int dsdb_validate_dsa_guid(struct ldb_context *ldb,
			   const struct GUID *dsa_guid,
			   const struct dom_sid *sid)
{
	/* strategy:
	    - find DN of record with the DSA GUID in the
	      configuration partition (objectGUID)
            - remove "NTDS Settings" component from DN
	    - do a base search on that DN for serverReference with
	      extended-dn enabled
            - extract objectSid from resulting serverReference
              attribute
	    - check this sid matches the sid argument
	*/
	struct ldb_dn *config_dn;
	TALLOC_CTX *tmp_ctx = talloc_new(ldb);
	struct ldb_message *msg;
	const char *attrs1[] = { NULL };
	const char *attrs2[] = { "serverReference", NULL };
	int ret;
	struct ldb_dn *dn, *account_dn;
	struct dom_sid sid2;
	NTSTATUS status;

	config_dn = ldb_get_config_basedn(ldb);

	ret = dsdb_search_one(ldb, tmp_ctx, &msg, config_dn, LDB_SCOPE_SUBTREE,
			      attrs1, 0, "(&(objectGUID=%s)(objectClass=nTDSDSA))", GUID_string(tmp_ctx, dsa_guid));
	if (ret != LDB_SUCCESS) {
		DEBUG(1,(__location__ ": Failed to find DSA objectGUID %s for sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}
	dn = msg->dn;

	if (!ldb_dn_remove_child_components(dn, 1)) {
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE,
			      attrs2, DSDB_SEARCH_SHOW_EXTENDED_DN,
			      "(objectClass=server)");
	if (ret != LDB_SUCCESS) {
		DEBUG(1,(__location__ ": Failed to find server record for DSA with objectGUID %s, sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	account_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, msg, "serverReference");
	if (account_dn == NULL) {
		DEBUG(1,(__location__ ": Failed to find account dn "
			 "(serverReference) for %s, parent of DSA with "
			 "objectGUID %s, sid %s\n",
			 ldb_dn_get_linearized(msg->dn),
			 GUID_string(tmp_ctx, dsa_guid),
			 dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	status = dsdb_get_extended_dn_sid(account_dn, &sid2, "SID");
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1,(__location__ ": Failed to find SID for DSA with objectGUID %s, sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	if (!dom_sid_equal(sid, &sid2)) {
		/* someone is trying to spoof another account */
		DEBUG(0,(__location__ ": Bad DSA objectGUID %s for sid %s - expected sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid),
			 dom_sid_string(tmp_ctx, sid),
			 dom_sid_string(tmp_ctx, &sid2)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	talloc_free(tmp_ctx);
	return LDB_SUCCESS;
}
int dsdb_validate_dsa_guid(struct ldb_context *ldb,
			   const struct GUID *dsa_guid,
			   const struct dom_sid *sid)
{
	 
	struct ldb_dn *config_dn;
	TALLOC_CTX *tmp_ctx = talloc_new(ldb);
	struct ldb_message *msg;
	const char *attrs1[] = { NULL };
	const char *attrs2[] = { "serverReference", NULL };
	int ret;
	struct ldb_dn *dn, *account_dn;
	struct dom_sid sid2;
	NTSTATUS status;

	config_dn = ldb_get_config_basedn(ldb);

	ret = dsdb_search_one(ldb, tmp_ctx, &msg, config_dn, LDB_SCOPE_SUBTREE,
			      attrs1, 0, "(&(objectGUID=%s)(objectClass=nTDSDSA))", GUID_string(tmp_ctx, dsa_guid));
	if (ret != LDB_SUCCESS) {
		DEBUG(1,(__location__ ": Failed to find DSA objectGUID %s for sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}
	dn = msg->dn;

	if (!ldb_dn_remove_child_components(dn, 1)) {
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE,
			      attrs2, DSDB_SEARCH_SHOW_EXTENDED_DN,
			      "(objectClass=server)");
	if (ret != LDB_SUCCESS) {
		DEBUG(1,(__location__ ": Failed to find server record for DSA with objectGUID %s, sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	account_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, msg, "serverReference");
	if (account_dn == NULL) {
		DEBUG(1,(__location__ ": Failed to find account dn "
			 "(serverReference) for %s, parent of DSA with "
			 "objectGUID %s, sid %s\n",
			 ldb_dn_get_linearized(msg->dn),
			 GUID_string(tmp_ctx, dsa_guid),
			 dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	status = dsdb_get_extended_dn_sid(account_dn, &sid2, "SID");
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1,(__location__ ": Failed to find SID for DSA with objectGUID %s, sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	if (!dom_sid_equal(sid, &sid2)) {
		 
		DEBUG(0,(__location__ ": Bad DSA objectGUID %s for sid %s - expected sid %s\n",
			 GUID_string(tmp_ctx, dsa_guid),
			 dom_sid_string(tmp_ctx, sid),
			 dom_sid_string(tmp_ctx, &sid2)));
		talloc_free(tmp_ctx);
		return ldb_operr(ldb);
	}

	talloc_free(tmp_ctx);
	return LDB_SUCCESS;
}