static int samldb_check_pwd_last_set_acl(struct samldb_ctx *ac,
					 struct dom_sid *sid)
{
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	int ret = 0;
	struct security_token *user_token = NULL;
	struct security_descriptor *domain_sd = NULL;
	struct ldb_dn *domain_dn = ldb_get_default_basedn(ldb_module_get_ctx(ac->module));
	const char *operation = "";
	const struct dsdb_class *objectclass = NULL;

	if (dsdb_module_am_system(ac->module)) {
		return LDB_SUCCESS;
	}

	switch (ac->req->operation) {
	case LDB_ADD:
		operation = "add";
		break;
	case LDB_MODIFY:
		operation = "modify";
		break;
	default:
		return ldb_module_operr(ac->module);
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	ret = samldb_get_domain_secdesc_and_oc(ac, &domain_sd, &objectclass);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	ret = acl_check_extended_right(ac,
				       ac->module,
				       ac->req,
				       objectclass,
				       domain_sd,
				       user_token,
				       GUID_DRS_UNEXPIRE_PASSWORD,
				       SEC_ADS_CONTROL_ACCESS,
				       sid);
	if (ret != LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
		return ret;
	}

	ldb_debug_set(ldb, LDB_DEBUG_WARNING,
		      "Failed to %s %s: "
		      "Setting pwdLastSet to -1 requires the "
		      "Unexpire-Password right that was not given "
		      "on the Domain object",
		      operation,
		      ldb_dn_get_linearized(ac->msg->dn));
	dsdb_acl_debug(domain_sd, user_token,
		       domain_dn, true, 10);

	return ret;
}
static int samldb_check_pwd_last_set_acl(struct samldb_ctx *ac,
					 struct dom_sid *sid)
{
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	int ret = 0;
	struct security_token *user_token = NULL;
	struct security_descriptor *domain_sd = NULL;
	struct ldb_dn *domain_dn = ldb_get_default_basedn(ldb_module_get_ctx(ac->module));
	const char *operation = "";
	const struct dsdb_class *objectclass = NULL;

	if (dsdb_module_am_system(ac->module)) {
		return LDB_SUCCESS;
	}

	switch (ac->req->operation) {
	case LDB_ADD:
		operation = "add";
		break;
	case LDB_MODIFY:
		operation = "modify";
		break;
	default:
		return ldb_module_operr(ac->module);
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	ret = samldb_get_domain_secdesc_and_oc(ac, &domain_sd, &objectclass);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	ret = acl_check_extended_right(ac,
				       ac->module,
				       ac->req,
				       objectclass,
				       domain_sd,
				       user_token,
				       GUID_DRS_UNEXPIRE_PASSWORD,
				       SEC_ADS_CONTROL_ACCESS,
				       sid);
	if (ret != LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
		return ret;
	}

	ldb_debug_set(ldb, LDB_DEBUG_WARNING,
		      "Failed to %s %s: "
		      "Setting pwdLastSet to -1 requires the "
		      "Unexpire-Password right that was not given "
		      "on the Domain object",
		      operation,
		      ldb_dn_get_linearized(ac->msg->dn));
	dsdb_acl_debug(domain_sd, user_token,
		       domain_dn, true, 10);

	return ret;
}