(WIP) Migrate active_profile

client/server/server.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
-	"os/user"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"sync"
@@ -24,7 +24,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/netbirdio/netbird/client/internal/getent"
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/prometheus/client_golang/prometheus"
 
@@ -515,7 +514,12 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
+	callerID, err := callerIdentity(callerCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	stored, err := s.storedProfileConfig(msg.ProfileName, callerID)
 	if err != nil {
 		return nil, err
 	}
@@ -523,7 +527,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	config, err := s.setConfigInputFromRequest(msg)
+	config, err := s.setConfigInputFromRequest(msg, callerID)
 	if err != nil {
 		return nil, err
 	}
@@ -535,7 +539,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	}
 
 	if activeProf, err := s.profileManager.GetActiveProfileState(); err == nil {
-		if activePath, err := activeProf.FilePath(); err == nil && activePath == config.ConfigPath {
+		if activePath, err := s.profileManager.ActiveProfilePath(activeProf); err == nil && activePath == config.ConfigPath {
 			s.localMetrics.Reconcile(updatedConf.LocalMetricsEnabled, updatedConf.LocalMetricsAddress)
 		}
 	}
@@ -553,10 +557,10 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 // field is its own optional case. Returns the resolved ConfigInput
 // and a non-nil error only when the active profile file path cannot
 // be determined.
-func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profilemanager.ConfigInput, error) {
+func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest, callerID ipcauth.Identity) (profilemanager.ConfigInput, error) {
 	var config profilemanager.ConfigInput
 
-	resolved, err := s.resolveProfileHandle(msg.ProfileName, msg.Username)
+	resolved, err := s.resolveProfileHandle(msg.ProfileName, callerID)
 	if err != nil {
 		log.Errorf("failed to resolve profile %q: %v", msg.ProfileName, err)
 		return config, err
@@ -659,6 +663,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}
 
+	callerID, err := callerIdentity(callerCtx)
+	if err != nil {
+		return nil, err
+	}
+
 	activeProf, err := s.profileManager.GetActiveProfileState()
 	if err != nil {
 		log.Errorf("failed to get active profile state: %v", err)
@@ -670,7 +679,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// refused login neither switches the profile nor cancels a login already in
 	// progress, and it reads the profile the request targets, which is the one the
 	// switch below would activate.
-	stored, err := s.storedLoginConfig(activeProf, msg)
+	stored, err := s.storedLoginConfig(activeProf, msg, callerID)
 	if err != nil {
 		return nil, err
 	}
@@ -703,7 +712,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		return nil, err
 	}
 
-	log.Infof("active profile: %s for %s", activeProf.ID, activeProf.Username)
+	log.Infof("active profile: %s", activeProf.ID)
 
 	s.mutex.Lock()
 
@@ -1064,6 +1073,12 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 		return nil, fmt.Errorf("config is not defined, please call login command first")
 	}
 
+	callerID, err := callerIdentity(callerCtx)
+	if err != nil {
+		s.mutex.Unlock()
+		return nil, err
+	}
+
 	activeProf, err := s.profileManager.GetActiveProfileState()
 	if err != nil {
 		s.mutex.Unlock()
@@ -1072,7 +1087,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	}
 
 	if msg != nil && msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, callerID, activeProf); err != nil {
 			s.mutex.Unlock()
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
@@ -1086,7 +1101,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 		return nil, fmt.Errorf("failed to get active profile state: %w", err)
 	}
 
-	log.Infof("active profile: %s for %s", activeProf.ID, activeProf.Username)
+	log.Infof("active profile: %s", activeProf.ID)
 
 	config, _, err := s.getConfig(activeProf)
 	if err != nil {
@@ -1138,8 +1153,8 @@ func (s *Server) waitForUp(callerCtx context.Context) (*proto.UpResponse, error)
 // targets, so a privileged-change decision can be made against the values the
 // profile currently holds. A profile that has no config file yet yields nil,
 // which every caller must read as "nothing enabled yet".
-func (s *Server) storedProfileConfig(handle, username string) (*profilemanager.Config, error) {
-	resolved, err := s.resolveProfileHandle(handle, username)
+func (s *Server) storedProfileConfig(handle string, callerID ipcauth.Identity) (*profilemanager.Config, error) {
+	resolved, err := s.resolveProfileHandle(handle, callerID)
 	if err != nil {
 		return nil, err
 	}
@@ -1155,23 +1170,18 @@ func (s *Server) storedProfileConfig(handle, username string) (*profilemanager.C
 // storedLoginConfig loads the on-disk config of the profile a login request
 // targets: the one it names, or the active one when it names none. Used to decide
 // a privileged change before the request is allowed to switch profiles.
-func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) (*profilemanager.Config, error) {
+func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest, callerID ipcauth.Identity) (*profilemanager.Config, error) {
 	if msg.ProfileName == nil {
-		cfgPath, err := activeProf.FilePath()
+		cfgPath, err := s.profileManager.ActiveProfilePath(activeProf)
 		if err != nil {
 			return nil, fmt.Errorf("active profile file path: %w", err)
 		}
 		return s.storedConfigAtPath(cfgPath)
 	}
 
-	// Mirrors switchProfileIfNeeded: the default profile resolves without a
-	// username, so this reads the same profile the switch would activate.
-	handle := *msg.ProfileName
-	username := ""
-	if handle != profilemanager.DefaultProfileName {
-		username = msg.GetUsername()
-	}
-	return s.storedProfileConfig(handle, username)
+	// Mirrors switchProfileIfNeeded, so this reads the very profile the switch
+	// would activate.
+	return s.storedProfileConfig(*msg.ProfileName, callerID)
 }
 
 // storedConfigAtPath reads a profile config file, yielding nil when it does not
@@ -1191,11 +1201,26 @@ func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error)
 	return cfg, nil
 }
 
+// callerIdentity returns the kernel-authenticated identity of the RPC caller.
+//
+// Every profile-addressing RPC scopes itself with this rather than with the
+// username its request carries: that field is whatever the client chose to
+// send, so scoping by it lets any local caller address another user's profile.
+// The username fields on the wire are kept for compatibility and ignored.
+func callerIdentity(ctx context.Context) (ipcauth.Identity, error) {
+	id, ok := ipcauth.CallerIdentity(ctx)
+	if !ok {
+		return ipcauth.Identity{}, gstatus.Error(codes.Unauthenticated, "caller identity could not be verified on the daemon control channel")
+	}
+	return id, nil
+}
+
 // resolveProfileHandle resolves a wire-level profile handle (display
-// name, ID, or unique ID prefix) to a concrete profile. Returns gRPC
-// status errors so handlers can return them directly.
-func (s *Server) resolveProfileHandle(handle, username string) (*profilemanager.Profile, error) {
-	p, err := s.profileManager.ResolveProfile(handle, username)
+// name, ID, or unique ID prefix) to a concrete profile owned by, or open to,
+// the calling identity. Returns gRPC status errors so handlers can return them
+// directly.
+func (s *Server) resolveProfileHandle(handle string, callerID ipcauth.Identity) (*profilemanager.Profile, error) {
+	p, err := s.profileManager.ResolveProfile(handle, callerID)
 	if err == nil {
 		return p, nil
 	}
@@ -1212,36 +1237,28 @@ func (s *Server) resolveProfileHandle(handle, username string) (*profilemanager.
 // switchProfileIfNeeded resolves the user-supplied handle, updates the
 // active profile state if it differs from the current one, and returns
 // the resolved profile so callers can include its ID in RPC responses.
-func (s *Server) switchProfileIfNeeded(handle string, userName *string, activeProf *profilemanager.ActiveProfileState) (*profilemanager.Profile, error) {
-	if handle != profilemanager.DefaultProfileName && (userName == nil || *userName == "") {
-		log.Errorf("profile name is set to %s, but username is not provided", handle)
-		return nil, fmt.Errorf("profile name is set to %s, but username is not provided", handle)
-	}
-
-	var username string
-	if handle != profilemanager.DefaultProfileName {
-		username = *userName
-	}
-
-	resolved, err := s.resolveProfileHandle(handle, username)
+func (s *Server) switchProfileIfNeeded(handle string, callerID ipcauth.Identity, activeProf *profilemanager.ActiveProfileState) (*profilemanager.Profile, error) {
+	resolved, err := s.resolveProfileHandle(handle, callerID)
 	if err != nil {
 		return nil, err
 	}
 
-	if resolved.ID != activeProf.ID || username != activeProf.Username {
-		if s.checkProfilesDisabled() {
-			log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
-			return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
-		}
+	if s.isActiveProfile(activeProf, resolved) {
+		return resolved, nil
+	}
 
-		log.Infof("switching to profile %s (%s) for user %s", resolved.Name, resolved.ID, username)
-		if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
-			ID:       resolved.ID,
-			Username: username,
-		}); err != nil {
-			log.Errorf("failed to set active profile state: %v", err)
-			return nil, fmt.Errorf("failed to set active profile state: %w", err)
-		}
+	if s.checkProfilesDisabled() {
+		log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
+		return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
+	}
+
+	log.Infof("switching to profile %s (%s) for %s", resolved.Name, resolved.ID, callerID)
+	if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       resolved.ID,
+		Username: legacyDirHint(resolved),
+	}); err != nil {
+		log.Errorf("failed to set active profile state: %v", err)
+		return nil, fmt.Errorf("failed to set active profile state: %w", err)
 	}
 
 	return resolved, nil
@@ -1252,6 +1269,11 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
+	callerID, err := callerIdentity(callerCtx)
+	if err != nil {
+		return nil, err
+	}
+
 	activeProf, err := s.profileManager.GetActiveProfileState()
 	if err != nil {
 		log.Errorf("failed to get active profile state: %v", err)
@@ -1259,7 +1281,7 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	}
 
 	if msg != nil && msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, callerID, activeProf); err != nil {
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
 		}
@@ -1395,12 +1417,12 @@ func (s *Server) Logout(ctx context.Context, msg *proto.LogoutRequest) (*proto.L
 }
 
 func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutRequest) (*proto.LogoutResponse, error) {
-	if msg.Username == nil || *msg.Username == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided when profile name is specified")
+	callerID, err := callerIdentity(ctx)
+	if err != nil {
+		return nil, err
 	}
-	username := *msg.Username
 
-	resolved, err := s.resolveProfileHandle(*msg.ProfileName, username)
+	resolved, err := s.resolveProfileHandle(*msg.ProfileName, callerID)
 	if err != nil {
 		return nil, err
 	}
@@ -1410,11 +1432,11 @@ func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutReque
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed to get active profile state: %v", err)
 	}
 
-	if err := s.validateProfileLogout(resolved.ID, isActiveProfile(activeProf, resolved.ID, username)); err != nil {
+	if err := s.validateProfileLogout(resolved.ID, s.isActiveProfile(activeProf, resolved)); err != nil {
 		return nil, err
 	}
 
-	if err := s.logoutFromProfile(ctx, resolved, username); err != nil {
+	if err := s.logoutFromProfile(ctx, resolved); err != nil {
 		log.Errorf("failed to logout from profile %s: %v", resolved.ID, err)
 		// A refused deregistration is already a status error carrying the reason
 		// and the command to run; rewrapping it as Internal would flatten both
@@ -1425,7 +1447,7 @@ func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutReque
 		return nil, gstatus.Errorf(codes.Internal, "logout: %v", err)
 	}
 
-	s.cleanupAfterProfileLogout(resolved.ID, username)
+	s.cleanupAfterProfileLogout(resolved)
 
 	return &proto.LogoutResponse{}, nil
 }
@@ -1436,14 +1458,14 @@ func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutReque
 // check: Login switches profiles under guardedConfigMu, which this path does not
 // hold, so a login that landed meanwhile must not have its fresh connection
 // dropped by a logout that targeted the profile it replaced.
-func (s *Server) cleanupAfterProfileLogout(id profilemanager.ID, username string) {
+func (s *Server) cleanupAfterProfileLogout(profile *profilemanager.Profile) {
 	activeProf, err := s.profileManager.GetActiveProfileState()
 	if err != nil {
-		log.Errorf("failed to get active profile state after logout from profile %s: %v", id, err)
+		log.Errorf("failed to get active profile state after logout from profile %s: %v", profile.ID, err)
 		return
 	}
 
-	if !isActiveProfile(activeProf, id, username) {
+	if !s.isActiveProfile(activeProf, profile) {
 		return
 	}
 
@@ -1489,7 +1511,7 @@ func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutRe
 
 // getConfig reads config file and returns Config and whether the config file already existed. Errors out if it does not exist
 func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
-	cfgPath, err := activeProf.FilePath()
+	cfgPath, err := s.profileManager.ActiveProfilePath(activeProf)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get active profile file path: %w", err)
 	}
@@ -1533,27 +1555,51 @@ func (s *Server) validateProfileLogout(id profilemanager.ID, isActive bool) erro
 	return nil
 }
 
-// isActiveProfile reports whether id is the profile the daemon runs for
-// username. The username is part of the comparison because legacy profile IDs
-// are display names, which two users can both hold; the default profile is
-// shared by every user and carries no username.
-func isActiveProfile(activeProf *profilemanager.ActiveProfileState, id profilemanager.ID, username string) bool {
-	if activeProf == nil || activeProf.ID != id {
+// isActiveProfile reports whether profile is the one the daemon runs.
+//
+// The comparison ends on the config file rather than on the ID, because a
+// legacy profile ID is a display name that two users can each hold: the path is
+// what tells alice's `work` from bob's. It is not the caller's username, which
+// says nothing about which profile the daemon activated.
+func (s *Server) isActiveProfile(activeProf *profilemanager.ActiveProfileState, profile *profilemanager.Profile) bool {
+	if activeProf == nil || profile == nil || activeProf.ID != profile.ID {
 		return false
 	}
+	if profile.ID == profilemanager.DefaultProfileName {
+		return true
+	}
 
-	return id == profilemanager.DefaultProfileName || activeProf.Username == username
+	activePath, err := s.profileManager.ActiveProfilePath(activeProf)
+	if err != nil {
+		log.Warnf("cannot resolve the active profile's path, treating %s as not active: %v", profile.ID, err)
+		return false
+	}
+	return activePath == profile.Path
+}
+
+// legacyDirHint records which per-username directory a pre-migration profile's
+// file sits in, which is all the active-profile state still reads its username
+// for. A profile in the shared directory needs no hint: its ID is unique.
+func legacyDirHint(profile *profilemanager.Profile) string {
+	if profile.Path == "" || profile.ID == profilemanager.DefaultProfileName {
+		return ""
+	}
+	dir := filepath.Base(filepath.Dir(profile.Path))
+	if dir == profilemanager.DefaultProfilePathDir {
+		return ""
+	}
+	return dir
 }
 
 // logoutFromProfile deregisters profile, reusing the running config when
-// profile is the one the daemon is connected with. The username takes part in
-// that decision for the same reason it does in the logout gate: a legacy
-// profile ID is a display name two users can share, and sending the running
-// config for a namesake would deregister the active peer instead of the
+// profile is the one the daemon is connected with. That decision is made on the
+// profile's file rather than on its ID, for the same reason the logout gate is:
+// a legacy profile ID is a display name two users can share, and sending the
+// running config for a namesake would deregister the active peer instead of the
 // requested one.
-func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.Profile, username string) error {
+func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.Profile) error {
 	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err == nil && isActiveProfile(activeProf, profile.ID, username) && s.connectClient != nil {
+	if err == nil && s.isActiveProfile(activeProf, profile) && s.connectClient != nil {
 		return s.sendLogoutRequest(ctx)
 	}
 
@@ -2188,7 +2234,12 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		return nil, ctx.Err()
 	}
 
-	resolved, err := s.resolveProfileHandle(req.ProfileName, req.Username)
+	callerID, err := callerIdentity(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	resolved, err := s.resolveProfileHandle(req.ProfileName, callerID)
 	if err != nil {
 		log.Errorf("failed to resolve profile %q: %v", req.ProfileName, err)
 		return nil, err
@@ -2301,15 +2352,16 @@ func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (
 		return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
 	}
 
-	if msg.ProfileName == "" || msg.Username == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and username must be provided")
+	if msg.ProfileName == "" {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name must be provided")
 	}
 
-	callerId, ok := ipcauth.CallerIdentity(ctx)
-	if !ok {
-		return nil, fmt.Errorf("failed to get identity from context")
+	callerID, err := callerIdentity(ctx)
+	if err != nil {
+		return nil, err
 	}
-	created, err := s.profileManager.AddProfile(msg.ProfileName, msg.Username, &callerId)
+
+	created, err := s.profileManager.AddProfile(msg.ProfileName, &callerID)
 	if err != nil {
 		log.Errorf("failed to create profile: %v", err)
 		return nil, fmt.Errorf("failed to create profile: %w", err)
@@ -2328,21 +2380,21 @@ func (s *Server) RenameProfile(ctx context.Context, msg *proto.RenameProfileRequ
 		return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
 	}
 
-	if msg.Handle == "" || msg.Username == "" || msg.NewProfileName == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name, username and new profile name must be provided")
+	if msg.Handle == "" || msg.NewProfileName == "" {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and new profile name must be provided")
 	}
 
-	resolved, err := s.resolveProfileHandle(msg.Handle, msg.Username)
+	callerID, err := callerIdentity(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	userID, ok := ipcauth.CallerIdentity(ctx)
-	if !ok {
-		return nil, gstatus.Error(codes.Unauthenticated, "caller identity could not be resolved")
+	resolved, err := s.resolveProfileHandle(msg.Handle, callerID)
+	if err != nil {
+		return nil, err
 	}
 
-	err = s.profileManager.RenameProfile(resolved.ID, userID, msg.NewProfileName)
+	err = s.profileManager.RenameProfile(resolved.ID, callerID, msg.NewProfileName)
 	if err != nil {
 		log.Errorf("failed to rename profile: %v", err)
 		return nil, fmt.Errorf("failed to rename profile: %w", err)
@@ -2366,19 +2418,24 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name must be provided")
 	}
 
-	resolved, err := s.resolveProfileHandle(msg.ProfileName, msg.Username)
+	callerID, err := callerIdentity(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := s.logoutFromProfile(ctx, resolved, msg.Username); err != nil {
+	resolved, err := s.resolveProfileHandle(msg.ProfileName, callerID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := s.logoutFromProfile(ctx, resolved); err != nil {
 		// Deregistration is best-effort here: the local profile is removed
 		// either way, so an unprivileged caller leaves the peer registered on
 		// the management server rather than being blocked from removing it.
 		log.Warnf("removing profile %s locally without deregistering it: %v", resolved.ID, err)
 	}
 
-	if err := s.profileManager.RemoveProfile(resolved.ID, msg.Username); err != nil {
+	if err := s.profileManager.RemoveProfile(resolved.ID, callerID); err != nil {
 		log.Errorf("failed to remove profile: %v", err)
 		return nil, fmt.Errorf("failed to remove profile: %w", err)
 	}
@@ -2433,16 +2490,12 @@ func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesReques
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if msg.Username == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided")
+	callerID, err := callerIdentity(ctx)
+	if err != nil {
+		return nil, err
 	}
 
-	userID, ok := ipcauth.CallerIdentity(ctx)
-	if !ok {
-		return nil, gstatus.Error(codes.Unauthenticated, "caller identity could not be resolved")
-	}
-
-	profiles, err := s.profileManager.ListProfiles(userID)
+	profiles, err := s.profileManager.ListProfiles(callerID)
 	if err != nil {
 		log.Errorf("failed to list profiles: %v", err)
 		return nil, fmt.Errorf("failed to list profiles: %w", err)
@@ -2701,10 +2754,15 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		afterLoginPreCheck()
 	}
 
+	callerID, err := callerIdentity(callerCtx)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	s.guardedConfigMu.Lock()
 	defer s.guardedConfigMu.Unlock()
 
-	stored, err := s.storedLoginConfig(activeProf, msg)
+	stored, err := s.storedLoginConfig(activeProf, msg, callerID)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -2728,7 +2786,7 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 	}
 
 	if msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, callerID, activeProf); err != nil {
 			return nil, nil, fmt.Errorf("switch profile: %w", err)
 		}
 	}
@@ -2738,7 +2796,7 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		return nil, nil, fmt.Errorf("active profile state: %w", err)
 	}
 
-	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
+	if err := s.persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
 		return nil, nil, fmt.Errorf("persist login overrides: %w", err)
 	}
 
@@ -2769,37 +2827,24 @@ func (s *Server) SessionHolder() (ipcauth.Principal, bool) {
 	return principal, true
 }
 
-// OwnsProfile check if the Identity mathces the owner in the profile resolved
-// from the handle.
+// OwnsProfile reports whether the profile the handle resolves to answers to
+// this identity.
 //
-// Note: username is resolved locally and through LDAP/AD so lookup might fail
-// or be delayed.
+// The identity is handed to the loader directly. There is deliberately no
+// uid-to-username lookup on the way: the loader no longer keys profiles by
+// directory, and putting NSS on the authorization path would make every
+// decision wait on a resolver that can be slow, or absent, and would deny
+// every caller whenever it times out.
 func (s *Server) OwnsProfile(id ipcauth.Identity, handle string) bool {
-	var username *user.User
-	var lookupErr error
-	if id.IsWindows() {
-		username, lookupErr = getent.LookupUserID(id.SID)
-	} else {
-		username, lookupErr = getent.LookupUserID(strconv.FormatUint(uint64(id.UID), 10))
-	}
-	if lookupErr != nil {
-		log.Errorf("failed to lookup user by Identity %v: %v", id, lookupErr)
-		return false
-	}
-	resolved, err := s.resolveProfileHandle(handle, username.Name)
+	resolved, err := s.resolveProfileHandle(handle, id)
 	if err != nil {
 		log.Errorf("failed to resolve profile %q: %v", handle, err)
 		return false
 	}
-	if len(resolved.Owners) < 1 {
-		// TODO: define unowned behavior
-		return true
-	}
-	owner := resolved.Owners[0]
-	return owner.Matches(id)
+	return resolved.AccessibleBy(id)
 }
 
-func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
+func (s *Server) persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
 	if preSharedKey != nil && *preSharedKey == "" {
 		preSharedKey = nil
 	}
@@ -2807,7 +2852,7 @@ func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, manage
 		return nil
 	}
 
-	cfgPath, err := activeProf.FilePath()
+	cfgPath, err := s.profileManager.ActiveProfilePath(activeProf)
 	if err != nil {
 		return fmt.Errorf("active profile file path: %w", err)
 	}