static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
					       TALLOC_CTX *mem_ctx,
					       const struct dom_sid *groupsid,
					       const struct dom_sid *membersid,
					       int mod_op)
{
	struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
		m->private_data, struct pdb_samba_dsdb_state);
	struct ldb_message *msg;
	int ret;
	struct ldb_message_element *el;
	struct dom_sid_buf buf;
	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
	msg = ldb_msg_new(tmp_ctx);
	if (msg == NULL) {
		TALLOC_FREE(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}

	msg->dn = ldb_dn_new_fmt(
		msg,
		state->ldb,
		"<SID=%s>",
		dom_sid_str_buf(groupsid, &buf));
	if (!msg->dn || !ldb_dn_validate(msg->dn)) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}
	ret = ldb_msg_add_fmt(
		msg,
		"member",
		"<SID=%s>",
		dom_sid_str_buf(membersid, &buf));
	if (ret != LDB_SUCCESS) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}
	el = ldb_msg_find_element(msg, "member");
	el->flags = mod_op;

	/* No need for transactions here, the ldb auto-transaction
	 * code will handle things for the single operation */
	ret = ldb_modify(state->ldb, msg);
	talloc_free(tmp_ctx);
	if (ret != LDB_SUCCESS) {
		DEBUG(10, ("ldb_modify failed: %s\n",
			   ldb_errstring(state->ldb)));
		if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
			return NT_STATUS_MEMBER_IN_GROUP;
		}
		if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
			return NT_STATUS_MEMBER_NOT_IN_GROUP;
		}
		return NT_STATUS_LDAP(ret);
	}

	return NT_STATUS_OK;
}
static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
					       TALLOC_CTX *mem_ctx,
					       const struct dom_sid *groupsid,
					       const struct dom_sid *membersid,
					       int mod_op)
{
	struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
		m->private_data, struct pdb_samba_dsdb_state);
	struct ldb_message *msg;
	int ret;
	struct ldb_message_element *el;
	struct dom_sid_buf buf;
	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
	msg = ldb_msg_new(tmp_ctx);
	if (msg == NULL) {
		TALLOC_FREE(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}

	msg->dn = ldb_dn_new_fmt(
		msg,
		state->ldb,
		"<SID=%s>",
		dom_sid_str_buf(groupsid, &buf));
	if (!msg->dn || !ldb_dn_validate(msg->dn)) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}
	ret = ldb_msg_add_fmt(
		msg,
		"member",
		"<SID=%s>",
		dom_sid_str_buf(membersid, &buf));
	if (ret != LDB_SUCCESS) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NO_MEMORY;
	}
	el = ldb_msg_find_element(msg, "member");
	el->flags = mod_op;

	 
	ret = ldb_modify(state->ldb, msg);
	talloc_free(tmp_ctx);
	if (ret != LDB_SUCCESS) {
		DEBUG(10, ("ldb_modify failed: %s\n",
			   ldb_errstring(state->ldb)));
		if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
			return NT_STATUS_MEMBER_IN_GROUP;
		}
		if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
			return NT_STATUS_MEMBER_NOT_IN_GROUP;
		}
		return NT_STATUS_LDAP(ret);
	}

	return NT_STATUS_OK;
}