From: Volker Lendecke <vlendec@samba.org>
Date: Wed, 19 Oct 2005 13:45:44 +0000 (+0000)
Subject: r11181: Implement wbinfo -s and wbinfo --user-sids. The patch is so large because
X-Git-Tag: samba-4.0.0alpha6~801^3~8474
X-Git-Url: http://git.samba.org/samba.git/?a=commitdiff_plain;h=0f51ae83f09fa90362cae12a37ca4debc35f8491;p=samba.git

r11181: Implement wbinfo -s and wbinfo --user-sids. The patch is so large because
--user-sids required the extension to trusted domains.

Implement "winbind sealed pipes" parameter for debugging purposes.

Volker
(This used to be commit 3821a17bdb68b2f1389b5a150502c057d28569d2)
---

diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index 5957dfc0251..03c05998715 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -140,6 +140,7 @@ typedef struct
 	char **server_services;
 	char *ntptr_providor;
 	char *szWinbindSeparator;
+	BOOL bWinbindSealedPipes;
 	char *swat_directory;
 	BOOL tls_enabled;
 	char *tls_keyfile;
@@ -550,6 +551,7 @@ static struct parm_struct parm_table[] = {
 	{"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE},
 	{"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER},
 	{"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER },
+	{"winbind sealed pipes", P_BOOL, P_GLOBAL, &Globals.bWinbindSealedPipes, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER },
 
 	{NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0}
 };
@@ -671,6 +673,7 @@ static void init_globals(void)
 	do_parameter("WINSsupport", "False", NULL);
 
 	do_parameter("winbind separator", "\\", NULL);
+	do_parameter("winbind sealed pipes", "True", NULL);
 
 	do_parameter("client signing", "Yes", NULL);
 	do_parameter("server signing", "auto", NULL);
@@ -812,6 +815,7 @@ FN_GLOBAL_STRING(lp_sam_url, &Globals.szSAM_URL)
 FN_GLOBAL_STRING(lp_spoolss_url, &Globals.szSPOOLSS_URL)
 FN_GLOBAL_STRING(lp_wins_url, &Globals.szWINS_URL)
 FN_GLOBAL_CONST_STRING(lp_winbind_separator, &Globals.szWinbindSeparator)
+FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
 FN_GLOBAL_STRING(lp_private_dir, &Globals.szPrivateDir)
 FN_GLOBAL_STRING(lp_serverstring, &Globals.szServerString)
 FN_GLOBAL_STRING(lp_lockdir, &Globals.szLockDir)
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk
index d071dd16047..551f5c47bb4 100644
--- a/source4/winbind/config.mk
+++ b/source4/winbind/config.mk
@@ -10,11 +10,15 @@ INIT_OBJ_FILES = \
 		winbind/wb_samba3_protocol.o \
 		winbind/wb_samba3_cmd.o \
 		winbind/wb_init_domain.o \
+		winbind/wb_sid2domain.o \
+		winbind/wb_domain_request.o \
 		winbind/wb_connect_lsa.o \
 		winbind/wb_connect_sam.o \
 		winbind/wb_cmd_lookupname.o \
+		winbind/wb_cmd_lookupsid.o \
 		winbind/wb_cmd_getdcname.o \
 		winbind/wb_cmd_userdomgroups.o \
+		winbind/wb_cmd_usersids.o \
 		winbind/wb_pam_auth.o \
 		winbind/wb_async_helpers.o
 REQUIRED_SUBSYSTEMS = RPC_NDR_LSA
diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c
index c8749896df5..35f3ec3bb72 100644
--- a/source4/winbind/wb_async_helpers.c
+++ b/source4/winbind/wb_async_helpers.c
@@ -360,6 +360,163 @@ NTSTATUS wb_get_schannel_creds(struct cli_credentials *wks_creds,
 	return wb_get_schannel_creds_recv(c, mem_ctx, netlogon_pipe);
 }
 
+struct lsa_lookupsids_state {
+	struct composite_context *ctx;
+	int num_sids;
+	struct lsa_LookupSids r;
+	struct lsa_SidArray sids;
+	struct lsa_TransNameArray names;
+	uint32_t count;
+	struct wb_sid_object **result;
+};
+
+static void lsa_lookupsids_recv_names(struct rpc_request *req);
+
+struct composite_context *wb_lsa_lookupsids_send(struct dcerpc_pipe *lsa_pipe,
+						 struct policy_handle *handle,
+						 int num_sids,
+						 const struct dom_sid **sids)
+{
+	struct composite_context *result;
+	struct rpc_request *req;
+	struct lsa_lookupsids_state *state;
+	int i;
+
+	result = talloc_zero(NULL, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = lsa_pipe->conn->event_ctx;
+
+	state = talloc(result, struct lsa_lookupsids_state);
+	if (state == NULL) goto failed;
+	result->private_data = state;
+	state->ctx = result;
+
+	state->sids.num_sids = num_sids;
+	state->sids.sids = talloc_array(state, struct lsa_SidPtr, num_sids);
+	if (state->sids.sids == NULL) goto failed;
+
+	for (i=0; i<num_sids; i++) {
+		state->sids.sids[i].sid = dom_sid_dup(state->sids.sids,
+						      sids[i]);
+		if (state->sids.sids[i].sid == NULL) goto failed;
+	}
+
+	state->count = 0;
+	state->num_sids = num_sids;
+	state->names.count = 0;
+	state->names.names = NULL;
+
+	state->r.in.handle = handle;
+	state->r.in.sids = &state->sids;
+	state->r.in.names = &state->names;
+	state->r.in.level = 1;
+	state->r.in.count = &state->count;
+	state->r.out.names = &state->names;
+	state->r.out.count = &state->count;
+
+	req = dcerpc_lsa_LookupSids_send(lsa_pipe, state, &state->r);
+	if (req == NULL) goto failed;
+
+	req->async.callback = lsa_lookupsids_recv_names;
+	req->async.private = state;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void lsa_lookupsids_recv_names(struct rpc_request *req)
+{
+	struct lsa_lookupsids_state *state =
+		talloc_get_type(req->async.private,
+				struct lsa_lookupsids_state);
+	int i;
+
+	state->ctx->status = dcerpc_ndr_request_recv(req);
+	if (!composite_is_ok(state->ctx)) return;
+	state->ctx->status = state->r.out.result;
+	if (!NT_STATUS_IS_OK(state->ctx->status) &&
+	    !NT_STATUS_EQUAL(state->ctx->status, STATUS_SOME_UNMAPPED)) {
+		composite_error(state->ctx, state->ctx->status);
+		return;
+	}
+
+	state->result = talloc_array(state, struct wb_sid_object *,
+				     state->num_sids);
+	if (composite_nomem(state->result, state->ctx)) return;
+
+	for (i=0; i<state->num_sids; i++) {
+		struct lsa_TranslatedName *name =
+			&state->r.out.names->names[i];
+		struct lsa_TrustInformation *dom;
+
+		state->result[i] = talloc_zero(state->result,
+					       struct wb_sid_object);
+		if (composite_nomem(state->result[i], state->ctx)) return;
+
+		state->result[i]->type = name->sid_type;
+		if (state->result[i]->type == SID_NAME_UNKNOWN) {
+			continue;
+		}
+
+		if (name->sid_index >= state->r.out.domains->count) {
+			composite_error(state->ctx,
+					NT_STATUS_INVALID_PARAMETER);
+			return;
+		}
+
+		dom = &state->r.out.domains->domains[name->sid_index];
+		state->result[i]->domain = talloc_reference(state->result[i],
+							    dom->name.string);
+		if ((name->sid_type == SID_NAME_DOMAIN) ||
+		    (name->name.string == NULL)) {
+			state->result[i]->name =
+				talloc_strdup(state->result[i], "");
+		} else {
+			state->result[i]->name =
+				talloc_steal(state->result[i],
+					     name->name.string);
+		}
+
+		if (composite_nomem(state->result[i]->name, state->ctx)) {
+			return;
+		}
+	}
+
+	composite_done(state->ctx);
+}
+
+NTSTATUS wb_lsa_lookupsids_recv(struct composite_context *c,
+				TALLOC_CTX *mem_ctx,
+				struct wb_sid_object ***names)
+{
+	NTSTATUS status = composite_wait(c);
+	if (NT_STATUS_IS_OK(status)) {
+		struct lsa_lookupsids_state *state =
+			talloc_get_type(c->private_data,
+					struct lsa_lookupsids_state);
+		*names = talloc_steal(mem_ctx, state->result);
+	}
+	talloc_free(c);
+	return status;
+}
+
+NTSTATUS wb_lsa_lookupsids(struct dcerpc_pipe *lsa_pipe,
+			   struct policy_handle *handle,
+			   int num_sids, const struct dom_sid **sids,
+			   TALLOC_CTX *mem_ctx,
+			   struct wb_sid_object ***names)
+{
+	struct composite_context *c =
+		wb_lsa_lookupsids_send(lsa_pipe, handle, num_sids, sids);
+	return wb_lsa_lookupnames_recv(c, mem_ctx, names);
+}
+
+			   
+
 struct lsa_lookupnames_state {
 	struct composite_context *ctx;
 	uint32_t num_names;
@@ -747,4 +904,3 @@ NTSTATUS wb_samr_userdomgroups_recv(struct composite_context *ctx,
 	talloc_free(ctx);
 	return status;
 }
-	
diff --git a/source4/winbind/wb_async_helpers.h b/source4/winbind/wb_async_helpers.h
index 1bf1c78ca83..413747090c3 100644
--- a/source4/winbind/wb_async_helpers.h
+++ b/source4/winbind/wb_async_helpers.h
@@ -33,3 +33,8 @@ struct wb_sid_object {
 	const char *domain;
 	const char *name;
 };
+
+struct wb_dom_info {
+	const char *name;
+	const struct dom_sid *sid;
+};
diff --git a/source4/winbind/wb_cmd_getdcname.c b/source4/winbind/wb_cmd_getdcname.c
index 3ddcbc89620..72e0ba0efdc 100644
--- a/source4/winbind/wb_cmd_getdcname.c
+++ b/source4/winbind/wb_cmd_getdcname.c
@@ -24,6 +24,7 @@
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_stream.h"
+#include "smbd/service_task.h"
 
 #include "librpc/gen_ndr/ndr_netlogon.h"
 
@@ -63,7 +64,7 @@ static void composite_netr_GetAnyDCName_recv_rpc(struct rpc_request *req)
 	composite_done(ctx);
 }
 
-NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
+static NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
 {
 	NTSTATUS status = composite_wait(ctx);
 	talloc_free(ctx);
@@ -72,30 +73,28 @@ NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
 
 struct cmd_getdcname_state {
 	struct composite_context *ctx;
-	struct wbsrv_domain *domain;
 	const char *domain_name;
 
 	struct netr_GetAnyDCName g;
 };
 
-static struct composite_context *getdcname_send_req(void *p);
+static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain,
+						    void *p);
 static NTSTATUS getdcname_recv_req(struct composite_context *ctx, void *p);
 
-struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call,
-						const char *domain)
+struct composite_context *wb_cmd_getdcname_send(struct wbsrv_service *service,
+						struct wbsrv_domain *domain,
+						const char *domain_name)
 {
 	struct cmd_getdcname_state *state;
-	struct wbsrv_service *service = call->wbconn->listen_socket->service;
 
 	state = talloc(NULL, struct cmd_getdcname_state);
-	state->domain = service->domains;
-	state->domain_name = talloc_strdup(state, domain);
-	state->ctx = wb_queue_domain_send(state, state->domain,
-					  call->event_ctx,
-					  call->wbconn->conn->msg_ctx,
-					  getdcname_send_req,
-					  getdcname_recv_req,
-					  state);
+	state->domain_name = talloc_strdup(state, domain_name);
+	state->ctx = wb_domain_request_send(state, service,
+					    service->primary_sid,
+					    getdcname_send_req,
+					    getdcname_recv_req,
+					    state);
 	if (state->ctx == NULL) {
 		talloc_free(state);
 		return NULL;
@@ -104,17 +103,17 @@ struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call,
 	return state->ctx;
 }
 
-static struct composite_context *getdcname_send_req(void *p)
+static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain, void *p)
 {
 	struct cmd_getdcname_state *state =
 		talloc_get_type(p, struct cmd_getdcname_state);
 
 	state->g.in.logon_server = talloc_asprintf(
 		state, "\\\\%s",
-		dcerpc_server_name(state->domain->netlogon_pipe));
+		dcerpc_server_name(domain->netlogon_pipe));
 	state->g.in.domainname = state->domain_name;
 
-	return composite_netr_GetAnyDCName_send(state->domain->netlogon_pipe,
+	return composite_netr_GetAnyDCName_send(domain->netlogon_pipe,
 						state, &state->g);
 }
 
diff --git a/source4/winbind/wb_cmd_list_trustdom.c b/source4/winbind/wb_cmd_list_trustdom.c
new file mode 100644
index 00000000000..1f3ba267d0b
--- /dev/null
+++ b/source4/winbind/wb_cmd_list_trustdom.c
@@ -0,0 +1,124 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Command backend for wbinfo -m
+
+   Copyright (C) Volker Lendecke 2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+#include "smbd/service_task.h"
+
+/* List trusted domains. To avoid the trouble with having to wait for other
+ * conflicting requests waiting for the lsa pipe we're opening our own lsa
+ * pipe here. */
+
+struct cmd_list_trustdom_state {
+	struct composite_context *ctx;
+	struct dcerpc_pipe *lsa_pipe;
+	struct policy_handle *lsa_policy;
+	int num_domains;
+	struct wb_dom_info *domains;
+
+	uint32_t resume_handle;
+	struct lsa_DomainList domains;
+	struct lsa_EnumTrustDom r;
+};
+
+static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx);
+static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx);
+static void cmd_list_trustdoms_recv_doms(struct rpc_request *req);
+
+struct composite_context *wb_cmd_list_trustdoms_send(struct wbsrv_service *service)
+{
+	struct composite_context *result, *ctx;
+	struct cmd_list_trustdom_state *state;
+
+	result = talloc_zero(NULL, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = service->task->event_ctx;
+
+	state = talloc(result, struct cmd_list_trustdom_state);
+	if (state == NULL) goto failed;
+	state->ctx = result;
+	result->private_data = state;
+
+	state->service = service;
+
+	ctx = wb_sid2domain_send(service, service->primary_sid);
+	if (ctx == NULL) goto failed;
+	ctx->async.fn = cmd_list_trustdoms_recv_domain;
+	ctx->async.private_data = state;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx)
+{
+	struct cmd_list_trustdom_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct cmd_list_trustdom_state);
+	struct wbsrv_domain *domain;
+	struct smbcli_tree *tree;
+
+	state->ctx->status = wb_sid2domain_recv(ctx, &domain);
+	if (!composite_is_ok(state->ctx)) return;
+
+	tree = dcerpc_smb_tree(domain->lsa_pipe);
+	if (composite_nomem(tree, state->tree)) return;
+
+	ctx = wb_init_lsa_send(tree, domain->lsa_auth_type,
+			       domain->schannel_creds);
+	composite_continue(state->ctx, ctx, cmd_list_trustdoms_recv_lsa,
+			   state);
+}
+
+static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx)
+{
+	struct cmd_list_trustdom_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct cmd_list_trustdom_state);
+	struct rpc_request *req;
+
+	state->ctx->status = wb_init_lsa_recv(ctx, state,
+					      &state->lsa_pipe,
+					      &state->lsa_policy);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->resume_handle = 0;
+	state->r.in.policy_handle = state->lsa_policy;
+	state->r.in.resume_handle = &state->resume_handle;
+	state->r.in.max_size = 1000;
+	state->r.out.resume_handle = &state->resume_handle;
+
+	req = dcerpc_lsa_EnumTrustDom_send(state->lsa_pipe, state, &state->r);
+	composite_continue_rpc(state->ctx, req, cmd_list_trustdoms_recv_doms,
+			       state);
+}
+
+static void cmd_list_trustdoms_recv_doms(struct rpc_request *req)
+{
+	
+}
diff --git a/source4/winbind/wb_cmd_lookupname.c b/source4/winbind/wb_cmd_lookupname.c
index 9889b70d848..abdcaad02da 100644
--- a/source4/winbind/wb_cmd_lookupname.c
+++ b/source4/winbind/wb_cmd_lookupname.c
@@ -24,49 +24,49 @@
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_stream.h"
+#include "smbd/service_task.h"
 
 struct cmd_lookupname_state {
 	struct composite_context *ctx;
-	struct wbsrv_call *call;
-	struct wbsrv_domain *domain;
 	const char *name;
 	struct wb_sid_object *result;
 };
 
-static struct composite_context *lookupname_send_req(void *p);
+static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain, void *p);
 static NTSTATUS lookupname_recv_req(struct composite_context *ctx, void *p);
 
-struct composite_context *wb_cmd_lookupname_send(struct wbsrv_call *call,
+struct composite_context *wb_cmd_lookupname_send(struct wbsrv_service *service,
+						 struct wbsrv_domain *domain,
+						 const char *dom_name,
 						 const char *name)
 {
 	struct cmd_lookupname_state *state;
-	struct wbsrv_service *service = call->wbconn->listen_socket->service;
 
 	state = talloc(NULL, struct cmd_lookupname_state);
-	state->domain = service->domains;
-	state->call = call;
-	state->name = talloc_strdup(state, name);
-	state->ctx = wb_queue_domain_send(state, state->domain,
-					  call->event_ctx,
-					  call->wbconn->conn->msg_ctx,
-					  lookupname_send_req,
-					  lookupname_recv_req,
-					  state);
-	if (state->ctx == NULL) {
-		talloc_free(state);
-		return NULL;
-	}
+	state->name = talloc_asprintf(state, "%s\\%s", dom_name, name);
+	if (state->name == NULL) goto failed;
+	state->ctx = wb_domain_request_send(state, service,
+					    service->primary_sid,
+					    lookupname_send_req,
+					    lookupname_recv_req,
+					    state);
+	if (state->ctx == NULL) goto failed;
 	state->ctx->private_data = state;
 	return state->ctx;
+
+ failed:
+	talloc_free(state);
+	return NULL;
 }
 
-static struct composite_context *lookupname_send_req(void *p)
+static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain,
+						     void *p)
 {
 	struct cmd_lookupname_state *state =
 		talloc_get_type(p, struct cmd_lookupname_state);
 
-	return wb_lsa_lookupnames_send(state->domain->lsa_pipe,
-				       state->domain->lsa_policy,
+	return wb_lsa_lookupnames_send(domain->lsa_pipe,
+				       domain->lsa_policy,
 				       1, &state->name);
 }
 
@@ -98,10 +98,13 @@ NTSTATUS wb_cmd_lookupname_recv(struct composite_context *c,
 	return status;
 }
 
-NTSTATUS wb_cmd_lookupname(struct wbsrv_call *call, const char *name,
+NTSTATUS wb_cmd_lookupname(struct wbsrv_service *service,
+			   struct wbsrv_domain *domain,
+			   const char *dom_name,
+			   const char *name,
 			   TALLOC_CTX *mem_ctx, struct wb_sid_object **sid)
 {
 	struct composite_context *c =
-		wb_cmd_lookupname_send(call, name);
+		wb_cmd_lookupname_send(service, domain, dom_name, name);
 	return wb_cmd_lookupname_recv(c, mem_ctx, sid);
 }
diff --git a/source4/winbind/wb_cmd_lookupsid.c b/source4/winbind/wb_cmd_lookupsid.c
new file mode 100644
index 00000000000..c189f0329a1
--- /dev/null
+++ b/source4/winbind/wb_cmd_lookupsid.c
@@ -0,0 +1,107 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Command backend for wbinfo -s
+
+   Copyright (C) Volker Lendecke 2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+#include "smbd/service_task.h"
+
+struct cmd_lookupsid_state {
+	struct composite_context *ctx;
+	const struct dom_sid *sid;
+	struct wb_sid_object *result;
+};
+
+static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p);
+static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p);
+
+struct composite_context *wb_cmd_lookupsid_send(struct wbsrv_service *service,
+						struct wbsrv_domain *domain,
+						const struct dom_sid *sid)
+{
+	struct cmd_lookupsid_state *state;
+
+	state = talloc(NULL, struct cmd_lookupsid_state);
+	state->sid = dom_sid_dup(state, sid);
+	if (state->sid == NULL) goto failed;
+	state->ctx = wb_domain_request_send(state, service,
+					    service->primary_sid,
+					    lookupsid_send_req,
+					    lookupsid_recv_req,
+					    state);
+	if (state->ctx == NULL) goto failed;
+	state->ctx->private_data = state;
+	return state->ctx;
+
+ failed:
+	talloc_free(state);
+	return NULL;
+}
+
+static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p)
+{
+	struct cmd_lookupsid_state *state =
+		talloc_get_type(p, struct cmd_lookupsid_state);
+
+	return wb_lsa_lookupsids_send(domain->lsa_pipe,
+				      domain->lsa_policy,
+				      1, &state->sid);
+}
+
+static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p)
+{
+	struct cmd_lookupsid_state *state =
+		talloc_get_type(p, struct cmd_lookupsid_state);
+	struct wb_sid_object **names;
+	NTSTATUS status;
+
+	status = wb_lsa_lookupsids_recv(ctx, state, &names);
+	if (NT_STATUS_IS_OK(status)) {
+		state->result = names[0];
+	}
+	return status;
+}
+
+NTSTATUS wb_cmd_lookupsid_recv(struct composite_context *c,
+			       TALLOC_CTX *mem_ctx,
+			       struct wb_sid_object **sid)
+{
+	struct cmd_lookupsid_state *state =
+		talloc_get_type(c->private_data, struct cmd_lookupsid_state);
+	NTSTATUS status = composite_wait(c);
+	if (NT_STATUS_IS_OK(status)) {
+		*sid = talloc_steal(mem_ctx, state->result);
+	}
+	talloc_free(state);
+	return status;
+}
+
+NTSTATUS wb_cmd_lookupsid(struct wbsrv_service *service,
+			  struct wbsrv_domain *domain,
+			  const struct dom_sid *sid,
+			  TALLOC_CTX *mem_ctx, struct wb_sid_object **name)
+{
+	struct composite_context *c =
+		wb_cmd_lookupsid_send(service, domain, sid);
+	return wb_cmd_lookupsid_recv(c, mem_ctx, name);
+}
diff --git a/source4/winbind/wb_cmd_userdomgroups.c b/source4/winbind/wb_cmd_userdomgroups.c
index ea2db9877f9..b69547b3e46 100644
--- a/source4/winbind/wb_cmd_userdomgroups.c
+++ b/source4/winbind/wb_cmd_userdomgroups.c
@@ -29,70 +29,29 @@
 
 struct cmd_userdomgroups_state {
 	struct composite_context *ctx;
-	struct wbsrv_domain *domain;
+	struct dom_sid *dom_sid;
 	uint32_t user_rid;
 	int num_rids;
 	uint32_t *rids;
 };
 
-static void composite_trigger_now(struct event_context *ev,
-				  struct timed_event *te,
-				  struct timeval t, void *ptr)
-{
-	struct composite_context *c =
-		talloc_get_type(ptr, struct composite_context);
-	if (NT_STATUS_IS_OK(c->status)) {
-		c->state = COMPOSITE_STATE_ERROR;
-	} else {
-		c->state = COMPOSITE_STATE_DONE;
-	}
-		
-	if (c->async.fn) {
-		c->async.fn(c);
-	}
-}
-
-
-static struct composite_context *userdomgroups_send_req(void *p);
+static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain, void *p);
 static NTSTATUS userdomgroups_recv_req(struct composite_context *ctx, void *p);
 
-struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call,
+struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_service *service,
 						    const struct dom_sid *sid)
 {
 	struct cmd_userdomgroups_state *state;
-	struct wbsrv_service *service = call->wbconn->listen_socket->service;
 
 	state = talloc(NULL, struct cmd_userdomgroups_state);
-	state->domain = service->domains;
-
-	if (dom_sid_in_domain(state->domain->sid, sid)) {
-		state->user_rid = sid->sub_auths[sid->num_auths-1];
-		state->ctx = wb_queue_domain_send(state, state->domain,
-						  call->event_ctx,
-						  call->wbconn->conn->msg_ctx,
-						  userdomgroups_send_req,
-						  userdomgroups_recv_req,
-						  state);
-		if (state->ctx == NULL) goto failed;
-		state->ctx->private_data = state;
-		return state->ctx;
-	}
 
-	state->ctx = talloc(state, struct composite_context);
+	state->user_rid = sid->sub_auths[sid->num_auths-1];
+	state->ctx = wb_domain_request_send(state, service, sid,
+					    userdomgroups_send_req,
+					    userdomgroups_recv_req,
+					    state);
 	if (state->ctx == NULL) goto failed;
-	state->ctx->state = COMPOSITE_STATE_IN_PROGRESS;
-	state->ctx->async.fn = NULL;
-	state->ctx->event_ctx = call->event_ctx;
-	state->ctx->status = NT_STATUS_NO_SUCH_USER;
 	state->ctx->private_data = state;
-
-	/* Using composite_trigger_error here causes problems with the client
-	 * socket. Linux 2.6.8 gives me a ECONNRESET on the next read after
-	 * writing the reply when I don't wait the 100 milliseconds. */
-	
-	event_add_timed(state->ctx->event_ctx, state->ctx,
-			timeval_current_ofs(0, 100000),
-			composite_trigger_now, state->ctx);
 	return state->ctx;
 
  failed:
@@ -100,13 +59,16 @@ struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call,
 	return NULL;
 }
 
-static struct composite_context *userdomgroups_send_req(void *p)
+static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain,
+							void *p)
 {
 	struct cmd_userdomgroups_state *state =
 		talloc_get_type(p, struct cmd_userdomgroups_state);
 
-	return wb_samr_userdomgroups_send(state->domain->samr_pipe,
-					  state->domain->domain_handle,
+	state->dom_sid = talloc_reference(state, domain->sid);
+	if (state->dom_sid == NULL) return NULL;
+	return wb_samr_userdomgroups_send(domain->samr_pipe,
+					  domain->domain_handle,
 					  state->user_rid);
 }
 
@@ -140,7 +102,7 @@ NTSTATUS wb_cmd_userdomgroups_recv(struct composite_context *c,
 	}
 
 	for (i=0; i<state->num_rids; i++) {
-		(*sids)[i] = dom_sid_add_rid((*sids), state->domain->sid,
+		(*sids)[i] = dom_sid_add_rid((*sids), state->dom_sid,
 					     state->rids[i]);
 		if ((*sids)[i] == NULL) {
 			status = NT_STATUS_NO_MEMORY;
@@ -153,12 +115,12 @@ done:
 	return status;
 }
 
-NTSTATUS wb_cmd_userdomgroups(struct wbsrv_call *call,
+NTSTATUS wb_cmd_userdomgroups(struct wbsrv_service *service,
 			      const struct dom_sid *sid,
 			      TALLOC_CTX *mem_ctx, int *num_sids,
 			      struct dom_sid ***sids)
 {
 	struct composite_context *c =
-		wb_cmd_userdomgroups_send(call, sid);
+		wb_cmd_userdomgroups_send(service, sid);
 	return wb_cmd_userdomgroups_recv(c, mem_ctx, num_sids, sids);
 }
diff --git a/source4/winbind/wb_cmd_usersids.c b/source4/winbind/wb_cmd_usersids.c
new file mode 100644
index 00000000000..47c69fffc80
--- /dev/null
+++ b/source4/winbind/wb_cmd_usersids.c
@@ -0,0 +1,333 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Command backend for wbinfo --user-sids
+
+   Copyright (C) Volker Lendecke 2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+#include "smbd/service_task.h"
+#include "lib/events/events.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "librpc/gen_ndr/ndr_samr.h"
+
+/* Calculate the token in two steps: Go the user's originating domain, asking
+ * for the user's domain groups. Then with the resulting list of sids go to
+ * our own domain, expanding the aliases aka domain local groups. Two helpers
+ * are needed: composite_samr_GetAliasMembership and wb_sidaliases. The core
+ * function this file supplies is wb_cmd_usersids somewhere down. */
+
+
+/* composite_context wrapper around dcerpc_samr_GetAliasMembership */
+
+static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req);
+
+static struct composite_context *composite_samr_GetAliasMembership_send(struct dcerpc_pipe *p,
+									TALLOC_CTX *mem_ctx,
+									struct samr_GetAliasMembership *r)
+{
+	struct composite_context *result;
+	struct rpc_request *req;
+
+	result = talloc(mem_ctx, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = p->conn->event_ctx;
+
+	req = dcerpc_samr_GetAliasMembership_send(p, mem_ctx, r);
+	if (req == NULL) goto failed;
+	req->async.callback = composite_samr_GetAliasMembership_recv_rpc;
+	req->async.private = result;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req)
+{
+	struct composite_context *ctx =
+		talloc_get_type(req->async.private, struct composite_context);
+
+	ctx->status = dcerpc_ndr_request_recv(req);
+	if (!composite_is_ok(ctx)) return;
+	composite_done(ctx);
+}
+
+static NTSTATUS composite_samr_GetAliasMembership_recv(struct composite_context *ctx)
+{
+	NTSTATUS status = composite_wait(ctx);
+	talloc_free(ctx);
+	return status;
+}
+
+/* Composite wrapper including domain selection and domain queueing around
+ * GetAliasMemberships */
+
+struct sidaliases_state {
+	struct composite_context *ctx;
+	int num_sids;
+	const struct dom_sid *domain_sid;
+	const struct dom_sid *sids;
+
+	struct lsa_SidArray lsa_sids;
+	struct samr_Ids rids;
+	struct samr_GetAliasMembership r;
+};
+
+static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain,
+						     void *p);
+static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p);
+
+static struct composite_context *wb_sidaliases_send(struct wbsrv_service *service,
+						    int num_sids,
+						    struct dom_sid **sids)
+{
+	struct sidaliases_state *state;
+	int i;
+
+	state = talloc(NULL, struct sidaliases_state);
+
+	state->domain_sid = talloc_reference(state, service->primary_sid);
+	if (state->domain_sid == NULL) goto failed;
+
+	state->lsa_sids.num_sids = num_sids;
+	state->lsa_sids.sids = talloc_array(state, struct lsa_SidPtr,
+					    num_sids);
+	if (state->lsa_sids.sids == NULL) goto failed;
+
+	for (i=0; i<state->lsa_sids.num_sids; i++) {
+		state->lsa_sids.sids[i].sid =
+			talloc_reference(state->lsa_sids.sids, sids[i]);
+		if (state->lsa_sids.sids[i].sid == NULL) goto failed;
+	}
+
+	state->rids.count = 0;
+	state->rids.ids = NULL;
+
+	state->ctx = wb_domain_request_send(state, service,
+					    service->primary_sid,
+					    sidaliases_send_req,
+					    sidaliases_recv_req,
+					    state);
+	if (state->ctx == NULL) goto failed;
+	state->ctx->private_data = state;
+	return state->ctx;
+
+ failed:
+	talloc_free(state);
+	return NULL;
+}
+
+static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain,
+						     void *p)
+{
+	struct sidaliases_state *state =
+		talloc_get_type(p, struct sidaliases_state);
+
+	state->r.in.domain_handle = domain->domain_handle;
+	state->r.in.sids = &state->lsa_sids;
+	state->r.out.rids = &state->rids;
+
+	return composite_samr_GetAliasMembership_send(domain->samr_pipe,
+						      state, &state->r);
+}
+
+static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p)
+{
+	struct sidaliases_state *state =
+		talloc_get_type(p, struct sidaliases_state);
+	NTSTATUS status;
+
+	status = composite_samr_GetAliasMembership_recv(ctx);
+	NT_STATUS_NOT_OK_RETURN(status);
+	return state->r.out.result;
+}
+
+static NTSTATUS wb_sidaliases_recv(struct composite_context *ctx,
+				   TALLOC_CTX *mem_ctx,
+				   int *num_sids,
+				   struct dom_sid ***sids)
+{
+	struct sidaliases_state *state =
+		talloc_get_type(ctx->private_data,
+				struct sidaliases_state);
+	NTSTATUS status;
+	int i;
+
+	status = composite_wait(ctx);
+	if (!NT_STATUS_IS_OK(status)) goto done;
+
+	*num_sids = state->r.out.rids->count;
+	*sids = talloc_array(mem_ctx, struct dom_sid *, *num_sids);
+	if (*sids == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+	for (i=0; i<*num_sids; i++) {
+		(*sids)[i] = dom_sid_add_rid((*sids), state->domain_sid,
+					     state->r.out.rids->ids[i]);
+		if ((*sids)[i] == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto done;
+		}
+	}
+
+ done:
+	talloc_free(state);
+	return status;
+}
+
+/* Supplied a SID, go to the user's DC, ask it for the user's domain
+ * groups. Then go to our DC, ask it for the domain local groups. */
+
+struct cmd_usersids_state {
+	struct composite_context *ctx;
+	struct wbsrv_service *service;
+	struct dom_sid *user_sid;
+	int num_domgroups;
+	struct dom_sid **domgroups;
+	int num_sids;
+	struct dom_sid **sids;
+};
+
+static void cmd_usersids_recv_domgroups(struct composite_context *ctx);
+static void cmd_usersids_recv_aliases(struct composite_context *ctx);
+
+struct composite_context *wb_cmd_usersids_send(struct wbsrv_service *service,
+					       const struct dom_sid *sid)
+{
+	struct composite_context *result, *ctx;
+	struct cmd_usersids_state *state;
+
+	result = talloc_zero(NULL, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = service->task->event_ctx;
+
+	state = talloc(result, struct cmd_usersids_state);
+	if (state == NULL) goto failed;
+	state->ctx = result;
+	result->private_data = state;
+
+	state->service = service;
+	state->user_sid = dom_sid_dup(state, sid);
+	if (state->user_sid == NULL) goto failed;
+
+	ctx = wb_cmd_userdomgroups_send(service, sid);
+	if (ctx == NULL) goto failed;
+
+	ctx->async.fn = cmd_usersids_recv_domgroups;
+	ctx->async.private_data = state;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void cmd_usersids_recv_domgroups(struct composite_context *ctx)
+{
+	struct cmd_usersids_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct cmd_usersids_state);
+
+	int i;
+	struct dom_sid **sids;
+
+	state->ctx->status = wb_cmd_userdomgroups_recv(ctx, state,
+						       &state->num_domgroups,
+						       &state->domgroups);
+	if (!composite_is_ok(state->ctx)) return;
+
+	sids = talloc_array(state, struct dom_sid *, state->num_domgroups+1);
+	if (composite_nomem(sids, state->ctx)) return;
+
+	sids[0] = state->user_sid;
+	for (i=0; i<state->num_domgroups; i++) {
+		sids[i+1] = state->domgroups[i];
+	}
+
+	ctx = wb_sidaliases_send(state->service, state->num_domgroups+1,
+				 sids);
+	composite_continue(state->ctx, ctx, cmd_usersids_recv_aliases, state);
+}
+
+static void cmd_usersids_recv_aliases(struct composite_context *ctx)
+{
+	struct cmd_usersids_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct cmd_usersids_state);
+	int i, num_aliases;
+	struct dom_sid **aliases;
+
+	state->ctx->status = wb_sidaliases_recv(ctx, state, &num_aliases,
+						&aliases);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->num_sids = 1 + state->num_domgroups + num_aliases;
+	state->sids = talloc_array(state, struct dom_sid *, state->num_sids);
+	if (composite_nomem(state->sids, state->ctx)) return;
+
+	state->sids[0] = talloc_steal(state->sids, state->user_sid);
+
+	for (i=0; i<state->num_domgroups; i++) {
+		state->sids[1+i] =
+			talloc_steal(state->sids, state->domgroups[i]);
+	}
+
+	for (i=0; i<num_aliases; i++) {
+		state->sids[1+i+state->num_domgroups] =
+			talloc_steal(state->sids, aliases[i]);
+	}
+
+	composite_done(state->ctx);
+}
+
+NTSTATUS wb_cmd_usersids_recv(struct composite_context *ctx,
+			      TALLOC_CTX *mem_ctx,
+			      int *num_sids, struct dom_sid ***sids)
+{
+	NTSTATUS status = composite_wait(ctx);
+	if (NT_STATUS_IS_OK(status)) {
+		struct cmd_usersids_state *state =
+			talloc_get_type(ctx->private_data,
+					struct cmd_usersids_state);
+		*num_sids = state->num_sids;
+		*sids = talloc_steal(mem_ctx, state->sids);
+	}
+	talloc_free(ctx);
+	return status;
+}
+
+NTSTATUS wb_cmd_usersids(struct wbsrv_service *service,
+			      const struct dom_sid *sid,
+			      TALLOC_CTX *mem_ctx, int *num_sids,
+			      struct dom_sid ***sids)
+{
+	struct composite_context *c =
+		wb_cmd_usersids_send(service, sid);
+	return wb_cmd_usersids_recv(c, mem_ctx, num_sids, sids);
+}
+
diff --git a/source4/winbind/wb_connect_lsa.c b/source4/winbind/wb_connect_lsa.c
index 82fe3b2e744..ada510a22c7 100644
--- a/source4/winbind/wb_connect_lsa.c
+++ b/source4/winbind/wb_connect_lsa.c
@@ -45,9 +45,9 @@ struct init_lsa_state {
 static void init_lsa_recv_pipe(struct composite_context *ctx);
 static void init_lsa_recv_openpol(struct rpc_request *req);
 
-static struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree,
-						  uint8_t auth_type,
-						  struct cli_credentials *creds)
+struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree,
+					   uint8_t auth_type,
+					   struct cli_credentials *creds)
 {
 	struct composite_context *result, *ctx;
 	struct init_lsa_state *state;
@@ -147,10 +147,10 @@ static void init_lsa_recv_openpol(struct rpc_request *req)
 	composite_done(state->ctx);
 }
 
-static NTSTATUS wb_init_lsa_recv(struct composite_context *c,
-				 TALLOC_CTX *mem_ctx,
-				 struct dcerpc_pipe **lsa_pipe,
-				 struct policy_handle **lsa_policy)
+NTSTATUS wb_init_lsa_recv(struct composite_context *c,
+			  TALLOC_CTX *mem_ctx,
+			  struct dcerpc_pipe **lsa_pipe,
+			  struct policy_handle **lsa_policy)
 {
 	NTSTATUS status = composite_wait(c);
 	if (NT_STATUS_IS_OK(status)) {
diff --git a/source4/winbind/wb_domain_request.c b/source4/winbind/wb_domain_request.c
new file mode 100644
index 00000000000..b516331f8a8
--- /dev/null
+++ b/source4/winbind/wb_domain_request.c
@@ -0,0 +1,157 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   A composite API for initializing a domain
+
+   Copyright (C) Volker Lendecke 2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+#include "smbd/service_task.h"
+#include "dlinklist.h"
+
+struct domain_request_state {
+	struct domain_request_state *prev, *next;
+	struct composite_context *ctx;
+	struct wbsrv_service *service;
+	struct wbsrv_domain *domain;
+	struct composite_context *(*send_fn)(struct wbsrv_domain *domain,
+					     void *p);
+	NTSTATUS (*recv_fn)(struct composite_context *c,
+			    void *p);
+	void *private_data;
+};
+
+static void domain_request_recv_domain(struct composite_context *ctx);
+static void domain_request_recv_init(struct composite_context *ctx);
+static void domain_request_recv_sub(struct composite_context *ctx);
+
+struct composite_context *wb_domain_request_send(TALLOC_CTX *mem_ctx,
+						 struct wbsrv_service *service,
+						 const struct dom_sid *sid,
+						 struct composite_context *(*send_fn)(struct wbsrv_domain *domain, void *p),
+						 NTSTATUS (*recv_fn)(struct composite_context *c,
+								     void *p),
+						 void *private_data)
+					      
+{
+	struct composite_context *result, *ctx;
+	struct domain_request_state *state;
+
+	result = talloc(mem_ctx, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = service->task->event_ctx;
+
+	state = talloc_zero(result, struct domain_request_state);
+	if (state == NULL) goto failed;
+	state->ctx = result;
+	result->private_data = state;
+
+	state->service = service;
+	state->send_fn = send_fn;
+	state->recv_fn = recv_fn;
+	state->private_data = private_data;
+
+	ctx = wb_sid2domain_send(service, sid);
+	if (ctx == NULL) goto failed;
+
+	ctx->async.fn = domain_request_recv_domain;
+	ctx->async.private_data = state;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void domain_request_recv_domain(struct composite_context *ctx)
+{
+	struct domain_request_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct domain_request_state);
+
+	state->ctx->status = wb_sid2domain_recv(ctx, &state->domain);
+	if (!composite_is_ok(state->ctx)) return;
+
+	if (state->domain->busy) {
+		DEBUG(3, ("Domain %s busy\n", state->domain->name));
+		DLIST_ADD_END(state->domain->request_queue, state,
+			      struct domain_request_state *);
+		return;
+	}
+
+	state->domain->busy = True;
+
+	if (!state->domain->initialized) {
+		ctx = wb_init_domain_send(state->domain,
+					  state->service->task->event_ctx,
+					  state->service->task->msg_ctx);
+		composite_continue(state->ctx, ctx, domain_request_recv_init,
+				   state);
+		return;
+	}
+
+	ctx = state->send_fn(state->domain, state->private_data);
+	composite_continue(state->ctx, ctx, domain_request_recv_sub, state);
+}
+
+static void domain_request_recv_init(struct composite_context *ctx)
+{
+	struct domain_request_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct domain_request_state);
+
+	state->ctx->status = wb_init_domain_recv(ctx);
+	if (!composite_is_ok(state->ctx)) return;
+
+	ctx = state->send_fn(state->domain, state->private_data);
+	composite_continue(state->ctx, ctx, domain_request_recv_sub, state);
+}
+
+static void domain_request_recv_sub(struct composite_context *ctx)
+{
+	struct domain_request_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct domain_request_state);
+
+	state->ctx->status = state->recv_fn(ctx, state->private_data);
+	state->domain->busy = False;
+
+	if (state->domain->request_queue != NULL) {
+		struct domain_request_state *s2;
+		s2 = state->domain->request_queue;
+		DLIST_REMOVE(state->domain->request_queue, s2);
+		ctx = s2->send_fn(state->domain, s2->private_data);
+		composite_continue(s2->ctx, ctx, domain_request_recv_sub, s2);
+		state->domain->busy = True;
+	}
+
+	if (!composite_is_ok(state->ctx)) return;
+	composite_done(state->ctx);
+}
+
+NTSTATUS wb_domain_request_recv(struct composite_context *ctx)
+{
+	NTSTATUS status = composite_wait(ctx);
+	talloc_free(ctx);
+	return status;
+}
diff --git a/source4/winbind/wb_init_domain.c b/source4/winbind/wb_init_domain.c
index e89d70d5c6b..7bed7e47ba8 100644
--- a/source4/winbind/wb_init_domain.c
+++ b/source4/winbind/wb_init_domain.c
@@ -26,6 +26,7 @@
 #include "winbind/wb_async_helpers.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_stream.h"
+#include "smbd/service_task.h"
 #include "dlinklist.h"
 
 #include "librpc/gen_ndr/nbt.h"
@@ -84,6 +85,7 @@ struct init_domain_state {
 };
 
 static void init_domain_recv_dcs(struct composite_context *ctx);
+static void init_domain_recv_dcip(struct composite_context *ctx);
 static void init_domain_recv_tree(struct composite_context *ctx);
 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
@@ -111,6 +113,17 @@ struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain,
 
 	state->domain = domain;
 
+	if (domain->dcname != NULL) {
+		struct nbt_name name;
+		make_nbt_name(&name, domain->dcname, 0x20);
+		ctx = resolve_name_send(&name, result->event_ctx,
+					lp_name_resolve_order());
+		if (ctx == NULL) goto failed;
+		ctx->async.fn = init_domain_recv_dcip;
+		ctx->async.private_data = state;
+		return result;
+	}
+
 	if (state->domain->schannel_creds != NULL) {
 		talloc_free(state->domain->schannel_creds);
 	}
@@ -175,6 +188,31 @@ static void init_domain_recv_dcs(struct composite_context *ctx)
 	composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
 }
 
+static void init_domain_recv_dcip(struct composite_context *ctx)
+{
+	struct init_domain_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct init_domain_state);
+	const char *dcaddr;
+
+	state->ctx->status = resolve_name_recv(ctx, state, &dcaddr);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->conn.in.dest_host = dcaddr;
+	state->conn.in.port = 0;
+	state->conn.in.called_name = state->domain->dcname;
+	state->conn.in.service = "IPC$";
+	state->conn.in.service_type = "IPC";
+	state->conn.in.workgroup = state->domain->name;
+	state->conn.in.credentials = state->domain->schannel_creds;
+
+	state->conn.in.fallback_to_anonymous = True;
+
+	ctx = smb_composite_connect_send(&state->conn, state,
+					 state->ctx->event_ctx);
+	composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
+}
+
 static void init_domain_recv_tree(struct composite_context *ctx)
 {
 	struct init_domain_state *state =
@@ -184,7 +222,8 @@ static void init_domain_recv_tree(struct composite_context *ctx)
 	state->ctx->status = smb_composite_connect_recv(ctx, state);
 	if (!composite_is_ok(state->ctx)) return;
 
-	if (state->domain->schannel_creds == NULL) {
+	if ((state->domain->schannel_creds == NULL) ||
+	    cli_credentials_is_anonymous(state->domain->schannel_creds)) {
 		/* No chance to open netlogon */
 		ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
 		composite_continue(state->ctx, ctx,
@@ -212,6 +251,15 @@ static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
 
 	talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
 
+	if (!lp_winbind_sealed_pipes()) {
+		state->netlogon_pipe = talloc_reference(state,
+							state->auth2_pipe);
+		ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
+		composite_continue(state->ctx, ctx, init_domain_recv_lsa,
+				   state);
+		return;
+	}
+
 	state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
 	if (composite_nomem(state->netlogon_pipe, state->ctx)) return;
 
@@ -272,7 +320,6 @@ static void init_domain_recv_lsa(struct composite_context *ctx)
 		/* Give the tree to the LSA pipe. If auth2_pipe exists we have
 		 * given it to that already */
 		talloc_unlink(state, state->conn.out.tree);
-		state->conn.out.tree = NULL;
 	}
 
 	state->queryinfo.in.handle = state->lsa_policy;
@@ -392,114 +439,3 @@ NTSTATUS wb_init_domain(struct wbsrv_domain *domain,
 		wb_init_domain_send(domain, event_ctx, messaging_ctx);
 	return wb_init_domain_recv(c);
 }
-
-struct queue_domain_state {
-	struct queue_domain_state *prev, *next;
-	struct composite_context *ctx;
-	struct wbsrv_domain *domain;
-	struct composite_context *(*send_fn)(void *p);
-	NTSTATUS (*recv_fn)(struct composite_context *c,
-			    void *p);
-	void *private_data;
-};
-
-static void queue_domain_recv_init(struct composite_context *ctx);
-static void queue_domain_recv_sub(struct composite_context *ctx);
-
-struct composite_context *wb_queue_domain_send(TALLOC_CTX *mem_ctx,
-					       struct wbsrv_domain *domain,
-					       struct event_context *event_ctx,
-					       struct messaging_context *msg_ctx,
-					       struct composite_context *(*send_fn)(void *p),
-					       NTSTATUS (*recv_fn)(struct composite_context *c,
-								   void *p),
-					       void *private_data)
-{
-	struct composite_context *result, *ctx;
-	struct queue_domain_state *state;
-
-	result = talloc(mem_ctx, struct composite_context);
-	if (result == NULL) goto failed;
-	result->state = COMPOSITE_STATE_IN_PROGRESS;
-	result->async.fn = NULL;
-	result->event_ctx = event_ctx;
-
-	state = talloc(result, struct queue_domain_state);
-	if (state == NULL) goto failed;
-	state->ctx = result;
-	result->private_data = state;
-
-	state->send_fn = send_fn;
-	state->recv_fn = recv_fn;
-	state->private_data = private_data;
-	state->domain = domain;
-
-	if (domain->busy) {
-		DEBUG(0, ("Domain %s busy\n", domain->name));
-		DLIST_ADD_END(domain->request_queue, state,
-			      struct queue_domain_state *);
-		return result;
-	}
-
-	domain->busy = True;
-
-	if (!domain->initialized) {
-		ctx = wb_init_domain_send(domain, result->event_ctx, msg_ctx);
-		if (ctx == NULL) goto failed;
-		ctx->async.fn = queue_domain_recv_init;
-		ctx->async.private_data = state;
-		return result;
-	}
-
-	ctx = state->send_fn(state->private_data);
-	if (ctx == NULL) goto failed;
-	ctx->async.fn = queue_domain_recv_sub;
-	ctx->async.private_data = state;
-	return result;
-
- failed:
-	talloc_free(result);
-	return NULL;
-}
-
-static void queue_domain_recv_init(struct composite_context *ctx)
-{
-	struct queue_domain_state *state =
-		talloc_get_type(ctx->async.private_data,
-				struct queue_domain_state);
-
-	state->ctx->status = wb_init_domain_recv(ctx);
-	if (!composite_is_ok(state->ctx)) return;
-
-	ctx = state->send_fn(state->private_data);
-	composite_continue(state->ctx, ctx, queue_domain_recv_sub, state);
-}
-
-static void queue_domain_recv_sub(struct composite_context *ctx)
-{
-	struct queue_domain_state *state =
-		talloc_get_type(ctx->async.private_data,
-				struct queue_domain_state);
-
-	state->ctx->status = state->recv_fn(ctx, state->private_data);
-	state->domain->busy = False;
-
-	if (state->domain->request_queue != NULL) {
-		struct queue_domain_state *s2;
-		s2 = state->domain->request_queue;
-		DLIST_REMOVE(state->domain->request_queue, s2);
-		ctx = s2->send_fn(s2->private_data);
-		composite_continue(s2->ctx, ctx, queue_domain_recv_sub, s2);
-		state->domain->busy = True;
-	}
-
-	if (!composite_is_ok(state->ctx)) return;
-	composite_done(state->ctx);
-}
-
-NTSTATUS wb_queue_domain_recv(struct composite_context *ctx)
-{
-	NTSTATUS status = composite_wait(ctx);
-	talloc_free(ctx);
-	return status;
-}
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index ef43aededd6..b6864a39cc3 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -30,7 +30,6 @@
 struct pam_auth_crap_state {
 	struct composite_context *ctx;
 	struct event_context *event_ctx;
-	struct wbsrv_domain *domain;
 	const char *domain_name;
 	const char *user_name;
 	const char *workstation;
@@ -46,7 +45,8 @@ struct pam_auth_crap_state {
 	DATA_BLOB info3;
 };
 
-static struct composite_context *crap_samlogon_send_req(void *p);
+static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain,
+							void *p);
 static NTSTATUS crap_samlogon_recv_req(struct composite_context *ctx, void *p);
 
 struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
@@ -63,7 +63,6 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
 	state = talloc(NULL, struct pam_auth_crap_state);
 	if (state == NULL) goto failed;
 
-	state->domain = service->domains;
 	state->event_ctx = call->event_ctx;
 
 	state->domain_name = talloc_strdup(state, domain);
@@ -86,12 +85,11 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
 	if ((lm_resp.data != NULL) &&
 	    (state->lm_resp.data == NULL)) goto failed;
 
-	state->ctx = wb_queue_domain_send(state, state->domain,
-					  call->event_ctx,
-					  call->wbconn->conn->msg_ctx,
-					  crap_samlogon_send_req,
-					  crap_samlogon_recv_req,
-					  state);
+	state->ctx = wb_domain_request_send(state, service,
+					    service->primary_sid,
+					    crap_samlogon_send_req,
+					    crap_samlogon_recv_req,
+					    state);
 	if (state->ctx == NULL) goto failed;
 	state->ctx->private_data = state;
 	return state->ctx;
@@ -101,12 +99,13 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
 	return NULL;
 }
 
-static struct composite_context *crap_samlogon_send_req(void *p)
+static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain,
+							void *p)
 {
 	struct pam_auth_crap_state *state =
 		talloc_get_type(p, struct pam_auth_crap_state);
-	state->creds_state = cli_credentials_get_netlogon_creds(
-		state->domain->schannel_creds);
+	state->creds_state =
+		cli_credentials_get_netlogon_creds(domain->schannel_creds);
 
 	creds_client_authenticator(state->creds_state, &state->auth);
 
@@ -127,12 +126,11 @@ static struct composite_context *crap_samlogon_send_req(void *p)
 	state->ninfo.lm.data = state->lm_resp.data;
 
 	state->r.in.server_name = talloc_asprintf(
-		state, "\\\\%s",
-		dcerpc_server_name(state->domain->netlogon_pipe));
+		state, "\\\\%s", dcerpc_server_name(domain->netlogon_pipe));
 	if (state->r.in.server_name == NULL) return NULL;
 
-	state->r.in.workstation = cli_credentials_get_workstation(
-		state->domain->schannel_creds);
+	state->r.in.workstation =
+		cli_credentials_get_workstation(domain->schannel_creds);
 	state->r.in.credential = &state->auth;
 	state->r.in.return_authenticator = &state->auth2;
 	state->r.in.logon_level = 2;
@@ -140,7 +138,7 @@ static struct composite_context *crap_samlogon_send_req(void *p)
 	state->r.in.logon.network = &state->ninfo;
 	state->r.out.return_authenticator = NULL;
 
-	return composite_netr_LogonSamLogon_send(state->domain->netlogon_pipe,
+	return composite_netr_LogonSamLogon_send(domain->netlogon_pipe,
 						 state, &state->r);
 }
 
diff --git a/source4/winbind/wb_samba3_cmd.c b/source4/winbind/wb_samba3_cmd.c
index a53b06ae4ec..2eb1c1f5a37 100644
--- a/source4/winbind/wb_samba3_cmd.c
+++ b/source4/winbind/wb_samba3_cmd.c
@@ -128,10 +128,12 @@ static void getdcname_recv_dc(struct composite_context *ctx);
 NTSTATUS wbsrv_samba3_getdcname(struct wbsrv_samba3_call *s3call)
 {
 	struct composite_context *ctx;
+	struct wbsrv_service *service =
+		s3call->call->wbconn->listen_socket->service;
 
 	DEBUG(5, ("wbsrv_samba3_getdcname called\n"));
 
-	ctx = wb_cmd_getdcname_send(s3call->call,
+	ctx = wb_cmd_getdcname_send(service, service->domains,
 				    s3call->request.domain_name);
 	NT_STATUS_HAVE_NO_MEMORY(ctx);
 
@@ -190,7 +192,9 @@ NTSTATUS wbsrv_samba3_userdomgroups(struct wbsrv_samba3_call *s3call)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	ctx = wb_cmd_userdomgroups_send(s3call->call, sid);
+	;
+	ctx = wb_cmd_userdomgroups_send(
+		s3call->call->wbconn->listen_socket->service, sid);
 	NT_STATUS_HAVE_NO_MEMORY(ctx);
 
 	ctx->async.fn = userdomgroups_recv_groups;
@@ -252,15 +256,106 @@ static void userdomgroups_recv_groups(struct composite_context *ctx)
 	}
 }
 
+static void usersids_recv_sids(struct composite_context *ctx);
+
+NTSTATUS wbsrv_samba3_usersids(struct wbsrv_samba3_call *s3call)
+{
+	struct composite_context *ctx;
+	struct dom_sid *sid;
+
+	DEBUG(5, ("wbsrv_samba3_usersids called\n"));
+
+	sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid);
+	if (sid == NULL) {
+		DEBUG(5, ("Could not parse sid %s\n",
+			  s3call->request.data.sid));
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ctx = wb_cmd_usersids_send(
+		s3call->call->wbconn->listen_socket->service, sid);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	ctx->async.fn = usersids_recv_sids;
+	ctx->async.private_data = s3call;
+	s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
+	return NT_STATUS_OK;
+}
+
+static void usersids_recv_sids(struct composite_context *ctx)
+{
+	struct wbsrv_samba3_call *s3call =
+		talloc_get_type(ctx->async.private_data,
+				struct wbsrv_samba3_call);
+	int i, num_sids;
+	struct dom_sid **sids;
+	char *sids_string;
+	NTSTATUS status;
+
+	status = wb_cmd_usersids_recv(ctx, s3call, &num_sids, &sids);
+	if (!NT_STATUS_IS_OK(status)) goto done;
+
+	sids_string = talloc_strdup(s3call, "");
+	if (sids_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+
+	for (i=0; i<num_sids; i++) {
+		sids_string = talloc_asprintf_append(
+			sids_string, "%s\n", dom_sid_string(s3call, sids[i]));
+		if (sids_string == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto done;
+		}
+	}
+
+	s3call->response.result = WINBINDD_OK;
+	s3call->response.extra_data = sids_string;
+	s3call->response.length += strlen(sids_string);
+	s3call->response.data.num_entries = num_sids;
+
+	/* Hmmmm. Nasty protocol -- who invented the zeros between the
+	 * SIDs? Hmmm. Could have been me -- vl */
+
+	while (*sids_string != '\0') {
+		if ((*sids_string) == '\n') {
+			*sids_string = '\0';
+		}
+		sids_string += 1;
+	}
+
+ done:
+	if (!NT_STATUS_IS_OK(status)) {
+		struct winbindd_response *resp = &s3call->response;
+		resp->result = WINBINDD_ERROR;
+		WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string,
+					nt_errstr(status));
+		WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string,
+					nt_errstr(status));
+		resp->data.auth.pam_error = nt_status_to_pam(status);
+	}
+
+	status = wbsrv_send_reply(s3call->call);
+	if (!NT_STATUS_IS_OK(status)) {
+		wbsrv_terminate_connection(s3call->call->wbconn,
+					   "wbsrv_queue_reply() failed");
+		return;
+	}
+}
+
 static void lookupname_recv_sid(struct composite_context *ctx);
 
 NTSTATUS wbsrv_samba3_lookupname(struct wbsrv_samba3_call *s3call)
 {
 	struct composite_context *ctx;
+	struct wbsrv_service *service =
+		s3call->call->wbconn->listen_socket->service;
 
 	DEBUG(5, ("wbsrv_samba3_lookupname called\n"));
 
-	ctx = wb_cmd_lookupname_send(s3call->call,
+	ctx = wb_cmd_lookupname_send(service, service->domains,
+				     s3call->request.data.name.dom_name,
 				     s3call->request.data.name.name);
 	NT_STATUS_HAVE_NO_MEMORY(ctx);
 
@@ -306,6 +401,70 @@ static void lookupname_recv_sid(struct composite_context *ctx)
 	}
 }
 
+static void lookupsid_recv_name(struct composite_context *ctx);
+
+NTSTATUS wbsrv_samba3_lookupsid(struct wbsrv_samba3_call *s3call)
+{
+	struct composite_context *ctx;
+	struct wbsrv_service *service =
+		s3call->call->wbconn->listen_socket->service;
+	struct dom_sid *sid;
+
+	DEBUG(5, ("wbsrv_samba3_lookupsid called\n"));
+
+	sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid);
+	if (sid == NULL) {
+		DEBUG(5, ("Could not parse sid %s\n",
+			  s3call->request.data.sid));
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ctx = wb_cmd_lookupsid_send(service, service->domains, sid);
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	/* setup the callbacks */
+	ctx->async.fn = lookupsid_recv_name;
+	ctx->async.private_data	= s3call;
+	s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
+	return NT_STATUS_OK;
+}
+
+static void lookupsid_recv_name(struct composite_context *ctx)
+{
+	struct wbsrv_samba3_call *s3call =
+		talloc_get_type(ctx->async.private_data,
+				struct wbsrv_samba3_call);
+	struct wb_sid_object *sid;
+	NTSTATUS status;
+
+	status = wb_cmd_lookupsid_recv(ctx, s3call, &sid);
+	if (!NT_STATUS_IS_OK(status)) goto done;
+
+	s3call->response.result = WINBINDD_OK;
+	s3call->response.data.name.type = sid->type;
+	WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.dom_name,
+				sid->domain);
+	WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.name, sid->name);
+
+ done:
+	if (!NT_STATUS_IS_OK(status)) {
+		struct winbindd_response *resp = &s3call->response;
+		resp->result = WINBINDD_ERROR;
+		WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string,
+					nt_errstr(status));
+		WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string,
+					nt_errstr(status));
+		resp->data.auth.pam_error = nt_status_to_pam(status);
+	}
+
+	status = wbsrv_send_reply(s3call->call);
+	if (!NT_STATUS_IS_OK(status)) {
+		wbsrv_terminate_connection(s3call->call->wbconn,
+					   "wbsrv_queue_reply() failed");
+		return;
+	}
+}
+
 NTSTATUS wbsrv_samba3_pam_auth(struct wbsrv_samba3_call *s3call)
 {
 	s3call->response.result			= WINBINDD_ERROR;
diff --git a/source4/winbind/wb_samba3_protocol.c b/source4/winbind/wb_samba3_protocol.c
index 2c99aa63c9d..fa2225a5c31 100644
--- a/source4/winbind/wb_samba3_protocol.c
+++ b/source4/winbind/wb_samba3_protocol.c
@@ -69,6 +69,8 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
 
 	DEBUG(10, ("Got winbind samba3 request %d\n", s3call->request.cmd));
 
+	s3call->response.length = sizeof(s3call->response);
+
 	switch(s3call->request.cmd) {
 	case WINBINDD_INTERFACE_VERSION:
 		return wbsrv_samba3_interface_version(s3call);
@@ -94,6 +96,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
 	case WINBINDD_LOOKUPNAME:
 		return wbsrv_samba3_lookupname(s3call);
 
+	case WINBINDD_LOOKUPSID:
+		return wbsrv_samba3_lookupsid(s3call);
+
 	case WINBINDD_PAM_AUTH:
 		return wbsrv_samba3_pam_auth(s3call);
 
@@ -105,6 +110,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
 
 	case WINBINDD_GETUSERDOMGROUPS:
 		return wbsrv_samba3_userdomgroups(s3call);
+
+	case WINBINDD_GETUSERSIDS:
+		return wbsrv_samba3_usersids(s3call);
 	}
 
 	s3call->response.result = WINBINDD_ERROR;
@@ -121,17 +129,17 @@ NTSTATUS wbsrv_samba3_push_reply(struct wbsrv_call *call, TALLOC_CTX *mem_ctx, D
 
 	extra_data = s3call->response.extra_data;
 	if (extra_data) {
-		extra_data_len = strlen((char *)s3call->response.extra_data) + 1;
+		extra_data_len = s3call->response.length -
+			sizeof(s3call->response);
 	}
 
-	blob = data_blob_talloc(mem_ctx, NULL, sizeof(s3call->response) + extra_data_len);
+	blob = data_blob_talloc(mem_ctx, NULL, s3call->response.length);
 	NT_STATUS_HAVE_NO_MEMORY(blob.data);
 
 	/* don't push real pointer values into sockets */
 	if (extra_data) {
 		s3call->response.extra_data = (void *)0xFFFFFFFF;
 	}
-	s3call->response.length = sizeof(s3call->response) + extra_data_len;
 	memcpy(blob.data, &s3call->response, sizeof(s3call->response));
 	/* set back the pointer */
 	s3call->response.extra_data = extra_data;
diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c
index a835067dd01..d12adfc9d43 100644
--- a/source4/winbind/wb_server.c
+++ b/source4/winbind/wb_server.c
@@ -312,6 +312,8 @@ static void winbind_task_init(struct task_server *task)
 		return;
 	}
 
+	service->primary_sid = talloc_reference(service, service->domains->sid);
+
 	/* setup the unprivileged samba3 socket */
 	listen_socket = talloc(service, struct wbsrv_listen_socket);
 	if (!listen_socket) goto nomem;
diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h
index e511325c725..30737bccbfb 100644
--- a/source4/winbind/wb_server.h
+++ b/source4/winbind/wb_server.h
@@ -33,6 +33,7 @@
 struct wbsrv_service {
 	struct task_server *task;
 
+	const struct dom_sid *primary_sid;
 	struct wbsrv_domain *domains;
 };
 
@@ -51,6 +52,7 @@ struct wbsrv_domain {
 
 	const char *name;
 	const struct dom_sid *sid;
+	const char *dcname;
 
 	struct dcerpc_pipe *lsa_pipe;
 	struct policy_handle *lsa_policy;
@@ -65,7 +67,7 @@ struct wbsrv_domain {
 	struct cli_credentials *schannel_creds;
 
 	BOOL busy;
-	struct queue_domain_state *request_queue;
+	struct domain_request_state *request_queue;
 };
 
 /* 
diff --git a/source4/winbind/wb_sid2domain.c b/source4/winbind/wb_sid2domain.c
new file mode 100644
index 00000000000..1d15fa20c32
--- /dev/null
+++ b/source4/winbind/wb_sid2domain.c
@@ -0,0 +1,223 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Find and init a domain struct for a SID
+
+   Copyright (C) Volker Lendecke 2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+#include "smbd/service_task.h"
+#include "lib/events/events.h"
+#include "librpc/gen_ndr/nbt.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "winbind/wb_async_helpers.h"
+#include "include/dlinklist.h"
+
+static const char *sam_name(void)
+{
+	if (lp_server_role() == ROLE_STANDALONE) {
+		return lp_netbios_name();
+	}
+	return lp_workgroup();
+}
+
+static struct wbsrv_domain *find_primary_domain(struct wbsrv_service *service)
+{
+	const char *my_domain_name = sam_name();
+	struct wbsrv_domain *domain;
+
+	for (domain = service->domains; domain!=NULL; domain = domain->next) {
+		if (strcasecmp(domain->name, my_domain_name) == 0) {
+			break;
+		}
+	}
+	return domain;
+}
+
+static struct wbsrv_domain *find_domain_from_sid(struct wbsrv_service *service,
+						 const struct dom_sid *sid)
+{
+	struct wbsrv_domain *domain;
+
+	for (domain = service->domains; domain!=NULL; domain = domain->next) {
+		if (dom_sid_equal(domain->sid, sid)) {
+			break;
+		}
+		if (dom_sid_in_domain(domain->sid, sid)) {
+			break;
+		}
+	}
+	return domain;
+}
+
+struct sid2domain_state {
+	struct composite_context *ctx;
+	struct wbsrv_service *service;
+	const struct dom_sid *sid;
+
+	const char *domain_name;
+	const char *dc_name;
+	struct dom_sid *domain_sid;
+
+	struct wbsrv_domain *my_domain;
+	struct wbsrv_domain *result;
+};
+
+static void sid2domain_recv_name(struct composite_context *ctx);
+static void sid2domain_recv_dcname(struct composite_context *ctx);
+static void sid2domain_recv_init(struct composite_context *ctx);
+
+struct composite_context *wb_sid2domain_send(struct wbsrv_service *service,
+					     const struct dom_sid *sid)
+{
+	struct composite_context *result, *ctx;
+	struct sid2domain_state *state;
+
+	result = talloc_zero(NULL, struct composite_context);
+	if (result == NULL) goto failed;
+	result->state = COMPOSITE_STATE_IN_PROGRESS;
+	result->async.fn = NULL;
+	result->event_ctx = service->task->event_ctx;
+
+	state = talloc(result, struct sid2domain_state);
+	if (state == NULL) goto failed;
+	state->ctx = result;
+	result->private_data = state;
+
+	state->service = service;
+	state->sid = dom_sid_dup(state, sid);
+	if (state->sid == NULL) goto failed;
+
+	state->result = find_domain_from_sid(service, sid);
+	if (state->result != NULL) {
+		result->status = NT_STATUS_OK;
+		composite_trigger_done(result);
+		return result;
+	}
+
+	state->my_domain = find_primary_domain(service);
+	if (state->my_domain == NULL) {
+		result->status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+		composite_trigger_error(result);
+		return result;
+	}
+
+	ctx = wb_cmd_lookupsid_send(service, state->my_domain, state->sid);
+	if (ctx == NULL) goto failed;
+	ctx->async.fn = sid2domain_recv_name;
+	ctx->async.private_data = state;
+	return result;
+
+ failed:
+	talloc_free(result);
+	return NULL;
+}
+
+static void sid2domain_recv_name(struct composite_context *ctx)
+{
+	struct sid2domain_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct sid2domain_state);
+	struct wb_sid_object *name;
+
+	state->ctx->status = wb_cmd_lookupsid_recv(ctx, state, &name);
+	if (!composite_is_ok(state->ctx)) return;
+
+	if (name->type == SID_NAME_UNKNOWN) {
+		composite_error(state->ctx, NT_STATUS_NO_SUCH_DOMAIN);
+		return;
+	}
+
+	state->domain_name = name->domain;
+	state->domain_sid = dom_sid_dup(state, state->sid);
+	if (name->type != SID_NAME_DOMAIN) {
+		state->domain_sid->num_auths -= 1;
+	}
+	
+	ctx = wb_cmd_getdcname_send(state->service, state->my_domain,
+				    state->domain_name);
+	composite_continue(state->ctx, ctx, sid2domain_recv_dcname, state);
+}
+
+static void sid2domain_recv_dcname(struct composite_context *ctx)
+{
+	struct sid2domain_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct sid2domain_state);
+
+	state->ctx->status = wb_cmd_getdcname_recv(ctx, state,
+						   &state->dc_name);
+	if (!composite_is_ok(state->ctx)) return;
+
+	state->result = talloc_zero(state, struct wbsrv_domain);
+	if (composite_nomem(state->result, state->ctx)) return;
+
+	state->result->name = talloc_steal(state->result, state->domain_name);
+	state->result->sid = talloc_steal(state->result, state->domain_sid);
+	state->result->dcname = talloc_steal(state->result, state->dc_name);
+
+	state->result->schannel_creds = cli_credentials_init(state->result);
+	if (composite_nomem(state->result->schannel_creds, state->ctx)) return;
+	cli_credentials_set_conf(state->result->schannel_creds);
+	cli_credentials_set_anonymous(state->result->schannel_creds);
+
+	talloc_steal(state->service, state->result);
+	DLIST_ADD(state->service->domains, state->result);
+
+	ctx = wb_init_domain_send(state->result,
+				  state->service->task->event_ctx,
+				  state->service->task->msg_ctx);
+	composite_continue(state->ctx, ctx, sid2domain_recv_init, state);
+}
+
+static void sid2domain_recv_init(struct composite_context *ctx)
+{
+	struct sid2domain_state *state =
+		talloc_get_type(ctx->async.private_data,
+				struct sid2domain_state);
+
+	state->ctx->status = wb_init_domain_recv(state->ctx);
+	if (!composite_is_ok(state->ctx)) return;
+
+	composite_done(state->ctx);
+}
+
+NTSTATUS wb_sid2domain_recv(struct composite_context *ctx,
+			    struct wbsrv_domain **result)
+{
+	NTSTATUS status = composite_wait(ctx);
+	if (NT_STATUS_IS_OK(status)) {
+		struct sid2domain_state *state =
+			talloc_get_type(ctx->private_data,
+					struct sid2domain_state);
+		*result = state->result;
+	}
+	talloc_free(ctx);
+	return status;
+}
+
+NTSTATUS wb_sid2domain(struct wbsrv_service *service,
+		       const struct dom_sid *sid,
+		       struct wbsrv_domain **result)
+{
+	struct composite_context *c = wb_sid2domain_send(service, sid);
+	return wb_sid2domain_recv(c, result);
+}