* Makefile.in (DLL_OFILES): Add setlsapwd.o.

	* cygserver.h (CYGWIN_SERVER_VERSION_API): Bump.
	(request_code_t): Define CYGSERVER_REQUEST_SETPWD request type.
	* cygserver_msg.h (client_request_msg::retval): Use default value of -1
	for retval if msglen is 0.
	* cygserver_sem.h (client_request_sem::retval): Ditto.
	* cygserver_shm.h (client_request_shm::retval): Ditto.
	* cygserver_setpwd.h: New file.
	* external.cc (cygwin_internal): Implement new CW_SET_PRIV_KEY type.
	* sec_auth.cc (open_local_policy): Make externally available.
	Get ACCESS_MASK as argument.
	(create_token): Accommodate change to open_local_policy.
	(lsaauth): Ditto.
	(lsaprivkeyauth): New function fetching token by retrieving
	password stored in Cygwin or Interix LSA private data area and
	calling LogonUser with it.
	* security.h (lsaprivkeyauth): Declare.
	(open_local_policy): Declare.
	* setlsapwd.cc: New file implementing setting LSA private data password
	using LsaStorePrivateData or by calling cygserver if available.
	* syscalls.cc (seteuid32): Add workaround to get the original token
	when switching back to the original privileged user, even if
	setgroups group list is still active.  Add long comment to explain why.
	Call lsaprivkeyauth first, only if that fails call lsaauth or
	create_token.
	* include/cygwin/version.h: Bump API minor number.
	* include/sys/cygwin.h (cygwin_getinfo_types): Add CW_SET_PRIV_KEY.

14 files changed, 323 insertions, 32 deletions

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 31d74eed0..ddb11d82a 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,33 @@
+2008-11-26  Corinna Vinschen  <corinna@vinschen.de>
+
+	* Makefile.in (DLL_OFILES): Add setlsapwd.o.
+	* cygserver.h (CYGWIN_SERVER_VERSION_API): Bump.
+	(request_code_t): Define CYGSERVER_REQUEST_SETPWD request type.
+	* cygserver_msg.h (client_request_msg::retval): Use default value of -1
+	for retval if msglen is 0.
+	* cygserver_sem.h (client_request_sem::retval): Ditto.
+	* cygserver_shm.h (client_request_shm::retval): Ditto.
+	* cygserver_setpwd.h: New file.
+	* external.cc (cygwin_internal): Implement new CW_SET_PRIV_KEY type.
+	* sec_auth.cc (open_local_policy): Make externally available.
+	Get ACCESS_MASK as argument.
+	(create_token): Accommodate change to open_local_policy.
+	(lsaauth): Ditto.
+	(lsaprivkeyauth): New function fetching token by retrieving
+	password stored in Cygwin or Interix LSA private data area and
+	calling LogonUser with it.
+	* security.h (lsaprivkeyauth): Declare.
+	(open_local_policy): Declare.
+	* setlsapwd.cc: New file implementing setting LSA private data password
+	using LsaStorePrivateData or by calling cygserver if available.
+	* syscalls.cc (seteuid32): Add workaround to get the original token
+	when switching back to the original privileged user, even if
+	setgroups group list is still active.  Add long comment to explain why.
+	Call lsaprivkeyauth first, only if that fails call lsaauth or
+	create_token.
+	* include/cygwin/version.h: Bump API minor number.
+	* include/sys/cygwin.h (cygwin_getinfo_types): Add CW_SET_PRIV_KEY.
+
 2008-11-21  Corinna Vinschen  <corinna@vinschen.de>
 
 	* fhandler_floppy.cc (fhandler_dev_floppy::raw_read): Drop
diff --git a/winsup/cygwin/Makefile.in b/winsup/cygwin/Makefile.in
index d6f6bb1ce..49baebc96 100644
--- a/winsup/cygwin/Makefile.in
+++ b/winsup/cygwin/Makefile.in
@@ -141,11 +141,11 @@ DLL_OFILES:=assert.o autoload.o bsdlib.o ctype.o cxx.o cygheap.o cygthread.o \
 	nftw.o ntea.o passwd.o path.o pinfo.o pipe.o poll.o posix_ipc.o \
 	pthread.o random.o regcomp.o regerror.o regexec.o regfree.o registry.o \
 	resource.o rexec.o rcmd.o scandir.o sched.o sec_acl.o sec_auth.o \
-	sec_helper.o security.o select.o sem.o shared.o shm.o sigfe.o signal.o \
-	sigproc.o smallprint.o spawn.o strace.o strfuncs.o strptime.o strsep.o \
-	strsig.o sync.o syscalls.o sysconf.o syslog.o termios.o thread.o \
-	timer.o times.o tls_pbuf.o tty.o uinfo.o uname.o wait.o wincap.o \
-	window.o winf.o xsique.o \
+	sec_helper.o security.o select.o sem.o setlsapwd.o shared.o shm.o \
+	sigfe.o signal.o sigproc.o smallprint.o spawn.o strace.o strfuncs.o \
+	strptime.o strsep.o strsig.o sync.o syscalls.o sysconf.o syslog.o \
+	termios.o thread.o timer.o times.o tls_pbuf.o tty.o uinfo.o uname.o \
+	wait.o wincap.o window.o winf.o xsique.o \
 	$(EXTRA_DLL_OFILES) $(EXTRA_OFILES) $(MALLOC_OFILES) $(MT_SAFE_OBJECTS)
 
 GMON_OFILES:=gmon.o mcount.o profil.o
diff --git a/winsup/cygwin/cygserver.h b/winsup/cygwin/cygserver.h
index 09ab78a9f..b549ed006 100644
--- a/winsup/cygwin/cygserver.h
+++ b/winsup/cygwin/cygserver.h
@@ -1,6 +1,6 @@
 /* cygserver.h
 
-   Copyright 2001, 2002, 2003, 2004 Red Hat Inc.
+   Copyright 2001, 2002, 2003, 2004, 2008 Red Hat Inc.
 
    Written by Egor Duda <deo@logos-m.ru>
 
@@ -20,7 +20,7 @@ details. */
 #endif
 
 #define CYGWIN_SERVER_VERSION_MAJOR	1
-#define CYGWIN_SERVER_VERSION_API	3
+#define CYGWIN_SERVER_VERSION_API	4
 #define CYGWIN_SERVER_VERSION_MINOR	0
 #define CYGWIN_SERVER_VERSION_PATCH	0
 
@@ -51,6 +51,7 @@ protected:
     CYGSERVER_REQUEST_MSG,
     CYGSERVER_REQUEST_SEM,
     CYGSERVER_REQUEST_SHM,
+    CYGSERVER_REQUEST_SETPWD,
     CYGSERVER_REQUEST_LAST
   } request_code_t;
 
diff --git a/winsup/cygwin/cygserver_msg.h b/winsup/cygwin/cygserver_msg.h
index 7fbb12cab..37616bb1d 100644
--- a/winsup/cygwin/cygserver_msg.h
+++ b/winsup/cygwin/cygserver_msg.h
@@ -1,6 +1,6 @@
 /* cygserver_msg.h: Single unix specification IPC interface for Cygwin.
 
-   Copyright 2003 Red Hat, Inc.
+   Copyright 2003, 2008 Red Hat, Inc.
 
 This file is part of Cygwin.
 
@@ -75,7 +75,7 @@ public:
   client_request_msg (int, const void *, size_t, int);	// msgsnd
 #endif
 
-  int retval () const { return _parameters.out.ret; }
+  int retval () const { return msglen () ? _parameters.out.ret : -1; }
   ssize_t rcvval () const { return _parameters.out.rcv; }
 };
 
diff --git a/winsup/cygwin/cygserver_sem.h b/winsup/cygwin/cygserver_sem.h
index 225d8f215..fdf6f8c39 100644
--- a/winsup/cygwin/cygserver_sem.h
+++ b/winsup/cygwin/cygserver_sem.h
@@ -1,6 +1,6 @@
 /* cygserver_sem.h: Single unix specification IPC interface for Cygwin.
 
-   Copyright 2003 Red Hat, Inc.
+   Copyright 2003, 2008 Red Hat, Inc.
 
 This file is part of Cygwin.
 
@@ -71,7 +71,7 @@ public:
   client_request_sem (int, struct sembuf *, size_t);	// semop
 #endif
 
-  int retval () const { return _parameters.out.ret; }
+  int retval () const { return msglen () ? _parameters.out.ret : -1; }
 };
 
 #ifndef __INSIDE_CYGWIN__
diff --git a/winsup/cygwin/cygserver_setpwd.h b/winsup/cygwin/cygserver_setpwd.h
new file mode 100644
index 000000000..94ee2998d
--- /dev/null
+++ b/winsup/cygwin/cygserver_setpwd.h
@@ -0,0 +1,53 @@
+/* cygserver_setpwd.h: Set LSA private data password for current user.
+
+   Copyright 2008 Red Hat, Inc.
+
+This file is part of Cygwin.
+
+This software is a copyrighted work licensed under the terms of the
+Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
+details. */
+
+#ifndef __CYGSERVER_SETPWD_H__
+#define __CYGSERVER_SETPWD_H__
+
+#include <sys/types.h>
+#include "cygserver.h"
+
+#define CYGWIN_LSA_KEY_PREFIX	L"L$CYGWIN_"
+
+#ifndef __INSIDE_CYGWIN__
+class transport_layer_base;
+class process_cache;
+#endif
+
+class client_request_setpwd : public client_request
+{
+  friend class client_request;
+
+private:
+  union
+  {
+    struct
+    {
+      WCHAR passwd[256];
+    } in;
+  } _parameters;
+
+#ifndef __INSIDE_CYGWIN__
+  client_request_setpwd ();
+  virtual void serve (transport_layer_base *, process_cache *);
+#endif
+
+public:
+
+#ifdef __INSIDE_CYGWIN__
+  client_request_setpwd (PUNICODE_STRING);
+#endif
+};
+
+#ifdef __INSIDE_CYGWIN__
+unsigned long setlsapwd (const char *passwd);
+#endif
+
+#endif /* __CYGSERVER_SETPWD_H__ */
diff --git a/winsup/cygwin/cygserver_shm.h b/winsup/cygwin/cygserver_shm.h
index 2948f6725..baa3e052a 100644
--- a/winsup/cygwin/cygserver_shm.h
+++ b/winsup/cygwin/cygserver_shm.h
@@ -1,6 +1,6 @@
 /* cygserver_shm.h: Single unix specification IPC interface for Cygwin.
 
-   Copyright 2003 Red Hat, Inc.
+   Copyright 2003, 2008 Red Hat, Inc.
 
 This file is part of Cygwin.
 
@@ -78,7 +78,7 @@ public:
   client_request_shm (proc *);				// shmfork
 #endif
 
-  int retval () const { return _parameters.out.ret; }
+  int retval () const { return msglen () ? _parameters.out.ret : -1; }
   void *ptrval () const { return (void *)_parameters.out.ptr; }
   vm_object_t objval () const { return _parameters.out.obj; }
 };
diff --git a/winsup/cygwin/external.cc b/winsup/cygwin/external.cc
index 675d8b066..b880e07fb 100644
--- a/winsup/cygwin/external.cc
+++ b/winsup/cygwin/external.cc
@@ -25,6 +25,7 @@ details. */
 #include "cygtls.h"
 #include "child_info.h"
 #include "environ.h"
+#include "cygserver_setpwd.h"
 #include <unistd.h>
 #include <stdlib.h>
 #include <wchar.h>
@@ -357,6 +358,11 @@ cygwin_internal (cygwin_getinfo_types t, ...)
 	  dos_file_warning = va_arg (arg, int);
 	}
 	break;
+      case CW_SET_PRIV_KEY:
+	{
+	  const char *passwd = va_arg (arg, const char *);
+	  return setlsapwd (passwd);
+	}
 
       default:
 	break;
diff --git a/winsup/cygwin/include/cygwin/version.h b/winsup/cygwin/include/cygwin/version.h
index 268f99db7..ef332ce23 100644
--- a/winsup/cygwin/include/cygwin/version.h
+++ b/winsup/cygwin/include/cygwin/version.h
@@ -335,12 +335,13 @@ details. */
       186: Remove ancient V8 regexp functions.  Also eliminate old crt0 interface
            which provided its own user_data structure.
       187: Export cfmakeraw.
+      188: Export CW_SET_PRIV_KEY.
      */
 
      /* Note that we forgot to bump the api for ualarm, strtoll, strtoull */
 
 #define CYGWIN_VERSION_API_MAJOR 0
-#define CYGWIN_VERSION_API_MINOR 187
+#define CYGWIN_VERSION_API_MINOR 188
 
      /* There is also a compatibity version number associated with the
 	shared memory regions.  It is incremented when incompatible
diff --git a/winsup/cygwin/include/sys/cygwin.h b/winsup/cygwin/include/sys/cygwin.h
index 1ba18597d..8c1101051 100644
--- a/winsup/cygwin/include/sys/cygwin.h
+++ b/winsup/cygwin/include/sys/cygwin.h
@@ -140,7 +140,8 @@ typedef enum
     CW_DEBUG_SELF,
     CW_SYNC_WINENV,
     CW_CYGTLS_PADSIZE,
-    CW_SET_DOS_FILE_WARNING
+    CW_SET_DOS_FILE_WARNING,
+    CW_SET_PRIV_KEY
   } cygwin_getinfo_types;
 
 #define CW_NEXTPID	0x80000000	/* or with pid to get next one */
diff --git a/winsup/cygwin/sec_auth.cc b/winsup/cygwin/sec_auth.cc
index 3f7a082b2..138131744 100644
--- a/winsup/cygwin/sec_auth.cc
+++ b/winsup/cygwin/sec_auth.cc
@@ -27,6 +27,7 @@ details. */
 #include <iptypes.h>
 #include "pwdgrp.h"
 #include "cyglsa.h"
+#include "cygserver_setpwd.h"
 #include <cygwin/version.h>
 
 extern "C" void
@@ -150,13 +151,13 @@ str2uni_cat (UNICODE_STRING &tgt, const char *srcstr)
     tgt.Length = tgt.MaximumLength = 0;
 }
 
-static LSA_HANDLE
-open_local_policy ()
+HANDLE
+open_local_policy (ACCESS_MASK access)
 {
   LSA_OBJECT_ATTRIBUTES oa = { 0, 0, 0, 0, 0, 0 };
-  LSA_HANDLE lsa = INVALID_HANDLE_VALUE;
+  HANDLE lsa = INVALID_HANDLE_VALUE;
 
-  NTSTATUS ret = LsaOpenPolicy (NULL, &oa, POLICY_EXECUTE, &lsa);
+  NTSTATUS ret = LsaOpenPolicy (NULL, &oa, access, &lsa);
   if (ret != STATUS_SUCCESS)
     __seterrno_from_win_error (LsaNtStatusToWinError (ret));
   return lsa;
@@ -785,7 +786,7 @@ create_token (cygsid &usersid, user_groups &new_groups, struct passwd *pw)
   push_self_privilege (SE_CREATE_TOKEN_PRIVILEGE, true);
 
   /* Open policy object. */
-  if ((lsa = open_local_policy ()) == INVALID_HANDLE_VALUE)
+  if ((lsa = open_local_policy (POLICY_EXECUTE)) == INVALID_HANDLE_VALUE)
     goto out;
 
   /* User, owner, primary group. */
@@ -963,7 +964,7 @@ lsaauth (cygsid &usersid, user_groups &new_groups, struct passwd *pw)
     }
 
   /* Open policy object. */
-  if ((lsa = open_local_policy ()) == INVALID_HANDLE_VALUE)
+  if ((lsa = open_local_policy (POLICY_EXECUTE)) == INVALID_HANDLE_VALUE)
     goto out;
 
   /* Create origin. */
@@ -1172,3 +1173,75 @@ out:
   debug_printf ("%p = lsaauth ()", user_token);
   return user_token;
 }
+
+#define SFU_LSA_KEY_SUFFIX	L"_microsoft_sfu_utility"
+
+HANDLE
+lsaprivkeyauth (struct passwd *pw)
+{
+  NTSTATUS status;
+  HANDLE lsa = INVALID_HANDLE_VALUE;
+  HANDLE token = NULL;
+  WCHAR sid[256];
+  WCHAR domain[MAX_DOMAIN_NAME_LEN + 1];
+  WCHAR user[UNLEN + 1];
+  WCHAR key_name[MAX_DOMAIN_NAME_LEN + UNLEN + wcslen (SFU_LSA_KEY_SUFFIX) + 2];
+  UNICODE_STRING key;
+  PUNICODE_STRING data;
+  cygsid psid;
+
+  push_self_privilege (SE_TCB_PRIVILEGE, true);
+
+  /* Open policy object. */
+  if ((lsa = open_local_policy (POLICY_GET_PRIVATE_INFORMATION))
+      == INVALID_HANDLE_VALUE)
+    goto out;
+
+  /* Needed for Interix key and LogonUser. */
+  extract_nt_dom_user (pw, domain, user);
+
+  /* First test for a Cygwin entry. */
+  if (psid.getfrompw (pw) && psid.string (sid))
+    {
+      wcpcpy (wcpcpy (key_name, CYGWIN_LSA_KEY_PREFIX), sid);
+      RtlInitUnicodeString (&key, key_name);
+      status = LsaRetrievePrivateData (lsa, &key, &data);
+      if (!NT_SUCCESS (status))
+	{
+	  /* No Cygwin key, try Interix key. */
+	  if (!*domain)
+	    goto out;
+	  __small_swprintf (key_name, L"%W_%W%W",
+			    domain, user, SFU_LSA_KEY_SUFFIX);
+	  RtlInitUnicodeString (&key, key_name);
+	  status = LsaRetrievePrivateData (lsa, &key, &data);
+	  if (!NT_SUCCESS (status))
+	    goto out;
+	}
+    }
+
+  /* The key is not 0-terminated. */
+  PWCHAR passwd = (PWCHAR) alloca (data->Length + sizeof (WCHAR));
+  *wcpncpy (passwd, data->Buffer, data->Length / sizeof (WCHAR)) = L'\0';
+  LsaFreeMemory (data);
+  debug_printf ("Try logon for %W\\%W", domain, user);
+  if (!LogonUserW (user, domain, passwd, LOGON32_LOGON_INTERACTIVE,
+		   LOGON32_PROVIDER_DEFAULT, &token))
+    {
+      __seterrno ();
+      token = NULL;
+    }
+  else if (!SetHandleInformation (token,
+				  HANDLE_FLAG_INHERIT,
+				  HANDLE_FLAG_INHERIT))
+    {
+      __seterrno ();
+      CloseHandle (token);
+      token = NULL;
+    }
+
+out:
+  close_local_policy (lsa);
+  pop_self_privilege ();
+  return token;
+}
diff --git a/winsup/cygwin/security.h b/winsup/cygwin/security.h
index 27a2d0046..0f194bade 100644
--- a/winsup/cygwin/security.h
+++ b/winsup/cygwin/security.h
@@ -370,6 +370,8 @@ void __stdcall str2uni_cat (_UNICODE_STRING &, const char *) __attribute__ ((reg
 HANDLE create_token (cygsid &usersid, user_groups &groups, struct passwd * pw);
 /* LSA authentication function. */
 HANDLE lsaauth (cygsid &, user_groups &, struct passwd *);
+/* LSA private key storage authentication, same as when using service logons. */
+HANDLE lsaprivkeyauth (struct passwd *pw);
 /* Verify an existing token */
 bool verify_token (HANDLE token, cygsid &usersid, user_groups &groups, bool *pintern = NULL);
 /* Get groups of a user */
@@ -380,6 +382,8 @@ void extract_nt_dom_user (const struct passwd *pw, PWCHAR domain, PWCHAR user);
 /* Get default logonserver for a domain. */
 bool get_logon_server (PWCHAR domain, PWCHAR wserver, bool rediscovery);
 
+HANDLE open_local_policy (ACCESS_MASK access);
+
 /* sec_helper.cc: Security helper functions. */
 int set_privilege (HANDLE token, DWORD privilege, bool enable);
 void set_cygwin_privileges (HANDLE token);
diff --git a/winsup/cygwin/setlsapwd.cc b/winsup/cygwin/setlsapwd.cc
new file mode 100644
index 000000000..34284afd3
--- /dev/null
+++ b/winsup/cygwin/setlsapwd.cc
@@ -0,0 +1,90 @@
+/* setlsapwd.cc: Set LSA private data password for current user.
+
+   Copyright 2008 Red Hat, Inc.
+
+This file is part of Cygwin.
+
+This software is a copyrighted work licensed under the terms of the
+Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
+details. */
+
+#include "winsup.h"
+#include "shared_info.h"
+#include "cygerrno.h"
+#include "path.h"
+#include "fhandler.h"
+#include "dtable.h"
+#include "cygheap.h"
+#include "security.h"
+#include "cygserver_setpwd.h"
+#include "ntdll.h"
+#include <ntsecapi.h>
+#include <stdlib.h>
+#include <wchar.h>
+
+#ifdef USE_SERVER
+/*
+ * client_request_setpwd Constructor
+ */
+
+client_request_setpwd::client_request_setpwd (PUNICODE_STRING passwd)
+  : client_request (CYGSERVER_REQUEST_SETPWD, &_parameters, sizeof (_parameters))
+{
+  memset (_parameters.in.passwd, 0, sizeof _parameters.in.passwd);
+  if (passwd->Length > 0 && passwd->Length < 256 * sizeof (WCHAR))
+    wcpncpy (_parameters.in.passwd, passwd->Buffer, 255);
+
+  msglen (sizeof (_parameters.in));
+}
+
+#endif /* USE_SERVER */
+
+unsigned long
+setlsapwd (const char *passwd)
+{
+  unsigned long ret = (unsigned long) -1;
+  HANDLE lsa = INVALID_HANDLE_VALUE;
+  WCHAR sid[128];
+  WCHAR key_name[128 + wcslen (CYGWIN_LSA_KEY_PREFIX)];
+  PWCHAR data_buf = NULL;
+  UNICODE_STRING key;
+  UNICODE_STRING data;
+
+  wcpcpy (wcpcpy (key_name, CYGWIN_LSA_KEY_PREFIX),
+	  cygheap->user.get_windows_id (sid));
+  RtlInitUnicodeString (&key, key_name);
+  if (!passwd || ! *passwd
+      || sys_mbstowcs_alloc (&data_buf, HEAP_NOTHEAP, passwd))
+    {
+      NTSTATUS status = STATUS_ACCESS_DENIED;
+
+      memset (&data, 0, sizeof data);
+      if (data_buf)
+	RtlInitUnicodeString (&data, data_buf);
+      /* First try it locally.  Works for admin accounts. */
+      if ((lsa = open_local_policy (POLICY_CREATE_SECRET))
+	  != INVALID_HANDLE_VALUE)
+	{
+	  status = LsaStorePrivateData (lsa, &key, data.Length ? &data : NULL);
+	  if (NT_SUCCESS (status))
+	    ret = 0;
+	  LsaClose (lsa);
+	}
+      if (ret)
+#ifdef USE_SERVER
+	{
+	  /* If that fails, ask cygserver. */
+	  client_request_setpwd request (&data);
+	  if (request.make_request () == -1 || request.error_code ())
+	    set_errno (request.error_code ());
+	  else
+	    ret = 0;
+	}
+#else
+      __seterrno_from_nt_status (status);
+#endif
+      if (data_buf)
+	free (data_buf);
+    }
+  return ret;
+}
diff --git a/winsup/cygwin/syscalls.cc b/winsup/cygwin/syscalls.cc
index 9b39f7712..4590c37a8 100644
--- a/winsup/cygwin/syscalls.cc
+++ b/winsup/cygwin/syscalls.cc
@@ -2493,7 +2493,23 @@ seteuid32 (__uid32_t uid)
   cygheap->user.deimpersonate ();
 
   /* Verify if the process token is suitable. */
-  if (verify_token (hProcToken, usersid, groups))
+  /* TODO, CV 2008-11-25: The check against saved_sid is a kludge and a
+     shortcut.  We must check if it's really feasible in the long run.
+     The reason to add this shortcut is this:  sshd switches back to the
+     privileged user running sshd at least twice in the process of
+     authentication.  It calls seteuid first, then setegid.  Due to this
+     order, the setgroups group list is still active when calling seteuid
+     and verify_token treats the original token of the privileged user as
+     insufficient.  This in turn results in creating a new user token for
+     the privileged user instead of using the orignal token.  This can have
+     unfortunate side effects.  The created token has different group
+     memberships, different user rights, and misses possible network
+     credentials. 
+     Therefore we try this shortcut now.  When switching back to the
+     privileged user, we probably always want a correct (aka original)
+     user token for this privileged user, not only in sshd. */
+  if ((uid == cygheap->user.saved_uid && usersid == cygheap->user.saved_sid ())
+      || verify_token (hProcToken, usersid, groups))
     new_token = hProcToken;
   /* Verify if the external token is suitable */
   else if (cygheap->user.external_token != NO_IMPERSONATION
@@ -2514,19 +2530,35 @@ seteuid32 (__uid32_t uid)
 
   debug_printf ("Found token %d", new_token);
 
-  /* If no impersonation token is available, try to
-     authenticate using NtCreateToken () or LSA authentication. */
+  /* If no impersonation token is available, try to authenticate using
+     LSA private data stored password, LSA authentication using our own
+     LSA module, or, as last chance, NtCreateToken. */
   if (new_token == INVALID_HANDLE_VALUE)
     {
-      if (!(new_token = lsaauth (usersid, groups, pw_new)))
-	{
-	  debug_printf ("lsaauth failed, try create_token.");
-	  new_token = create_token (usersid, groups, pw_new);
-	  if (new_token == INVALID_HANDLE_VALUE)
+      new_token = lsaprivkeyauth (pw_new);
+      if (new_token)
+        {
+	  /* We have to verify this token since settings in /etc/group
+	     might render it unusable im terms of group membership. */
+	  if (!verify_token (new_token, usersid, groups))
 	    {
-	      debug_printf ("create_token failed, bail out of here");
-	      cygheap->user.reimpersonate ();
-	      return -1;
+	      CloseHandle (new_token);
+	      new_token = NULL;
+	    }
+	}
+      if (!new_token)
+        {
+	  debug_printf ("lsaprivkeyauth failed, try lsaauth.");
+	  if (!(new_token = lsaauth (usersid, groups, pw_new)))
+	    {
+	      debug_printf ("lsaauth failed, try create_token.");
+	      new_token = create_token (usersid, groups, pw_new);
+	      if (new_token == INVALID_HANDLE_VALUE)
+		{
+		  debug_printf ("create_token failed, bail out of here");
+		  cygheap->user.reimpersonate ();
+		  return -1;
+		}
 	    }
 	}