From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Fri, 2 Dec 2005 10:34:34 +0000 (+0000)
Subject: Network Identity Manager updates for KFW 3.0 Beta 3
X-Git-Tag: ms-bug-test-20060525~45
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=469a923cec9900a48204578e4f4c0656d11fb89b;p=thirdparty%2Fkrb5.git

Network Identity Manager updates for KFW 3.0 Beta 3

Fix the handling of case sensitive names being stored in the
registry.  Only apply case sensitive encoding logic to the
keys below the NetIdMgr key.

Fix the importing of credentials from MSLSA:

Apply an ugly hack to krb5configcc.c that forces _WIN32_WINNT
to 0x0501 for the one file so that the executable can be built
as APPVER=5.0 and yet still gain access to balloon tips on XP
and above.

ticket: new
component: windows
status: open
target_version: 1.4.4

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17535 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/windows/identity/apiversion.txt b/src/windows/identity/apiversion.txt
index 44ce7603f7..c382eb52e7 100644
--- a/src/windows/identity/apiversion.txt
+++ b/src/windows/identity/apiversion.txt
@@ -44,11 +44,11 @@ Date=NOTRELEASED
 Version=2
 AppVersion=0.1.1.0
 Date=Nov 01, 2005
-# Alpha release of NetIDMgr
+# Beta 1 release of NetIDMgr
 
 #----------------------------------------------------------------
 Version=3
 AppVersion=0.1.2.0
-Date=NOTRELEASED
-# Beta release
+Date=Nov 30, 2005
+# Beta 2 release
 
diff --git a/src/windows/identity/config/Makefile b/src/windows/identity/config/Makefile
index e720bd804c..f10928fc59 100644
--- a/src/windows/identity/config/Makefile
+++ b/src/windows/identity/config/Makefile
@@ -94,7 +94,7 @@ mkversion: $(VERSIONINT) $(VERSIONEXT)
 NETIDMGR_VERSION_STR_1033=$(NETIDMGR_VERSION)
 NETIDMGR_COMMENT_STR_1033=Official build.  Please send bug reports to kfw-bugs@MIT.EDU
 !elseif "$(KH_RELEASE)" == "PRERELEASE"
-NETIDMGR_VERSION_STR_1033=$(NETIDMGR_VERSION) Alpha
+NETIDMGR_VERSION_STR_1033=$(NETIDMGR_VERSION) Prelease $(NETIDMGR_RELEASEDESC)
 NETIDMGR_COMMENT_STR_1033=Prerelease build.  Please send bug reports to kfw-bugs@MIT.EDU
 !elseif "$(KH_RELEASE)" == "PRIVATE"
 NETIDMGR_VERSION_STR_1033=$(NETIDMGR_VERSION).PRIVATE
diff --git a/src/windows/identity/config/Makefile.w32 b/src/windows/identity/config/Makefile.w32
index 84e8566512..49524dfd97 100644
--- a/src/windows/identity/config/Makefile.w32
+++ b/src/windows/identity/config/Makefile.w32
@@ -46,8 +46,9 @@ KHIMAIRA_WIN32_CONFIG=1
 # Version info
 NETIDMGR_VERSION_MAJOR=0
 NETIDMGR_VERSION_MINOR=1
-NETIDMGR_VERSION_PATCH=2
+NETIDMGR_VERSION_PATCH=3
 NETIDMGR_VERSION_AUX=0
+NETIDMGR_RELEASEDESC=Beta 3
 
 # The API version.  This number must be incremented each time the API
 # changes.  Plugins specify the version of the API that they were
@@ -197,6 +198,10 @@ khcwarn=/Wp64
 khcwarn=$(khcwarn) /WX
 !endif
 
+#DEBUG_SYMBOLS
+ldebug=$(ldebug) /DEBUG
+cdebug=$(cdebug) -Os -Zi
+
 khcflags=$(cdebug) $(cflags) $(incflags) $(khdefines) $(khcwarn)
 khlguiflags=$(ldebug) $(guilflags)
 khlconflags=$(ldebug) $(conlflags)
diff --git a/src/windows/identity/doc/main_page.h b/src/windows/identity/doc/main_page.h
index 2a74e8f4a1..238ce3e6c0 100644
--- a/src/windows/identity/doc/main_page.h
+++ b/src/windows/identity/doc/main_page.h
@@ -105,5 +105,6 @@
     - <b>0.1.1</b> First Alpha release <em>Nov 01, 2005</em>\n
       Released along with Kerberos for Windows 3.0.0 beta.
 
-    - <b>0.1.2</b> (tbd) <em>[tbd]</em>\n
+    - <b>0.1.2</b> Second Alpha release <em>Nov 30, 2005</em>\n
+      Released along with Kerberos for Windows 3.0.0 beta 2.
 */
diff --git a/src/windows/identity/help/khhelp.h b/src/windows/identity/help/khhelp.h
index 1324c3dc45..2e07838c62 100644
--- a/src/windows/identity/help/khhelp.h
+++ b/src/windows/identity/help/khhelp.h
@@ -1,5 +1,3 @@
-#define NIDM_HELPFILE              L"netidmgr.chm"
-
 #define IDH_WELCOME                1000
 #define IDH_WIN_MAIN               1001
 
diff --git a/src/windows/identity/kconfig/api.c b/src/windows/identity/kconfig/api.c
index 41b6ccb11c..e860e9e51e 100644
--- a/src/windows/identity/kconfig/api.c
+++ b/src/windows/identity/kconfig/api.c
@@ -202,9 +202,37 @@ khcint_RegOpenKeyEx(HKEY hkey, LPCWSTR sSubKey, DWORD ulOptions,
     LONG rv = ERROR_SUCCESS;
 
     hkp = hkey;
+    t = sSubKey;
+
+    /* check for case insensitive prefix first */
+    if (!wcsnicmp(sSubKey, CONFIG_REGPATHW, ARRAYLENGTH(CONFIG_REGPATHW) - 1)) {
+        HKEY hkt;
+
+        t = sSubKey + (ARRAYLENGTH(CONFIG_REGPATHW) - 1);
+
+#ifdef DEBUG
+        assert(*t == L'\0' || *t == L'\\');
+#endif
+
+        rv = RegOpenKeyEx(hkp,
+                          CONFIG_REGPATHW,
+                          ulOptions,
+                          samDesired,
+                          &hkt);
+
+        if (rv != ERROR_SUCCESS)
+            return rv;
+
+        if (*t == L'\0') {
+            *phkResult = hkt;
+            return rv;
+        }
+
+        t++;
+        hkp = hkt;
+    }
 
     /* descend down the components of the subkey */
-    t = sSubKey;
     while(TRUE) {
         wchar_t * slash;
         HKEY hkt;
@@ -260,11 +288,7 @@ khcint_RegOpenKeyEx(HKEY hkey, LPCWSTR sSubKey, DWORD ulOptions,
             goto _cleanup;
         }
 
-	/* FIX ME - This is not what we intended to do.  We want
-	 * a case sensitive match but we are running into a problem 
-	 * because of "HKLM\SOFTWARE" and "HKCU\Software"
-	 */
-        if (!(wcsnicmp(sk_name, t, cch))) {
+        if (!(wcsncmp(sk_name, t, cch))) {
             /* bingo! ?? */
             if (cch < KCONF_MAXCCH_NAME &&
                 (sk_name[cch] == L'\0' ||
@@ -285,9 +309,9 @@ khcint_RegOpenKeyEx(HKEY hkey, LPCWSTR sSubKey, DWORD ulOptions,
 
 LONG
 khcint_RegCreateKeyEx(HKEY hKey,
-                      LPCTSTR lpSubKey,
+                      LPCWSTR lpSubKey,
                       DWORD Reserved,
-                      LPTSTR lpClass,
+                      LPWSTR lpClass,
                       DWORD dwOptions,
                       REGSAM samDesired,
                       LPSECURITY_ATTRIBUTES lpSecurityAttributes,
@@ -305,6 +329,39 @@ khcint_RegCreateKeyEx(HKEY hKey,
 
     hkp = hKey;
     t = lpSubKey;
+
+    /* check for case insensitive prefix first */
+    if (!wcsnicmp(lpSubKey, CONFIG_REGPATHW, ARRAYLENGTH(CONFIG_REGPATHW) - 1)) {
+        HKEY hkt;
+
+        t = lpSubKey + (ARRAYLENGTH(CONFIG_REGPATHW) - 1);
+
+#ifdef DEBUG
+        assert(*t == L'\0' || *t == L'\\');
+#endif
+
+        rv = RegCreateKeyEx(hkp,
+                            CONFIG_REGPATHW,
+                            Reserved,
+                            lpClass,
+                            dwOptions,
+                            samDesired,
+                            lpSecurityAttributes,
+                            &hkt,
+                            lpdwDisposition);
+
+        if (rv != ERROR_SUCCESS)
+            return rv;
+
+        if (*t == L'\0') {
+            *phkResult = hkt;
+            return rv;
+        }
+
+        t++;
+        hkp = hkt;
+    }
+
     while(TRUE) {
         wchar_t * slash;
         HKEY hkt;
@@ -328,7 +385,6 @@ khcint_RegCreateKeyEx(HKEY hKey,
             if (hkp != hKey)
                 RegCloseKey(hkp);
             hkp = hkt;
-
         } else {
 
             rv = RegCreateKeyEx(hKey,
@@ -341,7 +397,6 @@ khcint_RegCreateKeyEx(HKEY hKey,
                                 phkResult,
                                 lpdwDisposition);
             goto _cleanup;
-
         }
     }
 
@@ -360,11 +415,7 @@ khcint_RegCreateKeyEx(HKEY hKey,
         if (l != ERROR_SUCCESS)
             break;
 
-	/* FIX ME - This is not what we intended to do.  We want
-	 * a case sensitive match but we are running into a problem 
-	 * because of "HKLM\SOFTWARE" and "HKCU\Software"
-	 */
-        if (!(wcsnicmp(sk_name, t, cch))) {
+        if (!(wcsncmp(sk_name, t, cch))) {
             /* bingo! ?? */
             if (sk_name[cch] == L'\0' ||
                 sk_name[cch] == L'~') {
@@ -602,11 +653,7 @@ khcint_open_space_int(kconf_conf_space * parent,
     EnterCriticalSection(&cs_conf_global);
     c = TFIRSTCHILD(p);
     while(c) {
-	/* FIX ME - This is not what we intended to do.  We want
-	 * a case sensitive match but we are running into a problem 
-	 * because of "HKLM\SOFTWARE" and "HKCU\Software"
-	 */
-        if(c->name && !wcsicmp(c->name, buf))
+        if(c->name && !wcscmp(c->name, buf))
             break;
 
         c = LNEXT(c);
@@ -624,19 +671,21 @@ khcint_open_space_int(kconf_conf_space * parent,
         /* we are not creating the space, so it must exist in the form of a
         registry key in HKLM or HKCU.  If it existed as a schema, we
         would have already retured it above. */
-        if(flags & KCONF_FLAG_USER)
+        
+        if (flags & KCONF_FLAG_USER)
             pkey = khcint_space_open_key(p, KHM_PERM_READ | KCONF_FLAG_USER);
 
-        if((!pkey || 
-            (khcint_RegOpenKeyEx(pkey, buf, 0, KEY_READ, &ckey) != 
-             ERROR_SUCCESS)) 
+        if((!pkey ||
+            (khcint_RegOpenKeyEx(pkey, buf, 0, KEY_READ, &ckey) !=
+             ERROR_SUCCESS))
            && (flags & KCONF_FLAG_MACHINE)) {
 
             pkey = khcint_space_open_key(p, KHM_PERM_READ | KCONF_FLAG_MACHINE);
-            if(!pkey || 
-               (khcint_RegOpenKeyEx(pkey, buf, 0, KEY_READ, &ckey) != 
+            if(!pkey ||
+               (khcint_RegOpenKeyEx(pkey, buf, 0, KEY_READ, &ckey) !=
                 ERROR_SUCCESS)) {
                 *result = NULL;
+
                 return KHM_ERROR_NOT_FOUND;
             }
         }
@@ -899,11 +948,7 @@ khc_read_string(khm_handle pconf,
 
         if(c->schema && khc_is_schema_handle(conf)) {
             for(i=0;i<c->nSchema;i++) {
-		/* FIX ME - This is not what we intended to do.  We want
-		* a case sensitive match but we are running into a problem 
-		* because of "HKLM\SOFTWARE" and "HKCU\Software"
-		*/
-                if(c->schema[i].type == KC_STRING && !wcsicmp(value, c->schema[i].name)) {
+                if(c->schema[i].type == KC_STRING && !wcscmp(value, c->schema[i].name)) {
                     /* found it */
                     size_t cbsize = 0;
 
@@ -1048,11 +1093,7 @@ khc_read_int32(khm_handle pconf, wchar_t * pvalue, khm_int32 * buf) {
 
         if(c->schema && khc_is_schema_handle(conf)) {
             for(i=0;i<c->nSchema;i++) {
-		/* FIX ME - This is not what we intended to do.  We want
-		* a case sensitive match but we are running into a problem 
-		* because of "HKLM\SOFTWARE" and "HKCU\Software"
-		*/
-                if(c->schema[i].type == KC_INT32 && !wcsicmp(value, c->schema[i].name)) {
+                if(c->schema[i].type == KC_INT32 && !wcscmp(value, c->schema[i].name)) {
                     *buf = (khm_int32) c->schema[i].value;
                     rv = KHM_ERROR_SUCCESS;
                     goto _exit;
@@ -1171,11 +1212,7 @@ khc_read_int64(khm_handle pconf, wchar_t * pvalue, khm_int64 * buf) {
 
         if(c->schema && khc_is_schema_handle(conf)) {
             for(i=0;i<c->nSchema;i++) {
-		/* FIX ME - This is not what we intended to do.  We want
-		* a case sensitive match but we are running into a problem 
-		* because of "HKLM\SOFTWARE" and "HKCU\Software"
-		*/
-                if(c->schema[i].type == KC_INT64 && !wcsicmp(value, c->schema[i].name)) {
+                if(c->schema[i].type == KC_INT64 && !wcscmp(value, c->schema[i].name)) {
                     *buf = (khm_int64) c->schema[i].value;
                     rv = KHM_ERROR_SUCCESS;
                     goto _exit;
@@ -1699,11 +1736,7 @@ khc_get_type(khm_handle conf, wchar_t * value) {
         int i;
 
         for(i=0; i<c->nSchema; i++) {
-	    /* FIX ME - This is not what we intended to do.  We want
-	    * a case sensitive match but we are running into a problem 
-	    * because of "HKLM\SOFTWARE" and "HKCU\Software"
-	    */
-            if(!wcsicmp(c->schema[i].name, value)) {
+            if(!wcscmp(c->schema[i].name, value)) {
                 return c->schema[i].type;
             }
         }
@@ -1760,11 +1793,7 @@ khc_value_exists(khm_handle conf, wchar_t * value) {
 
     if(c->schema) {
         for(i=0; i<c->nSchema; i++) {
-	    /* FIX ME - This is not what we intended to do.  We want
-	    * a case sensitive match but we are running into a problem 
-	    * because of "HKLM\SOFTWARE" and "HKCU\Software"
-	    */
-            if(!wcsicmp(c->schema[i].name, value)) {
+            if(!wcscmp(c->schema[i].name, value)) {
                 rv |= KCONF_FLAG_SCHEMA;
                 break;
             }
diff --git a/src/windows/identity/kcreddb/credential.c b/src/windows/identity/kcreddb/credential.c
index 335521e126..ccad383e6f 100644
--- a/src/windows/identity/kcreddb/credential.c
+++ b/src/windows/identity/kcreddb/credential.c
@@ -533,12 +533,12 @@ KHMEXP khm_int32 KHMAPI kcdb_cred_get_attr_string(
 
     if(KHM_FAILED(kcdb_attrib_get_info(attr_id, &attrib))) {
         code = KHM_ERROR_INVALID_PARAM;
-        goto _exit;
+        goto _exit_nolock;
     }
 
     if(KHM_FAILED(kcdb_type_get_info(attrib->type, &type))) {
         code = KHM_ERROR_UNKNOWN;
-        goto _exit;
+        goto _exit_nolock;
     }
 
     kcdb_cred_lock_read();
@@ -603,6 +603,7 @@ KHMEXP khm_int32 KHMAPI kcdb_cred_get_attr_string(
 
 _exit:
     kcdb_cred_unlock_read();
+_exit_nolock:
     if(type)
         kcdb_type_release_info(type);
     if(attrib)
diff --git a/src/windows/identity/kmm/kmm_registrar.c b/src/windows/identity/kmm/kmm_registrar.c
index ae94a9ed31..f9fdd4de81 100644
--- a/src/windows/identity/kmm/kmm_registrar.c
+++ b/src/windows/identity/kmm/kmm_registrar.c
@@ -544,7 +544,7 @@ void kmm_init_module(kmm_module_i * m) {
     /* If the module is not in the pre-init state, we can't
        initialize it. */
     if(m->state != KMM_MODULE_STATE_PREINIT) {
-        _report_mr1(KHERR_WARNING, MSG_IM_NOT_PREINIT, _int32(m->state));
+        _report_mr1(KHERR_INFO, MSG_IM_NOT_PREINIT, _int32(m->state));
         goto _exit;
     }
 
@@ -558,7 +558,7 @@ void kmm_init_module(kmm_module_i * m) {
     if(KHM_SUCCEEDED(khc_read_int32(csp_mod, L"Flags", &i)) &&
        (i & KMM_MODULE_FLAG_DISABLED)) {
 
-        _report_mr0(KHERR_ERROR, MSG_IM_DISABLED);
+        _report_mr0(KHERR_INFO, MSG_IM_DISABLED);
 
         m->state = KMM_MODULE_STATE_FAIL_DISABLED;
         goto _exit;
@@ -578,11 +578,9 @@ void kmm_init_module(kmm_module_i * m) {
 
         if(tm > 0 && 
            FtIntervalToSeconds((LPFILETIME) &ct) > fail_reset_time) {
-
             i = 0;
             khc_write_int32(csp_mod, L"FailureCount", 0);
             khc_write_int64(csp_mod, L"FailureTime", 0);
-
         }
 
         khc_read_int32(csp_mod, L"FailureReason", &last_reason);
@@ -593,7 +591,7 @@ void kmm_init_module(kmm_module_i * m) {
         if(i > max_fail_count && 
            last_reason != KMM_MODULE_STATE_FAIL_NOT_FOUND) {
             /* failed too many times */
-            _report_mr0(KHERR_ERROR, MSG_IM_MAX_FAIL);
+            _report_mr0(KHERR_INFO, MSG_IM_MAX_FAIL);
 
             m->state = KMM_MODULE_STATE_FAIL_MAX_FAILURE;
             goto _exit;
diff --git a/src/windows/identity/kmm/kmmconfig.csv b/src/windows/identity/kmm/kmmconfig.csv
index b22e9b2056..171d667ddd 100644
--- a/src/windows/identity/kmm/kmmconfig.csv
+++ b/src/windows/identity/kmm/kmmconfig.csv
@@ -3,7 +3,6 @@ PluginManager,KC_SPACE,0,Plugin Manager Configuration
   Plugins,KC_SPACE,0,Plugin Specific configuration
     PluginMaxFailureCount,KC_INT32,3,Maximum number of failure counts before plugin is disabled
     PluginFailureCountResetTime,KC_INT64,36000,Time after first failure at which the failure count is reset
-    LoadList,KC_STRING,AfsCred,List of plugins that are active
     _Schema,KC_SPACE,0,Plugin schema
       Module,KC_STRING,<module name>,The name of the module that registered this plugin
       Description,KC_STRING,<Description>,Description of the plugin
@@ -18,7 +17,6 @@ PluginManager,KC_SPACE,0,Plugin Manager Configuration
     _Schema,KC_ENDSPACE,0,
   Plugins,KC_ENDSPACE,0,
   Modules,KC_SPACE,0,Module Specific configuration
-    LoadList,KC_STRING,"OpenAFS,MITKrb5,MITKrb4",List of modules to load at startup
     ModuleMaxFailureCount,KC_INT32,3,Maximum number of failure counts before module is disabled
     ModuleFailureCountResetTime,KC_INT64,72000,Time after first failure at which the failure count is reset
     _Schema,KC_SPACE,0,Module schema
@@ -29,10 +27,10 @@ PluginManager,KC_SPACE,0,Plugin Manager Configuration
       FailureReason,KC_INT32,0,Reason for last failure.  One of the module status values.
       PluginList,KC_STRING,<plugins>,List of plugins implemented in the module
     _Schema,KC_ENDSPACE,0,
-    OpenAFS,KC_SPACE,0,OpenAFS Module
-      ImagePath,KC_STRING,afscred.dll,
-      PluginList,KC_STRING,AfsCred,
-    OpenAFS,KC_ENDSPACE,0,
+#    OpenAFS,KC_SPACE,0,OpenAFS Module
+#      ImagePath,KC_STRING,afscred.dll,
+#      PluginList,KC_STRING,AfsCred,
+#    OpenAFS,KC_ENDSPACE,0,
     MITKrb5,KC_SPACE,0,MIT Kerberos V
       ImagePath,KC_STRING,krb5cred.dll,
       PluginList,KC_STRING,Krb5Cred,
diff --git a/src/windows/identity/nidmgrdll/Makefile b/src/windows/identity/nidmgrdll/Makefile
index fc2887cc1b..03d3c3d541 100644
--- a/src/windows/identity/nidmgrdll/Makefile
+++ b/src/windows/identity/nidmgrdll/Makefile
@@ -86,7 +86,8 @@ OBJFILES= \
 	$(UIDIR)\actiondef.obj 		\
 	$(UIDIR)\acceldef.obj		\
 	$(UIDIR)\configui.obj		\
-	$(UIDIR)\trackerwnd.obj
+	$(UIDIR)\trackerwnd.obj		\
+	$(UIDIR)\version.obj
 
 RESFILES= \
 	$(OBJ)\nidmgrdll.res		\
diff --git a/src/windows/identity/plugins/common/dynimport.c b/src/windows/identity/plugins/common/dynimport.c
index ed5110e667..b906b6ae98 100644
--- a/src/windows/identity/plugins/common/dynimport.c
+++ b/src/windows/identity/plugins/common/dynimport.c
@@ -91,6 +91,7 @@ DECL_FUNC_PTR(krb5_get_init_creds_password);
 DECL_FUNC_PTR(krb5_get_prompt_types);
 DECL_FUNC_PTR(krb5_build_principal_ext);
 DECL_FUNC_PTR(krb5_cc_get_name);
+DECL_FUNC_PTR(krb5_cc_get_type);
 DECL_FUNC_PTR(krb5_cc_resolve);
 DECL_FUNC_PTR(krb5_cc_default);
 DECL_FUNC_PTR(krb5_cc_default_name);
@@ -190,36 +191,36 @@ FUNC_INFO ccapi_fi[] = {
 
 FUNC_INFO k4_fi[] = {
     MAKE_FUNC_INFO(get_krb_err_txt_entry),
-        MAKE_FUNC_INFO(k_isinst),
-        MAKE_FUNC_INFO(k_isname),
-        MAKE_FUNC_INFO(k_isrealm),
-        MAKE_FUNC_INFO(kadm_change_your_password),
-        MAKE_FUNC_INFO(kname_parse),
-        MAKE_FUNC_INFO(krb_get_cred),
-        MAKE_FUNC_INFO(krb_get_krbhst),
-        MAKE_FUNC_INFO(krb_get_lrealm),
-        MAKE_FUNC_INFO(krb_get_pw_in_tkt),
-        MAKE_FUNC_INFO(krb_get_tf_realm),
-        MAKE_FUNC_INFO(krb_mk_req),
-        MAKE_FUNC_INFO(krb_realmofhost),
-        MAKE_FUNC_INFO(tf_init),
-        MAKE_FUNC_INFO(tf_close),
-        MAKE_FUNC_INFO(tf_get_cred),
-        MAKE_FUNC_INFO(tf_get_pname),
-        MAKE_FUNC_INFO(tf_get_pinst),
-        MAKE_FUNC_INFO(LocalHostAddr),
-        MAKE_FUNC_INFO(tkt_string),
-        MAKE_FUNC_INFO(krb_set_tkt_string),
-        MAKE_FUNC_INFO(initialize_krb_error_func),
-        MAKE_FUNC_INFO(initialize_kadm_error_table),
-        MAKE_FUNC_INFO(dest_tkt),
-        /*        MAKE_FUNC_INFO(lsh_LoadKrb4LeashErrorTables), */// XXX
-        MAKE_FUNC_INFO(krb_in_tkt),
-        MAKE_FUNC_INFO(krb_save_credentials),
-        MAKE_FUNC_INFO(krb_get_krbconf2),
-        MAKE_FUNC_INFO(krb_get_krbrealm2),
-        MAKE_FUNC_INFO(krb_life_to_time),
-        END_FUNC_INFO
+    MAKE_FUNC_INFO(k_isinst),
+    MAKE_FUNC_INFO(k_isname),
+    MAKE_FUNC_INFO(k_isrealm),
+    MAKE_FUNC_INFO(kadm_change_your_password),
+    MAKE_FUNC_INFO(kname_parse),
+    MAKE_FUNC_INFO(krb_get_cred),
+    MAKE_FUNC_INFO(krb_get_krbhst),
+    MAKE_FUNC_INFO(krb_get_lrealm),
+    MAKE_FUNC_INFO(krb_get_pw_in_tkt),
+    MAKE_FUNC_INFO(krb_get_tf_realm),
+    MAKE_FUNC_INFO(krb_mk_req),
+    MAKE_FUNC_INFO(krb_realmofhost),
+    MAKE_FUNC_INFO(tf_init),
+    MAKE_FUNC_INFO(tf_close),
+    MAKE_FUNC_INFO(tf_get_cred),
+    MAKE_FUNC_INFO(tf_get_pname),
+    MAKE_FUNC_INFO(tf_get_pinst),
+    MAKE_FUNC_INFO(LocalHostAddr),
+    MAKE_FUNC_INFO(tkt_string),
+    MAKE_FUNC_INFO(krb_set_tkt_string),
+    MAKE_FUNC_INFO(initialize_krb_error_func),
+    MAKE_FUNC_INFO(initialize_kadm_error_table),
+    MAKE_FUNC_INFO(dest_tkt),
+    /*        MAKE_FUNC_INFO(lsh_LoadKrb4LeashErrorTables), */// XXX
+    MAKE_FUNC_INFO(krb_in_tkt),
+    MAKE_FUNC_INFO(krb_save_credentials),
+    MAKE_FUNC_INFO(krb_get_krbconf2),
+    MAKE_FUNC_INFO(krb_get_krbrealm2),
+    MAKE_FUNC_INFO(krb_life_to_time),
+    END_FUNC_INFO
 };
 
 FUNC_INFO k5_fi[] = {
@@ -234,6 +235,7 @@ FUNC_INFO k5_fi[] = {
     MAKE_FUNC_INFO(krb5_get_prompt_types),
     MAKE_FUNC_INFO(krb5_build_principal_ext),
     MAKE_FUNC_INFO(krb5_cc_get_name),
+    MAKE_FUNC_INFO(krb5_cc_get_type),
     MAKE_FUNC_INFO(krb5_cc_resolve),
     MAKE_FUNC_INFO(krb5_cc_default),
     MAKE_FUNC_INFO(krb5_cc_default_name),
@@ -290,8 +292,8 @@ FUNC_INFO k5_fi[] = {
 
 FUNC_INFO k524_fi[] = {
     MAKE_FUNC_INFO(krb524_init_ets),
-        MAKE_FUNC_INFO(krb524_convert_creds_kdc),
-        END_FUNC_INFO
+    MAKE_FUNC_INFO(krb524_convert_creds_kdc),
+    END_FUNC_INFO
 };
 
 FUNC_INFO profile_fi[] = {
@@ -312,8 +314,8 @@ FUNC_INFO profile_fi[] = {
 
 FUNC_INFO ce_fi[] = {
     MAKE_FUNC_INFO(com_err),
-        MAKE_FUNC_INFO(error_message),
-        END_FUNC_INFO
+    MAKE_FUNC_INFO(error_message),
+    END_FUNC_INFO
 };
 
 FUNC_INFO service_fi[] = {
@@ -327,11 +329,11 @@ FUNC_INFO service_fi[] = {
 
 FUNC_INFO lsa_fi[] = {
     MAKE_FUNC_INFO(LsaConnectUntrusted),
-        MAKE_FUNC_INFO(LsaLookupAuthenticationPackage),
-        MAKE_FUNC_INFO(LsaCallAuthenticationPackage),
-        MAKE_FUNC_INFO(LsaFreeReturnBuffer),
-        MAKE_FUNC_INFO(LsaGetLogonSessionData),
-        END_FUNC_INFO
+    MAKE_FUNC_INFO(LsaLookupAuthenticationPackage),
+    MAKE_FUNC_INFO(LsaCallAuthenticationPackage),
+    MAKE_FUNC_INFO(LsaFreeReturnBuffer),
+    MAKE_FUNC_INFO(LsaGetLogonSessionData),
+    END_FUNC_INFO
 };
 
 // psapi functions
diff --git a/src/windows/identity/plugins/common/dynimport.h b/src/windows/identity/plugins/common/dynimport.h
index 99aad9aedc..778bff324b 100644
--- a/src/windows/identity/plugins/common/dynimport.h
+++ b/src/windows/identity/plugins/common/dynimport.h
@@ -203,6 +203,7 @@ extern DECL_FUNC_PTR(krb5_get_init_creds_password);
 extern DECL_FUNC_PTR(krb5_get_prompt_types);
 extern DECL_FUNC_PTR(krb5_build_principal_ext);
 extern DECL_FUNC_PTR(krb5_cc_get_name);
+extern DECL_FUNC_PTR(krb5_cc_get_type);
 extern DECL_FUNC_PTR(krb5_cc_resolve);
 extern DECL_FUNC_PTR(krb5_cc_default);
 extern DECL_FUNC_PTR(krb5_cc_default_name);
diff --git a/src/windows/identity/plugins/common/krb5common.c b/src/windows/identity/plugins/common/krb5common.c
index 6019c928ef..cb9d86bc52 100644
--- a/src/windows/identity/plugins/common/krb5common.c
+++ b/src/windows/identity/plugins/common/krb5common.c
@@ -139,6 +139,9 @@ khm_krb5_initialize(khm_handle ident,
             } while(FALSE);
         }
 
+#ifndef FAILOVER_TO_DEFAULT_CCACHE
+	rc = 1;
+#endif
         if (*cache == 0
 #ifdef FAILOVER_TO_DEFAULT_CCACHE
             && (rc = (*pkrb5_cc_default)(*ctx, cache))
diff --git a/src/windows/identity/plugins/krb5/krb5configcc.c b/src/windows/identity/plugins/krb5/krb5configcc.c
index 256f6b75e9..66e7a08d00 100644
--- a/src/windows/identity/plugins/krb5/krb5configcc.c
+++ b/src/windows/identity/plugins/krb5/krb5configcc.c
@@ -24,6 +24,11 @@
 
 /* $Id$ */
 
+#if _WIN32_WINNT < 0x501
+#undef _WIN32_WINNT
+#define _WIN32_WINNT 0x501
+#endif
+
 #include<krbcred.h>
 #include<krb5.h>
 #include<assert.h>
@@ -381,42 +386,63 @@ k5_ccconfig_dlgproc(HWND hwnd,
                 /* not there.  we need to add.  but check a few things
                    first */
                 if (!PathFileExists(path)) {
-                    EDITBALLOONTIP bt;
                     wchar_t title[64];
                     wchar_t text[128];
 
-                    bt.cbStruct = sizeof(bt);
-                    bt.pszTitle = title;
                     LoadString(hResModule, IDS_CFG_FCN_WARNING,
                                title, ARRAYLENGTH(title));
-                    bt.pszText = text;
+
                     LoadString(hResModule, IDS_CFG_FCN_W_NOTFOUND,
                                text, ARRAYLENGTH(text));
-                    bt.ttiIcon = TTI_WARNING;
-
-                    SendDlgItemMessage(hwnd, IDC_CFG_FCNAME,
-                                       EM_SHOWBALLOONTIP,
-                                       0,
-                                       (LPARAM) &bt);
-
+#if _WIN32_WINNT >= 0x501
+                    if (IS_COMMCTL6())
+                    {
+                        EDITBALLOONTIP bt;
+
+                        bt.cbStruct = sizeof(bt);
+                        bt.pszTitle = title;
+                        bt.pszText = text;
+                        bt.ttiIcon = TTI_WARNING;
+
+                        SendDlgItemMessage(hwnd, IDC_CFG_FCNAME,
+                                           EM_SHOWBALLOONTIP,
+                                           0,
+                                           (LPARAM) &bt);
+                    } else {
+#endif
+                        MessageBox(hwnd, text, title, MB_OK | MB_ICONWARNING);
+#if _WIN32_WINNT >= 0x501
+                    }
+#endif
                 } else if (PathIsRelative(path)) {
-                    EDITBALLOONTIP bt;
                     wchar_t title[64];
                     wchar_t text[128];
 
-                    bt.cbStruct = sizeof(bt);
-                    bt.pszTitle = title;
                     LoadString(hResModule, IDS_CFG_FCN_WARNING,
                                title, ARRAYLENGTH(title));
-                    bt.pszText = text;
                     LoadString(hResModule, IDS_CFG_FCN_W_RELATIVE,
                                text, ARRAYLENGTH(text));
-                    bt.ttiIcon = TTI_WARNING;
 
-                    SendDlgItemMessage(hwnd, IDC_CFG_FCNAME,
-                                       EM_SHOWBALLOONTIP,
-                                       0,
-                                       (LPARAM) &bt);
+#if _WIN32_WINNT >= 0x501
+                    if (IS_COMMCTL6())
+                    {
+                        EDITBALLOONTIP bt;
+
+                        bt.cbStruct = sizeof(bt);
+                        bt.pszTitle = title;
+                        bt.pszText = text;
+                        bt.ttiIcon = TTI_WARNING;
+
+                        SendDlgItemMessage(hwnd, IDC_CFG_FCNAME,
+                                           EM_SHOWBALLOONTIP,
+                                           0,
+                                           (LPARAM) &bt);
+                    } else {
+#endif
+                        MessageBox(hwnd, text, title, MB_OK | MB_ICONWARNING);
+#if _WIN32_WINNT >= 0x501
+                    }
+#endif
                 }
 
                 k5_add_file_cc(&d->work, path);
diff --git a/src/windows/identity/plugins/krb5/krb5funcs.c b/src/windows/identity/plugins/krb5/krb5funcs.c
index d1a897d631..3dfea750ca 100644
--- a/src/windows/identity/plugins/krb5/krb5funcs.c
+++ b/src/windows/identity/plugins/krb5/krb5funcs.c
@@ -206,17 +206,17 @@ int com_addr(void)
 static long get_tickets_from_cache(krb5_context ctx, 
                                    krb5_ccache cache)
 {
-    krb5_error_code	code;
-    krb5_principal	KRBv5Principal;
-    krb5_flags		flags = 0;
-    krb5_cc_cursor	KRBv5Cursor;
-    krb5_creds		KRBv5Credentials;
+    krb5_error_code code;
+    krb5_principal  KRBv5Principal;
+    krb5_flags	    flags = 0;
+    krb5_cc_cursor  KRBv5Cursor;
+    krb5_creds	    KRBv5Credentials;
     krb5_ticket    *tkt=NULL;
-    char			*ClientName;
-    char			*PrincipalName;
-    wchar_t         wbuf[256];      /* temporary conversion buffer */
-    wchar_t         *wcc_name = NULL;      /* credential cache name */
-    char			*sServerName;
+    char	   *ClientName;
+    char	   *PrincipalName;
+    wchar_t         wbuf[256];  /* temporary conversion buffer */
+    wchar_t         wcc_name[KRB5_MAXCCH_CCNAME]; /* credential cache name */
+    char	   *sServerName;
     khm_handle      ident = NULL;
     khm_handle      cred = NULL;
     time_t          tt;
@@ -231,18 +231,28 @@ static long get_tickets_from_cache(krb5_context ctx,
 #endif
 
     {
-        char * cc_name;
-        size_t namelen;
+        const char * cc_name;
+        const char * cc_type;
 
         cc_name = (*pkrb5_cc_get_name)(ctx, cache);
         if(cc_name) {
-            namelen = strlen(cc_name);
-            namelen = (namelen + 1 + 5) * sizeof(wchar_t);
-            /* the +5 is for the possible addtion of API: or FILE:
-               during the cannonicalization process */
-            wcc_name = PMALLOC(namelen);
-            AnsiStrToUnicode(wcc_name, namelen, cc_name);
-            khm_krb5_canon_cc_name(wcc_name, namelen);
+            cc_type = (*pkrb5_cc_get_type)(ctx, cache);
+            if (cc_type) {
+                StringCbPrintf(wcc_name, sizeof(wcc_name), L"%S:%S", cc_type, cc_name);
+            } else {
+                AnsiStrToUnicode(wcc_name, sizeof(wcc_name), cc_name);
+                khm_krb5_canon_cc_name(wcc_name, sizeof(wcc_name));
+            }
+        } else {
+            cc_type = (*pkrb5_cc_get_type)(ctx, cache);
+            if (cc_type) {
+                StringCbPrintf(wcc_name, sizeof(wcc_name), L"%S:", cc_type);
+            } else {
+#ifdef DEBUG
+                assert(FALSE);
+#endif
+                StringCbCopy(wcc_name, sizeof(wcc_name), L"");
+            }
         }
     }
 
@@ -543,8 +553,6 @@ static long get_tickets_from_cache(krb5_context ctx,
     }
 
 _exit:
-    if(wcc_name)
-        PFREE(wcc_name);
 
     return code;
 }
@@ -1507,30 +1515,60 @@ khm_krb5_ms2mit(BOOL save_creds)
     char *princ_name = NULL;
     BOOL rc = FALSE;
 
+#ifdef DEBUG
+    kherr_debug_printf(L"Begin : khm_krb5_ms2mit. save_cred=%d\n", (int) save_creds);
+#endif
     if ( !pkrb5_init_context )
         goto cleanup;
 
     if (code = pkrb5_init_context(&kcontext))
         goto cleanup;
 
+#ifdef DEBUG
+    kherr_debug_printf(L"Resolving MSLSA\n");
+#endif
     if (code = pkrb5_cc_resolve(kcontext, "MSLSA:", &mslsa_ccache))
         goto cleanup;
 
     if ( save_creds ) {
-        if (code = pkrb5_cc_get_principal(kcontext, mslsa_ccache, &princ))
+#ifdef DEBUG
+        kherr_debug_printf(L"Getting principal\n");
+#endif
+	if (code = pkrb5_cc_get_principal(kcontext, mslsa_ccache, &princ))
             goto cleanup;
 
-        if (code = pkrb5_unparse_name(kcontext, princ, &princ_name))
+#ifdef DEBUG
+	kherr_debug_printf(L"Unparsing name\n");
+#endif
+	if (code = pkrb5_unparse_name(kcontext, princ, &princ_name))
             goto cleanup;
 
+#ifdef DEBUG
+        kherr_debug_printf(L"Unparsed [%S].  Resolving target cache\n", princ_name);
+#endif
         /* TODO: actually look up the preferred ccache name */
-        if ((code = pkrb5_cc_resolve(kcontext, princ_name, &ccache)) ||
-            (code = pkrb5_cc_default(kcontext, &ccache)))
-            goto cleanup;
+        if (code = pkrb5_cc_resolve(kcontext, princ_name, &ccache)) {
+#ifdef DEBUG
+            kherr_debug_printf(L"Cannot resolve cache [%S] with code=%d.  Trying default.\n", princ_name, code);
+#endif
+
+            if (code = pkrb5_cc_default(kcontext, &ccache)) {
+#ifdef DEBUG
+                kherr_debug_printf(L"Failed to resolve default ccache. Code=%d", code);
+#endif
+                goto cleanup;
+            }
+        }
 
+#ifdef DEBUG
+        kherr_debug_printf(L"Initializing ccache\n");
+#endif
         if (code = pkrb5_cc_initialize(kcontext, ccache, princ))
             goto cleanup;
 
+#ifdef DEBUG
+        kherr_debug_printf(L"Copying credentials\n");
+#endif
         if (code = pkrb5_cc_copy_creds(kcontext, mslsa_ccache, ccache))
             goto cleanup;
 
@@ -1540,8 +1578,8 @@ khm_krb5_ms2mit(BOOL save_creds)
         if ((code = pkrb5_cc_start_seq_get(kcontext, mslsa_ccache, &cursor))) 
             goto cleanup;
 
-        while (!(code = pkrb5_cc_next_cred(kcontext, mslsa_ccache, &cursor, &creds))) 
-        {
+        while (!(code = pkrb5_cc_next_cred(kcontext, mslsa_ccache, 
+                                           &cursor, &creds))) {
             if ( creds.ticket_flags & TKT_FLG_INITIAL ) {
                 rc = TRUE;
                 pkrb5_free_cred_contents(kcontext, &creds);
@@ -1553,6 +1591,10 @@ khm_krb5_ms2mit(BOOL save_creds)
     }
 
 cleanup:
+#ifdef DEBUG
+    kherr_debug_printf(L"  Received code=%d", code);
+#endif
+
     if (princ_name)
         pkrb5_free_unparsed_name(kcontext, princ_name);
     if (princ)
diff --git a/src/windows/identity/plugins/krb5/krb5identpro.c b/src/windows/identity/plugins/krb5/krb5identpro.c
index dd4782e6f3..858243daf7 100644
--- a/src/windows/identity/plugins/krb5/krb5identpro.c
+++ b/src/windows/identity/plugins/krb5/krb5identpro.c
@@ -438,7 +438,7 @@ ui_cb(khui_new_creds * nc,
                                        NULL,
                                        &cb_ms);
 
-            if (rv != KHM_ERROR_TOO_LONG)
+            if (rv != KHM_ERROR_TOO_LONG || cb_ms <= sizeof(wchar_t) * 2)
                 goto _add_lru_realms;
 
             ms = PMALLOC(cb_ms);
diff --git a/src/windows/identity/plugins/krb5/krb5main.c b/src/windows/identity/plugins/krb5/krb5main.c
index 7bf121dd0c..d324857feb 100644
--- a/src/windows/identity/plugins/krb5/krb5main.c
+++ b/src/windows/identity/plugins/krb5/krb5main.c
@@ -60,6 +60,8 @@ khm_handle csp_params       = NULL;
 
 BOOL is_k5_identpro = TRUE;
 
+khm_ui_4  k5_commctl_version;
+
 kmm_module_locale locales[] = {
     LOCALE_DEF(MAKELANGID(LANG_ENGLISH,SUBLANG_ENGLISH_US), L"krb5cred_en_us.dll", KMM_MLOC_FLAG_DEFAULT)
 };
@@ -86,6 +88,8 @@ KHMEXP khm_int32 KHMAPI init_module(kmm_module h_module) {
     } else
         goto _exit;
 
+    k5_commctl_version = khm_get_commctl_version(NULL);
+
     /* register the plugin */
     ZeroMemory(&pi, sizeof(pi));
     pi.name = KRB5_PLUGIN_NAME;
diff --git a/src/windows/identity/plugins/krb5/krb5newcreds.c b/src/windows/identity/plugins/krb5/krb5newcreds.c
index fc36d2c20e..a08fb91d94 100644
--- a/src/windows/identity/plugins/krb5/krb5newcreds.c
+++ b/src/windows/identity/plugins/krb5/krb5newcreds.c
@@ -1771,6 +1771,18 @@ k5_msg_cred_dialog(khm_int32 msg_type,
 
                     khm_krb5_list_tickets(&ctx);
 
+                    /* If there is no default identity, then make this the default */
+                    kcdb_identity_refresh(nc->identities[0]);
+                    {
+                        khm_handle tdefault = NULL;
+
+                        if (KHM_SUCCEEDED(kcdb_identity_get_default(&tdefault))) {
+                            kcdb_identity_release(tdefault);
+                        } else {
+                            kcdb_identity_set_default(nc->identities[0]);
+                        }
+                    }
+
                     /* also add the principal and the realm in to the
                        LRU lists */
                     rv = kcdb_identity_get_name(nc->identities[0],
@@ -1808,11 +1820,14 @@ k5_msg_cred_dialog(khm_int32 msg_type,
                         assert(KHM_SUCCEEDED(rv));
 
                         if (multi_string_find(wbuf,
-                                                  idname,
-                                                  KHM_CASE_SENSITIVE) 
-                            != NULL)
-                            /* it's already there */
-                            goto _add_realm_to_LRU;
+                                              idname,
+                                              KHM_CASE_SENSITIVE) 
+                            != NULL) {
+                            /* it's already there.  We remove it here
+                               and add it at the top of the LRU
+                               list. */
+                            multi_string_delete(wbuf, idname, KHM_CASE_SENSITIVE);
+                        }
                     } else {
                         multi_string_init(wbuf, cb_ms);
                     }
@@ -1825,13 +1840,14 @@ k5_msg_cred_dialog(khm_int32 msg_type,
                                                 L"LRUPrincipals",
                                                 wbuf);
 
-                _add_realm_to_LRU:
-
                     atsign = wcschr(idname, L'@');
-                    assert(atsign != NULL);
+                    if (atsign != NULL)
+                        goto _done_with_LRU;
 
                     atsign++;
-                    assert(*atsign != L'\0');
+
+                    if (*atsign == L'\0')
+                        goto _done_with_LRU;
 
                     cb = cb_ms;
                     rv = khc_read_multi_string(csp_params,
@@ -1854,25 +1870,28 @@ k5_msg_cred_dialog(khm_int32 msg_type,
                         assert(KHM_SUCCEEDED(rv));
                     } else if (rv == KHM_ERROR_SUCCESS) {
                         if (multi_string_find(wbuf,
-                                                  atsign,
-                                                  KHM_CASE_SENSITIVE)
-                            != NULL)
-                            goto _done_with_LRU;
+                                              atsign,
+                                              KHM_CASE_SENSITIVE)
+                            != NULL) {
+                            /* remove the realm and add it at the top
+                               later. */
+                            multi_string_delete(wbuf, atsign, KHM_CASE_SENSITIVE); 
+                        }
                     } else {
                         multi_string_init(wbuf, cb_ms);
                     }
 
                     cb = cb_ms;
                     rv = multi_string_prepend(wbuf,
-                                                  &cb,
-                                                  atsign);
+                                              &cb,
+                                              atsign);
 
                     if (rv == KHM_ERROR_TOO_LONG) {
-                        wbuf = realloc(wbuf, cb);
+                        wbuf = PREALLOC(wbuf, cb);
 
                         rv = multi_string_prepend(wbuf,
-                                                      &cb,
-                                                      atsign);
+                                                  &cb,
+                                                  atsign);
 
                         assert(KHM_SUCCEEDED(rv));
                     }
@@ -2201,7 +2220,15 @@ k5_msg_cred_dialog(khm_int32 msg_type,
 
     case KMSG_CRED_IMPORT:
         {
-            khm_krb5_ms2mit(TRUE);
+            khm_int32 t = 0;
+
+#ifdef DEBUG
+            assert(csp_params);
+#endif
+            khc_read_int32(csp_params, L"MsLsaImport", &t);
+
+            if (t == 1)
+                khm_krb5_ms2mit(TRUE);
         }
         break;
     }
diff --git a/src/windows/identity/plugins/krb5/krb5plugin.c b/src/windows/identity/plugins/krb5/krb5plugin.c
index ecfde2f5a7..e58e69f346 100644
--- a/src/windows/identity/plugins/krb5/krb5plugin.c
+++ b/src/windows/identity/plugins/krb5/krb5plugin.c
@@ -31,6 +31,10 @@
 #include<strsafe.h>
 #include<krb5.h>
 
+#ifdef DEBUG
+#include<assert.h>
+#endif
+
 khm_int32 credtype_id_krb5 = KCDB_CREDTYPE_INVALID;
 khm_boolean krb5_initialized = FALSE;
 khm_handle krb5_credset = NULL;
@@ -141,10 +145,20 @@ k5_msg_system(khm_int32 msg_type, khm_int32 msg_subtype,
             }
 
         if(k5_main_fiber != NULL) {
-#if (_WIN32_WINNT >= 0x0501)
-            ConvertFiberToThread();
+
+            if (k5_kinit_fiber) {
+#ifdef DEBUG
+                assert(k5_kinit_fiber != GetCurrentFiber());
+#endif
+#if CLEANUP_FIBERS_ON_EXIT
+                DeleteFiber(k5_kinit_fiber);
+                CloseHandle(k5_kinit_fiber);
 #endif
+                k5_kinit_fiber = NULL;
+            }
+
             k5_main_fiber = NULL;
+
         }
 
         if(k5_sub != NULL) {
diff --git a/src/windows/identity/plugins/krb5/krbcred.h b/src/windows/identity/plugins/krb5/krbcred.h
index 7efc360a04..7ab035c8c9 100644
--- a/src/windows/identity/plugins/krb5/krbcred.h
+++ b/src/windows/identity/plugins/krb5/krbcred.h
@@ -93,6 +93,10 @@ extern khm_int32 attr_id_addr_list;
 extern khm_int32 attr_id_krb5_flags;
 extern khm_int32 attr_id_krb5_ccname;
 
+extern khm_ui_4  k5_commctl_version;
+
+#define IS_COMMCTL6() (k5_commctl_version >= 0x60000)
+
 /* Configuration spaces */
 #define CSNAME_KRB5CRED      L"Krb5Cred"
 #define CSNAME_PARAMS        L"Parameters"
diff --git a/src/windows/identity/ui/Makefile b/src/windows/identity/ui/Makefile
index 4419444a30..7b3acc40f4 100644
--- a/src/windows/identity/ui/Makefile
+++ b/src/windows/identity/ui/Makefile
@@ -64,7 +64,8 @@ SDKLIBFILES= 			\
 	comctl32.lib 		\
 	shell32.lib		\
 	htmlhelp.lib		\
-	iphlpapi.lib
+	iphlpapi.lib		\
+	shlwapi.lib
 
 $(OBJ)\uiconfig.c: uiconfig.csv $(CONFDIR)\csvschema.cfg
 	$(CCSV) $** $@
diff --git a/src/windows/identity/ui/aboutwnd.c b/src/windows/identity/ui/aboutwnd.c
index 4f5d38ef48..da7abdfee3 100644
--- a/src/windows/identity/ui/aboutwnd.c
+++ b/src/windows/identity/ui/aboutwnd.c
@@ -108,12 +108,6 @@ about_dlg_proc(HWND hwnd,
                     mod.dwSize = sizeof(mod);
                 } while(Module32Next(hsnap, &mod));
 
-#if (_WIN32_WINNT >= 0x501)
-                /* we are also setting the report style when creating
-                   the control.  this is actually optional. */
-                ListView_SetView(hw, LV_VIEW_DETAILS);
-#endif
-
             _done_with_modules:
                 CloseHandle(hsnap);
             }
diff --git a/src/windows/identity/ui/appglobal.h b/src/windows/identity/ui/appglobal.h
index d7e5667afb..585ec090a7 100644
--- a/src/windows/identity/ui/appglobal.h
+++ b/src/windows/identity/ui/appglobal.h
@@ -27,11 +27,17 @@
 #ifndef __KHIMAIRA_APPGLOBAL_H
 #define __KHIMAIRA_APPGLOBAL_H
 
+/* Helpfile */
+#define NIDM_HELPFILE              L"netidmgr.chm"
+
 /* global data */
 extern HINSTANCE khm_hInstance;
 extern int khm_nCmdShow;
 extern const wchar_t * khm_facility;
 extern kconf_schema schema_uiconfig[];
+extern khm_ui_4 khm_commctl_version;
+
+#define IS_COMMCTL6() (khm_commctl_version >= 0x60000)
 
 typedef struct tag_khm_startup_options {
     BOOL seen;
@@ -67,6 +73,8 @@ void khm_exit_gui(void);
 void khm_parse_commandline();
 void khm_register_window_classes(void);
 
+HWND khm_html_help(HWND hwnd, UINT command, DWORD_PTR data);
+
 #define MAX_RES_STRING 1024
 
 #define ELIPSIS L"..."
diff --git a/src/windows/identity/ui/cfg_identities_wnd.c b/src/windows/identity/ui/cfg_identities_wnd.c
index 8b27c3334c..d38b338d23 100644
--- a/src/windows/identity/ui/cfg_identities_wnd.c
+++ b/src/windows/identity/ui/cfg_identities_wnd.c
@@ -946,9 +946,6 @@ khm_cfg_ids_tab_proc(HWND hwnd,
                 cfg_idents.idents[i].lv_idx = ListView_InsertItem(hw, &lvi);
             }
 
-#if (_WIN32_WINNT >= 0x501)
-            ListView_SetView(hw, LV_VIEW_DETAILS);
-#endif
         }
         return FALSE;
 
diff --git a/src/windows/identity/ui/cfg_plugins_wnd.c b/src/windows/identity/ui/cfg_plugins_wnd.c
index 8bf767e8c3..6dad3698ff 100644
--- a/src/windows/identity/ui/cfg_plugins_wnd.c
+++ b/src/windows/identity/ui/cfg_plugins_wnd.c
@@ -119,9 +119,6 @@ khm_cfg_plugins_proc(HWND hwnd,
             hw = GetDlgItem(hwnd, IDC_CFG_PLUGINS);
 #ifdef DEBUG
             assert(hw);
-#endif
-#if (_WIN32_WINNT >= 0x501)
-            ListView_SetView(hw, LV_VIEW_DETAILS);
 #endif
             ZeroMemory(&lvc, sizeof(lvc));
 
diff --git a/src/windows/identity/ui/main.c b/src/windows/identity/ui/main.c
index 4f1aa7d5de..93055d97f2 100644
--- a/src/windows/identity/ui/main.c
+++ b/src/windows/identity/ui/main.c
@@ -24,6 +24,7 @@
 
 /* $Id$ */
 
+#include<shlwapi.h>
 #include<khmapp.h>
 
 #if DEBUG
@@ -33,6 +34,7 @@
 HINSTANCE khm_hInstance;
 const wchar_t * khm_facility = L"NetIDMgr";
 int khm_nCmdShow;
+khm_ui_4 khm_commctl_version = 0;
 
 khm_startup_options khm_startup;
 
@@ -123,12 +125,16 @@ void khm_register_window_classes(void) {
         ICC_BAR_CLASSES |
         ICC_DATE_CLASSES |
         ICC_HOTKEY_CLASS |
+        ICC_LISTVIEW_CLASSES |
+        ICC_TAB_CLASSES |
 #if (_WIN32_WINNT >= 0x501)
-        ICC_LINK_CLASS |
-        ICC_STANDARD_CLASSES |
+        ((IS_COMMCTL6())?
+         ICC_LINK_CLASS |
+         ICC_STANDARD_CLASSES :
+         0) |
 #endif
-        ICC_LISTVIEW_CLASSES |
-        ICC_TAB_CLASSES;
+        0;
+
     InitCommonControlsEx(&ics);
 
     khm_register_main_wnd_class();
@@ -368,6 +374,27 @@ khm_module_load_ctx_handler(enum kherr_ctx_event evt,
                              c->serial);
 }
 
+static wchar_t helpfile[MAX_PATH] = L"";
+
+HWND khm_html_help(HWND hwnd, UINT command, DWORD_PTR data) {
+    if (!*helpfile) {
+        DWORD dw;
+        wchar_t ppath[MAX_PATH];
+
+        dw = GetModuleFileName(NULL, ppath, ARRAYLENGTH(ppath));
+
+        if (dw == 0) {
+            StringCbCopy(helpfile, sizeof(helpfile), NIDM_HELPFILE);
+        } else {
+            PathRemoveFileSpec(ppath);
+            PathAppend(ppath, NIDM_HELPFILE);
+            StringCbCopy(helpfile, sizeof(helpfile), ppath);
+        }
+    }
+
+    return HtmlHelp(hwnd, helpfile, command, data);
+}
+
 void khm_load_default_modules(void) {
     kherr_context * c;
 
@@ -418,6 +445,10 @@ int WINAPI WinMain(HINSTANCE hInstance,
            processes started by plugins. */
         SetEnvironmentVariable(L"KERBEROSLOGIN_NEVER_PROMPT", L"1");
 
+        khm_version_init();
+
+        khm_commctl_version = khm_get_commctl_version(NULL);
+
         /* we only open a main window if this is the only instance 
            of the application that is running. */
         kmq_init();
diff --git a/src/windows/identity/ui/mainwnd.c b/src/windows/identity/ui/mainwnd.c
index 5fbd1ec9b1..8f55005b32 100644
--- a/src/windows/identity/ui/mainwnd.c
+++ b/src/windows/identity/ui/mainwnd.c
@@ -176,24 +176,25 @@ LRESULT CALLBACK khm_main_wnd_proc(
             break;
 
         case KHUI_ACTION_HELP_CTX:
-            HtmlHelp(khm_hwnd_main, NIDM_HELPFILE,
-                     HH_HELP_CONTEXT, IDH_WELCOME);
+            khm_html_help(khm_hwnd_main, HH_HELP_CONTEXT, IDH_WELCOME);
             break;
 
         case KHUI_ACTION_HELP_CONTENTS:
-            HtmlHelp(khm_hwnd_main, NIDM_HELPFILE,
-                     HH_DISPLAY_TOC, 0);
+            khm_html_help(khm_hwnd_main, HH_DISPLAY_TOC, 0);
             break;
 
         case KHUI_ACTION_HELP_INDEX:
-            HtmlHelp(khm_hwnd_main, NIDM_HELPFILE,
-                     HH_DISPLAY_INDEX, (DWORD_PTR) L"");
+            khm_html_help(khm_hwnd_main, HH_DISPLAY_INDEX, (DWORD_PTR) L"");
             break;
 
         case KHUI_ACTION_HELP_ABOUT:
             khm_create_about_window();
             break;
 
+        case KHUI_ACTION_IMPORT:
+            khm_cred_import();
+            break;
+
         case KHUI_ACTION_PROPERTIES:
             /* properties are not handled by the main window.
                Just bounce it to credwnd.  However, use SendMessage
diff --git a/src/windows/identity/ui/notifier.c b/src/windows/identity/ui/notifier.c
index c795245b12..5d62be5fc4 100644
--- a/src/windows/identity/ui/notifier.c
+++ b/src/windows/identity/ui/notifier.c
@@ -988,10 +988,11 @@ ATOM khm_register_alerter_wnd_class(void)
 
     wcx.cbSize = sizeof(wcx);
     wcx.style =
+        CS_OWNDC |
 #if(_WIN32_WINNT >= 0x0501)
-        CS_DROPSHADOW |
+        ((IS_COMMCTL6())? CS_DROPSHADOW: 0) |
 #endif
-        CS_OWNDC;
+        0;
     wcx.lpfnWndProc = alerter_wnd_proc;
     wcx.cbClsExtra = 0;
     wcx.cbWndExtra = DLGWINDOWEXTRA + sizeof(LONG_PTR);
diff --git a/src/windows/identity/ui/reqdaemon.c b/src/windows/identity/ui/reqdaemon.c
index 620bdc54e6..9c48eed431 100644
--- a/src/windows/identity/ui/reqdaemon.c
+++ b/src/windows/identity/ui/reqdaemon.c
@@ -293,8 +293,9 @@ DWORD WINAPI
 khm_reqdaemon_thread_proc(LPVOID vparam) {
     BOOL rv;
     MSG msg;
+#ifdef DEBUG
     DWORD dw;
-
+#endif
     khm_register_reqdaemonwnd_class();
 
 #ifdef DEBUG
diff --git a/src/windows/identity/uilib/Makefile b/src/windows/identity/uilib/Makefile
index 4e65600936..1920d6aa39 100644
--- a/src/windows/identity/uilib/Makefile
+++ b/src/windows/identity/uilib/Makefile
@@ -36,7 +36,8 @@ UIDLLOBJFILES=			\
 	$(OBJ)\actiondef.obj 	\
 	$(OBJ)\acceldef.obj	\
 	$(OBJ)\configui.obj	\
-	$(OBJ)\trackerwnd.obj
+	$(OBJ)\trackerwnd.obj	\
+	$(OBJ)\version.obj
 
 INCFILES=			\
 	$(INCDIR)\khuidefs.h	\
diff --git a/src/windows/identity/uilib/khuidefs.h b/src/windows/identity/uilib/khuidefs.h
index 50214c3732..67d8db33dd 100644
--- a/src/windows/identity/uilib/khuidefs.h
+++ b/src/windows/identity/uilib/khuidefs.h
@@ -48,11 +48,47 @@
 
 #include<strsafe.h>
 
+/*! \internal */
+KHMEXP void KHMAPI
+khm_version_init(void);
+
 /*! \defgroup khui User Interface
 
     Functions and data structures for interacting with the user
     interface.
 
-*/
+@{*/
+
+/*! \brief Get the version of the NetIDMgr library
+
+    \param[out] libver Receives the version of the library.
+
+    \param[out] apiver Receives the API version of the library.
+        Optional.  Set to NULL if this value is not required.
+
+    \note When the NetIDMgr framework loads a plugin, it checks the
+        version information of the plugin against the version of the
+        library to determine if the plugin is compatible.
+ */
+KHMEXP void KHMAPI
+khm_get_lib_version(khm_version * libver, khm_ui_4 * apiver);
+
+/*! \brief Return the version of Common Control library
+
+    Can be used to check the version of the Windows Common Control
+    library that is currently loaded.  The return value of the
+    function is the packed version value obatained by the macro :
+
+    \code
+    MAKELONG(vesion->dwMinorVersion, version->dwMajorVersion);
+    \endcode
+
+    The \a pdvi parameter is optional.  Specify NULL if this is not
+    required.
+ */
+KHMEXP khm_ui_4 KHMAPI
+khm_get_commctl_version(khm_version * pdvi);
+
+/*!@}*/
 
 #endif
diff --git a/src/windows/identity/uilib/version.c b/src/windows/identity/uilib/version.c
new file mode 100644
index 0000000000..cf7f702bf1
--- /dev/null
+++ b/src/windows/identity/uilib/version.c
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2005 Massachusetts Institute of Technology
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/* $Id$ */
+
+#include<shlwapi.h>
+#include<khuidefs.h>
+#include<netidmgr_intver.h>
+
+DLLVERSIONINFO ver_commctl;
+
+static void
+get_dll_version(wchar_t * dllname, DLLVERSIONINFO * pdvi) {
+    HINSTANCE hdll;
+
+    hdll = LoadLibrary(dllname);
+
+    ZeroMemory(pdvi, sizeof(*pdvi));
+
+    if(hdll) {
+        DLLGETVERSIONPROC pDllGetVersion;
+
+        pDllGetVersion = (DLLGETVERSIONPROC) GetProcAddress(hdll, "DllGetVersion");
+        if(pDllGetVersion) {
+            pdvi->cbSize = sizeof(*pdvi);
+
+            (*pDllGetVersion)(pdvi);
+        }
+        FreeLibrary(hdll);
+    }
+}
+
+KHMEXP void KHMAPI
+khm_version_init(void) {
+    get_dll_version(L"comctl32.dll", &ver_commctl);
+}
+
+KHMEXP void KHMAPI
+khm_get_lib_version(khm_version * libver, khm_ui_4 * apiver) {
+    if (!libver)
+        return;
+
+    libver->major = KH_VERSION_MAJOR;
+    libver->minor = KH_VERSION_MINOR;
+    libver->patch = KH_VERSION_PATCH;
+    libver->aux = KH_VERSION_AUX;
+
+    if (apiver)
+        *apiver = KH_VERSION_API;
+}
+
+KHMEXP khm_ui_4 KHMAPI
+khm_get_commctl_version(khm_version * pdvi) {
+    if (pdvi) {
+        pdvi->major = (khm_ui_2) ver_commctl.dwMajorVersion;
+        pdvi->minor = (khm_ui_2) ver_commctl.dwMinorVersion;
+        pdvi->patch = (khm_ui_2) ver_commctl.dwBuildNumber;
+        pdvi->aux =   (khm_ui_2) ver_commctl.dwPlatformID;
+    }
+
+    return MAKELONG(ver_commctl.dwMinorVersion, ver_commctl.dwMajorVersion);
+}