//---------------------------------------------------------------------------
//
//  Microsoft Windows
//  Copyright (C) Microsoft Corporation, 1992 - 1995
//
//  File:  cuar.cxx
//
//  Contents:  Account Restrictions Propset for the User object
//
//  History:   11-1-95     krishnag    Created.
//
//        PROPERTY_RW(AccountDisabled, boolean, 1)              I
//        PROPERTY_RW(AccountExpirationDate, DATE, 2)           I
//        PROPERTY_RO(AccountCanExpire, boolean, 3)             I
//        PROPERTY_RO(PasswordCanExpire, boolean, 4)            I
//        PROPERTY_RW(GraceLoginsAllowed, long, 5)              NI
//        PROPERTY_RW(GraceLoginsRemaining, long, 6)            NI
//        PROPERTY_RW(IsAccountLocked, boolean, 7)              I
//        PROPERTY_RW(IsAdmin, boolean, 8)                      I
//        PROPERTY_RW(LoginHours, VARIANT, 9)                   I
//        PROPERTY_RW(LoginWorkstations, VARIANT, 10)           I
//        PROPERTY_RW(MaxLogins, long, 11)                      I
//        PROPERTY_RW(MaxStorage, long, 12)                     I
//        PROPERTY_RW(PasswordExpirationDate, DATE, 13)         I
//        PROPERTY_RW(PasswordRequired, boolean, 14)            I
//        PROPERTY_RW(RequireUniquePassword,boolean, 15)        I
//
//
//----------------------------------------------------------------------------
#include "ldap.hxx"
#pragma hdrstop

#include <lm.h>
#include <winldap.h>
#include "..\ldapc\ldpcache.hxx"
#include "..\ldapc\ldaputil.hxx"
#include "..\ldapc\parse.hxx"
#include <dsgetdc.h>
#include <sspi.h>


HRESULT
BuildLDAPPathFromADsPath2(
    LPWSTR szADsPathName,
    LPWSTR *pszLDAPServer,
    LPWSTR *pszLDAPDn,
    DWORD * pdwPort
);


DWORD
GetDefaultServer(
    DWORD dwPort,
    BOOL fVerify,
    LPWSTR szDomainDnsName,
    LPWSTR szServerName,
    BOOL fWriteable
    );

HRESULT
GetDomainDNSNameFromHost(
    LPWSTR szHostName,
    SEC_WINNT_AUTH_IDENTITY& AuthI,
    CCredentials &Credentials,
    DWORD dwPort,
    LPWSTR * ppszHostName
    );

//
// The list of server entries - detailing SSL support
//
PSERVSSLENTRY gpServerSSLList = NULL;

//
// Critical Section and support routines to protect list
//
CRITICAL_SECTION g_ServerListCritSect;


//
// Flag that indicates if kerberos is being used.
//
const unsigned long KERB_SUPPORT_FLAGS = ISC_RET_MUTUAL_AUTH ;
//
// Routines that support cacheing server SSL info for perf
//


#define STRING_LENGTH(p) ( p ? wcslen(p) : 0)

//
// Get the status of SSL support on the server pszServerName
// 0 indicates that the server was not in our list.
//
DWORD ReadServerSupportsSSL( LPWSTR pszServerName)
{
    ENTER_SERVERLIST_CRITICAL_SECTION();
    PSERVSSLENTRY pServerList = gpServerSSLList;
    DWORD dwRetVal = 0;

    //
    // Keep going through the list until we hit the end or
    // we find an entry that matches.
    //
    while ((pServerList != NULL) && (dwRetVal == 0)) {

#ifdef WIN95
        if (!(_wcsicmp(pszServerName, pServerList->pszServerName))) {
#else
        if (CompareStringW(
                LOCALE_SYSTEM_DEFAULT,
                NORM_IGNORECASE,
                pszServerName,
                -1,
                pServerList->pszServerName,
                -1
            ) == CSTR_EQUAL ) {
#endif
            dwRetVal = pServerList->dwFlags;
        }

        pServerList = pServerList->pNext;
    }

    LEAVE_SERVERLIST_CRITICAL_SECTION();

    return dwRetVal;
}


HRESULT UpdateServerSSLSupportStatus(
            PWSTR pszServerName,
            DWORD dwFlags
            )
{
    HRESULT hr = S_OK;
    PSERVSSLENTRY pServEntry = NULL;
    ENTER_SERVERLIST_CRITICAL_SECTION()
    PSERVSSLENTRY pServerList = gpServerSSLList;
    DWORD dwRetVal = 0;

    ADsAssert(pszServerName && *pszServerName);

    //
    // Keep going through the list until we hit the end or
    // we find an entry that matches.
    //
    while ((pServerList != NULL) && (dwRetVal == 0)) {

#ifdef WIN95
        if (!(_wcsicmp(pszServerName, pServerList->pszServerName))) {
#else
        if (CompareStringW(
                LOCALE_SYSTEM_DEFAULT,
                NORM_IGNORECASE,
                pszServerName,
                -1,
                pServerList->pszServerName,
                -1
            ) == CSTR_EQUAL ) {
#endif
            pServerList->dwFlags = dwFlags;
            LEAVE_SERVERLIST_CRITICAL_SECTION()
            RRETURN(S_OK);
        }

        pServerList = pServerList->pNext;
    }


    pServEntry = (PSERVSSLENTRY) AllocADsMem(sizeof(SERVSSLENTRY));

    if (!pServEntry) {
        BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
    }

    pServEntry->pszServerName = AllocADsStr(pszServerName);
    if (!pServEntry->pszServerName) {
        BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
    }

    pServEntry->dwFlags = dwFlags;

    pServEntry->pNext = gpServerSSLList;
    gpServerSSLList = pServEntry;

error:
    if (FAILED(hr) && pServEntry) {
        //
        // Free only pServEntry as the string cannot have
        // a value in the error case
        //
        FreeADsMem(pServEntry);
    }

    LEAVE_SERVERLIST_CRITICAL_SECTION();

    RRETURN(hr);
}

void FreeServerSSLSupportList()
{
    PSERVSSLENTRY pList = gpServerSSLList;
    PSERVSSLENTRY pPrevEntry = NULL;

    while (pList) {
        pPrevEntry = pList;

        FreeADsStr(pList->pszServerName);
        pList = pList->pNext;

        FreeADsMem(pPrevEntry);
    }
}

#if (!defined(WIN95))
//
// Take a AuthI struct and return a cred handle.
//
HRESULT
ConvertAuthIdentityToCredHandle(
    SEC_WINNT_AUTH_IDENTITY& AuthI,
    OUT PCredHandle CredentialsHandle
    )
{
    SECURITY_STATUS secStatus = SEC_E_OK;
    TimeStamp Lifetime;

    secStatus = AcquireCredentialsHandleWrapper(
                    NULL,           // New principal
                    MICROSOFT_KERBEROS_NAME_W,
                    SECPKG_CRED_OUTBOUND,
                    NULL,
                    &AuthI,
                    NULL,
                    NULL,
                    CredentialsHandle,
                    &Lifetime
                    );

    if (secStatus != SEC_E_OK) {

        RRETURN(E_FAIL);
    } else {
        RRETURN(S_OK);
    }

}

//
// ***** Caller must free the strings put in the    ****
// ***** AuthIdentity struct later.                 ****
//
HRESULT
GetAuthIdentityForCaller(
    CCredentials& Credentials,
    IADs * pIADs,
    OUT SEC_WINNT_AUTH_IDENTITY *pAuthI,
    BOOL fEnforceMutualAuth
    )
{
    HRESULT hr = S_OK;
    LPWSTR pszNTLMUser = NULL;
    LPWSTR pszNTLMDomain = NULL;
    LPWSTR pszDefaultServer = NULL;
    LPWSTR dn = NULL;
    LPWSTR passwd = NULL;
    IADsObjOptPrivate * pADsPrivObjectOptions = NULL;
    ULONG ulFlags = 0;

    if (fEnforceMutualAuth) {

        hr = pIADs->QueryInterface(
                 IID_IADsObjOptPrivate,
                 (void **)&pADsPrivObjectOptions
                 );
        BAIL_ON_FAILURE(hr);

        hr = pADsPrivObjectOptions->GetOption (
                 LDAP_MUTUAL_AUTH_STATUS,
                 (void *) &ulFlags
                 );

        BAIL_ON_FAILURE(hr);

        if (!(ulFlags & KERB_SUPPORT_FLAGS)) {
            BAIL_ON_FAILURE(hr = E_FAIL);
        }
    }

    hr = Credentials.GetUserName(&dn);
    BAIL_ON_FAILURE(hr);

    hr = Credentials.GetPassword(&passwd);
    BAIL_ON_FAILURE(hr);

    //
    // Get the userName and password into the auth struct.
    //
    hr = LdapCrackUserDNtoNTLMUser2(
            dn,
            &pszNTLMUser,
            &pszNTLMDomain
            );

    if (FAILED(hr)) {
        hr = LdapCrackUserDNtoNTLMUser(
                dn,
                &pszNTLMUser,
                &pszNTLMDomain
                );
        BAIL_ON_FAILURE(hr);
    }

    //
    // If the domain name is NULL and enforceMutualAuth is false,
    // then we need to throw in the defaultDomainName. This will
    // be needed subsequently for the LogonUser call.
    //
    if (!fEnforceMutualAuth && !pszNTLMDomain) {
        //
        // Call GetDefaultServer.
        //
        pszDefaultServer = (LPWSTR) AllocADsMem(sizeof(WCHAR) * MAX_PATH);
        if (!pszDefaultServer) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }

        pszNTLMDomain = (LPWSTR) AllocADsMem(sizeof(WCHAR) * MAX_PATH);
        if (!pszNTLMDomain) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }

        hr = GetDefaultServer(
                 -1, // this will use the default ldap port
                 FALSE,
                 pszNTLMDomain,
                 pszDefaultServer,
                 TRUE
                 );
        BAIL_ON_FAILURE(hr);
    }

    pAuthI->User = (PWCHAR)pszNTLMUser;
    pAuthI->UserLength = (pszNTLMUser == NULL)? 0: wcslen(pszNTLMUser);
    pAuthI->Domain = (PWCHAR)pszNTLMDomain;
    pAuthI->DomainLength = (pszNTLMDomain == NULL)? 0: wcslen(pszNTLMDomain);
    pAuthI->Password = (PWCHAR)passwd;
    pAuthI->PasswordLength = (passwd == NULL)? 0: wcslen(passwd);
    pAuthI->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;


error:

    if (FAILED(hr)) {

        //
        // Free the strings
        //
        if (pszNTLMUser) {
            FreeADsStr(pszNTLMUser);
        }

        if (pszNTLMDomain) {
            FreeADsStr(pszNTLMDomain);
        }

        if (passwd) {
            SecureZeroMemory(passwd, wcslen(passwd)*sizeof(WCHAR));
            FreeADsStr(passwd);
        }
    }

    if (pADsPrivObjectOptions) {
        pADsPrivObjectOptions->Release();
    }

    //
    // Always free the dn
    //
    if (dn) {
        FreeADsStr(dn);
    }

    if (pszDefaultServer) {
        FreeADsMem(pszDefaultServer);
    }

    RRETURN(hr);
}
#endif

//  Class CLDAPUser

STDMETHODIMP
CLDAPUser::get_AccountDisabled(THIS_ VARIANT_BOOL FAR* retval)
{
    if ( retval == NULL )
        RRETURN( E_ADS_BAD_PARAMETER );

    LONG lUserAcctControl;
    HRESULT hr = get_LONG_Property( (IADsUser *)this,
                                     TEXT("userAccountControl"),
                                     &lUserAcctControl );

    if ( SUCCEEDED(hr))
        *retval = lUserAcctControl & UF_ACCOUNTDISABLE ?
                      VARIANT_TRUE : VARIANT_FALSE;

    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::put_AccountDisabled(THIS_ VARIANT_BOOL fAccountDisabled)
{
    LONG lUserAcctControl;
    IADsObjOptPrivate * pADsPrivObjectOptions = NULL;
    BOOL fSet = FALSE;
    HRESULT hr = get_LONG_Property( (IADsUser *)this,
                                    TEXT("userAccountControl"),
                                    &lUserAcctControl );
    if ( SUCCEEDED(hr))
    {
        if ( fAccountDisabled )
            lUserAcctControl |= UF_ACCOUNTDISABLE;
        else
            lUserAcctControl &= ~UF_ACCOUNTDISABLE;

        hr = _pADs->QueryInterface(
                    IID_IADsObjOptPrivate,
                    (void **)&pADsPrivObjectOptions
                    );
        if(SUCCEEDED(hr))
        {
            hr = pADsPrivObjectOptions->GetOption (
                     LDAP_USERACCOUNTCONTROL,
                     (void*)&fSet
                     );

        }

        if(!fSet)
        {
            lUserAcctControl |= UF_LOCKOUT;
        }

        hr = put_LONG_Property( (IADsUser *)this,
                                 TEXT("userAccountControl"),
                                 lUserAcctControl );
    }

    if(pADsPrivObjectOptions)
        pADsPrivObjectOptions->Release();

    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::get_AccountExpirationDate(THIS_ DATE FAR* retval)
{
    GET_PROPERTY_FILETIME((IADsUser *)this, AccountExpirationDate);
}

STDMETHODIMP
CLDAPUser::put_AccountExpirationDate(THIS_ DATE daAccountExpirationDate)
{
    PUT_PROPERTY_FILETIME((IADsUser *)this, AccountExpirationDate);
}

STDMETHODIMP
CLDAPUser::get_GraceLoginsAllowed(THIS_ long FAR* retval)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::put_GraceLoginsAllowed(THIS_ long lGraceLoginsAllowed)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::get_GraceLoginsRemaining(THIS_ long FAR* retval)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::put_GraceLoginsRemaining(THIS_ long lGraceLoginsRemaining)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::get_IsAccountLocked(THIS_ VARIANT_BOOL FAR* retval)
{
    HRESULT hr = S_OK;

    VARIANT var;
    IADsLargeInteger *pLargeInt = NULL;

    LONG LowPart, HighPart;

    if ( retval == NULL )
        RRETURN( E_ADS_BAD_PARAMETER );

    VariantInit(&var);

    hr = _pADs->Get(TEXT("lockoutTime"), &var);

    if (SUCCEEDED(hr)) {
        //
        // There's a lockoutTime, we need to determine
        // if it equals 0 (== not locked-out).
        //
        ADsAssert(V_VT(&var) == VT_DISPATCH);

        if (V_VT(&var) != VT_DISPATCH) {
            BAIL_ON_FAILURE(hr = E_FAIL);
        }

        hr = V_DISPATCH(&var)->QueryInterface(IID_IADsLargeInteger,
                                              reinterpret_cast<void**>(&pLargeInt)
                                              );
        BAIL_ON_FAILURE(hr);

        hr = pLargeInt->get_LowPart(&LowPart);
        BAIL_ON_FAILURE(hr);
        
        hr = pLargeInt->get_HighPart(&HighPart);
        BAIL_ON_FAILURE(hr);

        if ( (LowPart != 0) || (HighPart != 0) ) {
            *retval = VARIANT_TRUE;
        }
        else {
            *retval = VARIANT_FALSE;
        }

    }
    else if (hr == E_ADS_PROPERTY_NOT_FOUND) {
        //
        // If there's no lockoutTime, the account is not
        // locked-out.
        //
        *retval = VARIANT_FALSE;
        hr = S_OK;
    }
    else {
        BAIL_ON_FAILURE(hr);
    }

error:

    if (pLargeInt) {
        pLargeInt->Release();
    }

    VariantClear(&var);
    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::put_IsAccountLocked(THIS_ VARIANT_BOOL fIsAccountLocked)
{
    HRESULT hr = S_OK;

    if (fIsAccountLocked) {
        //
        // You cannot set an account to a locked state.
        //
        RRETURN(E_ADS_BAD_PARAMETER);
    }

    hr = put_LONG_Property( (IADsUser *)this,
                             TEXT("lockoutTime"),
                             0 );

    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::get_LoginHours(THIS_ VARIANT FAR* retval)
{
    GET_PROPERTY_VARIANT((IADsUser *)this, LoginHours);
}

STDMETHODIMP
CLDAPUser::put_LoginHours(THIS_ VARIANT vLoginHours)
{
    PUT_PROPERTY_VARIANT((IADsUser *)this, LoginHours);
}

STDMETHODIMP
CLDAPUser::get_LoginWorkstations(THIS_ VARIANT FAR* retval)
{
    GET_PROPERTY_BSTRARRAY((IADsUser *)this,LoginWorkstations);
}

STDMETHODIMP
CLDAPUser::put_LoginWorkstations(THIS_ VARIANT vLoginWorkstations)
{
    PUT_PROPERTY_BSTRARRAY((IADsUser *)this,LoginWorkstations);
}

STDMETHODIMP
CLDAPUser::get_MaxLogins(THIS_ long FAR* retval)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::put_MaxLogins(THIS_ long lMaxLogins)
{
    RRETURN(E_ADS_PROPERTY_NOT_SUPPORTED);
}

STDMETHODIMP
CLDAPUser::get_MaxStorage(THIS_ long FAR* retval)
{
    GET_PROPERTY_LONG((IADsUser *)this, MaxStorage);
}


STDMETHODIMP
CLDAPUser::put_MaxStorage(THIS_ long lMaxStorage)
{
    PUT_PROPERTY_LONG((IADsUser *)this, MaxStorage);
}

STDMETHODIMP
CLDAPUser::get_PasswordExpirationDate(THIS_ DATE FAR* retval)
{
    GET_PROPERTY_DATE((IADsUser *)this, PasswordExpirationDate);
}

STDMETHODIMP
CLDAPUser::put_PasswordExpirationDate(THIS_ DATE daPasswordExpirationDate)
{
    PUT_PROPERTY_DATE((IADsUser *)this, PasswordExpirationDate);
}

STDMETHODIMP
CLDAPUser::get_PasswordRequired(THIS_ VARIANT_BOOL FAR* retval)
{
    if ( retval == NULL )
        RRETURN( E_ADS_BAD_PARAMETER );

    LONG lUserAcctControl;
    HRESULT hr = get_LONG_Property( (IADsUser *)this,
                                     TEXT("userAccountControl"),
                                     &lUserAcctControl );

    if ( SUCCEEDED(hr))
        *retval = lUserAcctControl & UF_PASSWD_NOTREQD ?
                      VARIANT_FALSE: VARIANT_TRUE;

    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::put_PasswordRequired(THIS_ VARIANT_BOOL fPasswordRequired)
{
    LONG lUserAcctControl;
    IADsObjOptPrivate * pADsPrivObjectOptions = NULL;
    BOOL fSet = FALSE;
    HRESULT hr = get_LONG_Property( (IADsUser *)this,
                                    TEXT("userAccountControl"),
                                    &lUserAcctControl );
    if ( SUCCEEDED(hr))
    {
        if ( fPasswordRequired )
            lUserAcctControl &= ~UF_PASSWD_NOTREQD;
        else
            lUserAcctControl |= UF_PASSWD_NOTREQD;

        hr = _pADs->QueryInterface(
                    IID_IADsObjOptPrivate,
                    (void **)&pADsPrivObjectOptions
                    );
        if(SUCCEEDED(hr))
        {
            hr = pADsPrivObjectOptions->GetOption (
                     LDAP_USERACCOUNTCONTROL,
                     (void*)&fSet
                     );

        }

        if(!fSet)
        {
            lUserAcctControl |= UF_LOCKOUT;
        }

        hr = put_LONG_Property( (IADsUser *)this,
                                 TEXT("userAccountControl"),
                                 lUserAcctControl );
    }

    if(pADsPrivObjectOptions)
        pADsPrivObjectOptions->Release();

    RRETURN(hr);
}

STDMETHODIMP
CLDAPUser::get_PasswordMinimumLength(THIS_ LONG FAR* retval)
{
    GET_PROPERTY_LONG((IADsUser *)this, PasswordMinimumLength);
}

STDMETHODIMP
CLDAPUser::put_PasswordMinimumLength(THIS_ LONG lPasswordMinimumLength)
{
    PUT_PROPERTY_LONG((IADsUser *)this, PasswordMinimumLength);
}

STDMETHODIMP
CLDAPUser::get_RequireUniquePassword(THIS_ VARIANT_BOOL FAR* retval)
{
    GET_PROPERTY_VARIANT_BOOL((IADsUser *)this, RequireUniquePassword);
}

STDMETHODIMP
CLDAPUser::put_RequireUniquePassword(THIS_ VARIANT_BOOL fRequireUniquePassword)
{
    PUT_PROPERTY_VARIANT_BOOL((IADsUser *)this, RequireUniquePassword);
}

BOOLEAN
_cdecl   ServerCertCallback(
                      PLDAP Connection,
                      PCCERT_CONTEXT  pServerCert
                      )
{
   //
   // After the secure connection is established, this function is called by
   // LDAP. This gives the client an opportunity to verify the server cert.
   // If, for some reason, the client doesn't approve it, it should return FALSE
   // and the connection will be terminated. Else, return TRUE
   //

   fprintf( stderr, "Server cert callback has been called...\n" );

   //
   // Use some way to verify the server certificate.
   //

   return TRUE;
}

STDMETHODIMP
CLDAPUser::SetPassword(THIS_ BSTR bstrNewPassword)
{
    HRESULT hr = E_FAIL;
    BOOLEAN bUseLDAP = FALSE;

    LPWSTR pszServer = NULL;
    LPWSTR pszHostName = NULL;
    DWORD dwLen = 0;
    
    int err = 0;

    BSTR bstrADsPath = NULL;
    LPWSTR szServerSSL = NULL;
    LPWSTR szDn = NULL;
    DWORD dwPortSSL = 0;
    PADSLDP pAdsLdpSSL = NULL;

    IADsObjOptPrivate * pADsPrivObjectOptions = NULL;
    PADSLDP pAdsLdp = NULL;
    LDAPMessage *pMsgResult = NULL;
    LDAPMessage *pMsgEntry = NULL;
    LDAP *pLdapCurrent = NULL;
    LPWSTR Attributes[] = {L"objectClass", NULL};

    VARIANT varSamAccount;
    DWORD dwServerPwdSupport = SERVER_STATUS_UNKNOWN;
    LPWSTR pszHostDomainName = NULL;
    SEC_WINNT_AUTH_IDENTITY AuthI;
    BOOLEAN fPasswordSet = FALSE;
    LPWSTR pszTempPwd = NULL;
    ULONG ulFlags = 0;
    VARIANT varGetInfoEx;
    BOOL fCachePrimed = FALSE;

    BOOL fImpersonating = FALSE;
    HANDLE hUserToken = INVALID_HANDLE_VALUE;

    IADsObjectOptions* pADsOpt = NULL;
    DWORD dwPasswordPort;
    DWORD dwPasswordMethod;
    VARIANT var;
    CCredentials cTempCred = _Credentials;

    //
    // Init params we will need to free later.
    //
    AuthI.User = NULL;
    AuthI.Domain = NULL;
    AuthI.Password = NULL;
    VariantInit(&varSamAccount);
    VariantInit(&varGetInfoEx);
    VariantInit(&var);

    //
    // Get the Ldap path of the user object
    //
    hr = _pADs->get_ADsPath( &bstrADsPath );
    BAIL_ON_FAILURE(hr);

    hr = BuildLDAPPathFromADsPath2(
                bstrADsPath,
                &szServerSSL,
                &szDn,
                &dwPortSSL
                );
    BAIL_ON_FAILURE(hr);
    

    //
    // Now do an LDAP Search with Referrals and get the handle to success
    // connection. This is where we can find the server the referred object
    // resides on
    //
    hr = _pADs->QueryInterface(
                    IID_IADsObjOptPrivate,
                    (void **)&pADsPrivObjectOptions
                    );
    BAIL_ON_FAILURE(hr);

    hr = pADsPrivObjectOptions->GetOption (
             LDAP_SERVER,
             (void*)&pszHostName
             );

    BAIL_ON_FAILURE(hr);

    //
    // additional lengh 3 is for '\0' and "\\\\"
    //
    dwLen = STRING_LENGTH(pszHostName) + 3;
    pszServer = (LPWSTR) AllocADsMem( dwLen * sizeof(WCHAR) );
    if (!pszServer) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }
    wcscpy(pszServer,L"\\\\");
    wcscat(pszServer, pszHostName);

     // get the info of password port and password method (SSL or clear text)
    hr = _pADs->QueryInterface(
                   IID_IADsObjectOptions,
                   (void **)&pADsOpt
                   );
    BAIL_ON_FAILURE(hr);

    hr = pADsOpt->GetOption(
                    ADS_OPTION_PASSWORD_PORTNUMBER,
                    &var
                    );
    BAIL_ON_FAILURE(hr);

    dwPasswordPort = V_I4(&var);
    VariantClear(&var);

    hr = pADsOpt->GetOption(
                    ADS_OPTION_PASSWORD_METHOD,
                    &var
                    );
    BAIL_ON_FAILURE(hr);

    dwPasswordMethod = V_I4(&var);

    if(dwPasswordMethod == ADS_PASSWORD_ENCODE_REQUIRE_SSL)
    {       
        dwServerPwdSupport = ReadServerSupportsSSL(pszHostName);

        if (dwServerPwdSupport ==
                (  SERVER_STATUS_UNKNOWN
                 | SERVER_DOES_NOT_SUPPORT_SSL
                 | SERVER_DOES_NOT_SUPPORT_NETUSER
                 | SERVER_DOES_NOT_SUPPORT_KERBEROS )
            ) 
        {
            //
            // All flags are set, we will reset and rebuild cache
            //
            UpdateServerSSLSupportStatus(
                pszHostName,
                SERVER_STATUS_UNKNOWN
                );
            dwServerPwdSupport = SERVER_STATUS_UNKNOWN;
          }

        if (dwServerPwdSupport == SERVER_STATUS_UNKNOWN
            || !(dwServerPwdSupport & SERVER_DOES_NOT_SUPPORT_SSL)) {

            //
            // Try to establish SSL connection for this Password Operation
            //

            // if NULL credential is passed in and auth flag does not contain secure auth, we need to make sure we keep
            // the default behavior: first try secure auth over SSL, then do anonymous bind over SSL
            if(cTempCred.IsNullCredentials() && !(cTempCred.GetAuthFlags() & ADS_SECURE_AUTHENTICATION))
            {
                cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() | ADS_USE_SSL | ADS_SECURE_AUTHENTICATION);
            
                hr = LdapOpenObject(
                            pszHostName,
                            szDn,
                            &pAdsLdpSSL,
                            cTempCred,
                            dwPasswordPort
                            );

                // check ERROR_LOGON_FAILURE to be consistent witht the behavior of LdapOpenBindWithDefaultCredentials when
                // credential is null and auth flag is 0
                if (FAILED(hr) && hr != ERROR_LOGON_FAILURE)
                {
                    cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() & ~ADS_SECURE_AUTHENTICATION);
                    hr = LdapOpenObject(
                                pszHostName,
                                szDn,
                                &pAdsLdpSSL,
                                cTempCred,
                                dwPasswordPort
                                );

                }
            }
            else
            {
                cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() | ADS_USE_SSL);
            
                hr = LdapOpenObject(
                            pszHostName,
                            szDn,
                            &pAdsLdpSSL,
                            cTempCred,
                            dwPasswordPort
                            );
            }

            if (SUCCEEDED(hr)) {
                int retval;
                SecPkgContext_ConnectionInfo  sslattr;

                retval = ldap_get_option( pAdsLdpSSL->LdapHandle, LDAP_OPT_SSL_INFO, &sslattr );
                if (retval == LDAP_SUCCESS) {
                    //
                    // If Channel is secure enough, enable LDAP Password Change
                    //
                    if (sslattr.dwCipherStrength >= 128) {
                        bUseLDAP = TRUE;
                    }
                }
            }

            //
            // Update the SSL support if appropriate
            // 
            if (dwServerPwdSupport == SERVER_STATUS_UNKNOWN
                || !bUseLDAP) {

                //
                // Set the server does not support ssl bit if necessary
                //
                UpdateServerSSLSupportStatus(
                    pszHostName,
                    bUseLDAP ?
                    dwServerPwdSupport :
                    dwServerPwdSupport |= SERVER_DOES_NOT_SUPPORT_SSL
                );
            }
        }

    }
    else
    {
        cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() & ~ADS_USE_SSL);
        hr = LdapOpenObject(
                        pszHostName,
                        szDn,
                        &pAdsLdpSSL,
                        cTempCred,
                        dwPasswordPort
                        );
        if(SUCCEEDED(hr))
            bUseLDAP = TRUE;        
    }

    if (bUseLDAP) {
        //
        // LDAP Password Set
        //
        PLDAPModW prgMod[2];
        LDAPModW ModReplace;
        struct berval* rgBerVal[2];
        struct berval BerVal;
        int ipwdLen;

        prgMod[0] = &ModReplace;
        prgMod[1] = NULL;

        ModReplace.mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
        ModReplace.mod_type = L"unicodePwd";
        ModReplace.mod_bvalues = rgBerVal;
        rgBerVal[0] = &BerVal;
        rgBerVal[1] = NULL;

        //
        // 2 extra for "" to put the password in.
        //
        if (bstrNewPassword) {
            ipwdLen = (wcslen(bstrNewPassword) + 2) * sizeof(WCHAR);
        }
        else {
            ipwdLen = 2 * sizeof(WCHAR);
        }

        //
        // Add 1 for the \0.
        //
        pszTempPwd = (LPWSTR) AllocADsMem(ipwdLen + sizeof(WCHAR));
        if (!pszTempPwd) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }

        wcscpy(pszTempPwd, L"\"");
        if (bstrNewPassword) {
            wcscat(pszTempPwd, bstrNewPassword);
        }

        wcscat(pszTempPwd, L"\"");


        BerVal.bv_len = ipwdLen;
        BerVal.bv_val = (char*)pszTempPwd;

        hr = LdapModifyS(
                       pAdsLdpSSL,
                       szDn,
                       prgMod
                       );
        BAIL_ON_FAILURE(hr);

        //
        // Set flag so that we do not try any other methods.
        //
        fPasswordSet = TRUE;
    }


//
// Try kerberos setpassword if applicable
//
#if (!defined(WIN95))
//
// Only valid on Win2k
//
    if (!fPasswordSet) {

        //
        // If we cached the server as not supporting Kerberos, most likely it
        // was because we were not mutually authenticated.  Do a quick check to
        // see if that has changed, so that we can update our cached information
        // if necessary.
        //
        if (dwServerPwdSupport & SERVER_DOES_NOT_SUPPORT_KERBEROS) {

            hr = pADsPrivObjectOptions->GetOption (
                     LDAP_MUTUAL_AUTH_STATUS,
                     (void *) &ulFlags
                     );

            BAIL_ON_FAILURE(hr);

            if ((ulFlags & KERB_SUPPORT_FLAGS)) {
                UpdateServerSSLSupportStatus(
                    pszHostName,
                    dwServerPwdSupport &= (~SERVER_DOES_NOT_SUPPORT_KERBEROS)
                    );
            }
        }
    
        if (!(dwServerPwdSupport & SERVER_DOES_NOT_SUPPORT_KERBEROS)) {

            //
            // Kerberos set password
            //
            CredHandle secCredHandle = {0};
            SECURITY_STATUS SecStatus;
            DWORD dwStatus = 0;
            LPWSTR pszSamAccountArr[] = {L"sAMAccountName"};

            if (!fCachePrimed) {
                hr = ADsBuildVarArrayStr( pszSamAccountArr, 1, &varGetInfoEx );
                BAIL_ON_FAILURE(hr);

                hr = _pADs->GetInfoEx(varGetInfoEx, 0);
                BAIL_ON_FAILURE(hr);

                fCachePrimed = TRUE;
            }
            
            hr = _pADs->Get(L"sAMAccountName", &varSamAccount);
            BAIL_ON_FAILURE(hr);

            //
            // The AuthIdentity structure is ueful down the road.
            // This routine will fail if we were not bound using
            // kerberos to the server.
            //
            hr = GetAuthIdentityForCaller(
                     _Credentials,
                     _pADs,
                     &AuthI,
                     TRUE // enforce mutual auth.
                     );

            if (FAILED(hr)) {
                UpdateServerSSLSupportStatus(
                    pszHostName,
                    dwServerPwdSupport |= SERVER_DOES_NOT_SUPPORT_KERBEROS
                    );
            }
            else {

                //
                // Kerb really needs this handle.
                //
                hr = ConvertAuthIdentityToCredHandle(
                         AuthI,
                         &secCredHandle
                         );

                if (FAILED(hr)) {
                    UpdateServerSSLSupportStatus(
                        pszHostName,
                        dwServerPwdSupport |= SERVER_DOES_NOT_SUPPORT_KERBEROS
                        );
                }

                if (SUCCEEDED(hr)) {

                    //
                    // Get the domain dns name for the user
                    //
                    hr = GetDomainDNSNameFromHost(
                             pszHostName,
                             AuthI,
                             _Credentials,
                             dwPortSSL,
                             &pszHostDomainName
                             );

                    if (SUCCEEDED(hr)) {

                        dwStatus = KerbSetPasswordUserEx(
                                        pszHostDomainName,
                                        V_BSTR(&varSamAccount),
                                        bstrNewPassword,
                                        &secCredHandle,
                                        pszHostName
                                        );

                        if (dwStatus) {
                            //
                            // We should have got this to come in here.
                            //
                            hr = HRESULT_FROM_WIN32(ERROR_LOGON_FAILURE);
                        }
                        else {
                            fPasswordSet = TRUE;
                        }
                    } // if domain dns name get succeeded.

                    FreeCredentialsHandleWrapper(&secCredHandle);

                } // if GetCredentialsForCaller succeeded.
            } // if we could get authidentity succesfully
        } // if server supports kerberos
    } // if password not set.
#endif
    //
    //  At this point server status cannot be unknown, it
    // will atleast have info about ssl support.
    //
    if (!fPasswordSet) {

        if (!(dwServerPwdSupport & SERVER_DOES_NOT_SUPPORT_NETUSER)) {
            //
            // Password Set using NET APIs
            //
            NET_API_STATUS nasStatus;
            DWORD dwParmErr = 0;
            LPWSTR pszSamAccountArr[] = {L"sAMAccountName"};

            //
            // Get SamAccountName
            //
            VariantClear(&varSamAccount);
            VariantClear(&varGetInfoEx);
            

            if (!fCachePrimed) {
                hr = ADsBuildVarArrayStr( pszSamAccountArr, 1, &varGetInfoEx );
                BAIL_ON_FAILURE(hr);

                hr = _pADs->GetInfoEx(varGetInfoEx, 0);
                BAIL_ON_FAILURE(hr);

                fCachePrimed = TRUE;
            }

            hr = _pADs->Get(L"sAMAccountName", &varSamAccount);
            BAIL_ON_FAILURE(hr);

            //
            // Set the password
            //
            USER_INFO_1003 lpUserInfo1003 ;

            lpUserInfo1003.usri1003_password = bstrNewPassword;

#ifndef Win95
            //
            // At this point if the user credentials are non NULL,
            // we want to impersonate the user and then make this call.
            // This will make sure the NetUserSetInfo call is made in the
            // correct context.
            //
            if (!_Credentials.IsNullCredentials()) {
                //
                // Need to get the userName and password in the format
                // usable by the logonUser call.
                //
                if ((AuthI.User == NULL)
                    && (AuthI.Domain == NULL)
                    && (AuthI.Password == NULL)
                    ) {
                    //
                    // Get teh Auth identity struct populate if necessary.
                    //
                    hr = GetAuthIdentityForCaller(
                             _Credentials,
                             _pADs,
                             &AuthI,
                             FALSE
                             );
                }

                BAIL_ON_FAILURE(hr);

                //
                // Note that if this code is backported, then we might
                // need to change LOGON32_PROVIDER_WINNT50 to 
                // LOGON32_PROVIDER_DEFAULT as NT4 and below will support
                // only that option. Also note that Win2k and below, do not
                // allow all accounts to impersonate.
                //
                if (LogonUser(
                        AuthI.User,
                        AuthI.Domain,
                        AuthI.Password,
                        LOGON32_LOGON_NEW_CREDENTIALS,
                        LOGON32_PROVIDER_WINNT50,
                        &hUserToken
                        )
                    ) {
                    //
                    // Call succeeded so we should use this context.
                    //
                    if (ImpersonateLoggedOnUser(hUserToken)) {
                        fImpersonating = TRUE;
                    } 
                }
                if (!fImpersonating) {
                    hr = HRESULT_FROM_WIN32(GetLastError());
                }
                
                BAIL_ON_FAILURE(hr);
            } // if credentials are valid.
#endif

            nasStatus = NetUserSetInfo(
                            pszServer,
                            V_BSTR(&varSamAccount),
                            1003,
                            (LPBYTE)&lpUserInfo1003,
                            &dwParmErr
                            );
#ifndef Win95
            if (fImpersonating) {
                if (RevertToSelf()) {
                    fImpersonating = FALSE;
                } 
                else {
                    ADsAssert(!"Revert to self failed.");
                    BAIL_ON_FAILURE(hr = HRESULT_FROM_WIN32(GetLastError()));
                }
            }
#endif

            if ( nasStatus == NERR_UserNotFound )  { // User not created yet
                hr = E_ADS_OBJECT_UNBOUND;
                BAIL_ON_FAILURE(hr);
            }

            hr = HRESULT_FROM_WIN32(nasStatus);
            if (FAILED(hr) && (nasStatus == ERROR_LOGON_FAILURE)) {

                //
                // Was failure and ERROR_LOGON_FAILURE
                //
                UpdateServerSSLSupportStatus(
                    pszHostName,
                    dwServerPwdSupport |= SERVER_DOES_NOT_SUPPORT_NETUSER
                    );
                //
                // Need to free the variant as we will re-read in kerb
                //
                VariantClear(&varSamAccount);
            }
            else {
                //
                // password set succeed
                //
                fPasswordSet = TRUE;
            }
        }
    } // if Password not set.


    
error:
    if (bstrADsPath) {
        ADsFreeString(bstrADsPath);
    }

    if (szServerSSL) {
        FreeADsStr(szServerSSL);
    }

    if (szDn) {
        FreeADsStr(szDn);
    }

    if (pAdsLdpSSL) {
        LdapCloseObject(pAdsLdpSSL);
    }

    if (pADsPrivObjectOptions) {
        pADsPrivObjectOptions->Release();
    }

    if (pADsOpt) {
        pADsOpt->Release();
    }
        

    if (pMsgResult) {
        LdapMsgFree(pMsgResult);
    }

    if (pszHostDomainName) {
        FreeADsStr(pszHostDomainName);
    }

    if (AuthI.User) {
        FreeADsStr(AuthI.User);
    }

    if (AuthI.Domain) {
        FreeADsStr(AuthI.Domain);
    }

    if (AuthI.Password) {
        SecureZeroMemory(AuthI.Password, AuthI.PasswordLength*sizeof(WCHAR));
        FreeADsStr(AuthI.Password);
    }

    if (pszTempPwd) {
        SecureZeroMemory(pszTempPwd, wcslen(pszTempPwd)*sizeof(WCHAR));
        FreeADsMem(pszTempPwd);
    } 

    if (pszHostName) {
    	FreeADsStr(pszHostName);
    }

    if (pszServer) {
    	FreeADsMem(pszServer);
    }

   
#ifndef Win95
    if (fImpersonating) {
        //
        // Try and call revert to self again
        //
        RevertToSelf();
    }
#endif

    if (hUserToken != INVALID_HANDLE_VALUE ) {
        CloseHandle(hUserToken);
        hUserToken = NULL;
    }

    VariantClear(&varSamAccount);
    VariantClear(&varGetInfoEx);
    VariantClear(&var);

    RRETURN(hr);
}


STDMETHODIMP
CLDAPUser::ChangePassword(THIS_ BSTR bstrOldPassword, BSTR bstrNewPassword)
{
    HRESULT hr = S_OK;
    BOOLEAN bUseLDAP = FALSE;

    LPWSTR pszServer = NULL;
    LPWSTR pszHostName = NULL;
    DWORD dwLen = 0;
        
    int err = 0;

    BSTR bstrADsPath = NULL;
    LPWSTR szServerSSL = NULL;
    LPWSTR szDn = NULL;
    DWORD dwPortSSL = 0;
    PADSLDP pAdsLdpSSL = NULL;

    IADsObjOptPrivate * pADsPrivObjectOptions = NULL;
    PADSLDP pAdsLdp = NULL;
    LDAPMessage *pMsgResult = NULL;
    LDAPMessage *pMsgEntry = NULL;
    LDAP *pLdapCurrent = NULL;
    LPWSTR Attributes[] = {L"objectClass", NULL};

    VARIANT varSamAccount;
    DWORD dwServerSSLSupport = 0;
    LPWSTR pszNewPassword = NULL;
    LPWSTR pszOldPassword = NULL;
    VARIANT varGetInfoEx;
    
    SEC_WINNT_AUTH_IDENTITY AuthI;
    BOOL fImpersonating = FALSE;
    HANDLE hUserToken = INVALID_HANDLE_VALUE;

    IADsObjectOptions* pADsOpt = NULL;
    DWORD dwPasswordPort;
    DWORD dwPasswordMethod;
    VARIANT var;
    CCredentials cTempCred = _Credentials;

    VariantInit(&varSamAccount);
    VariantInit(&varGetInfoEx);
    VariantInit(&var);
    memset(&AuthI, 0, sizeof(SEC_WINNT_AUTH_IDENTITY));

    //
    // Get the Ldap path of the user object
    //
    hr = _pADs->get_ADsPath( &bstrADsPath );
    BAIL_ON_FAILURE(hr);

    hr = BuildLDAPPathFromADsPath2(
                bstrADsPath,
                &szServerSSL,
                &szDn,
                &dwPortSSL
                );
    BAIL_ON_FAILURE(hr);

    //
    // Now do an LDAP Search with Referrals and get the handle to success
    // connection. This is where we can find the server the referred object
    // resides on
    //
    hr = _pADs->QueryInterface(
                    IID_IADsObjOptPrivate,
                    (void **)&pADsPrivObjectOptions
                    );
    BAIL_ON_FAILURE(hr);

    hr = pADsPrivObjectOptions->GetOption (
             LDAP_SERVER,
             (void *)&pszHostName
             );

    BAIL_ON_FAILURE(hr);

    //
    // additional length 3 is for '\0' and "\\\\"
    //
    dwLen = STRING_LENGTH(pszHostName) + 3;
    pszServer = (LPWSTR) AllocADsMem( dwLen * sizeof(WCHAR) );
    if (!pszServer) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }
    wcscpy(pszServer,L"\\\\");
    wcscat(pszServer, pszHostName);

    // get the info of password port and password method (SSL or clear text)
    hr = _pADs->QueryInterface(
                   IID_IADsObjectOptions,
                   (void **)&pADsOpt
                   );
    BAIL_ON_FAILURE(hr);

    hr = pADsOpt->GetOption(
                    ADS_OPTION_PASSWORD_PORTNUMBER,
                    &var
                    );
    BAIL_ON_FAILURE(hr);

    dwPasswordPort = V_I4(&var);
    VariantClear(&var);

    hr = pADsOpt->GetOption(
                    ADS_OPTION_PASSWORD_METHOD,
                    &var
                    );
    BAIL_ON_FAILURE(hr);

    dwPasswordMethod = V_I4(&var);
    
    if(dwPasswordMethod == ADS_PASSWORD_ENCODE_REQUIRE_SSL)
    {        
        dwServerSSLSupport = ReadServerSupportsSSL(pszHostName);

        if (dwServerSSLSupport == SERVER_STATUS_UNKNOWN
            || !(dwServerSSLSupport & SERVER_DOES_NOT_SUPPORT_SSL)) {

            //
            // Try to establish SSL connection for this Password Operation
            //

            // if NULL credential is passed in and auth flag does not contain secure auth, we need to make sure we keep
            // the default behavior: first try secure auth over SSL, then do anonymous bind over SSL
            if(cTempCred.IsNullCredentials() && !(cTempCred.GetAuthFlags() & ADS_SECURE_AUTHENTICATION))
            {
                cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() | ADS_USE_SSL | ADS_SECURE_AUTHENTICATION);
            
                hr = LdapOpenObject(
                            pszHostName,
                            szDn,
                            &pAdsLdpSSL,
                            cTempCred,
                            dwPasswordPort
                            );

                // check ERROR_LOGON_FAILURE to be consistent witht the behavior of LdapOpenBindWithDefaultCredentials when
                // credential is null and auth flag is 0
                if (FAILED(hr) && hr != ERROR_LOGON_FAILURE)
                {
                    cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() & ~ADS_SECURE_AUTHENTICATION);
                    hr = LdapOpenObject(
                                pszHostName,
                                szDn,
                                &pAdsLdpSSL,
                                cTempCred,
                                dwPasswordPort
                                );

                }
            }
            else
            {
                cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() | ADS_USE_SSL);
                hr = LdapOpenObject(
                            pszHostName,
                            szDn,
                            &pAdsLdpSSL,
                            cTempCred,
                            dwPasswordPort
                            );
            }

            if (SUCCEEDED(hr)) {
                int retval;
                SecPkgContext_ConnectionInfo  sslattr;

                retval = ldap_get_option( pAdsLdpSSL->LdapHandle, LDAP_OPT_SSL_INFO, &sslattr );
                if (retval == LDAP_SUCCESS) {
                    //
                    // If Channel is secure enough, enable LDAP Password Change
                    //
                    if (sslattr.dwCipherStrength >= 128) {
                        bUseLDAP = TRUE;
                    }
                }
            }

            //
            // Update the SSL support if appropriate
            //
            if (dwServerSSLSupport == SERVER_STATUS_UNKNOWN
                || !bUseLDAP) {
 
                UpdateServerSSLSupportStatus(
                    pszHostName,
                    bUseLDAP ?
                    dwServerSSLSupport :
                    dwServerSSLSupport |= SERVER_DOES_NOT_SUPPORT_SSL
                );
            }

        }

    }
    else
    {
        cTempCred.SetAuthFlags(cTempCred.GetAuthFlags() & ~ADS_USE_SSL);
        hr = LdapOpenObject(
                        pszHostName,
                        szDn,
                        &pAdsLdpSSL,
                        cTempCred,
                        dwPasswordPort
                        );
        if(SUCCEEDED(hr))
            bUseLDAP = TRUE;
    }
    

    if (bUseLDAP) {
        //
        // LDAP Password Set
        //
        PLDAPModW prgMod[3];
        LDAPModW ModDelete;
        LDAPModW ModAdd;
        int iOldPwdLen, iNewPwdLen;
        struct berval* rgBerVal[2];
        struct berval* rgBerVal2[2];
        struct berval BerVal;
        struct berval BerVal2;

        prgMod[0] = &ModDelete;
        prgMod[1] = &ModAdd;
        prgMod[2] = NULL;

        ModDelete.mod_op = LDAP_MOD_DELETE | LDAP_MOD_BVALUES;
        ModDelete.mod_type = L"unicodePwd";
        ModDelete.mod_bvalues = rgBerVal;
        rgBerVal[0] = &BerVal;
        rgBerVal[1] = NULL;
        //
        // Put old pwd in quotes.
        //
        if (bstrOldPassword) {
            iOldPwdLen = (wcslen(bstrOldPassword) + 2) * sizeof(WCHAR);
        }
        else {
            iOldPwdLen = 2 * sizeof(WCHAR);
        }

        pszOldPassword = (LPWSTR) AllocADsMem((iOldPwdLen+1) * sizeof(WCHAR));

        if (!pszOldPassword) {
            BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
        }

        wcscpy(pszOldPassword, L"\"");
        if (bstrOldPassword) {
            wcscat(pszOldPassword, bstrOldPassword);
        }

        wcscat(pszOldPassword, L"\"");

        BerVal.bv_len = iOldPwdLen;
        BerVal.bv_val = (char*)pszOldPassword;

        ModAdd.mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
        ModAdd.mod_type = L"unicodePwd";
        ModAdd.mod_bvalues = rgBerVal2;
        rgBerVal2[0] = &BerVal2;
        rgBerVal2[1] = NULL;
        //
        // Put new password in ""
        //
        if (bstrNewPassword) {
            iNewPwdLen = (wcslen(bstrNewPassword) + 2) * sizeof(WCHAR);
        }
        else {
            iNewPwdLen = 2 * sizeof(WCHAR);
        }

        pszNewPassword = (LPWSTR) AllocADsMem(iNewPwdLen + sizeof(WCHAR));

        if (!pszNewPassword) {
            BAIL_ON_FAILURE(hr = E_FAIL);
        }

        wcscpy(pszNewPassword, L"\"");
        if (bstrNewPassword) {
            wcscat(pszNewPassword, bstrNewPassword);
        }
        wcscat(pszNewPassword, L"\"");


        BerVal2.bv_len = iNewPwdLen;
        BerVal2.bv_val = (char*)pszNewPassword;

        hr = LdapModifyS(
                       pAdsLdpSSL,
                       szDn,
                       prgMod
                       );
        BAIL_ON_FAILURE(hr);
    }
    else {
        //
        // Password Set using NET APIs
        //
        NET_API_STATUS nasStatus;
        DWORD dwParmErr = 0;
        LPWSTR pszSamAccountArr[] = {L"sAMAccountName"};

        //
        // Get SamAccountName
        //

        hr = ADsBuildVarArrayStr( pszSamAccountArr, 1, &varGetInfoEx );
        BAIL_ON_FAILURE(hr);

        hr = _pADs->GetInfoEx(varGetInfoEx, 0);
        BAIL_ON_FAILURE(hr);
        
        hr = _pADs->Get(L"sAMAccountName", &varSamAccount);
        BAIL_ON_FAILURE(hr);

#ifndef Win95
        //
        // At this point if the user credentials are non NULL,
        // we want to impersonate the user and then make this call.
        // This will make sure the NetUserChangePassword call is made in the
        // correct context.
        //
        if (!_Credentials.IsNullCredentials()) {
            //
            // Need to get the userName and password in the format
            // usable by the logonUser call.
            //
            hr = GetAuthIdentityForCaller(
                    _Credentials,
                    _pADs,
                    &AuthI,
                    FALSE
                    );

            if SUCCEEDED(hr) {
            
                //
                // Note that if this code is backported, then we might
                // need to change LOGON32_PROVIDER_WINNT50 to 
                // LOGON32_PROVIDER_DEFAULT as NT4 and below will support
                // only that option. Also note that Win2k and below, do not
                // allow all accounts to impersonate.
                //
                if (LogonUser(
                         AuthI.User,
                         AuthI.Domain,
                         AuthI.Password,
                         LOGON32_LOGON_NEW_CREDENTIALS,
                         LOGON32_PROVIDER_DEFAULT,
                         &hUserToken
                         )
                    ) {
                    //  
                    // Call succeeded so we should use this context.
                    //
                    if (ImpersonateLoggedOnUser(hUserToken)) {
                        fImpersonating = TRUE;
                    } 
                }
            } // if we could successfully get the auth ident structure.

            //
            // We will continue to make the ChangePassword call even if
            // we could not impersonate successfully.
            //

        } // if credentials are valid.
#endif

        //
        // Do the actual change password
        //
        nasStatus = NetUserChangePassword(
                            pszServer,
                            V_BSTR(&varSamAccount),
                            bstrOldPassword,
                            bstrNewPassword
                            );
#ifndef Win95
        if (fImpersonating) {
            if (RevertToSelf()) {
                fImpersonating = FALSE;
            }
            else {
                ADsAssert(!"Revert to self failed.");
                BAIL_ON_FAILURE(hr = HRESULT_FROM_WIN32(GetLastError()));
            }
        }
#endif


        if ( nasStatus == NERR_UserNotFound )  // User not created yet
        {
            hr = E_ADS_OBJECT_UNBOUND;
            BAIL_ON_FAILURE(hr);
        }

        hr = HRESULT_FROM_WIN32(nasStatus);
        BAIL_ON_FAILURE(hr);
    }

        
error:
    if (bstrADsPath) {
        ADsFreeString(bstrADsPath);
    }

    if (szServerSSL) {
        FreeADsStr(szServerSSL);
    }

    if (szDn) {
        FreeADsStr(szDn);
    }

    if (pAdsLdpSSL) {
        LdapCloseObject(pAdsLdpSSL);
    }

    if (pADsPrivObjectOptions) {
        pADsPrivObjectOptions->Release();
    }

    if (pADsOpt) {
        pADsOpt->Release();
    }

    if (pMsgResult) {
        LdapMsgFree(pMsgResult);
    }

    if (pszOldPassword) {
        SecureZeroMemory(pszOldPassword, wcslen(pszOldPassword)*sizeof(WCHAR));
        FreeADsMem(pszOldPassword);
    }
    
    if (pszNewPassword) {
        SecureZeroMemory(pszNewPassword, wcslen(pszNewPassword)*sizeof(WCHAR));
        FreeADsMem(pszNewPassword);
    }

    if (AuthI.User) {
        FreeADsStr(AuthI.User);
    }

    if (AuthI.Domain) {
        FreeADsStr(AuthI.Domain);
    }

    if (AuthI.Password) {
        SecureZeroMemory(AuthI.Password, AuthI.PasswordLength*sizeof(WCHAR));
        FreeADsStr(AuthI.Password);
    }
   
    if (pszHostName) {
    	FreeADsStr(pszHostName);
    }

    if (pszServer) {
    	FreeADsMem(pszServer);
    }

   
#ifndef Win95
    if (fImpersonating) {
        //
        // Try and call revert to self again
        //
        RevertToSelf();
    }
#endif

    if (hUserToken != INVALID_HANDLE_VALUE ) {
        CloseHandle(hUserToken);
        hUserToken = NULL;
    }

    VariantClear(&varSamAccount);
    VariantClear(&varGetInfoEx);
    VariantClear(&var);

    RRETURN(hr);
}

//+---------------------------------------------------------------------------
//
// GetDomainDNSNameFromHost
//
// Given the domain dns name for a host, we need to get hold of the
// dns name for the domain.
//
// Arguments:
//   [szHostName]       - name of server.
//   [Credentials]      - Credentials to use for bind.
//   [dwPort]           - Port to connect to server on.
//   [ppszHostName]     - ptr to string for retval.
//
// Returns:
//  S_OK                - If operation succeeds.
//  E_*                 - For other cases.
//
//----------------------------------------------------------------------------
HRESULT
GetDomainDNSNameFromHost(
    LPWSTR szHostName,
    SEC_WINNT_AUTH_IDENTITY& AuthI,
    CCredentials& Credentials,
    DWORD dwPort,
    LPWSTR * ppszHostName
    )
{
    HRESULT hr = S_OK;
    PADSLDP ld = NULL;
    LPTSTR *aValuesNamingContext = NULL;
    IADsNameTranslate *pNameTranslate = NULL;
    BSTR bstrName = NULL;
    int nCount = 0;

    //
    // Bind to the ROOTDSE of the server.
    //
    hr = LdapOpenObject(
             szHostName,
             NULL, // the DN.
             &ld,
             Credentials,
             dwPort
             );

    BAIL_ON_FAILURE(hr);

    //
    // Now get the defaultNamingContext
    //
    hr = LdapReadAttributeFast(
             ld,
             NULL, // the DN.
             LDAP_OPATT_DEFAULT_NAMING_CONTEXT_W,
             &aValuesNamingContext,
             &nCount
             );
    //
    // Verify we actuall got back at least one value
    //
    if (SUCCEEDED(hr) && (nCount < 1)) {
        hr = HRESULT_FROM_WIN32(ERROR_DS_NO_ATTRIBUTE_OR_VALUE);
    }

    BAIL_ON_FAILURE(hr);

    //
    // Create nametran object
    //
    hr = CoCreateInstance(
             CLSID_NameTranslate,
             NULL,
             CLSCTX_ALL,
             IID_IADsNameTranslate,
             (void **) &pNameTranslate
             );
    BAIL_ON_FAILURE(hr);

    //
    // Init with defaultNamingContext and get transalte
    //

    hr = pNameTranslate->InitEx(
                             ADS_NAME_INITTYPE_SERVER,
                             szHostName,
                             AuthI.User,
                             AuthI.Domain,
                             AuthI.Password
                             );
    BAIL_ON_FAILURE(hr);

    hr = pNameTranslate->Set(
                             ADS_NAME_TYPE_1779,
                             aValuesNamingContext[0]
                             );
    BAIL_ON_FAILURE(hr);


    hr = pNameTranslate->Get(
                             ADS_NAME_TYPE_CANONICAL,
                             &bstrName
                             );
    BAIL_ON_FAILURE(hr);

    if (!bstrName) {
        BAIL_ON_FAILURE(hr = E_FAIL);
    }

    *ppszHostName = AllocADsStr(bstrName);

    if (!*ppszHostName) {
        BAIL_ON_FAILURE(hr = E_OUTOFMEMORY);
    }

    //
    // Null terminate one place ahead so we can get rid of /
    //
    (*ppszHostName)[wcslen(bstrName)-1] = L'\0';


error :
    if (ld) {
        LdapCloseObject(ld);
    }

    if (pNameTranslate) {
        pNameTranslate->Release();
    }

    if (bstrName) {
        SysFreeString(bstrName);
    }

    if (aValuesNamingContext) {
        LdapValueFree(aValuesNamingContext);
    }

    RRETURN(hr);
}