static int samldb_sam_accountname_valid_check(struct samldb_ctx *ac)
{
	int ret = 0;
	bool is_admin;
	struct security_token *user_token = NULL;
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	struct ldb_message_element *el = NULL;

	ret = dsdb_get_expected_new_values(ac,
					   ac->msg,
					   "samAccountName",
					   &el,
					   ac->req->operation);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (el == NULL || el->num_values == 0) {
		ldb_asprintf_errstring(ldb,
			"%08X: samldb: 'samAccountName' can't be deleted/empty!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		if (ac->req->operation == LDB_ADD) {
			return LDB_ERR_CONSTRAINT_VIOLATION;
		} else {
			return LDB_ERR_UNWILLING_TO_PERFORM;
		}
	}

	ret = samldb_unique_attr_check(ac, "samAccountName", NULL,
				       ldb_get_default_basedn(
					       ldb_module_get_ctx(ac->module)));

	/*
	 * Error code munging to try and match what must be some quite
	 * strange code-paths in Windows
	 */
	if (ret == LDB_ERR_CONSTRAINT_VIOLATION
	    && ac->req->operation == LDB_MODIFY) {
		ret = LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
	} else if (ret == LDB_ERR_OBJECT_CLASS_VIOLATION) {
		ret = LDB_ERR_CONSTRAINT_VIOLATION;
	}
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	ret = samldb_sam_account_upn_clash(ac);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (!ac->need_trailing_dollar) {
		return LDB_SUCCESS;
	}

	/* This does not permit a single $ */
	if (el->values[0].length < 2) {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "can't just be one character!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	is_admin
		= security_token_has_builtin_administrators(user_token);

	if (is_admin) {
		/*
		 * Administrators are allowed to select strange names.
		 * This is poor practice but not prevented.
		 */
		return false;
	}

	if (el->values[0].data[el->values[0].length - 1] != '$') {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "must have a trailing $!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}
	if (el->values[0].data[el->values[0].length - 2] == '$') {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "must not have a double trailing $!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	return ret;
}
static int samldb_sam_accountname_valid_check(struct samldb_ctx *ac)
{
	int ret = 0;
	bool is_admin;
	struct security_token *user_token = NULL;
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	struct ldb_message_element *el = NULL;

	ret = dsdb_get_expected_new_values(ac,
					   ac->msg,
					   "samAccountName",
					   &el,
					   ac->req->operation);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (el == NULL || el->num_values == 0) {
		ldb_asprintf_errstring(ldb,
			"%08X: samldb: 'samAccountName' can't be deleted/empty!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		if (ac->req->operation == LDB_ADD) {
			return LDB_ERR_CONSTRAINT_VIOLATION;
		} else {
			return LDB_ERR_UNWILLING_TO_PERFORM;
		}
	}

	ret = samldb_unique_attr_check(ac, "samAccountName", NULL,
				       ldb_get_default_basedn(
					       ldb_module_get_ctx(ac->module)));

	 
	if (ret == LDB_ERR_CONSTRAINT_VIOLATION
	    && ac->req->operation == LDB_MODIFY) {
		ret = LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
	} else if (ret == LDB_ERR_OBJECT_CLASS_VIOLATION) {
		ret = LDB_ERR_CONSTRAINT_VIOLATION;
	}
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	ret = samldb_sam_account_upn_clash(ac);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (!ac->need_trailing_dollar) {
		return LDB_SUCCESS;
	}

	 
	if (el->values[0].length < 2) {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "can't just be one character!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	user_token = acl_user_token(ac->module);
	if (user_token == NULL) {
		return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
	}

	is_admin
		= security_token_has_builtin_administrators(user_token);

	if (is_admin) {
		 
		return false;
	}

	if (el->values[0].data[el->values[0].length - 1] != '$') {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "must have a trailing $!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}
	if (el->values[0].data[el->values[0].length - 2] == '$') {
		ldb_asprintf_errstring(ldb,
				       "%08X: samldb: 'samAccountName' "
				       "must not have a double trailing $!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	return ret;
}