diff -r 4784c14aa639 -r b5d15a4a19f5 src/server/daemon/keyfile_auth.c
--- a/src/server/daemon/keyfile_auth.c	Sun Aug 23 23:04:17 2020 +0200
+++ b/src/server/daemon/keyfile_auth.c	Mon Aug 24 12:50:16 2020 +0200
@@ -43,40 +43,18 @@
 
 #include "keyfile_auth.h"
 
-Keyfile* keyfile_new() {
-    Keyfile *keyfile = malloc(sizeof(Keyfile));
+Keyfile* keyfile_new(UcxAllocator *a) {
+    Keyfile *keyfile = alcalloc(a, 1, sizeof(Keyfile));
+    if(!keyfile) {
+        return NULL;
+    }
     keyfile->authdb.get_user = keyfile_get_user;
     keyfile->authdb.use_cache = 0;
-    keyfile->users = ucx_map_new(16);
-    keyfile->ref = 1;
+    keyfile->users = ucx_map_new_a(a, 16);
     return keyfile;
 }
 
-void keyfile_ref(Keyfile *keyfile) {
-    ws_atomic_inc32(&keyfile->ref);
-}
-
-void keyfile_unref(Keyfile *keyfile) {
-    uint32_t ref = ws_atomic_dec32(&keyfile->ref);
-    if(ref == 0) { 
-        UcxMapIterator i = ucx_map_iterator(keyfile->users);
-        KeyfileUser *user;
-        UCX_MAP_FOREACH(key, user, i) {
-            free(user->user.name);
-            free(user->hash);
-            for(int n=0;n<user->numgroups;n++) {
-                free(user->groups[n].ptr);
-            }
-            free(user->groups);
-        }
-        ucx_map_free(keyfile->users);
-        
-        free(keyfile->authdb.name);
-        free(keyfile);
-    }
-}
-
-void keyfile_add_user(
+int keyfile_add_user(
         Keyfile *keyfile,
         sstr_t name,
         enum KeyfileHashType hash_type,
@@ -84,14 +62,16 @@
         sstr_t *groups,
         size_t ngroups)
 {
+    UcxAllocator *a = keyfile->users->allocator;
+    
     if(hash.length < 12) {
         // hash too short
         // TODO: log
-        return;
+        return -1;
     }
     
-    KeyfileUser *user = malloc(sizeof(KeyfileUser));
-    user->user.name = sstrdup(name).ptr;
+    KeyfileUser *user = almalloc(a, sizeof(KeyfileUser));
+    user->user.name = sstrdup_a(a, name).ptr;
     user->user.uid = -1;
     user->user.gid = -1;
     user->user.verify_password = keyfile_user_verify_password;
@@ -99,16 +79,29 @@
     user->user.free = keyfile_user_free;
     
     user->hash_type = hash_type;
-    user->hash = malloc(hash.length + 1);
+    user->hash = almalloc(a, hash.length + 1);
+    
+    if(!user->user.name || !user->hash) {
+        return -1;
+    }
+    
     user->hashlen = util_base64decode(hash.ptr, hash.length, user->hash);
     
-    user->groups = calloc(ngroups, sizeof(sstr_t));
-    for(int i=0;i<ngroups;i++) {
-        user->groups[i] = sstrdup(groups[i]);
+    if(ngroups > 0) {
+        user->groups = alcalloc(a, ngroups, sizeof(sstr_t));
+        if(!user->groups) {
+            return -1;
+        }
+        for(int i=0;i<ngroups;i++) {
+            user->groups[i] = sstrdup(groups[i]);
+        }
+        
+    } else {
+        user->groups = NULL;
     }
     
     // add to keyfile
-    ucx_map_sstr_put(keyfile->users, name, user);
+    return ucx_map_sstr_put(keyfile->users, name, user);
 }
 
 // authdb functions