3 files changed, 302 insertions, 148 deletions

diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 4e797acd36..bae13bd996 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -144,6 +144,7 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 			
 			if(strequal(tok, user_info->wksta_name.str)) {
 				invalid_ws = False;
+
 				break;
 			}
 		}
@@ -171,38 +172,23 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 }
 
 /****************************************************************************
-check if a username/password is OK assuming the password is a 24 byte
-SMB hash supplied in the user_info structure
-return an NT_STATUS constant.
+ Look for the specified user in the sam, return ldb result structures
 ****************************************************************************/
 
-static NTSTATUS check_sam_security(const struct auth_context *auth_context,
-				   void *my_private_data, 
-				   TALLOC_CTX *mem_ctx,
-				   const struct auth_usersupplied_info *user_info, 
-				   struct auth_serversupplied_info **server_info)
+static NTSTATUS sam_search_user(const char *username, const char *domain, 
+				TALLOC_CTX *mem_ctx, void *sam_ctx, 
+				struct ldb_message ***ret_msgs, 
+				struct ldb_message ***ret_msgs_domain)
 {
 	struct ldb_message **msgs;
 	struct ldb_message **msgs_domain;
-	void *sam_ctx;
-	char *username = user_info->internal_username.str;
-	uint16_t acct_flags;
-	const char *workstation_list;
-	NTTIME acct_expiry;
-	NTTIME must_change_time;
-	NTTIME last_set_time;
 
 	uint_t ret;
 	uint_t ret_domain;
 
-	const char *domain_dn;
+	const char *domain_dn = NULL;
 	const char *domain_sid;
 
-	NTSTATUS nt_status;
-	DATA_BLOB user_sess_key = data_blob(NULL, 0);
-	DATA_BLOB lm_sess_key = data_blob(NULL, 0);
-	struct samr_Password *lm_pwd, *nt_pwd;
-
 	const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", 
 			       "userAccountControl",
 			       "pwdLastSet",
@@ -226,18 +212,31 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 			       NULL,
 	};
 
-	const char *domain_attrs[] =  {"name"};
+	const char *domain_attrs[] =  {"name", "objectSid"};
+
+	if (domain) {
+		/* find the domain's DN */
+		ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
+					  "(&(|(realm=%s)(name=%s))(objectclass=domain))", 
+					  domain, domain);
+		
+		if (ret_domain == 0) {
+			DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n", 
+				 domain));
+			return NT_STATUS_NO_SUCH_USER;
+		}
+		
+		if (ret_domain > 1) {
+			DEBUG(0,("Found %d records matching domain [%s]\n", 
+				 ret_domain, domain));
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		}
+
+		domain_dn = msgs_domain[0]->dn;
 
-	if (!user_info || !auth_context) {
-		return NT_STATUS_UNSUCCESSFUL;
-	}
-	
-	sam_ctx = samdb_connect(mem_ctx);
-	if (sam_ctx == NULL) {
-		return NT_STATUS_INVALID_SYSTEM_SERVICE;
 	}
 	/* pull the user attributes */
-	ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
+	ret = samdb_search(sam_ctx, mem_ctx, domain_dn, &msgs, attrs,
 			   "(&(sAMAccountName=%s)(objectclass=user))", 
 			   username);
 
@@ -252,30 +251,56 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 	
-	domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
-	if (!domain_sid) {
-		return NT_STATUS_INTERNAL_DB_CORRUPTION;
-	}
+	if (!domain) {
+		domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
+		if (!domain_sid) {
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		}
 
-	/* find the domain's DN */
-	ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
-			   "(&(objectSid=%s)(objectclass=domain))", 
-			   domain_sid);
+		/* find the domain's DN */
+		ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
+					  "(&(objectSid=%s)(objectclass=domain))", 
+					  domain_sid);
+		
+		if (ret_domain == 0) {
+			DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n", 
+				 domain_sid));
+			return NT_STATUS_NO_SUCH_USER;
+		}
+		
+		if (ret_domain > 1) {
+			DEBUG(0,("Found %d records matching domain [%s]\n", 
+				 ret_domain, domain_sid));
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		}
 
-	if (ret_domain == 0) {
-		DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n", 
-			 domain_sid));
-		return NT_STATUS_NO_SUCH_USER;
+		domain_dn = msgs_domain[0]->dn;
 	}
+	*ret_msgs = msgs;
+	*ret_msgs_domain = msgs_domain;
+	
+	return NT_STATUS_OK;
+}
+
+NTSTATUS sam_check_password(const struct auth_context *auth_context, 
+			    const char *username,
+			    TALLOC_CTX *mem_ctx, void *sam_ctx, 
+			    struct ldb_message **msgs,
+			    const char *domain_dn,
+			    const struct auth_usersupplied_info *user_info, 
+			    DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key) 
+{
+
+	uint16_t acct_flags;
+	const char *workstation_list;
+	NTTIME acct_expiry;
+	NTTIME must_change_time;
+	NTTIME last_set_time;
+	struct samr_Password *lm_pwd, *nt_pwd;
+
+	NTSTATUS nt_status;
 
-	if (ret_domain > 1) {
-		DEBUG(0,("Found %d records matching domain [%s]\n", 
-			 ret_domain, domain_sid));
-		return NT_STATUS_INTERNAL_DB_CORRUPTION;
-	}
 
-	domain_dn = msgs_domain[0]->dn;
-	
 	acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
 	
 	/* Quit if the account was locked out. */
@@ -293,7 +318,7 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 	nt_status = sam_password_ok(auth_context, mem_ctx, 
 				    username, acct_flags, 
 				    lm_pwd, nt_pwd,
-				    user_info, &user_sess_key, &lm_sess_key);
+				    user_info, user_sess_key, lm_sess_key);
 	
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		return nt_status;
@@ -314,68 +339,72 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 				   workstation_list,
 				   user_info);
 
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		return nt_status;
-	}
+	return nt_status;
+}
+
+NTSTATUS sam_make_server_info(TALLOC_CTX *mem_ctx, void *sam_ctx, 
+			      struct ldb_message **msgs, struct ldb_message **msgs_domain, 
+			      struct auth_serversupplied_info **server_info) 
+{
+
+	struct ldb_message **group_msgs;
+	int group_ret;
+	const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL }; 
+	/* find list of sids */
+	struct dom_sid **groupSIDs = NULL;
+	struct dom_sid *user_sid;
+	struct dom_sid *primary_group_sid;
+	const char *sidstr;
+	int i;
+	uint_t rid;
+	
+	NTSTATUS nt_status;
 
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info(auth_context, server_info, username))) {		
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(mem_ctx, server_info, 
+							  samdb_result_string(msgs[0], "sAMAccountName", "")))) {		
 		DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
 		return nt_status;
 	}
-
-	{
-		struct ldb_message **group_msgs;
-		char *dn = msgs[0]->dn;
-		int group_ret;
-		const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL }; 
-		/* find list of sids */
-		struct dom_sid **groupSIDs = NULL;
-		struct dom_sid *user_sid;
-		struct dom_sid *primary_group_sid;
-		const char *sidstr;
-		int i;
-		uint_t rid;
-
-		group_ret = samdb_search(sam_ctx,
-					 mem_ctx, NULL, &group_msgs, group_attrs,
-					 "(&(member=%s)(sAMAccountType=*))", 
-					 dn);
-		if (group_ret == -1) {
-			return NT_STATUS_INTERNAL_DB_CORRUPTION;
-		}
-		
-		if (group_ret > 0 && 
-		    !(groupSIDs = talloc_array_p(*server_info, struct dom_sid *, group_ret))) {
-			talloc_free(*server_info);
-			return NT_STATUS_NO_MEMORY;
-		}
-
-		/* Need to unroll some nested groups, but not aliases */
-		for (i = 0; i < group_ret; i++) {
-			sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
-			groupSIDs[i] = dom_sid_parse_talloc(*server_info, sidstr);
-		}
-		
-		sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
-		user_sid = dom_sid_parse_talloc(*server_info, sidstr);
-		primary_group_sid = dom_sid_parse_talloc(*server_info, sidstr);
-		rid = samdb_result_uint(msgs[0], "primaryGroupID", ~0);
-		if (rid == ~0) {
-			if (group_ret > 0) {
-				primary_group_sid = groupSIDs[0];
-			} else {
-				primary_group_sid = NULL;
-			}
+	
+	group_ret = samdb_search(sam_ctx,
+				 mem_ctx, NULL, &group_msgs, group_attrs,
+				 "(&(member=%s)(sAMAccountType=*))", 
+				 msgs[0]->dn);
+	if (group_ret == -1) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+	
+	if (group_ret > 0 && 
+	    !(groupSIDs = talloc_array_p(*server_info, struct dom_sid *, group_ret))) {
+		talloc_free(*server_info);
+		return NT_STATUS_NO_MEMORY;
+	}
+	
+	/* Need to unroll some nested groups, but not aliases */
+	for (i = 0; i < group_ret; i++) {
+		sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
+		groupSIDs[i] = dom_sid_parse_talloc(*server_info, sidstr);
+	}
+	
+	sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
+	user_sid = dom_sid_parse_talloc(*server_info, sidstr);
+	primary_group_sid = dom_sid_parse_talloc(*server_info, sidstr);
+	rid = samdb_result_uint(msgs[0], "primaryGroupID", ~0);
+	if (rid == ~0) {
+		if (group_ret > 0) {
+			primary_group_sid = groupSIDs[0];
 		} else {
-			primary_group_sid->sub_auths[primary_group_sid->num_auths-1] = rid;
+			primary_group_sid = NULL;
 		}
-
-		(*server_info)->user_sid = user_sid;
-		(*server_info)->primary_group_sid = primary_group_sid;
-		
-		(*server_info)->n_domain_groups = group_ret;
-		(*server_info)->domain_groups = groupSIDs;
+	} else {
+		primary_group_sid->sub_auths[primary_group_sid->num_auths-1] = rid;
 	}
+	
+	(*server_info)->user_sid = user_sid;
+	(*server_info)->primary_group_sid = primary_group_sid;
+	
+	(*server_info)->n_domain_groups = group_ret;
+	(*server_info)->domain_groups = groupSIDs;
 
 	(*server_info)->account_name 
 		= talloc_strdup(*server_info, 
@@ -409,10 +438,10 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 	(*server_info)->last_password_change = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
 	(*server_info)->allow_password_change
 		= samdb_result_allow_password_change(sam_ctx, mem_ctx, 
-						     domain_dn, msgs[0], "pwdLastSet");
+						     msgs_domain[0]->dn, msgs[0], "pwdLastSet");
 	(*server_info)->force_password_change
 		= samdb_result_force_password_change(sam_ctx, mem_ctx, 
-						     domain_dn, msgs[0], "pwdLastSet");
+						     msgs_domain[0]->dn, msgs[0], "pwdLastSet");
 
 	(*server_info)->logon_count = samdb_result_uint(msgs[0], "logonCount", 0);
 	(*server_info)->bad_password_count = samdb_result_uint(msgs[0], "badPwdCount", 0);
@@ -421,9 +450,6 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 
 	(*server_info)->guest = False;
 
-	(*server_info)->user_session_key = user_sess_key;
-	(*server_info)->lm_session_key = lm_sess_key;
-
 	if (!(*server_info)->account_name 
 	    || !(*server_info)->full_name 
 	    || !(*server_info)->logon_script
@@ -437,6 +463,85 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 	return nt_status;
 }
 
+NTSTATUS sam_get_server_info(const char *username, const char *domain, TALLOC_CTX *mem_ctx,
+			     struct auth_serversupplied_info **server_info)
+{
+	NTSTATUS nt_status;
+
+	struct ldb_message **msgs;
+	struct ldb_message **domain_msgs;
+	void *sam_ctx;
+
+	sam_ctx = samdb_connect(mem_ctx);
+	if (sam_ctx == NULL) {
+		return NT_STATUS_INVALID_SYSTEM_SERVICE;
+	}
+
+	nt_status = sam_search_user(username, domain, mem_ctx, sam_ctx, &msgs, &domain_msgs);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+
+	nt_status = sam_make_server_info(mem_ctx, sam_ctx, msgs, domain_msgs, server_info);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS check_sam_security_internals(const struct auth_context *auth_context,
+					     const char *domain,
+					     TALLOC_CTX *mem_ctx,
+					     const struct auth_usersupplied_info *user_info, 
+					     struct auth_serversupplied_info **server_info)
+{
+	NTSTATUS nt_status;
+
+	const char *username = user_info->internal_username.str;
+	struct ldb_message **msgs;
+	struct ldb_message **domain_msgs;
+	void *sam_ctx;
+	DATA_BLOB user_sess_key, lm_sess_key;
+
+	sam_ctx = samdb_connect(mem_ctx);
+	if (sam_ctx == NULL) {
+		return NT_STATUS_INVALID_SYSTEM_SERVICE;
+	}
+
+	nt_status = sam_search_user(username, domain, mem_ctx, sam_ctx, &msgs, &domain_msgs);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+
+	nt_status = sam_check_password(auth_context, username, mem_ctx, sam_ctx, msgs, domain_msgs[0]->dn, user_info,
+				       &user_sess_key, &lm_sess_key);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+	
+	nt_status = sam_make_server_info(mem_ctx, sam_ctx, msgs, domain_msgs, server_info);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+
+	talloc_reference(auth_context, *server_info);
+
+	(*server_info)->user_session_key = user_sess_key;
+	(*server_info)->lm_session_key = lm_sess_key;
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS check_sam_security(const struct auth_context *auth_context,
+				   void *my_private_data, 
+				   TALLOC_CTX *mem_ctx,
+				   const struct auth_usersupplied_info *user_info, 
+				   struct auth_serversupplied_info **server_info)
+{
+	return check_sam_security_internals(auth_context, NULL,
+					    mem_ctx, user_info, server_info);
+}
+
 /* module initialisation */
 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, 
 					   const char *param, 
@@ -462,22 +567,44 @@ static NTSTATUS check_samstrict_security(const struct auth_context *auth_context
 					 const struct auth_usersupplied_info *user_info, 
 					 struct auth_serversupplied_info **server_info)
 {
+	const char *domain;
+	BOOL is_local_name, is_my_domain;
 
 	if (!user_info || !auth_context) {
 		return NT_STATUS_LOGON_FAILURE;
 	}
 
-	/* If we are a domain member, we must not 
-	   attempt to check the password locally,
-	   unless it is one of our aliases. */
+	is_local_name = is_myname(user_info->domain.str);
+	is_my_domain  = strequal(user_info->domain.str, lp_workgroup());
+
+	/* check whether or not we service this domain/workgroup name */
 	
-	if (!is_myname(user_info->domain.str)) {
-		DEBUG(7,("The requested user domain is not the local server name. [%s]\\[%s]\n",
-			user_info->domain.str,user_info->internal_username.str));
-		return NT_STATUS_NO_SUCH_USER;
+	switch ( lp_server_role() ) {
+		case ROLE_STANDALONE:
+		case ROLE_DOMAIN_MEMBER:
+			if ( !is_local_name ) {
+				DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
+					user_info->domain.str, (lp_server_role() == ROLE_DOMAIN_MEMBER 
+					? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
+				return NT_STATUS_NOT_IMPLEMENTED;
+			}
+			domain = lp_netbios_name();
+			break;
+		case ROLE_DOMAIN_PDC:
+		case ROLE_DOMAIN_BDC:
+			if ( !is_local_name && !is_my_domain ) {
+				DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
+					user_info->domain.str));
+				return NT_STATUS_NOT_IMPLEMENTED;
+			}
+			domain = lp_workgroup();
+			break;
+		default: /* name is ok */
+			domain = user_info->domain.str;
+			break;
 	}
 	
-	return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
+	return check_sam_security_internals(auth_context, domain, mem_ctx, user_info, server_info);
 }
 
 /* module initialisation */
diff --git a/source4/libcli/auth/gensec_krb5.c b/source4/libcli/auth/gensec_krb5.c
index 14e2f586c3..1ce05b519e 100644
--- a/source4/libcli/auth/gensec_krb5.c
+++ b/source4/libcli/auth/gensec_krb5.c
@@ -611,39 +611,48 @@ static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security
 	struct dom_sid *sid;
 	char *p;
 	char *principal;
+	const char *username;
+	const char *realm;
 
 	*session_info_out = NULL;
 
-	nt_status = make_server_info(gensec_security, &server_info, gensec_krb5_state->peer_principal);
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		return nt_status;
-	}
-
-	server_info->guest = False;
+	/* IF we have the PAC - otherwise (TODO) we need to get this
+	 * data from elsewere - local ldb, or lookup of some
+	 * kind... */
 
-	principal = talloc_strdup(server_info, gensec_krb5_state->peer_principal);
+	principal = talloc_strdup(gensec_krb5_state, gensec_krb5_state->peer_principal);
 	p = strchr(principal, '@');
 	if (p) {
 		*p = '\0';
 	}
-	server_info->account_name = principal;
-	server_info->domain = talloc_strdup(server_info, p++);
-	if (!server_info->domain) {
-		free_server_info(&server_info);
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	nt_status = make_session_info(server_info, &session_info);
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		free_server_info(&server_info);
-		return nt_status;
-	}
+	p++;
+	username = principal;
+	realm = p;
+	
+	if (logon_info) {
+		nt_status = make_server_info(gensec_krb5_state, &server_info, gensec_krb5_state->peer_principal);
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			return nt_status;
+		}
+		
+		server_info->guest = False;
+		
+		server_info->account_name = talloc_strdup(server_info, principal);
+		server_info->domain = talloc_strdup(server_info, realm);
+		if (!server_info->domain) {
+			free_server_info(&server_info);
+			return NT_STATUS_NO_MEMORY;
+		}
+		
+		/* references the server_info into the session_info */
+		nt_status = make_session_info(gensec_krb5_state, server_info, &session_info);
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			free_server_info(&server_info);
+			return nt_status;
+		}
 
-	/* IF we have the PAC - otherwise (TODO) we need to get this
-	 * data from elsewere - local ldb, or lookup of some
-	 * kind... */
+		talloc_free(server_info);
 
-	if (logon_info) {
 		ptoken = talloc_p(session_info, struct nt_user_token);
 		if (!ptoken) {
 			return NT_STATUS_NO_MEMORY;
@@ -666,16 +675,37 @@ static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security
 		
 		for (;ptoken->num_sids < logon_info->groups_count; ptoken->num_sids++) {
 			sid = dom_sid_dup(session_info, logon_info->dom_sid);
-			ptoken->user_sids[ptoken->num_sids] = dom_sid_add_rid(session_info, sid, logon_info->groups[ptoken->num_sids - 2].rid);
+			ptoken->user_sids[ptoken->num_sids]
+				= dom_sid_add_rid(session_info, sid, 
+						  logon_info->groups[ptoken->num_sids - 2].rid);
 		}
 		
 		debug_nt_user_token(DBGC_AUTH, 0, ptoken);
 		
 		session_info->nt_user_token = ptoken;
 	} else {
-		session_info->nt_user_token = NULL;
+		TALLOC_CTX *mem_ctx = talloc_named(gensec_krb5_state, 0, "PAC-less session info discovery for %s@%s", username, realm);
+		if (!mem_ctx) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		nt_status = sam_get_server_info(username, realm, gensec_krb5_state, &server_info);
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			talloc_free(mem_ctx);
+			return nt_status;
+		}
+
+		/* references the server_info into the session_info */
+		nt_status = make_session_info(gensec_krb5_state, server_info, &session_info);
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			talloc_free(mem_ctx);
+			return nt_status;
+		}
+
+		talloc_free(mem_ctx);
 	}
 
+	talloc_free(principal);
+
 	nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
 
 	session_info->workstation = NULL;
diff --git a/source4/libcli/auth/gensec_ntlmssp.c b/source4/libcli/auth/gensec_ntlmssp.c
index 0683581495..48438aaae1 100644
--- a/source4/libcli/auth/gensec_ntlmssp.c
+++ b/source4/libcli/auth/gensec_ntlmssp.c
@@ -370,19 +370,16 @@ static NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security, T
  */
 
 static NTSTATUS gensec_ntlmssp_session_info(struct gensec_security *gensec_security,
-				     struct auth_session_info **session_info) 
+					    struct auth_session_info **session_info) 
 {
 	NTSTATUS nt_status;
 	struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
-	nt_status = make_session_info(gensec_ntlmssp_state->server_info, session_info);
+	nt_status = make_session_info(gensec_ntlmssp_state, gensec_ntlmssp_state->server_info, session_info);
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		return nt_status;
 	}
 
-	/* the session_info owns this now */
-	gensec_ntlmssp_state->server_info = NULL;
-
 	(*session_info)->session_key = data_blob_talloc(*session_info, 
 							gensec_ntlmssp_state->ntlmssp_state->session_key.data,
 							gensec_ntlmssp_state->ntlmssp_state->session_key.length);