unix instance of group database API

(This used to be commit e76f593b3572ac881f1aa1fb3326d8b7169b0078)

4 files changed, 263 insertions, 218 deletions

diff --git a/source3/rpc_server/srv_lookup.c b/source3/rpc_server/srv_lookup.c
index 6ed7a5b0e9..9981ce0371 100644
--- a/source3/rpc_server/srv_lookup.c
+++ b/source3/rpc_server/srv_lookup.c
@@ -110,16 +110,19 @@ int make_dom_gids(DOMAIN_GRP *mem, int num_members, DOM_GID **ppgids)
 		uint32 status;
 
 		uint32 rid;
+		DOM_SID sid;
 		uint8  type;
 
 		uint8  attr  = mem[count].attr;
 		char   *name = mem[count].name;
 
 		become_root(True);
-		status = lookup_grp_rid(name, &rid, &type);
+		status = lookup_group_name(name, &sid, &type);
 		unbecome_root(True);
 
-		if (status == 0x0)
+		sid_split_rid(&sid, &rid);
+
+		if (status == 0x0 && sid_equal(&sid, &global_sam_sid))
 		{
 			gids = (DOM_GID *)Realloc( gids, sizeof(DOM_GID) * (count+1) );
 
@@ -168,53 +171,53 @@ int get_domain_user_groups(DOMAIN_GRP_MEMBER **grp_members, uint32 group_rid)
 
 
 /*******************************************************************
- lookup_builtin_names
+ lookup_builtin_sid
  ********************************************************************/
-uint32 lookup_builtin_names(DOM_SID *sid, char *name, uint8 *type)
+uint32 lookup_builtin_sid(DOM_SID *sid, char *name, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_wk_user_name (sid, name, type) : status;
-	status = (status != 0x0) ? lookup_wk_group_name(sid, name, type) : status;
-	status = (status != 0x0) ? lookup_wk_alias_name(sid, name, type) : status;
+	status = (status != 0x0) ? lookup_wk_user_sid (sid, name, type) : status;
+	status = (status != 0x0) ? lookup_wk_group_sid(sid, name, type) : status;
+	status = (status != 0x0) ? lookup_wk_alias_sid(sid, name, type) : status;
 
 	return status;
 }
 
 
 /*******************************************************************
- lookup_added_name - names that have been added to the SAM database by admins.
+ lookup_added_sid - names that have been added to the SAM database by admins.
  ********************************************************************/
-uint32 lookup_added_name(DOM_SID *sid, char *name, uint8 *type)
+uint32 lookup_added_sid(DOM_SID *sid, char *name, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_user_name (sid, name, type) : status;
-	status = (status != 0x0) ? lookup_group_name(sid, name, type) : status;
-	status = (status != 0x0) ? lookup_alias_name(sid, name, type) : status;
+	status = (status != 0x0) ? lookup_user_sid (sid, name, type) : status;
+	status = (status != 0x0) ? lookup_group_sid(sid, name, type) : status;
+	status = (status != 0x0) ? lookup_alias_sid(sid, name, type) : status;
 
 	return status;
 }
 
 
 /*******************************************************************
- lookup_name
+ lookup_sid
  ********************************************************************/
-uint32 lookup_name(DOM_SID *sid, char *name, uint8 *type)
+uint32 lookup_sid(DOM_SID *sid, char *name, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_builtin_names(sid, name, type) : status;
-	status = (status != 0x0) ? lookup_added_name   (sid, name, type) : status;
+	status = (status != 0x0) ? lookup_builtin_sid(sid, name, type) : status;
+	status = (status != 0x0) ? lookup_added_sid   (sid, name, type) : status;
 
 	return status;
 }
 
 
 /*******************************************************************
- lookup_wk_group_name
+ lookup_wk_group_sid
  ********************************************************************/
-uint32 lookup_wk_group_name(DOM_SID *sid, char *group_name, uint8 *type)
+uint32 lookup_wk_group_sid(DOM_SID *sid, char *group_name, uint8 *type)
 {
 	int i = 0; 
 	uint32 rid;
@@ -230,7 +233,7 @@ uint32 lookup_wk_group_name(DOM_SID *sid, char *group_name, uint8 *type)
 		return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 	}
 
-	DEBUG(5,("lookup_wk_group_name: rid: %d", rid));
+	DEBUG(5,("lookup_wk_group_sid: rid: %d", rid));
 
 	while (domain_group_rids[i].rid != rid && domain_group_rids[i].rid != 0)
 	{
@@ -249,47 +252,47 @@ uint32 lookup_wk_group_name(DOM_SID *sid, char *group_name, uint8 *type)
 }
 
 /*******************************************************************
- lookup_group_name
+ lookup_group_sid
  ********************************************************************/
-uint32 lookup_group_name(DOM_SID *sid, char *group_name, uint8 *type)
+uint32 lookup_group_sid(DOM_SID *sid, char *group_name, uint8 *type)
 {
-	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
+	pstring sid_str;
 	uint32 rid;
 	DOM_SID tmp;
+	DOMAIN_GRP *grp = NULL;
+	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
 	(*type) = SID_NAME_DOM_GRP;
 
+	sid_to_string(sid_str, sid);
+	DEBUG(5,("lookup_group_sid: sid: %s", sid_str));
+
 	sid_copy(&tmp, sid);
 	sid_split_rid(&tmp, &rid);
 
-	if (!sid_equal(&global_sid_S_1_5_20, &tmp))
+	if (!sid_equal(&global_sam_sid, &tmp))
 	{
-		return status;
+		DEBUG(5,("not our SID\n"));
+		return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 	}
 
-	DEBUG(5,("lookup_group_name: rid: 0x%x", rid));
-
-	if (map_group_sid_to_name(sid, group_name, NULL))
-	{
-		status = 0x0;
-	}
+	grp = getgrouprid(rid, NULL, NULL);
 
-	if (status == 0x0)
+	if (grp != NULL)
 	{
+		fstrcpy(group_name, grp->name);
 		DEBUG(5,(" = %s\n", group_name));
-	}
-	else
-	{
-		DEBUG(5,(" none mapped\n"));
+		return 0x0;
 	}
 
+	DEBUG(5,(" none mapped\n"));
 	return status;
 }
 
 /*******************************************************************
- lookup_wk_alias_name
+ lookup_wk_alias_sid
  ********************************************************************/
-uint32 lookup_wk_alias_name(DOM_SID *sid, char *alias_name, uint8 *type)
+uint32 lookup_wk_alias_sid(DOM_SID *sid, char *alias_name, uint8 *type)
 {
 	int i = 0; 
 	uint32 rid;
@@ -305,7 +308,7 @@ uint32 lookup_wk_alias_name(DOM_SID *sid, char *alias_name, uint8 *type)
 		return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 	}
 
-	DEBUG(5,("lookup_wk_alias_name: rid: %d", rid));
+	DEBUG(5,("lookup_wk_alias_sid: rid: %d", rid));
 
 	while (builtin_alias_rids[i].rid != rid && builtin_alias_rids[i].rid != 0)
 	{
@@ -324,25 +327,47 @@ uint32 lookup_wk_alias_name(DOM_SID *sid, char *alias_name, uint8 *type)
 }
 
 /*******************************************************************
- lookup_alias_name
+ lookup_alias_sid
  ********************************************************************/
-uint32 lookup_alias_name(DOM_SID *sid, char *alias_name, uint8 *type)
+uint32 lookup_alias_sid(DOM_SID *sid, char *alias_name, uint8 *type)
 {
-	fstring sid_str;
+	pstring sid_str;
+	uint32 rid;
+	DOM_SID tmp;
+	LOCAL_GRP *als = NULL;
+	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
+
 	(*type) = SID_NAME_ALIAS;
 
 	sid_to_string(sid_str, sid);
+	DEBUG(5,("lookup_alias_sid: sid: %s", sid_str));
 
-	DEBUG(2,("lookup_alias_name: sid: %s\n", sid_str));
-	DEBUG(2,(" NOT IMPLEMENTED\n"));
+	sid_copy(&tmp, sid);
+	sid_split_rid(&tmp, &rid);
 
-	return 0xC0000000 | NT_STATUS_NONE_MAPPED;
+	if (!sid_equal(&global_sam_sid, &tmp))
+	{
+		DEBUG(5,("not our SID\n"));
+		return 0xC0000000 | NT_STATUS_NONE_MAPPED;
+	}
+
+	als = getaliasrid(rid, NULL, NULL);
+
+	if (als != NULL)
+	{
+		fstrcpy(alias_name, als->name);
+		DEBUG(5,(" = %s\n", alias_name));
+		return 0x0;
+	}
+
+	DEBUG(5,(" none mapped\n"));
+	return status;
 }
 
 /*******************************************************************
  lookup well-known user name
  ********************************************************************/
-uint32 lookup_wk_user_name(DOM_SID *sid, char *user_name, uint8 *type)
+uint32 lookup_wk_user_sid(DOM_SID *sid, char *user_name, uint8 *type)
 {
 	int i = 0;
 	uint32 rid;
@@ -358,7 +383,7 @@ uint32 lookup_wk_user_name(DOM_SID *sid, char *user_name, uint8 *type)
 		return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 	}
 
-	DEBUG(5,("lookup_wk_user_name: rid: %d", rid));
+	DEBUG(5,("lookup_wk_user_sid: rid: %d", rid));
 
 	/* look up the well-known domain user rids first */
 	while (domain_user_rids[i].rid != rid && domain_user_rids[i].rid != 0)
@@ -380,7 +405,7 @@ uint32 lookup_wk_user_name(DOM_SID *sid, char *user_name, uint8 *type)
 /*******************************************************************
  lookup user name
  ********************************************************************/
-uint32 lookup_user_name(DOM_SID *sid, char *user_name, uint8 *type)
+uint32 lookup_user_sid(DOM_SID *sid, char *user_name, uint8 *type)
 {
 	struct sam_disp_info *disp_info;
 	uint32 rid;
@@ -393,7 +418,7 @@ uint32 lookup_user_name(DOM_SID *sid, char *user_name, uint8 *type)
 
 	if (sid_equal(&global_sam_sid, &tmp))
 	{
-		DEBUG(5,("lookup_user_name in SAM %s: rid: %d",
+		DEBUG(5,("lookup_user_sid in SAM %s: rid: %d",
 		          global_sam_name, rid));
 
 		/* find the user account */
@@ -417,20 +442,21 @@ uint32 lookup_user_name(DOM_SID *sid, char *user_name, uint8 *type)
 /*******************************************************************
  lookup_group_rid
  ********************************************************************/
-uint32 lookup_group_rid(char *group_name, uint32 *rid, uint8 *type)
+uint32 lookup_group_name(char *grp_name, DOM_SID *sid, uint8 *type)
 {
-	DOM_SID sid;
-
-	(*rid) = 0;
+	DOMAIN_GRP *grp = NULL;
 	(*type) = SID_NAME_DOM_GRP;
 
-	DEBUG(5,("lookup_group_rid: name: %s", group_name));
+	DEBUG(5,("lookup_group_name: name: %s", grp_name));
 
-	if (map_group_name_to_sid(group_name, &sid) &&
-	    sid_split_rid(&sid, rid) &&
-	    sid_equal(&sid, &global_sam_sid))
+	grp = getgroupnam(grp_name, NULL, NULL);
+
+	if (grp != NULL)
 	{
-		DEBUG(5,(" = 0x%x\n", (*rid)));
+		sid_copy(sid, &global_sam_sid);
+		sid_append_rid(sid, grp->rid);
+
+		DEBUG(5,(" = 0x%x\n", grp->rid));
 		return 0x0;
 	}
 
@@ -439,64 +465,52 @@ uint32 lookup_group_rid(char *group_name, uint32 *rid, uint8 *type)
 }
 
 /*******************************************************************
- lookup_wk_group_rid
+ lookup_wk_group_name
  ********************************************************************/
-uint32 lookup_wk_group_rid(char *group_name, uint32 *rid, uint8 *type)
+uint32 lookup_wk_group_name(char *group_name, DOM_SID *sid, uint8 *type)
 {
 	char *grp_name;
 	int i = -1; /* start do loop at -1 */
-	(*rid) = 0;
+	uint32 rid;
 	(*type) = SID_NAME_WKN_GRP;
 
 	do /* find, if it exists, a group rid for the group name */
 	{
 		i++;
-		(*rid) = domain_group_rids[i].rid;
+		rid      = domain_group_rids[i].rid;
 		grp_name = domain_group_rids[i].name;
 
-	} while (grp_name != NULL && !strequal(grp_name, group_name));
-
-	return (grp_name != NULL) ? 0 : 0xC0000000 | NT_STATUS_NONE_MAPPED;
-}
-
-/*******************************************************************
- lookup_alias_sid
- ********************************************************************/
-uint32 lookup_alias_sid(char *alias_name, DOM_SID *sid, uint8 *type)
-{
-	(*type) = SID_NAME_ALIAS;
-
-	DEBUG(5,("lookup_alias_rid: name: %s", alias_name));
+		if (strequal(grp_name, group_name))
+		{
+			sid_copy(sid, &global_sam_sid);
+			sid_append_rid(sid, rid);
 
-	if (map_alias_name_to_sid(alias_name, sid))
-	{
-		fstring sid_str;
-		sid_to_string(sid_str, sid);
-		DEBUG(5,(" = %s\n", sid_str));
-		return 0x0;
-	}
+			return 0x0;
+		}
+			
+	} while (grp_name != NULL);
 
-	DEBUG(5,(" none mapped\n"));
 	return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 }
 
 /*******************************************************************
- lookup_alias_rid
+ lookup_alias_name
  ********************************************************************/
-uint32 lookup_alias_rid(char *alias_name, uint32 *rid, uint8 *type)
+uint32 lookup_alias_name(char *als_name, DOM_SID *sid, uint8 *type)
 {
-	DOM_SID sid;
-
-	(*rid) = 0;
+	LOCAL_GRP *als = NULL;
 	(*type) = SID_NAME_ALIAS;
 
-	DEBUG(5,("lookup_alias_rid: name: %s", alias_name));
+	DEBUG(5,("lookup_alias_name: name: %s", als_name));
 
-	if (map_alias_name_to_sid(alias_name, &sid) &&
-	    sid_split_rid(&sid, rid) &&
-	    sid_equal(&sid, &global_sam_sid))
+	als = getaliasnam(als_name, NULL, NULL);
+
+	if (als != NULL)
 	{
-		DEBUG(5,(" = 0x%x\n", (*rid)));
+		sid_copy(sid, &global_sam_sid);
+		sid_append_rid(sid, als->rid);
+
+		DEBUG(5,(" = 0x%x\n", als->rid));
 		return 0x0;
 	}
 
@@ -505,9 +519,9 @@ uint32 lookup_alias_rid(char *alias_name, uint32 *rid, uint8 *type)
 }
 
 /*******************************************************************
- lookup_wk_alias_sid
+ lookup_wk_alias_name
  ********************************************************************/
-uint32 lookup_wk_alias_sid(char *alias_name, DOM_SID *sid, uint8 *type)
+uint32 lookup_wk_alias_name(char *alias_name, DOM_SID *sid, uint8 *type)
 {
 	char *als_name;
 	int i = 0;
@@ -535,53 +549,6 @@ uint32 lookup_wk_alias_sid(char *alias_name, DOM_SID *sid, uint8 *type)
 }
 
 /*******************************************************************
- lookup_wk_alias_rid
- ********************************************************************/
-uint32 lookup_wk_alias_rid(char *alias_name, uint32 *rid, uint8 *type)
-{
-	char *als_name;
-	int i = -1; /* start do loop at -1 */
-	(*rid) = 0;
-	(*type) = SID_NAME_ALIAS;
-
-	do /* find, if it exists, a alias rid for the alias name*/
-	{
-		i++;
-		(*rid) = builtin_alias_rids[i].rid;
-		als_name = builtin_alias_rids[i].name;
-
-	} while (als_name != NULL && !strequal(als_name, alias_name));
-
-	return (als_name != NULL) ? 0 : 0xC0000000 | NT_STATUS_NONE_MAPPED;
-}
-
-/*******************************************************************
- lookup_sid
- ********************************************************************/
-uint32 lookup_sid(char *name, DOM_SID *sid, uint8 *type)
-{
-	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
-	fstring domain;
-	fstring user;
-	
-	split_domain_name(name, domain, user);
-
-	if (!strequal(domain, global_sam_name))
-	{
-		DEBUG(0,("lookup_sid: remote domain %s not supported\n", domain));
-		return status;
-	}
-
-	status = (status != 0x0) ? lookup_wk_alias_sid(user, sid, type) : status;
-	status = (status != 0x0) ? lookup_alias_sid   (user, sid, type) : status;
-#if 0
-	status = (status != 0x0) ? lookup_domain_sid  (user, sid, type) : status;
-#endif
-
-	return status;
-}
-
-/*******************************************************************
  lookup_added_user_rid
  ********************************************************************/
 uint32 lookup_added_user_rids(char *user_name,
@@ -607,12 +574,11 @@ uint32 lookup_added_user_rids(char *user_name,
 }
 
 /*******************************************************************
- lookup_added_user_rid
+ lookup_added_user_name
  ********************************************************************/
-uint32 lookup_added_user_rid(char *user_name, uint32 *rid, uint8 *type)
+uint32 lookup_added_user_name(char *user_name, DOM_SID *sid, uint8 *type)
 {
 	struct sam_passwd *sam_pass;
-	(*rid) = 0;
 	(*type) = SID_NAME_USER;
 
 	/* find the user account */
@@ -622,7 +588,9 @@ uint32 lookup_added_user_rid(char *user_name, uint32 *rid, uint8 *type)
 
 	if (sam_pass != NULL)
 	{
-		(*rid) = sam_pass->user_rid;
+		sid_copy(sid, &global_sam_sid);
+		sid_append_rid(sid, sam_pass->user_rid);
+
 		return 0x0;
 	}
 
@@ -630,87 +598,107 @@ uint32 lookup_added_user_rid(char *user_name, uint32 *rid, uint8 *type)
 }
 
 /*******************************************************************
- lookup_wk_user_rid
+ lookup_wk_user_name
  ********************************************************************/
-uint32 lookup_wk_user_rid(char *user_name, uint32 *rid, uint8 *type)
+uint32 lookup_wk_user_name(char *user_name, DOM_SID *sid, uint8 *type)
 {
 	char *usr_name;
 	int i = -1; /* start do loop at -1 */
-	(*rid) = 0;
 	(*type) = SID_NAME_USER;
 
 	do /* find, if it exists, a alias rid for the alias name*/
 	{
 		i++;
-		(*rid) = domain_user_rids[i].rid;
 		usr_name = domain_user_rids[i].name;
 
 	} while (usr_name != NULL && !strequal(usr_name, user_name));
 
-	return (usr_name != NULL) ? 0 : 0xC0000000 | NT_STATUS_NONE_MAPPED;
+	if (usr_name != NULL)
+	{
+		sid_copy(sid, &global_sid_S_1_5_20);
+		sid_append_rid(sid, domain_user_rids[i].rid);
+		return 0;
+	}
+
+	return 0xC0000000 | NT_STATUS_NONE_MAPPED;
 }
 
 /*******************************************************************
- lookup_added_grp_rid
+ lookup_added_grp_name
  ********************************************************************/
-uint32 lookup_added_grp_rid(char *name, uint32 *rid, uint8 *type)
+uint32 lookup_added_grp_name(char *name, DOM_SID *sid, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_group_rid(name, rid, type) : status;
-	status = (status != 0x0) ? lookup_alias_rid(name, rid, type) : status;
+	status = (status != 0x0) ? lookup_group_name(name, sid, type) : status;
+	status = (status != 0x0) ? lookup_alias_name(name, sid, type) : status;
 
 	return status;
 }
 
 /*******************************************************************
- lookup_builtin_grp_rid
+ lookup_builtin_grp_name
  ********************************************************************/
-uint32 lookup_builtin_grp_rid(char *name, uint32 *rid, uint8 *type)
+uint32 lookup_builtin_grp_name(char *name, DOM_SID *sid, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_wk_group_rid(name, rid, type) : status;
-	status = (status != 0x0) ? lookup_wk_alias_rid(name, rid, type) : status;
+	status = (status != 0x0) ? lookup_wk_group_name(name, sid, type) : status;
+	status = (status != 0x0) ? lookup_wk_alias_name(name, sid, type) : status;
 
 	return status;
 }
 
 /*******************************************************************
- lookup_grp_rid
+ lookup_grp_name
  ********************************************************************/
-uint32 lookup_grp_rid(char *name, uint32 *rid, uint8 *type)
+uint32 lookup_grp_name(char *name, DOM_SID *sid, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_builtin_grp_rid(name, rid, type) : status;
-	status = (status != 0x0) ? lookup_added_grp_rid  (name, rid, type) : status;
+	status = (status != 0x0) ? lookup_builtin_grp_name(name, sid, type) : status;
+	status = (status != 0x0) ? lookup_added_grp_name  (name, sid, type) : status;
 
 	return status;
 }
 
 /*******************************************************************
- lookup_user_rid
+ lookup_user_name
  ********************************************************************/
-uint32 lookup_user_rid(char *name, uint32 *rid, uint8 *type)
+uint32 lookup_user_name(char *name, DOM_SID *sid, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 
-	status = (status != 0x0) ? lookup_wk_user_rid   (name, rid, type) : status;
-	status = (status != 0x0) ? lookup_added_user_rid(name, rid, type) : status;
+	status = (status != 0x0) ? lookup_wk_user_name   (name, sid, type) : status;
+	status = (status != 0x0) ? lookup_added_user_name(name, sid, type) : status;
 
 	return status;
 }
 
 /*******************************************************************
- lookup_rid
+ lookup_name
  ********************************************************************/
-uint32 lookup_rid(char *name, uint32 *rid, uint8 *type)
+uint32 lookup_name(char *name, DOM_SID *sid, uint8 *type)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
+	fstring domain;
+	fstring user;
+	
+	split_domain_name(name, domain, user);
+
+	if (!strequal(domain, global_sam_name))
+	{
+		DEBUG(0,("lookup_name: remote domain %s not supported\n", domain));
+		return status;
+	}
 
-	status = (status != 0x0) ? lookup_user_rid(name, rid, type) : status;
-	status = (status != 0x0) ? lookup_grp_rid (name, rid, type) : status;
+	status = (status != 0x0) ? lookup_wk_alias_name(user, sid, type) : status;
+	status = (status != 0x0) ? lookup_alias_name   (user, sid, type) : status;
+	status = (status != 0x0) ? lookup_user_name    (name, sid, type) : status;
+	status = (status != 0x0) ? lookup_grp_name     (name, sid, type) : status;
+#if 0
+	status = (status != 0x0) ? lookup_domain_name  (user, sid, type) : status;
+#endif
 
 	return status;
 }
@@ -722,6 +710,7 @@ uint32 lookup_user_rids(char *name, uint32 *usr_rid, uint32 *grp_rid)
 {
 	uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 	uint8 type;
+	DOM_SID sid;
 
 	/*
 	 * try an ordinary user lookup
@@ -737,11 +726,14 @@ uint32 lookup_user_rids(char *name, uint32 *usr_rid, uint32 *grp_rid)
 	 * hm.  must be a well-known user, in a well-known group.
 	 */
 
-	status = lookup_wk_user_rid(name, usr_rid, &type);
+	status = lookup_wk_user_name(name, &sid, &type);
+	sid_split_rid(&sid, usr_rid);
+
 	if (status != 0 || type != SID_NAME_USER)
 	{
 		return status; /* ok, maybe not! */
 	}
+
 	if (type != SID_NAME_USER)
 	{
 		return 0xC0000000 | NT_STATUS_NONE_MAPPED; /* users only... */
@@ -751,7 +743,9 @@ uint32 lookup_user_rids(char *name, uint32 *usr_rid, uint32 *grp_rid)
 	 * ok, got the user rid: now try the group rid
 	 */
 
-	status = lookup_builtin_grp_rid(name, grp_rid, &type);
+	status = lookup_builtin_grp_name(name, &sid, &type);
+	sid_split_rid(&sid, usr_rid);
+
 	if (type == SID_NAME_DOM_GRP ||
 	    type == SID_NAME_ALIAS ||
 	    type == SID_NAME_WKN_GRP)
diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c
index 51b6e8d25b..8c9db172d2 100644
--- a/source3/rpc_server/srv_lsa.c
+++ b/source3/rpc_server/srv_lsa.c
@@ -85,6 +85,7 @@ make_dom_query
  ***************************************************************************/
 static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
 {
+	fstring sid_str;
 	int domlen = strlen(dom_name);
 
 	d_q->uni_dom_max_len = domlen * 2;
@@ -96,6 +97,7 @@ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
 	/* this string is supposed to be character short */
 	make_unistr2(&(d_q->uni_domain_name), dom_name, domlen);
 
+	sid_to_string(sid_str, dom_sid);
 	make_dom_sid2(&(d_q->dom_sid), dom_sid);
 }
 
@@ -197,8 +199,8 @@ make_reply_lookup_rids
  ***************************************************************************/
 static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l,
 				int num_entries,
-				uint32 dom_rids[MAX_LOOKUP_SIDS],
-				uint8  dom_types[MAX_LOOKUP_SIDS])
+				DOM_SID dom_sids [MAX_LOOKUP_SIDS],
+				uint8   dom_types[MAX_LOOKUP_SIDS])
 {
 	int i;
 
@@ -215,8 +217,11 @@ static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l,
 
 	for (i = 0; i < num_entries; i++)
 	{
+		DOM_SID sid = dom_sids[i];
+		uint32 rid;
+		sid_split_rid(&sid, &rid);
 		make_dom_ref(&(r_l->dom_ref), dom_name, dom_sid);
-		make_dom_rid2(&(r_l->dom_rid[i]), dom_rids[i], dom_types[i]);
+		make_dom_rid2(&(r_l->dom_rid[i]), rid, dom_types[i]);
 	}
 
 	r_l->num_entries3 = num_entries;
@@ -241,7 +246,7 @@ static void make_lsa_trans_names(DOM_R_REF *ref,
 	{
 		uint32 status = 0x0;
 		DOM_SID find_sid = sid[i].sid;
-		DOM_SID tmp      = sid[i].sid;
+		DOM_SID tmp_sid  = sid[i].sid;
 		uint32 rid = 0xffffffff;
 		int dom_idx = -1;
 		fstring name;
@@ -261,7 +266,7 @@ static void make_lsa_trans_names(DOM_R_REF *ref,
 		{
 			if (sid_equal(&find_sid, &global_sam_sid))
 			{
-				status = lookup_name(&tmp, name, &sid_name_use);
+				status = lookup_sid(&tmp_sid, name, &sid_name_use);
 			}
 			else
 			{
@@ -337,15 +342,15 @@ lsa_reply_lookup_rids
  ***************************************************************************/
 static void lsa_reply_lookup_rids(prs_struct *rdata,
 				int num_entries,
-				uint32 dom_rids[MAX_LOOKUP_SIDS],
-				uint8  dom_types[MAX_LOOKUP_SIDS])
+				DOM_SID dom_sids [MAX_LOOKUP_SIDS],
+				uint8   dom_types[MAX_LOOKUP_SIDS])
 {
 	LSA_R_LOOKUP_RIDS r_l;
 
 	ZERO_STRUCT(r_l);
 
 	/* set up the LSA Lookup RIDs response */
-	make_reply_lookup_rids(&r_l, num_entries, dom_rids, dom_types);
+	make_reply_lookup_rids(&r_l, num_entries, dom_sids, dom_types);
 
 	r_l.status = 0x0;
 
@@ -474,11 +479,11 @@ static void api_lsa_lookup_names( uint16 vuid, prs_struct *data,
 {
 	int i;
 	LSA_Q_LOOKUP_RIDS q_l;
-	uint32 dom_rids[MAX_LOOKUP_SIDS];
-	uint8  dom_types[MAX_LOOKUP_SIDS];
+	DOM_SID dom_sids [MAX_LOOKUP_SIDS];
+	uint8   dom_types[MAX_LOOKUP_SIDS];
 
 	ZERO_STRUCT(q_l);
-	ZERO_ARRAY(dom_rids);	
+	ZERO_ARRAY(dom_sids);	
 
 	/* grab the info class and policy handle */
 	lsa_io_q_lookup_rids("", &q_l, data, 0);
@@ -491,17 +496,16 @@ static void api_lsa_lookup_names( uint16 vuid, prs_struct *data,
 		fstring name;
 		fstrcpy(name, unistr2(q_l.lookup_name[i].str.buffer));
 
-		if (lookup_rid(name, &dom_rids[i], &dom_types[i]))
+		if (!lookup_name(name, &dom_sids[i], &dom_types[i]))
 		{
-			/* WHOOPS!  we should really do something about this... */
-			dom_rids[i] = 0;
+			dom_types[i] = SID_NAME_UNKNOWN;
 		}
 	}
 
 	/* construct reply.  return status is always 0x0 */
 	lsa_reply_lookup_rids(rdata,
                               q_l.num_entries,
-	                      dom_rids, /* text-converted SIDs */
+	                      dom_sids, /* text-converted SIDs */
 	                      dom_types); /* SID_NAME_USE types */
 }
 
diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c
index 7b970d27d2..7e725f3599 100644
--- a/source3/rpc_server/srv_samr.c
+++ b/source3/rpc_server/srv_samr.c
@@ -444,15 +444,20 @@ static void samr_reply_enum_dom_groups(SAMR_Q_ENUM_DOM_GROUPS *q_u,
 	{
 		BOOL ret;
 		char *name;
+		int i;
 		got_grps = True;
 
-		while (num_entries < MAX_SAM_ENTRIES && ((name = domain_group_rids[num_entries].name) != NULL))
+		become_root(True);
+		ret = enumdomgroups(&grps, &num_entries);
+		unbecome_root(True);
+
+		while (num_entries < MAX_SAM_ENTRIES && ((name = domain_group_rids[i].name) != NULL))
 		{
 			DOMAIN_GRP tmp_grp;
 
 			fstrcpy(tmp_grp.name   , name);
 			fstrcpy(tmp_grp.comment, "");
-			tmp_grp.rid = domain_group_rids[num_entries].rid;
+			tmp_grp.rid = domain_group_rids[i].rid;
 			tmp_grp.attr = 0x7;
 
 			if (!add_domain_group(&grps, &num_entries, &tmp_grp))
@@ -460,11 +465,10 @@ static void samr_reply_enum_dom_groups(SAMR_Q_ENUM_DOM_GROUPS *q_u,
 				r_e.status = 0xC0000000 | NT_STATUS_NO_MEMORY;
 				break;
 			}
+
+			i++;
 		}
 
-		become_root(True);
-		ret = enumdomgroups(&grps, &num_entries);
-		unbecome_root(True);
 		if (!ret)
 		{
 			r_e.status = 0xC0000000 | NT_STATUS_NO_MEMORY;
@@ -807,11 +811,12 @@ static void samr_reply_lookup_ids(SAMR_Q_LOOKUP_IDS *q_u,
 		else if (sid_equal(&dom_sid, &usr_sid))
 		{
 			DOMAIN_GRP *mem_grp = NULL;
+			BOOL ret;
 
 			DEBUG(5,("lookup on Domain SID\n"));
 
 			become_root(True);
-			getusergroupsnam(sam_pass->smb_name, &mem_grp, &num_rids);
+			ret = getusergroupsnam(sam_pass->smb_name, &mem_grp, &num_rids);
 			unbecome_root(True);
 
 			num_rids = MIN(num_rids, MAX_SAM_ENTRIES);
@@ -880,10 +885,19 @@ static void samr_reply_lookup_names(SAMR_Q_LOOKUP_NAMES *q_u,
 
 	for (i = 0; i < num_rids && status == 0; i++)
 	{
+		DOM_SID sid;
 		fstring name;
 		fstrcpy(name, unistrn2(q_u->uni_user_name[i].buffer, q_u->uni_user_name[i].uni_str_len));
 
-		status = lookup_rid(name, &(rid[i]), &(type[i]));
+		status = lookup_name(name, &sid, &(type[i]));
+		if (status == 0x0)
+		{
+			sid_split_rid(&sid, &rid[i]);
+		}
+		else
+		{
+			type[i] = SID_NAME_UNKNOWN;
+		}
 	}
 
 	make_samr_r_lookup_names(&r_u, num_rids, rid, type, status);
@@ -995,9 +1009,10 @@ static void samr_reply_unknown_12(SAMR_Q_UNKNOWN_12 *q_u,
 				prs_struct *rdata)
 {
 	fstring group_names[MAX_SAM_ENTRIES];
-	uint32  group_attrs[MAX_SAM_ENTRIES];
+	uint8   group_attrs[MAX_SAM_ENTRIES];
 	uint32 status     = 0;
 	int num_gids = q_u->num_gids1;
+	DOM_SID pol_sid;
 
 	SAMR_R_UNKNOWN_12 r_u;
 
@@ -1009,6 +1024,11 @@ static void samr_reply_unknown_12(SAMR_Q_UNKNOWN_12 *q_u,
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
+	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &pol_sid))
+	{
+		status = NT_STATUS_OBJECT_TYPE_MISMATCH;
+	}
+
 	if (status == 0x0)
 	{
 		int i;
@@ -1020,7 +1040,10 @@ static void samr_reply_unknown_12(SAMR_Q_UNKNOWN_12 *q_u,
 
 		for (i = 0; i < num_gids && status == 0; i++)
 		{
-			fstrcpy(group_names[i], "dummy group");
+			DOM_SID sid;
+			sid_copy(&sid, &pol_sid);
+			sid_append_rid(&sid, q_u->gid[i]);
+			lookup_sid(&sid, group_names[i], &group_attrs[i]);
 			group_attrs[i] = 0x2;
 		}
 	}
@@ -1369,9 +1392,10 @@ static void samr_reply_query_usergroups(SAMR_Q_QUERY_USERGROUPS *q_u,
 	if (status == 0x0)
 	{
 		DOMAIN_GRP *mem_grp = NULL;
+		BOOL ret;
 
 		become_root(True);
-		getusergroupsnam(sam_pass->smb_name, &mem_grp, &num_groups);
+		ret = getusergroupsnam(sam_pass->smb_name, &mem_grp, &num_groups);
 		unbecome_root(True);
 
                 gids = NULL;
diff --git a/source3/rpc_server/srv_sid.c b/source3/rpc_server/srv_sid.c
index 6428e965f7..a8a94204c1 100644
--- a/source3/rpc_server/srv_sid.c
+++ b/source3/rpc_server/srv_sid.c
@@ -63,13 +63,10 @@ DOM_SID global_member_sid;
 
 DOM_SID global_sid_S_1_5_20; /* local well-known domain */
 DOM_SID global_sid_S_1_1;    /* everyone */
+DOM_SID global_sid_S_1_3;    /* */
 DOM_SID global_sid_S_1_5;    /* NT Authority */
-DOM_SID global_sid_S_1_3_0;    /* Creator owner */
-DOM_SID global_sid_S_1_3_1;    /* Creator group */
-DOM_SID global_sid_S_1_3_2;    /* Creator owner server */
-DOM_SID global_sid_S_1_3_3;    /* Creator group server */
 
-extern fstring global_myworkgroup;
+extern pstring global_myworkgroup;
 /* extern fstring global_member_dom_name; */
 
 static struct sid_name_map_info
@@ -82,10 +79,7 @@ sid_name_map[] =
 {
 	{ &global_sid_S_1_5_20, "BUILTIN" },
 	{ &global_sid_S_1_1   , "Everyone" },
-	{ &global_sid_S_1_3_0 , "Creator Owner" },
-	{ &global_sid_S_1_3_1 , "Creator Group" },
-	{ &global_sid_S_1_3_2 , "Creator Owner Server" },
-	{ &global_sid_S_1_3_3 , "Creator Group Server" },
+	{ &global_sid_S_1_3   , "don't know" },
 	{ &global_sid_S_1_5   , "NT Authority" },
 	{ &global_sam_sid     , global_sam_name },
 	{ &global_member_sid  , global_myworkgroup },
@@ -99,6 +93,7 @@ sid_name_map[] =
 static BOOL read_sid_from_file(int fd, char *sid_file)
 {   
   fstring fline;
+	fstring sid_str;
     
   memset(fline, '\0', sizeof(fline));
 
@@ -118,12 +113,43 @@ static BOOL read_sid_from_file(int fd, char *sid_file)
     return False;
   }
 
+	sid_to_string(sid_str, &global_sam_sid);
+	DEBUG(5,("read_sid_from_file: sid %s\n", sid_str));
+
   return True;
 }
 
 /****************************************************************************
- Generate the global machine sid. Look for the MACHINE.SID file first, if
- not found then look in smb.conf and use it to create the MACHINE.SID file.
+ sets up the name associated with the SAM database for which we are responsible
+****************************************************************************/
+void get_sam_domain_name(void)
+{
+	switch (lp_server_role())
+	{
+		case ROLE_DOMAIN_PDC:
+		case ROLE_DOMAIN_BDC:
+		{
+			/* we are PDC (or BDC) for a Domain */
+			fstrcpy(global_sam_name, lp_workgroup());
+			break;
+		}
+		case ROLE_DOMAIN_MEMBER:
+		{
+			/* we are a "PDC", but FOR LOCAL SAM DATABASE ONLY */
+			fstrcpy(global_sam_name, global_myname);
+			break;
+		}
+		default:
+		{
+			/* no domain role, probably due to "security = share" */
+			memset(global_sam_name, 0, sizeof(global_sam_name));
+			break;
+		}
+	}
+}
+
+/****************************************************************************
+ obtain the sid from the PDC.  do some verification along the way...
 ****************************************************************************/
 BOOL get_member_domain_sid(void)
 {
@@ -138,7 +164,7 @@ BOOL get_member_domain_sid(void)
 
 	if (!cli_connect_serverlist(&cli, lp_passwordserver()))
 	{
-		DEBUG(0,("get_member_domain_sid: unable to initialize client connection.\n"));
+		DEBUG(0,("get_member_domain_sid: unable to initialise client connection.\n"));
 		return False;
 	}
 
@@ -179,11 +205,11 @@ BOOL get_member_domain_sid(void)
 	if (res)
 	{
 		pstring sid;
-		DEBUG(5,("LSA Query Info Policy\n"));
+		DEBUG(2,("LSA Query Info Policy\n"));
 		sid_to_string(sid, &sid3);
-		DEBUG(5,("Domain Member     - Domain: %s SID: %s\n", dom3, sid));
+		DEBUG(2,("Domain Member     - Domain: %s SID: %s\n", dom3, sid));
 		sid_to_string(sid, &sid5);
-		DEBUG(5,("Domain Controller - Domain: %s SID: %s\n", dom5, sid));
+		DEBUG(2,("Domain Controller - Domain: %s SID: %s\n", dom5, sid));
 
 		if (!strequal(dom3, global_myworkgroup) ||
 		    !strequal(dom5, global_myworkgroup))
@@ -195,7 +221,7 @@ BOOL get_member_domain_sid(void)
 	}
 	else
 	{
-		DEBUG(5,("lsa query info failed\n"));
+		DEBUG(1,("lsa query info failed\n"));
 	}
 	if (!res)
 	{
@@ -217,10 +243,7 @@ void generate_wellknown_sids(void)
 {
 	string_to_sid(&global_sid_S_1_5_20, "S-1-5-32");
 	string_to_sid(&global_sid_S_1_1   , "S-1-1"   );
-	string_to_sid(&global_sid_S_1_3_0 , "S-1-3-0" );
-	string_to_sid(&global_sid_S_1_3_1 , "S-1-3-1" );
-	string_to_sid(&global_sid_S_1_3_2 , "S-1-3-2" );
-	string_to_sid(&global_sid_S_1_3_3 , "S-1-3-3" );
+	string_to_sid(&global_sid_S_1_3   , "S-1-3"   );
 	string_to_sid(&global_sid_S_1_5   , "S-1-5"   );
 }
 
@@ -476,7 +499,7 @@ BOOL split_domain_name(char *fullname, char *domain, char *name)
 	fstrcpy(full_name, fullname);
 	p = strchr(full_name+1, '\\');
 
-	if (p == NULL)
+	if (p != NULL)
 	{
 		*p = 0;
 		fstrcpy(domain, full_name);