r685: The SAM is dead! Long live the new SAM! ;-)

This commit kills passdb, which was only hosting the auth subsystem.

With the work tridge has done on Samba4's SAM backend, this can (and
now is) all hosted on ldb.  The auth_sam.c file now references this
backend.

You will need to assign your users passwords in ldb - adding a new line:

unicodePwd: myPass

to a record, using ldbedit, should be sufficient.  Naturally, this
assumes you have had your personal SAMR provisioning tutorial from
tridge.  Everybody else can still use the anonymous logins.

Andrew Bartlett
(This used to be commit 2aa0b55fb86648731d5f2201fa5a6aa993b7ca48)

4 files changed, 207 insertions, 225 deletions

diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index bf6e1b77e1..db50e24959 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -64,6 +64,8 @@ typedef struct auth_usersupplied_info
 
 typedef struct auth_serversupplied_info 
 {
+	TALLOC_CTX *mem_ctx;
+
 	BOOL guest;
 	
 	/* NT group information taken from the info3 structure */
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 028fda74fe..6f61820ae5 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -33,17 +33,14 @@
 
 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 				TALLOC_CTX *mem_ctx,
-				SAM_ACCOUNT *sampass, 
+				const char *username,
+				uint16 acct_flags,
+				const uint8 lm_pw[16], const uint8 nt_pw[16],
 				const auth_usersupplied_info *user_info, 
 				DATA_BLOB *user_sess_key, 
 				DATA_BLOB *lm_sess_key)
 {
-	uint16 acct_ctrl;
-	const uint8 *lm_pw, *nt_pw;
-	const char *username = pdb_get_username(sampass);
-
-	acct_ctrl = pdb_get_acct_ctrl(sampass);
-	if (acct_ctrl & ACB_PWNOTREQ) {
+	if (acct_flags & ACB_PWNOTREQ) {
 		if (lp_null_passwords()) {
 			DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
 			return NT_STATUS_OK;
@@ -53,9 +50,6 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 		}		
 	}
 
-	lm_pw = pdb_get_lanman_passwd(sampass);
-	nt_pw = pdb_get_nt_passwd(sampass);
-
 	return ntlm_password_check(mem_ctx, &auth_context->challenge, 
 				   &user_info->lm_resp, &user_info->nt_resp, 
 				   &user_info->lm_interactive_pwd, &user_info->nt_interactive_pwd,
@@ -72,49 +66,51 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 ****************************************************************************/
 
 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
-			       SAM_ACCOUNT *sampass, 
+			       const char *username,
+			       uint16 acct_flags,
+			       struct ldb_message **msgs,
 			       const auth_usersupplied_info *user_info)
 {
-	uint16	acct_ctrl = pdb_get_acct_ctrl(sampass);
 	char *workstation_list;
 	time_t kickoff_time;
 	
-	DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
+	DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
 
 	/* Quit if the account was disabled. */
-	if (acct_ctrl & ACB_DISABLED) {
-		DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_DISABLED) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
 		return NT_STATUS_ACCOUNT_DISABLED;
 	}
 
 	/* Quit if the account was locked out. */
-	if (acct_ctrl & ACB_AUTOLOCK) {
-		DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_AUTOLOCK) {
+		DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
 	}
 
+#if 0
 	/* Test account expire time */
 	
 	kickoff_time = pdb_get_kickoff_time(sampass);
 	if (kickoff_time != 0 && time(NULL) > kickoff_time) {
-		DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
+		DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
 		DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
 		return NT_STATUS_ACCOUNT_EXPIRED;
 	}
 
-	if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
+	if (!(acct_flags & ACB_PWNOEXP)) {
 		time_t must_change_time = pdb_get_pass_must_change_time(sampass);
 		time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 
 		/* check for immediate expiry "must change at next logon" */
 		if (must_change_time == 0 && last_set_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
+			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", username));
 			return NT_STATUS_PASSWORD_MUST_CHANGE;
 		}
 
 		/* check for expired password */
 		if (must_change_time < time(NULL) && must_change_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
+			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", username));
 			DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", timestring(mem_ctx, must_change_time), (long)must_change_time));
 			return NT_STATUS_PASSWORD_EXPIRED;
 		}
@@ -144,19 +140,19 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 		if (invalid_ws) 
 			return NT_STATUS_INVALID_WORKSTATION;
 	}
-
-	if (acct_ctrl & ACB_DOMTRUST) {
-		DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
+#endif
+	if (acct_flags & ACB_DOMTRUST) {
+		DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 	}
 	
-	if (acct_ctrl & ACB_SVRTRUST) {
-		DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_SVRTRUST) {
+		DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 	}
 	
-	if (acct_ctrl & ACB_WSTRUST) {
-		DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_WSTRUST) {
+		DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 	}
 	
@@ -175,60 +171,156 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 				   const auth_usersupplied_info *user_info, 
 				   auth_serversupplied_info **server_info)
 {
-	SAM_ACCOUNT *sampass=NULL;
+	struct ldb_message **msgs;
+	void *sam_ctx;
+	uint16 acct_flags;
+	char *username = user_info->internal_username.str;
 	BOOL ret;
 	NTSTATUS nt_status;
 	DATA_BLOB user_sess_key = data_blob(NULL, 0);
 	DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+	const uint8 *lm_pwd, *nt_pwd;
+	const char *unicodePwd;
+	struct samr_Hash lmPwdHash_u, ntPwdHash_u;
+	struct samr_Hash *lmPwdHash, *ntPwdHash;
+	uint_t num_lm, num_nt;
 
 	if (!user_info || !auth_context) {
 		return NT_STATUS_UNSUCCESSFUL;
 	}
-
-	/* Can't use the talloc version here, because the returned struct gets
-	   kept on the server_info */
-	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
-		return nt_status;
+	
+	sam_ctx = samdb_connect();
+	if (sam_ctx == NULL) {
+		return NT_STATUS_INVALID_SYSTEM_SERVICE;
 	}
-
-	/* get the account information */
-
-	become_root();
-	ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
-	unbecome_root();
-
-	if (ret == False) {
-		DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
-		pdb_free_sam(&sampass);
+	/* pull all the user attributes */
+	ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, NULL,
+			   "(&(sAMAccountName=%s)(objectclass=user))", 
+			   username);
+
+	if (ret == 0) {
+		DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n", 
+			 username));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
+	if (ret > 1) {
+		DEBUG(1,("Found %d records matching user [%s]\n", ret, username));
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+	
+	acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
+	
 	/* Quit if the account was locked out. */
-	if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
-		DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_AUTOLOCK) {
+		DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", 
+			 username));
 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
 	}
 
-	nt_status = sam_password_ok(auth_context, mem_ctx, sampass, 
+	unicodePwd = samdb_result_string(msgs[0], "unicodePwd", NULL);
+	
+	if (unicodePwd) {
+		BOOL lm_hash_ok;
+		/* compute the new nt and lm hashes */
+		lm_hash_ok = E_deshash(unicodePwd, lmPwdHash_u.hash);
+		E_md4hash(unicodePwd, ntPwdHash_u.hash);
+
+		if (lm_hash_ok) {
+			lm_pwd = lmPwdHash_u.hash;
+		} else {
+			lm_pwd = NULL;
+		}
+
+		nt_pwd = ntPwdHash_u.hash;
+		
+	} else {
+		num_lm = samdb_result_hashes(mem_ctx, msgs[0], "lmPwdHash", &lmPwdHash);
+		if (num_lm == 0) {
+			lm_pwd = NULL;
+		} else if (num_lm > 1) {
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		} else {
+			lm_pwd = lmPwdHash[0].hash;
+		}
+		
+		num_nt = samdb_result_hashes(mem_ctx, msgs[0], "ntPwdHash", &ntPwdHash);
+		if (num_nt == 0) {
+			nt_pwd = NULL;
+		} else if (num_nt > 1) {
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		} else {
+			nt_pwd = ntPwdHash[0].hash;
+		}
+	}
+
+	nt_status = sam_password_ok(auth_context, mem_ctx, 
+				    username, acct_flags, 
+				    lm_pwd, nt_pwd,
 				    user_info, &user_sess_key, &lm_sess_key);
 	
 	if (!NT_STATUS_IS_OK(nt_status)) {
-		pdb_free_sam(&sampass);
 		return nt_status;
 	}
 
-	nt_status = sam_account_ok(mem_ctx, sampass, user_info);
+	nt_status = sam_account_ok(mem_ctx, username, acct_flags, msgs, user_info);
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
-		pdb_free_sam(&sampass);
 		return nt_status;
 	}
 
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {		
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, username))) {		
 		DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
 		return nt_status;
 	}
 
+	{
+		struct ldb_message **group_msgs;
+		char *dn = msgs[0]->dn;
+		int group_ret;
+		const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL }; 
+		/* find list of sids */
+		struct dom_sid **groupSIDs = NULL;
+		struct dom_sid *user_sid;
+		struct dom_sid *group_sid;
+		const char *sidstr;
+		int i;
+
+		group_ret = samdb_search(sam_ctx,
+					 mem_ctx, NULL, &group_msgs, group_attrs,
+					 "(&(member=%s)(sAMAccountType=*))", 
+					 dn);
+		
+		if (!(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs, 
+						   struct dom_sid *, group_ret))) {
+			talloc_destroy((*server_info)->mem_ctx);
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		/* Need to unroll some nested groups, but not aliases */
+		for (i = 0; i < group_ret; i++) {
+			sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
+			groupSIDs[i] = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		}
+		
+		sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
+		user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		group_sid->sub_auths[group_sid->num_auths-1] 
+			= samdb_result_uint(msgs[0], "primaryGroupID", 0);
+
+		if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx, 
+								     user_sid, group_sid, 
+								     group_ret, groupSIDs, 
+								     False, &(*server_info)->ptok))) {
+			DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
+			free_server_info(server_info);
+			return nt_status;
+		}
+	}
+
+	(*server_info)->guest = False;
+
 	(*server_info)->user_session_key = user_sess_key;
 	(*server_info)->lm_session_key = lm_sess_key;
 
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 6becf8c8b5..fda8c18fa4 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -26,40 +26,11 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
-extern DOM_SID global_sid_World;
-extern DOM_SID global_sid_Network;
-extern DOM_SID global_sid_Builtin_Guests;
-extern DOM_SID global_sid_Authenticated_Users;
-
-/****************************************************************************
- Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
- unix info.
-****************************************************************************/
-
-NTSTATUS auth_get_sam_account(const char *user, SAM_ACCOUNT **account) 
-{
-	BOOL pdb_ret;
-	NTSTATUS nt_status;
-	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(account))) {
-		return nt_status;
-	}
-	
-	become_root();
-	pdb_ret = pdb_getsampwnam(*account, user);
-	unbecome_root();
-
-	if (!pdb_ret) {
-		
-		struct passwd *pass = Get_Pwnam(user);
-		if (!pass) 
-			return NT_STATUS_NO_SUCH_USER;
-
-		if (!NT_STATUS_IS_OK(nt_status = pdb_fill_sam_pw(*account, pass))) {
-			return nt_status;
-		}
-	}
-	return NT_STATUS_OK;
-}
+extern struct dom_sid *global_sid_World;
+extern struct dom_sid *global_sid_Anonymous;
+extern struct dom_sid *global_sid_Network;
+extern struct dom_sid *global_sid_Builtin_Guests;
+extern struct dom_sid *global_sid_Authenticated_Users;
 
 /****************************************************************************
  Create an auth_usersupplied_data structure
@@ -428,11 +399,11 @@ void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
 	}
 	
 	DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n",
-				    sid_to_string(sid_str, &token->user_sids[0]) ));
+				    sid_to_string(sid_str, token->user_sids[0]) ));
 	DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", (unsigned long)token->num_sids));
 	for (i = 0; i < token->num_sids; i++)
 		DEBUGADDC(dbg_class, dbg_lev, ("SID[%3lu]: %s\n", (unsigned long)i, 
-					       sid_to_string(sid_str, &token->user_sids[i])));
+					       sid_to_string(sid_str, token->user_sids[i])));
 }
 
 /****************************************************************************
@@ -454,33 +425,30 @@ void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid, int
  Create the SID list for this user.
 ****************************************************************************/
 
-static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *group_sid, 
-				     int n_groupSIDs, DOM_SID *groupSIDs, 
-				     BOOL is_guest, NT_USER_TOKEN **token)
+NTSTATUS create_nt_user_token(TALLOC_CTX *mem_ctx, 
+			      struct dom_sid *user_sid, struct dom_sid *group_sid, 
+			      int n_groupSIDs, struct dom_sid **groupSIDs, 
+			      BOOL is_guest, struct nt_user_token **token)
 {
 	NTSTATUS       nt_status = NT_STATUS_OK;
-	NT_USER_TOKEN *ptoken;
+	struct nt_user_token *ptoken;
 	int i;
 	int sid_ndx;
 	
-	if ((ptoken = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
+	if (!(ptoken = talloc_p(mem_ctx, struct nt_user_token))) {
 		DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
 		nt_status = NT_STATUS_NO_MEMORY;
 		return nt_status;
 	}
 
-	ZERO_STRUCTP(ptoken);
-
-	ptoken->num_sids = n_groupSIDs + 5;
+	ptoken->num_sids = 0;
 
-	if ((ptoken->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
+	if (!(ptoken->user_sids = talloc_array_p(mem_ctx, struct dom_sid*, n_groupSIDs + 5))) {
 		DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
 		nt_status = NT_STATUS_NO_MEMORY;
 		return nt_status;
 	}
 	
-	memset((char*)ptoken->user_sids,0,sizeof(DOM_SID) * ptoken->num_sids);
-	
 	/*
 	 * Note - user SID *MUST* be first in token !
 	 * se_access_check depends on this.
@@ -488,9 +456,10 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
 	 * Primary group SID is second in token. Convention.
 	 */
 
-	sid_copy(&ptoken->user_sids[PRIMARY_USER_SID_INDEX], user_sid);
-	if (group_sid)
-		sid_copy(&ptoken->user_sids[PRIMARY_GROUP_SID_INDEX], group_sid);
+	ptoken->user_sids[PRIMARY_USER_SID_INDEX] = user_sid;
+	ptoken->num_sids++;
+	ptoken->user_sids[PRIMARY_GROUP_SID_INDEX] = group_sid;
+	ptoken->num_sids++;
 
 	/*
 	 * Finally add the "standard" SIDs.
@@ -498,29 +467,31 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
 	 * don't really support) is the addition of Authenticated_Users.
 	 */
 
-	sid_copy(&ptoken->user_sids[2], &global_sid_World);
-	sid_copy(&ptoken->user_sids[3], &global_sid_Network);
+	ptoken->user_sids[2] = global_sid_World;
+	ptoken->user_sids[3] = global_sid_Network;
+
+	if (is_guest) {
+		ptoken->user_sids[4] = global_sid_Builtin_Guests;
+		ptoken->num_sids++;
+	} else {
+		ptoken->user_sids[4] = global_sid_Authenticated_Users;
+		ptoken->num_sids++;
+	}
 
-	if (is_guest)
-		sid_copy(&ptoken->user_sids[4], &global_sid_Builtin_Guests);
-	else
-		sid_copy(&ptoken->user_sids[4], &global_sid_Authenticated_Users);
-	
 	sid_ndx = 5; /* next available spot */
 
 	for (i = 0; i < n_groupSIDs; i++) {
 		size_t check_sid_idx;
 		for (check_sid_idx = 1; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
-			if (sid_equal(&ptoken->user_sids[check_sid_idx], 
-				      &groupSIDs[i])) {
+			if (sid_equal(ptoken->user_sids[check_sid_idx], 
+				      groupSIDs[i])) {
 				break;
 			}
 		}
 		
 		if (check_sid_idx >= ptoken->num_sids) /* Not found already */ {
-			sid_copy(&ptoken->user_sids[sid_ndx++], &groupSIDs[i]);
-		} else {
-			ptoken->num_sids--;
+			ptoken->user_sids[sid_ndx++] = groupSIDs[i];
+			ptoken->num_sids++;
 		}
 	}
 	
@@ -535,65 +506,18 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
  Make a user_info struct
 ***************************************************************************/
 
-static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
+NTSTATUS make_server_info(auth_serversupplied_info **server_info, const char *username)
 {
-	*server_info = malloc(sizeof(**server_info));
+	TALLOC_CTX *mem_ctx = talloc_init("auth subsystem: server_info for %s", username);
+	*server_info = talloc_p(mem_ctx, auth_serversupplied_info);
 	if (!*server_info) {
 		DEBUG(0,("make_server_info: malloc failed!\n"));
+		talloc_destroy(mem_ctx);
 		return NT_STATUS_NO_MEMORY;
 	}
-	ZERO_STRUCTP(*server_info);
-
-	return NT_STATUS_OK;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a SAM_ACCOUNT
-***************************************************************************/
-
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, 
-			      SAM_ACCOUNT *sampass)
-{
-	NTSTATUS nt_status = NT_STATUS_OK;
-	const DOM_SID *user_sid = pdb_get_user_sid(sampass);
-	const DOM_SID *group_sid = pdb_get_group_sid(sampass);
-	NT_USER_TOKEN *token;
-	BOOL is_guest;
-	uint32 rid;
-
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sampass))) {
-		return nt_status;
-	}
-	
-	is_guest = (sid_peek_rid(user_sid, &rid) && rid == DOMAIN_USER_RID_GUEST);
-
-	if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token(user_sid, group_sid,
-							      0, NULL, is_guest, 
-							      &token)))
-	{
-		DEBUG(4,("create_nt_user_token failed\n"));
-		free_server_info(server_info);
-		return nt_status;
-	}
-
-	(*server_info)->ptok = token;
+	(*server_info)->mem_ctx = mem_ctx;
 	
-	return nt_status;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion 
- to a SAM_ACCOUNT
-***************************************************************************/
-
-NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
-{
-	NTSTATUS nt_status;
-	SAM_ACCOUNT *sampass = NULL;
-	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(&sampass, pwd))) {		
-		return nt_status;
-	}
-	return make_server_info_sam(server_info, sampass);
+	return NT_STATUS_OK;
 }
 
 /***************************************************************************
@@ -603,35 +527,29 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struc
 NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
 {
 	NTSTATUS nt_status;
-	SAM_ACCOUNT *sampass = NULL;
-	DOM_SID guest_sid;
+	static const char zeros[16];
 
-	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
-		return nt_status;
-	}
+	nt_status = make_server_info(server_info, "");
 
-	sid_copy(&guest_sid, get_global_sam_sid());
-	sid_append_rid(&guest_sid, DOMAIN_USER_RID_GUEST);
-
-	become_root();
-	if (!pdb_getsampwsid(sampass, &guest_sid)) {
-		unbecome_root();
-		return NT_STATUS_NO_SUCH_USER;
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
 	}
-	unbecome_root();
-
-	nt_status = make_server_info_sam(server_info, sampass);
-
-	if (NT_STATUS_IS_OK(nt_status)) {
-		static const char zeros[16];
-		(*server_info)->guest = True;
-		
-		/* annoying, but the Guest really does have a session key, 
-		   and it is all zeros! */
-		(*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
-		(*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+	
+	(*server_info)->guest = True;
+	
+	if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx, 
+							      global_sid_Anonymous, global_sid_Builtin_Guests,
+							      0, NULL, 
+							      True, &(*server_info)->ptok))) {
+		DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
+		free_server_info(server_info);
+		return nt_status;
 	}
-
+	
+	/* annoying, but the Guest really does have a session key, 
+	   and it is all zeros! */
+	(*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
+	(*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
 
 	return nt_status;
 }
@@ -666,14 +584,11 @@ void free_user_info(auth_usersupplied_info **user_info)
 
 void free_server_info(auth_serversupplied_info **server_info)
 {
-	DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
-	if (*server_info != NULL) {
-
-		/* call pam_end here, unless we know we are keeping it */
-		delete_nt_token( &(*server_info)->ptok );
-		ZERO_STRUCT(**server_info);
+	DEBUG(5,("attempting to free a server_info structure\n"));
+	if (!*server_info) {
+		talloc_destroy((*server_info)->mem_ctx);
 	}
-	SAFE_FREE(*server_info);
+	*server_info = NULL;
 }
 
 /***************************************************************************
@@ -714,32 +629,6 @@ void delete_nt_token(NT_USER_TOKEN **pptoken)
     SAFE_FREE(*pptoken);
 }
 
-/****************************************************************************
- Duplicate a SID token.
-****************************************************************************/
-
-struct nt_user_token *dup_nt_token(NT_USER_TOKEN *ptoken)
-{
-	NT_USER_TOKEN *token;
-
-	if (!ptoken)
-		return NULL;
-
-    if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
-        return NULL;
-
-    ZERO_STRUCTP(token);
-
-    if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
-        SAFE_FREE(token);
-        return NULL;
-    }
-
-    token->num_sids = ptoken->num_sids;
-
-	return token;
-}
-
 /**
  * Squash an NT_STATUS in line with security requirements.
  * In an attempt to avoid giving the whole game away when users
diff --git a/source4/auth/config.m4 b/source4/auth/config.m4
index b84ec5d475..8fc1f5edeb 100644
--- a/source4/auth/config.m4
+++ b/source4/auth/config.m4
@@ -2,7 +2,6 @@ dnl # AUTH Server subsystem
 
 SMB_MODULE(auth_sam,AUTH,STATIC,[auth/auth_sam.o])
 SMB_MODULE(auth_builtin,AUTH,STATIC,[auth/auth_builtin.o])
-SMB_MODULE(auth_unix,AUTH,STATIC,[auth/auth_unix.o])
 
 SMB_SUBSYSTEM(AUTH,auth/auth.o,
 		[auth/auth_ntlmssp.o