterate_getgroupntnam,          /* In groupdb.c */
 	iterate_getgroupgid,          /* In groupdb.c */
 	iterate_getgrouprid,          /* In groupdb.c */
 	getgrpunixpwent,