1 files changed, 260 insertions, 142 deletions

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index e8f2af41f3..8e1b420b47 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -1,4 +1,4 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Authentication utility functions
    Copyright (C) Andrew Tridgell 1992-1998
@@ -36,7 +36,7 @@ extern DOM_SID global_sid_Authenticated_Users;
  Create a UNIX user on demand.
 ****************************************************************************/
 
-static int smb_create_user(const char *unix_user, const char *homedir)
+static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
 {
 	pstring add_script;
 	int ret;
@@ -44,7 +44,9 @@ static int smb_create_user(const char *unix_user, const char *homedir)
 	pstrcpy(add_script, lp_adduser_script());
 	if (! *add_script)
 		return -1;
-	all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
+	all_string_sub(add_script, "%u", unix_username, sizeof(pstring));
+	if (domain)
+		all_string_sub(add_script, "%D", domain, sizeof(pstring));
 	if (homedir)
 		all_string_sub(add_script, "%H", homedir, sizeof(pstring));
 	ret = smbrun(add_script,NULL);
@@ -54,25 +56,30 @@ static int smb_create_user(const char *unix_user, const char *homedir)
 
 /****************************************************************************
  Add and Delete UNIX users on demand, based on NTSTATUS codes.
+ We don't care about RID's here so ignore.
 ****************************************************************************/
 
-void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
+void auth_add_user_script(const char *domain, const char *username)
 {
-	struct passwd *pwd=NULL;
-
-	if (NT_STATUS_IS_OK(nt_status)) {
-
-		if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
-			
-			/*
-			 * User validated ok against Domain controller.
-			 * If the admin wants us to try and create a UNIX
-			 * user on the fly, do so.
-			 */
-			
-			if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
-				smb_create_user(user_info->internal_username.str, NULL);
-			}
+	uint32 rid;
+	/*
+	 * User validated ok against Domain controller.
+	 * If the admin wants us to try and create a UNIX
+	 * user on the fly, do so.
+	 */
+	
+	if ( lp_adduser_script() ) 
+		smb_create_user(domain, username, NULL);
+	else {
+		DEBUG(10,("auth_add_user_script: no 'add user script'.  Asking winbindd\n"));
+		
+		/* should never get here is we a re a domain member running winbindd
+		   However, a host set for 'security = server' might run winbindd for 
+		   account allocation */
+		   
+		if ( !winbind_create_user(username, NULL) ) {
+			DEBUG(5,("auth_add_user_script: winbindd_create_user() failed\n"));
+			rid = 0;
 		}
 	}
 }
@@ -208,41 +215,26 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
 	DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
 	      client_domain, smb_name, wksta_name));
 	
-	if (lp_allow_trusted_domains() && *client_domain) {
-
-		/* the client could have given us a workstation name
-		   or other crap for the workgroup - we really need a
-		   way of telling if this domain name is one of our
-		   trusted domain names 
-
-		   Also don't allow "" as a domain, fixes a Win9X bug 
+	/* don't allow "" as a domain, fixes a Win9X bug 
 		   where it doens't supply a domain for logon script
-		   'net use' commands.
-
-		   Finally, we do this by looking up a cache of trusted domains!
-		*/
+	   'net use' commands.*/
 
+	if ( *client_domain )
 		domain = client_domain;
+	else
+		domain = lp_workgroup();
 
-		if (is_trusted_domain(domain)) {
-			return make_user_info(user_info, smb_name, internal_username,
-			                      client_domain, domain, wksta_name,
-			                      lm_pwd, nt_pwd, plaintext, ntlmssp_flags,
-			                      encrypted);
-		}
+	/* do what win2k does.  Always map unknown domains to our own
+	   and let the "passdb backend" handle unknown users. */
 
-	} else {
-		domain = lp_workgroup();
-	}
+	if ( !is_trusted_domain(domain) ) 
+		domain = get_default_sam_name();
 	
-	return make_user_info(user_info, 
-			      smb_name, internal_username,
-			      client_domain, domain,
-			      wksta_name, 
-			      lm_pwd, nt_pwd,
-			      plaintext, 
-			      ntlmssp_flags, encrypted);
+	/* we know that it is a trusted domain (and we are allowing them) or it is our domain */
 	
+	return make_user_info(user_info, smb_name, internal_username, 
+		client_domain, domain, wksta_name, lm_pwd, nt_pwd,
+		plaintext, ntlmssp_flags, encrypted);
 }
 
 /****************************************************************************
@@ -611,10 +603,10 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups,
 	NT_USER_TOKEN *token;
 	int i;
 
-	if (NT_STATUS_IS_ERR(uid_to_sid(&user_sid, uid))) {
+	if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid, uid))) {
 		return NULL;
 	}
-	if (NT_STATUS_IS_ERR(gid_to_sid(&group_sid, gid))) {
+	if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid, gid))) {
 		return NULL;
 	}
 
@@ -625,7 +617,7 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups,
 	}
 
 	for (i = 0; i < ngroups; i++) {
-		if (NT_STATUS_IS_ERR(gid_to_sid(&(group_sids)[i], (groups)[i]))) {
+		if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids)[i], (groups)[i]))) {
 			DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups[i]));
 			SAFE_FREE(group_sids);
 			return NULL;
@@ -654,29 +646,22 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups,
  * of groups.
  ******************************************************************************/
 
-static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
+static NTSTATUS get_user_groups_from_local_sam(const char *username, uid_t uid, gid_t gid,
 					       int *n_groups, DOM_SID **groups,	gid_t **unix_groups)
 {
-	uid_t             uid;
-	gid_t             gid;
 	int               n_unix_groups;
 	int               i;
 
 	*n_groups = 0;
 	*groups   = NULL;
 
-	if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sampass), &uid)) || NT_STATUS_IS_ERR(sid_to_gid(pdb_get_group_sid(sampass), &gid))) {
-		DEBUG(0, ("get_user_groups_from_local_sam: error fetching uid or gid for user!\n"));
-		return NT_STATUS_UNSUCCESSFUL;
-	}
-	
 	n_unix_groups = groups_max();
 	if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) {
 		DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
 		return NT_STATUS_NO_MEMORY;
 	}
 	
-	if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
+	if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) {
 		gid_t *groups_tmp;
 		groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups);
 		if (!groups_tmp) {
@@ -685,7 +670,7 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
 		}
 		*unix_groups = groups_tmp;
 
-		if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
+		if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) {
 			DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
 			SAFE_FREE(*unix_groups);
 			return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */
@@ -706,7 +691,7 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
 	*n_groups = n_unix_groups;
 
 	for (i = 0; i < *n_groups; i++) {
-		if (NT_STATUS_IS_ERR(gid_to_sid(&(*groups)[i], (*unix_groups)[i]))) {
+		if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups)[i], (*unix_groups)[i]))) {
 			DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups)[i+1]));
 			SAFE_FREE(*groups);
 			SAFE_FREE(*unix_groups);
@@ -721,10 +706,8 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
  Make a user_info struct
 ***************************************************************************/
 
-static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
+static NTSTATUS make_server_info(auth_serversupplied_info **server_info)
 {
-	NTSTATUS ret;
-
 	*server_info = malloc(sizeof(**server_info));
 	if (!*server_info) {
 		DEBUG(0,("make_server_info: malloc failed!\n"));
@@ -732,24 +715,25 @@ static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACC
 	}
 	ZERO_STRUCTP(*server_info);
 
-	(*server_info)->sam_fill_level = SAM_FILL_ALL;
-	(*server_info)->sam_account    = sampass;
-	if (NT_STATUS_IS_ERR(ret = sid_to_uid(pdb_get_user_sid(sampass), &((*server_info)->uid))))
-		return ret;
-	if (NT_STATUS_IS_ERR(ret = sid_to_gid(pdb_get_group_sid(sampass), &((*server_info)->gid))))
-		return ret;
+	/* Initialise the uid and gid values to something non-zero
+	   which may save us from giving away root access if there
+	   is a bug in allocating these fields. */
+
+	(*server_info)->uid = -1;
+	(*server_info)->gid = -1;
 
 	return NT_STATUS_OK;
 }
 
 /***************************************************************************
- Make (and fill) a user_info struct from a SAM_ACCOUNT
+Fill a server_info struct from a SAM_ACCOUNT with their groups
 ***************************************************************************/
 
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, 
-			      SAM_ACCOUNT *sampass)
+static NTSTATUS add_user_groups(auth_serversupplied_info **server_info, 
+				SAM_ACCOUNT *sampass,
+				uid_t uid, gid_t gid)
 {
-	NTSTATUS nt_status = NT_STATUS_OK;
+	NTSTATUS nt_status;
 	const DOM_SID *user_sid = pdb_get_user_sid(sampass);
 	const DOM_SID *group_sid = pdb_get_group_sid(sampass);
 	int       n_groupSIDs = 0;
@@ -759,14 +743,11 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
 	BOOL is_guest;
 	uint32 rid;
 
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sampass))) {
-		return nt_status;
-	}
-	
-	if (!NT_STATUS_IS_OK(nt_status 
-			     = get_user_groups_from_local_sam(sampass, 
-		&n_groupSIDs, &groupSIDs, &unix_groups)))
-	{
+	nt_status = get_user_groups_from_local_sam(pdb_get_username(sampass),
+						   uid, gid, 
+						   &n_groupSIDs, &groupSIDs,
+						   &unix_groups);
+	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(4,("get_user_groups_from_local_sam failed\n"));
 		free_server_info(server_info);
 		return nt_status;
@@ -789,11 +770,49 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
 
 	(*server_info)->n_groups = n_groupSIDs;
 	(*server_info)->groups = unix_groups;
-
 	(*server_info)->ptok = token;
+
+	return nt_status;
+}
+
+/***************************************************************************
+ Make (and fill) a user_info struct from a SAM_ACCOUNT
+***************************************************************************/
+
+NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, 
+			      SAM_ACCOUNT *sampass)
+{
+	NTSTATUS nt_status;
+	struct passwd *pwd;
+
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info)))
+		return nt_status;
+
+	(*server_info)->sam_account    = sampass;
+
+	if ( !(pwd = getpwnam_alloc(pdb_get_username(sampass))) )  {
+		DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
+			  pdb_get_username(sampass)));
+		free_server_info(server_info);
+		return NT_STATUS_NO_SUCH_USER;
+	}
+	(*server_info)->unix_name = smb_xstrdup(pwd->pw_name);
+	(*server_info)->gid = pwd->pw_gid;
+	(*server_info)->uid = pwd->pw_uid;
 	
-	DEBUG(5,("make_server_info_sam: made server info for user %s\n",
-		 pdb_get_username((*server_info)->sam_account)));
+	passwd_free(&pwd);
+
+	if (!NT_STATUS_IS_OK(nt_status = add_user_groups(server_info, sampass, 
+							 (*server_info)->uid, 
+							 (*server_info)->gid))) {
+		free_server_info(server_info);
+		return nt_status;
+	}
+
+	(*server_info)->sam_fill_level = SAM_FILL_ALL;
+	DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
+		 pdb_get_username(sampass),
+		 (*server_info)->unix_name));
 
 	return nt_status;
 }
@@ -810,7 +829,22 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struc
 	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(&sampass, pwd))) {		
 		return nt_status;
 	}
-	return make_server_info_sam(server_info, sampass);
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info))) {
+		return nt_status;
+	}
+
+	(*server_info)->sam_account    = sampass;
+
+	if (!NT_STATUS_IS_OK(nt_status = add_user_groups(server_info, sampass, pwd->pw_uid, pwd->pw_gid))) {
+		return nt_status;
+	}
+
+	(*server_info)->unix_name = smb_xstrdup(pwd->pw_name);
+
+	(*server_info)->sam_fill_level = SAM_FILL_ALL;
+	(*server_info)->uid = pwd->pw_uid;
+	(*server_info)->gid = pwd->pw_gid;
+	return nt_status;
 }
 
 /***************************************************************************
@@ -847,6 +881,43 @@ NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
 }
 
 /***************************************************************************
+ Purely internal function for make_server_info_info3
+ Fill the sam account from getpwnam
+***************************************************************************/
+static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx, 
+				 const char *domain,
+				 const char *username,
+				 char **found_username,
+				 uid_t *uid, gid_t *gid,
+				 SAM_ACCOUNT **sam_account)
+{
+	fstring dom_user;
+	struct passwd *passwd;
+
+	fstr_sprintf(dom_user, "%s%s%s",
+		     domain, lp_winbind_separator(), username);
+
+	passwd = Get_Pwnam(dom_user);
+
+	/* if the lookup for DOMAIN\username failed, try again 
+	   with just 'username'.  This is need for accessing the server
+	   as a trust user that actually maps to a local account */
+
+	if ( !passwd ) 
+		passwd = Get_Pwnam(username);
+
+	if (passwd == NULL)
+		return NT_STATUS_NO_SUCH_USER;
+
+	*uid = passwd->pw_uid;
+	*gid = passwd->pw_gid;
+
+	*found_username = talloc_strdup(mem_ctx, passwd->pw_name);
+
+	return pdb_init_sam_pw(sam_account, passwd);
+}
+
+/***************************************************************************
  Make a server_info struct from the info3 returned by a domain logon 
 ***************************************************************************/
 
@@ -858,7 +929,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 				NET_USER_INFO_3 *info3) 
 {
 	NTSTATUS nt_status = NT_STATUS_OK;
-
+	char *found_username;
 	const char *nt_domain;
 	const char *nt_username;
 
@@ -866,10 +937,8 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 	DOM_SID user_sid;
 	DOM_SID group_sid;
 
-	struct passwd *passwd;
-
-	unid_t u_id, g_id;
-	int u_type, g_type;
+	uid_t uid;
+	gid_t gid;
 
 	int n_lgroupSIDs;
 	DOM_SID *lgroupSIDs   = NULL;
@@ -905,40 +974,20 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 		/* If the server didn't give us one, just use the one we sent them */
 		domain = domain;
 	}
-
-	u_type = ID_USERID;
-	g_type = ID_GROUPID;
-	if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&u_id, &u_type, &user_sid))
-	    && NT_STATUS_IS_OK(idmap_get_id_from_sid(&g_id, &g_type, &group_sid))
-	    && ((passwd = getpwuid_alloc(u_id.uid)))) {
-		nt_status = pdb_init_sam_pw(&sam_account, passwd);
-		passwd_free(&passwd);
-	} else {
-		char *dom_user;
-		dom_user = talloc_asprintf(mem_ctx, "%s%s%s", 
-					   nt_domain,
-					   lp_winbind_separator(),
-					   internal_username);
-		
-		if (!dom_user) {
-			DEBUG(0, ("talloc_asprintf failed!\n"));
-			return NT_STATUS_NO_MEMORY;
-		} else { 
-		
-			if (!(passwd = Get_Pwnam(dom_user))
-				/* Only lookup local for the local
-				   domain, we don't want this for
-				   trusted domains */
-			    && strequal(nt_domain, lp_workgroup())) {
-				passwd = Get_Pwnam(internal_username);
-			}
-			    
-			if (!passwd) {
-				return NT_STATUS_NO_SUCH_USER;
-			} else {
-				nt_status = pdb_init_sam_pw(&sam_account, passwd);
-			}
-		}
+	
+	/* try to fill the SAM account..  If getpwnam() fails, then try the 
+	   add user script (2.2.x behavior) */
+	   
+	nt_status = fill_sam_account(mem_ctx, nt_domain, internal_username,
+		&found_username, &uid, &gid, &sam_account);
+
+	if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
+		DEBUG(3,("User %s does not exist, trying to add it\n", 
+			internal_username));
+		auth_add_user_script(nt_domain, internal_username);
+		nt_status = fill_sam_account(mem_ctx, nt_domain, 
+			internal_username, &found_username,
+			&uid, &gid, &sam_account);
 	}
 	
 	if (!NT_STATUS_IS_OK(nt_status)) {
@@ -946,17 +995,12 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 		return nt_status;
 	}
 		
-	if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
+	if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
 		pdb_free_sam(&sam_account);
-		return NT_STATUS_UNSUCCESSFUL;
+		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
-		pdb_free_sam(&sam_account);
-		return NT_STATUS_UNSUCCESSFUL;
-	}
-		
-	if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
+	if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
 		pdb_free_sam(&sam_account);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -966,7 +1010,18 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (!pdb_set_fullname(sam_account, unistr2_static(&(info3->uni_full_name)), PDB_CHANGED)) {
+	if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
+		pdb_free_sam(&sam_account);
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+	if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
+		pdb_free_sam(&sam_account);
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+		
+	if (!pdb_set_fullname(sam_account, unistr2_static(&(info3->uni_full_name)), 
+			      PDB_CHANGED)) {
 		pdb_free_sam(&sam_account);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -991,20 +1046,31 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sam_account))) {
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info))) {
 		DEBUG(4, ("make_server_info failed!\n"));
 		pdb_free_sam(&sam_account);
 		return nt_status;
 	}
 
+	/* save this here to _net_sam_logon() doesn't fail (it assumes a 
+	   valid SAM_ACCOUNT) */
+		   
+	(*server_info)->sam_account = sam_account;
+
+	(*server_info)->unix_name = smb_xstrdup(found_username);
+
+	/* Fill in the unix info we found on the way */
+
+	(*server_info)->sam_fill_level = SAM_FILL_ALL;
+	(*server_info)->uid = uid;
+	(*server_info)->gid = gid;
+
 	/* Store the user group information in the server_info 
 	   returned to the caller. */
 	
-	if (!NT_STATUS_IS_OK(nt_status 
-			     = get_user_groups_from_local_sam(sam_account, 
-							      &n_lgroupSIDs, 
-							      &lgroupSIDs, 
-							      &unix_groups)))
+	nt_status = get_user_groups_from_local_sam((*server_info)->unix_name,
+		uid, gid, &n_lgroupSIDs, &lgroupSIDs, &unix_groups);
+	if ( !NT_STATUS_IS_OK(nt_status) )
 	{
 		DEBUG(4,("get_user_groups_from_local_sam failed\n"));
 		return nt_status;
@@ -1018,8 +1084,9 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 				  (n_lgroupSIDs + info3->num_groups2 +
 				   info3->num_other_sids));
 	if (!all_group_SIDs) {
-		DEBUG(0, ("create_nt_token_info3: malloc() failed for DOM_SID list!\n"));
+		DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
 		SAFE_FREE(lgroupSIDs);
+		free_server_info(server_info);
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -1032,9 +1099,10 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 		sid_copy(&all_group_SIDs[i+n_lgroupSIDs], &(info3->dom_sid.sid));
 		if (!sid_append_rid(&all_group_SIDs[i+n_lgroupSIDs], info3->gids[i].g_rid)) {
 			nt_status = NT_STATUS_INVALID_PARAMETER;
-			DEBUG(3,("create_nt_token_info3: could not append additional group rid 0x%x\n",
+			DEBUG(3,("could not append additional group rid 0x%x\n",
 				info3->gids[i].g_rid));			
 			SAFE_FREE(lgroupSIDs);
+			free_server_info(server_info);
 			return nt_status;
 		}
 	}
@@ -1060,6 +1128,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 			    all_group_SIDs, False, &token))) {
 		DEBUG(4,("create_nt_user_token failed\n"));
 		SAFE_FREE(all_group_SIDs);
+		free_server_info(server_info);
 		return nt_status;
 	}
 
@@ -1111,6 +1180,7 @@ void free_server_info(auth_serversupplied_info **server_info)
 		/* call pam_end here, unless we know we are keeping it */
 		delete_nt_token( &(*server_info)->ptok );
 		SAFE_FREE((*server_info)->groups);
+		SAFE_FREE((*server_info)->unix_name);
 		ZERO_STRUCT(**server_info);
 	}
 	SAFE_FREE(*server_info);
@@ -1208,4 +1278,52 @@ NTSTATUS nt_status_squash(NTSTATUS nt_status)
 }
 
 
+/**
+ * Verify whether or not given domain is trusted.
+ *
+ * @param domain_name name of the domain to be verified
+ * @return true if domain is one of the trusted once or
+ *         false if otherwise
+ **/
+
+BOOL is_trusted_domain(const char* dom_name)
+{
+	DOM_SID trustdom_sid;
+	char *pass = NULL;
+	time_t lct;
+	BOOL ret;
+
+	/* no trusted domains for a standalone server */
+
+	if ( lp_server_role() == ROLE_STANDALONE )
+		return False;
+
+	/* if we are a DC, then check for a direct trust relationships */
+
+	if (lp_server_role() == ROLE_DOMAIN_BDC || lp_server_role() == ROLE_DOMAIN_PDC) {
+		become_root();
+		ret = secrets_fetch_trusted_domain_password(dom_name, &pass, &trustdom_sid, &lct);
+		unbecome_root();
+		SAFE_FREE(pass);
+		if (ret)
+			return True;
+	}
+	else {
+		/* if winbindd is not up and we are a domain member) then we need to update the
+		   trustdom_cache ourselves */
+
+		if ( !winbind_ping() )
+			update_trustdom_cache();
+	}
+
+	/* now the trustdom cache should be available a DC could still
+	 * have a transitive trust so fall back to the cache of trusted
+	 * domains (like a domain member would use  */
+
+	if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
+		return True;
+	}
+
+	return False;
+}