static int samldb_check_sensitive_attributes(struct samldb_ctx *ac)
{
	struct ldb_message_element *el = NULL;
	struct security_token *user_token = NULL;
	int ret;

	if (dsdb_module_am_system(ac->module)) {
		return LDB_SUCCESS;
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	el = ldb_msg_find_element(ac->msg, "sidHistory");
	if (el) {
               /*
                * sidHistory is restricted to the (not implemented
                * yet in Samba) DsAddSidHistory call (direct LDB access is
                * as SYSTEM so will bypass this).
		*
		* If you want to modify this, say to merge domains,
		* directly modify the sam.ldb as root.
                */
		ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
				       "sidHistory "
				       "(entry %s) cannot be created "
				       "or changed over LDAP!",
				       ldb_dn_get_linearized(ac->msg->dn));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	el = ldb_msg_find_element(ac->msg, "msDS-SecondaryKrbTgtNumber");
	if (el) {
		struct security_descriptor *domain_sd;
		const struct dsdb_class *objectclass = NULL;
		/*
		 * msDS-SecondaryKrbTgtNumber allows the creator to
		 * become an RODC, this is trusted as an RODC
		 * account
		 */
		ret = samldb_get_domain_secdesc_and_oc(ac, &domain_sd, &objectclass);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
		ret = acl_check_extended_right(ac,
					       ac->module,
					       ac->req,
					       objectclass,
					       domain_sd,
					       user_token,
					       GUID_DRS_DS_INSTALL_REPLICA,
					       SEC_ADS_CONTROL_ACCESS,
					       NULL);
		if (ret != LDB_SUCCESS) {
			ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
					       "msDS-SecondaryKrbTgtNumber "
					       "(entry %s) cannot be created "
					       "or changed without "
					       "DS-Install-Replica extended right!",
					       ldb_dn_get_linearized(ac->msg->dn));
			return ret;
		}
	}

	el = ldb_msg_find_element(ac->msg, "msDS-AllowedToDelegateTo");
	if (el) {
		/*
		 * msDS-AllowedToDelegateTo is incredibly powerful,
		 * given that it allows a server to become ANY USER on
		 * the target server only listed by SPN so needs to be
		 * protected just as the userAccountControl
		 * UF_TRUSTED_FOR_DELEGATION is.
		 */

		bool have_priv = security_token_has_privilege(user_token,
							      SEC_PRIV_ENABLE_DELEGATION);
		if (have_priv == false) {
			ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
					       "msDS-AllowedToDelegateTo "
					       "(entry %s) cannot be created "
					       "or changed without SePrivEnableDelegation!",
					       ldb_dn_get_linearized(ac->msg->dn));
			return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
		}
	}
	return LDB_SUCCESS;
}
static int samldb_check_sensitive_attributes(struct samldb_ctx *ac)
{
	struct ldb_message_element *el = NULL;
	struct security_token *user_token = NULL;
	int ret;

	if (dsdb_module_am_system(ac->module)) {
		return LDB_SUCCESS;
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	el = ldb_msg_find_element(ac->msg, "sidHistory");
	if (el) {
                
		ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
				       "sidHistory "
				       "(entry %s) cannot be created "
				       "or changed over LDAP!",
				       ldb_dn_get_linearized(ac->msg->dn));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	el = ldb_msg_find_element(ac->msg, "msDS-SecondaryKrbTgtNumber");
	if (el) {
		struct security_descriptor *domain_sd;
		const struct dsdb_class *objectclass = NULL;
		 
		ret = samldb_get_domain_secdesc_and_oc(ac, &domain_sd, &objectclass);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
		ret = acl_check_extended_right(ac,
					       ac->module,
					       ac->req,
					       objectclass,
					       domain_sd,
					       user_token,
					       GUID_DRS_DS_INSTALL_REPLICA,
					       SEC_ADS_CONTROL_ACCESS,
					       NULL);
		if (ret != LDB_SUCCESS) {
			ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
					       "msDS-SecondaryKrbTgtNumber "
					       "(entry %s) cannot be created "
					       "or changed without "
					       "DS-Install-Replica extended right!",
					       ldb_dn_get_linearized(ac->msg->dn));
			return ret;
		}
	}

	el = ldb_msg_find_element(ac->msg, "msDS-AllowedToDelegateTo");
	if (el) {
		 

		bool have_priv = security_token_has_privilege(user_token,
							      SEC_PRIV_ENABLE_DELEGATION);
		if (have_priv == false) {
			ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
					       "msDS-AllowedToDelegateTo "
					       "(entry %s) cannot be created "
					       "or changed without SePrivEnableDelegation!",
					       ldb_dn_get_linearized(ac->msg->dn));
			return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
		}
	}
	return LDB_SUCCESS;
}