Merge passdb from HEAD -> 3.0

The work here includes:
 - metze' set/changed patch, which avoids making changes to ldap on unmodified
attributes.

 - volker's group mapping in passdb patch

 - volker's samsync stuff
 - volkers SAMR changes.

 - mezte's connection caching patch

 - my recent changes (fix magic root check, ldap ssl)

Andrew Bartlett
(This used to be commit 2044d60bbe0043cdbb9aba931115672bde975d2f)

5 files changed, 144 insertions, 107 deletions

diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index e187e1556e..c4fc0a5de7 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -856,7 +856,7 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU
 		return NT_STATUS_ACCESS_DENIED;
 
 	/* get the list of mapped groups (domain, local, builtin) */
-	if(!enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
+	if(!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
 		return NT_STATUS_OK;
 
 	if (q_u->enum_context >= num_entries)
@@ -971,7 +971,7 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
-	if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
+	if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set.count));
@@ -1012,7 +1012,7 @@ NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
-	if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITHOUT_PRIV))
+	if (!pdb_getgrsid(&map, info->sid, MAPPING_WITHOUT_PRIV))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	/*
@@ -1043,12 +1043,12 @@ NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
-	if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
+	if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	map.systemaccount=q_u->access;
 
-	if(!add_mapping_entry(&map, TDB_REPLACE))
+	if(!pdb_update_group_mapping_entry(&map))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	free_privilege(&map.priv_set);
@@ -1075,7 +1075,7 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
-	if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
+	if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	set=&q_u->set;
@@ -1092,7 +1092,7 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u
 		add_privilege(&map.priv_set, *luid_attr);
 	}
 
-	if(!add_mapping_entry(&map, TDB_REPLACE))
+	if(!pdb_update_group_mapping_entry(&map))
 		return NT_STATUS_NO_SUCH_GROUP;
 	
 	free_privilege(&map.priv_set);	
@@ -1119,7 +1119,7 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
-	if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
+	if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV))
 		return NT_STATUS_NO_SUCH_GROUP;
 
 	if (q_u->allrights!=0) {
@@ -1149,7 +1149,7 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP
 		remove_privilege(&map.priv_set, *luid_attr);
 	}
 
-	if(!add_mapping_entry(&map, TDB_REPLACE))
+	if(!pdb_update_group_mapping_entry(&map))
 		return NT_STATUS_NO_SUCH_GROUP;
 	
 	free_privilege(&map.priv_set);	
diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index 4478729e4d..69d619a2b0 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -433,12 +433,12 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *
 	cred_hash3( pwd, q_u->pwd, p->dc.sess_key, 0);
 
 	/* lies!  nt and lm passwords are _not_ the same: don't care */
-	if (!pdb_set_lanman_passwd (sampass, pwd)) {
+	if (!pdb_set_lanman_passwd (sampass, pwd, PDB_CHANGED)) {
 		pdb_free_sam(&sampass);
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (!pdb_set_nt_passwd     (sampass, pwd)) {
+	if (!pdb_set_nt_passwd     (sampass, pwd, PDB_CHANGED)) {
 		pdb_free_sam(&sampass);
 		return NT_STATUS_NO_MEMORY;
 	}
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index b3df2b830e..543f9ee379 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -205,8 +205,8 @@ static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
 
 	/* These now zero out the old password */
 
-	pdb_set_lanman_passwd(sam_pass, NULL);
-	pdb_set_nt_passwd(sam_pass, NULL);
+	pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
+	pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 }
 
 
@@ -302,7 +302,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
 		return NT_STATUS_OK;
 	}
 
-	if (!enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) {
+	if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -894,7 +894,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM
 	/* well-known aliases */
 	if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) {
 		
-		enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV);
+		pdb_enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV);
 		
 		if (num_entries != 0) {		
 			*d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
@@ -931,7 +931,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM
 		for (; (num_entries < max_entries) && (grp != NULL); grp = grp->next) {
 			uint32 trid;
 			
-			if(!get_group_from_gid(grp->gr_gid, &smap, MAPPING_WITHOUT_PRIV))
+			if(!pdb_getgrgid(&smap, grp->gr_gid, MAPPING_WITHOUT_PRIV))
 				continue;
 			
 			if (smap.sid_name_use!=SID_NAME_ALIAS) {
@@ -1012,7 +1012,7 @@ static NTSTATUS get_group_domain_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DO
 
 	*p_num_entries = 0;
 
-	enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV);
+	pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV);
 
 	num_entries=group_entries-start_idx;
 
@@ -1328,7 +1328,7 @@ NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAM
 	    !sid_check_is_in_builtin(&sid))
 		return NT_STATUS_OBJECT_TYPE_MISMATCH;
 
-	if (!get_group_map_from_sid(sid, &map, MAPPING_WITHOUT_PRIV))
+	if (!pdb_getgrsid(&map, sid, MAPPING_WITHOUT_PRIV))
 		return NT_STATUS_NO_SUCH_ALIAS;
 
 	switch (q_u->switch_level) {
@@ -2288,13 +2288,13 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
 			return nt_status;
 		}
 		
-		if (!pdb_set_username(sam_pass, account)) {
+		if (!pdb_set_username(sam_pass, account, PDB_CHANGED)) {
 			pdb_free_sam(&sam_pass);
 			return NT_STATUS_NO_MEMORY;
 		}
 	}
 
- 	pdb_set_acct_ctrl(sam_pass, acb_info);
+ 	pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
  
  	if (!pdb_add_sam_account(sam_pass)) {
  		pdb_free_sam(&sam_pass);
@@ -2675,8 +2675,9 @@ static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, DOM_SID *sid)
 		pdb_free_sam(&pwd);
 		return False;
 	}
-
-	if (!pdb_set_acct_ctrl(pwd, id10->acb_info)) {
+	
+	/* FIX ME: check if the value is really changed --metze */
+	if (!pdb_set_acct_ctrl(pwd, id10->acb_info, PDB_CHANGED)) {
 		pdb_free_sam(&pwd);
 		return False;
 	}
@@ -2712,11 +2713,11 @@ static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, DOM_SID *sid)
 		return False;
 	}
  
-	if (!pdb_set_lanman_passwd (pwd, id12->lm_pwd)) {
+	if (!pdb_set_lanman_passwd (pwd, id12->lm_pwd, PDB_CHANGED)) {
 		pdb_free_sam(&pwd);
 		return False;
 	}
-	if (!pdb_set_nt_passwd     (pwd, id12->nt_pwd)) {
+	if (!pdb_set_nt_passwd     (pwd, id12->nt_pwd, PDB_CHANGED)) {
 		pdb_free_sam(&pwd);
 		return False;
 	}
@@ -3180,7 +3181,7 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
 
 	if (sid_equal(&alias_sid, &global_sid_Builtin)) {
 		DEBUG(10, ("lookup on Builtin SID (S-1-5-32)\n"));
-		if(!get_local_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV))
+		if(!get_builtin_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV))
 			return NT_STATUS_NO_SUCH_ALIAS;
 	} else {
 		if (sid_equal(&alias_sid, get_global_sam_sid())) {
@@ -3404,19 +3405,21 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
 
 	if ((pwd=getpwuid_alloc(uid)) == NULL) {
 		return NT_STATUS_NO_SUCH_USER;
-	} else {
-		passwd_free(&pwd);
 	}
 
-	if ((grp=getgrgid(map.gid)) == NULL)
+	if ((grp=getgrgid(map.gid)) == NULL) {
+		passwd_free(&pwd);
 		return NT_STATUS_NO_SUCH_ALIAS;
+	}
 
 	/* we need to copy the name otherwise it's overloaded in user_in_group_list */
 	fstrcpy(grp_name, grp->gr_name);
 
 	/* if the user is already in the group */
-	if(user_in_group_list(pwd->pw_name, grp_name))
+	if(user_in_group_list(pwd->pw_name, grp_name)) {
+		passwd_free(&pwd);
 		return NT_STATUS_MEMBER_IN_ALIAS;
+	}
 
 	/* 
 	 * ok, the group exist, the user exist, the user is not in the group,
@@ -3425,9 +3428,12 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
 	smb_add_user_group(grp_name, pwd->pw_name);
 
 	/* check if the user has been added then ... */
-	if(!user_in_group_list(pwd->pw_name, grp_name))
+	if(!user_in_group_list(pwd->pw_name, grp_name)) {
+		passwd_free(&pwd);
 		return NT_STATUS_MEMBER_NOT_IN_ALIAS;	/* don't know what to reply else */
+	}
 
+	passwd_free(&pwd);
 	return NT_STATUS_OK;
 }
 
@@ -3512,7 +3518,7 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
 	GROUP_MAP map;
 	uid_t uid;
 	NTSTATUS ret;
-	SAM_ACCOUNT *sam_user;
+	SAM_ACCOUNT *sam_user=NULL;
 	BOOL check;
 	uint32 acc_granted;
 
@@ -3559,19 +3565,21 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
 
 	if ((pwd=getpwuid_alloc(uid)) == NULL) {
 		return NT_STATUS_NO_SUCH_USER;
-	} else {
-		passwd_free(&pwd);
 	}
 
-	if ((grp=getgrgid(map.gid)) == NULL)
+	if ((grp=getgrgid(map.gid)) == NULL) {
+		passwd_free(&pwd);
 		return NT_STATUS_NO_SUCH_GROUP;
+	}
 
 	/* we need to copy the name otherwise it's overloaded in user_in_group_list */
 	fstrcpy(grp_name, grp->gr_name);
 
 	/* if the user is already in the group */
-	if(user_in_group_list(pwd->pw_name, grp_name))
+	if(user_in_group_list(pwd->pw_name, grp_name)) {
+		passwd_free(&pwd);
 		return NT_STATUS_MEMBER_IN_GROUP;
+	}
 
 	/* 
 	 * ok, the group exist, the user exist, the user is not in the group,
@@ -3582,9 +3590,12 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
 	smb_add_user_group(grp_name, pwd->pw_name);
 
 	/* check if the user has been added then ... */
-	if(!user_in_group_list(pwd->pw_name, grp_name))
+	if(!user_in_group_list(pwd->pw_name, grp_name)) {
+		passwd_free(&pwd);
 		return NT_STATUS_MEMBER_NOT_IN_GROUP;		/* don't know what to reply else */
+	}
 
+	passwd_free(&pwd);
 	return NT_STATUS_OK;
 }
 
@@ -3783,7 +3794,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
 	if ( (grp=getgrgid(gid)) != NULL)
 		return NT_STATUS_ACCESS_DENIED;
 
-	if(!group_map_remove(group_sid))
+	if(!pdb_delete_group_mapping_entry(group_sid))
 		return NT_STATUS_ACCESS_DENIED;
 
 	if (!close_policy_hnd(p, &q_u->group_pol))
@@ -3846,7 +3857,7 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S
 		return NT_STATUS_ACCESS_DENIED;
 
 	/* don't check if we removed it as it could be an un-mapped group */
-	group_map_remove(alias_sid);
+	pdb_delete_group_mapping_entry(alias_sid);
 
 	if (!close_policy_hnd(p, &q_u->alias_pol))
 		return NT_STATUS_OBJECT_NAME_INVALID;
@@ -4076,7 +4087,7 @@ NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_
 			return NT_STATUS_INVALID_INFO_CLASS;
 	}
 
-	if(!add_mapping_entry(&map, TDB_REPLACE)) {
+	if(!pdb_update_group_mapping_entry(&map)) {
 		free_privilege(&map.priv_set);
 		return NT_STATUS_NO_SUCH_GROUP;
 	}
@@ -4120,7 +4131,7 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_
 			return NT_STATUS_INVALID_INFO_CLASS;
 	}
 
-	if(!add_mapping_entry(&map, TDB_REPLACE)) {
+	if(!pdb_update_group_mapping_entry(&map)) {
 		free_privilege(&map.priv_set);
 		return NT_STATUS_NO_SUCH_GROUP;
 	}
diff --git a/source3/rpc_server/srv_samr_util.c b/source3/rpc_server/srv_samr_util.c
index 18297056d6..97c7b67839 100644
--- a/source3/rpc_server/srv_samr_util.c
+++ b/source3/rpc_server/srv_samr_util.c
@@ -47,14 +47,14 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		stored_time = pdb_get_logon_time(to);
 		DEBUG(10,("INFO_21 LOGON_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_logon_time(to, unix_time, True);
+			pdb_set_logon_time(to, unix_time, PDB_CHANGED);
 	}	
 	if (!nt_time_is_zero(&from->logoff_time)) {
 		unix_time=nt_time_to_unix(&from->logoff_time);
 		stored_time = pdb_get_logoff_time(to);
 		DEBUG(10,("INFO_21 LOGOFF_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_logoff_time(to, unix_time, True);
+			pdb_set_logoff_time(to, unix_time, PDB_CHANGED);
 	}
 	
 	if (!nt_time_is_zero(&from->kickoff_time)) {
@@ -62,7 +62,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		stored_time = pdb_get_kickoff_time(to);
 		DEBUG(10,("INFO_21 KICKOFF_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_kickoff_time(to, unix_time , True);
+			pdb_set_kickoff_time(to, unix_time , PDB_CHANGED);
 	}	
 
 	if (!nt_time_is_zero(&from->pass_can_change_time)) {
@@ -70,14 +70,14 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		stored_time = pdb_get_pass_can_change_time(to);
 		DEBUG(10,("INFO_21 PASS_CAN_CH: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_can_change_time(to, unix_time, True);
+			pdb_set_pass_can_change_time(to, unix_time, PDB_CHANGED);
 	}
 	if (!nt_time_is_zero(&from->pass_last_set_time)) {
 		unix_time=nt_time_to_unix(&from->pass_last_set_time);
 		stored_time = pdb_get_pass_last_set_time(to);
 		DEBUG(10,("INFO_21 PASS_LAST_SET: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_last_set_time(to, unix_time);
+			pdb_set_pass_last_set_time(to, unix_time, PDB_CHANGED);
 	}
 
 	if (!nt_time_is_zero(&from->pass_must_change_time)) {
@@ -85,7 +85,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		stored_time=pdb_get_pass_must_change_time(to);
 		DEBUG(10,("INFO_21 PASS_MUST_CH: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_must_change_time(to, unix_time, True);
+			pdb_set_pass_must_change_time(to, unix_time, PDB_CHANGED);
 	}
 
 	/* Backend should check this for sainity */
@@ -94,15 +94,15 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_user_name);
 		DEBUG(10,("INFO_21 UNI_USER_NAME: %s -> %s\n", old_string, new_string));
 		if (STRING_CHANGED)
-		    pdb_set_username(to      , new_string);
+		    pdb_set_username(to      , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_full_name.buffer) {
 		old_string = pdb_get_fullname(to);
-		new_string = pdb_unistr2_convert(&from->uni_user_name);
+		new_string = pdb_unistr2_convert(&from->uni_full_name);
 		DEBUG(10,("INFO_21 UNI_FULL_NAME: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_fullname(to      , new_string);
+			pdb_set_fullname(to      , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_home_dir.buffer) {
@@ -110,7 +110,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_home_dir);
 		DEBUG(10,("INFO_21 UNI_HOME_DIR: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_homedir(to       , new_string, True);
+			pdb_set_homedir(to       , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_dir_drive.buffer) {
@@ -118,7 +118,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_dir_drive);
 		DEBUG(10,("INFO_21 UNI_DIR_DRIVE: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_dir_drive(to     , new_string, True);
+			pdb_set_dir_drive(to     , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_logon_script.buffer) {
@@ -126,7 +126,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_logon_script);
 		DEBUG(10,("INFO_21 UNI_LOGON_SCRIPT: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_logon_script(to  , new_string, True);
+			pdb_set_logon_script(to  , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_profile_path.buffer) {
@@ -134,7 +134,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_profile_path);
 		DEBUG(10,("INFO_21 UNI_PROFILE_PATH: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_profile_path(to  , new_string, True);
+			pdb_set_profile_path(to  , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_acct_desc.buffer) {
@@ -142,7 +142,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_acct_desc);
 		DEBUG(10,("INFO_21 UNI_ACCT_DESC: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_acct_desc(to     , new_string);
+			pdb_set_acct_desc(to     , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_workstations.buffer) {
@@ -150,7 +150,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_workstations);
 		DEBUG(10,("INFO_21 UNI_WORKSTATIONS: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_workstations(to  , new_string);
+			pdb_set_workstations(to  , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_unknown_str.buffer) {
@@ -158,7 +158,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_unknown_str);
 		DEBUG(10,("INFO_21 UNI_UNKNOWN_STR: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_unknown_str(to   , new_string);
+			pdb_set_unknown_str(to   , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_munged_dial.buffer) {
@@ -166,40 +166,53 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		new_string = pdb_unistr2_convert(&from->uni_munged_dial);
 		DEBUG(10,("INFO_21 UNI_MUNGED_DIAL: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_munged_dial(to   , new_string);
+			pdb_set_munged_dial(to   , new_string, PDB_CHANGED);
 	}
 	
-	if (from->user_rid) {
+	if (from->user_rid != pdb_get_user_rid(to)) {
 		DEBUG(10,("INFO_21 USER_RID: %u -> %u NOT UPDATED!\n",pdb_get_user_rid(to),from->user_rid));
 		/* we really allow this ??? metze */
-		/* pdb_set_user_sid_from_rid(to, from->user_rid);*/
+		/* pdb_set_user_sid_from_rid(to, from->user_rid, PDB_CHANGED);*/
 	}
 	
-	if (from->group_rid) {
+	if (from->group_rid != pdb_get_group_rid(to)) {
 		DEBUG(10,("INFO_21 GROUP_RID: %u -> %u\n",pdb_get_group_rid(to),from->group_rid));
-		pdb_set_group_sid_from_rid(to, from->group_rid);
+		pdb_set_group_sid_from_rid(to, from->group_rid, PDB_CHANGED);
 	}
 	
 	DEBUG(10,("INFO_21 ACCT_CTRL: %08X -> %08X\n",pdb_get_acct_ctrl(to),from->acb_info));
-	pdb_set_acct_ctrl(to, from->acb_info);
+	if (from->acb_info != pdb_get_acct_ctrl(to)) {
+		pdb_set_acct_ctrl(to, from->acb_info, PDB_CHANGED);
+	}
 
-	DEBUG(10,("INFO_21 UNKOWN_3: %08X -> %08X\n",pdb_get_unknown3(to),from->unknown_3));
-	pdb_set_unknown_3(to, from->unknown_3);
-	
+	DEBUG(10,("INFO_21 UNKOWN_3: %08X -> %08X\n",pdb_get_unknown_3(to),from->unknown_3));
+	if (from->unknown_3 != pdb_get_unknown_3(to)) {
+		pdb_set_unknown_3(to, from->unknown_3, PDB_CHANGED);
+	}
 
 	DEBUG(15,("INFO_21 LOGON_DIVS: %08X -> %08X\n",pdb_get_logon_divs(to),from->logon_divs));
-	pdb_set_logon_divs(to, from->logon_divs);
+	if (from->logon_divs != pdb_get_logon_divs(to)) {
+		pdb_set_logon_divs(to, from->logon_divs, PDB_CHANGED);
+	}
 
 	DEBUG(15,("INFO_21 LOGON_HRS.LEN: %08X -> %08X\n",pdb_get_hours_len(to),from->logon_hrs.len));
-	pdb_set_hours_len(to, from->logon_hrs.len);
+	if (from->logon_hrs.len != pdb_get_hours_len(to)) {
+		pdb_set_hours_len(to, from->logon_hrs.len, PDB_CHANGED);
+	}
+
 	DEBUG(15,("INFO_21 LOGON_HRS.HOURS: %s -> %s\n",pdb_get_hours(to),from->logon_hrs.hours));
-	pdb_set_hours(to, from->logon_hrs.hours);
+/* Fix me: only update if it changes --metze */
+	pdb_set_hours(to, from->logon_hrs.hours, PDB_CHANGED);
 
-	DEBUG(10,("INFO_21 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown5(to),from->unknown_5));
-	pdb_set_unknown_5(to, from->unknown_5);
+	DEBUG(10,("INFO_21 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown_5(to),from->unknown_5));
+	if (from->unknown_5 != pdb_get_unknown_5(to)) {
+		pdb_set_unknown_5(to, from->unknown_5, PDB_CHANGED);
+	}
 
-	DEBUG(10,("INFO_21 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown6(to),from->unknown_6));
-	pdb_set_unknown_6(to, from->unknown_6);
+	DEBUG(10,("INFO_21 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown_6(to),from->unknown_6));
+	if (from->unknown_6 != pdb_get_unknown_6(to)) {
+		pdb_set_unknown_6(to, from->unknown_6, PDB_CHANGED);
+	}
 
 	DEBUG(10,("INFO_21 PADDING1 %02X %02X %02X %02X %02X %02X\n",
 		  from->padding1[0],
@@ -211,7 +224,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 
 	DEBUG(10,("INFO_21 PASS_MUST_CHANGE_AT_NEXT_LOGON: %02X\n",from->passmustchange));
 	if (from->passmustchange==PASS_MUST_CHANGE_AT_NEXT_LOGON) {
-		pdb_set_pass_must_change_time(to,0, True);		
+		pdb_set_pass_must_change_time(to,0, PDB_CHANGED);		
 	}
 
 	DEBUG(10,("INFO_21 PADDING_2: %02X\n",from->padding2));
@@ -236,14 +249,14 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		stored_time = pdb_get_logon_time(to);
 		DEBUG(10,("INFO_23 LOGON_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_logon_time(to, unix_time, True);
+			pdb_set_logon_time(to, unix_time, PDB_CHANGED);
 	}	
 	if (!nt_time_is_zero(&from->logoff_time)) {
 		unix_time=nt_time_to_unix(&from->logoff_time);
 		stored_time = pdb_get_logoff_time(to);
 		DEBUG(10,("INFO_23 LOGOFF_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_logoff_time(to, unix_time, True);
+			pdb_set_logoff_time(to, unix_time, PDB_CHANGED);
 	}
 	
 	if (!nt_time_is_zero(&from->kickoff_time)) {
@@ -251,7 +264,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		stored_time = pdb_get_kickoff_time(to);
 		DEBUG(10,("INFO_23 KICKOFF_TIME: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_kickoff_time(to, unix_time , True);
+			pdb_set_kickoff_time(to, unix_time , PDB_CHANGED);
 	}	
 
 	if (!nt_time_is_zero(&from->pass_can_change_time)) {
@@ -259,14 +272,14 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		stored_time = pdb_get_pass_can_change_time(to);
 		DEBUG(10,("INFO_23 PASS_CAN_CH: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_can_change_time(to, unix_time, True);
+			pdb_set_pass_can_change_time(to, unix_time, PDB_CHANGED);
 	}
 	if (!nt_time_is_zero(&from->pass_last_set_time)) {
 		unix_time=nt_time_to_unix(&from->pass_last_set_time);
 		stored_time = pdb_get_pass_last_set_time(to);
 		DEBUG(10,("INFO_23 PASS_LAST_SET: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_last_set_time(to, unix_time);
+			pdb_set_pass_last_set_time(to, unix_time, PDB_CHANGED);
 	}
 
 	if (!nt_time_is_zero(&from->pass_must_change_time)) {
@@ -274,7 +287,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		stored_time=pdb_get_pass_must_change_time(to);
 		DEBUG(10,("INFO_23 PASS_MUST_CH: %lu -> %lu\n",(long unsigned int)stored_time, (long unsigned int)unix_time));
 		if (stored_time != unix_time) 
-			pdb_set_pass_must_change_time(to, unix_time, True);
+			pdb_set_pass_must_change_time(to, unix_time, PDB_CHANGED);
 	}
 
 	/* Backend should check this for sainity */
@@ -283,15 +296,15 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_user_name);
 		DEBUG(10,("INFO_23 UNI_USER_NAME: %s -> %s\n", old_string, new_string));
 		if (STRING_CHANGED)
-		    pdb_set_username(to      , new_string);
+		    pdb_set_username(to      , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_full_name.buffer) {
 		old_string = pdb_get_fullname(to);
-		new_string = pdb_unistr2_convert(&from->uni_user_name);
+		new_string = pdb_unistr2_convert(&from->uni_full_name);
 		DEBUG(10,("INFO_23 UNI_FULL_NAME: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_fullname(to      , new_string);
+			pdb_set_fullname(to      , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_home_dir.buffer) {
@@ -299,7 +312,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_home_dir);
 		DEBUG(10,("INFO_23 UNI_HOME_DIR: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_homedir(to       , new_string, True);
+			pdb_set_homedir(to       , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_dir_drive.buffer) {
@@ -307,7 +320,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_dir_drive);
 		DEBUG(10,("INFO_23 UNI_DIR_DRIVE: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_dir_drive(to     , new_string, True);
+			pdb_set_dir_drive(to     , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_logon_script.buffer) {
@@ -315,7 +328,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_logon_script);
 		DEBUG(10,("INFO_23 UNI_LOGON_SCRIPT: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_logon_script(to  , new_string, True);
+			pdb_set_logon_script(to  , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_profile_path.buffer) {
@@ -323,7 +336,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_profile_path);
 		DEBUG(10,("INFO_23 UNI_PROFILE_PATH: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_profile_path(to  , new_string, True);
+			pdb_set_profile_path(to  , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_acct_desc.buffer) {
@@ -331,7 +344,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_acct_desc);
 		DEBUG(10,("INFO_23 UNI_ACCT_DESC: %s -> %s\n",old_string,new_string));
 		if (STRING_CHANGED)
-			pdb_set_acct_desc(to     , new_string);
+			pdb_set_acct_desc(to     , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_workstations.buffer) {
@@ -339,7 +352,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_workstations);
 		DEBUG(10,("INFO_23 UNI_WORKSTATIONS: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_workstations(to  , new_string);
+			pdb_set_workstations(to  , new_string, PDB_CHANGED);
 	}
 
 	if (from->hdr_unknown_str.buffer) {
@@ -347,7 +360,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_unknown_str);
 		DEBUG(10,("INFO_23 UNI_UNKNOWN_STR: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_unknown_str(to   , new_string);
+			pdb_set_unknown_str(to   , new_string, PDB_CHANGED);
 	}
 	
 	if (from->hdr_munged_dial.buffer) {
@@ -355,40 +368,53 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		new_string = pdb_unistr2_convert(&from->uni_munged_dial);
 		DEBUG(10,("INFO_23 UNI_MUNGED_DIAL: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED)
-			pdb_set_munged_dial(to   , new_string);
+			pdb_set_munged_dial(to   , new_string, PDB_CHANGED);
 	}
 	
-	if (from->user_rid) {
+	if (from->user_rid != pdb_get_user_rid(to)) {
 		DEBUG(10,("INFO_23 USER_RID: %u -> %u NOT UPDATED!\n",pdb_get_user_rid(to),from->user_rid));
 		/* we really allow this ??? metze */
-		/* pdb_set_user_sid_from_rid(to, from->user_rid);*/
+		/* pdb_set_user_sid_from_rid(to, from->user_rid, PDB_CHANGED);*/
 	}
 	
-	if (from->group_rid) {
+	if (from->group_rid != pdb_get_group_rid(to)) {
 		DEBUG(10,("INFO_23 GROUP_RID: %u -> %u\n",pdb_get_group_rid(to),from->group_rid));
-		pdb_set_group_sid_from_rid(to, from->group_rid);
+		pdb_set_group_sid_from_rid(to, from->group_rid, PDB_CHANGED);
 	}
 	
 	DEBUG(10,("INFO_23 ACCT_CTRL: %08X -> %08X\n",pdb_get_acct_ctrl(to),from->acb_info));
-	pdb_set_acct_ctrl(to, from->acb_info);
+	if (from->acb_info != pdb_get_acct_ctrl(to)) {
+		pdb_set_acct_ctrl(to, from->acb_info, PDB_CHANGED);
+	}
 
-	DEBUG(10,("INFO_23 UNKOWN_3: %08X -> %08X\n",pdb_get_unknown3(to),from->unknown_3));
-	pdb_set_unknown_3(to, from->unknown_3);
-	
+	DEBUG(10,("INFO_23 UNKOWN_3: %08X -> %08X\n",pdb_get_unknown_3(to),from->unknown_3));
+	if (from->unknown_3 != pdb_get_unknown_3(to)) {
+		pdb_set_unknown_3(to, from->unknown_3, PDB_CHANGED);
+	}
 
 	DEBUG(15,("INFO_23 LOGON_DIVS: %08X -> %08X\n",pdb_get_logon_divs(to),from->logon_divs));
-	pdb_set_logon_divs(to, from->logon_divs);
+	if (from->logon_divs != pdb_get_logon_divs(to)) {
+		pdb_set_logon_divs(to, from->logon_divs, PDB_CHANGED);
+	}
 
 	DEBUG(15,("INFO_23 LOGON_HRS.LEN: %08X -> %08X\n",pdb_get_hours_len(to),from->logon_hrs.len));
-	pdb_set_hours_len(to, from->logon_hrs.len);
+	if (from->logon_hrs.len != pdb_get_hours_len(to)) {
+		pdb_set_hours_len(to, from->logon_hrs.len, PDB_CHANGED);
+	}
+
 	DEBUG(15,("INFO_23 LOGON_HRS.HOURS: %s -> %s\n",pdb_get_hours(to),from->logon_hrs.hours));
-	pdb_set_hours(to, from->logon_hrs.hours);
+/* Fix me: only update if it changes --metze */
+	pdb_set_hours(to, from->logon_hrs.hours, PDB_CHANGED);
 
-	DEBUG(10,("INFO_23 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown5(to),from->unknown_5));
-	pdb_set_unknown_5(to, from->unknown_5);
+	DEBUG(10,("INFO_23 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown_5(to),from->unknown_5));
+	if (from->unknown_5 != pdb_get_unknown_5(to)) {
+		pdb_set_unknown_5(to, from->unknown_5, PDB_CHANGED);
+	}
 
-	DEBUG(10,("INFO_23 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown6(to),from->unknown_6));
-	pdb_set_unknown_6(to, from->unknown_6);
+	DEBUG(10,("INFO_23 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown_6(to),from->unknown_6));
+	if (from->unknown_6 != pdb_get_unknown_6(to)) {
+		pdb_set_unknown_6(to, from->unknown_6, PDB_CHANGED);
+	}
 
 	DEBUG(10,("INFO_23 PADDING1 %02X %02X %02X %02X %02X %02X\n",
 		  from->padding1[0],
@@ -400,7 +426,7 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 
 	DEBUG(10,("INFO_23 PASS_MUST_CHANGE_AT_NEXT_LOGON: %02X\n",from->passmustchange));
 	if (from->passmustchange==PASS_MUST_CHANGE_AT_NEXT_LOGON) {
-		pdb_set_pass_must_change_time(to,0, True);		
+		pdb_set_pass_must_change_time(to,0, PDB_CHANGED);		
 	}
 
 	DEBUG(10,("INFO_23 PADDING_2: %02X\n",from->padding2));
diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c
index 50bf5db4fd..519daff1f6 100644
--- a/source3/rpc_server/srv_util.c
+++ b/source3/rpc_server/srv_util.c
@@ -276,7 +276,7 @@ BOOL get_domain_user_groups(TALLOC_CTX *ctx, int *numgroups, DOM_GID **pgids, SA
 	DEBUG(10,("get_domain_user_groups: searching domain groups [%s] is a member of\n", user_name));
 
 	/* first get the list of the domain groups */
-	if (!enum_group_mapping(SID_NAME_DOM_GRP, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
+	if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
 		return False;
 	DEBUG(10,("get_domain_user_groups: there are %d mapped groups\n", num_entries));